commit 1aa3aaf8953c84bad398adf6c3cabc9d6685bf7d upstream
A transaction complete work is allocated and queued for each
transaction. Under certain conditions the work->type might be marked as
BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT to notify userspace about
potential spamming threads or as BINDER_WORK_TRANSACTION_PENDING when
the target is currently frozen.
However, these work types are not being handled in binder_release_work()
so they will leak during a cleanup. This was reported by syzkaller with
the following kmemleak dump:
BUG: memory leak
unreferenced object 0xffff88810e2d6de0 (size 32):
comm "syz-executor338", pid 5046, jiffies 4294968230 (age 13.590s)
hex dump (first 32 bytes):
e0 6d 2d 0e 81 88 ff ff e0 6d 2d 0e 81 88 ff ff .m-......m-.....
04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff83d41873>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff83d41873>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83d41873>] binder_transaction+0x573/0x4050 drivers/android/binder.c:3152
[<ffffffff83d45a05>] binder_thread_write+0x6b5/0x1860 drivers/android/binder.c:4010
[<ffffffff83d486dc>] binder_ioctl_write_read drivers/android/binder.c:5066 [inline]
[<ffffffff83d486dc>] binder_ioctl+0x1b2c/0x3cf0 drivers/android/binder.c:5352
[<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
[<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
[<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
[<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fix the leaks by kfreeing these work types in binder_release_work() and
handle them as a BINDER_WORK_TRANSACTION_COMPLETE cleanup.
Cc: stable(a)vger.kernel.org
Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming")
Reported-by: syzbot+7f10c1653e35933c0f1e(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7f10c1653e35933c0f1e
Suggested-by: Alice Ryhl <aliceryhl(a)google.com>
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
Reviewed-by: Alice Ryhl <aliceryhl(a)google.com>
Acked-by: Todd Kjos <tkjos(a)google.com>
Link: https://lore.kernel.org/r/20230922175138.230331-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[cmllamas: backport to v5.15 by dropping BINDER_WORK_TRANSACTION_PENDING
as commit 0567461a7a6e is not present. Remove fixes tag accordingly.]
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
---
drivers/android/binder.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cbbed43baf05..b63322e7e101 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -4620,6 +4620,7 @@ static void binder_release_work(struct binder_proc *proc,
"undelivered TRANSACTION_ERROR: %u\n",
e->cmd);
} break;
+ case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT:
case BINDER_WORK_TRANSACTION_COMPLETE: {
binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
"undelivered TRANSACTION_COMPLETE\n");
base-commit: 9b91d36ba301db86bbf9e783169f7f6abf2585d8
--
2.43.0.472.g3155946c3a-goog
With VRR, every atomic commit affecting a given display must trigger
a new scanout cycle, so that userspace is able to control the refresh
rate of the display. Before this commit, this was not the case for
atomic commits that only contain cursor plane properties.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3034
Cc: stable(a)vger.kernel.org
Signed-off-by: Xaver Hugl <xaver.hugl(a)gmail.com>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b452796fc6d3..b379c859fbef 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8149,9 +8149,15 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,
/* Cursor plane is handled after stream updates */
if (plane->type == DRM_PLANE_TYPE_CURSOR) {
if ((fb && crtc == pcrtc) ||
- (old_plane_state->fb && old_plane_state->crtc == pcrtc))
+ (old_plane_state->fb && old_plane_state->crtc == pcrtc)) {
cursor_update = true;
-
+ /*
+ * With atomic modesetting, cursor changes must
+ * also trigger a new refresh period with vrr
+ */
+ if (!state->legacy_cursor_update)
+ pflip_present = true;
+ }
continue;
}
--
2.43.0
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Since the plane_state variable is declared outside the scaler_users
loop in intel_atomic_setup_scalers(), and it's never reset back to
NULL inside the loop we may end up calling intel_atomic_setup_scaler()
with a non-NULL plane state for the pipe scaling case. That is bad
because intel_atomic_setup_scaler() determines whether we are doing
plane scaling or pipe scaling based on plane_state!=NULL. The end
result is that we may miscalculate the scaler mode for pipe scaling.
The hardware becomes somewhat upset if we end up in this situation
when scanning out a planar format on a SDR plane. We end up
programming the pipe scaler into planar mode as well, and the
result is a screenfull of garbage.
Fix the situation by making sure we pass the correct plane_state==NULL
when calculating the scaler mode for pipe scaling.
Cc: stable(a)vger.kernel.org
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/display/skl_scaler.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/skl_scaler.c b/drivers/gpu/drm/i915/display/skl_scaler.c
index 1e7c97243fcf..8a934bada624 100644
--- a/drivers/gpu/drm/i915/display/skl_scaler.c
+++ b/drivers/gpu/drm/i915/display/skl_scaler.c
@@ -504,7 +504,6 @@ int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv,
{
struct drm_plane *plane = NULL;
struct intel_plane *intel_plane;
- struct intel_plane_state *plane_state = NULL;
struct intel_crtc_scaler_state *scaler_state =
&crtc_state->scaler_state;
struct drm_atomic_state *drm_state = crtc_state->uapi.state;
@@ -536,6 +535,7 @@ int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv,
/* walkthrough scaler_users bits and start assigning scalers */
for (i = 0; i < sizeof(scaler_state->scaler_users) * 8; i++) {
+ struct intel_plane_state *plane_state = NULL;
int *scaler_id;
const char *name;
int idx, ret;
--
2.41.0
Mark reports that brightness is not restored after Xorg dpms screen blank.
This behavior was introduced by commit d9e865826c20 ("drm/amd/display:
Simplify brightness initialization") which dropped the cached backlight
value in display code, but also removed code for when the default value
read back was less than 1 nit.
Restore this code so that the backlight brightness is restored to the
correct default value in this circumstance.
Reported-by: Mark Herbert <mark.herbert42(a)gmail.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3031
Cc: stable(a)vger.kernel.org
Cc: Camille Cho <camille.cho(a)amd.com>
Cc: Krunoslav Kovac <krunoslav.kovac(a)amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com>
Fixes: d9e865826c20 ("drm/amd/display: Simplify brightness initialization")
Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com>
---
.../amd/display/dc/link/protocols/link_edp_panel_control.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
index ac0fa88b52a0..bf53a86ea817 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
@@ -287,8 +287,8 @@ bool set_default_brightness_aux(struct dc_link *link)
if (link && link->dpcd_sink_ext_caps.bits.oled == 1) {
if (!read_default_bl_aux(link, &default_backlight))
default_backlight = 150000;
- // if > 5000, it might be wrong readback
- if (default_backlight > 5000000)
+ // if < 1 nits or > 5000, it might be wrong readback
+ if (default_backlight < 1000 || default_backlight > 5000000)
default_backlight = 150000;
return edp_set_backlight_level_nits(link, true,
--
2.34.1
When destroying a vgic, we have rather cumbersome rules about
when slots_lock and config_lock are held, resulting in fun
buglets.
The first port of call is to simplify kvm_vgic_map_resources()
so that there is only one call to kvm_vgic_destroy() instead of
two, with the second only holding half of the locks.
For that, we kill the non-locking primitive and move the call
outside of the locking altogether. This doesn't change anything
(we re-acquire the locks and teardown the whole vgic), and
simplifies the code significantly.
Cc: stable(a)vger.kernel.org
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
---
arch/arm64/kvm/vgic/vgic-init.c | 29 ++++++++++++++---------------
1 file changed, 14 insertions(+), 15 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index c8c3cb812783..ad7e86879eb9 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -382,26 +382,24 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
}
-static void __kvm_vgic_destroy(struct kvm *kvm)
+void kvm_vgic_destroy(struct kvm *kvm)
{
struct kvm_vcpu *vcpu;
unsigned long i;
- lockdep_assert_held(&kvm->arch.config_lock);
+ mutex_lock(&kvm->slots_lock);
vgic_debug_destroy(kvm);
kvm_for_each_vcpu(i, vcpu, kvm)
kvm_vgic_vcpu_destroy(vcpu);
+ mutex_lock(&kvm->arch.config_lock);
+
kvm_vgic_dist_destroy(kvm);
-}
-void kvm_vgic_destroy(struct kvm *kvm)
-{
- mutex_lock(&kvm->arch.config_lock);
- __kvm_vgic_destroy(kvm);
mutex_unlock(&kvm->arch.config_lock);
+ mutex_unlock(&kvm->slots_lock);
}
/**
@@ -469,25 +467,26 @@ int kvm_vgic_map_resources(struct kvm *kvm)
type = VGIC_V3;
}
- if (ret) {
- __kvm_vgic_destroy(kvm);
+ if (ret)
goto out;
- }
+
dist->ready = true;
dist_base = dist->vgic_dist_base;
mutex_unlock(&kvm->arch.config_lock);
ret = vgic_register_dist_iodev(kvm, dist_base, type);
- if (ret) {
+ if (ret)
kvm_err("Unable to register VGIC dist MMIO regions\n");
- kvm_vgic_destroy(kvm);
- }
- mutex_unlock(&kvm->slots_lock);
- return ret;
+ goto out_slots;
out:
mutex_unlock(&kvm->arch.config_lock);
+out_slots:
mutex_unlock(&kvm->slots_lock);
+
+ if (ret)
+ kvm_vgic_destroy(kvm);
+
return ret;
}
--
2.39.2
The rtc on the mox shares its interrupt line with the moxtet bus. Set
the interrupt type to be consistent between both devices. This ensures
correct setup of the interrupt line regardless of probing order.
Signed-off-by: Sjoerd Simons <sjoerd(a)collabora.com>
Cc: stable(a)vger.kernel.org # v6.2+
Fixes: 21aad8ba615e ("arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC")
---
(no changes since v1)
arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
index 9eab2bb22134..805ef2d79b40 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
@@ -130,7 +130,7 @@ rtc@6f {
compatible = "microchip,mcp7940x";
reg = <0x6f>;
interrupt-parent = <&gpiosb>;
- interrupts = <5 0>; /* GPIO2_5 */
+ interrupts = <5 IRQ_TYPE_EDGE_FALLING>; /* GPIO2_5 */
};
};
--
2.43.0
The Turris Mox shares the moxtet IRQ with various devices on the board,
so mark the IRQ as shared in the driver as well.
Without this loading the module will fail with:
genirq: Flags mismatch irq 40. 00002002 (moxtet) vs. 00002080 (mcp7940x)
Signed-off-by: Sjoerd Simons <sjoerd(a)collabora.com>
Cc: stable(a)vger.kernel.org # v6.2+
---
(no changes since v1)
drivers/bus/moxtet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bus/moxtet.c b/drivers/bus/moxtet.c
index 5eb0fe73ddc4..48c18f95660a 100644
--- a/drivers/bus/moxtet.c
+++ b/drivers/bus/moxtet.c
@@ -755,7 +755,7 @@ static int moxtet_irq_setup(struct moxtet *moxtet)
moxtet->irq.masked = ~0;
ret = request_threaded_irq(moxtet->dev_irq, NULL, moxtet_irq_thread_fn,
- IRQF_ONESHOT, "moxtet", moxtet);
+ IRQF_SHARED | IRQF_ONESHOT, "moxtet", moxtet);
if (ret < 0)
goto err_free;
--
2.43.0
When RPMB was converted to a character device, it added support for
multiple RPMB partitions (Commit 97548575bef3 ("mmc: block: Convert RPMB
to a character device").
One of the changes in this commit was transforming the variable
target_part defined in __mmc_blk_ioctl_cmd into a bitmask.
This inadvertedly regressed the validation check done in
mmc_blk_part_switch_pre() and mmc_blk_part_switch_post().
This commit fixes that regression.
Fixes: 97548575bef3 ("mmc: block: Convert RPMB to a character device")
Signed-off-by: Jorge Ramirez-Ortiz <jorge(a)foundries.io>
Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org>
Cc: <stable(a)vger.kernel.org> # v4.14+
---
v2:
fixes parenthesis around condition
v3:
adds stable to commit header
v4:
fixes the stable version to v4.14
adds Reviewed-by
drivers/mmc/core/block.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 152dfe593c43..13093d26bf81 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -851,9 +851,10 @@ static const struct block_device_operations mmc_bdops = {
static int mmc_blk_part_switch_pre(struct mmc_card *card,
unsigned int part_type)
{
+ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
int ret = 0;
- if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
+ if ((part_type & mask) == mask) {
if (card->ext_csd.cmdq_en) {
ret = mmc_cmdq_disable(card);
if (ret)
@@ -868,9 +869,10 @@ static int mmc_blk_part_switch_pre(struct mmc_card *card,
static int mmc_blk_part_switch_post(struct mmc_card *card,
unsigned int part_type)
{
+ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
int ret = 0;
- if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
+ if ((part_type & mask) == mask) {
mmc_retune_unpause(card->host);
if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
ret = mmc_cmdq_enable(card);
@@ -3143,4 +3145,3 @@ module_exit(mmc_blk_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Multimedia Card (MMC) block device driver");
-
--
2.34.1
Hi,
On 2023-12-01 08:31:48 +0000, Zhang, Rui wrote:
> As a quick fix, I'm not going to fix the "potential issue" describes
> above because we have not seen a real problem caused by this yet.
>
> Can you please try the below patch to confirm if the problem is gone on
> your system?
> This patch falls back to the previous way as sent at
> https://lore.kernel.org/lkml/87pm4bp54z.ffs@tglx/T/
I've just spent a couple hours bisecting why upgrading to 6.7-rc4 left me with
just a single CPU core on my dual socket workstation.
before:
[ 0.000000] Linux version 6.6.0-andres-00003-g31255e072b2e ...
...
[ 0.022960] ACPI: Using ACPI (MADT) for SMP configuration information
...
[ 0.022968] smpboot: Allowing 40 CPUs, 0 hotplug CPUs
...
[ 0.345921] smpboot: CPU0: Intel(R) Xeon(R) Gold 5215 CPU @ 2.50GHz (family: 0x6, model: 0x55, stepping: 0x7)
...
[ 0.347229] .... node #0, CPUs: #1 #2 #3 #4 #5 #6 #7 #8 #9
[ 0.349082] .... node #1, CPUs: #10 #11 #12 #13 #14 #15 #16 #17 #18 #19
[ 0.003190] smpboot: CPU 10 Converting physical 0 to logical die 1
[ 0.361053] .... node #0, CPUs: #20 #21 #22 #23 #24 #25 #26 #27 #28 #29
[ 0.363990] .... node #1, CPUs: #30 #31 #32 #33 #34 #35 #36 #37 #38 #39
...
[ 0.370886] smp: Brought up 2 nodes, 40 CPUs
[ 0.370891] smpboot: Max logical packages: 2
[ 0.370896] smpboot: Total of 40 processors activated (200000.00 BogoMIPS)
[ 0.403905] node 0 deferred pages initialised in 32ms
[ 0.408865] node 1 deferred pages initialised in 37ms
after:
[ 0.000000] Linux version 6.6.0-andres-00004-gec9aedb2aa1a ...
...
[ 0.022935] ACPI: Using ACPI (MADT) for SMP configuration information
...
[ 0.022942] smpboot: Allowing 1 CPUs, 0 hotplug CPUs
...
[ 0.356424] smpboot: CPU0: Intel(R) Xeon(R) Gold 5215 CPU @ 2.50GHz (family: 0x6, model: 0x55, stepping: 0x7)
...
[ 0.357098] smp: Bringing up secondary CPUs ...
[ 0.357107] smp: Brought up 2 nodes, 1 CPU
[ 0.357108] smpboot: Max logical packages: 1
[ 0.357110] smpboot: Total of 1 processors activated (5000.00 BogoMIPS)
[ 0.726283] node 0 deferred pages initialised in 368ms
[ 0.774704] node 1 deferred pages initialised in 418ms
There does seem to be something off with the ACPI data, when booting without
the patch, I do see messages like:
[ 0.715228] APIC: NR_CPUS/possible_cpus limit of 40 reached. Processor 40/0x7f00 ignored.
[ 0.715231] ACPI: Unable to map lapic to logical cpu number
But other than that, the system has worked for a couple years.
It's obviously not good to regress from 2x10/20 cores/threads to a single
core. I guess it's at least somewhat funny to imagine a 2 socket system with
a single core...
It seems particularly worrying that this patch has apparently been selected
for -stable:
https://lore.kernel.org/all/20231122153212.852040-2-sashal@kernel.org/
Even if it didn't have these unintended consequences, it seems like a commit
like this hardly is -stable material?
I've attached .config, dmesg of a boot with gec9aedb2aa1a and one with
gec9aedb2aa1a^.
Greetings,
Andres Freund
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
Since 64 bit cmpxchg() is very expensive on 32bit architectures, the
timestamp used by the ring buffer does some interesting tricks to be able
to still have an atomic 64 bit number. It originally just used 60 bits and
broke it up into two 32 bit words where the extra 2 bits were used for
synchronization. But this was not enough for all use cases, and all 64
bits were required.
The 32bit version of the ring buffer timestamp was then broken up into 3
32bit words using the same counter trick. But one update was not done. The
check to see if the read operation was done without interruption only
checked the first two words and not last one (like it had before this
update). Fix it by making sure all three updates happen without
interruption by comparing the initial counter with the last updated
counter.
Link: https://lore.kernel.org/linux-trace-kernel/20231206100050.3100b7bb@gandalf.…
Cc: stable(a)vger.kernel.org
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Fixes: f03f2abce4f39 ("ring-buffer: Have 32 bit time stamps use all 64 bits")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/ring_buffer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index a6da2d765c78..8d2a4f00eca9 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -644,8 +644,8 @@ static inline bool __rb_time_read(rb_time_t *t, u64 *ret, unsigned long *cnt)
*cnt = rb_time_cnt(top);
- /* If top and bottom counts don't match, this interrupted a write */
- if (*cnt != rb_time_cnt(bottom))
+ /* If top and msb counts don't match, this interrupted a write */
+ if (*cnt != rb_time_cnt(msb))
return false;
/* The shift to msb will lose its cnt bits */
--
2.42.0
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
There's a race where if an event is discarded from the ring buffer and an
interrupt were to happen at that time and insert an event, the time stamp
is still used from the discarded event as an offset. This can screw up the
timings.
If the event is going to be discarded, set the "before_stamp" to zero.
When a new event comes in, it compares the "before_stamp" with the
"write_stamp" and if they are not equal, it will insert an absolute
timestamp. This will prevent the timings from getting out of sync due to
the discarded event.
Link: https://lore.kernel.org/linux-trace-kernel/20231206100244.5130f9b3@gandalf.…
Cc: stable(a)vger.kernel.org
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Fixes: 6f6be606e763f ("ring-buffer: Force before_stamp and write_stamp to be different on discard")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/ring_buffer.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 43cc47d7faaf..a6da2d765c78 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3030,22 +3030,19 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
local_read(&bpage->write) & ~RB_WRITE_MASK;
unsigned long event_length = rb_event_length(event);
+ /*
+ * For the before_stamp to be different than the write_stamp
+ * to make sure that the next event adds an absolute
+ * value and does not rely on the saved write stamp, which
+ * is now going to be bogus.
+ */
+ rb_time_set(&cpu_buffer->before_stamp, 0);
+
/* Something came in, can't discard */
if (!rb_time_cmpxchg(&cpu_buffer->write_stamp,
write_stamp, write_stamp - delta))
return false;
- /*
- * It's possible that the event time delta is zero
- * (has the same time stamp as the previous event)
- * in which case write_stamp and before_stamp could
- * be the same. In such a case, force before_stamp
- * to be different than write_stamp. It doesn't
- * matter what it is, as long as its different.
- */
- if (!delta)
- rb_time_set(&cpu_buffer->before_stamp, 0);
-
/*
* If an event were to come in now, it would see that the
* write_stamp and the before_stamp are different, and assume
--
2.42.0
From: Petr Pavlu <petr.pavlu(a)suse.com>
Function trace_buffered_event_disable() is responsible for freeing pages
backing buffered events and this process can run concurrently with
trace_event_buffer_lock_reserve().
The following race is currently possible:
* Function trace_buffered_event_disable() is called on CPU 0. It
increments trace_buffered_event_cnt on each CPU and waits via
synchronize_rcu() for each user of trace_buffered_event to complete.
* After synchronize_rcu() is finished, function
trace_buffered_event_disable() has the exclusive access to
trace_buffered_event. All counters trace_buffered_event_cnt are at 1
and all pointers trace_buffered_event are still valid.
* At this point, on a different CPU 1, the execution reaches
trace_event_buffer_lock_reserve(). The function calls
preempt_disable_notrace() and only now enters an RCU read-side
critical section. The function proceeds and reads a still valid
pointer from trace_buffered_event[CPU1] into the local variable
"entry". However, it doesn't yet read trace_buffered_event_cnt[CPU1]
which happens later.
* Function trace_buffered_event_disable() continues. It frees
trace_buffered_event[CPU1] and decrements
trace_buffered_event_cnt[CPU1] back to 0.
* Function trace_event_buffer_lock_reserve() continues. It reads and
increments trace_buffered_event_cnt[CPU1] from 0 to 1. This makes it
believe that it can use the "entry" that it already obtained but the
pointer is now invalid and any access results in a use-after-free.
Fix the problem by making a second synchronize_rcu() call after all
trace_buffered_event values are set to NULL. This waits on all potential
users in trace_event_buffer_lock_reserve() that still read a previous
pointer from trace_buffered_event.
Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/
Link: https://lkml.kernel.org/r/20231205161736.19663-4-petr.pavlu@suse.com
Cc: stable(a)vger.kernel.org
Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events")
Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index ef72354f61ce..fbcd3bafb93e 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2791,13 +2791,17 @@ void trace_buffered_event_disable(void)
free_page((unsigned long)per_cpu(trace_buffered_event, cpu));
per_cpu(trace_buffered_event, cpu) = NULL;
}
+
/*
- * Make sure trace_buffered_event is NULL before clearing
- * trace_buffered_event_cnt.
+ * Wait for all CPUs that potentially started checking if they can use
+ * their event buffer only after the previous synchronize_rcu() call and
+ * they still read a valid pointer from trace_buffered_event. It must be
+ * ensured they don't see cleared trace_buffered_event_cnt else they
+ * could wrongly decide to use the pointed-to buffer which is now freed.
*/
- smp_wmb();
+ synchronize_rcu();
- /* Do the work on each cpu */
+ /* For each CPU, relinquish the buffer */
on_each_cpu_mask(tracing_buffer_mask, enable_trace_buffered_event, NULL,
true);
}
--
2.42.0
From: Petr Pavlu <petr.pavlu(a)suse.com>
The following warning appears when using buffered events:
[ 203.556451] WARNING: CPU: 53 PID: 10220 at kernel/trace/ring_buffer.c:3912 ring_buffer_discard_commit+0x2eb/0x420
[...]
[ 203.670690] CPU: 53 PID: 10220 Comm: stress-ng-sysin Tainted: G E 6.7.0-rc2-default #4 56e6d0fcf5581e6e51eaaecbdaec2a2338c80f3a
[ 203.670704] Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017
[ 203.670709] RIP: 0010:ring_buffer_discard_commit+0x2eb/0x420
[ 203.735721] Code: 4c 8b 4a 50 48 8b 42 48 49 39 c1 0f 84 b3 00 00 00 49 83 e8 01 75 b1 48 8b 42 10 f0 ff 40 08 0f 0b e9 fc fe ff ff f0 ff 47 08 <0f> 0b e9 77 fd ff ff 48 8b 42 10 f0 ff 40 08 0f 0b e9 f5 fe ff ff
[ 203.735734] RSP: 0018:ffffb4ae4f7b7d80 EFLAGS: 00010202
[ 203.735745] RAX: 0000000000000000 RBX: ffffb4ae4f7b7de0 RCX: ffff8ac10662c000
[ 203.735754] RDX: ffff8ac0c750be00 RSI: ffff8ac10662c000 RDI: ffff8ac0c004d400
[ 203.781832] RBP: ffff8ac0c039cea0 R08: 0000000000000000 R09: 0000000000000000
[ 203.781839] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 203.781842] R13: ffff8ac10662c000 R14: ffff8ac0c004d400 R15: ffff8ac10662c008
[ 203.781846] FS: 00007f4cd8a67740(0000) GS:ffff8ad798880000(0000) knlGS:0000000000000000
[ 203.781851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 203.781855] CR2: 0000559766a74028 CR3: 00000001804c4000 CR4: 00000000001506f0
[ 203.781862] Call Trace:
[ 203.781870] <TASK>
[ 203.851949] trace_event_buffer_commit+0x1ea/0x250
[ 203.851967] trace_event_raw_event_sys_enter+0x83/0xe0
[ 203.851983] syscall_trace_enter.isra.0+0x182/0x1a0
[ 203.851990] do_syscall_64+0x3a/0xe0
[ 203.852075] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 203.852090] RIP: 0033:0x7f4cd870fa77
[ 203.982920] Code: 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 b8 89 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e9 43 0e 00 f7 d8 64 89 01 48
[ 203.982932] RSP: 002b:00007fff99717dd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000089
[ 203.982942] RAX: ffffffffffffffda RBX: 0000558ea1d7b6f0 RCX: 00007f4cd870fa77
[ 203.982948] RDX: 0000000000000000 RSI: 00007fff99717de0 RDI: 0000558ea1d7b6f0
[ 203.982957] RBP: 00007fff99717de0 R08: 00007fff997180e0 R09: 00007fff997180e0
[ 203.982962] R10: 00007fff997180e0 R11: 0000000000000246 R12: 00007fff99717f40
[ 204.049239] R13: 00007fff99718590 R14: 0000558e9f2127a8 R15: 00007fff997180b0
[ 204.049256] </TASK>
For instance, it can be triggered by running these two commands in
parallel:
$ while true; do
echo hist:key=id.syscall:val=hitcount > \
/sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger;
done
$ stress-ng --sysinfo $(nproc)
The warning indicates that the current ring_buffer_per_cpu is not in the
committing state. It happens because the active ring_buffer_event
doesn't actually come from the ring_buffer_per_cpu but is allocated from
trace_buffered_event.
The bug is in function trace_buffered_event_disable() where the
following normally happens:
* The code invokes disable_trace_buffered_event() via
smp_call_function_many() and follows it by synchronize_rcu(). This
increments the per-CPU variable trace_buffered_event_cnt on each
target CPU and grants trace_buffered_event_disable() the exclusive
access to the per-CPU variable trace_buffered_event.
* Maintenance is performed on trace_buffered_event, all per-CPU event
buffers get freed.
* The code invokes enable_trace_buffered_event() via
smp_call_function_many(). This decrements trace_buffered_event_cnt and
releases the access to trace_buffered_event.
A problem is that smp_call_function_many() runs a given function on all
target CPUs except on the current one. The following can then occur:
* Task X executing trace_buffered_event_disable() runs on CPU 0.
* The control reaches synchronize_rcu() and the task gets rescheduled on
another CPU 1.
* The RCU synchronization finishes. At this point,
trace_buffered_event_disable() has the exclusive access to all
trace_buffered_event variables except trace_buffered_event[CPU0]
because trace_buffered_event_cnt[CPU0] is never incremented and if the
buffer is currently unused, remains set to 0.
* A different task Y is scheduled on CPU 0 and hits a trace event. The
code in trace_event_buffer_lock_reserve() sees that
trace_buffered_event_cnt[CPU0] is set to 0 and decides the use the
buffer provided by trace_buffered_event[CPU0].
* Task X continues its execution in trace_buffered_event_disable(). The
code incorrectly frees the event buffer pointed by
trace_buffered_event[CPU0] and resets the variable to NULL.
* Task Y writes event data to the now freed buffer and later detects the
created inconsistency.
The issue is observable since commit dea499781a11 ("tracing: Fix warning
in trace_buffered_event_disable()") which moved the call of
trace_buffered_event_disable() in __ftrace_event_enable_disable()
earlier, prior to invoking call->class->reg(.. TRACE_REG_UNREGISTER ..).
The underlying problem in trace_buffered_event_disable() is however
present since the original implementation in commit 0fc1b09ff1ff
("tracing: Use temp buffer when filtering events").
Fix the problem by replacing the two smp_call_function_many() calls with
on_each_cpu_mask() which invokes a given callback on all CPUs.
Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/
Link: https://lkml.kernel.org/r/20231205161736.19663-2-petr.pavlu@suse.com
Cc: stable(a)vger.kernel.org
Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events")
Fixes: dea499781a11 ("tracing: Fix warning in trace_buffered_event_disable()")
Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2492c6c76850..6aeffa4a6994 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2781,11 +2781,9 @@ void trace_buffered_event_disable(void)
if (--trace_buffered_event_ref)
return;
- preempt_disable();
/* For each CPU, set the buffer as used. */
- smp_call_function_many(tracing_buffer_mask,
- disable_trace_buffered_event, NULL, 1);
- preempt_enable();
+ on_each_cpu_mask(tracing_buffer_mask, disable_trace_buffered_event,
+ NULL, true);
/* Wait for all current users to finish */
synchronize_rcu();
@@ -2800,11 +2798,9 @@ void trace_buffered_event_disable(void)
*/
smp_wmb();
- preempt_disable();
/* Do the work on each cpu */
- smp_call_function_many(tracing_buffer_mask,
- enable_trace_buffered_event, NULL, 1);
- preempt_enable();
+ on_each_cpu_mask(tracing_buffer_mask, enable_trace_buffered_event, NULL,
+ true);
}
static struct trace_buffer *temp_buffer;
--
2.42.0
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
It use to be that only the top level instance had a snapshot buffer (for
latency tracers like wakeup and irqsoff). When stopping a tracer in an
instance would not disable the snapshot buffer. This could have some
unintended consequences if the irqsoff tracer is enabled.
Consolidate the tracing_start/stop() with tracing_start/stop_tr() so that
all instances behave the same. The tracing_start/stop() functions will
just call their respective tracing_start/stop_tr() with the global_array
passed in.
Link: https://lkml.kernel.org/r/20231205220011.041220035@goodmis.org
Cc: stable(a)vger.kernel.org
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 110 +++++++++++++------------------------------
1 file changed, 34 insertions(+), 76 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e978868b1a22..2492c6c76850 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2360,13 +2360,7 @@ int is_tracing_stopped(void)
return global_trace.stop_count;
}
-/**
- * tracing_start - quick start of the tracer
- *
- * If tracing is enabled but was stopped by tracing_stop,
- * this will start the tracer back up.
- */
-void tracing_start(void)
+static void tracing_start_tr(struct trace_array *tr)
{
struct trace_buffer *buffer;
unsigned long flags;
@@ -2374,119 +2368,83 @@ void tracing_start(void)
if (tracing_disabled)
return;
- raw_spin_lock_irqsave(&global_trace.start_lock, flags);
- if (--global_trace.stop_count) {
- if (global_trace.stop_count < 0) {
+ raw_spin_lock_irqsave(&tr->start_lock, flags);
+ if (--tr->stop_count) {
+ if (WARN_ON_ONCE(tr->stop_count < 0)) {
/* Someone screwed up their debugging */
- WARN_ON_ONCE(1);
- global_trace.stop_count = 0;
+ tr->stop_count = 0;
}
goto out;
}
/* Prevent the buffers from switching */
- arch_spin_lock(&global_trace.max_lock);
+ arch_spin_lock(&tr->max_lock);
- buffer = global_trace.array_buffer.buffer;
+ buffer = tr->array_buffer.buffer;
if (buffer)
ring_buffer_record_enable(buffer);
#ifdef CONFIG_TRACER_MAX_TRACE
- buffer = global_trace.max_buffer.buffer;
+ buffer = tr->max_buffer.buffer;
if (buffer)
ring_buffer_record_enable(buffer);
#endif
- arch_spin_unlock(&global_trace.max_lock);
-
- out:
- raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
-}
-
-static void tracing_start_tr(struct trace_array *tr)
-{
- struct trace_buffer *buffer;
- unsigned long flags;
-
- if (tracing_disabled)
- return;
-
- /* If global, we need to also start the max tracer */
- if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
- return tracing_start();
-
- raw_spin_lock_irqsave(&tr->start_lock, flags);
-
- if (--tr->stop_count) {
- if (tr->stop_count < 0) {
- /* Someone screwed up their debugging */
- WARN_ON_ONCE(1);
- tr->stop_count = 0;
- }
- goto out;
- }
-
- buffer = tr->array_buffer.buffer;
- if (buffer)
- ring_buffer_record_enable(buffer);
+ arch_spin_unlock(&tr->max_lock);
out:
raw_spin_unlock_irqrestore(&tr->start_lock, flags);
}
/**
- * tracing_stop - quick stop of the tracer
+ * tracing_start - quick start of the tracer
*
- * Light weight way to stop tracing. Use in conjunction with
- * tracing_start.
+ * If tracing is enabled but was stopped by tracing_stop,
+ * this will start the tracer back up.
*/
-void tracing_stop(void)
+void tracing_start(void)
+
+{
+ return tracing_start_tr(&global_trace);
+}
+
+static void tracing_stop_tr(struct trace_array *tr)
{
struct trace_buffer *buffer;
unsigned long flags;
- raw_spin_lock_irqsave(&global_trace.start_lock, flags);
- if (global_trace.stop_count++)
+ raw_spin_lock_irqsave(&tr->start_lock, flags);
+ if (tr->stop_count++)
goto out;
/* Prevent the buffers from switching */
- arch_spin_lock(&global_trace.max_lock);
+ arch_spin_lock(&tr->max_lock);
- buffer = global_trace.array_buffer.buffer;
+ buffer = tr->array_buffer.buffer;
if (buffer)
ring_buffer_record_disable(buffer);
#ifdef CONFIG_TRACER_MAX_TRACE
- buffer = global_trace.max_buffer.buffer;
+ buffer = tr->max_buffer.buffer;
if (buffer)
ring_buffer_record_disable(buffer);
#endif
- arch_spin_unlock(&global_trace.max_lock);
+ arch_spin_unlock(&tr->max_lock);
out:
- raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
+ raw_spin_unlock_irqrestore(&tr->start_lock, flags);
}
-static void tracing_stop_tr(struct trace_array *tr)
+/**
+ * tracing_stop - quick stop of the tracer
+ *
+ * Light weight way to stop tracing. Use in conjunction with
+ * tracing_start.
+ */
+void tracing_stop(void)
{
- struct trace_buffer *buffer;
- unsigned long flags;
-
- /* If global, we need to also stop the max tracer */
- if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
- return tracing_stop();
-
- raw_spin_lock_irqsave(&tr->start_lock, flags);
- if (tr->stop_count++)
- goto out;
-
- buffer = tr->array_buffer.buffer;
- if (buffer)
- ring_buffer_record_disable(buffer);
-
- out:
- raw_spin_unlock_irqrestore(&tr->start_lock, flags);
+ return tracing_stop_tr(&global_trace);
}
static int trace_save_cmdline(struct task_struct *tsk)
--
2.42.0
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
When the ring buffer is being resized, it can cause side effects to the
running tracer. For instance, there's a race with irqsoff tracer that
swaps individual per cpu buffers between the main buffer and the snapshot
buffer. The resize operation modifies the main buffer and then the
snapshot buffer. If a swap happens in between those two operations it will
break the tracer.
Simply stop the running tracer before resizing the buffers and enable it
again when finished.
Link: https://lkml.kernel.org/r/20231205220010.748996423@goodmis.org
Cc: stable(a)vger.kernel.org
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Fixes: 3928a8a2d9808 ("ftrace: make work with new ring buffer")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 231c173ec04f..e978868b1a22 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6387,9 +6387,12 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
if (!tr->array_buffer.buffer)
return 0;
+ /* Do not allow tracing while resizng ring buffer */
+ tracing_stop_tr(tr);
+
ret = ring_buffer_resize(tr->array_buffer.buffer, size, cpu);
if (ret < 0)
- return ret;
+ goto out_start;
#ifdef CONFIG_TRACER_MAX_TRACE
if (!tr->current_trace->use_max_tr)
@@ -6417,7 +6420,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
WARN_ON(1);
tracing_disabled = 1;
}
- return ret;
+ goto out_start;
}
update_buffer_entries(&tr->max_buffer, cpu);
@@ -6426,7 +6429,8 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
#endif /* CONFIG_TRACER_MAX_TRACE */
update_buffer_entries(&tr->array_buffer, cpu);
-
+ out_start:
+ tracing_start_tr(tr);
return ret;
}
--
2.42.0
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
It use to be that only the top level instance had a snapshot buffer (for
latency tracers like wakeup and irqsoff). The update of the ring buffer
size would check if the instance was the top level and if so, it would
also update the snapshot buffer as it needs to be the same as the main
buffer.
Now that lower level instances also has a snapshot buffer, they too need
to update their snapshot buffer sizes when the main buffer is changed,
otherwise the following can be triggered:
# cd /sys/kernel/tracing
# echo 1500 > buffer_size_kb
# mkdir instances/foo
# echo irqsoff > instances/foo/current_tracer
# echo 1000 > instances/foo/buffer_size_kb
Produces:
WARNING: CPU: 2 PID: 856 at kernel/trace/trace.c:1938 update_max_tr_single.part.0+0x27d/0x320
Which is:
ret = ring_buffer_swap_cpu(tr->max_buffer.buffer, tr->array_buffer.buffer, cpu);
if (ret == -EBUSY) {
[..]
}
WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY); <== here
That's because ring_buffer_swap_cpu() has:
int ret = -EINVAL;
[..]
/* At least make sure the two buffers are somewhat the same */
if (cpu_buffer_a->nr_pages != cpu_buffer_b->nr_pages)
goto out;
[..]
out:
return ret;
}
Instead, update all instances' snapshot buffer sizes when their main
buffer size is updated.
Link: https://lkml.kernel.org/r/20231205220010.454662151@goodmis.org
Cc: stable(a)vger.kernel.org
Cc: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Mark Rutland <mark.rutland(a)arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 9aebf904ff97..231c173ec04f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6392,8 +6392,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
return ret;
#ifdef CONFIG_TRACER_MAX_TRACE
- if (!(tr->flags & TRACE_ARRAY_FL_GLOBAL) ||
- !tr->current_trace->use_max_tr)
+ if (!tr->current_trace->use_max_tr)
goto out;
ret = ring_buffer_resize(tr->max_buffer.buffer, size, cpu);
--
2.42.0
This is a note to let you know that I've just added the patch titled
serial: ma35d1: Validate console index before assignment
to my tty git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
in the tty-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From f0b9d97a77fa8f18400450713358303a435ab688 Mon Sep 17 00:00:00 2001
From: Andi Shyti <andi.shyti(a)kernel.org>
Date: Mon, 4 Dec 2023 17:38:03 +0100
Subject: serial: ma35d1: Validate console index before assignment
The console is immediately assigned to the ma35d1 port without
checking its index. This oversight can lead to out-of-bounds
errors when the index falls outside the valid '0' to
MA35_UART_NR range. Such scenario trigges ran error like the
following:
UBSAN: array-index-out-of-bounds in drivers/tty/serial/ma35d1_serial.c:555:51
index -1 is out of range for type 'uart_ma35d1_port [17]
Check the index before using it and bail out with a warning.
Fixes: 930cbf92db01 ("tty: serial: Add Nuvoton ma35d1 serial driver support")
Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org>
Cc: Jacky Huang <ychuang3(a)nuvoton.com>
Cc: <stable(a)vger.kernel.org> # v6.5+
Link: https://lore.kernel.org/r/20231204163804.1331415-2-andi.shyti@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/tty/serial/ma35d1_serial.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/ma35d1_serial.c b/drivers/tty/serial/ma35d1_serial.c
index a6a7c405892e..21b574f78b86 100644
--- a/drivers/tty/serial/ma35d1_serial.c
+++ b/drivers/tty/serial/ma35d1_serial.c
@@ -552,11 +552,19 @@ static void ma35d1serial_console_putchar(struct uart_port *port, unsigned char c
*/
static void ma35d1serial_console_write(struct console *co, const char *s, u32 count)
{
- struct uart_ma35d1_port *up = &ma35d1serial_ports[co->index];
+ struct uart_ma35d1_port *up;
unsigned long flags;
int locked = 1;
u32 ier;
+ if ((co->index < 0) || (co->index >= MA35_UART_NR)) {
+ pr_warn("Failed to write on ononsole port %x, out of range\n",
+ co->index);
+ return;
+ }
+
+ up = &ma35d1serial_ports[co->index];
+
if (up->port.sysrq)
locked = 0;
else if (oops_in_progress)
--
2.43.0
When an interrupt controller uses a function such as handle_level_irq()
as an interrupt handler and the controller implements the irq_disable()
callback, the following scenario will appear in the i2c-hid driver in
the sleep scenario:
in the sleep flow, while the user is still triggering the i2c-hid
interrupt, we get the following function call:
handle_level_irq()
-> mask_ack_irq()
-> mask_irq()
i2c_hid_core_suspend()
-> disable_irq()
-> __irq_disable()
-> irq_state_set_disabled()
-> irq_state_set_masked()
irq_thread_fn()
-> irq_finalize_oneshot()
-> if (!desc->threads_oneshot && !irqd_irq_disabled() &&
irqd_irq_masked())
unmask_threaded_irq()
-> unmask_irq()
That is, when __irq_disable() is called between mask_irq() and
irq_finalize_oneshot(), the code in irq_finalize_oneshot() will cause
the !irqd_irq_disabled() fails to enter the unmask_irq() branch, which
causes mask_irq/unmask_irq to be called unpaired and the i2c-hid
interrupt to be masked.
Since mask_irq/unmask_irq and irq_disabled() belong to two different
hardware registers or policies, the !irqd_irq_disabled() assertion may
not be used to determine whether unmask_irq() needs to be called.
Cc: stable(a)vger.kernel.org
Signed-off-by: xiongxin <xiongxin(a)kylinos.cn>
Signed-off-by: Riwen Lu <luriwen(a)kylinos.cn>
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 1782f90cd8c6..9160fc9170b3 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1120,8 +1120,7 @@ static void irq_finalize_oneshot(struct irq_desc *desc,
desc->threads_oneshot &= ~action->thread_mask;
- if (!desc->threads_oneshot && !irqd_irq_disabled(&desc->irq_data) &&
- irqd_irq_masked(&desc->irq_data))
+ if (!desc->threads_oneshot && irqd_irq_masked(&desc->irq_data))
unmask_threaded_irq(desc);
out_unlock:
--
2.34.1
On Wed, Dec 6, 2023 at 4:05 PM Hangbin Liu <liuhangbin(a)gmail.com> wrote:
>
> On Wed, Dec 06, 2023 at 01:37:18PM +0100, Florent Revest wrote:
> > In __team_options_register, team_options are allocated and appended to
> > the team's option_list.
> > If one option instance allocation fails, the "inst_rollback" cleanup
> > path frees the previously allocated options but doesn't remove them from
> > the team's option_list.
> > This leaves dangling pointers that can be dereferenced later by other
> > parts of the team driver that iterate over options.
> >
> > This patch fixes the cleanup path to remove the dangling pointers from
> > the list.
> >
> > As far as I can tell, this uaf doesn't have much security implications
> > since it would be fairly hard to exploit (an attacker would need to make
> > the allocation of that specific small object fail) but it's still nice
> > to fix.
> >
> > Fixes: 80f7c6683fe0 ("team: add support for per-port options")
> > Signed-off-by: Florent Revest <revest(a)chromium.org>
>
> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com>
Thank you for the quick reviews Hangbin & Jiri, I appreciate! :)
I just realized I forgot to CC stable (like I always do... :) maybe I
should tattoo it on my arm) Let me know if you'd like a v2 adding:
Cc: stable(a)vger.kernel.org
The quilt patch titled
Subject: nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
has been removed from the -mm tree. Its filename was
nilfs2-prevent-warning-in-nilfs_sufile_set_segment_usage.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
Date: Tue, 5 Dec 2023 17:59:47 +0900
If nilfs2 reads a disk image with corrupted segment usage metadata, and
its segment usage information is marked as an error for the segment at the
write location, nilfs_sufile_set_segment_usage() can trigger WARN_ONs
during log writing.
Segments newly allocated for writing with nilfs_sufile_alloc() will not
have this error flag set, but this unexpected situation will occur if the
segment indexed by either nilfs->ns_segnum or nilfs->ns_nextnum (active
segment) was marked in error.
Fix this issue by inserting a sanity check to treat it as a file system
corruption.
Since error returns are not allowed during the execution phase where
nilfs_sufile_set_segment_usage() is used, this inserts the sanity check
into nilfs_sufile_mark_dirty() which pre-reads the buffer containing the
segment usage record to be updated and sets it up in a dirty state for
writing.
In addition, nilfs_sufile_set_segment_usage() is also called when
canceling log writing and undoing segment usage update, so in order to
avoid issuing the same kernel warning in that case, in case of
cancellation, avoid checking the error flag in
nilfs_sufile_set_segment_usage().
Link: https://lkml.kernel.org/r/20231205085947.4431-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Reported-by: syzbot+14e9f834f6ddecece094(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=14e9f834f6ddecece094
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/nilfs2/sufile.c | 42 +++++++++++++++++++++++++++++++++++-------
1 file changed, 35 insertions(+), 7 deletions(-)
--- a/fs/nilfs2/sufile.c~nilfs2-prevent-warning-in-nilfs_sufile_set_segment_usage
+++ a/fs/nilfs2/sufile.c
@@ -501,15 +501,38 @@ int nilfs_sufile_mark_dirty(struct inode
down_write(&NILFS_MDT(sufile)->mi_sem);
ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh);
- if (!ret) {
- mark_buffer_dirty(bh);
- nilfs_mdt_mark_dirty(sufile);
- kaddr = kmap_atomic(bh->b_page);
- su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
+ if (ret)
+ goto out_sem;
+
+ kaddr = kmap_atomic(bh->b_page);
+ su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
+ if (unlikely(nilfs_segment_usage_error(su))) {
+ struct the_nilfs *nilfs = sufile->i_sb->s_fs_info;
+
+ kunmap_atomic(kaddr);
+ brelse(bh);
+ if (nilfs_segment_is_active(nilfs, segnum)) {
+ nilfs_error(sufile->i_sb,
+ "active segment %llu is erroneous",
+ (unsigned long long)segnum);
+ } else {
+ /*
+ * Segments marked erroneous are never allocated by
+ * nilfs_sufile_alloc(); only active segments, ie,
+ * the segments indexed by ns_segnum or ns_nextnum,
+ * can be erroneous here.
+ */
+ WARN_ON_ONCE(1);
+ }
+ ret = -EIO;
+ } else {
nilfs_segment_usage_set_dirty(su);
kunmap_atomic(kaddr);
+ mark_buffer_dirty(bh);
+ nilfs_mdt_mark_dirty(sufile);
brelse(bh);
}
+out_sem:
up_write(&NILFS_MDT(sufile)->mi_sem);
return ret;
}
@@ -536,9 +559,14 @@ int nilfs_sufile_set_segment_usage(struc
kaddr = kmap_atomic(bh->b_page);
su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
- WARN_ON(nilfs_segment_usage_error(su));
- if (modtime)
+ if (modtime) {
+ /*
+ * Check segusage error and set su_lastmod only when updating
+ * this entry with a valid timestamp, not for cancellation.
+ */
+ WARN_ON_ONCE(nilfs_segment_usage_error(su));
su->su_lastmod = cpu_to_le64(modtime);
+ }
su->su_nblocks = cpu_to_le32(nblocks);
kunmap_atomic(kaddr);
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
nilfs2-move-page-release-outside-of-nilfs_delete_entry-and-nilfs_set_link.patch
nilfs2-eliminate-staggered-calls-to-kunmap-in-nilfs_rename.patch
The quilt patch titled
Subject: highmem: fix a memory copy problem in memcpy_from_folio
has been removed from the -mm tree. Its filename was
highmem-fix-a-memory-copy-problem-in-memcpy_from_folio.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Su Hui <suhui(a)nfschina.com>
Subject: highmem: fix a memory copy problem in memcpy_from_folio
Date: Thu, 30 Nov 2023 11:40:18 +0800
Clang static checker complains that value stored to 'from' is never read.
And memcpy_from_folio() only copy the last chunk memory from folio to
destination. Use 'to += chunk' to replace 'from += chunk' to fix this
typo problem.
Link: https://lkml.kernel.org/r/20231130034017.1210429-1-suhui@nfschina.com
Fixes: b23d03ef7af5 ("highmem: add memcpy_to_folio() and memcpy_from_folio()")
Signed-off-by: Su Hui <suhui(a)nfschina.com>
Reviewed-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: Ira Weiny <ira.weiny(a)intel.com>
Cc: Jiaqi Yan <jiaqiyan(a)google.com>
Cc: Nathan Chancellor <nathan(a)kernel.org>
Cc: Nick Desaulniers <ndesaulniers(a)google.com>
Cc: Peter Collingbourne <pcc(a)google.com>
Cc: Tom Rix <trix(a)redhat.com>
Cc: Tony Luck <tony.luck(a)intel.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/highmem.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/highmem.h~highmem-fix-a-memory-copy-problem-in-memcpy_from_folio
+++ a/include/linux/highmem.h
@@ -454,7 +454,7 @@ static inline void memcpy_from_folio(cha
memcpy(to, from, chunk);
kunmap_local(from);
- from += chunk;
+ to += chunk;
offset += chunk;
len -= chunk;
} while (len > 0);
_
Patches currently in -mm which might be from suhui(a)nfschina.com are
The quilt patch titled
Subject: nilfs2: fix missing error check for sb_set_blocksize call
has been removed from the -mm tree. Its filename was
nilfs2-fix-missing-error-check-for-sb_set_blocksize-call.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: fix missing error check for sb_set_blocksize call
Date: Wed, 29 Nov 2023 23:15:47 +0900
When mounting a filesystem image with a block size larger than the page
size, nilfs2 repeatedly outputs long error messages with stack traces to
the kernel log, such as the following:
getblk(): invalid block size 8192 requested
logical block size: 512
...
Call Trace:
dump_stack_lvl+0x92/0xd4
dump_stack+0xd/0x10
bdev_getblk+0x33a/0x354
__breadahead+0x11/0x80
nilfs_search_super_root+0xe2/0x704 [nilfs2]
load_nilfs+0x72/0x504 [nilfs2]
nilfs_mount+0x30f/0x518 [nilfs2]
legacy_get_tree+0x1b/0x40
vfs_get_tree+0x18/0xc4
path_mount+0x786/0xa88
__ia32_sys_mount+0x147/0x1a8
__do_fast_syscall_32+0x56/0xc8
do_fast_syscall_32+0x29/0x58
do_SYSENTER_32+0x15/0x18
entry_SYSENTER_32+0x98/0xf1
...
This overloads the system logger. And to make matters worse, it sometimes
crashes the kernel with a memory access violation.
This is because the return value of the sb_set_blocksize() call, which
should be checked for errors, is not checked.
The latter issue is due to out-of-buffer memory being accessed based on a
large block size that caused sb_set_blocksize() to fail for buffers read
with the initial minimum block size that remained unupdated in the
super_block structure.
Since nilfs2 mkfs tool does not accept block sizes larger than the system
page size, this has been overlooked. However, it is possible to create
this situation by intentionally modifying the tool or by passing a
filesystem image created on a system with a large page size to a system
with a smaller page size and mounting it.
Fix this issue by inserting the expected error handling for the call to
sb_set_blocksize().
Link: https://lkml.kernel.org/r/20231129141547.4726-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/nilfs2/the_nilfs.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/nilfs2/the_nilfs.c~nilfs2-fix-missing-error-check-for-sb_set_blocksize-call
+++ a/fs/nilfs2/the_nilfs.c
@@ -716,7 +716,11 @@ int init_nilfs(struct the_nilfs *nilfs,
goto failed_sbh;
}
nilfs_release_super_block(nilfs);
- sb_set_blocksize(sb, blocksize);
+ if (!sb_set_blocksize(sb, blocksize)) {
+ nilfs_err(sb, "bad blocksize %d", blocksize);
+ err = -EINVAL;
+ goto out;
+ }
err = nilfs_load_super_block(nilfs, sb, blocksize, &sbp);
if (err)
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
nilfs2-move-page-release-outside-of-nilfs_delete_entry-and-nilfs_set_link.patch
nilfs2-eliminate-staggered-calls-to-kunmap-in-nilfs_rename.patch
The quilt patch titled
Subject: drivers/base/cpu: crash data showing should depends on KEXEC_CORE
has been removed from the -mm tree. Its filename was
drivers-base-cpu-crash-data-showing-should-depends-on-kexec_core.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Baoquan He <bhe(a)redhat.com>
Subject: drivers/base/cpu: crash data showing should depends on KEXEC_CORE
Date: Tue, 28 Nov 2023 13:52:48 +0800
After commit 88a6f8994421 ("crash: memory and CPU hotplug sysfs
attributes"), on x86_64, if only below kernel configs related to kdump are
set, compiling error are triggered.
----
CONFIG_CRASH_CORE=y
CONFIG_KEXEC_CORE=y
CONFIG_CRASH_DUMP=y
CONFIG_CRASH_HOTPLUG=y
------
------------------------------------------------------
drivers/base/cpu.c: In function `crash_hotplug_show':
drivers/base/cpu.c:309:40: error: implicit declaration of function `crash_hotplug_cpu_support'; did you mean `crash_hotplug_show'? [-Werror=implicit-function-declaration]
309 | return sysfs_emit(buf, "%d\n", crash_hotplug_cpu_support());
| ^~~~~~~~~~~~~~~~~~~~~~~~~
| crash_hotplug_show
cc1: some warnings being treated as errors
------------------------------------------------------
CONFIG_KEXEC is used to enable kexec_load interface, the
crash_notes/crash_notes_size/crash_hotplug showing depends on
CONFIG_KEXEC is incorrect. It should depend on KEXEC_CORE instead.
Fix it now.
Link: https://lkml.kernel.org/r/20231128055248.659808-1-bhe@redhat.com
Fixes: 88a6f8994421 ("crash: memory and CPU hotplug sysfs attributes")
Signed-off-by: Baoquan He <bhe(a)redhat.com>
Tested-by: Ignat Korchagin <ignat(a)cloudflare.com> [compile-time only]
Tested-by: Alexander Gordeev <agordeev(a)linux.ibm.com>
Reviewed-by: Eric DeVolder <eric_devolder(a)yahoo.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
drivers/base/cpu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/base/cpu.c~drivers-base-cpu-crash-data-showing-should-depends-on-kexec_core
+++ a/drivers/base/cpu.c
@@ -144,7 +144,7 @@ static DEVICE_ATTR(release, S_IWUSR, NUL
#endif /* CONFIG_ARCH_CPU_PROBE_RELEASE */
#endif /* CONFIG_HOTPLUG_CPU */
-#ifdef CONFIG_KEXEC
+#ifdef CONFIG_KEXEC_CORE
#include <linux/kexec.h>
static ssize_t crash_notes_show(struct device *dev,
@@ -189,14 +189,14 @@ static const struct attribute_group cras
#endif
static const struct attribute_group *common_cpu_attr_groups[] = {
-#ifdef CONFIG_KEXEC
+#ifdef CONFIG_KEXEC_CORE
&crash_note_cpu_attr_group,
#endif
NULL
};
static const struct attribute_group *hotplugable_cpu_attr_groups[] = {
-#ifdef CONFIG_KEXEC
+#ifdef CONFIG_KEXEC_CORE
&crash_note_cpu_attr_group,
#endif
NULL
_
Patches currently in -mm which might be from bhe(a)redhat.com are
kexec_core-change-dependency-of-object-files.patch
kexec-drop-dependency-on-arch_supports_kexec-from-crash_dump-fix-1.patch
kexec-drop-dependency-on-arch_supports_kexec-from-crash_dump-fix-2.patch
riscv-fix-vmallc_start-definition.patch
resource-add-walk_system_ram_res_rev.patch
kexec_file-load-kernel-at-top-of-system-ram-if-required.patch
kexec_file-add-kexec_file-flag-to-control-debug-printing.patch
kexec_file-print-out-debugging-message-if-required.patch
kexec_file-x86-print-out-debugging-message-if-required.patch
kexec_file-arm64-print-out-debugging-message-if-required.patch
kexec_file-ricv-print-out-debugging-message-if-required.patch
kexec_file-power-print-out-debugging-message-if-required.patch
kexec_file-parisc-print-out-debugging-message-if-required.patch
riscv-kexec-fix-the-ifdeffery-for-aflags_kexec_relocateo.patch
The quilt patch titled
Subject: lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly
has been removed from the -mm tree. Its filename was
lib-group_cpusc-avoid-to-acquire-cpu-hotplug-lock-in-group_cpus_evenly.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Ming Lei <ming.lei(a)redhat.com>
Subject: lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly
Date: Mon, 20 Nov 2023 16:35:59 +0800
group_cpus_evenly() could be part of storage driver's error handler, such
as nvme driver, when may happen during CPU hotplug, in which storage queue
has to drain its pending IOs because all CPUs associated with the queue
are offline and the queue is becoming inactive. And handling IO needs
error handler to provide forward progress.
Then deadlock is caused:
1) inside CPU hotplug handler, CPU hotplug lock is held, and blk-mq's
handler is waiting for inflight IO
2) error handler is waiting for CPU hotplug lock
3) inflight IO can't be completed in blk-mq's CPU hotplug handler
because error handling can't provide forward progress.
Solve the deadlock by not holding CPU hotplug lock in group_cpus_evenly(),
in which two stage spreads are taken: 1) the 1st stage is over all present
CPUs; 2) the end stage is over all other CPUs.
Turns out the two stage spread just needs consistent 'cpu_present_mask',
and remove the CPU hotplug lock by storing it into one local cache. This
way doesn't change correctness, because all CPUs are still covered.
Link: https://lkml.kernel.org/r/20231120083559.285174-1-ming.lei@redhat.com
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
Reported-by: Yi Zhang <yi.zhang(a)redhat.com>
Reported-by: Guangwu Zhang <guazhang(a)redhat.com>
Tested-by: Guangwu Zhang <guazhang(a)redhat.com>
Reviewed-by: Chengming Zhou <zhouchengming(a)bytedance.com>
Reviewed-by: Jens Axboe <axboe(a)kernel.dk>
Cc: Keith Busch <kbusch(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
lib/group_cpus.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/lib/group_cpus.c~lib-group_cpusc-avoid-to-acquire-cpu-hotplug-lock-in-group_cpus_evenly
+++ a/lib/group_cpus.c
@@ -366,13 +366,25 @@ struct cpumask *group_cpus_evenly(unsign
if (!masks)
goto fail_node_to_cpumask;
- /* Stabilize the cpumasks */
- cpus_read_lock();
build_node_to_cpumask(node_to_cpumask);
+ /*
+ * Make a local cache of 'cpu_present_mask', so the two stages
+ * spread can observe consistent 'cpu_present_mask' without holding
+ * cpu hotplug lock, then we can reduce deadlock risk with cpu
+ * hotplug code.
+ *
+ * Here CPU hotplug may happen when reading `cpu_present_mask`, and
+ * we can live with the case because it only affects that hotplug
+ * CPU is handled in the 1st or 2nd stage, and either way is correct
+ * from API user viewpoint since 2-stage spread is sort of
+ * optimization.
+ */
+ cpumask_copy(npresmsk, data_race(cpu_present_mask));
+
/* grouping present CPUs first */
ret = __group_cpus_evenly(curgrp, numgrps, node_to_cpumask,
- cpu_present_mask, nmsk, masks);
+ npresmsk, nmsk, masks);
if (ret < 0)
goto fail_build_affinity;
nr_present = ret;
@@ -387,15 +399,13 @@ struct cpumask *group_cpus_evenly(unsign
curgrp = 0;
else
curgrp = nr_present;
- cpumask_andnot(npresmsk, cpu_possible_mask, cpu_present_mask);
+ cpumask_andnot(npresmsk, cpu_possible_mask, npresmsk);
ret = __group_cpus_evenly(curgrp, numgrps, node_to_cpumask,
npresmsk, nmsk, masks);
if (ret >= 0)
nr_others = ret;
fail_build_affinity:
- cpus_read_unlock();
-
if (ret >= 0)
WARN_ON(nr_present + nr_others < numgrps);
_
Patches currently in -mm which might be from ming.lei(a)redhat.com are
The quilt patch titled
Subject: checkstack: fix printed address
has been removed from the -mm tree. Its filename was
checkstack-fix-printed-address.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Heiko Carstens <hca(a)linux.ibm.com>
Subject: checkstack: fix printed address
Date: Mon, 20 Nov 2023 19:37:17 +0100
All addresses printed by checkstack have an extra incorrect 0 appended at
the end.
This was introduced with commit 677f1410e058 ("scripts/checkstack.pl: don't
display $dre as different entity"): since then the address is taken from
the line which contains the function name, instead of the line which
contains stack consumption. E.g. on s390:
0000000000100a30 <do_one_initcall>:
...
100a44: e3 f0 ff 70 ff 71 lay %r15,-144(%r15)
So the used regex which matches spaces and hexadecimal numbers to extract
an address now matches a different substring. Subsequently replacing spaces
with 0 appends a zero at the and, instead of replacing leading spaces.
Fix this by using the proper regex, and simplify the code a bit.
Link: https://lkml.kernel.org/r/20231120183719.2188479-2-hca@linux.ibm.com
Fixes: 677f1410e058 ("scripts/checkstack.pl: don't display $dre as different entity")
Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com>
Cc: Maninder Singh <maninder1.s(a)samsung.com>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Vaneet Narang <v.narang(a)samsung.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
scripts/checkstack.pl | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/scripts/checkstack.pl~checkstack-fix-printed-address
+++ a/scripts/checkstack.pl
@@ -139,15 +139,11 @@ $total_size = 0;
while (my $line = <STDIN>) {
if ($line =~ m/$funcre/) {
$func = $1;
- next if $line !~ m/^($xs*)/;
+ next if $line !~ m/^($x*)/;
if ($total_size > $min_stack) {
push @stack, "$intro$total_size\n";
}
-
- $addr = $1;
- $addr =~ s/ /0/g;
- $addr = "0x$addr";
-
+ $addr = "0x$1";
$intro = "$addr $func [$file]:";
my $padlen = 56 - length($intro);
while ($padlen > 0) {
_
Patches currently in -mm which might be from hca(a)linux.ibm.com are
arch-remove-arch_thread_stack_allocator.patch
arch-remove-arch_task_struct_allocator.patch
arch-remove-arch_task_struct_on_stack.patch
checkstack-sort-output-by-size-and-function-name.patch
checkstack-allow-to-pass-minstacksize-parameter.patch
The quilt patch titled
Subject: mm/memory_hotplug: fix error handling in add_memory_resource()
has been removed from the -mm tree. Its filename was
mm-memory_hotplug-fix-error-handling-in-add_memory_resource.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Sumanth Korikkar <sumanthk(a)linux.ibm.com>
Subject: mm/memory_hotplug: fix error handling in add_memory_resource()
Date: Mon, 20 Nov 2023 15:53:53 +0100
In add_memory_resource(), creation of memory block devices occurs after
successful call to arch_add_memory(). However, creation of memory block
devices could fail. In that case, arch_remove_memory() is called to
perform necessary cleanup.
Currently with or without altmap support, arch_remove_memory() is always
passed with altmap set to NULL during error handling. This leads to
freeing of struct pages using free_pages(), eventhough the allocation
might have been performed with altmap support via
altmap_alloc_block_buf().
Fix the error handling by passing altmap in arch_remove_memory(). This
ensures the following:
* When altmap is disabled, deallocation of the struct pages array occurs
via free_pages().
* When altmap is enabled, deallocation occurs via vmem_altmap_free().
Link: https://lkml.kernel.org/r/20231120145354.308999-3-sumanthk@linux.ibm.com
Fixes: a08a2ae34613 ("mm,memory_hotplug: allocate memmap from the added memory range")
Signed-off-by: Sumanth Korikkar <sumanthk(a)linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer(a)linux.ibm.com>
Acked-by: David Hildenbrand <david(a)redhat.com>
Cc: Alexander Gordeev <agordeev(a)linux.ibm.com>
Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com>
Cc: Anshuman Khandual <anshuman.khandual(a)arm.com>
Cc: Heiko Carstens <hca(a)linux.ibm.com>
Cc: kernel test robot <lkp(a)intel.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Vasily Gorbik <gor(a)linux.ibm.com>
Cc: <stable(a)vger.kernel.org> [5.15+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory_hotplug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/memory_hotplug.c~mm-memory_hotplug-fix-error-handling-in-add_memory_resource
+++ a/mm/memory_hotplug.c
@@ -1458,7 +1458,7 @@ int __ref add_memory_resource(int nid, s
/* create memory block devices after memory was added */
ret = create_memory_block_devices(start, size, params.altmap, group);
if (ret) {
- arch_remove_memory(start, size, NULL);
+ arch_remove_memory(start, size, params.altmap);
goto error_free;
}
_
Patches currently in -mm which might be from sumanthk(a)linux.ibm.com are
mm-use-vmem_altmap-code-without-config_zone_device.patch
The quilt patch titled
Subject: mm/memory_hotplug: add missing mem_hotplug_lock
has been removed from the -mm tree. Its filename was
mm-memory_hotplug-add-missing-mem_hotplug_lock.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Sumanth Korikkar <sumanthk(a)linux.ibm.com>
Subject: mm/memory_hotplug: add missing mem_hotplug_lock
Date: Mon, 20 Nov 2023 15:53:52 +0100
From Documentation/core-api/memory-hotplug.rst:
When adding/removing/onlining/offlining memory or adding/removing
heterogeneous/device memory, we should always hold the mem_hotplug_lock
in write mode to serialise memory hotplug (e.g. access to global/zone
variables).
mhp_(de)init_memmap_on_memory() functions can change zone stats and
struct page content, but they are currently called w/o the
mem_hotplug_lock.
When memory block is being offlined and when kmemleak goes through each
populated zone, the following theoretical race conditions could occur:
CPU 0: | CPU 1:
memory_offline() |
-> offline_pages() |
-> mem_hotplug_begin() |
... |
-> mem_hotplug_done() |
| kmemleak_scan()
| -> get_online_mems()
| ...
-> mhp_deinit_memmap_on_memory() |
[not protected by mem_hotplug_begin/done()]|
Marks memory section as offline, | Retrieves zone_start_pfn
poisons vmemmap struct pages and updates | and struct page members.
the zone related data |
| ...
| -> put_online_mems()
Fix this by ensuring mem_hotplug_lock is taken before performing
mhp_init_memmap_on_memory(). Also ensure that
mhp_deinit_memmap_on_memory() holds the lock.
online/offline_pages() are currently only called from
memory_block_online/offline(), so it is safe to move the locking there.
Link: https://lkml.kernel.org/r/20231120145354.308999-2-sumanthk@linux.ibm.com
Fixes: a08a2ae34613 ("mm,memory_hotplug: allocate memmap from the added memory range")
Signed-off-by: Sumanth Korikkar <sumanthk(a)linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer(a)linux.ibm.com>
Acked-by: David Hildenbrand <david(a)redhat.com>
Cc: Alexander Gordeev <agordeev(a)linux.ibm.com>
Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com>
Cc: Anshuman Khandual <anshuman.khandual(a)arm.com>
Cc: Heiko Carstens <hca(a)linux.ibm.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Vasily Gorbik <gor(a)linux.ibm.com>
Cc: kernel test robot <lkp(a)intel.com>
Cc: <stable(a)vger.kernel.org> [5.15+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
drivers/base/memory.c | 18 +++++++++++++++---
mm/memory_hotplug.c | 13 ++++++-------
2 files changed, 21 insertions(+), 10 deletions(-)
--- a/drivers/base/memory.c~mm-memory_hotplug-add-missing-mem_hotplug_lock
+++ a/drivers/base/memory.c
@@ -180,6 +180,9 @@ static inline unsigned long memblk_nr_po
}
#endif
+/*
+ * Must acquire mem_hotplug_lock in write mode.
+ */
static int memory_block_online(struct memory_block *mem)
{
unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr);
@@ -204,10 +207,11 @@ static int memory_block_online(struct me
if (mem->altmap)
nr_vmemmap_pages = mem->altmap->free;
+ mem_hotplug_begin();
if (nr_vmemmap_pages) {
ret = mhp_init_memmap_on_memory(start_pfn, nr_vmemmap_pages, zone);
if (ret)
- return ret;
+ goto out;
}
ret = online_pages(start_pfn + nr_vmemmap_pages,
@@ -215,7 +219,7 @@ static int memory_block_online(struct me
if (ret) {
if (nr_vmemmap_pages)
mhp_deinit_memmap_on_memory(start_pfn, nr_vmemmap_pages);
- return ret;
+ goto out;
}
/*
@@ -227,9 +231,14 @@ static int memory_block_online(struct me
nr_vmemmap_pages);
mem->zone = zone;
+out:
+ mem_hotplug_done();
return ret;
}
+/*
+ * Must acquire mem_hotplug_lock in write mode.
+ */
static int memory_block_offline(struct memory_block *mem)
{
unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr);
@@ -247,6 +256,7 @@ static int memory_block_offline(struct m
if (mem->altmap)
nr_vmemmap_pages = mem->altmap->free;
+ mem_hotplug_begin();
if (nr_vmemmap_pages)
adjust_present_page_count(pfn_to_page(start_pfn), mem->group,
-nr_vmemmap_pages);
@@ -258,13 +268,15 @@ static int memory_block_offline(struct m
if (nr_vmemmap_pages)
adjust_present_page_count(pfn_to_page(start_pfn),
mem->group, nr_vmemmap_pages);
- return ret;
+ goto out;
}
if (nr_vmemmap_pages)
mhp_deinit_memmap_on_memory(start_pfn, nr_vmemmap_pages);
mem->zone = NULL;
+out:
+ mem_hotplug_done();
return ret;
}
--- a/mm/memory_hotplug.c~mm-memory_hotplug-add-missing-mem_hotplug_lock
+++ a/mm/memory_hotplug.c
@@ -1129,6 +1129,9 @@ void mhp_deinit_memmap_on_memory(unsigne
kasan_remove_zero_shadow(__va(PFN_PHYS(pfn)), PFN_PHYS(nr_pages));
}
+/*
+ * Must be called with mem_hotplug_lock in write mode.
+ */
int __ref online_pages(unsigned long pfn, unsigned long nr_pages,
struct zone *zone, struct memory_group *group)
{
@@ -1149,7 +1152,6 @@ int __ref online_pages(unsigned long pfn
!IS_ALIGNED(pfn + nr_pages, PAGES_PER_SECTION)))
return -EINVAL;
- mem_hotplug_begin();
/* associate pfn range with the zone */
move_pfn_range_to_zone(zone, pfn, nr_pages, NULL, MIGRATE_ISOLATE);
@@ -1208,7 +1210,6 @@ int __ref online_pages(unsigned long pfn
writeback_set_ratelimit();
memory_notify(MEM_ONLINE, &arg);
- mem_hotplug_done();
return 0;
failed_addition:
@@ -1217,7 +1218,6 @@ failed_addition:
(((unsigned long long) pfn + nr_pages) << PAGE_SHIFT) - 1);
memory_notify(MEM_CANCEL_ONLINE, &arg);
remove_pfn_range_from_zone(zone, pfn, nr_pages);
- mem_hotplug_done();
return ret;
}
@@ -1863,6 +1863,9 @@ static int count_system_ram_pages_cb(uns
return 0;
}
+/*
+ * Must be called with mem_hotplug_lock in write mode.
+ */
int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages,
struct zone *zone, struct memory_group *group)
{
@@ -1885,8 +1888,6 @@ int __ref offline_pages(unsigned long st
!IS_ALIGNED(start_pfn + nr_pages, PAGES_PER_SECTION)))
return -EINVAL;
- mem_hotplug_begin();
-
/*
* Don't allow to offline memory blocks that contain holes.
* Consequently, memory blocks with holes can never get onlined
@@ -2031,7 +2032,6 @@ int __ref offline_pages(unsigned long st
memory_notify(MEM_OFFLINE, &arg);
remove_pfn_range_from_zone(zone, start_pfn, nr_pages);
- mem_hotplug_done();
return 0;
failed_removal_isolated:
@@ -2046,7 +2046,6 @@ failed_removal:
(unsigned long long) start_pfn << PAGE_SHIFT,
((unsigned long long) end_pfn << PAGE_SHIFT) - 1,
reason);
- mem_hotplug_done();
return ret;
}
_
Patches currently in -mm which might be from sumanthk(a)linux.ibm.com are
mm-use-vmem_altmap-code-without-config_zone_device.patch
The quilt patch titled
Subject: mm: fix oops when filemap_map_pmd() without prealloc_pte
has been removed from the -mm tree. Its filename was
mm-fix-oops-when-filemap_map_pmd-without-prealloc_pte.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Hugh Dickins <hughd(a)google.com>
Subject: mm: fix oops when filemap_map_pmd() without prealloc_pte
Date: Fri, 17 Nov 2023 00:49:18 -0800 (PST)
syzbot reports oops in lockdep's __lock_acquire(), called from
__pte_offset_map_lock() called from filemap_map_pages(); or when I run the
repro, the oops comes in pmd_install(), called from filemap_map_pmd()
called from filemap_map_pages(), just before the __pte_offset_map_lock().
The problem is that filemap_map_pmd() has been assuming that when it finds
pmd_none(), a page table has already been prepared in prealloc_pte; and
indeed do_fault_around() has been careful to preallocate one there, when
it finds pmd_none(): but what if *pmd became none in between?
My 6.6 mods in mm/khugepaged.c, avoiding mmap_lock for write, have made it
easy for *pmd to be cleared while servicing a page fault; but even before
those, a huge *pmd might be zapped while a fault is serviced.
The difference in symptomatic stack traces comes from the "memory model"
in use: pmd_install() uses pmd_populate() uses page_to_pfn(): in some
models that is strict, and will oops on the NULL prealloc_pte; in other
models, it will construct a bogus value to be populated into *pmd, then
__pte_offset_map_lock() oops when trying to access split ptlock pointer
(or some other symptom in normal case of ptlock embedded not pointer).
Link: https://lore.kernel.org/linux-mm/20231115065506.19780-1-jose.pekkarinen@fox…
Link: https://lkml.kernel.org/r/6ed0c50c-78ef-0719-b3c5-60c0c010431c@google.com
Fixes: f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths")
Signed-off-by: Hugh Dickins <hughd(a)google.com>
Reported-and-tested-by: syzbot+89edd67979b52675ddec(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-mm/0000000000005e44550608a0806c@google.com/
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Cc: Jann Horn <jannh(a)google.com>,
Cc: Jos�� Pekkarinen <jose.pekkarinen(a)foxhound.fi>
Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org> [5.12+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/filemap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/filemap.c~mm-fix-oops-when-filemap_map_pmd-without-prealloc_pte
+++ a/mm/filemap.c
@@ -3371,7 +3371,7 @@ static bool filemap_map_pmd(struct vm_fa
}
}
- if (pmd_none(*vmf->pmd))
+ if (pmd_none(*vmf->pmd) && vmf->prealloc_pte)
pmd_install(mm, vmf->pmd, &vmf->prealloc_pte);
return false;
_
Patches currently in -mm which might be from hughd(a)google.com are
The quilt patch titled
Subject: hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write
has been removed from the -mm tree. Its filename was
hugetlb-fix-null-ptr-deref-in-hugetlb_vma_lock_write.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Subject: hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write
Date: Mon, 13 Nov 2023 17:20:33 -0800
The routine __vma_private_lock tests for the existence of a reserve map
associated with a private hugetlb mapping. A pointer to the reserve map
is in vma->vm_private_data. __vma_private_lock was checking the pointer
for NULL. However, it is possible that the low bits of the pointer could
be used as flags. In such instances, vm_private_data is not NULL and not
a valid pointer. This results in the null-ptr-deref reported by syzbot:
general protection fault, probably for non-canonical address 0xdffffc000000001d:
0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
CPU: 0 PID: 5048 Comm: syz-executor139 Not tainted 6.6.0-rc7-syzkaller-00142-g88
8cf78c29e2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 1
0/09/2023
RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5004
...
Call Trace:
<TASK>
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
down_write+0x93/0x200 kernel/locking/rwsem.c:1573
hugetlb_vma_lock_write mm/hugetlb.c:300 [inline]
hugetlb_vma_lock_write+0xae/0x100 mm/hugetlb.c:291
__hugetlb_zap_begin+0x1e9/0x2b0 mm/hugetlb.c:5447
hugetlb_zap_begin include/linux/hugetlb.h:258 [inline]
unmap_vmas+0x2f4/0x470 mm/memory.c:1733
exit_mmap+0x1ad/0xa60 mm/mmap.c:3230
__mmput+0x12a/0x4d0 kernel/fork.c:1349
mmput+0x62/0x70 kernel/fork.c:1371
exit_mm kernel/exit.c:567 [inline]
do_exit+0x9ad/0x2a20 kernel/exit.c:861
__do_sys_exit kernel/exit.c:991 [inline]
__se_sys_exit kernel/exit.c:989 [inline]
__x64_sys_exit+0x42/0x50 kernel/exit.c:989
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Mask off low bit flags before checking for NULL pointer. In addition, the
reserve map only 'belongs' to the OWNER (parent in parent/child
relationships) so also check for the OWNER flag.
Link: https://lkml.kernel.org/r/20231114012033.259600-1-mike.kravetz@oracle.com
Reported-by: syzbot+6ada951e7c0f7bc8a71e(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-mm/00000000000078d1e00608d7878b@google.com/
Fixes: bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Reviewed-by: Rik van Riel <riel(a)surriel.com>
Cc: Edward Adam Davis <eadavis(a)qq.com>
Cc: Muchun Song <muchun.song(a)linux.dev>
Cc: Nathan Chancellor <nathan(a)kernel.org>
Cc: Nick Desaulniers <ndesaulniers(a)google.com>
Cc: Tom Rix <trix(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/hugetlb.h | 5 +----
mm/hugetlb.c | 7 +++++++
2 files changed, 8 insertions(+), 4 deletions(-)
--- a/include/linux/hugetlb.h~hugetlb-fix-null-ptr-deref-in-hugetlb_vma_lock_write
+++ a/include/linux/hugetlb.h
@@ -1268,10 +1268,7 @@ static inline bool __vma_shareable_lock(
return (vma->vm_flags & VM_MAYSHARE) && vma->vm_private_data;
}
-static inline bool __vma_private_lock(struct vm_area_struct *vma)
-{
- return (!(vma->vm_flags & VM_MAYSHARE)) && vma->vm_private_data;
-}
+bool __vma_private_lock(struct vm_area_struct *vma);
/*
* Safe version of huge_pte_offset() to check the locks. See comments
--- a/mm/hugetlb.c~hugetlb-fix-null-ptr-deref-in-hugetlb_vma_lock_write
+++ a/mm/hugetlb.c
@@ -1182,6 +1182,13 @@ static int is_vma_resv_set(struct vm_are
return (get_vma_private_data(vma) & flag) != 0;
}
+bool __vma_private_lock(struct vm_area_struct *vma)
+{
+ return !(vma->vm_flags & VM_MAYSHARE) &&
+ get_vma_private_data(vma) & ~HPAGE_RESV_MASK &&
+ is_vma_resv_set(vma, HPAGE_RESV_OWNER);
+}
+
void hugetlb_dup_vma_private(struct vm_area_struct *vma)
{
VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
_
Patches currently in -mm which might be from mike.kravetz(a)oracle.com are
The kernel hangs for a good 12 seconds without any info being printed to
dmesg, very early in the boot process, if this regulator is not enabled.
Force-enable it to work around this issue, until we know more about the
underlying problem.
Signed-off-by: Paul Cercueil <paul(a)crapouillou.net>
Fixes: 8620cc2f99b7 ("ARM: dts: exynos: Add devicetree file for the Galaxy S2")
Cc: <stable(a)vger.kernel.org> # v5.8+
---
arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/arm/boot/dts/samsung/exynos4210-i9100.dts b/arch/arm/boot/dts/samsung/exynos4210-i9100.dts
index a9ec1f6c1dea..a076a1dfe41f 100644
--- a/arch/arm/boot/dts/samsung/exynos4210-i9100.dts
+++ b/arch/arm/boot/dts/samsung/exynos4210-i9100.dts
@@ -527,6 +527,14 @@ vtcam_reg: LDO12 {
regulator-name = "VT_CAM_1.8V";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
+
+ /*
+ * Force-enable this regulator; otherwise the
+ * kernel hangs very early in the boot process
+ * for about 12 seconds, without apparent
+ * reason.
+ */
+ regulator-always-on;
};
vcclcd_reg: LDO13 {
--
2.42.0
This is the start of the stable review cycle for the 5.15.142 release.
There are 64 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Dec 2023 18:32:16 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.142-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.142-rc2
Christoph Hellwig <hch(a)lst.de>
iomap: update ki_pos a little later in iomap_dio_complete
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: fix deadlock on RTL8125 in jumbo mtu mode
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: disable ASPM in case of tx timeout
Wenchao Chen <wenchao.chen(a)unisoc.com>
mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
Heiner Kallweit <hkallweit1(a)gmail.com>
mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
Lu Baolu <baolu.lu(a)linux.intel.com>
iommu/vt-d: Make context clearing consistent with context mapping
Lu Baolu <baolu.lu(a)linux.intel.com>
iommu/vt-d: Omit devTLB invalidation requests when TES=0
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: don't warn for disabling a non-existing frequency
Steve French <stfrench(a)microsoft.com>
smb3: fix caching of ctime on setxattr
Jeff Layton <jlayton(a)kernel.org>
fs: add ctime accessors infrastructure
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
Mark Hasemeyer <markhas(a)chromium.org>
ASoC: SOF: sof-pci-dev: Fix community key quirk detection
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: don't use the community key on APL Chromebooks
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: add parameter to override topology filename
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: use community key on all Up boards
Hans de Goede <hdegoede(a)redhat.com>
ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
Steve French <stfrench(a)microsoft.com>
smb3: fix touch -h of symlink
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
selftests/resctrl: Move _GNU_SOURCE define into Makefile
Shaopeng Tan <tan.shaopeng(a)jp.fujitsu.com>
selftests/resctrl: Add missing SPDX license to Makefile
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix async branch flags
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Stop DMA in case of failures on ravb_open()
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Start TX queues after HW initialization succeeded
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Use pm_runtime_resume_and_get()
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Check return value of reset_control_deassert()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
ravb: Fix races between ravb_tx_timeout_work() and net related ops
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: prevent potential deadlock in rtl8169_close
Andrey Grodzovsky <andrey.grodzovsky(a)amd.com>
Revert "workqueue: remove unused cancel_work()"
Geetha sowjanya <gakula(a)marvell.com>
octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64
Furong Xu <0x1207(a)gmail.com>
net: stmmac: xgmac: Disable FPE MMC interrupts
Elena Salomatkina <elena.salomatkina.cmc(a)gmail.com>
octeontx2-af: Fix possible buffer overflow
Willem de Bruijn <willemb(a)google.com>
selftests/net: ipsec: fix constant out of range
Dmitry Antipov <dmantipov(a)yandex.ru>
uapi: propagate __struct_group() attributes to the container union
Ioana Ciornei <ioana.ciornei(a)nxp.com>
dpaa2-eth: increase the needed headroom to account for alignment
Zhengchao Shao <shaozhengchao(a)huawei.com>
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
Niklas Neronin <niklas.neronin(a)linux.intel.com>
usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Change configuration warnings to notices
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: fix race of netvsc and VF register_netdevice
Patrick Wang <patrick.wang.shcn(a)gmail.com>
rcu: Avoid tracing a few functions executed in stop machine
Xin Long <lucien.xin(a)gmail.com>
vlan: move dev_put into vlan_dev_uninit
Xin Long <lucien.xin(a)gmail.com>
vlan: introduce vlan_dev_free_egress_priority
Max Nguyen <maxwell.nguyen(a)hp.com>
Input: xpad - add HyperX Clutch Gladiate Support
Filipe Manana <fdmanana(a)suse.com>
btrfs: make error messages more clear when getting a chunk map
Jann Horn <jannh(a)google.com>
btrfs: send: ensure send_fd is writable
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix off-by-one when checking chunk map includes logical address
Bragatheswaran Manickavel <bragathemanick0908(a)gmail.com>
btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod()
Qu Wenruo <wqu(a)suse.com>
btrfs: add dmesg output for first mount and last unmount of a filesystem
Helge Deller <deller(a)gmx.de>
parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes
Timothy Pearson <tpearson(a)raptorengineering.com>
powerpc: Don't clobber f0/vs0 during fp|altivec register save
Abdul Halim, Mohd Syazwan <mohd.syazwan.abdul.halim(a)intel.com>
iommu/vt-d: Add MTL to quirk list to skip TE disabling
Markus Weippert <markus(a)gekmihesg.de>
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
Wu Bo <bo.wu(a)vivo.com>
dm verity: don't perform FEC for failed readahead IO
Mikulas Patocka <mpatocka(a)redhat.com>
dm-verity: align struct dm_verity_fec_io properly
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Add supported ALC257 for ChromeOS
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Headset Mic VREF to 100%
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Disable power-save on KONTRON SinglePC
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Be sure to wait while busy in CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Do not lose cache flush during CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Retry commands in CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Fix task clearing in CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Warn of halt or task clear failure
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Increase recovery halt timeout
Yang Yingliang <yangyingliang(a)huawei.com>
firewire: core: fix possible memory leak in create_units()
Maria Yu <quic_aiquny(a)quicinc.com>
pinctrl: avoid reload of p state in list iteration
-------------
Diffstat:
Makefile | 4 +-
arch/parisc/include/uapi/asm/errno.h | 2 -
arch/powerpc/kernel/fpu.S | 13 ++++
arch/powerpc/kernel/vector.S | 2 +
drivers/cpufreq/imx6q-cpufreq.c | 32 ++++----
drivers/firewire/core-device.c | 11 +--
drivers/input/joystick/xpad.c | 2 +
drivers/iommu/intel/dmar.c | 18 +++++
drivers/iommu/intel/iommu.c | 6 +-
drivers/md/bcache/btree.c | 2 +-
drivers/md/dm-verity-fec.c | 3 +-
drivers/md/dm-verity-target.c | 4 +-
drivers/md/dm-verity.h | 6 --
drivers/mmc/core/block.c | 2 +
drivers/mmc/core/core.c | 9 ++-
drivers/mmc/core/regulator.c | 41 +++++++++++
drivers/mmc/host/cqhci-core.c | 44 +++++------
drivers/mmc/host/sdhci-sprd.c | 25 +++++++
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 +-
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 2 +-
.../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +-
drivers/net/ethernet/realtek/r8169_main.c | 23 +++++-
drivers/net/ethernet/renesas/ravb_main.c | 30 ++++++--
drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +
drivers/net/hyperv/netvsc_drv.c | 25 ++++---
drivers/pinctrl/core.c | 6 +-
drivers/usb/core/config.c | 85 +++++++++++-----------
drivers/video/fbdev/sticore.h | 2 +-
fs/btrfs/disk-io.c | 1 +
fs/btrfs/ref-verify.c | 2 +
fs/btrfs/send.c | 2 +-
fs/btrfs/super.c | 5 +-
fs/btrfs/volumes.c | 9 ++-
fs/cifs/cifsfs.c | 1 +
fs/cifs/xattr.c | 5 +-
fs/inode.c | 16 ++++
fs/iomap/direct-io.c | 22 +++---
include/linux/fs.h | 45 +++++++++++-
include/linux/mmc/host.h | 3 +
include/linux/platform_data/x86/soc.h | 65 +++++++++++++++++
include/linux/workqueue.h | 1 +
include/uapi/linux/stddef.h | 2 +-
kernel/rcu/tree_plugin.h | 8 +-
kernel/workqueue.c | 9 +++
lib/errname.c | 6 --
net/8021q/vlan.h | 2 +-
net/8021q/vlan_dev.c | 15 +++-
net/8021q/vlan_netlink.c | 7 +-
net/ipv4/igmp.c | 6 +-
sound/pci/hda/hda_intel.c | 2 +
sound/pci/hda/patch_realtek.c | 12 +++
sound/soc/intel/common/soc-intel-quirks.h | 51 +------------
sound/soc/sof/sof-pci-dev.c | 62 ++++++++++++----
tools/arch/parisc/include/uapi/asm/errno.h | 2 -
tools/perf/util/intel-pt.c | 2 +
tools/testing/selftests/net/ipsec.c | 4 +-
tools/testing/selftests/resctrl/Makefile | 4 +-
tools/testing/selftests/resctrl/resctrl.h | 1 -
59 files changed, 550 insertions(+), 244 deletions(-)
This is the start of the stable review cycle for the 4.19.301 release.
There are 63 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Dec 2023 18:32:16 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.301-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.301-rc2
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Retry commands in CQE error recovery
Zheng Yongjun <zhengyongjun3(a)huawei.com>
mmc: core: convert comma to semicolon
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Fix task clearing in CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Warn of halt or task clear failure
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Increase recovery halt timeout
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: don't warn for disabling a non-existing frequency
Mimi Zohar <zohar(a)linux.ibm.com>
ima: detect changes to the backing overlay file
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
ovl: skip overlayfs superblocks at global sync
Amir Goldstein <amir73il(a)gmail.com>
ima: annotate iint mutex to avoid lockdep false positive warnings
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
Linus Walleij <linus.walleij(a)linaro.org>
mtd: cfi_cmdset_0001: Byte swap OTP info
Jean-Philippe Brucker <jean-philippe(a)linaro.org>
mtd: cfi_cmdset_0001: Support the absence of protection registers
Heiko Carstens <hca(a)linux.ibm.com>
s390/cmma: fix detection of DAT pages
Alexander Gordeev <agordeev(a)linux.ibm.com>
s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
Steve French <stfrench(a)microsoft.com>
smb3: fix touch -h of symlink
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Start TX queues after HW initialization succeeded
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
ravb: Fix races between ravb_tx_timeout_work() and net related ops
Zhengchao Shao <shaozhengchao(a)huawei.com>
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
Max Nguyen <maxwell.nguyen(a)hp.com>
Input: xpad - add HyperX Clutch Gladiate Support
Jann Horn <jannh(a)google.com>
btrfs: send: ensure send_fd is writable
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix off-by-one when checking chunk map includes logical address
Timothy Pearson <tpearson(a)raptorengineering.com>
powerpc: Don't clobber f0/vs0 during fp|altivec register save
Markus Weippert <markus(a)gekmihesg.de>
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
Wu Bo <bo.wu(a)vivo.com>
dm verity: don't perform FEC for failed readahead IO
Mikulas Patocka <mpatocka(a)redhat.com>
dm-verity: align struct dm_verity_fec_io properly
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Headset Mic VREF to 100%
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Disable power-save on KONTRON SinglePC
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Do not lose cache flush during CQE error recovery
Yang Yingliang <yangyingliang(a)huawei.com>
firewire: core: fix possible memory leak in create_units()
Maria Yu <quic_aiquny(a)quicinc.com>
pinctrl: avoid reload of p state in list iteration
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix wakeup after probe deferral
Ricardo Ribalda <ribalda(a)chromium.org>
usb: dwc3: set the dma max_seg_size
Oliver Neukum <oneukum(a)suse.com>
USB: dwc2: write HCINT with INTMASK applied
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: don't claim interface 4 for ZTE MF290
Puliang Lu <puliang.lu(a)fibocom.com>
USB: serial: option: fix FM101R-GL defines
Victor Fragoso <victorffs(a)hotmail.com>
USB: serial: option: add Fibocom L7xx modules
Rand Deeb <rand.sec96(a)gmail.com>
bcache: prevent potential division by zero error
Coly Li <colyli(a)suse.de>
bcache: check return value from btree_node_alloc_replacement()
Mikulas Patocka <mpatocka(a)redhat.com>
dm-delay: fix a race between delay_presuspend and delay_bio
Long Li <longli(a)microsoft.com>
hv_netvsc: Mark VF as slave before exposing it to user-mode
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix race of register_netdevice_notifier and VF register
Asuna Yang <spriteovo(a)gmail.com>
USB: serial: option: add Luat Air72*U series products
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: protect device queue against concurrent access
Coly Li <colyli(a)suse.de>
bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
Claire Lin <claire.lin(a)broadcom.com>
mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips
Andrew Murray <andrew.murray(a)arm.com>
KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
Andrew Murray <andrew.murray(a)arm.com>
arm64: cpufeature: Extract capped perfmon fields
Huacai Chen <chenhuacai(a)loongson.cn>
MIPS: KVM: Fix a build warning about variable set but not used
Samuel Holland <samuel.holland(a)sifive.com>
net: axienet: Fix check for partial TX checksum
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: propagate the correct speed and duplex status
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle the corner-case during tx completion
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle corner-case during sfp hotplug
Stefano Stabellini <sstabellini(a)kernel.org>
arm/xen: fix xen_vcpu_info allocation alignment
Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com>
net: usb: ax88179_178a: fix failed operations during ax88179_reset
Kunwu Chan <chentao(a)kylinos.cn>
ipv4: Correct/silence an endian warning in __ip_do_redirect
Charles Yi <be286(a)163.com>
HID: fix HID device resource race between HID core and debugging support
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: core: store the unique system identifier in hid_device
Jonas Karlman <jonas(a)kwiboo.se>
drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
Chen Ni <nichen(a)iscas.ac.cn>
ata: pata_isapnp: Add missing error check for devm_ioport_map()
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 timings
Christopher Bednarz <christopher.n.bednarz(a)intel.com>
RDMA/irdma: Prevent zero-length STAG registration
Saravana Kannan <saravanak(a)google.com>
driver core: Release all resources during unbind before updating device links
-------------
Diffstat:
Makefile | 4 +-
arch/arm/xen/enlighten.c | 3 +-
arch/arm64/include/asm/cpufeature.h | 23 +++++++++++
arch/arm64/include/asm/sysreg.h | 6 +++
arch/arm64/kvm/sys_regs.c | 10 +++++
arch/mips/kvm/mmu.c | 3 +-
arch/powerpc/kernel/fpu.S | 13 ++++++
arch/powerpc/kernel/vector.S | 2 +
arch/s390/mm/page-states.c | 14 +++----
drivers/ata/pata_isapnp.c | 3 ++
drivers/base/dd.c | 4 +-
drivers/cpufreq/imx6q-cpufreq.c | 32 ++++++++-------
drivers/firewire/core-device.c | 11 ++----
drivers/gpu/drm/panel/panel-simple.c | 12 +++---
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +++++--
drivers/hid/hid-core.c | 16 ++++++--
drivers/hid/hid-debug.c | 3 ++
drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 +++
drivers/infiniband/hw/i40iw/i40iw_type.h | 2 +
drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 ++++-
drivers/input/joystick/xpad.c | 2 +
drivers/md/bcache/btree.c | 6 ++-
drivers/md/bcache/sysfs.c | 2 +-
drivers/md/dm-delay.c | 17 +++++---
drivers/md/dm-verity-fec.c | 3 +-
drivers/md/dm-verity-target.c | 4 +-
drivers/md/dm-verity.h | 6 ---
drivers/mmc/core/block.c | 2 +
drivers/mmc/core/core.c | 15 ++++---
drivers/mmc/host/cqhci.c | 44 ++++++++++-----------
drivers/mtd/chips/cfi_cmdset_0001.c | 29 +++++++++++---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 5 ++-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 +++++++
drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 ++++--
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 ++++++-
drivers/net/ethernet/renesas/ravb_main.c | 15 +++++--
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
drivers/net/hyperv/netvsc_drv.c | 41 +++++++++++++------
drivers/net/usb/ax88179_178a.c | 4 +-
drivers/pinctrl/core.c | 6 +--
drivers/s390/block/dasd.c | 24 ++++++------
drivers/usb/dwc2/hcd_intr.c | 15 ++++---
drivers/usb/dwc3/core.c | 2 +
drivers/usb/dwc3/dwc3-qcom.c | 8 ++--
drivers/usb/serial/option.c | 11 ++++--
drivers/video/fbdev/sticore.h | 2 +-
fs/btrfs/send.c | 2 +-
fs/btrfs/volumes.c | 2 +-
fs/cifs/cifsfs.c | 1 +
fs/overlayfs/super.c | 5 ++-
fs/sync.c | 3 +-
include/linux/fs.h | 2 +
include/linux/hid.h | 5 +++
net/ipv4/igmp.c | 6 ++-
net/ipv4/route.c | 2 +-
security/integrity/iint.c | 48 +++++++++++++++++------
security/integrity/ima/ima_api.c | 5 +++
security/integrity/ima/ima_main.c | 16 +++++++-
security/integrity/integrity.h | 2 +
sound/pci/hda/hda_intel.c | 2 +
sound/pci/hda/patch_realtek.c | 9 +++++
61 files changed, 434 insertions(+), 171 deletions(-)
A refcount issue can appeared in __fwnode_link_del() due to the
pr_debug() call:
WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110
Call Trace:
<TASK>
...
of_node_get+0x1e/0x30
of_fwnode_get+0x28/0x40
fwnode_full_name_string+0x34/0x90
fwnode_string+0xdb/0x140
...
vsnprintf+0x17b/0x630
...
__fwnode_link_del+0x25/0xa0
fwnode_links_purge+0x39/0xb0
of_node_release+0xd9/0x180
...
Indeed, an fwnode (of_node) is being destroyed and so, of_node_release()
is called because the of_node refcount reached 0.
From of_node_release() several function calls are done and lead to
a pr_debug() calls with %pfwf to print the fwnode full name.
The issue is not present if we change %pfwf to %pfwP.
To print the full name, %pfwf iterates over the current node and its
parents and obtain/drop a reference to all nodes involved.
In order to allow to print the full name (%pfwf) of a node while it is
being destroyed, do not obtain/drop a reference to this current node.
Fixes: a92eb7621b9f ("lib/vsprintf: Make use of fwnode API to obtain node names and separators")
Cc: stable(a)vger.kernel.org
Signed-off-by: Herve Codina <herve.codina(a)bootlin.com>
Reviewed-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
---
Changes v2 -> v3
- Fix typo in comment ("ie parents node" -> "i.e. parent nodes")
- Add 'Reviewed-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>'
- Add 'Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>'
Changes v1 -> v2
- Avoid handling current node out of the loop. Instead obtain/drop references
in the loop based on the depth value.
- Remove some of the backtrace lines in the commit log.
lib/vsprintf.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index afb88b24fa74..2aa408441cd3 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2110,15 +2110,20 @@ char *fwnode_full_name_string(struct fwnode_handle *fwnode, char *buf,
/* Loop starting from the root node to the current node. */
for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {
- struct fwnode_handle *__fwnode =
- fwnode_get_nth_parent(fwnode, depth);
+ /*
+ * Only get a reference for other nodes (i.e. parent nodes).
+ * fwnode refcount may be 0 here.
+ */
+ struct fwnode_handle *__fwnode = depth ?
+ fwnode_get_nth_parent(fwnode, depth) : fwnode;
buf = string(buf, end, fwnode_get_name_prefix(__fwnode),
default_str_spec);
buf = string(buf, end, fwnode_get_name(__fwnode),
default_str_spec);
- fwnode_handle_put(__fwnode);
+ if (depth)
+ fwnode_handle_put(__fwnode);
}
return buf;
--
2.41.0
Currently EROFS can map another compressed buffer for inplace
decompression, that was used to handle the cases that some pages of
compressed data are actually not in-place I/O.
However, like most simple LZ77 algorithms, LZ4 expects the compressed
data is arranged at the end of the decompressed buffer and it
explicitly uses memmove() to handle overlapping:
__________________________________________________________
|_ direction of decompression --> ____ |_ compressed data _|
Although EROFS arranges compressed data like this, it typically maps two
individual virtual buffers so the relative order is uncertain.
Previously, it was hardly observed since LZ4 only uses memmove() for
short overlapped literals and x86/arm64 memmove implementations seem to
completely cover it up and they don't have this issue. Juhyung reported
that EROFS data corruption can be found on a new Intel x86 processor.
After some analysis, it seems that recent x86 processors with the new
FSRM feature expose this issue with "rep movsb".
Let's strictly use the decompressed buffer for lz4 inplace
decompression for now. Later, as an useful improvement, we could try
to tie up these two buffers together in the correct order.
Reported-and-tested-by: Juhyung Park <qkrwngud825(a)gmail.com>
Closes: https://lore.kernel.org/r/CAD14+f2AVKf8Fa2OO1aAUdDNTDsVzzR6ctU_oJSmTyd6zSYR…
Fixes: 0ffd71bcc3a0 ("staging: erofs: introduce LZ4 decompression inplace")
Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend")
Cc: stable <stable(a)vger.kernel.org> # 5.4+
Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com>
---
changes since v1:
- address some nits pointed out by Juhyung.
fs/erofs/decompressor.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 5ec11f5024b7..d08a6ee23ac5 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -121,11 +121,11 @@ static int z_erofs_lz4_prepare_dstpages(struct z_erofs_lz4_decompress_ctx *ctx,
}
static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx,
- void *inpage, unsigned int *inputmargin, int *maptype,
- bool may_inplace)
+ void *inpage, void *out, unsigned int *inputmargin,
+ int *maptype, bool may_inplace)
{
struct z_erofs_decompress_req *rq = ctx->rq;
- unsigned int omargin, total, i, j;
+ unsigned int omargin, total, i;
struct page **in;
void *src, *tmp;
@@ -135,12 +135,13 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx,
omargin < LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize))
goto docopy;
- for (i = 0; i < ctx->inpages; ++i) {
- DBG_BUGON(rq->in[i] == NULL);
- for (j = 0; j < ctx->outpages - ctx->inpages + i; ++j)
- if (rq->out[j] == rq->in[i])
- goto docopy;
- }
+ for (i = 0; i < ctx->inpages; ++i)
+ if (rq->out[ctx->outpages - ctx->inpages + i] !=
+ rq->in[i])
+ goto docopy;
+ kunmap_local(inpage);
+ *maptype = 3;
+ return out + ((ctx->outpages - ctx->inpages) << PAGE_SHIFT);
}
if (ctx->inpages <= 1) {
@@ -148,7 +149,6 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_lz4_decompress_ctx *ctx,
return inpage;
}
kunmap_local(inpage);
- might_sleep();
src = erofs_vm_map_ram(rq->in, ctx->inpages);
if (!src)
return ERR_PTR(-ENOMEM);
@@ -204,12 +204,12 @@ int z_erofs_fixup_insize(struct z_erofs_decompress_req *rq, const char *padbuf,
}
static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx,
- u8 *out)
+ u8 *dst)
{
struct z_erofs_decompress_req *rq = ctx->rq;
bool support_0padding = false, may_inplace = false;
unsigned int inputmargin;
- u8 *headpage, *src;
+ u8 *out, *headpage, *src;
int ret, maptype;
DBG_BUGON(*rq->in == NULL);
@@ -230,11 +230,12 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx,
}
inputmargin = rq->pageofs_in;
- src = z_erofs_lz4_handle_overlap(ctx, headpage, &inputmargin,
+ src = z_erofs_lz4_handle_overlap(ctx, headpage, dst, &inputmargin,
&maptype, may_inplace);
if (IS_ERR(src))
return PTR_ERR(src);
+ out = dst + rq->pageofs_out;
/* legacy format could compress extra data in a pcluster. */
if (rq->partial_decoding || !support_0padding)
ret = LZ4_decompress_safe_partial(src + inputmargin, out,
@@ -265,7 +266,7 @@ static int z_erofs_lz4_decompress_mem(struct z_erofs_lz4_decompress_ctx *ctx,
vm_unmap_ram(src, ctx->inpages);
} else if (maptype == 2) {
erofs_put_pcpubuf(src);
- } else {
+ } else if (maptype != 3) {
DBG_BUGON(1);
return -EFAULT;
}
@@ -308,7 +309,7 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq,
}
dstmap_out:
- ret = z_erofs_lz4_decompress_mem(&ctx, dst + rq->pageofs_out);
+ ret = z_erofs_lz4_decompress_mem(&ctx, dst);
if (!dst_maptype)
kunmap_local(dst);
else if (dst_maptype == 2)
--
2.39.3
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x d839a656d0f3caca9f96e9bf912fd394ac6a11bc
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023120318-banana-quilt-5997@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
d839a656d0f3 ("kprobes: consistent rcu api usage for kretprobe holder")
4bbd93455659 ("kprobes: kretprobe scalability improvement")
8865aea0471c ("kernel: kprobes: Use struct_size()")
195b9cb5b288 ("fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free()")
5f81018753df ("fprobe: Release rethook after the ftrace_ops is unregistered")
76d0de5729c0 ("fprobe: Pass entry_data to handlers")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From d839a656d0f3caca9f96e9bf912fd394ac6a11bc Mon Sep 17 00:00:00 2001
From: JP Kobryn <inwardvessel(a)gmail.com>
Date: Fri, 1 Dec 2023 14:53:55 +0900
Subject: [PATCH] kprobes: consistent rcu api usage for kretprobe holder
It seems that the pointer-to-kretprobe "rp" within the kretprobe_holder is
RCU-managed, based on the (non-rethook) implementation of get_kretprobe().
The thought behind this patch is to make use of the RCU API where possible
when accessing this pointer so that the needed barriers are always in place
and to self-document the code.
The __rcu annotation to "rp" allows for sparse RCU checking. Plain writes
done to the "rp" pointer are changed to make use of the RCU macro for
assignment. For the single read, the implementation of get_kretprobe()
is simplified by making use of an RCU macro which accomplishes the same,
but note that the log warning text will be more generic.
I did find that there is a difference in assembly generated between the
usage of the RCU macros vs without. For example, on arm64, when using
rcu_assign_pointer(), the corresponding store instruction is a
store-release (STLR) which has an implicit barrier. When normal assignment
is done, a regular store (STR) is found. In the macro case, this seems to
be a result of rcu_assign_pointer() using smp_store_release() when the
value to write is not NULL.
Link: https://lore.kernel.org/all/20231122132058.3359-1-inwardvessel@gmail.com/
Fixes: d741bf41d7c7 ("kprobes: Remove kretprobe hash")
Cc: stable(a)vger.kernel.org
Signed-off-by: JP Kobryn <inwardvessel(a)gmail.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index ab1da3142b06..64672bace560 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -139,7 +139,7 @@ static inline bool kprobe_ftrace(struct kprobe *p)
*
*/
struct kretprobe_holder {
- struct kretprobe *rp;
+ struct kretprobe __rcu *rp;
struct objpool_head pool;
};
@@ -245,10 +245,7 @@ unsigned long kretprobe_trampoline_handler(struct pt_regs *regs,
static nokprobe_inline struct kretprobe *get_kretprobe(struct kretprobe_instance *ri)
{
- RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(),
- "Kretprobe is accessed from instance under preemptive context");
-
- return READ_ONCE(ri->rph->rp);
+ return rcu_dereference_check(ri->rph->rp, rcu_read_lock_any_held());
}
static nokprobe_inline unsigned long get_kretprobe_retaddr(struct kretprobe_instance *ri)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 075a632e6c7c..d5a0ee40bf66 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2252,7 +2252,7 @@ int register_kretprobe(struct kretprobe *rp)
rp->rph = NULL;
return -ENOMEM;
}
- rp->rph->rp = rp;
+ rcu_assign_pointer(rp->rph->rp, rp);
rp->nmissed = 0;
/* Establish function entry probe point */
ret = register_kprobe(&rp->kp);
@@ -2300,7 +2300,7 @@ void unregister_kretprobes(struct kretprobe **rps, int num)
#ifdef CONFIG_KRETPROBE_ON_RETHOOK
rethook_free(rps[i]->rh);
#else
- rps[i]->rph->rp = NULL;
+ rcu_assign_pointer(rps[i]->rph->rp, NULL);
#endif
}
mutex_unlock(&kprobe_mutex);
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
It use to be that only the top level instance had a snapshot buffer (for
latency tracers like wakeup and irqsoff). When stopping a tracer in an
instance would not disable the snapshot buffer. This could have some
unintended consequences if the irqsoff tracer is enabled.
Consolidate the tracing_start/stop() with tracing_start/stop_tr() so that
all instances behave the same. The tracing_start/stop() functions will
just call their respective tracing_start/stop_tr() with the global_array
passed in.
Cc: stable(a)vger.kernel.org
Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 110 +++++++++++++------------------------------
1 file changed, 34 insertions(+), 76 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e978868b1a22..2492c6c76850 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2360,13 +2360,7 @@ int is_tracing_stopped(void)
return global_trace.stop_count;
}
-/**
- * tracing_start - quick start of the tracer
- *
- * If tracing is enabled but was stopped by tracing_stop,
- * this will start the tracer back up.
- */
-void tracing_start(void)
+static void tracing_start_tr(struct trace_array *tr)
{
struct trace_buffer *buffer;
unsigned long flags;
@@ -2374,119 +2368,83 @@ void tracing_start(void)
if (tracing_disabled)
return;
- raw_spin_lock_irqsave(&global_trace.start_lock, flags);
- if (--global_trace.stop_count) {
- if (global_trace.stop_count < 0) {
+ raw_spin_lock_irqsave(&tr->start_lock, flags);
+ if (--tr->stop_count) {
+ if (WARN_ON_ONCE(tr->stop_count < 0)) {
/* Someone screwed up their debugging */
- WARN_ON_ONCE(1);
- global_trace.stop_count = 0;
+ tr->stop_count = 0;
}
goto out;
}
/* Prevent the buffers from switching */
- arch_spin_lock(&global_trace.max_lock);
+ arch_spin_lock(&tr->max_lock);
- buffer = global_trace.array_buffer.buffer;
+ buffer = tr->array_buffer.buffer;
if (buffer)
ring_buffer_record_enable(buffer);
#ifdef CONFIG_TRACER_MAX_TRACE
- buffer = global_trace.max_buffer.buffer;
+ buffer = tr->max_buffer.buffer;
if (buffer)
ring_buffer_record_enable(buffer);
#endif
- arch_spin_unlock(&global_trace.max_lock);
-
- out:
- raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
-}
-
-static void tracing_start_tr(struct trace_array *tr)
-{
- struct trace_buffer *buffer;
- unsigned long flags;
-
- if (tracing_disabled)
- return;
-
- /* If global, we need to also start the max tracer */
- if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
- return tracing_start();
-
- raw_spin_lock_irqsave(&tr->start_lock, flags);
-
- if (--tr->stop_count) {
- if (tr->stop_count < 0) {
- /* Someone screwed up their debugging */
- WARN_ON_ONCE(1);
- tr->stop_count = 0;
- }
- goto out;
- }
-
- buffer = tr->array_buffer.buffer;
- if (buffer)
- ring_buffer_record_enable(buffer);
+ arch_spin_unlock(&tr->max_lock);
out:
raw_spin_unlock_irqrestore(&tr->start_lock, flags);
}
/**
- * tracing_stop - quick stop of the tracer
+ * tracing_start - quick start of the tracer
*
- * Light weight way to stop tracing. Use in conjunction with
- * tracing_start.
+ * If tracing is enabled but was stopped by tracing_stop,
+ * this will start the tracer back up.
*/
-void tracing_stop(void)
+void tracing_start(void)
+
+{
+ return tracing_start_tr(&global_trace);
+}
+
+static void tracing_stop_tr(struct trace_array *tr)
{
struct trace_buffer *buffer;
unsigned long flags;
- raw_spin_lock_irqsave(&global_trace.start_lock, flags);
- if (global_trace.stop_count++)
+ raw_spin_lock_irqsave(&tr->start_lock, flags);
+ if (tr->stop_count++)
goto out;
/* Prevent the buffers from switching */
- arch_spin_lock(&global_trace.max_lock);
+ arch_spin_lock(&tr->max_lock);
- buffer = global_trace.array_buffer.buffer;
+ buffer = tr->array_buffer.buffer;
if (buffer)
ring_buffer_record_disable(buffer);
#ifdef CONFIG_TRACER_MAX_TRACE
- buffer = global_trace.max_buffer.buffer;
+ buffer = tr->max_buffer.buffer;
if (buffer)
ring_buffer_record_disable(buffer);
#endif
- arch_spin_unlock(&global_trace.max_lock);
+ arch_spin_unlock(&tr->max_lock);
out:
- raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
+ raw_spin_unlock_irqrestore(&tr->start_lock, flags);
}
-static void tracing_stop_tr(struct trace_array *tr)
+/**
+ * tracing_stop - quick stop of the tracer
+ *
+ * Light weight way to stop tracing. Use in conjunction with
+ * tracing_start.
+ */
+void tracing_stop(void)
{
- struct trace_buffer *buffer;
- unsigned long flags;
-
- /* If global, we need to also stop the max tracer */
- if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
- return tracing_stop();
-
- raw_spin_lock_irqsave(&tr->start_lock, flags);
- if (tr->stop_count++)
- goto out;
-
- buffer = tr->array_buffer.buffer;
- if (buffer)
- ring_buffer_record_disable(buffer);
-
- out:
- raw_spin_unlock_irqrestore(&tr->start_lock, flags);
+ return tracing_stop_tr(&global_trace);
}
static int trace_save_cmdline(struct task_struct *tsk)
--
2.42.0
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
When the ring buffer is being resized, it can cause side effects to the
running tracer. For instance, there's a race with irqsoff tracer that
swaps individual per cpu buffers between the main buffer and the snapshot
buffer. The resize operation modifies the main buffer and then the
snapshot buffer. If a swap happens in between those two operations it will
break the tracer.
Simply stop the running tracer before resizing the buffers and enable it
again when finished.
Cc: stable(a)vger.kernel.org
Fixes: 3928a8a2d9808 ("ftrace: make work with new ring buffer")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 231c173ec04f..e978868b1a22 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6387,9 +6387,12 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
if (!tr->array_buffer.buffer)
return 0;
+ /* Do not allow tracing while resizng ring buffer */
+ tracing_stop_tr(tr);
+
ret = ring_buffer_resize(tr->array_buffer.buffer, size, cpu);
if (ret < 0)
- return ret;
+ goto out_start;
#ifdef CONFIG_TRACER_MAX_TRACE
if (!tr->current_trace->use_max_tr)
@@ -6417,7 +6420,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
WARN_ON(1);
tracing_disabled = 1;
}
- return ret;
+ goto out_start;
}
update_buffer_entries(&tr->max_buffer, cpu);
@@ -6426,7 +6429,8 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
#endif /* CONFIG_TRACER_MAX_TRACE */
update_buffer_entries(&tr->array_buffer, cpu);
-
+ out_start:
+ tracing_start_tr(tr);
return ret;
}
--
2.42.0
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
It use to be that only the top level instance had a snapshot buffer (for
latency tracers like wakeup and irqsoff). The update of the ring buffer
size would check if the instance was the top level and if so, it would
also update the snapshot buffer as it needs to be the same as the main
buffer.
Now that lower level instances also has a snapshot buffer, they too need
to update their snapshot buffer sizes when the main buffer is changed,
otherwise the following can be triggered:
# cd /sys/kernel/tracing
# echo 1500 > buffer_size_kb
# mkdir instances/foo
# echo irqsoff > instances/foo/current_tracer
# echo 1000 > instances/foo/buffer_size_kb
Produces:
WARNING: CPU: 2 PID: 856 at kernel/trace/trace.c:1938 update_max_tr_single.part.0+0x27d/0x320
Which is:
ret = ring_buffer_swap_cpu(tr->max_buffer.buffer, tr->array_buffer.buffer, cpu);
if (ret == -EBUSY) {
[..]
}
WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY); <== here
That's because ring_buffer_swap_cpu() has:
int ret = -EINVAL;
[..]
/* At least make sure the two buffers are somewhat the same */
if (cpu_buffer_a->nr_pages != cpu_buffer_b->nr_pages)
goto out;
[..]
out:
return ret;
}
Instead, update all instances' snapshot buffer sizes when their main
buffer size is updated.
Cc: stable(a)vger.kernel.org
Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 9aebf904ff97..231c173ec04f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6392,8 +6392,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
return ret;
#ifdef CONFIG_TRACER_MAX_TRACE
- if (!(tr->flags & TRACE_ARRAY_FL_GLOBAL) ||
- !tr->current_trace->use_max_tr)
+ if (!tr->current_trace->use_max_tr)
goto out;
ret = ring_buffer_resize(tr->max_buffer.buffer, size, cpu);
--
2.42.0
Dear User,
The Classic version of Ionos will be replaced by our new version on the 6th of December 2023. So it's time to upgrade, before you lose your email access.
Sign in
Note: Please do not ignore this email to avoid your account being closed.
Thanks for choosing Ionos
Ionos account team
The patch titled
Subject: nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
nilfs2-prevent-warning-in-nilfs_sufile_set_segment_usage.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
Date: Tue, 5 Dec 2023 17:59:47 +0900
If nilfs2 reads a disk image with corrupted segment usage metadata, and
its segment usage information is marked as an error for the segment at the
write location, nilfs_sufile_set_segment_usage() can trigger WARN_ONs
during log writing.
Segments newly allocated for writing with nilfs_sufile_alloc() will not
have this error flag set, but this unexpected situation will occur if the
segment indexed by either nilfs->ns_segnum or nilfs->ns_nextnum (active
segment) was marked in error.
Fix this issue by inserting a sanity check to treat it as a file system
corruption.
Since error returns are not allowed during the execution phase where
nilfs_sufile_set_segment_usage() is used, this inserts the sanity check
into nilfs_sufile_mark_dirty() which pre-reads the buffer containing the
segment usage record to be updated and sets it up in a dirty state for
writing.
In addition, nilfs_sufile_set_segment_usage() is also called when
canceling log writing and undoing segment usage update, so in order to
avoid issuing the same kernel warning in that case, in case of
cancellation, avoid checking the error flag in
nilfs_sufile_set_segment_usage().
Link: https://lkml.kernel.org/r/20231205085947.4431-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Reported-by: syzbot+14e9f834f6ddecece094(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=14e9f834f6ddecece094
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/nilfs2/sufile.c | 42 +++++++++++++++++++++++++++++++++++-------
1 file changed, 35 insertions(+), 7 deletions(-)
--- a/fs/nilfs2/sufile.c~nilfs2-prevent-warning-in-nilfs_sufile_set_segment_usage
+++ a/fs/nilfs2/sufile.c
@@ -501,15 +501,38 @@ int nilfs_sufile_mark_dirty(struct inode
down_write(&NILFS_MDT(sufile)->mi_sem);
ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh);
- if (!ret) {
- mark_buffer_dirty(bh);
- nilfs_mdt_mark_dirty(sufile);
- kaddr = kmap_atomic(bh->b_page);
- su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
+ if (ret)
+ goto out_sem;
+
+ kaddr = kmap_atomic(bh->b_page);
+ su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
+ if (unlikely(nilfs_segment_usage_error(su))) {
+ struct the_nilfs *nilfs = sufile->i_sb->s_fs_info;
+
+ kunmap_atomic(kaddr);
+ brelse(bh);
+ if (nilfs_segment_is_active(nilfs, segnum)) {
+ nilfs_error(sufile->i_sb,
+ "active segment %llu is erroneous",
+ (unsigned long long)segnum);
+ } else {
+ /*
+ * Segments marked erroneous are never allocated by
+ * nilfs_sufile_alloc(); only active segments, ie,
+ * the segments indexed by ns_segnum or ns_nextnum,
+ * can be erroneous here.
+ */
+ WARN_ON_ONCE(1);
+ }
+ ret = -EIO;
+ } else {
nilfs_segment_usage_set_dirty(su);
kunmap_atomic(kaddr);
+ mark_buffer_dirty(bh);
+ nilfs_mdt_mark_dirty(sufile);
brelse(bh);
}
+out_sem:
up_write(&NILFS_MDT(sufile)->mi_sem);
return ret;
}
@@ -536,9 +559,14 @@ int nilfs_sufile_set_segment_usage(struc
kaddr = kmap_atomic(bh->b_page);
su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
- WARN_ON(nilfs_segment_usage_error(su));
- if (modtime)
+ if (modtime) {
+ /*
+ * Check segusage error and set su_lastmod only when updating
+ * this entry with a valid timestamp, not for cancellation.
+ */
+ WARN_ON_ONCE(nilfs_segment_usage_error(su));
su->su_lastmod = cpu_to_le64(modtime);
+ }
su->su_nblocks = cpu_to_le32(nblocks);
kunmap_atomic(kaddr);
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
nilfs2-fix-missing-error-check-for-sb_set_blocksize-call.patch
nilfs2-prevent-warning-in-nilfs_sufile_set_segment_usage.patch
nilfs2-move-page-release-outside-of-nilfs_delete_entry-and-nilfs_set_link.patch
nilfs2-eliminate-staggered-calls-to-kunmap-in-nilfs_rename.patch
This is the start of the stable review cycle for the 5.10.203 release.
There are 134 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Dec 2023 04:35:38 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.203-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.203-rc2
Saravana Kannan <saravanak(a)google.com>
driver core: Release all resources during unbind before updating device links
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: fix deadlock on RTL8125 in jumbo mtu mode
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: disable ASPM in case of tx timeout
Wenchao Chen <wenchao.chen(a)unisoc.com>
mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
Heiner Kallweit <hkallweit1(a)gmail.com>
mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Retry commands in CQE error recovery
Zheng Yongjun <zhengyongjun3(a)huawei.com>
mmc: core: convert comma to semicolon
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Fix task clearing in CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Warn of halt or task clear failure
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Increase recovery halt timeout
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: don't warn for disabling a non-existing frequency
Quinn Tran <qutran(a)marvell.com>
scsi: qla2xxx: Fix system crash due to bad pointer access
Bart Van Assche <bvanassche(a)acm.org>
scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Introduce the scsi_cmd_to_rq() function
Steve French <stfrench(a)microsoft.com>
smb3: fix caching of ctime on setxattr
Jeff Layton <jlayton(a)kernel.org>
fs: add ctime accessors infrastructure
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: don't use ATRM for external devices
Rajat Jain <rajatja(a)google.com>
driver core: Move the "removable" attribute from USB to core
Amir Goldstein <amir73il(a)gmail.com>
ima: annotate iint mutex to avoid lockdep false positive warnings
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
Siddharth Vadapalli <s-vadapalli(a)ti.com>
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Add deviceID for AM64 and J7200
Heiko Carstens <hca(a)linux.ibm.com>
s390/cmma: fix detection of DAT pages
Alexander Gordeev <agordeev(a)linux.ibm.com>
s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
Mark Hasemeyer <markhas(a)chromium.org>
ASoC: SOF: sof-pci-dev: Fix community key quirk detection
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: don't use the community key on APL Chromebooks
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: add parameter to override topology filename
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: use community key on all Up boards
Hans de Goede <hdegoede(a)redhat.com>
ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
Steve French <stfrench(a)microsoft.com>
smb3: fix touch -h of symlink
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix async branch flags
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Adjust sample flags for VM-Exit
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Start TX queues after HW initialization succeeded
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Use pm_runtime_resume_and_get()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
ravb: Fix races between ravb_tx_timeout_work() and net related ops
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: prevent potential deadlock in rtl8169_close
Andrey Grodzovsky <andrey.grodzovsky(a)amd.com>
Revert "workqueue: remove unused cancel_work()"
Geetha sowjanya <gakula(a)marvell.com>
octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64
Furong Xu <0x1207(a)gmail.com>
net: stmmac: xgmac: Disable FPE MMC interrupts
Willem de Bruijn <willemb(a)google.com>
selftests/net: mptcp: fix uninitialized variable warnings
Willem de Bruijn <willemb(a)google.com>
selftests/net: ipsec: fix constant out of range
Ioana Ciornei <ioana.ciornei(a)nxp.com>
dpaa2-eth: increase the needed headroom to account for alignment
Zhengchao Shao <shaozhengchao(a)huawei.com>
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
Niklas Neronin <niklas.neronin(a)linux.intel.com>
usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Change configuration warnings to notices
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: fix race of netvsc and VF register_netdevice
Max Nguyen <maxwell.nguyen(a)hp.com>
Input: xpad - add HyperX Clutch Gladiate Support
Filipe Manana <fdmanana(a)suse.com>
btrfs: make error messages more clear when getting a chunk map
Jann Horn <jannh(a)google.com>
btrfs: send: ensure send_fd is writable
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix off-by-one when checking chunk map includes logical address
Bragatheswaran Manickavel <bragathemanick0908(a)gmail.com>
btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod()
Qu Wenruo <wqu(a)suse.com>
btrfs: add dmesg output for first mount and last unmount of a filesystem
Helge Deller <deller(a)gmx.de>
parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes
Timothy Pearson <tpearson(a)raptorengineering.com>
powerpc: Don't clobber f0/vs0 during fp|altivec register save
Abdul Halim, Mohd Syazwan <mohd.syazwan.abdul.halim(a)intel.com>
iommu/vt-d: Add MTL to quirk list to skip TE disabling
Markus Weippert <markus(a)gekmihesg.de>
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
Wu Bo <bo.wu(a)vivo.com>
dm verity: don't perform FEC for failed readahead IO
Mikulas Patocka <mpatocka(a)redhat.com>
dm-verity: align struct dm_verity_fec_io properly
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Add supported ALC257 for ChromeOS
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Headset Mic VREF to 100%
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Disable power-save on KONTRON SinglePC
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Do not lose cache flush during CQE error recovery
Yang Yingliang <yangyingliang(a)huawei.com>
firewire: core: fix possible memory leak in create_units()
Maria Yu <quic_aiquny(a)quicinc.com>
pinctrl: avoid reload of p state in list iteration
Adrian Hunter <adrian.hunter(a)intel.com>
perf inject: Fix GEN_ELF_TEXT_OFFSET for jit
Keith Busch <kbusch(a)kernel.org>
io_uring: fix off-by one bvec index
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix wakeup after probe deferral
Ricardo Ribalda <ribalda(a)chromium.org>
usb: dwc3: set the dma max_seg_size
Alexander Stein <alexander.stein(a)ew.tq-group.com>
usb: dwc3: Fix default mode initialization
Oliver Neukum <oneukum(a)suse.com>
USB: dwc2: write HCINT with INTMASK applied
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: don't claim interface 4 for ZTE MF290
Puliang Lu <puliang.lu(a)fibocom.com>
USB: serial: option: fix FM101R-GL defines
Victor Fragoso <victorffs(a)hotmail.com>
USB: serial: option: add Fibocom L7xx modules
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup lock c->root error
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup init dirty data errors
Rand Deeb <rand.sec96(a)gmail.com>
bcache: prevent potential division by zero error
Coly Li <colyli(a)suse.de>
bcache: check return value from btree_node_alloc_replacement()
Mikulas Patocka <mpatocka(a)redhat.com>
dm-delay: fix a race between delay_presuspend and delay_bio
Long Li <longli(a)microsoft.com>
hv_netvsc: Mark VF as slave before exposing it to user-mode
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix race of register_netdevice_notifier and VF register
Asuna Yang <spriteovo(a)gmail.com>
USB: serial: option: add Luat Air72*U series products
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: protect device queue against concurrent access
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race
Coly Li <colyli(a)suse.de>
bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
Keith Busch <kbusch(a)kernel.org>
swiotlb-xen: provide the "max_mapping_size" method
Hans de Goede <hdegoede(a)redhat.com>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com>
ASoC: simple-card: fixup asoc_simple_probe() error handling
Al Viro <viro(a)zeniv.linux.org.uk>
nfsd: lock_rename() needs both directories to live on the same fs
Zhang Yi <yi.zhang(a)huawei.com>
ext4: make sure allocate pending entry not fail
Baokun Li <libaokun1(a)huawei.com>
ext4: fix slab-use-after-free in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_delayed_block()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: factor out __es_alloc_extent() and __es_free_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: add a new helper to check if es must be kept
Huacai Chen <chenhuacai(a)loongson.cn>
MIPS: KVM: Fix a build warning about variable set but not used
Sakari Ailus <sakari.ailus(a)linux.intel.com>
media: ccs: Correctly initialise try compose rectangle
Peter Zijlstra <peterz(a)infradead.org>
lockdep: Fix block chain corruption
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix ACPI platform device leak
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix resource leaks on probe deferral
Christoph Hellwig <hch(a)lst.de>
nvmet: nul-terminate the NQNs passed in the connect command
Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com>
nvmet: remove unnecessary ctrl parameter
David Howells <dhowells(a)redhat.com>
afs: Fix file locking on R/O volumes to operate in local mode
David Howells <dhowells(a)redhat.com>
afs: Return ENOENT if no cell DNS record can be found
Samuel Holland <samuel.holland(a)sifive.com>
net: axienet: Fix check for partial TX checksum
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: propagate the correct speed and duplex status
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle the corner-case during tx completion
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle corner-case during sfp hotplug
Stefano Stabellini <sstabellini(a)kernel.org>
arm/xen: fix xen_vcpu_info allocation alignment
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: avoid data corruption caused by decline
Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com>
net: usb: ax88179_178a: fix failed operations during ax88179_reset
Kunwu Chan <chentao(a)kylinos.cn>
ipv4: Correct/silence an endian warning in __ip_do_redirect
Charles Yi <be286(a)163.com>
HID: fix HID device resource race between HID core and debugging support
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: core: store the unique system identifier in hid_device
Jonas Karlman <jonas(a)kwiboo.se>
drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
Chen Ni <nichen(a)iscas.ac.cn>
ata: pata_isapnp: Add missing error check for devm_ioport_map()
Eric Dumazet <edumazet(a)google.com>
wireguard: use DEV_STATS_INC()
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 timings
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
Xuxin Xiong <xuxinxiong(a)huaqin.corp-partner.google.com>
drm/panel: auo,b101uan08.3: Fine tune the panel power sequence
Shuijing Li <shuijing.li(a)mediatek.com>
drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence
David Howells <dhowells(a)redhat.com>
afs: Make error on cell lookup failure consistent with OpenAFS
David Howells <dhowells(a)redhat.com>
afs: Fix afs_server_list to be cleaned up with RCU
Heiner Kallweit <hkallweit1(a)gmail.com>
Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
Neil Armstrong <narmstrong(a)baylibre.com>
tty: serial: meson: retrieve port FIFO size from DT
Takashi Iwai <tiwai(a)suse.de>
media: imon: fix access to invalid resource for the second interface
Axel Lin <axel.lin(a)ingics.com>
i2c: sun6i-p2wi: Prevent potential division by zero
Qu Huang <qu.huang(a)linux.dev>
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
Patrick Thompson <ptf(a)google.com>
net: r8169: Disable multicast filter for RTL8168H and RTL8107E
Nathan Chancellor <nathan(a)kernel.org>
PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
Christopher Bednarz <christopher.n.bednarz(a)intel.com>
RDMA/irdma: Prevent zero-length STAG registration
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-usb | 11 -
Documentation/ABI/testing/sysfs-devices-removable | 17 ++
Makefile | 4 +-
arch/arm/xen/enlighten.c | 3 +-
arch/mips/kvm/mmu.c | 3 +-
arch/parisc/include/uapi/asm/errno.h | 2 -
arch/powerpc/kernel/fpu.S | 13 +
arch/powerpc/kernel/vector.S | 2 +
arch/s390/mm/page-states.c | 14 +-
drivers/acpi/resource.c | 7 +
drivers/ata/pata_isapnp.c | 3 +
drivers/base/core.c | 28 ++
drivers/base/dd.c | 4 +-
drivers/cpufreq/imx6q-cpufreq.c | 32 ++-
drivers/firewire/core-device.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 5 +
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 7 +
drivers/gpu/drm/panel/panel-simple.c | 13 +-
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +-
drivers/hid/hid-core.c | 16 +-
drivers/hid/hid-debug.c | 3 +
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +
drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 +
drivers/infiniband/hw/i40iw/i40iw_type.h | 2 +
drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 +-
drivers/input/joystick/xpad.c | 2 +
drivers/iommu/intel/iommu.c | 2 +-
drivers/md/bcache/btree.c | 6 +-
drivers/md/bcache/sysfs.c | 2 +-
drivers/md/bcache/writeback.c | 22 +-
drivers/md/dm-delay.c | 17 +-
drivers/md/dm-verity-fec.c | 3 +-
drivers/md/dm-verity-target.c | 4 +-
drivers/md/dm-verity.h | 6 -
drivers/media/i2c/smiapp/smiapp-core.c | 2 +-
drivers/media/rc/imon.c | 6 +
drivers/misc/pci_endpoint_test.c | 12 +
drivers/mmc/core/block.c | 2 +
drivers/mmc/core/core.c | 15 +-
drivers/mmc/core/regulator.c | 41 +++
drivers/mmc/host/cqhci.c | 44 +--
drivers/mmc/host/sdhci-sprd.c | 25 ++
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 +
drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 +-
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +-
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 +-
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 2 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +-
drivers/net/ethernet/realtek/r8169_main.c | 23 +-
drivers/net/ethernet/renesas/ravb_main.c | 20 +-
drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
drivers/net/hyperv/netvsc_drv.c | 66 +++--
drivers/net/usb/ax88179_178a.c | 4 +-
drivers/net/wireguard/device.c | 4 +-
drivers/net/wireguard/receive.c | 12 +-
drivers/net/wireguard/send.c | 3 +-
drivers/nvme/target/core.c | 21 +-
drivers/nvme/target/fabrics-cmd.c | 15 +-
drivers/nvme/target/nvmet.h | 5 +-
drivers/pci/controller/dwc/pci-keystone.c | 8 +-
drivers/pinctrl/core.c | 6 +-
drivers/s390/block/dasd.c | 24 +-
drivers/scsi/qla2xxx/qla_os.c | 14 +-
drivers/tty/serial/meson_uart.c | 2 +
drivers/usb/core/config.c | 85 +++---
drivers/usb/core/hub.c | 13 +-
drivers/usb/core/sysfs.c | 24 --
drivers/usb/dwc2/hcd_intr.c | 15 +-
drivers/usb/dwc3/core.c | 2 +
drivers/usb/dwc3/drd.c | 2 +-
drivers/usb/dwc3/dwc3-qcom.c | 52 +++-
drivers/usb/serial/option.c | 11 +-
drivers/video/fbdev/sticore.h | 2 +-
drivers/xen/swiotlb-xen.c | 1 +
fs/afs/dynroot.c | 4 +-
fs/afs/internal.h | 1 +
fs/afs/server_list.c | 2 +-
fs/afs/super.c | 2 +
fs/afs/vl_rotate.c | 10 +
fs/btrfs/disk-io.c | 1 +
fs/btrfs/ref-verify.c | 2 +
fs/btrfs/send.c | 2 +-
fs/btrfs/super.c | 5 +-
fs/btrfs/volumes.c | 9 +-
fs/cifs/cifsfs.c | 1 +
fs/cifs/xattr.c | 5 +-
fs/ext4/extents_status.c | 306 +++++++++++++++------
fs/inode.c | 16 ++
fs/nfsd/vfs.c | 12 +-
include/linux/device.h | 37 +++
include/linux/fs.h | 45 ++-
include/linux/hid.h | 5 +
include/linux/mmc/host.h | 3 +
include/linux/platform_data/x86/soc.h | 65 +++++
include/linux/usb.h | 7 -
include/linux/workqueue.h | 1 +
include/scsi/scsi_cmnd.h | 6 +
io_uring/io_uring.c | 2 +-
kernel/locking/lockdep.c | 3 +-
kernel/workqueue.c | 9 +
lib/errname.c | 6 -
net/ipv4/igmp.c | 6 +-
net/ipv4/route.c | 2 +-
net/smc/af_smc.c | 8 +-
security/integrity/iint.c | 48 +++-
sound/pci/hda/hda_intel.c | 2 +
sound/pci/hda/patch_realtek.c | 12 +
sound/soc/generic/simple-card.c | 6 +-
sound/soc/intel/common/soc-intel-quirks.h | 51 +---
sound/soc/sof/sof-pci-dev.c | 62 ++++-
tools/arch/parisc/include/uapi/asm/errno.h | 2 -
tools/perf/util/genelf.h | 4 +-
tools/perf/util/intel-pt.c | 13 +-
tools/testing/selftests/net/ipsec.c | 4 +-
tools/testing/selftests/net/mptcp/mptcp_connect.c | 11 +-
117 files changed, 1228 insertions(+), 518 deletions(-)
This is the start of the stable review cycle for the 5.4.263 release.
There are 93 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Dec 2023 04:35:52 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.263-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.263-rc2
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Retry commands in CQE error recovery
Zheng Yongjun <zhengyongjun3(a)huawei.com>
mmc: core: convert comma to semicolon
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Fix task clearing in CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Warn of halt or task clear failure
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Increase recovery halt timeout
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: don't warn for disabling a non-existing frequency
Quinn Tran <qutran(a)marvell.com>
scsi: qla2xxx: Fix system crash due to bad pointer access
Bart Van Assche <bvanassche(a)acm.org>
scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Introduce the scsi_cmd_to_rq() function
Bart Van Assche <bvanassche(a)acm.org>
scsi: qla2xxx: Simplify the code for aborting SCSI commands
Mimi Zohar <zohar(a)linux.ibm.com>
ima: detect changes to the backing overlay file
Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru>
ovl: skip overlayfs superblocks at global sync
Amir Goldstein <amir73il(a)gmail.com>
ima: annotate iint mutex to avoid lockdep false positive warnings
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
Linus Walleij <linus.walleij(a)linaro.org>
mtd: cfi_cmdset_0001: Byte swap OTP info
Jean-Philippe Brucker <jean-philippe(a)linaro.org>
mtd: cfi_cmdset_0001: Support the absence of protection registers
Heiko Carstens <hca(a)linux.ibm.com>
s390/cmma: fix detection of DAT pages
Alexander Gordeev <agordeev(a)linux.ibm.com>
s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
Steve French <stfrench(a)microsoft.com>
smb3: fix touch -h of symlink
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix async branch flags
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Adjust sample flags for VM-Exit
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Start TX queues after HW initialization succeeded
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Use pm_runtime_resume_and_get()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
ravb: Fix races between ravb_tx_timeout_work() and net related ops
Furong Xu <0x1207(a)gmail.com>
net: stmmac: xgmac: Disable FPE MMC interrupts
Zhengchao Shao <shaozhengchao(a)huawei.com>
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
Max Nguyen <maxwell.nguyen(a)hp.com>
Input: xpad - add HyperX Clutch Gladiate Support
Filipe Manana <fdmanana(a)suse.com>
btrfs: make error messages more clear when getting a chunk map
Jann Horn <jannh(a)google.com>
btrfs: send: ensure send_fd is writable
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix off-by-one when checking chunk map includes logical address
Qu Wenruo <wqu(a)suse.com>
btrfs: add dmesg output for first mount and last unmount of a filesystem
Timothy Pearson <tpearson(a)raptorengineering.com>
powerpc: Don't clobber f0/vs0 during fp|altivec register save
Markus Weippert <markus(a)gekmihesg.de>
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
Wu Bo <bo.wu(a)vivo.com>
dm verity: don't perform FEC for failed readahead IO
Mikulas Patocka <mpatocka(a)redhat.com>
dm-verity: align struct dm_verity_fec_io properly
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Add supported ALC257 for ChromeOS
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Headset Mic VREF to 100%
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Disable power-save on KONTRON SinglePC
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Do not lose cache flush during CQE error recovery
Yang Yingliang <yangyingliang(a)huawei.com>
firewire: core: fix possible memory leak in create_units()
Maria Yu <quic_aiquny(a)quicinc.com>
pinctrl: avoid reload of p state in list iteration
Adrian Hunter <adrian.hunter(a)intel.com>
perf inject: Fix GEN_ELF_TEXT_OFFSET for jit
Keith Busch <kbusch(a)kernel.org>
io_uring: fix off-by one bvec index
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix wakeup after probe deferral
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix resource leaks on probe deferral
Ricardo Ribalda <ribalda(a)chromium.org>
usb: dwc3: set the dma max_seg_size
Oliver Neukum <oneukum(a)suse.com>
USB: dwc2: write HCINT with INTMASK applied
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: don't claim interface 4 for ZTE MF290
Puliang Lu <puliang.lu(a)fibocom.com>
USB: serial: option: fix FM101R-GL defines
Victor Fragoso <victorffs(a)hotmail.com>
USB: serial: option: add Fibocom L7xx modules
Rand Deeb <rand.sec96(a)gmail.com>
bcache: prevent potential division by zero error
Coly Li <colyli(a)suse.de>
bcache: check return value from btree_node_alloc_replacement()
Mikulas Patocka <mpatocka(a)redhat.com>
dm-delay: fix a race between delay_presuspend and delay_bio
Long Li <longli(a)microsoft.com>
hv_netvsc: Mark VF as slave before exposing it to user-mode
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix race of register_netdevice_notifier and VF register
Asuna Yang <spriteovo(a)gmail.com>
USB: serial: option: add Luat Air72*U series products
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: protect device queue against concurrent access
Coly Li <colyli(a)suse.de>
bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
Hans de Goede <hdegoede(a)redhat.com>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
Andrew Murray <andrew.murray(a)arm.com>
KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
Andrew Murray <andrew.murray(a)arm.com>
arm64: cpufeature: Extract capped perfmon fields
Zhang Yi <yi.zhang(a)huawei.com>
ext4: make sure allocate pending entry not fail
Baokun Li <libaokun1(a)huawei.com>
ext4: fix slab-use-after-free in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_delayed_block()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: factor out __es_alloc_extent() and __es_free_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: add a new helper to check if es must be kept
Huacai Chen <chenhuacai(a)loongson.cn>
MIPS: KVM: Fix a build warning about variable set but not used
Christoph Hellwig <hch(a)lst.de>
nvmet: nul-terminate the NQNs passed in the connect command
Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com>
nvmet: remove unnecessary ctrl parameter
David Howells <dhowells(a)redhat.com>
afs: Fix file locking on R/O volumes to operate in local mode
David Howells <dhowells(a)redhat.com>
afs: Return ENOENT if no cell DNS record can be found
Samuel Holland <samuel.holland(a)sifive.com>
net: axienet: Fix check for partial TX checksum
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: propagate the correct speed and duplex status
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle the corner-case during tx completion
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle corner-case during sfp hotplug
Stefano Stabellini <sstabellini(a)kernel.org>
arm/xen: fix xen_vcpu_info allocation alignment
Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com>
net: usb: ax88179_178a: fix failed operations during ax88179_reset
Kunwu Chan <chentao(a)kylinos.cn>
ipv4: Correct/silence an endian warning in __ip_do_redirect
Charles Yi <be286(a)163.com>
HID: fix HID device resource race between HID core and debugging support
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: core: store the unique system identifier in hid_device
Jonas Karlman <jonas(a)kwiboo.se>
drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
Chen Ni <nichen(a)iscas.ac.cn>
ata: pata_isapnp: Add missing error check for devm_ioport_map()
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 timings
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
David Howells <dhowells(a)redhat.com>
afs: Make error on cell lookup failure consistent with OpenAFS
Nathan Chancellor <nathan(a)kernel.org>
PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
Christopher Bednarz <christopher.n.bednarz(a)intel.com>
RDMA/irdma: Prevent zero-length STAG registration
Saravana Kannan <saravanak(a)google.com>
driver core: Release all resources during unbind before updating device links
-------------
Diffstat:
Makefile | 4 +-
arch/arm/xen/enlighten.c | 3 +-
arch/arm64/include/asm/cpufeature.h | 23 ++
arch/arm64/include/asm/sysreg.h | 6 +
arch/arm64/kvm/sys_regs.c | 10 +
arch/mips/kvm/mmu.c | 3 +-
arch/powerpc/kernel/fpu.S | 13 +
arch/powerpc/kernel/vector.S | 2 +
arch/s390/mm/page-states.c | 14 +-
drivers/acpi/resource.c | 7 +
drivers/ata/pata_isapnp.c | 3 +
drivers/base/dd.c | 4 +-
drivers/cpufreq/imx6q-cpufreq.c | 32 +--
drivers/firewire/core-device.c | 11 +-
drivers/gpu/drm/panel/panel-simple.c | 13 +-
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +-
drivers/hid/hid-core.c | 16 +-
drivers/hid/hid-debug.c | 3 +
drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 +
drivers/infiniband/hw/i40iw/i40iw_type.h | 2 +
drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 +-
drivers/input/joystick/xpad.c | 2 +
drivers/md/bcache/btree.c | 6 +-
drivers/md/bcache/sysfs.c | 2 +-
drivers/md/dm-delay.c | 17 +-
drivers/md/dm-verity-fec.c | 3 +-
drivers/md/dm-verity-target.c | 4 +-
drivers/md/dm-verity.h | 6 -
drivers/mmc/core/block.c | 2 +
drivers/mmc/core/core.c | 15 +-
drivers/mmc/host/cqhci.c | 44 ++--
drivers/mtd/chips/cfi_cmdset_0001.c | 29 +-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 +
drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 +-
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +-
drivers/net/ethernet/renesas/ravb_main.c | 20 +-
drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
drivers/net/hyperv/netvsc_drv.c | 41 ++-
drivers/net/usb/ax88179_178a.c | 4 +-
drivers/nvme/target/core.c | 21 +-
drivers/nvme/target/fabrics-cmd.c | 15 +-
drivers/nvme/target/nvmet.h | 5 +-
drivers/pci/controller/dwc/pci-keystone.c | 8 +-
drivers/pinctrl/core.c | 6 +-
drivers/s390/block/dasd.c | 24 +-
drivers/scsi/qla2xxx/qla_def.h | 3 -
drivers/scsi/qla2xxx/qla_isr.c | 5 -
drivers/scsi/qla2xxx/qla_os.c | 39 +--
drivers/usb/dwc2/hcd_intr.c | 15 +-
drivers/usb/dwc3/core.c | 2 +
drivers/usb/dwc3/dwc3-qcom.c | 17 +-
drivers/usb/serial/option.c | 11 +-
drivers/video/fbdev/sticore.h | 2 +-
fs/afs/dynroot.c | 4 +-
fs/afs/super.c | 2 +
fs/afs/vl_rotate.c | 10 +
fs/btrfs/disk-io.c | 1 +
fs/btrfs/send.c | 2 +-
fs/btrfs/super.c | 5 +-
fs/btrfs/volumes.c | 9 +-
fs/cifs/cifsfs.c | 1 +
fs/ext4/extents_status.c | 306 +++++++++++++++-------
fs/io_uring.c | 2 +-
fs/overlayfs/super.c | 5 +-
fs/sync.c | 3 +-
include/linux/fs.h | 2 +
include/linux/hid.h | 5 +
include/scsi/scsi_cmnd.h | 6 +
net/ipv4/igmp.c | 6 +-
net/ipv4/route.c | 2 +-
security/integrity/iint.c | 48 +++-
security/integrity/ima/ima_api.c | 5 +
security/integrity/ima/ima_main.c | 16 +-
security/integrity/integrity.h | 2 +
sound/pci/hda/hda_intel.c | 2 +
sound/pci/hda/patch_realtek.c | 12 +
tools/perf/util/genelf.h | 4 +-
tools/perf/util/intel-pt.c | 13 +-
79 files changed, 765 insertions(+), 320 deletions(-)
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
(cherry picked from commit b022f0c7e404887a7c5229788fc99eff9f9a80d5)
---
kernel/trace/trace_kprobe.c | 74 +++++++++++++++++++++++++++++++++++++
kernel/trace/trace_probe.h | 1 +
2 files changed, 75 insertions(+)
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 718357289899..2f7cdbecdddd 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -715,6 +715,36 @@ static inline void sanitize_event_name(char *name)
*name = '_';
}
+struct count_symbols_struct {
+ const char *func_name;
+ unsigned int count;
+};
+
+static int count_symbols(void *data, const char *name, struct module *unused0,
+ unsigned long unused1)
+{
+ struct count_symbols_struct *args = data;
+
+ if (strcmp(args->func_name, name))
+ return 0;
+
+ args->count++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ struct count_symbols_struct args = {
+ .func_name = func_name,
+ .count = 0,
+ };
+
+ kallsyms_on_each_symbol(count_symbols, &args);
+
+ return args.count;
+}
+
static int trace_kprobe_create(int argc, const char *argv[])
{
/*
@@ -842,6 +872,31 @@ static int trace_kprobe_create(int argc, const char *argv[])
}
}
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1) {
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+ ret = -EADDRNOTAVAIL;
+
+ goto error;
+ } else if (count == 0) {
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ trace_probe_log_err(0, BAD_PROBE_ADDR);
+ ret = -ENOENT;
+
+ goto error;
+ }
+ }
+
trace_probe_log_set_index(0);
if (event) {
ret = traceprobe_parse_event_name(&event, &group, buf,
@@ -1805,6 +1860,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
}
#ifdef CONFIG_PERF_EVENTS
+
/* create a trace_kprobe, but don't add it to global lists */
struct trace_event_call *
create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1814,6 +1870,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
int ret;
char *event;
+ if (func) {
+ unsigned int count;
+
+ count = number_of_same_symbols(func);
+ if (count > 1)
+ /*
+ * Users should use addr to remove the ambiguity of
+ * using func only.
+ */
+ return ERR_PTR(-EADDRNOTAVAIL);
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return ERR_PTR(-ENOENT);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index d4a69b83902e..22c05ca97758 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -390,6 +390,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(BAD_MAXACT, "Invalid maxactive number"), \
C(MAXACT_TOO_BIG, "Maxactive is too big"), \
C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \
+ C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \
C(BAD_RETPROBE, "Retprobe address must be an function entry"), \
C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \
C(NO_GROUP_NAME, "Group name is not specified"), \
--
2.34.1
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
(cherry picked from commit b022f0c7e404887a7c5229788fc99eff9f9a80d5)
---
kernel/trace/trace_kprobe.c | 74 +++++++++++++++++++++++++++++++++++++
kernel/trace/trace_probe.h | 1 +
2 files changed, 75 insertions(+)
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 0b95277396fc..80a59dbdd631 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -714,6 +714,36 @@ static inline void sanitize_event_name(char *name)
*name = '_';
}
+struct count_symbols_struct {
+ const char *func_name;
+ unsigned int count;
+};
+
+static int count_symbols(void *data, const char *name, struct module *unused0,
+ unsigned long unused1)
+{
+ struct count_symbols_struct *args = data;
+
+ if (strcmp(args->func_name, name))
+ return 0;
+
+ args->count++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ struct count_symbols_struct args = {
+ .func_name = func_name,
+ .count = 0,
+ };
+
+ kallsyms_on_each_symbol(count_symbols, &args);
+
+ return args.count;
+}
+
static int trace_kprobe_create(int argc, const char *argv[])
{
/*
@@ -825,6 +855,31 @@ static int trace_kprobe_create(int argc, const char *argv[])
}
}
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1) {
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+ ret = -EADDRNOTAVAIL;
+
+ goto error;
+ } else if (count == 0) {
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ trace_probe_log_err(0, BAD_PROBE_ADDR);
+ ret = -ENOENT;
+
+ goto error;
+ }
+ }
+
trace_probe_log_set_index(0);
if (event) {
ret = traceprobe_parse_event_name(&event, &group, buf,
@@ -1596,6 +1651,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
}
#ifdef CONFIG_PERF_EVENTS
+
/* create a trace_kprobe, but don't add it to global lists */
struct trace_event_call *
create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1605,6 +1661,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
int ret;
char *event;
+ if (func) {
+ unsigned int count;
+
+ count = number_of_same_symbols(func);
+ if (count > 1)
+ /*
+ * Users should use addr to remove the ambiguity of
+ * using func only.
+ */
+ return ERR_PTR(-EADDRNOTAVAIL);
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return ERR_PTR(-ENOENT);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index dc19d5d185d4..edbb1624061e 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -403,6 +403,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(BAD_MAXACT, "Invalid maxactive number"), \
C(MAXACT_TOO_BIG, "Maxactive is too big"), \
C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \
+ C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \
C(BAD_RETPROBE, "Retprobe address must be an function entry"), \
C(NO_GROUP_NAME, "Group name is not specified"), \
C(GROUP_TOO_LONG, "Group name is too long"), \
--
2.34.1
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
(cherry picked from commit b022f0c7e404887a7c5229788fc99eff9f9a80d5)
---
kernel/trace/trace_kprobe.c | 48 +++++++++++++++++++++++++++++++++++++
1 file changed, 48 insertions(+)
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 36dfea29d5fa..720110942505 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -715,6 +715,36 @@ static inline void sanitize_event_name(char *name)
*name = '_';
}
+struct count_symbols_struct {
+ const char *func_name;
+ unsigned int count;
+};
+
+static int count_symbols(void *data, const char *name, struct module *unused0,
+ unsigned long unused1)
+{
+ struct count_symbols_struct *args = data;
+
+ if (strcmp(args->func_name, name))
+ return 0;
+
+ args->count++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ struct count_symbols_struct args = {
+ .func_name = func_name,
+ .count = 0,
+ };
+
+ kallsyms_on_each_symbol(count_symbols, &args);
+
+ return args.count;
+}
+
static int create_trace_kprobe(int argc, char **argv)
{
/*
@@ -845,6 +875,24 @@ static int create_trace_kprobe(int argc, char **argv)
}
argc -= 2; argv += 2;
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1)
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ return -EADDRNOTAVAIL;
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return -ENOENT;
+ }
+
/* setup a probe */
if (!event) {
/* Make a new event name */
--
2.34.1
Commit b022f0c7e404887a7c5229788fc99eff9f9a80d5 upstream.
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
(cherry picked from commit b022f0c7e404887a7c5229788fc99eff9f9a80d5)
---
kernel/trace/trace_kprobe.c | 48 +++++++++++++++++++++++++++++++++++++
1 file changed, 48 insertions(+)
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index d66aed6e9c75..45779ec370fa 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -617,6 +617,36 @@ static inline void sanitize_event_name(char *name)
*name = '_';
}
+struct count_symbols_struct {
+ const char *func_name;
+ unsigned int count;
+};
+
+static int count_symbols(void *data, const char *name, struct module *unused0,
+ unsigned long unused1)
+{
+ struct count_symbols_struct *args = data;
+
+ if (strcmp(args->func_name, name))
+ return 0;
+
+ args->count++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ struct count_symbols_struct args = {
+ .func_name = func_name,
+ .count = 0,
+ };
+
+ kallsyms_on_each_symbol(count_symbols, &args);
+
+ return args.count;
+}
+
static int create_trace_kprobe(int argc, char **argv)
{
/*
@@ -746,6 +776,24 @@ static int create_trace_kprobe(int argc, char **argv)
}
argc -= 2; argv += 2;
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1)
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ return -EADDRNOTAVAIL;
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return -ENOENT;
+ }
+
/* setup a probe */
if (!event) {
/* Make a new event name */
--
2.34.1
Hi all,
This series fixes some long-term issues in kernel that preventing
some machine from work properly.
Hopefully that will rescue some system in wild :-)
Thanks
Signed-off-by: Jiaxun Yang <jiaxun.yang(a)flygoat.com>
---
Changes in v2:
- Typo and style fixes
- Link to v1: https://lore.kernel.org/r/20231101-loongson64_fixes-v1-0-2a2582a4bfa9@flygo…
---
Jiaxun Yang (3):
MIPS: Loongson64: Reserve vgabios memory on boot
MIPS: Loongson64: Enable DMA noncoherent support
MIPS: Loongson64: Handle more memory types passed from firmware
arch/mips/Kconfig | 2 +
arch/mips/include/asm/mach-loongson64/boot_param.h | 9 ++++-
arch/mips/loongson64/env.c | 10 ++++-
arch/mips/loongson64/init.c | 47 ++++++++++++++--------
4 files changed, 49 insertions(+), 19 deletions(-)
---
base-commit: 9c2d379d63450ae464eeab45462e0cb573cd97d0
change-id: 20231101-loongson64_fixes-0afb1b503d1e
Best regards,
--
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
io_uring sets up the io worker kernel thread via a syscall out of an
user space prrocess. This process might have used FPU and since
copy_thread() didn't clear FPU states for kernel threads a BUG()
is triggered for using FPU inside kernel. Move code around
to always clear FPU state for user and kernel threads.
Cc: stable(a)vger.kernel.org
Reported-by: Aurelien Jarno <aurel32(a)debian.org>
Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055021
Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de>
---
arch/mips/kernel/process.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 5387ed0a5186..b630604c577f 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -121,6 +121,19 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
/* Put the stack after the struct pt_regs. */
childksp = (unsigned long) childregs;
p->thread.cp0_status = (read_c0_status() & ~(ST0_CU2|ST0_CU1)) | ST0_KERNEL_CUMASK;
+
+ /*
+ * New tasks lose permission to use the fpu. This accelerates context
+ * switching for most programs since they don't use the fpu.
+ */
+ clear_tsk_thread_flag(p, TIF_USEDFPU);
+ clear_tsk_thread_flag(p, TIF_USEDMSA);
+ clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
+
+#ifdef CONFIG_MIPS_MT_FPAFF
+ clear_tsk_thread_flag(p, TIF_FPUBOUND);
+#endif /* CONFIG_MIPS_MT_FPAFF */
+
if (unlikely(args->fn)) {
/* kernel thread */
unsigned long status = p->thread.cp0_status;
@@ -149,20 +162,8 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
p->thread.reg29 = (unsigned long) childregs;
p->thread.reg31 = (unsigned long) ret_from_fork;
- /*
- * New tasks lose permission to use the fpu. This accelerates context
- * switching for most programs since they don't use the fpu.
- */
childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
- clear_tsk_thread_flag(p, TIF_USEDFPU);
- clear_tsk_thread_flag(p, TIF_USEDMSA);
- clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE);
-
-#ifdef CONFIG_MIPS_MT_FPAFF
- clear_tsk_thread_flag(p, TIF_FPUBOUND);
-#endif /* CONFIG_MIPS_MT_FPAFF */
-
#ifdef CONFIG_MIPS_FP_SUPPORT
atomic_set(&p->thread.bd_emu_frame, BD_EMUFRAME_NONE);
#endif
--
2.35.3
This is the start of the stable review cycle for the 4.14.332 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Dec 2023 03:14:57 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.332-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.332-rc1
Saravana Kannan <saravanak(a)google.com>
driver core: Release all resources during unbind before updating device links
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Start TX queues after HW initialization succeeded
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
ravb: Fix races between ravb_tx_timeout_work() and net related ops
Zhengchao Shao <shaozhengchao(a)huawei.com>
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
Jann Horn <jannh(a)google.com>
btrfs: send: ensure send_fd is writable
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix off-by-one when checking chunk map includes logical address
Timothy Pearson <tpearson(a)raptorengineering.com>
powerpc: Don't clobber f0/vs0 during fp|altivec register save
Wu Bo <bo.wu(a)vivo.com>
dm verity: don't perform FEC for failed readahead IO
Mikulas Patocka <mpatocka(a)redhat.com>
dm-verity: align struct dm_verity_fec_io properly
Yang Yingliang <yangyingliang(a)huawei.com>
firewire: core: fix possible memory leak in create_units()
Maria Yu <quic_aiquny(a)quicinc.com>
pinctrl: avoid reload of p state in list iteration
Ricardo Ribalda <ribalda(a)chromium.org>
usb: dwc3: set the dma max_seg_size
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: don't claim interface 4 for ZTE MF290
Puliang Lu <puliang.lu(a)fibocom.com>
USB: serial: option: fix FM101R-GL defines
Victor Fragoso <victorffs(a)hotmail.com>
USB: serial: option: add Fibocom L7xx modules
Rand Deeb <rand.sec96(a)gmail.com>
bcache: prevent potential division by zero error
Coly Li <colyli(a)suse.de>
bcache: check return value from btree_node_alloc_replacement()
Asuna Yang <spriteovo(a)gmail.com>
USB: serial: option: add Luat Air72*U series products
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: protect device queue against concurrent access
Claire Lin <claire.lin(a)broadcom.com>
mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips
Samuel Holland <samuel.holland(a)sifive.com>
net: axienet: Fix check for partial TX checksum
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: propagate the correct speed and duplex status
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle corner-case during sfp hotplug
Stefano Stabellini <sstabellini(a)kernel.org>
arm/xen: fix xen_vcpu_info allocation alignment
Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com>
net: usb: ax88179_178a: fix failed operations during ax88179_reset
Kunwu Chan <chentao(a)kylinos.cn>
ipv4: Correct/silence an endian warning in __ip_do_redirect
Jonas Karlman <jonas(a)kwiboo.se>
drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
Chen Ni <nichen(a)iscas.ac.cn>
ata: pata_isapnp: Add missing error check for devm_ioport_map()
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 timings
Christopher Bednarz <christopher.n.bednarz(a)intel.com>
RDMA/irdma: Prevent zero-length STAG registration
-------------
Diffstat:
Makefile | 4 ++--
arch/arm/xen/enlighten.c | 3 ++-
arch/powerpc/kernel/fpu.S | 13 ++++++++++++
arch/powerpc/kernel/vector.S | 2 ++
drivers/ata/pata_isapnp.c | 3 +++
drivers/base/dd.c | 4 ++--
drivers/firewire/core-device.c | 11 ++++-------
drivers/gpu/drm/panel/panel-simple.c | 12 ++++++------
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 ++++++++++---
drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 ++++++
drivers/infiniband/hw/i40iw/i40iw_type.h | 2 ++
drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 ++++++++--
drivers/md/bcache/btree.c | 2 ++
drivers/md/bcache/sysfs.c | 2 +-
drivers/md/dm-verity-fec.c | 3 ++-
drivers/md/dm-verity-target.c | 4 +++-
drivers/md/dm-verity.h | 6 ------
drivers/mtd/nand/brcmnand/brcmnand.c | 5 ++++-
drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 ++++++++---
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 ++++++++++++-
drivers/net/ethernet/renesas/ravb_main.c | 15 +++++++++++---
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
drivers/net/usb/ax88179_178a.c | 4 ++--
drivers/pinctrl/core.c | 6 +++---
drivers/s390/block/dasd.c | 24 ++++++++++++-----------
drivers/usb/dwc3/core.c | 2 ++
drivers/usb/serial/option.c | 11 ++++++++---
fs/btrfs/send.c | 2 +-
fs/btrfs/volumes.c | 2 +-
net/ipv4/igmp.c | 6 ++++--
net/ipv4/route.c | 2 +-
31 files changed, 142 insertions(+), 65 deletions(-)
Upstream commit e0205d6203c2 ("spi: atmel: Prevent false timeouts on
long transfers") has tried to mitigate the problem of getting spi
transfers canceled because they were lasting too long. On slow buses,
transfers in the MiB range can take more than one second and thus a
calculation was added to progressively increment the timeout value. In
order to not be too problematic from a user point of view (waiting dozen
of seconds or even minutes), the wait call was turned interruptible.
Turning the wait interruptible was a mistake as what we really wanted to
do was to be able to kill a transfer. Any signal interrupting our
transfer would not be suitable at all so a second attempt was made at
turning the wait killable instead.
Link: https://lore.kernel.org/linux-spi/20231127095842.389631-1-miquel.raynal@boo…
All being well, it was reported that JFFS2 was showing a splat when
interrupting a transfer. After some more debate about whether JFFS2
should be fixed and how, it was also pointed out that the whole
consistency of the filesystem in case of parallel I/O would be
compromised. Changing JFFS2 behavior would in theory be possible but
nobody has the energy and time and knowledge to do this now, so better
prevent spi transfers to be interrupted by the user.
Partially revert the blamed commit to no longer use the interruptible
nor the killable variant of wait_for_completion().
Fixes: e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers")
Cc: stable(a)vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
---
drivers/spi/spi-atmel.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 0197c25f5029..54277de30161 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1333,12 +1333,10 @@ static int atmel_spi_one_transfer(struct spi_controller *host,
}
dma_timeout = msecs_to_jiffies(spi_controller_xfer_timeout(host, xfer));
- ret_timeout = wait_for_completion_killable_timeout(&as->xfer_completion,
- dma_timeout);
- if (ret_timeout <= 0) {
- dev_err(&spi->dev, "spi transfer %s\n",
- !ret_timeout ? "timeout" : "canceled");
- as->done_status = ret_timeout < 0 ? ret_timeout : -EIO;
+ ret_timeout = wait_for_completion_timeout(&as->xfer_completion, dma_timeout);
+ if (!ret_timeout) {
+ dev_err(&spi->dev, "spi transfer timeout\n");
+ as->done_status = -EIO;
}
if (as->done_status)
--
2.34.1
@Stable-Kernel:
You receive this patch series because its first patch fixes leaks in
PCI.
Changes in v4:
- Apply Arnd's Reviewed-by's
- Add ifdef CONFIG_HAS_IOPORT_MAP guard in drivers/pci/iomap.c (build
error on openrisc)
- Fix typo in patch no.5
Changes in v3:
- Create a separate patch for the leaks in lib/iomap.c. Make it the
series' first patch. (Arnd)
- Turns out the aforementioned bug wasn't just accidentally removing
iounmap() with the ifdef, it was also missing ioport_unmap() to begin
with. Add it.
- Move the ARCH_WANTS_GENERIC_IOMEM_IS_IOPORT-mechanism from
asm-generic/io.h to asm-generic/ioport.h. (Arnd)
- Adjust the implementation of iomem_is_ioport() in asm-generic/io.h so
that it matches exactly what pci_iounmap() previously did in
lib/pci_iomap.c. (Arnd)
- Move the CONFIG_HAS_IOPORT guard in asm-generic/io.h so that
iomem_is_ioport() will always be compiled and just returns false if
there are no ports.
- Add TODOs to several places informing about the generic
iomem_is_ioport() in lib/iomap.c not being generic.
- Add TODO about the followup work to make drivers/pci/iomap.c's
pci_iounmap() actually generic.
Changes in v2:
- Replace patch 4, previously extending the comment about pci_iounmap()
in lib/iomap.c, with a patch that moves pci_iounmap() from that file
to drivers/pci/iomap.c, creating a unified version there. (Arnd)
- Implement iomem_is_ioport() as a new helper in asm-generic/io.h and
lib/iomap.c. (Arnd)
- Move the build rule in drivers/pci/Makefile for iomap.o under the
guard of #if PCI. This had to be done because when just checking for
GENERIC_PCI_IOMAP being defined, the functions don't disappear, which
was the case previously in lib/pci_iomap.c, where the entire file was
made empty if PCI was not set by the guard #ifdef PCI. (Intel's Bots)
- Rephares all patches' commit messages a little bit.
Sooooooooo. I reworked v1.
Please review this carefully, the IO-Ranges are obviously a bit tricky,
as is the build-system / ifdef-ery.
Arnd has suggested that architectures defining a custom inb() need their
own iomem_is_ioport(), as well. I've grepped for inb() and found the
following list of archs that define their own:
- alpha
- arm
- m68k <--
- parisc
- powerpc
- sh
- sparc
- x86 <--
All of those have their own definitons of pci_iounmap(). Therefore, they
don't need our generic version in the first place and, thus, also need
no iomem_is_ioport().
The two exceptions are x86 and m68k. The former uses lib/iomap.c through
CONFIG_GENERIC_IOMAP, as Arnd pointed out in the previous discussion
(thus, CONFIG_GENERIC_IOMAP is not really generic in this regard).
So as I see it, only m68k WOULD need its own custom definition of
iomem_is_ioport(). But as I understand it it doesn't because it uses the
one from asm-generic/pci_iomap.h ??
I wasn't entirely sure how to deal with the address ranges for the
generic implementation in asm-generic/io.h. It's marked with a TODO.
Input appreciated.
I removed the guard around define pci_iounmap in asm-generic/io.h. An
alternative would be to have it be guarded by CONFIG_GENERIC_IOMAP and
CONFIG_GENERIC_PCI_IOMAP, both. Without such a guard, there is no
collision however, because generic pci_iounmap() from
drivers/pci/iomap.c will only get pulled in when
CONFIG_GENERIC_PCI_IOMAP is actually set.
I cross-built this for a variety of architectures, including the usual
suspects (s390, m68k). So far successfully. But let's see what Intel's
robots say :O
P.
Original cover letter:
Hi!
So it seems that since ca. 2007 the PCI code has been scattered a bit.
PCI's devres code, which is only ever used by users of the entire
PCI-subsystem anyways, resides in lib/devres.c and is guarded by an
ifdef PCI, just as the content of lib/pci_iomap.c is.
It, thus, seems reasonable to move all of that.
As I were at it, I moved as much of the devres-specific code from pci.c
to devres.c, too. The only exceptions are four functions that are
currently difficult to move. More information about that can be read
here [1].
I noticed these scattered files while working on (new) PCI-specific
devres functions. If we can get this here merged, I'll soon send another
patch series that addresses some API-inconsistencies and could move the
devres-part of the four remaining functions.
I don't want to do that in this series as this here is only about moving
code, whereas the next series would have to actually change API
behavior.
I successfully (cross-)built this for x86, x86_64, AARCH64 and ARM
(allyesconfig). I booted a kernel with it on x86_64, with a Fedora
desktop environment as payload. The OS came up fine
I hope this is OK. If we can get it in, we'd soon have a very
consistent PCI API again.
Regards,
P.
Philipp Stanner (5):
lib/pci_iomap.c: fix cleanup bugs in pci_iounmap()
lib: move pci_iomap.c to drivers/pci/
lib: move pci-specific devres code to drivers/pci/
pci: move devres code from pci.c to devres.c
lib, pci: unify generic pci_iounmap()
drivers/pci/Kconfig | 5 +
drivers/pci/Makefile | 3 +-
drivers/pci/devres.c | 450 +++++++++++++++++++++++++
lib/pci_iomap.c => drivers/pci/iomap.c | 49 +--
drivers/pci/pci.c | 249 --------------
drivers/pci/pci.h | 24 ++
include/asm-generic/io.h | 27 +-
include/asm-generic/iomap.h | 21 ++
lib/Kconfig | 3 -
lib/Makefile | 1 -
lib/devres.c | 208 +-----------
lib/iomap.c | 28 +-
12 files changed, 566 insertions(+), 502 deletions(-)
create mode 100644 drivers/pci/devres.c
rename lib/pci_iomap.c => drivers/pci/iomap.c (75%)
--
2.43.0
The qmc_chan_reset_rx() set the is_rx_stopped flag. This leads to an
inconsistent state in the following sequence.
qmc_chan_stop()
qmc_chan_reset()
Indeed, after the qmc_chan_reset() call, the channel must still be
stopped. Only a qmc_chan_start() call can move the channel from stopped
state to started state.
Fix the issue removing the is_rx_stopped flag setting from
qmc_chan_reset()
Fixes: 3178d58e0b97 ("soc: fsl: cpm1: Add support for QMC")
Cc: stable(a)vger.kernel.org
Signed-off-by: Herve Codina <herve.codina(a)bootlin.com>
Reviewed-by: Christophe Leroy <christophe.leroy(a)csgroup.eu>
---
drivers/soc/fsl/qe/qmc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/soc/fsl/qe/qmc.c b/drivers/soc/fsl/qe/qmc.c
index 3f3de1351c96..2312152a44b3 100644
--- a/drivers/soc/fsl/qe/qmc.c
+++ b/drivers/soc/fsl/qe/qmc.c
@@ -685,7 +685,6 @@ static void qmc_chan_reset_rx(struct qmc_chan *chan)
qmc_read16(chan->s_param + QMC_SPE_RBASE));
chan->rx_pending = 0;
- chan->is_rx_stopped = false;
spin_unlock_irqrestore(&chan->rx_lock, flags);
}
--
2.43.0
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x a2e7e59a94269484a83386972ca07c22fd188854
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023120303-purposely-museum-96a7@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
a2e7e59a9426 ("iommu: Avoid more races around device probe")
fa0828036488 ("iommu: Split iommu_group_add_device()")
14891af3799e ("iommu: Move the iommu driver sysfs setup into iommu_init/deinit_device()")
aa0958570f24 ("iommu: Add iommu_init/deinit_device() paired functions")
df15d76dcaca ("iommu: Simplify the __iommu_group_remove_device() flow")
7bdb99622f7e ("iommu: Inline iommu_group_get_for_dev() into __iommu_probe_device()")
5665d15d3cb7 ("iommu: Use iommu_group_ref_get/put() for dev->iommu_group")
6eb4da8cf545 ("iommu: Have __iommu_probe_device() check for already probed devices")
0046a4337eae ("iommu: Remove iommu_group_do_dma_first_attach() from iommu_group_add_device()")
d257344c6619 ("iommu: Replace __iommu_group_dma_first_attach() with set_domain")
dcf40ed3a20d ("iommu: Make __iommu_group_set_domain() handle error unwind")
3006b15b364a ("iommu: Add for_each_group_device()")
dba9ca9d41f5 ("iommu: Same critical region for device release and removal")
293f2564f3dd ("iommu: Split iommu_group_remove_device() into helpers")
143c7bc6496c ("Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a2e7e59a94269484a83386972ca07c22fd188854 Mon Sep 17 00:00:00 2001
From: Robin Murphy <robin.murphy(a)arm.com>
Date: Wed, 15 Nov 2023 18:25:44 +0000
Subject: [PATCH] iommu: Avoid more races around device probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
It turns out there are more subtle races beyond just the main part of
__iommu_probe_device() itself running in parallel - the dev_iommu_free()
on the way out of an unsuccessful probe can still manage to trip up
concurrent accesses to a device's fwspec. Thus, extend the scope of
iommu_probe_device_lock() to also serialise fwspec creation and initial
retrieval.
Reported-by: Zhenhua Huang <quic_zhenhuah(a)quicinc.com>
Link: https://lore.kernel.org/linux-iommu/e2e20e1c-6450-4ac5-9804-b0000acdf7de@qu…
Fixes: 01657bc14a39 ("iommu: Avoid races around device probe")
Signed-off-by: Robin Murphy <robin.murphy(a)arm.com>
Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Reviewed-by: André Draszik <andre.draszik(a)linaro.org>
Tested-by: André Draszik <andre.draszik(a)linaro.org>
Link: https://lore.kernel.org/r/16f433658661d7cadfea51e7c65da95826112a2b.17000714…
Cc: stable(a)vger.kernel.org
Signed-off-by: Joerg Roedel <jroedel(a)suse.de>
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index fa5dd71a80fa..02bb2cce423f 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1568,17 +1568,22 @@ static const struct iommu_ops *acpi_iommu_configure_id(struct device *dev,
int err;
const struct iommu_ops *ops;
+ /* Serialise to make dev->iommu stable under our potential fwspec */
+ mutex_lock(&iommu_probe_device_lock);
/*
* If we already translated the fwspec there is nothing left to do,
* return the iommu_ops.
*/
ops = acpi_iommu_fwspec_ops(dev);
- if (ops)
+ if (ops) {
+ mutex_unlock(&iommu_probe_device_lock);
return ops;
+ }
err = iort_iommu_configure_id(dev, id_in);
if (err && err != -EPROBE_DEFER)
err = viot_iommu_configure(dev);
+ mutex_unlock(&iommu_probe_device_lock);
/*
* If we have reason to believe the IOMMU driver missed the initial
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index c9a05bb49bfa..33e2a9b5d339 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -485,11 +485,12 @@ static void iommu_deinit_device(struct device *dev)
dev_iommu_free(dev);
}
+DEFINE_MUTEX(iommu_probe_device_lock);
+
static int __iommu_probe_device(struct device *dev, struct list_head *group_list)
{
const struct iommu_ops *ops = dev->bus->iommu_ops;
struct iommu_group *group;
- static DEFINE_MUTEX(iommu_probe_device_lock);
struct group_device *gdev;
int ret;
@@ -502,17 +503,15 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list
* probably be able to use device_lock() here to minimise the scope,
* but for now enforcing a simple global ordering is fine.
*/
- mutex_lock(&iommu_probe_device_lock);
+ lockdep_assert_held(&iommu_probe_device_lock);
/* Device is probed already if in a group */
- if (dev->iommu_group) {
- ret = 0;
- goto out_unlock;
- }
+ if (dev->iommu_group)
+ return 0;
ret = iommu_init_device(dev, ops);
if (ret)
- goto out_unlock;
+ return ret;
group = dev->iommu_group;
gdev = iommu_group_alloc_device(group, dev);
@@ -548,7 +547,6 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list
list_add_tail(&group->entry, group_list);
}
mutex_unlock(&group->mutex);
- mutex_unlock(&iommu_probe_device_lock);
if (dev_is_pci(dev))
iommu_dma_set_pci_32bit_workaround(dev);
@@ -562,8 +560,6 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list
iommu_deinit_device(dev);
mutex_unlock(&group->mutex);
iommu_group_put(group);
-out_unlock:
- mutex_unlock(&iommu_probe_device_lock);
return ret;
}
@@ -573,7 +569,9 @@ int iommu_probe_device(struct device *dev)
const struct iommu_ops *ops;
int ret;
+ mutex_lock(&iommu_probe_device_lock);
ret = __iommu_probe_device(dev, NULL);
+ mutex_unlock(&iommu_probe_device_lock);
if (ret)
return ret;
@@ -1822,7 +1820,9 @@ static int probe_iommu_group(struct device *dev, void *data)
struct list_head *group_list = data;
int ret;
+ mutex_lock(&iommu_probe_device_lock);
ret = __iommu_probe_device(dev, group_list);
+ mutex_unlock(&iommu_probe_device_lock);
if (ret == -ENODEV)
ret = 0;
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index 157b286e36bf..c25b4ae6aeee 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -112,16 +112,20 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
const u32 *id)
{
const struct iommu_ops *ops = NULL;
- struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+ struct iommu_fwspec *fwspec;
int err = NO_IOMMU;
if (!master_np)
return NULL;
+ /* Serialise to make dev->iommu stable under our potential fwspec */
+ mutex_lock(&iommu_probe_device_lock);
+ fwspec = dev_iommu_fwspec_get(dev);
if (fwspec) {
- if (fwspec->ops)
+ if (fwspec->ops) {
+ mutex_unlock(&iommu_probe_device_lock);
return fwspec->ops;
-
+ }
/* In the deferred case, start again from scratch */
iommu_fwspec_free(dev);
}
@@ -155,6 +159,8 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
fwspec = dev_iommu_fwspec_get(dev);
ops = fwspec->ops;
}
+ mutex_unlock(&iommu_probe_device_lock);
+
/*
* If we have reason to believe the IOMMU driver missed the initial
* probe for dev, replay it to get things in order.
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index ec289c1016f5..6291aa7b079b 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -845,6 +845,7 @@ static inline void dev_iommu_priv_set(struct device *dev, void *priv)
dev->iommu->priv = priv;
}
+extern struct mutex iommu_probe_device_lock;
int iommu_probe_device(struct device *dev);
int iommu_dev_enable_feature(struct device *dev, enum iommu_dev_features f);
@Stable-Kernel:
You receive this patch series because its first patch fixes leaks in
PCI.
Changes in v3:
- Create a separate patch for the leaks in lib/iomap.c. Make it the
series' first patch. (Arnd)
- Turns out the aforementioned bug wasn't just accidentally removing
iounmap() with the ifdef, it was also missing ioport_unmap() to begin
with. Add it.
- Move the ARCH_WANTS_GENERIC_IOMEM_IS_IOPORT-mechanism from
asm-generic/io.h to asm-generic/ioport.h. (Arnd)
- Adjust the implementation of iomem_is_ioport() in asm-generic/io.h so
that it matches exactly what pci_iounmap() previously did in
lib/pci_iomap.c. (Arnd)
- Move the CONFIG_HAS_IOPORT guard in asm-generic/io.h so that
iomem_is_ioport() will always be compiled and just returns false if
there are no ports.
- Add TODOs to several places informing about the generic
iomem_is_ioport() in lib/iomap.c not being generic.
- Add TODO about the followup work to make drivers/pci/iomap.c's
pci_iounmap() actually generic.
Changes in v2:
- Replace patch 4, previously extending the comment about pci_iounmap()
in lib/iomap.c, with a patch that moves pci_iounmap() from that file
to drivers/pci/iomap.c, creating a unified version there. (Arnd)
- Implement iomem_is_ioport() as a new helper in asm-generic/io.h and
lib/iomap.c. (Arnd)
- Move the build rule in drivers/pci/Makefile for iomap.o under the
guard of #if PCI. This had to be done because when just checking for
GENERIC_PCI_IOMAP being defined, the functions don't disappear, which
was the case previously in lib/pci_iomap.c, where the entire file was
made empty if PCI was not set by the guard #ifdef PCI. (Intel's Bots)
- Rephares all patches' commit messages a little bit.
Sooooooooo. I reworked v1.
Please review this carefully, the IO-Ranges are obviously a bit tricky,
as is the build-system / ifdef-ery.
Arnd has suggested that architectures defining a custom inb() need their
own iomem_is_ioport(), as well. I've grepped for inb() and found the
following list of archs that define their own:
- alpha
- arm
- m68k <--
- parisc
- powerpc
- sh
- sparc
- x86 <--
All of those have their own definitons of pci_iounmap(). Therefore, they
don't need our generic version in the first place and, thus, also need
no iomem_is_ioport().
The two exceptions are x86 and m68k. The former uses lib/iomap.c through
CONFIG_GENERIC_IOMAP, as Arnd pointed out in the previous discussion
(thus, CONFIG_GENERIC_IOMAP is not really generic in this regard).
So as I see it, only m68k WOULD need its own custom definition of
iomem_is_ioport(). But as I understand it it doesn't because it uses the
one from asm-generic/pci_iomap.h ??
I wasn't entirely sure how to deal with the address ranges for the
generic implementation in asm-generic/io.h. It's marked with a TODO.
Input appreciated.
I removed the guard around define pci_iounmap in asm-generic/io.h. An
alternative would be to have it be guarded by CONFIG_GENERIC_IOMAP and
CONFIG_GENERIC_PCI_IOMAP, both. Without such a guard, there is no
collision however, because generic pci_iounmap() from
drivers/pci/iomap.c will only get pulled in when
CONFIG_GENERIC_PCI_IOMAP is actually set.
I cross-built this for a variety of architectures, including the usual
suspects (s390, m68k). So far successfully. But let's see what Intel's
robots say :O
P.
Original cover letter:
Hi!
So it seems that since ca. 2007 the PCI code has been scattered a bit.
PCI's devres code, which is only ever used by users of the entire
PCI-subsystem anyways, resides in lib/devres.c and is guarded by an
ifdef PCI, just as the content of lib/pci_iomap.c is.
It, thus, seems reasonable to move all of that.
As I were at it, I moved as much of the devres-specific code from pci.c
to devres.c, too. The only exceptions are four functions that are
currently difficult to move. More information about that can be read
here [1].
I noticed these scattered files while working on (new) PCI-specific
devres functions. If we can get this here merged, I'll soon send another
patch series that addresses some API-inconsistencies and could move the
devres-part of the four remaining functions.
I don't want to do that in this series as this here is only about moving
code, whereas the next series would have to actually change API
behavior.
I successfully (cross-)built this for x86, x86_64, AARCH64 and ARM
(allyesconfig). I booted a kernel with it on x86_64, with a Fedora
desktop environment as payload. The OS came up fine
I hope this is OK. If we can get it in, we'd soon have a very
consistent PCI API again.
Regards,
P.
Philipp Stanner (5):
lib/pci_iomap.c: fix cleanup bugs in pci_iounmap()
lib: move pci_iomap.c to drivers/pci/
lib: move pci-specific devres code to drivers/pci/
pci: move devres code from pci.c to devres.c
lib, pci: unify generic pci_iounmap()
drivers/pci/Kconfig | 5 +
drivers/pci/Makefile | 3 +-
drivers/pci/devres.c | 450 +++++++++++++++++++++++++
lib/pci_iomap.c => drivers/pci/iomap.c | 49 +--
drivers/pci/pci.c | 249 --------------
drivers/pci/pci.h | 24 ++
include/asm-generic/io.h | 27 +-
include/asm-generic/iomap.h | 21 ++
lib/Kconfig | 3 -
lib/Makefile | 1 -
lib/devres.c | 208 +-----------
lib/iomap.c | 28 +-
12 files changed, 565 insertions(+), 503 deletions(-)
create mode 100644 drivers/pci/devres.c
rename lib/pci_iomap.c => drivers/pci/iomap.c (75%)
--
2.43.0
Hi, all
We are encountering a perf related soft lockup as shown below:
[25023823.265138] watchdog: BUG: soft lockup - CPU#29 stuck for 45s!
[YD:3284696]
[25023823.275772] net_failover virtio_scsi failover
[25023823.276750] CPU: 29 PID: 3284696 Comm: YD Kdump: loaded Not
tainted 4.19.90-23.18.v2101.ky10.aarch64 #1
[25023823.278257] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[25023823.279475] pstate: 80400005 (Nzcv daif +PAN -UAO)
[25023823.280516] pc : perf_iterate_sb+0x1b8/0x1f0
[25023823.281530] lr : perf_iterate_sb+0x18c/0x1f0
[25023823.282529] sp : ffff801f282efbf0
[25023823.283446] x29: ffff801f282efbf0 x28: ffff801f207a8b80
[25023823.284551] x27: 0000000000000000 x26: ffff801f99b355e8
[25023823.285674] x25: 0000000000000000 x24: ffff8019e2fbd800
[25023823.286770] x23: ffff0000093f0018 x22: ffff801f282efc40
[25023823.287864] x21: ffff000008255f60 x20: ffff801ffdf58e80
[25023823.288964] x19: ffff8019f1c27800 x18: 0000000000000000
[25023823.290060] x17: 0000000000000000 x16: 0000000000000000
[25023823.291164] x15: 0400000000000000 x14: 0000000000000000
[25023823.292266] x13: ffff000008c6e340 x12: 0000000000000002
[25023823.293381] x11: ffff000008c6e318 x10: 00000019e5feff20
[25023823.294486] x9 : ffff8019fb49c000 x8 : 0058e6fd335b260e
[25023823.295597] x7 : 0000000100321ed8 x6 : ffff00003d083780
[25023823.296715] x5 : 00ffffffffffffff x4 : 0000801ff4ae0000
[25023823.297860] x3 : ffff801ffdf64cc0 x2 : ffff000009858758
[25023823.298977] x1 : 0000000000000000 x0 : ffff8019e2fbd800
[25023823.300090] Call trace:
[25023823.300962] perf_iterate_sb+0x1b8/0x1f0
[25023823.301961] perf_event_task+0x78/0x80
[25023823.302946] perf_event_exit_task+0xa4/0xb0
[25023823.303978] do_exit+0x38c/0x5d0
[25023823.304932] do_group_exit+0x3c/0xd8
[25023823.305904] get_signal+0x12c/0x740
[25023823.306859] do_signal+0x158/0x260
[25023823.307795] do_notify_resume+0xd8/0x358
[25023823.308781] work_pending+0x8/0x10
We got a vmcore by enable panic_on_soft_lockup, from the vmcore we
found the perf_event accessed through
perf_iterate_sb -> perf_iterate_sb_cpu -> event_filter_match ->
pmu_filter_match -> for_each_sibling_event
had been removed:
#define for_each_sibling_event(sibling, event) \
if ((event)->group_leader == (event)) \
list_for_each_entry((sibling), &(event)->sibling_list,
sibling_list)
#define list_for_each_entry(pos, head, member) \
for (pos = __container_of((head)->next, pos, member); \
&pos->member != (head); \
pos = __container_of(pos->member.next, pos, member))
crash> struct perf_event ffff8019e2fbd800
struct perf_event {
event_entry = {
next = 0xffff8019f1c27800,
prev = 0xdead000000000200
},
...
state = PERF_EVENT_STATE_DEAD,
...
}
By the way, we also found another process which is deleting sibling_list:
crash> bt 3284533
PID: 3284533 TASK: ffff801f901ae880 CPU: 16 COMMAND: "YD"
#0 [ffff801f8cd977f0] __switch_to at ffff000008088ba4
#1 [ffff801f8cd97810] __schedule at ffff000008bf10c4
#2 [ffff801f8cd97890] schedule at ffff000008bf17b0
#3 [ffff801f8cd978a0] schedule_timeout at ffff000008bf5b10
#4 [ffff801f8cd97960] wait_for_common at ffff000008bf2530
#5 [ffff801f8cd979f0] wait_for_completion at ffff000008bf2644
#6 [ffff801f8cd97a10] __wait_rcu_gp at ffff000008171c00
#7 [ffff801f8cd97a80] synchronize_sched at ffff000008179da8
#8 [ffff801f8cd97ad0] perf_trace_event_unreg at ffff000008216d50
#9 [ffff801f8cd97b00] perf_trace_destroy at ffff000008217148
#10 [ffff801f8cd97b20] tp_perf_event_destroy at ffff000008256ae0
#11 [ffff801f8cd97b30] _free_event at ffff00000825f21c
#12 [ffff801f8cd97b70] put_event at ffff00000825faf0
#13 [ffff801f8cd97b80] perf_event_release_kernel at ffff00000825fcb8
#14 [ffff801f8cd97be0] perf_release at ffff00000825fdbc
#15 [ffff801f8cd97bf0] __fput at ffff00000832f0b8
#16 [ffff801f8cd97c30] ____fput at ffff00000832f28c
#17 [ffff801f8cd97c50] task_work_run at ffff00000810f8c8
#18 [ffff801f8cd97c90] do_exit at ffff0000080ef458
#19 [ffff801f8cd97cf0] do_group_exit at ffff0000080ef738
#20 [ffff801f8cd97d20] get_signal at ffff0000080fdde0
#21 [ffff801f8cd97d90] do_signal at ffff00000808e488
#22 [ffff801f8cd97e80] do_notify_resume at ffff00000808e7f4
#23 [ffff801f8cd97ff0] work_pending at ffff000008083f60
So it's reasonable to suspect that perf_iterate_sb is traversing
sibling_list while another
process is deleting it which eventually caused for_each_sibling_event
to endless loop and thus soft lockup.
The race scenario thus could be this:
CPU 29: CPU 16:
perf_event_release_kernel
--> mutex_lock(&ctx->mutex)
--> perf_remove_from_context
--> perf_group_detach(event);
for_each_sibling_event() -->
list_del_init(&event->sibling_list)
As commit f3c0eba287049(“perf: Add a few assertions”)said:
“Notable for_each_sibling_event() relies on exclusion from
modification. This would normally be holding either ctx->lock or
ctx->mutex, however due to how things are constructed disabling IRQs
is a valid and sufficient substitute for ctx->lock.”, we think it's
necessary to hold ctx ->mutex, but currently LTS such as 4.19,5.4,5.10,
and 6.1 all does not do so:
perf_event_task
--> perf_iterate_sb
--> perf_iterate_sb_cpu
--> event_filter_match
--> pmu_filter_match
--> for_each_sibling_event
commit bd27568117664(“perf: Rewrite core context handling”)had removed
the pmu_filter_match operation, so it may be a temporary workaround
for this issue.
But it's necessary to confirm if there is a race problem between
sibling_list, and if it is, how
to fix currently LTS branches.
Thanks in advance.
This is the start of the stable review cycle for the 5.10.203 release.
There are 135 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Dec 2023 03:14:57 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.203-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.203-rc1
Saravana Kannan <saravanak(a)google.com>
driver core: Release all resources during unbind before updating device links
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: fix deadlock on RTL8125 in jumbo mtu mode
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: disable ASPM in case of tx timeout
Wenchao Chen <wenchao.chen(a)unisoc.com>
mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
Heiner Kallweit <hkallweit1(a)gmail.com>
mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Retry commands in CQE error recovery
Zheng Yongjun <zhengyongjun3(a)huawei.com>
mmc: core: convert comma to semicolon
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Fix task clearing in CQE error recovery
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Warn of halt or task clear failure
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: cqhci: Increase recovery halt timeout
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
cpufreq: imx6q: don't warn for disabling a non-existing frequency
Quinn Tran <qutran(a)marvell.com>
scsi: qla2xxx: Fix system crash due to bad pointer access
Bart Van Assche <bvanassche(a)acm.org>
scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Introduce the scsi_cmd_to_rq() function
Steve French <stfrench(a)microsoft.com>
smb3: fix caching of ctime on setxattr
Jeff Layton <jlayton(a)kernel.org>
fs: add ctime accessors infrastructure
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: don't use ATRM for external devices
Rajat Jain <rajatja(a)google.com>
driver core: Move the "removable" attribute from USB to core
Amir Goldstein <amir73il(a)gmail.com>
ima: annotate iint mutex to avoid lockdep false positive warnings
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
Siddharth Vadapalli <s-vadapalli(a)ti.com>
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Kishon Vijay Abraham I <kishon(a)ti.com>
misc: pci_endpoint_test: Add deviceID for AM64 and J7200
Heiko Carstens <hca(a)linux.ibm.com>
s390/cmma: fix detection of DAT pages
Alexander Gordeev <agordeev(a)linux.ibm.com>
s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
Mark Hasemeyer <markhas(a)chromium.org>
ASoC: SOF: sof-pci-dev: Fix community key quirk detection
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: don't use the community key on APL Chromebooks
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: add parameter to override topology filename
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: SOF: sof-pci-dev: use community key on all Up boards
Hans de Goede <hdegoede(a)redhat.com>
ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
Steve French <stfrench(a)microsoft.com>
smb3: fix touch -h of symlink
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Fix async branch flags
Adrian Hunter <adrian.hunter(a)intel.com>
perf intel-pt: Adjust sample flags for VM-Exit
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Start TX queues after HW initialization succeeded
Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com>
net: ravb: Use pm_runtime_resume_and_get()
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
ravb: Fix races between ravb_tx_timeout_work() and net related ops
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: prevent potential deadlock in rtl8169_close
Andrey Grodzovsky <andrey.grodzovsky(a)amd.com>
Revert "workqueue: remove unused cancel_work()"
Geetha sowjanya <gakula(a)marvell.com>
octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64
Furong Xu <0x1207(a)gmail.com>
net: stmmac: xgmac: Disable FPE MMC interrupts
Willem de Bruijn <willemb(a)google.com>
selftests/net: mptcp: fix uninitialized variable warnings
Willem de Bruijn <willemb(a)google.com>
selftests/net: ipsec: fix constant out of range
Ioana Ciornei <ioana.ciornei(a)nxp.com>
dpaa2-eth: increase the needed headroom to account for alignment
Zhengchao Shao <shaozhengchao(a)huawei.com>
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
Niklas Neronin <niklas.neronin(a)linux.intel.com>
usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Change configuration warnings to notices
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: fix race of netvsc and VF register_netdevice
Max Nguyen <maxwell.nguyen(a)hp.com>
Input: xpad - add HyperX Clutch Gladiate Support
Filipe Manana <fdmanana(a)suse.com>
btrfs: make error messages more clear when getting a chunk map
Jann Horn <jannh(a)google.com>
btrfs: send: ensure send_fd is writable
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix off-by-one when checking chunk map includes logical address
Bragatheswaran Manickavel <bragathemanick0908(a)gmail.com>
btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod()
Qu Wenruo <wqu(a)suse.com>
btrfs: add dmesg output for first mount and last unmount of a filesystem
Helge Deller <deller(a)gmx.de>
parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes
Timothy Pearson <tpearson(a)raptorengineering.com>
powerpc: Don't clobber f0/vs0 during fp|altivec register save
Abdul Halim, Mohd Syazwan <mohd.syazwan.abdul.halim(a)intel.com>
iommu/vt-d: Add MTL to quirk list to skip TE disabling
Markus Weippert <markus(a)gekmihesg.de>
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
Wu Bo <bo.wu(a)vivo.com>
dm verity: don't perform FEC for failed readahead IO
Mikulas Patocka <mpatocka(a)redhat.com>
dm-verity: align struct dm_verity_fec_io properly
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Add supported ALC257 for ChromeOS
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek: Headset Mic VREF to 100%
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Disable power-save on KONTRON SinglePC
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Do not lose cache flush during CQE error recovery
Yang Yingliang <yangyingliang(a)huawei.com>
firewire: core: fix possible memory leak in create_units()
Maria Yu <quic_aiquny(a)quicinc.com>
pinctrl: avoid reload of p state in list iteration
Adrian Hunter <adrian.hunter(a)intel.com>
perf inject: Fix GEN_ELF_TEXT_OFFSET for jit
Keith Busch <kbusch(a)kernel.org>
io_uring: fix off-by one bvec index
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix wakeup after probe deferral
Ricardo Ribalda <ribalda(a)chromium.org>
usb: dwc3: set the dma max_seg_size
Alexander Stein <alexander.stein(a)ew.tq-group.com>
usb: dwc3: Fix default mode initialization
Oliver Neukum <oneukum(a)suse.com>
USB: dwc2: write HCINT with INTMASK applied
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: don't claim interface 4 for ZTE MF290
Puliang Lu <puliang.lu(a)fibocom.com>
USB: serial: option: fix FM101R-GL defines
Victor Fragoso <victorffs(a)hotmail.com>
USB: serial: option: add Fibocom L7xx modules
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup lock c->root error
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup init dirty data errors
Rand Deeb <rand.sec96(a)gmail.com>
bcache: prevent potential division by zero error
Coly Li <colyli(a)suse.de>
bcache: check return value from btree_node_alloc_replacement()
Mikulas Patocka <mpatocka(a)redhat.com>
dm-delay: fix a race between delay_presuspend and delay_bio
Long Li <longli(a)microsoft.com>
hv_netvsc: Mark VF as slave before exposing it to user-mode
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix race of register_netdevice_notifier and VF register
Asuna Yang <spriteovo(a)gmail.com>
USB: serial: option: add Luat Air72*U series products
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: protect device queue against concurrent access
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race
Coly Li <colyli(a)suse.de>
bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
Keith Busch <kbusch(a)kernel.org>
swiotlb-xen: provide the "max_mapping_size" method
Hans de Goede <hdegoede(a)redhat.com>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com>
ASoC: simple-card: fixup asoc_simple_probe() error handling
Al Viro <viro(a)zeniv.linux.org.uk>
nfsd: lock_rename() needs both directories to live on the same fs
Zhang Yi <yi.zhang(a)huawei.com>
ext4: make sure allocate pending entry not fail
Baokun Li <libaokun1(a)huawei.com>
ext4: fix slab-use-after-free in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_delayed_block()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: factor out __es_alloc_extent() and __es_free_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: add a new helper to check if es must be kept
Huacai Chen <chenhuacai(a)loongson.cn>
MIPS: KVM: Fix a build warning about variable set but not used
Sakari Ailus <sakari.ailus(a)linux.intel.com>
media: ccs: Correctly initialise try compose rectangle
Peter Zijlstra <peterz(a)infradead.org>
lockdep: Fix block chain corruption
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix ACPI platform device leak
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix resource leaks on probe deferral
Christoph Hellwig <hch(a)lst.de>
nvmet: nul-terminate the NQNs passed in the connect command
Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com>
nvmet: remove unnecessary ctrl parameter
David Howells <dhowells(a)redhat.com>
afs: Fix file locking on R/O volumes to operate in local mode
David Howells <dhowells(a)redhat.com>
afs: Return ENOENT if no cell DNS record can be found
Samuel Holland <samuel.holland(a)sifive.com>
net: axienet: Fix check for partial TX checksum
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: propagate the correct speed and duplex status
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle the corner-case during tx completion
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle corner-case during sfp hotplug
Stefano Stabellini <sstabellini(a)kernel.org>
arm/xen: fix xen_vcpu_info allocation alignment
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: avoid data corruption caused by decline
Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com>
net: usb: ax88179_178a: fix failed operations during ax88179_reset
Kunwu Chan <chentao(a)kylinos.cn>
ipv4: Correct/silence an endian warning in __ip_do_redirect
Charles Yi <be286(a)163.com>
HID: fix HID device resource race between HID core and debugging support
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: core: store the unique system identifier in hid_device
Jonas Karlman <jonas(a)kwiboo.se>
drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
Chen Ni <nichen(a)iscas.ac.cn>
ata: pata_isapnp: Add missing error check for devm_ioport_map()
Eric Dumazet <edumazet(a)google.com>
wireguard: use DEV_STATS_INC()
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 timings
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
Xuxin Xiong <xuxinxiong(a)huaqin.corp-partner.google.com>
drm/panel: auo,b101uan08.3: Fine tune the panel power sequence
Shuijing Li <shuijing.li(a)mediatek.com>
drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence
David Howells <dhowells(a)redhat.com>
afs: Make error on cell lookup failure consistent with OpenAFS
David Howells <dhowells(a)redhat.com>
afs: Fix afs_server_list to be cleaned up with RCU
Heiner Kallweit <hkallweit1(a)gmail.com>
Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
Harald Freudenberger <freude(a)linux.ibm.com>
s390/ap: fix AP bus crash on early config change callback invocation
Neil Armstrong <narmstrong(a)baylibre.com>
tty: serial: meson: retrieve port FIFO size from DT
Takashi Iwai <tiwai(a)suse.de>
media: imon: fix access to invalid resource for the second interface
Axel Lin <axel.lin(a)ingics.com>
i2c: sun6i-p2wi: Prevent potential division by zero
Qu Huang <qu.huang(a)linux.dev>
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
Patrick Thompson <ptf(a)google.com>
net: r8169: Disable multicast filter for RTL8168H and RTL8107E
Nathan Chancellor <nathan(a)kernel.org>
PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
Christopher Bednarz <christopher.n.bednarz(a)intel.com>
RDMA/irdma: Prevent zero-length STAG registration
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-usb | 11 -
Documentation/ABI/testing/sysfs-devices-removable | 17 ++
Makefile | 4 +-
arch/arm/xen/enlighten.c | 3 +-
arch/mips/kvm/mmu.c | 3 +-
arch/parisc/include/uapi/asm/errno.h | 2 -
arch/powerpc/kernel/fpu.S | 13 +
arch/powerpc/kernel/vector.S | 2 +
arch/s390/mm/page-states.c | 14 +-
drivers/acpi/resource.c | 7 +
drivers/ata/pata_isapnp.c | 3 +
drivers/base/core.c | 28 ++
drivers/base/dd.c | 4 +-
drivers/cpufreq/imx6q-cpufreq.c | 32 ++-
drivers/firewire/core-device.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 5 +
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 7 +
drivers/gpu/drm/panel/panel-simple.c | 13 +-
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +-
drivers/hid/hid-core.c | 16 +-
drivers/hid/hid-debug.c | 3 +
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +
drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 +
drivers/infiniband/hw/i40iw/i40iw_type.h | 2 +
drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 +-
drivers/input/joystick/xpad.c | 2 +
drivers/iommu/intel/iommu.c | 2 +-
drivers/md/bcache/btree.c | 6 +-
drivers/md/bcache/sysfs.c | 2 +-
drivers/md/bcache/writeback.c | 22 +-
drivers/md/dm-delay.c | 17 +-
drivers/md/dm-verity-fec.c | 3 +-
drivers/md/dm-verity-target.c | 4 +-
drivers/md/dm-verity.h | 6 -
drivers/media/i2c/smiapp/smiapp-core.c | 2 +-
drivers/media/rc/imon.c | 6 +
drivers/misc/pci_endpoint_test.c | 12 +
drivers/mmc/core/block.c | 2 +
drivers/mmc/core/core.c | 15 +-
drivers/mmc/core/regulator.c | 41 +++
drivers/mmc/host/cqhci.c | 44 +--
drivers/mmc/host/sdhci-sprd.c | 25 ++
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 +
drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 +-
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +-
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 +-
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 2 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +-
drivers/net/ethernet/realtek/r8169_main.c | 23 +-
drivers/net/ethernet/renesas/ravb_main.c | 20 +-
drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
drivers/net/hyperv/netvsc_drv.c | 66 +++--
drivers/net/usb/ax88179_178a.c | 4 +-
drivers/net/wireguard/device.c | 4 +-
drivers/net/wireguard/receive.c | 12 +-
drivers/net/wireguard/send.c | 3 +-
drivers/nvme/target/core.c | 21 +-
drivers/nvme/target/fabrics-cmd.c | 15 +-
drivers/nvme/target/nvmet.h | 5 +-
drivers/pci/controller/dwc/pci-keystone.c | 8 +-
drivers/pinctrl/core.c | 6 +-
drivers/s390/block/dasd.c | 24 +-
drivers/s390/crypto/ap_bus.c | 4 +
drivers/scsi/qla2xxx/qla_os.c | 14 +-
drivers/tty/serial/meson_uart.c | 2 +
drivers/usb/core/config.c | 85 +++---
drivers/usb/core/hub.c | 13 +-
drivers/usb/core/sysfs.c | 24 --
drivers/usb/dwc2/hcd_intr.c | 15 +-
drivers/usb/dwc3/core.c | 2 +
drivers/usb/dwc3/drd.c | 2 +-
drivers/usb/dwc3/dwc3-qcom.c | 52 +++-
drivers/usb/serial/option.c | 11 +-
drivers/video/fbdev/sticore.h | 2 +-
drivers/xen/swiotlb-xen.c | 1 +
fs/afs/dynroot.c | 4 +-
fs/afs/internal.h | 1 +
fs/afs/server_list.c | 2 +-
fs/afs/super.c | 2 +
fs/afs/vl_rotate.c | 10 +
fs/btrfs/disk-io.c | 1 +
fs/btrfs/ref-verify.c | 2 +
fs/btrfs/send.c | 2 +-
fs/btrfs/super.c | 5 +-
fs/btrfs/volumes.c | 9 +-
fs/cifs/cifsfs.c | 1 +
fs/cifs/xattr.c | 5 +-
fs/ext4/extents_status.c | 306 +++++++++++++++------
fs/inode.c | 16 ++
fs/nfsd/vfs.c | 12 +-
include/linux/device.h | 37 +++
include/linux/fs.h | 45 ++-
include/linux/hid.h | 5 +
include/linux/mmc/host.h | 3 +
include/linux/platform_data/x86/soc.h | 65 +++++
include/linux/usb.h | 7 -
include/linux/workqueue.h | 1 +
include/scsi/scsi_cmnd.h | 6 +
io_uring/io_uring.c | 2 +-
kernel/locking/lockdep.c | 3 +-
kernel/workqueue.c | 9 +
lib/errname.c | 6 -
net/ipv4/igmp.c | 6 +-
net/ipv4/route.c | 2 +-
net/smc/af_smc.c | 8 +-
security/integrity/iint.c | 48 +++-
sound/pci/hda/hda_intel.c | 2 +
sound/pci/hda/patch_realtek.c | 12 +
sound/soc/generic/simple-card.c | 6 +-
sound/soc/intel/common/soc-intel-quirks.h | 51 +---
sound/soc/sof/sof-pci-dev.c | 62 ++++-
tools/arch/parisc/include/uapi/asm/errno.h | 2 -
tools/perf/util/genelf.h | 4 +-
tools/perf/util/intel-pt.c | 13 +-
tools/testing/selftests/net/ipsec.c | 4 +-
tools/testing/selftests/net/mptcp/mptcp_connect.c | 11 +-
118 files changed, 1232 insertions(+), 518 deletions(-)
Hi!
The second patch of this series caused some troubles on 5.15.y, I apologize
about it [1].
When I tested it locally, I needed to set CONFIG_LIVEPATCH, so
kallsyms_on_each_symbol() would be known at link time.
To cope with this problem, we need to backport the first patch of this series as
pointed by Guenter Roeck [2].
This patch is only needed for 5.15, indeed the dependencies on CONFIG_LIVEPATCH
for kallsyms_on_each_symbol() was added in 3e3552056ab4
("kallsyms: only build {,module_}kallsyms_on_each_symbol when required").
This commit was first added to kernel 5.12, as git indicates it:
$ git name-rev --tags --name-only 3e3552056ab4
v5.12-rc1~67^2~8
Moreover, the first patch of this series, i.e. d721def7392a
("kallsyms: Make kallsyms_on_each_symbol generally available") was first added
in:
$ git name-rev --tags --name-only d721def7392a
v5.19-rc1~159^2~4^2~38^2~4
So, my patch only needs the first patch for the 5.15 kernel.
Regarding these two patches, I built and tested the series for several
architectures:
* i386:
$ make ARCH=i386 defconfig kvm_guest.config
...
$ make ARCH=i386 -j$(nproc)
...
Kernel: arch/x86/boot/bzImage is ready (#1)
$ bash run_extern_kernel.sh i386
...
root@vm-i386:~# uname -mr
5.15.140+ i686
root@vm-i386:~# echo 'p:myprobe name_show' > /sys/kernel/tracing/kprobe_events
-bash: echo: write error: Cannot assign requested address
* x86_64:
$ make x86_64_defconfig kvm_guest.config
...
$ make -j$(nproc)
...
Kernel: arch/x86/boot/bzImage is ready (#9)
$ bash run_extern_kernel.sh
...
root@vm-amd64:~# uname -rm
5.15.140+ x86_64
root@vm-amd64:~# echo 'p:myprobe name_show' > /sys/kernel/tracing/kprobe_events
-bash: echo: write error: Cannot assign requested address
* arm:
$ make ARCH=arm defconfig kvm_guest.config
...
$ make ARCH=arm menuconfig
# Add CONFIG_KPROBES
$ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- -j$(nproc)
...
Kernel: arch/arm/boot/zImage is ready
$ bash run_extern_kernel.sh armel
...
root@vm-armel:~# uname -mr
5.15.140-00002-gd3fdc3ca50b5 armv7l
root@vm-armel:~# echo 'p:myprobe name_show' > /sys/kernel/tracing/kprobe_events
-bash: echo: write error: Cannot assign requested address
* arm64:
$ make ARCH=arm64 defconfig kvm_guest.config
# Add CONFIG_KPROBES
...
$ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc)
...
OBJCOPY arch/arm64/boot/Image
GZIP arch/arm64/boot/Image.gz
$ bash run_extern_kernel.sh arm64
...
root@vm-arm64:~# uname -mr
5.15.140-00002-gd3fdc3ca50b5 aarch64
root@vm-arm64:~# echo 'p:myprobe name_show' > /sys/kernel/tracing/kprobe_events
-bash: echo: write error: Cannot assign requested address
If you see any ways to improve this patch, please share your feedback.
Francis Laniel (1):
tracing/kprobes: Return EADDRNOTAVAIL when func matches several
symbols
Jiri Olsa (1):
kallsyms: Make kallsyms_on_each_symbol generally available
include/linux/kallsyms.h | 7 +++-
kernel/kallsyms.c | 2 -
kernel/trace/trace_kprobe.c | 74 +++++++++++++++++++++++++++++++++++++
kernel/trace/trace_probe.h | 1 +
4 files changed, 81 insertions(+), 3 deletions(-)
Best regards.
---
[1]: https://lore.kernel.org/stable/CAEUSe78tYPTFuauB7cxZzvAeMhzB_25Q8DqLUfF7Nro…
[2]: https://lore.kernel.org/stable/06deae26-c59c-4746-867d-ab6f5852b0af@roeck-u…
--
2.34.1
The intended move from wait_for_completion_*() to
wait_for_completion_interruptible_*() was to allow (very) long spi memory
transfers to be stopped upon user request instead of freezing the
machine forever as the timeout value could now be significantly bigger.
However, depending on the user logic, applications can receive many
signals for their own "internal" purpose and have nothing to do with the
requested kernel operations, hence interrupting spi transfers upon any
signal is probably not a wise choice. Instead, let's switch to
wait_for_completion_killable_*() to only catch the "important"
signals. This was likely the intended behavior anyway.
Fixes: e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers")
Cc: stable(a)vger.kernel.org
Reported-by: Ronald Wahl <ronald.wahl(a)raritan.com>
Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
---
Hello Ronald, this is only compile tested, please let me know if that
fixes your use case or if you still suffer from interrupted transfers.
Thanks!
---
drivers/spi/spi-atmel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 6aa8adbe4170..2e8860865af9 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1336,8 +1336,8 @@ static int atmel_spi_one_transfer(struct spi_controller *host,
}
dma_timeout = msecs_to_jiffies(spi_controller_xfer_timeout(host, xfer));
- ret_timeout = wait_for_completion_interruptible_timeout(&as->xfer_completion,
- dma_timeout);
+ ret_timeout = wait_for_completion_killable_timeout(&as->xfer_completion,
+ dma_timeout);
if (ret_timeout <= 0) {
dev_err(&spi->dev, "spi transfer %s\n",
!ret_timeout ? "timeout" : "canceled");
--
2.34.1
Hi there,
We are pleased to inform you that AutoMechanika 2023 list is available for you to obtain at unlimited usage.
If I can be of any further assistance, please, let me know. So, that I will get back to you with the price and other details ASAP.
Awaiting your response.
Many thanks,
Aubrey Gill - Demand Generation
From: Chester Lin <clin(a)suse.com>
[ Upstream commit 08e8734d877a9a0fb8af1254a4ce58734fbef296 ]
With "W=1" and "-Wformat-truncation" build options, the kernel test robot
found a possible string truncation warning in pinctrl-s32cc.c, which uses
an 8-byte char array to hold a memory region name "map%u". Since the
maximum number of digits that a u32 value can present is 10, and the "map"
string occupies 3 bytes with a termination '\0', which means the rest 4
bytes cannot fully present the integer "X" that exceeds 4 digits.
Here we check if the number >= 10000, which is the lowest value that
contains more than 4 digits.
Reported-by: kernel test robot <lkp(a)intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311030159.iyUGjNGF-lkp@intel.com/
Signed-off-by: Chester Lin <clin(a)suse.com>
Link: https://lore.kernel.org/r/20231107141044.24058-1-clin@suse.com
Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-s32cc.c
index 7daff9f186cd8..f0cad2c501f76 100644
--- a/drivers/pinctrl/nxp/pinctrl-s32cc.c
+++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c
@@ -843,8 +843,8 @@ static int s32_pinctrl_probe_dt(struct platform_device *pdev,
if (!np)
return -ENODEV;
- if (mem_regions == 0) {
- dev_err(&pdev->dev, "mem_regions is 0\n");
+ if (mem_regions == 0 || mem_regions >= 10000) {
+ dev_err(&pdev->dev, "mem_regions is invalid: %u\n", mem_regions);
return -EINVAL;
}
--
2.42.0
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 2e84dc37920012b458e9458b19fc4ed33f81bc74
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112330-squealer-strife-0ecc@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
2e84dc379200 ("driver core: Release all resources during unbind before updating device links")
25f3bcfc54bc ("driver core: Add dma_cleanup callback in bus_type")
9ad307213fa4 ("driver core: Refactor multiple copies of device cleanup")
d8f7a5484f21 ("driver core: Free DMA range map when device is released")
885e50253bfd ("driver core: Move driver_sysfs_remove() after driver_sysfs_add()")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2e84dc37920012b458e9458b19fc4ed33f81bc74 Mon Sep 17 00:00:00 2001
From: Saravana Kannan <saravanak(a)google.com>
Date: Tue, 17 Oct 2023 18:38:50 -0700
Subject: [PATCH] driver core: Release all resources during unbind before
updating device links
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This commit fixes a bug in commit 9ed9895370ae ("driver core: Functional
dependencies tracking support") where the device link status was
incorrectly updated in the driver unbind path before all the device's
resources were released.
Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
Cc: stable <stable(a)kernel.org>
Reported-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Closes: https://lore.kernel.org/all/20231014161721.f4iqyroddkcyoefo@pengutronix.de/
Signed-off-by: Saravana Kannan <saravanak(a)google.com>
Cc: Thierry Reding <thierry.reding(a)gmail.com>
Cc: Yang Yingliang <yangyingliang(a)huawei.com>
Cc: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
Cc: Mark Brown <broonie(a)kernel.org>
Cc: Matti Vaittinen <mazziesaccount(a)gmail.com>
Cc: James Clark <james.clark(a)arm.com>
Acked-by: "Rafael J. Wysocki" <rafael(a)kernel.org>
Tested-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Acked-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Link: https://lore.kernel.org/r/20231018013851.3303928-1-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index a528cec24264..0c3725c3eefa 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1274,8 +1274,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
if (dev->bus && dev->bus->dma_cleanup)
dev->bus->dma_cleanup(dev);
- device_links_driver_cleanup(dev);
device_unbind_cleanup(dev);
+ device_links_driver_cleanup(dev);
klist_remove(&dev->p->knode_driver);
device_pm_check_callbacks(dev);
Current implementation blocks the running operations when Plug-out and
Plug-In is performed continuously, process gets stuck in
dwc3_thread_interrupt().
Code Flow:
CPU1
->Gadget_start
->dwc3_interrupt
->dwc3_thread_interrupt
->dwc3_process_event_buf
->dwc3_process_event_entry
->dwc3_endpoint_interrupt
->dwc3_ep0_interrupt
->dwc3_ep0_inspect_setup
->dwc3_ep0_stall_and_restart
By this time if pending_list is not empty, it will get the next request
on the given list and calls dwc3_gadget_giveback which will unmap request
and call its complete() callback to notify upper layers that it has
completed. Currently dwc3_gadget_giveback status is set to-ECONNRESET,
whereas it should be -ESHUTDOWN.
Cc: <stable(a)vger.kernel.org>
Fixes: d742220b3577 ("usb: dwc3: ep0: giveback requests on stall_and_restart")
Signed-off-by: Uttkarsh Aggarwal <quic_uaggarwa(a)quicinc.com>
---
drivers/usb/dwc3/ep0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index b94243237293..8317fedda1c0 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -238,7 +238,7 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
struct dwc3_request *req;
req = next_request(&dep->pending_list);
- dwc3_gadget_giveback(dep, req, -ECONNRESET);
+ dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
}
dwc->eps[0]->trb_enqueue = 0;
--
2.17.1
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x b56ebe7c896dc78b5865ec2c4b1dae3c93537517
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112040-sudden-savanna-4847@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
b56ebe7c896d ("x86/apic/msi: Fix misconfigured non-maskable MSI quirk")
9c15eeb5362c ("genirq: Allow fasteoi handler to resend interrupts on concurrent handling")
0cfb4a1af386 ("genirq: Use BIT() for the IRQD_* state flags")
b6d5fc3a5245 ("x86/apic/vector: Provide MSI parent domain")
2d958b02b04f ("genirq/msi: Rearrange MSI domain flags")
3dad5f9ad99b ("genirq/msi: Move IRQ_DOMAIN_MSI_NOMASK_QUIRK to MSI flags")
d474d92d7025 ("x86/apic: Remove X86_IRQ_ALLOC_CONTIGUOUS_VECTORS")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b56ebe7c896dc78b5865ec2c4b1dae3c93537517 Mon Sep 17 00:00:00 2001
From: Koichiro Den <den(a)valinux.co.jp>
Date: Thu, 26 Oct 2023 12:20:36 +0900
Subject: [PATCH] x86/apic/msi: Fix misconfigured non-maskable MSI quirk
commit ef8dd01538ea ("genirq/msi: Make interrupt allocation less
convoluted"), reworked the code so that the x86 specific quirk for affinity
setting of non-maskable PCI/MSI interrupts is not longer activated if
necessary.
This could be solved by restoring the original logic in the core MSI code,
but after a deeper analysis it turned out that the quirk flag is not
required at all.
The quirk is only required when the PCI/MSI device cannot mask the MSI
interrupts, which in turn also prevents reservation mode from being enabled
for the affected interrupt.
This allows ot remove the NOMASK quirk bit completely as msi_set_affinity()
can instead check whether reservation mode is enabled for the interrupt,
which gives exactly the same answer.
Even in the momentary non-existing case that the reservation mode would be
not set for a maskable MSI interrupt this would not cause any harm as it
just would cause msi_set_affinity() to go needlessly through the
functionaly equivalent slow path, which works perfectly fine with maskable
interrupts as well.
Rework msi_set_affinity() to query the reservation mode and remove all
NOMASK quirk logic from the core code.
[ tglx: Massaged changelog ]
Fixes: ef8dd01538ea ("genirq/msi: Make interrupt allocation less convoluted")
Suggested-by: Thomas Gleixner <tglx(a)linutronix.de>
Signed-off-by: Koichiro Den <den(a)valinux.co.jp>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/r/20231026032036.2462428-1-den@valinux.co.jp
diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
index 6b6b711678fe..d9651f15ae4f 100644
--- a/arch/x86/kernel/apic/msi.c
+++ b/arch/x86/kernel/apic/msi.c
@@ -55,14 +55,14 @@ msi_set_affinity(struct irq_data *irqd, const struct cpumask *mask, bool force)
* caused by the non-atomic update of the address/data pair.
*
* Direct update is possible when:
- * - The MSI is maskable (remapped MSI does not use this code path)).
- * The quirk bit is not set in this case.
+ * - The MSI is maskable (remapped MSI does not use this code path).
+ * The reservation mode bit is set in this case.
* - The new vector is the same as the old vector
* - The old vector is MANAGED_IRQ_SHUTDOWN_VECTOR (interrupt starts up)
* - The interrupt is not yet started up
* - The new destination CPU is the same as the old destination CPU
*/
- if (!irqd_msi_nomask_quirk(irqd) ||
+ if (!irqd_can_reserve(irqd) ||
cfg->vector == old_cfg.vector ||
old_cfg.vector == MANAGED_IRQ_SHUTDOWN_VECTOR ||
!irqd_is_started(irqd) ||
@@ -215,8 +215,6 @@ static bool x86_init_dev_msi_info(struct device *dev, struct irq_domain *domain,
if (WARN_ON_ONCE(domain != real_parent))
return false;
info->chip->irq_set_affinity = msi_set_affinity;
- /* See msi_set_affinity() for the gory details */
- info->flags |= MSI_FLAG_NOMASK_QUIRK;
break;
case DOMAIN_BUS_DMAR:
case DOMAIN_BUS_AMDVI:
diff --git a/include/linux/irq.h b/include/linux/irq.h
index d8a6fdce9373..90081afa10ce 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -215,8 +215,6 @@ struct irq_data {
* IRQD_SINGLE_TARGET - IRQ allows only a single affinity target
* IRQD_DEFAULT_TRIGGER_SET - Expected trigger already been set
* IRQD_CAN_RESERVE - Can use reservation mode
- * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change
- * required
* IRQD_HANDLE_ENFORCE_IRQCTX - Enforce that handle_irq_*() is only invoked
* from actual interrupt context.
* IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call
@@ -247,11 +245,10 @@ enum {
IRQD_SINGLE_TARGET = BIT(24),
IRQD_DEFAULT_TRIGGER_SET = BIT(25),
IRQD_CAN_RESERVE = BIT(26),
- IRQD_MSI_NOMASK_QUIRK = BIT(27),
- IRQD_HANDLE_ENFORCE_IRQCTX = BIT(28),
- IRQD_AFFINITY_ON_ACTIVATE = BIT(29),
- IRQD_IRQ_ENABLED_ON_SUSPEND = BIT(30),
- IRQD_RESEND_WHEN_IN_PROGRESS = BIT(31),
+ IRQD_HANDLE_ENFORCE_IRQCTX = BIT(27),
+ IRQD_AFFINITY_ON_ACTIVATE = BIT(28),
+ IRQD_IRQ_ENABLED_ON_SUSPEND = BIT(29),
+ IRQD_RESEND_WHEN_IN_PROGRESS = BIT(30),
};
#define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors)
@@ -426,21 +423,6 @@ static inline bool irqd_can_reserve(struct irq_data *d)
return __irqd_to_state(d) & IRQD_CAN_RESERVE;
}
-static inline void irqd_set_msi_nomask_quirk(struct irq_data *d)
-{
- __irqd_to_state(d) |= IRQD_MSI_NOMASK_QUIRK;
-}
-
-static inline void irqd_clr_msi_nomask_quirk(struct irq_data *d)
-{
- __irqd_to_state(d) &= ~IRQD_MSI_NOMASK_QUIRK;
-}
-
-static inline bool irqd_msi_nomask_quirk(struct irq_data *d)
-{
- return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK;
-}
-
static inline void irqd_set_affinity_on_activate(struct irq_data *d)
{
__irqd_to_state(d) |= IRQD_AFFINITY_ON_ACTIVATE;
diff --git a/include/linux/msi.h b/include/linux/msi.h
index a50ea79522f8..ddace8c34dcf 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -547,12 +547,6 @@ enum {
MSI_FLAG_ALLOC_SIMPLE_MSI_DESCS = (1 << 5),
/* Free MSI descriptors */
MSI_FLAG_FREE_MSI_DESCS = (1 << 6),
- /*
- * Quirk to handle MSI implementations which do not provide
- * masking. Currently known to affect x86, but has to be partially
- * handled in the core MSI code.
- */
- MSI_FLAG_NOMASK_QUIRK = (1 << 7),
/* Mask for the generic functionality */
MSI_GENERIC_FLAGS_MASK = GENMASK(15, 0),
diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c
index 5971a66be034..aae0402507ed 100644
--- a/kernel/irq/debugfs.c
+++ b/kernel/irq/debugfs.c
@@ -121,7 +121,6 @@ static const struct irq_bit_descr irqdata_states[] = {
BIT_MASK_DESCR(IRQD_AFFINITY_ON_ACTIVATE),
BIT_MASK_DESCR(IRQD_MANAGED_SHUTDOWN),
BIT_MASK_DESCR(IRQD_CAN_RESERVE),
- BIT_MASK_DESCR(IRQD_MSI_NOMASK_QUIRK),
BIT_MASK_DESCR(IRQD_FORWARDED_TO_VCPU),
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index b4c31a5c1147..79b4a58ba9c3 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -1204,7 +1204,6 @@ static int msi_handle_pci_fail(struct irq_domain *domain, struct msi_desc *desc,
#define VIRQ_CAN_RESERVE 0x01
#define VIRQ_ACTIVATE 0x02
-#define VIRQ_NOMASK_QUIRK 0x04
static int msi_init_virq(struct irq_domain *domain, int virq, unsigned int vflags)
{
@@ -1213,8 +1212,6 @@ static int msi_init_virq(struct irq_domain *domain, int virq, unsigned int vflag
if (!(vflags & VIRQ_CAN_RESERVE)) {
irqd_clr_can_reserve(irqd);
- if (vflags & VIRQ_NOMASK_QUIRK)
- irqd_set_msi_nomask_quirk(irqd);
/*
* If the interrupt is managed but no CPU is available to
@@ -1275,15 +1272,8 @@ static int __msi_domain_alloc_irqs(struct device *dev, struct irq_domain *domain
* Interrupt can use a reserved vector and will not occupy
* a real device vector until the interrupt is requested.
*/
- if (msi_check_reservation_mode(domain, info, dev)) {
+ if (msi_check_reservation_mode(domain, info, dev))
vflags |= VIRQ_CAN_RESERVE;
- /*
- * MSI affinity setting requires a special quirk (X86) when
- * reservation mode is active.
- */
- if (info->flags & MSI_FLAG_NOMASK_QUIRK)
- vflags |= VIRQ_NOMASK_QUIRK;
- }
xa_for_each_range(xa, idx, desc, ctrl->first, ctrl->last) {
if (!msi_desc_match(desc, MSI_DESC_NOTASSOCIATED))
From: Charles Keepax <ckeepax(a)opensource.cirrus.com>
[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ]
MIPS appears to define a RST symbol at a high level, which clashes
with some register naming in the driver. Since there is currently
no case for running this driver on MIPS devices simply cut off the
build of this driver on MIPS.
Reported-by: kernel test robot <lkp(a)intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/
Suggested-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Charles Keepax <ckeepax(a)opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirru…
Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/pinctrl/cirrus/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig
index 530426a74f751..b3cea8d56c4f6 100644
--- a/drivers/pinctrl/cirrus/Kconfig
+++ b/drivers/pinctrl/cirrus/Kconfig
@@ -1,7 +1,8 @@
# SPDX-License-Identifier: GPL-2.0-only
config PINCTRL_LOCHNAGAR
tristate "Cirrus Logic Lochnagar pinctrl driver"
- depends on MFD_LOCHNAGAR
+ # Avoid clash caused by MIPS defining RST, which is used in the driver
+ depends on MFD_LOCHNAGAR && !MIPS
select GPIOLIB
select PINMUX
select PINCONF
--
2.42.0
From: Charles Keepax <ckeepax(a)opensource.cirrus.com>
[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ]
MIPS appears to define a RST symbol at a high level, which clashes
with some register naming in the driver. Since there is currently
no case for running this driver on MIPS devices simply cut off the
build of this driver on MIPS.
Reported-by: kernel test robot <lkp(a)intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/
Suggested-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Charles Keepax <ckeepax(a)opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirru…
Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/pinctrl/cirrus/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig
index 530426a74f751..b3cea8d56c4f6 100644
--- a/drivers/pinctrl/cirrus/Kconfig
+++ b/drivers/pinctrl/cirrus/Kconfig
@@ -1,7 +1,8 @@
# SPDX-License-Identifier: GPL-2.0-only
config PINCTRL_LOCHNAGAR
tristate "Cirrus Logic Lochnagar pinctrl driver"
- depends on MFD_LOCHNAGAR
+ # Avoid clash caused by MIPS defining RST, which is used in the driver
+ depends on MFD_LOCHNAGAR && !MIPS
select GPIOLIB
select PINMUX
select PINCONF
--
2.42.0
From: Charles Keepax <ckeepax(a)opensource.cirrus.com>
[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ]
MIPS appears to define a RST symbol at a high level, which clashes
with some register naming in the driver. Since there is currently
no case for running this driver on MIPS devices simply cut off the
build of this driver on MIPS.
Reported-by: kernel test robot <lkp(a)intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/
Suggested-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Charles Keepax <ckeepax(a)opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirru…
Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/pinctrl/cirrus/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig
index 530426a74f751..b3cea8d56c4f6 100644
--- a/drivers/pinctrl/cirrus/Kconfig
+++ b/drivers/pinctrl/cirrus/Kconfig
@@ -1,7 +1,8 @@
# SPDX-License-Identifier: GPL-2.0-only
config PINCTRL_LOCHNAGAR
tristate "Cirrus Logic Lochnagar pinctrl driver"
- depends on MFD_LOCHNAGAR
+ # Avoid clash caused by MIPS defining RST, which is used in the driver
+ depends on MFD_LOCHNAGAR && !MIPS
select GPIOLIB
select PINMUX
select PINCONF
--
2.42.0
__cont_access_flags_changed was originally introduced to avoid making
unnecessary changes to the PTEs. Consider the following case: all the
PTEs in the contiguous group have PTE_DIRTY | PTE_RDONLY | PTE_WRITE,
and we are running on a system without HAFDBS. When writing via these
PTEs, we will get a page fault, and hugetlb_fault will (rightly)
attempt to update the PTEs with PTE_DIRTY | PTE_WRITE, but, as both the
original PTEs and the new PTEs are pte_dirty(),
__cont_access_flags_changed prevents the pgprot update from occurring.
To avoid the page fault loop that we get ourselves into, distinguish
between hardware-dirty and software-dirty for this check. Non-contiguous
PTEs aren't broken in the same way, as we will always write a new PTE
unless the new PTE is exactly equal to the old one.
Fixes: 031e6e6b4e12 ("arm64: hugetlb: Avoid unnecessary clearing in huge_ptep_set_access_flags")
Signed-off-by: James Houghton <jthoughton(a)google.com>
Cc: <stable(a)vger.kernel.org>
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index f5aae342632c..87a9564976fa 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -437,7 +437,10 @@ static int __cont_access_flags_changed(pte_t *ptep, pte_t pte, int ncontig)
for (i = 0; i < ncontig; i++) {
pte_t orig_pte = ptep_get(ptep + i);
- if (pte_dirty(pte) != pte_dirty(orig_pte))
+ if (pte_sw_dirty(pte) != pte_sw_dirty(orig_pte))
+ return 1;
+
+ if (pte_hw_dirty(pte) != pte_hw_dirty(orig_pte))
return 1;
if (pte_young(pte) != pte_young(orig_pte))
--
2.43.0.rc2.451.g8631bc7472-goog
Users have reported problems with recent Lenovo laptops that contain
an IDEA5002 I2C HID device. Reports include fans turning on and
running even at idle and spurious wakeups from suspend.
Presumably in the Windows ecosystem there is an application that
uses the HID device. Maybe that puts it into a lower power state so
it doesn't cause spurious events.
This device doesn't serve any functional purpose in Linux as nothing
interacts with it so blacklist it from being probed. This will
prevent the GPIO driver from setting up the GPIO and the spurious
interrupts and wake events will not occur.
Cc: stable(a)vger.kernel.org # 6.1
Reported-and-tested-by: Marcus Aram <marcus+oss(a)oxar.nl>
Reported-and-tested-by: Mark Herbert <mark.herbert42(a)gmail.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2812
Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com>
---
drivers/hid/i2c-hid/i2c-hid-acpi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.c b/drivers/hid/i2c-hid/i2c-hid-acpi.c
index ac918a9ea8d3..1b49243adb16 100644
--- a/drivers/hid/i2c-hid/i2c-hid-acpi.c
+++ b/drivers/hid/i2c-hid/i2c-hid-acpi.c
@@ -40,6 +40,11 @@ static const struct acpi_device_id i2c_hid_acpi_blacklist[] = {
* ICN8505 controller, has a _CID of PNP0C50 but is not HID compatible.
*/
{ "CHPN0001" },
+ /*
+ * The IDEA5002 ACPI device causes high interrupt usage and spurious
+ * wakeups from suspend.
+ */
+ { "IDEA5002" },
{ }
};
--
2.34.1
This is the start of the stable review cycle for the 5.15.141 release.
There are 69 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 02 Dec 2023 16:21:18 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.141-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.141-rc1
Keith Busch <kbusch(a)kernel.org>
io_uring: fix off-by one bvec index
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix wakeup after probe deferral
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix software node leak on probe errors
Ricardo Ribalda <ribalda(a)chromium.org>
usb: dwc3: set the dma max_seg_size
Alexander Stein <alexander.stein(a)ew.tq-group.com>
usb: dwc3: Fix default mode initialization
Oliver Neukum <oneukum(a)suse.com>
USB: dwc2: write HCINT with INTMASK applied
Badhri Jagan Sridharan <badhri(a)google.com>
usb: typec: tcpm: Skip hard reset when in error recovery
Lech Perczak <lech.perczak(a)gmail.com>
USB: serial: option: don't claim interface 4 for ZTE MF290
Puliang Lu <puliang.lu(a)fibocom.com>
USB: serial: option: fix FM101R-GL defines
Victor Fragoso <victorffs(a)hotmail.com>
USB: serial: option: add Fibocom L7xx modules
Pawel Laszczak <pawell(a)cadence.com>
usb: cdnsp: Fix deadlock issue during using NCM gadget
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup lock c->root error
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup init dirty data errors
Rand Deeb <rand.sec96(a)gmail.com>
bcache: prevent potential division by zero error
Coly Li <colyli(a)suse.de>
bcache: check return value from btree_node_alloc_replacement()
Mikulas Patocka <mpatocka(a)redhat.com>
dm-delay: fix a race between delay_presuspend and delay_bio
Long Li <longli(a)microsoft.com>
hv_netvsc: Mark VF as slave before exposing it to user-mode
Haiyang Zhang <haiyangz(a)microsoft.com>
hv_netvsc: Fix race of register_netdevice_notifier and VF register
Asuna Yang <spriteovo(a)gmail.com>
USB: serial: option: add Luat Air72*U series products
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: protect device queue against concurrent access
Charles Mirabile <cmirabil(a)redhat.com>
io_uring/fs: consider link->flags when getting path for LINKAT
Mingzhe Zou <mingzhe.zou(a)easystack.cn>
bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race
Song Liu <song(a)kernel.org>
md: fix bi_status reporting in md_end_clone_io
Coly Li <colyli(a)suse.de>
bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
Keith Busch <kbusch(a)kernel.org>
swiotlb-xen: provide the "max_mapping_size" method
Hans de Goede <hdegoede(a)redhat.com>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
Krister Johansen <kjlx(a)templeofstupid.com>
proc: sysctl: prevent aliased sysctls from getting passed to init
Francis Laniel <flaniel(a)linux.microsoft.com>
tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
Zhang Yi <yi.zhang(a)huawei.com>
ext4: make sure allocate pending entry not fail
Baokun Li <libaokun1(a)huawei.com>
ext4: fix slab-use-after-free in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_insert_delayed_block()
Baokun Li <libaokun1(a)huawei.com>
ext4: using nofail preallocation in ext4_es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_remove_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: use pre-allocated es in __es_insert_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: factor out __es_alloc_extent() and __es_free_extent()
Baokun Li <libaokun1(a)huawei.com>
ext4: add a new helper to check if es must be kept
Andrey Konovalov <andrey.konovalov(a)linaro.org>
media: qcom: camss: Fix csid-gen2 for test pattern generator
Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
media: qcom: camss: Fix set CSI2_RX_CFG1_VC_MODE when VC is greater than 3
Milen Mitkov <quic_mmitkov(a)quicinc.com>
media: camss: sm8250: Virtual channels for CSID
Souptick Joarder (HPE) <jrdr.linux(a)gmail.com>
media: camss: Replace hard coded value with parameter
Huacai Chen <chenhuacai(a)kernel.org>
MIPS: KVM: Fix a build warning about variable set but not used
Peter Zijlstra <peterz(a)infradead.org>
lockdep: Fix block chain corruption
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix ACPI platform device leak
Johan Hovold <johan+linaro(a)kernel.org>
USB: dwc3: qcom: fix resource leaks on probe deferral
Christoph Hellwig <hch(a)lst.de>
nvmet: nul-terminate the NQNs passed in the connect command
David Howells <dhowells(a)redhat.com>
afs: Fix file locking on R/O volumes to operate in local mode
David Howells <dhowells(a)redhat.com>
afs: Return ENOENT if no cell DNS record can be found
Samuel Holland <samuel.holland(a)sifive.com>
net: axienet: Fix check for partial TX checksum
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: propagate the correct speed and duplex status
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle the corner-case during tx completion
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: handle corner-case during sfp hotplug
Suman Ghosh <sumang(a)marvell.com>
octeontx2-pf: Fix ntuple rule creation to direct packet to VF with higher Rx queue than its PF
Stefano Stabellini <sstabellini(a)kernel.org>
arm/xen: fix xen_vcpu_info allocation alignment
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: avoid data corruption caused by decline
Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com>
net: usb: ax88179_178a: fix failed operations during ax88179_reset
Kunwu Chan <chentao(a)kylinos.cn>
ipv4: Correct/silence an endian warning in __ip_do_redirect
Charles Yi <be286(a)163.com>
HID: fix HID device resource race between HID core and debugging support
Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
HID: core: store the unique system identifier in hid_device
Jonas Karlman <jonas(a)kwiboo.se>
drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
Chen Ni <nichen(a)iscas.ac.cn>
ata: pata_isapnp: Add missing error check for devm_ioport_map()
Suman Ghosh <sumang(a)marvell.com>
octeontx2-pf: Fix memory leak during interface down
Eric Dumazet <edumazet(a)google.com>
wireguard: use DEV_STATS_INC()
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 timings
Marek Vasut <marex(a)denx.de>
drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
Xuxin Xiong <xuxinxiong(a)huaqin.corp-partner.google.com>
drm/panel: auo,b101uan08.3: Fine tune the panel power sequence
Shuijing Li <shuijing.li(a)mediatek.com>
drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence
David Howells <dhowells(a)redhat.com>
afs: Make error on cell lookup failure consistent with OpenAFS
David Howells <dhowells(a)redhat.com>
afs: Fix afs_server_list to be cleaned up with RCU
-------------
Diffstat:
Makefile | 4 +-
arch/arm/xen/enlighten.c | 3 +-
arch/mips/kvm/mmu.c | 3 +-
drivers/acpi/resource.c | 7 +
drivers/ata/pata_isapnp.c | 3 +
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 7 +
drivers/gpu/drm/panel/panel-simple.c | 13 +-
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +-
drivers/hid/hid-core.c | 16 +-
drivers/hid/hid-debug.c | 3 +
drivers/md/bcache/btree.c | 4 +-
drivers/md/bcache/sysfs.c | 2 +-
drivers/md/bcache/writeback.c | 22 +-
drivers/md/dm-delay.c | 17 +-
drivers/md/md.c | 3 +-
drivers/media/platform/qcom/camss/camss-csid-170.c | 65 +++--
drivers/media/platform/qcom/camss/camss-csid.c | 44 ++-
drivers/media/platform/qcom/camss/camss-csid.h | 11 +-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 +
drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 +-
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +-
.../ethernet/marvell/octeontx2/nic/otx2_flows.c | 20 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
drivers/net/hyperv/netvsc_drv.c | 41 ++-
drivers/net/usb/ax88179_178a.c | 4 +-
drivers/net/wireguard/device.c | 4 +-
drivers/net/wireguard/receive.c | 12 +-
drivers/net/wireguard/send.c | 3 +-
drivers/nvme/target/fabrics-cmd.c | 4 +
drivers/s390/block/dasd.c | 24 +-
drivers/usb/cdns3/cdnsp-ring.c | 3 +
drivers/usb/dwc2/hcd_intr.c | 15 +-
drivers/usb/dwc3/core.c | 2 +
drivers/usb/dwc3/drd.c | 2 +-
drivers/usb/dwc3/dwc3-qcom.c | 65 +++--
drivers/usb/serial/option.c | 11 +-
drivers/usb/typec/tcpm/tcpm.c | 9 +
drivers/xen/swiotlb-xen.c | 1 +
fs/afs/dynroot.c | 4 +-
fs/afs/internal.h | 1 +
fs/afs/server_list.c | 2 +-
fs/afs/super.c | 2 +
fs/afs/vl_rotate.c | 10 +
fs/ext4/extents_status.c | 306 +++++++++++++++------
fs/proc/proc_sysctl.c | 7 +
include/linux/hid.h | 5 +
include/linux/sysctl.h | 6 +
init/main.c | 4 +
io_uring/io_uring.c | 4 +-
kernel/locking/lockdep.c | 3 +-
kernel/trace/trace_kprobe.c | 74 +++++
kernel/trace/trace_probe.h | 1 +
net/ipv4/route.c | 2 +-
net/smc/af_smc.c | 8 +-
55 files changed, 704 insertions(+), 239 deletions(-)
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 724ff68e968b19d786870d333f9952bdd6b119cb
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112431-footpath-exes-5997@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
724ff68e968b ("media: ccs: Correctly initialise try compose rectangle")
b24cc2a18c50 ("media: smiapp: Rename as "ccs"")
161cc847370a ("media: smiapp: Internal rename to CCS")
47ff2ff267ee ("media: smiapp: Rename register access functions")
235ac9a4b36c ("media: smiapp: Remove quirk function for writing a single 8-bit register")
42aab58f456a ("media: smiapp: Use CCS registers")
3e158e1f1ec2 ("media: smiapp: Switch to CCS limits")
ca296a11156a ("media: smiapp: Read CCS limit values")
503a88422fb0 ("media: smiapp: Use MIPI CCS version and manufacturer ID information")
e66a7c849086 ("media: smiapp: Add macros for accessing CCS registers")
cb50351be662 ("media: smiapp: Remove macros for defining registers, merge definitions")
ab47d5cd8253 ("media: smiapp: Calculate CCS limit offsets and limit buffer size")
82731a194fc1 ("media: smiapp: Use CCS register flags")
6493c4b777c2 ("media: smiapp: Import CCS definitions")
1ec0b899c2b7 ("media: ccs: Add the generator for CCS register definitions and limits")
b5783c4d1fbe ("media: i2c: smiapp: simplify getting state container")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 724ff68e968b19d786870d333f9952bdd6b119cb Mon Sep 17 00:00:00 2001
From: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Date: Mon, 4 Sep 2023 15:57:37 +0300
Subject: [PATCH] media: ccs: Correctly initialise try compose rectangle
Initialise the try sink compose rectangle size to the sink compose
rectangle for binner and scaler sub-devices. This was missed due to the
faulty condition that lead to the compose rectangles to be initialised for
the pixel array sub-device where it is not relevant.
Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c
index 6a8116454f87..022e8712d48e 100644
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -3097,7 +3097,7 @@ static int ccs_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
try_fmt->code = sensor->internal_csi_format->code;
try_fmt->field = V4L2_FIELD_NONE;
- if (ssd != sensor->pixel_array)
+ if (ssd == sensor->pixel_array)
continue;
try_comp = v4l2_subdev_get_try_compose(sd, fh->state, i);
Add the necessary definitions to the qcom-cpufreq-nvmem driver to
support basic cpufreq scaling on the Qualcomm MSM8909 SoC. In practice
the necessary power domains vary depending on the actual PMIC the SoC
was combined with. With PM8909 the VDD_APC power domain is shared with
VDD_CX so the RPM firmware handles all voltage adjustments, while with
PM8916 and PM660 Linux is responsible to do adaptive voltage scaling
of a dedicated CPU regulator using CPR.
Signed-off-by: Stephan Gerhold <stephan.gerhold(a)kernkonzept.com>
---
Stephan Gerhold (4):
cpufreq: qcom-nvmem: Enable virtual power domain devices
cpufreq: dt: platdev: Add MSM8909 to blocklist
dt-bindings: cpufreq: qcom-nvmem: Document MSM8909
cpufreq: qcom-nvmem: Add MSM8909
.../bindings/cpufreq/qcom-cpufreq-nvmem.yaml | 1 +
drivers/cpufreq/cpufreq-dt-platdev.c | 1 +
drivers/cpufreq/qcom-cpufreq-nvmem.c | 47 +++++++++++++++++++++-
3 files changed, 48 insertions(+), 1 deletion(-)
---
base-commit: 0bb80ecc33a8fb5a682236443c1e740d5c917d1d
change-id: 20230906-msm8909-cpufreq-dff238de9ff3
Best regards,
--
Stephan Gerhold <stephan.gerhold(a)kernkonzept.com>
Kernkonzept GmbH at Dresden, Germany, HRB 31129, CEO Dr.-Ing. Michael Hohmuth
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: imx355: Enable runtime PM before registering async sub-device
Author: Bingbu Cao <bingbu.cao(a)intel.com>
Date: Wed Nov 22 17:46:06 2023 +0800
As the sensor device maybe accessible right after its async sub-device is
registered, such as ipu-bridge will try to power up sensor by sensor's
client device's runtime PM from the async notifier callback, if runtime PM
is not enabled, it will fail.
So runtime PM should be ready before its async sub-device is registered
and accessible by others.
Fixes: df0b5c4a7ddd ("media: add imx355 camera sensor driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bingbu Cao <bingbu.cao(a)intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
drivers/media/i2c/imx355.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
---
diff --git a/drivers/media/i2c/imx355.c b/drivers/media/i2c/imx355.c
index e1b1d2fc79dd..8c995c58743a 100644
--- a/drivers/media/i2c/imx355.c
+++ b/drivers/media/i2c/imx355.c
@@ -1747,10 +1747,6 @@ static int imx355_probe(struct i2c_client *client)
goto error_handler_free;
}
- ret = v4l2_async_register_subdev_sensor(&imx355->sd);
- if (ret < 0)
- goto error_media_entity;
-
/*
* Device is already turned on by i2c-core with ACPI domain PM.
* Enable runtime PM and turn off the device.
@@ -1759,9 +1755,15 @@ static int imx355_probe(struct i2c_client *client)
pm_runtime_enable(&client->dev);
pm_runtime_idle(&client->dev);
+ ret = v4l2_async_register_subdev_sensor(&imx355->sd);
+ if (ret < 0)
+ goto error_media_entity_runtime_pm;
+
return 0;
-error_media_entity:
+error_media_entity_runtime_pm:
+ pm_runtime_disable(&client->dev);
+ pm_runtime_set_suspended(&client->dev);
media_entity_cleanup(&imx355->sd.entity);
error_handler_free:
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: ov01a10: Enable runtime PM before registering async sub-device
Author: Bingbu Cao <bingbu.cao(a)intel.com>
Date: Wed Nov 22 17:46:07 2023 +0800
As the sensor device maybe accessible right after its async sub-device is
registered, such as ipu-bridge will try to power up sensor by sensor's
client device's runtime PM from the async notifier callback, if runtime PM
is not enabled, it will fail.
So runtime PM should be ready before its async sub-device is registered
and accessible by others.
It also sets the runtime PM status to active as the sensor was turned
on by i2c-core.
Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bingbu Cao <bingbu.cao(a)intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
drivers/media/i2c/ov01a10.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
---
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index 7cca9294ea31..5606437f37d0 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -862,6 +862,7 @@ static void ov01a10_remove(struct i2c_client *client)
v4l2_ctrl_handler_free(sd->ctrl_handler);
pm_runtime_disable(&client->dev);
+ pm_runtime_set_suspended(&client->dev);
}
static int ov01a10_probe(struct i2c_client *client)
@@ -909,17 +910,26 @@ static int ov01a10_probe(struct i2c_client *client)
goto err_media_entity_cleanup;
}
+ /*
+ * Device is already turned on by i2c-core with ACPI domain PM.
+ * Enable runtime PM and turn off the device.
+ */
+ pm_runtime_set_active(&client->dev);
+ pm_runtime_enable(dev);
+ pm_runtime_idle(dev);
+
ret = v4l2_async_register_subdev_sensor(&ov01a10->sd);
if (ret < 0) {
dev_err(dev, "Failed to register subdev: %d\n", ret);
- goto err_media_entity_cleanup;
+ goto err_pm_disable;
}
- pm_runtime_enable(dev);
- pm_runtime_idle(dev);
-
return 0;
+err_pm_disable:
+ pm_runtime_disable(dev);
+ pm_runtime_set_suspended(&client->dev);
+
err_media_entity_cleanup:
media_entity_cleanup(&ov01a10->sd.entity);
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: ov13b10: Enable runtime PM before registering async sub-device
Author: Bingbu Cao <bingbu.cao(a)intel.com>
Date: Wed Nov 22 17:46:08 2023 +0800
As the sensor device maybe accessible right after its async sub-device is
registered, such as ipu-bridge will try to power up sensor by sensor's
client device's runtime PM from the async notifier callback, if runtime PM
is not enabled, it will fail.
So runtime PM should be ready before its async sub-device is registered
and accessible by others.
Fixes: 7ee850546822 ("media: Add sensor driver support for the ov13b10 camera.")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bingbu Cao <bingbu.cao(a)intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
drivers/media/i2c/ov13b10.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
---
diff --git a/drivers/media/i2c/ov13b10.c b/drivers/media/i2c/ov13b10.c
index c06411d5ee2b..73c844aa5697 100644
--- a/drivers/media/i2c/ov13b10.c
+++ b/drivers/media/i2c/ov13b10.c
@@ -1554,24 +1554,27 @@ static int ov13b10_probe(struct i2c_client *client)
goto error_handler_free;
}
- ret = v4l2_async_register_subdev_sensor(&ov13b->sd);
- if (ret < 0)
- goto error_media_entity;
/*
* Device is already turned on by i2c-core with ACPI domain PM.
* Enable runtime PM and turn off the device.
*/
-
/* Set the device's state to active if it's in D0 state. */
if (full_power)
pm_runtime_set_active(&client->dev);
pm_runtime_enable(&client->dev);
pm_runtime_idle(&client->dev);
+ ret = v4l2_async_register_subdev_sensor(&ov13b->sd);
+ if (ret < 0)
+ goto error_media_entity_runtime_pm;
+
return 0;
-error_media_entity:
+error_media_entity_runtime_pm:
+ pm_runtime_disable(&client->dev);
+ if (full_power)
+ pm_runtime_set_suspended(&client->dev);
media_entity_cleanup(&ov13b->sd.entity);
error_handler_free:
@@ -1594,6 +1597,7 @@ static void ov13b10_remove(struct i2c_client *client)
ov13b10_free_controls(ov13b);
pm_runtime_disable(&client->dev);
+ pm_runtime_set_suspended(&client->dev);
}
static DEFINE_RUNTIME_DEV_PM_OPS(ov13b10_pm_ops, ov13b10_suspend,
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: ov9734: Enable runtime PM before registering async sub-device
Author: Bingbu Cao <bingbu.cao(a)intel.com>
Date: Wed Nov 22 17:46:09 2023 +0800
As the sensor device maybe accessible right after its async sub-device is
registered, such as ipu-bridge will try to power up sensor by sensor's
client device's runtime PM from the async notifier callback, if runtime PM
is not enabled, it will fail.
So runtime PM should be ready before its async sub-device is registered
and accessible by others.
Fixes: d3f863a63fe4 ("media: i2c: Add ov9734 image sensor driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bingbu Cao <bingbu.cao(a)intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
drivers/media/i2c/ov9734.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
---
diff --git a/drivers/media/i2c/ov9734.c b/drivers/media/i2c/ov9734.c
index 2b766bfc98fc..d99728597431 100644
--- a/drivers/media/i2c/ov9734.c
+++ b/drivers/media/i2c/ov9734.c
@@ -893,6 +893,7 @@ static void ov9734_remove(struct i2c_client *client)
media_entity_cleanup(&sd->entity);
v4l2_ctrl_handler_free(sd->ctrl_handler);
pm_runtime_disable(&client->dev);
+ pm_runtime_set_suspended(&client->dev);
mutex_destroy(&ov9734->mutex);
}
@@ -938,13 +939,6 @@ static int ov9734_probe(struct i2c_client *client)
goto probe_error_v4l2_ctrl_handler_free;
}
- ret = v4l2_async_register_subdev_sensor(&ov9734->sd);
- if (ret < 0) {
- dev_err(&client->dev, "failed to register V4L2 subdev: %d",
- ret);
- goto probe_error_media_entity_cleanup;
- }
-
/*
* Device is already turned on by i2c-core with ACPI domain PM.
* Enable runtime PM and turn off the device.
@@ -953,9 +947,18 @@ static int ov9734_probe(struct i2c_client *client)
pm_runtime_enable(&client->dev);
pm_runtime_idle(&client->dev);
+ ret = v4l2_async_register_subdev_sensor(&ov9734->sd);
+ if (ret < 0) {
+ dev_err(&client->dev, "failed to register V4L2 subdev: %d",
+ ret);
+ goto probe_error_media_entity_cleanup_pm;
+ }
+
return 0;
-probe_error_media_entity_cleanup:
+probe_error_media_entity_cleanup_pm:
+ pm_runtime_disable(&client->dev);
+ pm_runtime_set_suspended(&client->dev);
media_entity_cleanup(&ov9734->sd.entity);
probe_error_v4l2_ctrl_handler_free:
The driver always registers pin configurations in device tree. This can
cause some inconvenience to users, as pin configurations in the base
device tree cannot be disabled in the device tree overlay, even when the
relevant devices are not used.
Ignore disabled pin configuration nodes in device tree.
Fixes: 447976ab62c5 ("pinctrl: starfive: Add StarFive JH7110 sys controller driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Nam Cao <namcao(a)linutronix.de>
---
drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c
index 640f827a9b2c..b4f799572689 100644
--- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c
+++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c
@@ -135,7 +135,7 @@ static int jh7110_dt_node_to_map(struct pinctrl_dev *pctldev,
int ret;
ngroups = 0;
- for_each_child_of_node(np, child)
+ for_each_available_child_of_node(np, child)
ngroups += 1;
nmaps = 2 * ngroups;
@@ -150,7 +150,7 @@ static int jh7110_dt_node_to_map(struct pinctrl_dev *pctldev,
nmaps = 0;
ngroups = 0;
mutex_lock(&sfp->mutex);
- for_each_child_of_node(np, child) {
+ for_each_available_child_of_node(np, child) {
int npins = of_property_count_u32_elems(child, "pinmux");
int *pins;
u32 *pinmux;
--
2.39.2
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: i2c: st-mipid02: correct format propagation
Author: Alain Volmat <alain.volmat(a)foss.st.com>
Date: Mon Nov 13 15:57:30 2023 +0100
Use a copy of the struct v4l2_subdev_format when propagating
format from the sink to source pad in order to avoid impacting the
sink format returned to the application.
Thanks to Jacopo Mondi for pointing the issue.
Fixes: 6c01e6f3f27b ("media: st-mipid02: Propagate format from sink to source pad")
Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Jacopo Mondi <jacopo.mondi(a)ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally(a)ideasonboard.com>
Reviewed-by: Benjamin Mugnier <benjamin.mugnier(a)foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
drivers/media/i2c/st-mipid02.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c
index b08a249b5fdd..914f915749a8 100644
--- a/drivers/media/i2c/st-mipid02.c
+++ b/drivers/media/i2c/st-mipid02.c
@@ -769,6 +769,7 @@ static void mipid02_set_fmt_sink(struct v4l2_subdev *sd,
struct v4l2_subdev_format *format)
{
struct mipid02_dev *bridge = to_mipid02_dev(sd);
+ struct v4l2_subdev_format source_fmt;
struct v4l2_mbus_framefmt *fmt;
format->format.code = get_fmt_code(format->format.code);
@@ -780,8 +781,12 @@ static void mipid02_set_fmt_sink(struct v4l2_subdev *sd,
*fmt = format->format;
- /* Propagate the format change to the source pad */
- mipid02_set_fmt_source(sd, sd_state, format);
+ /*
+ * Propagate the format change to the source pad, taking
+ * care not to update the format pointer given back to user
+ */
+ source_fmt = *format;
+ mipid02_set_fmt_source(sd, sd_state, &source_fmt);
}
static int mipid02_set_fmt(struct v4l2_subdev *sd,
Invoke drm_plane_helper_funcs.end_fb_access before
drm_atomic_helper_commit_hw_done(). The latter function hands over
ownership of the plane state to the following commit, which might
free it. Releasing resources in end_fb_access then operates on undefined
state. This bug has been observed with non-blocking commits when they
are being queued up quickly.
Here is an example stack trace from the bug report. The plane state has
been free'd already, so the pages for drm_gem_fb_vunmap() are gone.
Unable to handle kernel paging request at virtual address 0000000100000049
[...]
drm_gem_fb_vunmap+0x18/0x74
drm_gem_end_shadow_fb_access+0x1c/0x2c
drm_atomic_helper_cleanup_planes+0x58/0xd8
drm_atomic_helper_commit_tail+0x90/0xa0
commit_tail+0x15c/0x188
commit_work+0x14/0x20
Fix this by running end_fb_access immediately after updating all planes
in drm_atomic_helper_commit_planes(). The existing clean-up helper
drm_atomic_helper_cleanup_planes() now only handles cleanup_fb.
For aborted commits, roll back from drm_atomic_helper_prepare_planes()
in the new helper drm_atomic_helper_unprepare_planes(). This case is
different from regular cleanup, as we have to release the new state;
regular cleanup releases the old state. The new helper also invokes
cleanup_fb for all planes.
The changes mostly involve DRM's atomic helpers. Only two drivers, i915
and nouveau, implement their own commit function. Update them to invoke
drm_atomic_helper_unprepare_planes(). Drivers with custom commit_tail
function do not require changes.
v4:
* fix documentation (kernel test robot)
v3:
* add drm_atomic_helper_unprepare_planes() for rolling back
* use correct state for end_fb_access
v2:
* fix test in drm_atomic_helper_cleanup_planes()
Reported-by: Alyssa Ross <hi(a)alyssa.is>
Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/
Suggested-by: Daniel Vetter <daniel(a)ffwll.ch>
Fixes: 94d879eaf7fb ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers")
Tested-by: Alyssa Ross <hi(a)alyssa.is>
Reviewed-by: Alyssa Ross <hi(a)alyssa.is>
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: <stable(a)vger.kernel.org> # v6.2+
---
drivers/gpu/drm/drm_atomic_helper.c | 78 +++++++++++++-------
drivers/gpu/drm/i915/display/intel_display.c | 2 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 2 +-
include/drm/drm_atomic_helper.h | 2 +
4 files changed, 56 insertions(+), 28 deletions(-)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index c3f677130def0..a920fbae714c8 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -2012,7 +2012,7 @@ int drm_atomic_helper_commit(struct drm_device *dev,
return ret;
drm_atomic_helper_async_commit(dev, state);
- drm_atomic_helper_cleanup_planes(dev, state);
+ drm_atomic_helper_unprepare_planes(dev, state);
return 0;
}
@@ -2072,7 +2072,7 @@ int drm_atomic_helper_commit(struct drm_device *dev,
return 0;
err:
- drm_atomic_helper_cleanup_planes(dev, state);
+ drm_atomic_helper_unprepare_planes(dev, state);
return ret;
}
EXPORT_SYMBOL(drm_atomic_helper_commit);
@@ -2650,6 +2650,39 @@ int drm_atomic_helper_prepare_planes(struct drm_device *dev,
}
EXPORT_SYMBOL(drm_atomic_helper_prepare_planes);
+/**
+ * drm_atomic_helper_unprepare_planes - release plane resources on aborts
+ * @dev: DRM device
+ * @state: atomic state object with old state structures
+ *
+ * This function cleans up plane state, specifically framebuffers, from the
+ * atomic state. It undoes the effects of drm_atomic_helper_prepare_planes()
+ * when aborting an atomic commit. For cleaning up after a successful commit
+ * use drm_atomic_helper_cleanup_planes().
+ */
+void drm_atomic_helper_unprepare_planes(struct drm_device *dev,
+ struct drm_atomic_state *state)
+{
+ struct drm_plane *plane;
+ struct drm_plane_state *new_plane_state;
+ int i;
+
+ for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->end_fb_access)
+ funcs->end_fb_access(plane, new_plane_state);
+ }
+
+ for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->cleanup_fb)
+ funcs->cleanup_fb(plane, new_plane_state);
+ }
+}
+EXPORT_SYMBOL(drm_atomic_helper_unprepare_planes);
+
static bool plane_crtc_active(const struct drm_plane_state *state)
{
return state->crtc && state->crtc->state->active;
@@ -2784,6 +2817,17 @@ void drm_atomic_helper_commit_planes(struct drm_device *dev,
funcs->atomic_flush(crtc, old_state);
}
+
+ /*
+ * Signal end of framebuffer access here before hw_done. After hw_done,
+ * a later commit might have already released the plane state.
+ */
+ for_each_old_plane_in_state(old_state, plane, old_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->end_fb_access)
+ funcs->end_fb_access(plane, old_plane_state);
+ }
}
EXPORT_SYMBOL(drm_atomic_helper_commit_planes);
@@ -2911,40 +2955,22 @@ EXPORT_SYMBOL(drm_atomic_helper_disable_planes_on_crtc);
* configuration. Hence the old configuration must be perserved in @old_state to
* be able to call this function.
*
- * This function must also be called on the new state when the atomic update
- * fails at any point after calling drm_atomic_helper_prepare_planes().
+ * This function may not be called on the new state when the atomic update
+ * fails at any point after calling drm_atomic_helper_prepare_planes(). Use
+ * drm_atomic_helper_unprepare_planes() in this case.
*/
void drm_atomic_helper_cleanup_planes(struct drm_device *dev,
struct drm_atomic_state *old_state)
{
struct drm_plane *plane;
- struct drm_plane_state *old_plane_state, *new_plane_state;
+ struct drm_plane_state *old_plane_state;
int i;
- for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
+ for_each_old_plane_in_state(old_state, plane, old_plane_state, i) {
const struct drm_plane_helper_funcs *funcs = plane->helper_private;
- if (funcs->end_fb_access)
- funcs->end_fb_access(plane, new_plane_state);
- }
-
- for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
- const struct drm_plane_helper_funcs *funcs;
- struct drm_plane_state *plane_state;
-
- /*
- * This might be called before swapping when commit is aborted,
- * in which case we have to cleanup the new state.
- */
- if (old_plane_state == plane->state)
- plane_state = new_plane_state;
- else
- plane_state = old_plane_state;
-
- funcs = plane->helper_private;
-
if (funcs->cleanup_fb)
- funcs->cleanup_fb(plane, plane_state);
+ funcs->cleanup_fb(plane, old_plane_state);
}
}
EXPORT_SYMBOL(drm_atomic_helper_cleanup_planes);
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 5cf162628b95e..ace834c9e8f9f 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -7354,7 +7354,7 @@ int intel_atomic_commit(struct drm_device *dev, struct drm_atomic_state *_state,
for_each_new_intel_crtc_in_state(state, crtc, new_crtc_state, i)
intel_color_cleanup_commit(new_crtc_state);
- drm_atomic_helper_cleanup_planes(dev, &state->base);
+ drm_atomic_helper_unprepare_planes(dev, &state->base);
intel_runtime_pm_put(&dev_priv->runtime_pm, state->wakeref);
return ret;
}
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 11fe75b68e95c..8d37a694b7724 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -2476,7 +2476,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
err_cleanup:
if (ret)
- drm_atomic_helper_cleanup_planes(dev, state);
+ drm_atomic_helper_unprepare_planes(dev, state);
done:
pm_runtime_put_autosuspend(dev->dev);
return ret;
diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h
index 536a0b0091c3a..006b5c977ad77 100644
--- a/include/drm/drm_atomic_helper.h
+++ b/include/drm/drm_atomic_helper.h
@@ -97,6 +97,8 @@ void drm_atomic_helper_commit_modeset_enables(struct drm_device *dev,
int drm_atomic_helper_prepare_planes(struct drm_device *dev,
struct drm_atomic_state *state);
+void drm_atomic_helper_unprepare_planes(struct drm_device *dev,
+ struct drm_atomic_state *state);
#define DRM_PLANE_COMMIT_ACTIVE_ONLY BIT(0)
#define DRM_PLANE_COMMIT_NO_DISABLE_AFTER_MODESET BIT(1)
--
2.43.0
Invoke drm_plane_helper_funcs.end_fb_access before
drm_atomic_helper_commit_hw_done(). The latter function hands over
ownership of the plane state to the following commit, which might
free it. Releasing resources in end_fb_access then operates on undefined
state. This bug has been observed with non-blocking commits when they
are being queued up quickly.
Here is an example stack trace from the bug report. The plane state has
been free'd already, so the pages for drm_gem_fb_vunmap() are gone.
Unable to handle kernel paging request at virtual address 0000000100000049
[...]
drm_gem_fb_vunmap+0x18/0x74
drm_gem_end_shadow_fb_access+0x1c/0x2c
drm_atomic_helper_cleanup_planes+0x58/0xd8
drm_atomic_helper_commit_tail+0x90/0xa0
commit_tail+0x15c/0x188
commit_work+0x14/0x20
Fix this by running end_fb_access immediately after updating all planes
in drm_atomic_helper_commit_planes(). The existing clean-up helper
drm_atomic_helper_cleanup_planes() now only handles cleanup_fb.
For aborted commits, roll back from drm_atomic_helper_prepare_planes()
in the new helper drm_atomic_helper_unprepare_planes(). This case is
different from regular cleanup, as we have to release the new state;
regular cleanup releases the old state. The new helper also invokes
cleanup_fb for all planes.
The changes mostly involve DRM's atomic helpers. Only two drivers, i915
and nouveau, implement their own commit function. Update them to invoke
drm_atomic_helper_unprepare_planes(). Drivers with custom commit_tail
function do not require changes.
v3:
* add drm_atomic_helper_unprepare_planes() for rolling back
* use correct state for end_fb_access
v2:
* fix test in drm_atomic_helper_cleanup_planes()
Reported-by: Alyssa Ross <hi(a)alyssa.is>
Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/
Suggested-by: Daniel Vetter <daniel(a)ffwll.ch>
Fixes: 94d879eaf7fb ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers")
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: <stable(a)vger.kernel.org> # v6.2+
---
drivers/gpu/drm/drm_atomic_helper.c | 78 +++++++++++++-------
drivers/gpu/drm/i915/display/intel_display.c | 2 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 2 +-
include/drm/drm_atomic_helper.h | 2 +
4 files changed, 56 insertions(+), 28 deletions(-)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index c3f677130def0..9adec3eb78563 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -2012,7 +2012,7 @@ int drm_atomic_helper_commit(struct drm_device *dev,
return ret;
drm_atomic_helper_async_commit(dev, state);
- drm_atomic_helper_cleanup_planes(dev, state);
+ drm_atomic_helper_unprepare_planes(dev, state);
return 0;
}
@@ -2072,7 +2072,7 @@ int drm_atomic_helper_commit(struct drm_device *dev,
return 0;
err:
- drm_atomic_helper_cleanup_planes(dev, state);
+ drm_atomic_helper_unprepare_planes(dev, state);
return ret;
}
EXPORT_SYMBOL(drm_atomic_helper_commit);
@@ -2650,6 +2650,39 @@ int drm_atomic_helper_prepare_planes(struct drm_device *dev,
}
EXPORT_SYMBOL(drm_atomic_helper_prepare_planes);
+/**
+ * drm_atomic_helper_unprepare_planes - release plane resources on aborts
+ * @dev: DRM device
+ * @old_state: atomic state object with old state structures
+ *
+ * This function cleans up plane state, specifically framebuffers, from the
+ * atomic state. It undoes the effects of drm_atomic_helper_prepare_planes()
+ * when aborting an atomic commit. For cleaning up after a successful commit
+ * use drm_atomic_helper_cleanup_planes().
+ */
+void drm_atomic_helper_unprepare_planes(struct drm_device *dev,
+ struct drm_atomic_state *state)
+{
+ struct drm_plane *plane;
+ struct drm_plane_state *new_plane_state;
+ int i;
+
+ for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->end_fb_access)
+ funcs->end_fb_access(plane, new_plane_state);
+ }
+
+ for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->cleanup_fb)
+ funcs->cleanup_fb(plane, new_plane_state);
+ }
+}
+EXPORT_SYMBOL(drm_atomic_helper_unprepare_planes);
+
static bool plane_crtc_active(const struct drm_plane_state *state)
{
return state->crtc && state->crtc->state->active;
@@ -2784,6 +2817,17 @@ void drm_atomic_helper_commit_planes(struct drm_device *dev,
funcs->atomic_flush(crtc, old_state);
}
+
+ /*
+ * Signal end of framebuffer access here before hw_done. After hw_done,
+ * a later commit might have already released the plane state.
+ */
+ for_each_old_plane_in_state(old_state, plane, old_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->end_fb_access)
+ funcs->end_fb_access(plane, old_plane_state);
+ }
}
EXPORT_SYMBOL(drm_atomic_helper_commit_planes);
@@ -2911,40 +2955,22 @@ EXPORT_SYMBOL(drm_atomic_helper_disable_planes_on_crtc);
* configuration. Hence the old configuration must be perserved in @old_state to
* be able to call this function.
*
- * This function must also be called on the new state when the atomic update
- * fails at any point after calling drm_atomic_helper_prepare_planes().
+ * This function may not be called on the new state when the atomic update
+ * fails at any point after calling drm_atomic_helper_prepare_planes(). Use
+ * drm_atomic_helper_unprepare_planes() in this case.
*/
void drm_atomic_helper_cleanup_planes(struct drm_device *dev,
struct drm_atomic_state *old_state)
{
struct drm_plane *plane;
- struct drm_plane_state *old_plane_state, *new_plane_state;
+ struct drm_plane_state *old_plane_state;
int i;
- for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
+ for_each_old_plane_in_state(old_state, plane, old_plane_state, i) {
const struct drm_plane_helper_funcs *funcs = plane->helper_private;
- if (funcs->end_fb_access)
- funcs->end_fb_access(plane, new_plane_state);
- }
-
- for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
- const struct drm_plane_helper_funcs *funcs;
- struct drm_plane_state *plane_state;
-
- /*
- * This might be called before swapping when commit is aborted,
- * in which case we have to cleanup the new state.
- */
- if (old_plane_state == plane->state)
- plane_state = new_plane_state;
- else
- plane_state = old_plane_state;
-
- funcs = plane->helper_private;
-
if (funcs->cleanup_fb)
- funcs->cleanup_fb(plane, plane_state);
+ funcs->cleanup_fb(plane, old_plane_state);
}
}
EXPORT_SYMBOL(drm_atomic_helper_cleanup_planes);
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 5cf162628b95e..ace834c9e8f9f 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -7354,7 +7354,7 @@ int intel_atomic_commit(struct drm_device *dev, struct drm_atomic_state *_state,
for_each_new_intel_crtc_in_state(state, crtc, new_crtc_state, i)
intel_color_cleanup_commit(new_crtc_state);
- drm_atomic_helper_cleanup_planes(dev, &state->base);
+ drm_atomic_helper_unprepare_planes(dev, &state->base);
intel_runtime_pm_put(&dev_priv->runtime_pm, state->wakeref);
return ret;
}
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 11fe75b68e95c..8d37a694b7724 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -2476,7 +2476,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
err_cleanup:
if (ret)
- drm_atomic_helper_cleanup_planes(dev, state);
+ drm_atomic_helper_unprepare_planes(dev, state);
done:
pm_runtime_put_autosuspend(dev->dev);
return ret;
diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h
index 536a0b0091c3a..006b5c977ad77 100644
--- a/include/drm/drm_atomic_helper.h
+++ b/include/drm/drm_atomic_helper.h
@@ -97,6 +97,8 @@ void drm_atomic_helper_commit_modeset_enables(struct drm_device *dev,
int drm_atomic_helper_prepare_planes(struct drm_device *dev,
struct drm_atomic_state *state);
+void drm_atomic_helper_unprepare_planes(struct drm_device *dev,
+ struct drm_atomic_state *state);
#define DRM_PLANE_COMMIT_ACTIVE_ONLY BIT(0)
#define DRM_PLANE_COMMIT_NO_DISABLE_AFTER_MODESET BIT(1)
--
2.43.0
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 974bba5c118f4c2baf00de0356e3e4f7928b4cbc
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023113059-unfunded-blasphemy-617e@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
974bba5c118f ("usb: config: fix iteration issue in 'usb_get_bos_descriptor()'")
7a09c1269702 ("USB: core: Change configuration warnings to notices")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 974bba5c118f4c2baf00de0356e3e4f7928b4cbc Mon Sep 17 00:00:00 2001
From: Niklas Neronin <niklas.neronin(a)linux.intel.com>
Date: Wed, 15 Nov 2023 14:13:25 +0200
Subject: [PATCH] usb: config: fix iteration issue in
'usb_get_bos_descriptor()'
The BOS descriptor defines a root descriptor and is the base descriptor for
accessing a family of related descriptors.
Function 'usb_get_bos_descriptor()' encounters an iteration issue when
skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in
the same descriptor being read repeatedly.
To address this issue, a 'goto' statement is introduced to ensure that the
pointer and the amount read is updated correctly. This ensures that the
function iterates to the next descriptor instead of reading the same
descriptor repeatedly.
Cc: stable(a)vger.kernel.org
Fixes: 3dd550a2d365 ("USB: usbcore: Fix slab-out-of-bounds bug during device reset")
Signed-off-by: Niklas Neronin <niklas.neronin(a)linux.intel.com>
Acked-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
Reviewed-by: Alan Stern <stern(a)rowland.harvard.edu>
Link: https://lore.kernel.org/r/20231115121325.471454-1-niklas.neronin@linux.inte…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index b19e38d5fd10..7f8d33f92ddb 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -1047,7 +1047,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
dev_notice(ddev, "descriptor type invalid, skip\n");
- continue;
+ goto skip_to_next_descriptor;
}
switch (cap_type) {
@@ -1078,6 +1078,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
break;
}
+skip_to_next_descriptor:
total_len -= length;
buffer += length;
}
From: Johannes Berg <johannes.berg(a)intel.com>
Commit 7e7efdda6adb385fbdfd6f819d76bc68c923c394 upstream.
My prior race fix here broke CQM when ranges aren't used, as
the reporting worker now requires the cqm_config to be set in
the wdev, but isn't set when there's no range configured.
Rather than continuing to special-case the range version, set
the cqm_config always and configure accordingly, also tracking
if range was used or not to be able to clear the configuration
appropriately with the same API, which was actually not right
if both were implemented by a driver for some reason, as is
the case with mac80211 (though there the implementations are
equivalent so it doesn't matter.)
Also, the original multiple-RSSI commit lost checking for the
callback, so might have potentially crashed if a driver had
neither implementation, and userspace tried to use it despite
not being advertised as supported.
Cc: stable(a)vger.kernel.org
Fixes: 4a4b8169501b ("cfg80211: Accept multiple RSSI thresholds for CQM")
Fixes: 37c20b2effe9 ("wifi: cfg80211: fix cqm_config access race")
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
---
net/wireless/core.h | 1 +
net/wireless/nl80211.c | 50 ++++++++++++++++++++++++++----------------
2 files changed, 32 insertions(+), 19 deletions(-)
diff --git a/net/wireless/core.h b/net/wireless/core.h
index e1accacc6f23..ee980965a7cf 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -297,6 +297,7 @@ struct cfg80211_cqm_config {
u32 rssi_hyst;
s32 last_rssi_event_value;
enum nl80211_cqm_rssi_threshold_event last_rssi_event_type;
+ bool use_range_api;
int n_rssi_thresholds;
s32 rssi_thresholds[];
};
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b19b5acfaf3a..42c858219b34 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -12574,10 +12574,6 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
int i, n, low_index;
int err;
- /* RSSI reporting disabled? */
- if (!cqm_config)
- return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
-
/*
* Obtain current RSSI value if possible, if not and no RSSI threshold
* event has been received yet, we should receive an event after a
@@ -12652,18 +12648,6 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
return -EOPNOTSUPP;
- if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
- if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
- return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
-
- return rdev_set_cqm_rssi_config(rdev, dev,
- thresholds[0], hysteresis);
- }
-
- if (!wiphy_ext_feature_isset(&rdev->wiphy,
- NL80211_EXT_FEATURE_CQM_RSSI_LIST))
- return -EOPNOTSUPP;
-
if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
n_thresholds = 0;
@@ -12671,6 +12655,20 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
old = rcu_dereference_protected(wdev->cqm_config,
lockdep_is_held(&wdev->mtx));
+ /* if already disabled just succeed */
+ if (!n_thresholds && !old)
+ return 0;
+
+ if (n_thresholds > 1) {
+ if (!wiphy_ext_feature_isset(&rdev->wiphy,
+ NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
+ !rdev->ops->set_cqm_rssi_range_config)
+ return -EOPNOTSUPP;
+ } else {
+ if (!rdev->ops->set_cqm_rssi_config)
+ return -EOPNOTSUPP;
+ }
+
if (n_thresholds) {
cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
n_thresholds),
@@ -12685,13 +12683,26 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
memcpy(cqm_config->rssi_thresholds, thresholds,
flex_array_size(cqm_config, rssi_thresholds,
n_thresholds));
+ cqm_config->use_range_api = n_thresholds > 1 ||
+ !rdev->ops->set_cqm_rssi_config;
rcu_assign_pointer(wdev->cqm_config, cqm_config);
+
+ if (cqm_config->use_range_api)
+ err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
+ else
+ err = rdev_set_cqm_rssi_config(rdev, dev,
+ thresholds[0],
+ hysteresis);
} else {
RCU_INIT_POINTER(wdev->cqm_config, NULL);
+ /* if enabled as range also disable via range */
+ if (old->use_range_api)
+ err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
+ else
+ err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
}
- err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
if (err) {
rcu_assign_pointer(wdev->cqm_config, old);
kfree_rcu(cqm_config, rcu_head);
@@ -18758,10 +18769,11 @@ void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
wdev_lock(wdev);
cqm_config = rcu_dereference_protected(wdev->cqm_config,
lockdep_is_held(&wdev->mtx));
- if (!wdev->cqm_config)
+ if (!cqm_config)
goto unlock;
- cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
+ if (cqm_config->use_range_api)
+ cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
rssi_level = cqm_config->last_rssi_event_value;
rssi_event = cqm_config->last_rssi_event_type;
--
2.43.0