From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c0b34637bd667..1553c2495841b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3207,6 +3207,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
Could we please get:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
'net: retrieve netns cookie via getsocketopt'
included in 5.10 LTS.
This is technically a feature, but it's absolutely trivial - it just
adds a new getsockopt to fetch a u64.
Using netns cookies from bpf without it is pretty annoying.
It doesn't cherrypick to 5.10 cleanly, due to trivial conflicts in
header files (previous constants haven't yet been defined),
and because of a post 5.10 change from atomic64_t to u64 - which
requires adding in an atomic_read(&).
I've uploaded a compiling version to:
https://android-review.googlesource.com/c/kernel/common/+/2503056
I think you should be able to cherrypick it via:
git fetch https://android.googlesource.com/kernel/common
refs/changes/56/2503056/2 && git cherry-pick FETCH_HEAD
Thanks!
Maciej Żenczykowski, Kernel Networking Developer @ Google
I'm announcing the release of the 5.4.238 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/filesystems/vfs.rst | 2 -
Makefile | 2 -
arch/s390/boot/ipl_report.c | 8 ++++
arch/x86/kvm/vmx/nested.c | 10 ++++-
arch/x86/mm/mem_encrypt_identity.c | 3 +
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 -
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +-
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 -
drivers/hid/hid-core.c | 18 ++++++---
drivers/hid/uhid.c | 1
drivers/hwmon/adt7475.c | 8 ++--
drivers/hwmon/ina3221.c | 2 -
drivers/hwmon/xgene-hwmon.c | 1
drivers/interconnect/core.c | 4 ++
drivers/media/i2c/m5mols/m5mols_core.c | 2 -
drivers/mmc/host/atmel-mci.c | 3 -
drivers/net/ethernet/intel/i40e/i40e_main.c | 1
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 ++
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1
drivers/net/phy/smsc.c | 5 ++
drivers/net/usb/smsc75xx.c | 7 +++
drivers/nfc/pn533/usb.c | 1
drivers/nfc/st-nci/ndlc.c | 6 ++-
drivers/nvme/target/core.c | 4 +-
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 54 ++++++++++++----------------
drivers/pci/pci.h | 10 ++++-
drivers/scsi/hosts.c | 5 --
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 ++++--
drivers/video/fbdev/stifb.c | 27 ++++++++++++++
fs/cifs/transport.c | 21 ++++------
fs/ext4/inode.c | 18 ++++-----
fs/ext4/namei.c | 4 --
fs/ext4/page-io.c | 10 +++--
fs/ext4/xattr.c | 11 +++++
fs/jffs2/file.c | 15 +++----
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 ++-
include/linux/sh_intc.h | 5 ++
include/linux/tracepoint.h | 15 +++----
kernel/trace/ftrace.c | 3 +
kernel/trace/trace_events_hist.c | 3 +
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 +++---
net/ipv4/tcp_output.c | 2 -
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 -
net/netfilter/nft_redir.c | 2 -
net/xfrm/xfrm_state.c | 3 -
sound/pci/hda/hda_intel.c | 22 ++++++++++-
sound/pci/hda/patch_hdmi.c | 3 +
58 files changed, 276 insertions(+), 143 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Bart Van Assche (1):
scsi: core: Fix a procfs host directory removal regression
Biju Das (1):
serial: 8250_em: Fix UART port type
Bjorn Helgaas (1):
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Christian Hewitt (1):
drm/meson: fix 1px pink line on GXM when scaling video overlay
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Dmitry Osipenko (1):
drm/panfrost: Don't sync rpm suspension after mmu flushing
Eric Biggers (1):
ext4: fix cgroup writeback accounting with fs-layer encryption
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Glenn Washburn (1):
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Greg Kroah-Hartman (1):
Linux 5.4.238
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Herbert Xu (1):
xfrm: Allow transport-mode states with AF_UNSPEC selector
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
Ivan Vecera (1):
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jeremy Sowden (1):
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jianguo Wu (1):
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Johan Hovold (1):
interconnect: fix mem leak when freeing nodes
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Kai Vehmanen (4):
ALSA: hda - add Intel DG1 PCI and HDMI ids
ALSA: hda - controller is in GPU on the DG1
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Lukas Wunner (1):
PCI: Unify delay handling for reset and resume
Marcus Folkesson (1):
hwmon: (ina3221) return prober error code
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Nikita Zhandarovich (1):
x86/mm: Fix use of uninitialized buffer in sme_enable()
Paolo Bonzini (1):
KVM: nVMX: add missing consistency checks for CR0 and CR4
Qu Huang (1):
drm/amdkfd: Fix an illegal memory access
Randy Dunlap (1):
clk: HI655X: select REGMAP instead of depending on it
Sherry Sun (1):
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Steven Rostedt (Google) (2):
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
Sven Schnelle (1):
s390/ipl: add missing intersection check to ipl_report handling
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Theodore Ts'o (1):
ext4: fix possible double unlock when moving a directory
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Wenchao Hao (1):
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Xiang Chen (1):
scsi: core: Fix a comment in function scsi_host_dev_release()
Yifei Liu (1):
jffs2: correct logic when creating a hole in jffs2_write_begin
Zhang Xiaoxu (1):
cifs: Move the in_send statistic to __smb_send_rqst()
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
I'm announcing the release of the 4.19.279 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/x86/mm/mem_encrypt_identity.c | 3 ++-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/jffs2/file.c | 15 +++++++--------
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
include/linux/tracepoint.h | 15 ++++++---------
kernel/trace/ftrace.c | 3 ++-
kernel/trace/trace_events_hist.c | 3 +++
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
38 files changed, 159 insertions(+), 77 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.19.279
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Nikita Zhandarovich (1):
x86/mm: Fix use of uninitialized buffer in sme_enable()
Qu Huang (1):
drm/amdkfd: Fix an illegal memory access
Randy Dunlap (1):
clk: HI655X: select REGMAP instead of depending on it
Steven Rostedt (Google) (2):
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Yifei Liu (1):
jffs2: correct logic when creating a hole in jffs2_write_begin
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
I'm announcing the release of the 4.14.311 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/block/sunvdc.c | 2 ++
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
kernel/trace/ftrace.c | 3 ++-
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
32 files changed, 137 insertions(+), 52 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.14.311
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: b15888840207c2bfe678dd1f68a32db54315e71f
Gitweb: https://git.kernel.org/tip/b15888840207c2bfe678dd1f68a32db54315e71f
Author: Chang S. Bae <chang.seok.bae(a)intel.com>
AuthorDate: Mon, 27 Feb 2023 13:05:03 -08:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:59:13 -07:00
x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()
__copy_xstate_to_uabi_buf() copies either from the tasks XSAVE buffer
or from init_fpstate into the ptrace buffer. Dynamic features, like
XTILEDATA, have an all zeroes init state and are not saved in
init_fpstate, which means the corresponding bit is not set in the
xfeatures bitmap of the init_fpstate header.
But __copy_xstate_to_uabi_buf() retrieves addresses for both the tasks
xstate and init_fpstate unconditionally via __raw_xsave_addr().
So if the tasks XSAVE buffer has a dynamic feature set, then the
address retrieval for init_fpstate triggers the warning in
__raw_xsave_addr() which checks the feature bit in the init_fpstate
header.
Remove the address retrieval from init_fpstate for extended features.
They have an all zeroes init state so init_fpstate has zeros for them.
Then zeroing the user buffer for the init state is the same as copying
them from init_fpstate.
Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode")
Reported-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/kvm/20230221163655.920289-2-mizhang@google.com/
Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Tested-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/all/20230227210504.18520-2-chang.seok.bae%40intel.c…
Cc: stable(a)vger.kernel.org
---
arch/x86/kernel/fpu/xstate.c | 30 ++++++++++++++----------------
1 file changed, 14 insertions(+), 16 deletions(-)
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 714166c..0bab497 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1118,21 +1118,20 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
zerofrom = offsetof(struct xregs_state, extended_state_area);
/*
- * The ptrace buffer is in non-compacted XSAVE format. In
- * non-compacted format disabled features still occupy state space,
- * but there is no state to copy from in the compacted
- * init_fpstate. The gap tracking will zero these states.
- */
- mask = fpstate->user_xfeatures;
-
- /*
- * Dynamic features are not present in init_fpstate. When they are
- * in an all zeros init state, remove those from 'mask' to zero
- * those features in the user buffer instead of retrieving them
- * from init_fpstate.
+ * This 'mask' indicates which states to copy from fpstate.
+ * Those extended states that are not present in fpstate are
+ * either disabled or initialized:
+ *
+ * In non-compacted format, disabled features still occupy
+ * state space but there is no state to copy from in the
+ * compacted init_fpstate. The gap tracking will zero these
+ * states.
+ *
+ * The extended features have an all zeroes init state. Thus,
+ * remove them from 'mask' to zero those features in the user
+ * buffer instead of retrieving them from init_fpstate.
*/
- if (fpu_state_size_dynamic())
- mask &= (header.xfeatures | xinit->header.xcomp_bv);
+ mask = header.xfeatures;
for_each_extended_xfeature(i, mask) {
/*
@@ -1151,9 +1150,8 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
pkru.pkru = pkru_val;
membuf_write(&to, &pkru, sizeof(pkru));
} else {
- copy_feature(header.xfeatures & BIT_ULL(i), &to,
+ membuf_write(&to,
__raw_xsave_addr(xsave, i),
- __raw_xsave_addr(xinit, i),
xstate_sizes[i]);
}
/*
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: a3f547addcaa10df5a226526bc9e2d9a94542344
Gitweb: https://git.kernel.org/tip/a3f547addcaa10df5a226526bc9e2d9a94542344
Author: Michal Koutný <mkoutny(a)suse.com>
AuthorDate: Mon, 06 Mar 2023 20:31:44 +01:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:42:47 -07:00
x86/mm: Do not shuffle CPU entry areas without KASLR
The commit 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") fixed
an omission of KASLR on CPU entry areas. It doesn't take into account
KASLR switches though, which may result in unintended non-determinism
when a user wants to avoid it (e.g. debugging, benchmarking).
Generate only a single combination of CPU entry areas offsets -- the
linear array that existed prior randomization when KASLR is turned off.
Since we have 3f148f331814 ("x86/kasan: Map shadow for percpu pages on
demand") and followups, we can use the more relaxed guard
kasrl_enabled() (in contrast to kaslr_memory_enabled()).
Fixes: 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area")
Signed-off-by: Michal Koutný <mkoutny(a)suse.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/all/20230306193144.24605-1-mkoutny%40suse.com
---
arch/x86/mm/cpu_entry_area.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
index 7316a82..e91500a 100644
--- a/arch/x86/mm/cpu_entry_area.c
+++ b/arch/x86/mm/cpu_entry_area.c
@@ -10,6 +10,7 @@
#include <asm/fixmap.h>
#include <asm/desc.h>
#include <asm/kasan.h>
+#include <asm/setup.h>
static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage);
@@ -29,6 +30,12 @@ static __init void init_cea_offsets(void)
unsigned int max_cea;
unsigned int i, j;
+ if (!kaslr_enabled()) {
+ for_each_possible_cpu(i)
+ per_cpu(_cea_offset, i) = i;
+ return;
+ }
+
max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE;
/* O(sodding terrible) */
From: Matheus Castello <matheus.castello(a)toradex.com>
Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent
with what all the other DRM bridge drivers are doing and this is
required since the bridge might not be there when the driver is probed
and this should not be a fatal failure.
Cc: <stable(a)vger.kernel.org>
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Signed-off-by: Matheus Castello <matheus.castello(a)toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com>
---
v2: use dev_err_probe() instead of dev_dbg() (Laurent)
---
drivers/gpu/drm/bridge/lontium-lt8912b.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 2019a8167d69..b40baced1331 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -676,8 +676,8 @@ static int lt8912_parse_dt(struct lt8912 *lt)
lt->hdmi_port = of_drm_find_bridge(port_node);
if (!lt->hdmi_port) {
- dev_err(lt->dev, "%s: Failed to get hdmi port\n", __func__);
- ret = -ENODEV;
+ ret = -EPROBE_DEFER;
+ dev_err_probe(lt->dev, ret, "%s: Failed to get hdmi port\n", __func__);
goto err_free_host_node;
}
--
2.25.1
From: Matheus Castello <matheus.castello(a)toradex.com>
Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent
with what all the other DRM bridge drivers are doing and this is
required since the bridge might not be there when the driver is probed
and this should not be a fatal failure.
Cc: <stable(a)vger.kernel.org>
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Signed-off-by: Matheus Castello <matheus.castello(a)toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com>
---
drivers/gpu/drm/bridge/lontium-lt8912b.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 2019a8167d69..fec02e47cfdb 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -676,8 +676,8 @@ static int lt8912_parse_dt(struct lt8912 *lt)
lt->hdmi_port = of_drm_find_bridge(port_node);
if (!lt->hdmi_port) {
- dev_err(lt->dev, "%s: Failed to get hdmi port\n", __func__);
- ret = -ENODEV;
+ dev_dbg(lt->dev, "%s: Failed to get hdmi port\n", __func__);
+ ret = -EPROBE_DEFER;
goto err_free_host_node;
}
--
2.25.1
This is the start of the stable review cycle for the 4.19.278 release.
There are 27 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 18 Mar 2023 09:41:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.278-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.278-rc3
Eric Dumazet <edumazet(a)google.com>
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
Kang Chen <void0red(a)gmail.com>
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
Shigeru Yoshida <syoshida(a)redhat.com>
net: caif: Fix use-after-free in cfusbl_device_notify()
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use BAR mappings for ring buffers with LLC
Tung Nguyen <tung.q.nguyen(a)dektech.com.au>
tipc: improve function tipc_wait_for_cond()
Paul Elder <paul.elder(a)ideasonboard.com>
media: ov5640: Fix analogue gain control
Alvaro Karsz <alvaro.karsz(a)solid-run.com>
PCI: Add SolidRun vendor ID
Nathan Chancellor <nathan(a)kernel.org>
macintosh: windfarm: Use unsigned type for 1-bit bitfields
Edward Humes <aurxenon(a)lunos.org>
alpha: fix R_ALPHA_LITERAL reloc for large modules
xurui <xurui(a)kylinos.cn>
MIPS: Fix a compilation issue
Nobuhiro Iwamatsu <nobuhiro1.iwamatsu(a)toshiba.co.jp>
Revert "spi: mt7621: Fix an error message in mt7621_spi_probe()"
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: generate modules.order only in directories visited by obj-y/m
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: fix false-positive need-builtin calculation
Jan Kara <jack(a)suse.cz>
udf: Detect system inodes linked into directory hierarchy
Jan Kara <jack(a)suse.cz>
udf: Preserve link count of system files
Jan Kara <jack(a)suse.cz>
udf: Remove pointless union in udf_inode_info
Steven J. Magnani <steve.magnani(a)digidescorp.com>
udf: reduce leakage of blocks related to named streams
Jan Kara <jack(a)suse.cz>
udf: Explain handling of load_nls() failure
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: change order inside nfc_se_io error path
Zhihao Cheng <chengzhihao1(a)huawei.com>
ext4: zero i_disksize when initializing the bootloader inode
Ye Bin <yebin10(a)huawei.com>
ext4: fix WARNING in ext4_update_inline_data
Ye Bin <yebin10(a)huawei.com>
ext4: move where set the MAY_INLINE_DATA flag is set
Darrick J. Wong <djwong(a)kernel.org>
ext4: fix another off-by-one fsmap error on 1k block filesystems
Eric Whitney <enwlinux(a)gmail.com>
ext4: fix RENAME_WHITEOUT handling for inline directories
Andrew Cooper <andrew.cooper3(a)citrix.com>
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
Theodore Ts'o <tytso(a)mit.edu>
fs: prevent out-of-bounds array speculation when closing a file descriptor
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/kernel/module.c | 4 +-
arch/mips/include/asm/mach-rc32434/pci.h | 2 +-
arch/x86/kernel/cpu/amd.c | 9 ++++
drivers/gpu/drm/i915/intel_ringbuffer.c | 4 +-
drivers/macintosh/windfarm_lm75_sensor.c | 4 +-
drivers/macintosh/windfarm_smu_sensors.c | 4 +-
drivers/media/i2c/ov5640.c | 2 +-
drivers/nfc/fdp/i2c.c | 4 ++
drivers/scsi/hosts.c | 2 +
drivers/staging/mt7621-spi/spi-mt7621.c | 8 ++--
fs/ext4/fsmap.c | 2 +
fs/ext4/inline.c | 1 -
fs/ext4/inode.c | 7 ++-
fs/ext4/ioctl.c | 1 +
fs/ext4/namei.c | 13 +++---
fs/ext4/xattr.c | 3 ++
fs/file.c | 1 +
fs/udf/directory.c | 2 +-
fs/udf/file.c | 7 ++-
fs/udf/ialloc.c | 14 +++---
fs/udf/inode.c | 76 ++++++++++++++++++++++----------
fs/udf/misc.c | 6 +--
fs/udf/namei.c | 7 ++-
fs/udf/partition.c | 2 +-
fs/udf/super.c | 12 ++++-
fs/udf/symlink.c | 2 +-
fs/udf/udf_i.h | 12 ++---
include/linux/pci_ids.h | 2 +
net/caif/caif_usb.c | 3 ++
net/ipv6/ila/ila_xlat.c | 1 +
net/nfc/netlink.c | 2 +-
net/tipc/socket.c | 2 +-
scripts/Makefile.build | 4 +-
34 files changed, 150 insertions(+), 79 deletions(-)
The s11b supply is used by the wlan module (as well as some of the
pmics) which are not yet fully described in the devicetree.
Mark the regulator as always-on for now.
Fixes: 123b30a75623 ("arm64: dts: qcom: sc8280xp-x13s: enable WiFi controller")
Cc: stable(a)vger.kernel.org # 6.2
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
index 26dbba9f51fb..c79559e4b22e 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
@@ -386,6 +386,7 @@ vreg_s11b: smps11 {
regulator-min-microvolt = <1272000>;
regulator-max-microvolt = <1272000>;
regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-always-on;
};
vreg_s12b: smps12 {
--
2.39.2
This is the start of the stable review cycle for the 5.4.238 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 23 Mar 2023 08:06:33 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.238-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.238-rc2
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - controller is in GPU on the DG1
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - add Intel DG1 PCI and HDMI ids
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +--
arch/s390/boot/ipl_report.c | 8 +++++
arch/x86/kvm/vmx/nested.c | 10 ++++--
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 ++---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 ++
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++++++---
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++---
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 --
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++
drivers/net/ethernet/sun/ldmvsw.c | 3 ++
drivers/net/ethernet/sun/sunvnet.c | 3 ++
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 ++-
drivers/net/usb/smsc75xx.c | 7 ++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++--
drivers/nvme/target/core.c | 4 ++-
drivers/pci/pci-driver.c | 4 +--
drivers/pci/pci.c | 54 +++++++++++++----------------
drivers/pci/pci.h | 10 +++++-
drivers/scsi/hosts.c | 5 +--
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++--
drivers/tty/serial/8250/8250_em.c | 4 +--
drivers/tty/serial/fsl_lpuart.c | 12 +++++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++
fs/cifs/transport.c | 21 +++++------
fs/ext4/inode.c | 18 +++++-----
fs/ext4/namei.c | 4 +--
fs/ext4/page-io.c | 10 +++---
fs/ext4/xattr.c | 11 ++++++
fs/jffs2/file.c | 15 ++++----
include/linux/hid.h | 3 ++
include/linux/netdevice.h | 6 ++--
include/linux/sh_intc.h | 5 ++-
include/linux/tracepoint.h | 15 ++++----
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace_events_hist.c | 3 ++
net/ipv4/fib_frontend.c | 3 ++
net/ipv4/ip_tunnel.c | 12 +++----
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +--
net/iucv/iucv.c | 2 +-
net/netfilter/nft_redir.c | 2 +-
net/xfrm/xfrm_state.c | 3 --
sound/pci/hda/hda_intel.c | 22 ++++++++++--
sound/pci/hda/patch_hdmi.c | 3 ++
58 files changed, 277 insertions(+), 144 deletions(-)
The bug was obswerved while reading code. There are not many users of
addr_mode_nbytes. Anyway, we should update the flash's current address
mode when changing the address mode, fix it. We don't care for now about
the set_4byte_addr_mode(nor, false) from spi_nor_restore(), as it is
used at driver remove and shutdown.
Cc: stable(a)vger.kernel.org
Fixes: d7931a215063 ("mtd: spi-nor: core: Track flash's internal address mode")
Signed-off-by: Tudor Ambarus <tudor.ambarus(a)linaro.org>
---
drivers/mtd/spi-nor/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 1cf566fed9c6..868414017399 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -2769,6 +2769,7 @@ static int spi_nor_quad_enable(struct spi_nor *nor)
static int spi_nor_init(struct spi_nor *nor)
{
+ struct spi_nor_flash_parameter *params = nor->params;
int err;
err = spi_nor_octal_dtr_enable(nor, true);
@@ -2810,9 +2811,10 @@ static int spi_nor_init(struct spi_nor *nor)
*/
WARN_ONCE(nor->flags & SNOR_F_BROKEN_RESET,
"enabling reset hack; may not recover from unexpected reboots\n");
- err = nor->params->set_4byte_addr_mode(nor, true);
+ err = params->set_4byte_addr_mode(nor, true);
if (err && err != -ENOTSUPP)
return err;
+ params->addr_mode_nbytes = 4;
}
return 0;
--
2.40.0.rc1.284.g88254d51c5-goog
This is the start of the stable review cycle for the 5.15.104 release.
There are 115 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:26 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.104-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.104-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI/DPC: Await readiness of secondary bus after reset
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Fedor Pchelkin <pchelkin(a)ispras.ru>
io_uring: avoid null-ptr-deref in io_arm_poll_handler
Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Shawn Wang <shawnwang(a)linux.alibaba.com>
x86/resctrl: Clear staged_config[] before and after it is used
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Yazen Ghannam <yazen.ghannam(a)amd.com>
x86/mce: Make sure logged MCEs are processed after sysfs update
Shawn Guo <shawn.guo(a)linaro.org>
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
Radu Pirea (OSS) <radu-nicolae.pirea(a)oss.nxp.com>
net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit
Tero Kristo <tero.kristo(a)linux.intel.com>
trace/hwlat: Do not wipe the contents of per-cpu thread data
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Francesco Dolcini <francesco.dolcini(a)toradex.com>
mmc: sdhci_am654: lower power-on failed message severity
David Hildenbrand <david(a)redhat.com>
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
Dave Ertman <david.m.ertman(a)intel.com>
ice: avoid bonding causing auxiliary plug/unplug under RTNL lock
Elmer Miroslav Mosher Golovin <miroslav(a)mishamosher.com>
nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Abeni <pabeni(a)redhat.com>
mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()
Matthieu Baerts <matthieu.baerts(a)tessares.net>
mptcp: avoid setting TCP_CLOSE state twice
Geliang Tang <geliang.tang(a)suse.com>
mptcp: add ro_after_init for tcp{,v6}_prot_override
Paolo Abeni <pabeni(a)redhat.com>
mptcp: fix possible deadlock in subflow_error_report
Błażej Szczygieł <mumei6102(a)gmail.com>
drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume
Johan Hovold <johan+linaro(a)kernel.org>
drm/sun4i: fix missing component unbind on bind errors
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/shmem-helper: Remove another errant put in error path
Guo Ren <guoren(a)linux.alibaba.com>
riscv: asid: Fixup stale TLB entry cause application crash
Sergey Matyukevich <sergey.matyukevich(a)syntacore.com>
Revert "riscv: mm: notify remote harts about mmu cache updates"
Hamidreza H. Fard <nitocris(a)posteo.net>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
Bard Liao <yung-chuan.liao(a)linux.intel.com>
ALSA: hda: intel-dsp-config: add MTL PCI id
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Volker Lendecke <vl(a)samba.org>
cifs: Fix smb2_set_path_size()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Sung-hun Kim <sfoon.kim(a)samsung.com>
tracing: Make splice_read available again
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: exynos: fix node leak in probe PM QoS error path
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Roman Gushchin <roman.gushchin(a)linux.dev>
firmware: xilinx: don't make a sleepable memory allocation from an atomic context
Johan Hovold <johan(a)kernel.org>
serial: 8250_fsl: fix handle_irq locking
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Eric Van Hensbergen <ericvh(a)kernel.org>
net/9p: fix bug in client create for .L
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: update s_journal_inum if it changes after journal replay
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
Jurica Vukadin <jura(a)vukad.in>
kconfig: Update config changed flag before calling callback
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
hwmon: tmp512: drop of_match_ptr for ID table
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ucd90320) Add minimum delay between bus accesses
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Nikolay Aleksandrov <razor(a)blackwall.org>
bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
Nikolay Aleksandrov <razor(a)blackwall.org>
bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
Po-Hsu Lin <po-hsu.lin(a)canonical.com>
selftests: net: devlink_port_split.py: skip test if no suitable device available
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
sh_eth: avoid PHY being resumed when interface is not up
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
ravb: avoid PHY being resumed when interface is not up
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
ice: xsk: disable txq irq before flushing hw
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Ming Lei <ming.lei(a)redhat.com>
nvme: fix handling single range discard request
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
block: null_blk: Fix handling of fake timeout request
Liu Ying <victor.liu(a)nxp.com>
drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Wenjia Zhang <wenjia(a)linux.ibm.com>
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Bart Van Assche <bvanassche(a)acm.org>
loop: Fix use-after-free issues
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: remove now incorrect comment regarding port 5
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
Jouni Högander <jouni.hogander(a)intel.com>
drm/i915/psr: Use calculated io and fast wake lines
Tom Rix <trix(a)redhat.com>
drm/i915/display: clean up comments
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display/psr: Handle plane and pipe restrictions at every page flip
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled
Niklas Schnelle <schnelle(a)linux.ibm.com>
PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
Eugenio Pérez <eperezma(a)redhat.com>
vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready
Eugenio Pérez <eperezma(a)redhat.com>
vdpa_sim: not reset state in vdpasim_queue_ready
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_masq: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_nat: correct length for loading protocol registers
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +-
arch/riscv/include/asm/mmu.h | 2 -
arch/riscv/include/asm/tlbflush.h | 18 --
arch/riscv/mm/context.c | 40 ++--
arch/riscv/mm/tlbflush.c | 28 +--
arch/s390/boot/ipl_report.c | 8 +
arch/s390/pci/pci.c | 16 +-
arch/s390/pci/pci_bus.c | 12 +-
arch/s390/pci/pci_bus.h | 3 +-
arch/x86/Makefile.um | 6 +
arch/x86/kernel/cpu/mce/core.c | 1 +
arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 7 +-
arch/x86/kernel/cpu/resctrl/internal.h | 1 +
arch/x86/kernel/cpu/resctrl/rdtgroup.c | 25 ++-
arch/x86/kvm/vmx/nested.c | 10 +-
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/loop.c | 25 ++-
drivers/block/null_blk/main.c | 6 +-
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 +-
drivers/cpuidle/cpuidle-psci-domain.c | 3 +-
drivers/firmware/xilinx/zynqmp.c | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +-
.../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 +-
.../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 43 ++++-
drivers/gpu/drm/drm_gem_shmem_helper.c | 9 +-
drivers/gpu/drm/i915/display/intel_display_types.h | 2 +
drivers/gpu/drm/i915/display/intel_psr.c | 207 +++++++++++++++------
drivers/gpu/drm/i915/gt/intel_ring.c | 2 +-
drivers/gpu/drm/i915/i915_active.c | 24 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_drv.c | 6 +-
drivers/hid/hid-core.c | 18 +-
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 +-
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/ltc2992.c | 1 +
drivers/hwmon/pmbus/adm1266.c | 1 +
drivers/hwmon/pmbus/ucd9000.c | 75 ++++++++
drivers/hwmon/tmp513.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +
drivers/interconnect/samsung/exynos.c | 6 +-
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 -
drivers/mmc/host/sdhci_am654.c | 2 +-
drivers/net/bonding/bond_main.c | 23 ++-
drivers/net/dsa/mt7530.c | 64 +++----
drivers/net/dsa/mv88e6xxx/chip.c | 16 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/intel/ice/ice.h | 14 +-
drivers/net/ethernet/intel/ice/ice_main.c | 19 +-
drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +-
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +
drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +-
drivers/net/ethernet/renesas/ravb_main.c | 12 +-
drivers/net/ethernet/renesas/sh_eth.c | 12 +-
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/nxp-c45-tja11xx.c | 2 +-
drivers/net/phy/smsc.c | 5 +-
drivers/net/usb/smsc75xx.c | 7 +
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 +-
drivers/nvme/host/core.c | 28 ++-
drivers/nvme/host/pci.c | 2 +
drivers/nvme/target/core.c | 4 +-
drivers/pci/bus.c | 21 +++
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 57 +++---
drivers/pci/pci.h | 16 +-
drivers/pci/pcie/dpc.c | 4 +-
drivers/scsi/hosts.c | 3 -
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 +-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/8250/8250_fsl.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 +-
drivers/vdpa/vdpa_sim/vdpa_sim.c | 13 ++
drivers/video/fbdev/stifb.c | 27 +++
fs/cifs/smb2inode.c | 31 ++-
fs/cifs/transport.c | 21 +--
fs/ext4/inode.c | 18 +-
fs/ext4/namei.c | 4 +-
fs/ext4/super.c | 7 +-
fs/ext4/xattr.c | 11 ++
fs/jffs2/file.c | 15 +-
include/drm/drm_bridge.h | 4 +-
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 +-
include/linux/pci.h | 1 +
include/linux/sh_intc.h | 5 +-
include/linux/tracepoint.h | 15 +-
io_uring/io_uring.c | 4 +-
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace.c | 2 +
kernel/trace/trace_events_hist.c | 3 +
kernel/trace/trace_hwlat.c | 3 -
mm/huge_memory.c | 6 +-
net/9p/client.c | 2 +-
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 +-
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 +-
net/mptcp/pm_netlink.c | 16 ++
net/mptcp/subflow.c | 12 +-
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 +-
net/smc/smc_cdc.c | 3 +
net/smc/smc_core.c | 2 +-
net/xfrm/xfrm_state.c | 3 -
scripts/kconfig/confdata.c | 6 +-
sound/hda/intel-dsp-config.c | 9 +
sound/pci/hda/hda_intel.c | 5 +-
sound/pci/hda/patch_realtek.c | 1 +
tools/testing/selftests/net/devlink_port_split.py | 36 +++-
120 files changed, 925 insertions(+), 439 deletions(-)
This is the start of the stable review cycle for the 5.10.176 release.
There are 99 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.176-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.176-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Gaosheng Cui <cuigaosheng1(a)huawei.com>
xfs: remove xfs_setattr_time() declaration
Christian Brauner <brauner(a)kernel.org>
fs: use consistent setgid checks in is_sxid()
Amir Goldstein <amir73il(a)gmail.com>
attr: use consistent sgid stripping checks
Amir Goldstein <amir73il(a)gmail.com>
attr: add setattr_should_drop_sgid()
Amir Goldstein <amir73il(a)gmail.com>
fs: move should_remove_suid()
Amir Goldstein <amir73il(a)gmail.com>
attr: add in_group_or_capable()
Yang Xu <xuyang2018.jy(a)fujitsu.com>
fs: move S_ISGID stripping into the vfs_*() helpers
Yang Xu <xuyang2018.jy(a)fujitsu.com>
fs: add mode_strip_sgid() helper
Darrick J. Wong <djwong(a)kernel.org>
xfs: use setattr_copy to set vfs inode attributes
Dave Chinner <dchinner(a)redhat.com>
xfs: set prealloc flag in xfs_alloc_file_space()
Dave Chinner <dchinner(a)redhat.com>
xfs: fallocate() should call file_modified()
Dave Chinner <dchinner(a)redhat.com>
xfs: remove XFS_PREALLOC_SYNC
Darrick J. Wong <djwong(a)kernel.org>
xfs: don't leak btree cursor when insrec fails after a split
Darrick J. Wong <djwong(a)kernel.org>
xfs: purge dquots after inode walk fails during quotacheck
Dave Chinner <dchinner(a)redhat.com>
xfs: don't assert fail on perag references on teardown
Lukas Wunner <lukas(a)wunner.de>
PCI/DPC: Await readiness of secondary bus after reset
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Fedor Pchelkin <pchelkin(a)ispras.ru>
io_uring: avoid null-ptr-deref in io_arm_poll_handler
Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Yazen Ghannam <yazen.ghannam(a)amd.com>
x86/mce: Make sure logged MCEs are processed after sysfs update
Shawn Guo <shawn.guo(a)linaro.org>
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Francesco Dolcini <francesco.dolcini(a)toradex.com>
mmc: sdhci_am654: lower power-on failed message severity
David Hildenbrand <david(a)redhat.com>
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Matthieu Baerts <matthieu.baerts(a)tessares.net>
mptcp: avoid setting TCP_CLOSE state twice
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/shmem-helper: Remove another errant put in error path
Hamidreza H. Fard <nitocris(a)posteo.net>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
Bard Liao <yung-chuan.liao(a)linux.intel.com>
ALSA: hda: intel-dsp-config: add MTL PCI id
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Volker Lendecke <vl(a)samba.org>
cifs: Fix smb2_set_path_size()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Sung-hun Kim <sfoon.kim(a)samsung.com>
tracing: Make splice_read available again
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Roman Gushchin <roman.gushchin(a)linux.dev>
firmware: xilinx: don't make a sleepable memory allocation from an atomic context
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
hwmon: tmp512: drop of_match_ptr for ID table
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ucd90320) Add minimum delay between bus accesses
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
Po-Hsu Lin <po-hsu.lin(a)canonical.com>
selftests: net: devlink_port_split.py: skip test if no suitable device available
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
ice: xsk: disable txq irq before flushing hw
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Ming Lei <ming.lei(a)redhat.com>
nvme: fix handling single range discard request
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
block: null_blk: Fix handling of fake timeout request
Damien Le Moal <damien.lemoal(a)wdc.com>
null_blk: Move driver into its own directory
Liu Ying <victor.liu(a)nxp.com>
drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Wenjia Zhang <wenjia(a)linux.ibm.com>
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_masq: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_nat: correct length for loading protocol registers
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Documentation/trace/ftrace.rst | 2 +-
Makefile | 4 +-
arch/s390/boot/ipl_report.c | 8 +++
arch/x86/Makefile.um | 6 ++
arch/x86/kernel/cpu/mce/core.c | 1 +
arch/x86/kvm/vmx/nested.c | 10 ++-
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/Kconfig | 8 +--
drivers/block/Makefile | 7 +-
drivers/block/null_blk/Kconfig | 12 ++++
drivers/block/null_blk/Makefile | 11 +++
drivers/block/{null_blk_main.c => null_blk/main.c} | 6 +-
drivers/block/{ => null_blk}/null_blk.h | 0
.../block/{null_blk_trace.c => null_blk/trace.c} | 2 +-
.../block/{null_blk_trace.h => null_blk/trace.h} | 2 +-
.../block/{null_blk_zoned.c => null_blk/zoned.c} | 2 +-
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 +-
drivers/cpuidle/cpuidle-psci-domain.c | 3 +-
drivers/firmware/xilinx/zynqmp.c | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +--
.../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 +-
drivers/gpu/drm/drm_gem_shmem_helper.c | 9 ++-
drivers/gpu/drm/i915/gt/intel_ring.c | 2 +-
drivers/gpu/drm/i915/i915_active.c | 24 ++++---
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++--
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 +--
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/pmbus/adm1266.c | 1 +
drivers/hwmon/pmbus/ucd9000.c | 75 ++++++++++++++++++++
drivers/hwmon/tmp513.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 ++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 -
drivers/mmc/host/sdhci_am654.c | 2 +-
drivers/net/dsa/mv88e6xxx/chip.c | 16 +++--
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +-
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 ++
drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +-
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 +-
drivers/net/usb/smsc75xx.c | 7 ++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 +-
drivers/nvme/host/core.c | 28 +++++---
drivers/nvme/target/core.c | 4 +-
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 57 +++++++--------
drivers/pci/pci.h | 16 ++++-
drivers/pci/pcie/dpc.c | 4 +-
drivers/scsi/hosts.c | 5 +-
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 +++-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 +++-
drivers/video/fbdev/stifb.c | 27 ++++++++
fs/attr.c | 70 +++++++++++++++++--
fs/cifs/smb2inode.c | 31 +++++++--
fs/cifs/transport.c | 21 +++---
fs/ext4/inode.c | 18 +++--
fs/ext4/namei.c | 4 +-
fs/ext4/xattr.c | 11 +++
fs/inode.c | 80 +++++++++++++---------
fs/internal.h | 6 ++
fs/jffs2/file.c | 15 ++--
fs/namei.c | 80 ++++++++++++++++++----
fs/ocfs2/file.c | 4 +-
fs/ocfs2/namei.c | 1 +
fs/open.c | 6 +-
fs/xfs/libxfs/xfs_btree.c | 8 ++-
fs/xfs/xfs_bmap_util.c | 9 +--
fs/xfs/xfs_file.c | 24 +++----
fs/xfs/xfs_iops.c | 56 +--------------
fs/xfs/xfs_iops.h | 1 -
fs/xfs/xfs_mount.c | 3 +-
fs/xfs/xfs_pnfs.c | 9 ++-
fs/xfs/xfs_qm.c | 9 ++-
include/drm/drm_bridge.h | 4 +-
include/linux/fs.h | 5 +-
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 +-
include/linux/sh_intc.h | 5 +-
include/linux/tracepoint.h | 15 ++--
io_uring/io_uring.c | 4 +-
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace.c | 2 +
kernel/trace/trace_events_hist.c | 3 +
mm/huge_memory.c | 6 +-
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 ++--
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 +-
net/mptcp/subflow.c | 1 -
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 +-
net/smc/smc_cdc.c | 3 +
net/smc/smc_core.c | 2 +-
net/xfrm/xfrm_state.c | 3 -
sound/hda/intel-dsp-config.c | 9 +++
sound/pci/hda/hda_intel.c | 5 +-
sound/pci/hda/patch_realtek.c | 1 +
tools/testing/selftests/net/devlink_port_split.py | 30 ++++++++
111 files changed, 743 insertions(+), 360 deletions(-)
This is the start of the stable review cycle for the 4.19.279 release.
There are 36 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:13 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.279-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.279-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Eric Biggers <ebiggers(a)kernel.org>
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/Makefile.um | 6 ++++++
arch/x86/mm/mem_encrypt_identity.c | 3 ++-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/jffs2/file.c | 15 +++++++--------
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
include/linux/tracepoint.h | 15 ++++++---------
kernel/trace/ftrace.c | 3 ++-
kernel/trace/trace_events_hist.c | 3 +++
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
39 files changed, 166 insertions(+), 78 deletions(-)
This is the start of the stable review cycle for the 4.14.311 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.311-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.311-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Eric Biggers <ebiggers(a)kernel.org>
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/Makefile.um | 6 ++++++
drivers/block/sunvdc.c | 2 ++
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
kernel/trace/ftrace.c | 3 ++-
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
33 files changed, 144 insertions(+), 53 deletions(-)
The patch titled
Subject: mm/hugetlb: fix uffd wr-protection for CoW optimization path
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Peter Xu <peterx(a)redhat.com>
Subject: mm/hugetlb: fix uffd wr-protection for CoW optimization path
Date: Tue, 21 Mar 2023 15:18:40 -0400
This patch fixes an issue that a hugetlb uffd-wr-protected mapping can be
writable even with uffd-wp bit set. It only happens with all these
conditions met: (1) hugetlb memory (2) private mapping (3) original
mapping was missing, then (4) being wr-protected (IOW, pte marker
installed). Then write to the page to trigger.
Userfaultfd-wp trap for hugetlb was implemented in hugetlb_fault() before
even reaching hugetlb_wp() to avoid taking more locks that userfault won't
need. However there's one CoW optimization path for missing hugetlb page
that can trigger hugetlb_wp() inside hugetlb_no_page(), that can bypass
the userfaultfd-wp traps.
A few ways to resolve this:
(1) Skip the CoW optimization for hugetlb private mapping, considering
that private mappings for hugetlb should be very rare, so it may not
really be helpful to major workloads. The worst case is we only skip the
optimization if userfaultfd_wp(vma)==true, because uffd-wp needs another
fault anyway.
(2) Move the userfaultfd-wp handling for hugetlb from hugetlb_fault()
into hugetlb_wp(). The major cons is there're a bunch of locks taken
when calling hugetlb_wp(), and that will make the changeset unnecessarily
complicated due to the lock operations.
(3) Carry over uffd-wp bit in hugetlb_wp(), so it'll need to fault again
for uffd-wp privately mapped pages.
This patch chose option (3) which contains the minimum changeset (simplest
for backport) and also make sure hugetlb_wp() itself will start to be
always safe with uffd-wp ptes even if called elsewhere in the future.
This patch will be needed for v5.19+ hence copy stable.
Link: https://lkml.kernel.org/r/20230321191840.1897940-1-peterx@redhat.com
Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection")
Signed-off-by: Peter Xu <peterx(a)redhat.com>
Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com>
Acked-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Axel Rasmussen <axelrasmussen(a)google.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: Nadav Amit <nadav.amit(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/mm/hugetlb.c~mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path
+++ a/mm/hugetlb.c
@@ -5478,7 +5478,7 @@ static vm_fault_t hugetlb_wp(struct mm_s
struct folio *pagecache_folio, spinlock_t *ptl)
{
const bool unshare = flags & FAULT_FLAG_UNSHARE;
- pte_t pte;
+ pte_t pte, newpte;
struct hstate *h = hstate_vma(vma);
struct page *old_page;
struct folio *new_folio;
@@ -5622,8 +5622,10 @@ retry_avoidcopy:
mmu_notifier_invalidate_range(mm, range.start, range.end);
page_remove_rmap(old_page, vma, true);
hugepage_add_new_anon_rmap(new_folio, vma, haddr);
- set_huge_pte_at(mm, haddr, ptep,
- make_huge_pte(vma, &new_folio->page, !unshare));
+ newpte = make_huge_pte(vma, &new_folio->page, !unshare);
+ if (huge_pte_uffd_wp(pte))
+ newpte = huge_pte_mkuffd_wp(newpte);
+ set_huge_pte_at(mm, haddr, ptep, newpte);
folio_set_hugetlb_migratable(new_folio);
/* Make the old page be freed below */
new_folio = page_folio(old_page);
_
Patches currently in -mm which might be from peterx(a)redhat.com are
kselftest-vm-fix-unused-variable-warning.patch
tools-headers-uapi-sync-linux-prctlh-with-the-kernel-sources.patch
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch
mm-khugepaged-alloc_charge_hpage-take-care-of-mem-charge-errors.patch
mm-khugepaged-cleanup-memcg-uncharge-for-failure-path.patch
mm-uffd-uffd_feature_wp_unpopulated.patch
selftests-mm-smoke-test-uffd_feature_wp_unpopulated.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported-fix.patch
The conditional MOVS instruction that appears to have been added to test
for the TIF_USING_IWMMXT thread_info flag only sets the N and Z
condition flags and register R7, none of which are referenced in the
subsequent code. This means that the instruction does nothing, which
means that we might misidentify faulting FPE instructions as iWMMXT
instructions on kernels that were built to support both.
This seems to have been part of the original submission of the code, and
so this has never worked as intended, and nobody ever noticed, and so we
might decide to just leave this as-is. However, with the ongoing move
towards multiplatform kernels, the issue becomes more likely to
manifest, and so it is better to fix it.
So check whether we are dealing with an undef exception regarding
coprocessor index #0 or #1, and if so, load the thread_info flag and
only dispatch it as a iWMMXT trap if the flag is set.
Cc: <stable(a)vger.kernel.org> # v2.6.9+
Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org>
---
arch/arm/kernel/entry-armv.S | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index c39303e5c23470e6..c5d2f07994fb0d87 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -606,10 +606,11 @@ call_fpe:
strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[]
#ifdef CONFIG_IWMMXT
@ Test if we need to give access to iWMMXt coprocessors
- ldr r5, [r10, #TI_FLAGS]
- rsbs r7, r8, #(1 << 8) @ CP 0 or 1 only
- movscs r7, r5, lsr #(TIF_USING_IWMMXT + 1)
- bcs iwmmxt_task_enable
+ tst r8, #0xe << 8 @ CP 0 or 1?
+ ldreq r5, [r10, #TI_FLAGS] @ if so, load thread_info flags
+ andeq r5, r5, #1 << TIF_USING_IWMMXT @ isolate TIF_USING_IWMMXT flag
+ teqeq r5, #1 << TIF_USING_IWMMXT @ check whether it is set
+ beq iwmmxt_task_enable @ branch if set
#endif
ARM( add pc, pc, r8, lsr #6 )
THUMB( lsr r8, r8, #6 )
--
2.39.2
In case of early initialisation errors and on platforms that do not use
the DPU controller, the deinitilisation code can be called with the kms
pointer set to NULL.
Fixes: f026e431cf86 ("drm/msm: Convert to Linux IRQ interfaces")
Cc: stable(a)vger.kernel.org # 5.14
Cc: Thomas Zimmermann <tzimmermann(a)suse.de>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/gpu/drm/msm/msm_drv.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 17a59d73fe01..2f2bcdb671d2 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -251,9 +251,11 @@ static int msm_drm_uninit(struct device *dev)
drm_bridge_remove(priv->bridges[i]);
priv->num_bridges = 0;
- pm_runtime_get_sync(dev);
- msm_irq_uninstall(ddev);
- pm_runtime_put_sync(dev);
+ if (kms) {
+ pm_runtime_get_sync(dev);
+ msm_irq_uninstall(ddev);
+ pm_runtime_put_sync(dev);
+ }
if (kms && kms->funcs)
kms->funcs->destroy(kms);
--
2.39.2
Fix SUPERH builds that select SYS_SUPPORTS_NUMA but do not select
SYS_SUPPORTS_SMP and SMP.
kernel/sched/topology.c is only built for CONFIG_SMP and then the NUMA
code + data inside topology.c is only built when CONFIG_NUMA is
set/enabled, so these arch/sh/ configs need to select SMP and
SYS_SUPPORTS_SMP to build the NUMA support.
Fixes this build error in multiple SUPERH configs:
mm/page_alloc.o: In function `get_page_from_freelist':
page_alloc.c:(.text+0x2ca8): undefined reference to `node_reclaim_distance'
Fixes: 357d59469c11 ("sh: Tidy up dependencies for SH-2 build.")
Fixes: 9109a30e5a54 ("sh: add support for sh7366 processor")
Fixes: 55ba99eb211a ("sh: Add support for SH7786 CPU subtype.")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Reported-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Rich Felker <dalias(a)libc.org>
Cc: Kuninori Morimoto <morimoto.kuninori(a)renesas.com>
Cc: linux-sh(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
---
v2: skipped
v3: skipped
v4: refresh & resend
v5: include CPU_SUBTYPE_SH7785 in this patch (Adrian)
arch/sh/Kconfig | 6 ++++++
1 file changed, 6 insertions(+)
diff -- a/arch/sh/Kconfig b/arch/sh/Kconfig
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -442,6 +442,8 @@ config CPU_SUBTYPE_SH7785
select CPU_SHX2
select ARCH_SPARSEMEM_ENABLE
select SYS_SUPPORTS_NUMA
+ select SYS_SUPPORTS_SMP
+ select SMP
select PINCTRL
config CPU_SUBTYPE_SH7786
@@ -476,6 +478,8 @@ config CPU_SUBTYPE_SH7722
select CPU_SHX2
select ARCH_SHMOBILE
select ARCH_SPARSEMEM_ENABLE
+ select SYS_SUPPORTS_SMP
+ select SMP
select SYS_SUPPORTS_NUMA
select SYS_SUPPORTS_SH_CMT
select PINCTRL
@@ -486,6 +490,8 @@ config CPU_SUBTYPE_SH7366
select CPU_SHX2
select ARCH_SHMOBILE
select ARCH_SPARSEMEM_ENABLE
+ select SYS_SUPPORTS_SMP
+ select SMP
select SYS_SUPPORTS_NUMA
select SYS_SUPPORTS_SH_CMT
In case of early initialisation errors and on platforms that do not use
the DPU controller, the deinitilisation code can be called with the kms
pointer set to NULL.
Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot")
Cc: stable(a)vger.kernel.org # 5.14
Cc: Abhinav Kumar <quic_abhinavk(a)quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/gpu/drm/msm/msm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 9ded384acba4..17a59d73fe01 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -242,7 +242,8 @@ static int msm_drm_uninit(struct device *dev)
msm_fbdev_free(ddev);
#endif
- msm_disp_snapshot_destroy(ddev);
+ if (kms)
+ msm_disp_snapshot_destroy(ddev);
drm_mode_config_cleanup(ddev);
--
2.39.2
On Tue, Mar 21, 2023 at 05:18:03AM -0700, KernelCI bot wrote:
The KernelCI bisection bot found a boot bisection on one of the HP
ChromeBooks in v5.10.175 triggered by b5005605013d ("drm/i915: Don't use
BAR mappings for ring buffers with LLC"). The system appears to die
very early in boot with no output.
I've left the full report from the bot below, including links to full
boot logs such as they are and a tag for the bot, and the full web
dashboard for the test case fail is at:
https://linux.kernelci.org/test/plan/id/64147346939869e04b8c8694/
including details of the successful test on v5.10.174.
> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
> * This automated bisection report was sent to you on the basis *
> * that you may be involved with the breaking commit it has *
> * found. No manual investigation has been done to verify it, *
> * and the root cause of the problem may be somewhere else. *
> * *
> * If you do send a fix, please include this trailer: *
> * Reported-by: "kernelci.org bot" <bot(a)kernelci.org> *
> * *
> * Hope this helps! *
> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
>
> stable-rc/linux-5.10.y bisection: baseline.login on hp-x360-14-G1-sona
>
> Summary:
> Start: de26e1b2103b Linux 5.10.175
> Plain log: https://storage.kernelci.org/stable-rc/linux-5.10.y/v5.10.175/x86_64/x86_64…
> HTML log: https://storage.kernelci.org/stable-rc/linux-5.10.y/v5.10.175/x86_64/x86_64…
> Result: b5005605013d drm/i915: Don't use BAR mappings for ring buffers with LLC
>
> Checks:
> revert: PASS
> verify: PASS
>
> Parameters:
> Tree: stable-rc
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> Branch: linux-5.10.y
> Target: hp-x360-14-G1-sona
> CPU arch: x86_64
> Lab: lab-collabora
> Compiler: gcc-10
> Config: x86_64_defconfig+x86-chromebook
> Test case: baseline.login
>
> Breaking commit found:
>
> -------------------------------------------------------------------------------
> commit b5005605013d30ab27c303cbaeff60b7872234a3
> Author: John Harrison <John.C.Harrison(a)Intel.com>
> Date: Wed Feb 15 17:11:01 2023 -0800
>
> drm/i915: Don't use BAR mappings for ring buffers with LLC
>
> commit 85636167e3206c3fbd52254fc432991cc4e90194 upstream.
>
> Direction from hardware is that ring buffers should never be mapped
> via the BAR on systems with LLC. There are too many caching pitfalls
> due to the way BAR accesses are routed. So it is safest to just not
> use it.
>
> Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com>
> Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere")
> Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
> Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com>
> Cc: intel-gfx(a)lists.freedesktop.org
> Cc: <stable(a)vger.kernel.org> # v4.9+
> Tested-by: Jouni Högander <jouni.hogander(a)intel.com>
> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com>
> Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-3-John…
> (cherry picked from commit 65c08339db1ada87afd6cfe7db8e60bb4851d919)
> Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
> Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c
> index 4034a4bac7f0..69b2e5509d67 100644
> --- a/drivers/gpu/drm/i915/gt/intel_ring.c
> +++ b/drivers/gpu/drm/i915/gt/intel_ring.c
> @@ -49,7 +49,7 @@ int intel_ring_pin(struct intel_ring *ring, struct i915_gem_ww_ctx *ww)
> if (unlikely(ret))
> goto err_unpin;
>
> - if (i915_vma_is_map_and_fenceable(vma))
> + if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915))
> addr = (void __force *)i915_vma_pin_iomap(vma);
> else
> addr = i915_gem_object_pin_map(vma->obj,
> @@ -91,7 +91,7 @@ void intel_ring_unpin(struct intel_ring *ring)
> return;
>
> i915_vma_unset_ggtt_write(vma);
> - if (i915_vma_is_map_and_fenceable(vma))
> + if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915))
> i915_vma_unpin_iomap(vma);
> else
> i915_gem_object_unpin_map(vma->obj);
> -------------------------------------------------------------------------------
>
>
> Git bisection log:
>
> -------------------------------------------------------------------------------
> git bisect start
> # good: [955623617f2f505ac08d0efda2bb50c1a52e2c96] Linux 5.10.174
> git bisect good 955623617f2f505ac08d0efda2bb50c1a52e2c96
> # bad: [de26e1b2103b1f56451f6ad77f0190c9066c87dc] Linux 5.10.175
> git bisect bad de26e1b2103b1f56451f6ad77f0190c9066c87dc
> # good: [d16701a385b54f44bf41ff1d7485e7a11080deb3] bnxt_en: Avoid order-5 memory allocation for TPA data
> git bisect good d16701a385b54f44bf41ff1d7485e7a11080deb3
> # good: [d47d364f6671d8794a89e4972b1fd3284d213c96] macintosh: windfarm: Use unsigned type for 1-bit bitfields
> git bisect good d47d364f6671d8794a89e4972b1fd3284d213c96
> # bad: [c3fd717b58f0a3e2461c16e2360ee6a949b47940] ext4: add strict range checks while freeing blocks
> git bisect bad c3fd717b58f0a3e2461c16e2360ee6a949b47940
> # good: [7aa5a495cbf8a33cd9fec892c180dedf14292b76] ipmi/watchdog: replace atomic_add() and atomic_sub()
> git bisect good 7aa5a495cbf8a33cd9fec892c180dedf14292b76
> # bad: [b5005605013d30ab27c303cbaeff60b7872234a3] drm/i915: Don't use BAR mappings for ring buffers with LLC
> git bisect bad b5005605013d30ab27c303cbaeff60b7872234a3
> # good: [c53d50d8081a49ba21f866a51277a012b9efad8e] skbuff: Fix nfct leak on napi stolen
> git bisect good c53d50d8081a49ba21f866a51277a012b9efad8e
> # first bad commit: [b5005605013d30ab27c303cbaeff60b7872234a3] drm/i915: Don't use BAR mappings for ring buffers with LLC
> -------------------------------------------------------------------------------
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Groups.io Links: You receive all messages sent to this group.
> View/Reply Online (#39748): https://groups.io/g/kernelci-results/message/39748
> Mute This Topic: https://groups.io/mt/97753328/1131744
> Group Owner: kernelci-results+owner(a)groups.io
> Unsubscribe: https://groups.io/g/kernelci-results/unsub [broonie(a)kernel.org]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
This is the start of the stable review cycle for the 5.4.238 release.
There are 60 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:16 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.238-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.238-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Kees Cook <keescook(a)chromium.org>
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Tom Saeger <tom.saeger(a)oracle.com>
Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()"
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - controller is in GPU on the DG1
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - add Intel DG1 PCI and HDMI ids
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +--
arch/mips/lasat/picvue_proc.c | 2 +-
arch/s390/boot/ipl_report.c | 8 +++++
arch/x86/Makefile.um | 6 ++++
arch/x86/kvm/vmx/nested.c | 10 ++++--
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 ++---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 ++
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++++++---
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++---
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 --
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++
drivers/net/ethernet/sun/ldmvsw.c | 3 ++
drivers/net/ethernet/sun/sunvnet.c | 3 ++
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 ++-
drivers/net/usb/smsc75xx.c | 7 ++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++--
drivers/nvme/target/core.c | 4 ++-
drivers/pci/pci-driver.c | 4 +--
drivers/pci/pci.c | 54 +++++++++++++----------------
drivers/pci/pci.h | 10 +++++-
drivers/scsi/hosts.c | 5 +--
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++--
drivers/tty/serial/8250/8250_em.c | 4 +--
drivers/tty/serial/fsl_lpuart.c | 12 +++++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++
fs/cifs/transport.c | 21 +++++------
fs/ext4/inode.c | 18 +++++-----
fs/ext4/namei.c | 4 +--
fs/ext4/page-io.c | 10 +++---
fs/ext4/xattr.c | 11 ++++++
fs/jffs2/file.c | 15 ++++----
include/linux/hid.h | 3 ++
include/linux/netdevice.h | 6 ++--
include/linux/sh_intc.h | 5 ++-
include/linux/tracepoint.h | 15 ++++----
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace_events_hist.c | 3 ++
net/ipv4/fib_frontend.c | 3 ++
net/ipv4/ip_tunnel.c | 12 +++----
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +--
net/iucv/iucv.c | 2 +-
net/netfilter/nft_redir.c | 2 +-
net/xfrm/xfrm_state.c | 3 --
sound/pci/hda/hda_intel.c | 22 ++++++++++--
sound/pci/hda/patch_hdmi.c | 3 ++
60 files changed, 284 insertions(+), 145 deletions(-)
For SCI, the TE (transmit enable) must be set after setting TIE (transmit
interrupt enable) or in the same instruction to start the transmission.
Set TE bit in sci_start_tx() instead of set_termios() for SCI and clear
TE bit, if circular buffer is empty in sci_transmit_chars().
Fixes: f9a2adcc9e90 ("arm64: dts: renesas: r9a07g044: Add SCI[0-1] nodes")
Cc: stable(a)vger.kernel.org
Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com>
---
v3:
* New patch
---
drivers/tty/serial/sh-sci.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index b9cd27451f90..9079a8ea9132 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -597,6 +597,15 @@ static void sci_start_tx(struct uart_port *port)
if (!s->chan_tx || port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
/* Set TIE (Transmit Interrupt Enable) bit in SCSCR */
ctrl = serial_port_in(port, SCSCR);
+
+ /*
+ * For SCI, TE (transmit enable) must be set after setting TIE
+ * (transmit interrupt enable) or in the same instruction to start
+ * the transmit process.
+ */
+ if (port->type == PORT_SCI)
+ ctrl |= SCSCR_TE;
+
serial_port_out(port, SCSCR, ctrl | SCSCR_TIE);
}
}
@@ -835,6 +844,12 @@ static void sci_transmit_chars(struct uart_port *port)
c = xmit->buf[xmit->tail];
xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
} else {
+ if (port->type == PORT_SCI) {
+ ctrl = serial_port_in(port, SCSCR);
+ ctrl &= ~SCSCR_TE;
+ serial_port_out(port, SCSCR, ctrl);
+ return;
+ }
break;
}
@@ -2581,8 +2596,14 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
sci_set_mctrl(port, port->mctrl);
}
- scr_val |= SCSCR_RE | SCSCR_TE |
- (s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0));
+ /*
+ * For SCI, TE (transmit enable) must be set after setting TIE
+ * (transmit interrupt enable) or in the same instruction to
+ * start the transmitting process. So skip setting TE here for SCI.
+ */
+ if (port->type != PORT_SCI)
+ scr_val |= SCSCR_TE;
+ scr_val |= SCSCR_RE | (s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0));
serial_port_out(port, SCSCR, scr_val | s->hscif_tot);
if ((srr + 1 == 5) &&
(port->type == PORT_SCIFA || port->type == PORT_SCIFB)) {
--
2.25.1
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 90410bcf873cf05f54a32183afff0161f44f9715
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679313445246112(a)kroah.com' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
90410bcf873c ("ocfs2: fix data corruption after failed write")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 90410bcf873cf05f54a32183afff0161f44f9715 Mon Sep 17 00:00:00 2001
From: Jan Kara via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com>
Date: Thu, 2 Mar 2023 16:38:43 +0100
Subject: [PATCH] ocfs2: fix data corruption after failed write
When buffered write fails to copy data into underlying page cache page,
ocfs2_write_end_nolock() just zeroes out and dirties the page. This can
leave dirty page beyond EOF and if page writeback tries to write this page
before write succeeds and expands i_size, page gets into inconsistent
state where page dirty bit is clear but buffer dirty bits stay set
resulting in page data never getting written and so data copied to the
page is lost. Fix the problem by invalidating page beyond EOF after
failed write.
Link: https://lkml.kernel.org/r/20230302153843.18499-1-jack@suse.cz
Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()")
Signed-off-by: Jan Kara <jack(a)suse.cz>
Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com>
Cc: Mark Fasheh <mark(a)fasheh.com>
Cc: Joel Becker <jlbec(a)evilplan.org>
Cc: Junxiao Bi <junxiao.bi(a)oracle.com>
Cc: Changwei Ge <gechangwei(a)live.cn>
Cc: Gang He <ghe(a)suse.com>
Cc: Jun Piao <piaojun(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 1d65f6ef00ca..0394505fdce3 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1977,11 +1977,26 @@ int ocfs2_write_end_nolock(struct address_space *mapping,
}
if (unlikely(copied < len) && wc->w_target_page) {
+ loff_t new_isize;
+
if (!PageUptodate(wc->w_target_page))
copied = 0;
- ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
- start+len);
+ new_isize = max_t(loff_t, i_size_read(inode), pos + copied);
+ if (new_isize > page_offset(wc->w_target_page))
+ ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
+ start+len);
+ else {
+ /*
+ * When page is fully beyond new isize (data copy
+ * failed), do not bother zeroing the page. Invalidate
+ * it instead so that writeback does not get confused
+ * put page & buffer dirty bits into inconsistent
+ * state.
+ */
+ block_invalidate_folio(page_folio(wc->w_target_page),
+ 0, PAGE_SIZE);
+ }
}
if (wc->w_target_page)
flush_dcache_page(wc->w_target_page);
From: Tobias Schramm <t.schramm(a)manjaro.org>
[ Upstream commit eca5bd666b0aa7dc0bca63292e4778968241134e ]
This commit fixes a race between completion of stop command and start of a
new command.
Previously the command ready interrupt was enabled before stop command
was written to the command register. This caused the command ready
interrupt to fire immediately since the CMDRDY flag is asserted constantly
while there is no command in progress.
Consequently the command state machine will immediately advance to the
next state when the tasklet function is executed again, no matter
actual completion state of the stop command.
Thus a new command can then be dispatched immediately, interrupting and
corrupting the stop command on the CMD line.
Fix that by dropping the command ready interrupt enable before calling
atmci_send_stop_cmd. atmci_send_stop_cmd does already enable the
command ready interrupt, no further writes to ATMCI_IER are necessary.
Signed-off-by: Tobias Schramm <t.schramm(a)manjaro.org>
Acked-by: Ludovic Desroches <ludovic.desroches(a)microchip.com>
Link: https://lore.kernel.org/r/20221230194315.809903-2-t.schramm@manjaro.org
Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/mmc/host/atmel-mci.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index c8a591d8a3d9e..a09c459d62c6a 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1857,7 +1857,6 @@ static void atmci_tasklet_func(unsigned long priv)
atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY);
state = STATE_WAITING_NOTBUSY;
} else if (host->mrq->stop) {
- atmci_writel(host, ATMCI_IER, ATMCI_CMDRDY);
atmci_send_stop_cmd(host, data);
state = STATE_SENDING_STOP;
} else {
@@ -1890,8 +1889,6 @@ static void atmci_tasklet_func(unsigned long priv)
* command to send.
*/
if (host->mrq->stop) {
- atmci_writel(host, ATMCI_IER,
- ATMCI_CMDRDY);
atmci_send_stop_cmd(host, data);
state = STATE_SENDING_STOP;
} else {
--
2.39.2
From: Marco Elver <elver(a)google.com>
Haibo Li reported:
| Unable to handle kernel paging request at virtual address
| ffffff802a0d8d7171
| Mem abort info:o:
| ESR = 0x9600002121
| EC = 0x25: DABT (current EL), IL = 32 bitsts
| SET = 0, FnV = 0 0
| EA = 0, S1PTW = 0 0
| FSC = 0x21: alignment fault
| Data abort info:o:
| ISV = 0, ISS = 0x0000002121
| CM = 0, WnR = 0 0
| swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000002835200000
| [ffffff802a0d8d71] pgd=180000005fbf9003, p4d=180000005fbf9003,
| pud=180000005fbf9003, pmd=180000005fbe8003, pte=006800002a0d8707
| Internal error: Oops: 96000021 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 2 PID: 45 Comm: kworker/u8:2 Not tainted
| 5.15.78-android13-8-g63561175bbda-dirty #1
| ...
| pc : kcsan_setup_watchpoint+0x26c/0x6bc
| lr : kcsan_setup_watchpoint+0x88/0x6bc
| sp : ffffffc00ab4b7f0
| x29: ffffffc00ab4b800 x28: ffffff80294fe588 x27: 0000000000000001
| x26: 0000000000000019 x25: 0000000000000001 x24: ffffff80294fdb80
| x23: 0000000000000000 x22: ffffffc00a70fb68 x21: ffffff802a0d8d71
| x20: 0000000000000002 x19: 0000000000000000 x18: ffffffc00a9bd060
| x17: 0000000000000001 x16: 0000000000000000 x15: ffffffc00a59f000
| x14: 0000000000000001 x13: 0000000000000000 x12: ffffffc00a70faa0
| x11: 00000000aaaaaaab x10: 0000000000000054 x9 : ffffffc00839adf8
| x8 : ffffffc009b4cf00 x7 : 0000000000000000 x6 : 0000000000000007
| x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffffffc00a70fb70
| x2 : 0005ff802a0d8d71 x1 : 0000000000000000 x0 : 0000000000000000
| Call trace:
| kcsan_setup_watchpoint+0x26c/0x6bc
| __tsan_read2+0x1f0/0x234
| inflate_fast+0x498/0x750
| zlib_inflate+0x1304/0x2384
| __gunzip+0x3a0/0x45c
| gunzip+0x20/0x30
| unpack_to_rootfs+0x2a8/0x3fc
| do_populate_rootfs+0xe8/0x11c
| async_run_entry_fn+0x58/0x1bc
| process_one_work+0x3ec/0x738
| worker_thread+0x4c4/0x838
| kthread+0x20c/0x258
| ret_from_fork+0x10/0x20
| Code: b8bfc2a8 2a0803f7 14000007 d503249f (78bfc2a8) )
| ---[ end trace 613a943cb0a572b6 ]-----
The reason for this is that on certain arm64 configuration since
e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when
CONFIG_LTO=y"), READ_ONCE() may be promoted to a full atomic acquire
instruction which cannot be used on unaligned addresses.
Fix it by avoiding READ_ONCE() in read_instrumented_memory(), and simply
forcing the compiler to do the required access by casting to the
appropriate volatile type. In terms of generated code this currently
only affects architectures that do not use the default READ_ONCE()
implementation.
The only downside is that we are not guaranteed atomicity of the access
itself, although on most architectures a plain load up to machine word
size should still be atomic (a fact the default READ_ONCE() still relies
on itself).
Reported-by: Haibo Li <haibo.li(a)mediatek.com>
Tested-by: Haibo Li <haibo.li(a)mediatek.com>
Cc: <stable(a)vger.kernel.org> # 5.17+
Signed-off-by: Marco Elver <elver(a)google.com>
Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org>
---
kernel/kcsan/core.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
index 54d077e1a2dc..5a60cc52adc0 100644
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -337,11 +337,20 @@ static void delay_access(int type)
*/
static __always_inline u64 read_instrumented_memory(const volatile void *ptr, size_t size)
{
+ /*
+ * In the below we don't necessarily need the read of the location to
+ * be atomic, and we don't use READ_ONCE(), since all we need for race
+ * detection is to observe 2 different values.
+ *
+ * Furthermore, on certain architectures (such as arm64), READ_ONCE()
+ * may turn into more complex instructions than a plain load that cannot
+ * do unaligned accesses.
+ */
switch (size) {
- case 1: return READ_ONCE(*(const u8 *)ptr);
- case 2: return READ_ONCE(*(const u16 *)ptr);
- case 4: return READ_ONCE(*(const u32 *)ptr);
- case 8: return READ_ONCE(*(const u64 *)ptr);
+ case 1: return *(const volatile u8 *)ptr;
+ case 2: return *(const volatile u16 *)ptr;
+ case 4: return *(const volatile u32 *)ptr;
+ case 8: return *(const volatile u64 *)ptr;
default: return 0; /* Ignore; we do not diff the values. */
}
}
--
2.40.0.rc2
The patch titled
Subject: mm: kfence: fix PG_slab and memcg_data clearing
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-kfence-fix-pg_slab-and-memcg_data-clearing.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Muchun Song <songmuchun(a)bytedance.com>
Subject: mm: kfence: fix PG_slab and memcg_data clearing
Date: Mon, 20 Mar 2023 11:00:59 +0800
It does not reset PG_slab and memcg_data when KFENCE fails to initialize
kfence pool at runtime. It is reporting a "Bad page state" message when
kfence pool is freed to buddy. The checking of whether it is a compound
head page seems unnecessary sicne we already guarantee this when
allocating kfence pool, removing the check to simplify the code.
Link: https://lkml.kernel.org/r/20230320030059.20189-1-songmuchun@bytedance.com
Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Fixes: 8f0b36497303 ("mm: kfence: fix objcgs vector allocation")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: Jann Horn <jannh(a)google.com>
Cc: Marco Elver <elver(a)google.com>
Cc: Roman Gushchin <roman.gushchin(a)linux.dev>
Cc: SeongJae Park <sjpark(a)amazon.de>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/kfence/core.c~mm-kfence-fix-pg_slab-and-memcg_data-clearing
+++ a/mm/kfence/core.c
@@ -561,10 +561,6 @@ static unsigned long kfence_init_pool(vo
if (!i || (i % 2))
continue;
- /* Verify we do not have a compound head page. */
- if (WARN_ON(compound_head(&pages[i]) != &pages[i]))
- return addr;
-
__folio_set_slab(slab_folio(slab));
#ifdef CONFIG_MEMCG
slab->memcg_data = (unsigned long)&kfence_metadata[i / 2 - 1].objcg |
@@ -597,12 +593,26 @@ static unsigned long kfence_init_pool(vo
/* Protect the right redzone. */
if (unlikely(!kfence_protect(addr + PAGE_SIZE)))
- return addr;
+ goto reset_slab;
addr += 2 * PAGE_SIZE;
}
return 0;
+
+reset_slab:
+ for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) {
+ struct slab *slab = page_slab(&pages[i]);
+
+ if (!i || (i % 2))
+ continue;
+#ifdef CONFIG_MEMCG
+ slab->memcg_data = 0;
+#endif
+ __folio_clear_slab(slab_folio(slab));
+ }
+
+ return addr;
}
static bool __init kfence_init_pool_early(void)
@@ -632,16 +642,6 @@ static bool __init kfence_init_pool_earl
* fails for the first page, and therefore expect addr==__kfence_pool in
* most failure cases.
*/
- for (char *p = (char *)addr; p < __kfence_pool + KFENCE_POOL_SIZE; p += PAGE_SIZE) {
- struct slab *slab = virt_to_slab(p);
-
- if (!slab)
- continue;
-#ifdef CONFIG_MEMCG
- slab->memcg_data = 0;
-#endif
- __folio_clear_slab(slab_folio(slab));
- }
memblock_free_late(__pa(addr), KFENCE_POOL_SIZE - (addr - (unsigned long)__kfence_pool));
__kfence_pool = NULL;
return false;
_
Patches currently in -mm which might be from songmuchun(a)bytedance.com are
mm-kfence-fix-using-kfence_metadata-without-initialization-in-show_object.patch
mm-kfence-fix-pg_slab-and-memcg_data-clearing.patch
mm-hugetlb_vmemmap-simplify-hugetlb_vmemmap_init-a-bit.patch
In verity_end_io(), if bi_status is not BLK_STS_OK, it can be return
directly. But if FEC configured, it is desired to correct the data page
through verity_verify_io. And the return value will be converted to
blk_status and passed to verity_finish_io().
BTW, when a bit is set in v->validated_blocks, verity_verify_io() skips
verification regardless of I/O error for the corresponding bio. In this
case, the I/O error could not be returned properly, and as a result,
there is a problem that abnormal data could be read for the
corresponding block.
To fix this problem, when an I/O error occurs, do not skip verification
even if the bit related is set in v->validated_blocks.
Fixes: 843f38d382b1 ("dm verity: add 'check_at_most_once' option to only validate hashes once")
Cc: stable(a)vger.kernel.org
Reviewed-by: Sungjong Seo <sj1557.seo(a)samsung.com>
Signed-off-by: Yeongjin Gil <youngjin.gil(a)samsung.com>
---
v2:
-change commit message and tag
---
drivers/md/dm-verity-target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index ade83ef3b439..9316399b920e 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -523,7 +523,7 @@ static int verity_verify_io(struct dm_verity_io *io)
sector_t cur_block = io->block + b;
struct ahash_request *req = verity_io_hash_req(v, io);
- if (v->validated_blocks &&
+ if (v->validated_blocks && bio->bi_status == BLK_STS_OK &&
likely(test_bit(cur_block, v->validated_blocks))) {
verity_bv_skip_block(v, io, iter);
continue;
--
2.40.0
Fix SUPERH builds that select SYS_SUPPORTS_NUMA but do not select
SYS_SUPPORTS_SMP and SMP.
kernel/sched/topology.c is only built for CONFIG_SMP and then the NUMA
code + data inside topology.c is only built when CONFIG_NUMA is
set/enabled, so these arch/sh/ configs need to select SMP and
SYS_SUPPORTS_SMP to build the NUMA support.
Fixes this build error in multiple SUPERH configs:
mm/page_alloc.o: In function `get_page_from_freelist':
page_alloc.c:(.text+0x2ca8): undefined reference to `node_reclaim_distance'
Fixes: 357d59469c11 ("sh: Tidy up dependencies for SH-2 build.")
Fixes: 9109a30e5a54 ("sh: add support for sh7366 processor")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Reported-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Rich Felker <dalias(a)libc.org>
Cc: linux-sh(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
---
v2: skipped
v3: skipped
v4: refresh & resend
arch/sh/Kconfig | 4 ++++
1 file changed, 4 insertions(+)
diff -- a/arch/sh/Kconfig b/arch/sh/Kconfig
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -477,6 +477,8 @@ config CPU_SUBTYPE_SH7722
select CPU_SHX2
select ARCH_SHMOBILE
select ARCH_SPARSEMEM_ENABLE
+ select SYS_SUPPORTS_SMP
+ select SMP
select SYS_SUPPORTS_NUMA
select SYS_SUPPORTS_SH_CMT
select PINCTRL
@@ -487,6 +489,8 @@ config CPU_SUBTYPE_SH7366
select CPU_SHX2
select ARCH_SHMOBILE
select ARCH_SPARSEMEM_ENABLE
+ select SYS_SUPPORTS_SMP
+ select SMP
select SYS_SUPPORTS_NUMA
select SYS_SUPPORTS_SH_CMT
Fix a build error in mcount.S when CONFIG_PRINTK is not enabled.
Fixes this build error:
sh2-linux-ld: arch/sh/lib/mcount.o: in function `stack_panic':
(.text+0xec): undefined reference to `dump_stack'
Fixes: e460ab27b6c3 ("sh: Fix up stack overflow check with ftrace disabled.")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Rich Felker <dalias(a)libc.org>
Suggested-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: stable(a)vger.kernel.org
---
v2: add PRINTK to STACK_DEBUG dependency (thanks, Geert)
v3: skipped
v4: refresh & resend
arch/sh/Kconfig.debug | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -- a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -15,7 +15,7 @@ config SH_STANDARD_BIOS
config STACK_DEBUG
bool "Check for stack overflows"
- depends on DEBUG_KERNEL
+ depends on DEBUG_KERNEL && PRINTK
help
This option will cause messages to be printed if free stack space
drops below a certain limit. Saying Y here will add overhead to
A mail was sent to you sometime last week with the expectation of
having a return mail from you but to my surprise you never bothered to replied.
Kindly reply for further explanations.
Respectfully yours,
Barrister. Douglas Felix.
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x b6985b9b82954caa53f862d6059d06c0526254f0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167930928916599(a)kroah.com' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
b6985b9b8295 ("mptcp: use the workqueue to destroy unaccepted sockets")
7d803344fdc3 ("mptcp: fix deadlock in fastopen error path")
f2bb566f5c97 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b6985b9b82954caa53f862d6059d06c0526254f0 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni(a)redhat.com>
Date: Thu, 9 Mar 2023 15:49:59 +0100
Subject: [PATCH] mptcp: use the workqueue to destroy unaccepted sockets
Christoph reported a UaF at token lookup time after having
refactored the passive socket initialization part:
BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260
Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198
CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6e/0x91
print_report+0x16a/0x46f
kasan_report+0xad/0x130
__token_bucket_busy+0x253/0x260
mptcp_token_new_connect+0x13d/0x490
mptcp_connect+0x4ed/0x860
__inet_stream_connect+0x80e/0xd90
tcp_sendmsg_fastopen+0x3ce/0x710
mptcp_sendmsg+0xff1/0x1a20
inet_sendmsg+0x11d/0x140
__sys_sendto+0x405/0x490
__x64_sys_sendto+0xdc/0x1b0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
We need to properly clean-up all the paired MPTCP-level
resources and be sure to release the msk last, even when
the unaccepted subflow is destroyed by the TCP internals
via inet_child_forget().
We can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra,
explicitly checking that for the critical scenario: the
closed subflow is the MPC one, the msk is not accepted and
eventually going through full cleanup.
With such change, __mptcp_destroy_sock() is always called
on msk sockets, even on accepted ones. We don't need anymore
to transiently drop one sk reference at msk clone time.
Please note this commit depends on the parent one:
mptcp: refactor passive socket initialization
Fixes: 58b09919626b ("mptcp: create msk early")
Cc: stable(a)vger.kernel.org
Reported-and-tested-by: Christoph Paasch <cpaasch(a)apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/347
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 447641d34c2c..2a2093d61835 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2342,7 +2342,6 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
goto out;
}
- sock_orphan(ssk);
subflow->disposable = 1;
/* if ssk hit tcp_done(), tcp_cleanup_ulp() cleared the related ops
@@ -2350,7 +2349,20 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
* reference owned by msk;
*/
if (!inet_csk(ssk)->icsk_ulp_ops) {
+ WARN_ON_ONCE(!sock_flag(ssk, SOCK_DEAD));
kfree_rcu(subflow, rcu);
+ } else if (msk->in_accept_queue && msk->first == ssk) {
+ /* if the first subflow moved to a close state, e.g. due to
+ * incoming reset and we reach here before inet_child_forget()
+ * the TCP stack could later try to close it via
+ * inet_csk_listen_stop(), or deliver it to the user space via
+ * accept().
+ * We can't delete the subflow - or risk a double free - nor let
+ * the msk survive - or will be leaked in the non accept scenario:
+ * fallback and let TCP cope with the subflow cleanup.
+ */
+ WARN_ON_ONCE(sock_flag(ssk, SOCK_DEAD));
+ mptcp_subflow_drop_ctx(ssk);
} else {
/* otherwise tcp will dispose of the ssk and subflow ctx */
if (ssk->sk_state == TCP_LISTEN) {
@@ -2398,9 +2410,10 @@ static unsigned int mptcp_sync_mss(struct sock *sk, u32 pmtu)
return 0;
}
-static void __mptcp_close_subflow(struct mptcp_sock *msk)
+static void __mptcp_close_subflow(struct sock *sk)
{
struct mptcp_subflow_context *subflow, *tmp;
+ struct mptcp_sock *msk = mptcp_sk(sk);
might_sleep();
@@ -2414,7 +2427,15 @@ static void __mptcp_close_subflow(struct mptcp_sock *msk)
if (!skb_queue_empty_lockless(&ssk->sk_receive_queue))
continue;
- mptcp_close_ssk((struct sock *)msk, ssk, subflow);
+ mptcp_close_ssk(sk, ssk, subflow);
+ }
+
+ /* if the MPC subflow has been closed before the msk is accepted,
+ * msk will never be accept-ed, close it now
+ */
+ if (!msk->first && msk->in_accept_queue) {
+ sock_set_flag(sk, SOCK_DEAD);
+ inet_sk_state_store(sk, TCP_CLOSE);
}
}
@@ -2623,6 +2644,9 @@ static void mptcp_worker(struct work_struct *work)
__mptcp_check_send_data_fin(sk);
mptcp_check_data_fin(sk);
+ if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
+ __mptcp_close_subflow(sk);
+
/* There is no point in keeping around an orphaned sk timedout or
* closed, but we need the msk around to reply to incoming DATA_FIN,
* even if it is orphaned and in FIN_WAIT2 state
@@ -2638,9 +2662,6 @@ static void mptcp_worker(struct work_struct *work)
}
}
- if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
- __mptcp_close_subflow(msk);
-
if (test_and_clear_bit(MPTCP_WORK_RTX, &msk->flags))
__mptcp_retrans(sk);
@@ -3078,6 +3099,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
msk->local_key = subflow_req->local_key;
msk->token = subflow_req->token;
msk->subflow = NULL;
+ msk->in_accept_queue = 1;
WRITE_ONCE(msk->fully_established, false);
if (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD)
WRITE_ONCE(msk->csum_enabled, true);
@@ -3095,8 +3117,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
security_inet_csk_clone(nsk, req);
bh_unlock_sock(nsk);
- /* keep a single reference */
- __sock_put(nsk);
+ /* note: the newly allocated socket refcount is 2 now */
return nsk;
}
@@ -3152,8 +3173,6 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
goto out;
}
- /* acquire the 2nd reference for the owning socket */
- sock_hold(new_mptcp_sock);
newsk = new_mptcp_sock;
MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPCAPABLEPASSIVEACK);
} else {
@@ -3704,6 +3723,7 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
struct sock *newsk = newsock->sk;
set_bit(SOCK_CUSTOM_SOCKOPT, &newsock->flags);
+ msk->in_accept_queue = 0;
lock_sock(newsk);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 61fd8eabfca2..3a2db1b862dd 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -295,7 +295,8 @@ struct mptcp_sock {
u8 recvmsg_inq:1,
cork:1,
nodelay:1,
- fastopening:1;
+ fastopening:1,
+ in_accept_queue:1;
int connect_flags;
struct work_struct work;
struct sk_buff *ooo_last_skb;
@@ -666,6 +667,8 @@ void mptcp_subflow_set_active(struct mptcp_subflow_context *subflow);
bool mptcp_subflow_active(struct mptcp_subflow_context *subflow);
+void mptcp_subflow_drop_ctx(struct sock *ssk);
+
static inline void mptcp_subflow_tcp_fallback(struct sock *sk,
struct mptcp_subflow_context *ctx)
{
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index a631a5e6fc7b..932a3e0eb22d 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -699,9 +699,10 @@ static bool subflow_hmac_valid(const struct request_sock *req,
static void mptcp_force_close(struct sock *sk)
{
- /* the msk is not yet exposed to user-space */
+ /* the msk is not yet exposed to user-space, and refcount is 2 */
inet_sk_state_store(sk, TCP_CLOSE);
sk_common_release(sk);
+ sock_put(sk);
}
static void subflow_ulp_fallback(struct sock *sk,
@@ -717,7 +718,7 @@ static void subflow_ulp_fallback(struct sock *sk,
mptcp_subflow_ops_undo_override(sk);
}
-static void subflow_drop_ctx(struct sock *ssk)
+void mptcp_subflow_drop_ctx(struct sock *ssk)
{
struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(ssk);
@@ -823,7 +824,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
if (new_msk)
mptcp_copy_inaddrs(new_msk, child);
- subflow_drop_ctx(child);
+ mptcp_subflow_drop_ctx(child);
goto out;
}
@@ -914,7 +915,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
return child;
dispose_child:
- subflow_drop_ctx(child);
+ mptcp_subflow_drop_ctx(child);
tcp_rsk(req)->drop_req = true;
inet_csk_prepare_for_destroy_sock(child);
tcp_done(child);
@@ -1866,7 +1867,6 @@ void mptcp_subflow_queue_clean(struct sock *listener_sk, struct sock *listener_s
struct sock *sk = (struct sock *)msk;
bool do_cancel_work;
- sock_hold(sk);
lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
next = msk->dl_next;
msk->first = NULL;
@@ -1954,6 +1954,13 @@ static void subflow_ulp_release(struct sock *ssk)
* when the subflow is still unaccepted
*/
release = ctx->disposable || list_empty(&ctx->node);
+
+ /* inet_child_forget() does not call sk_state_change(),
+ * explicitly trigger the socket close machinery
+ */
+ if (!release && !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW,
+ &mptcp_sk(sk)->flags))
+ mptcp_schedule_work(sk);
sock_put(sk);
}
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.
Signed-off-by: Lee Jones <lee(a)kernel.org>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[Lee: Backported to v4.9.y]
Signed-off-by: Lee Jones <lee(a)kernel.org>
---
drivers/hid/hid-core.c | 18 +++++++++++++-----
include/linux/hid.h | 3 +++
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index c5207ed5d65b1..b9e6c51173571 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -246,6 +246,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
unsigned usages;
unsigned offset;
unsigned i;
+ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
report = hid_register_report(parser->device, report_type, parser->global.report_id);
if (!report) {
@@ -269,8 +270,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
offset = report->size;
report->size += parser->global.report_size * parser->global.report_count;
+ if (parser->device->ll_driver->max_buffer_size)
+ max_buffer_size = parser->device->ll_driver->max_buffer_size;
+
/* Total size check: Allow for possible report index byte */
- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
+ if (report->size > (max_buffer_size - 1) << 3) {
hid_err(parser->device, "report is too long\n");
return -1;
}
@@ -1548,6 +1552,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int a;
u32 rsize, csize = size;
u8 *cdata = data;
@@ -1564,10 +1569,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
rsize = hid_compute_report_size(report);
- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE - 1;
- else if (rsize > HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE;
+ if (hid->ll_driver->max_buffer_size)
+ max_buffer_size = hid->ll_driver->max_buffer_size;
+
+ if (report_enum->numbered && rsize >= max_buffer_size)
+ rsize = max_buffer_size - 1;
+ else if (rsize > max_buffer_size)
+ rsize = max_buffer_size;
if (csize < rsize) {
dbg_hid("report %d is too short, (%d < %d)\n", report->id,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index a07fa623fd0c2..be12e7d14c4a1 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -736,6 +736,7 @@ struct hid_driver {
* @raw_request: send raw report request to device (e.g. feature report)
* @output_report: send output report to device
* @idle: send idle request to device
+ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE)
*/
struct hid_ll_driver {
int (*start)(struct hid_device *hdev);
@@ -760,6 +761,8 @@ struct hid_ll_driver {
int (*output_report) (struct hid_device *hdev, __u8 *buf, size_t len);
int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype);
+
+ unsigned int max_buffer_size;
};
extern struct hid_ll_driver i2c_hid_ll_driver;
--
2.40.0.rc1.284.g88254d51c5-goog
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 5da28edd7bd5518f97175ecea77615bb729a7a28
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167931300423217(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
5da28edd7bd5 ("io_uring/msg_ring: let target know allocated index")
172113101641 ("io_uring: extract a io_msg_install_complete helper")
11373026f296 ("io_uring: get rid of double locking")
b529c96a896b ("io_uring: remove overflow param from io_post_aux_cqe")
a77ab745f28d ("io_uring: make io_fill_cqe_aux static")
9b8c54755a2b ("io_uring: add io_aux_cqe which allows deferred completion")
931147ddfa6e ("io_uring: allow defer completion for aux posted cqes")
1bec951c3809 ("io_uring: iopoll protect complete_post")
fa18fa2272c7 ("io_uring: inline __io_req_complete_put()")
f9d567c75ec2 ("io_uring: inline __io_req_complete_post()")
e2ad599d1ed3 ("io_uring: allow multishot recv CQEs to overflow")
515e26961295 ("io_uring: revert "io_uring fix multishot accept ordering"")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5da28edd7bd5518f97175ecea77615bb729a7a28 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence(a)gmail.com>
Date: Thu, 16 Mar 2023 12:11:42 +0000
Subject: [PATCH] io_uring/msg_ring: let target know allocated index
msg_ring requests transferring files support auto index selection via
IORING_FILE_INDEX_ALLOC, however they don't return the selected index
to the target ring and there is no other good way for the userspace to
know where is the receieved file.
Return the index for allocated slots and 0 otherwise, which is
consistent with other fixed file installing requests.
Cc: stable(a)vger.kernel.org # v6.0+
Fixes: e6130eba8a848 ("io_uring: add support for passing fixed file descriptors")
Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com>
Link: https://github.com/axboe/liburing/issues/809
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/io_uring/msg_ring.c b/io_uring/msg_ring.c
index 8803c0979e2a..85fd7ce5f05b 100644
--- a/io_uring/msg_ring.c
+++ b/io_uring/msg_ring.c
@@ -202,7 +202,7 @@ static int io_msg_install_complete(struct io_kiocb *req, unsigned int issue_flag
* completes with -EOVERFLOW, then the sender must ensure that a
* later IORING_OP_MSG_RING delivers the message.
*/
- if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0))
+ if (!io_post_aux_cqe(target_ctx, msg->user_data, ret, 0))
ret = -EOVERFLOW;
out_unlock:
io_double_unlock_ctx(target_ctx);
@@ -229,6 +229,8 @@ static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags)
struct io_ring_ctx *ctx = req->ctx;
struct file *src_file = msg->src_file;
+ if (msg->len)
+ return -EINVAL;
if (target_ctx == ctx)
return -EINVAL;
if (target_ctx->flags & IORING_SETUP_R_DISABLED)
Greg,
Following backports catch up with recent 5.15.y xfs backports.
Patches 1-3 are the backports from the previous 5.15 xfs backports
round that Chandan requested for 5.4 [1].
Patches 4-14 are the SGID fixes that I collaborated with Leah [2].
Christian has reviewed the backports of his vfs patches to 5.10.
Patch 15 is a fix for a build warning caused by one of the SGID fixes
that you applied to 5.15.y.
This series has gone through the usual xfs test/review routine.
Thanks,
Amir.
[1] https://lore.kernel.org/linux-xfs/874jrtzlgp.fsf@debian-BULLSEYE-live-build…
[2] https://lore.kernel.org/linux-xfs/20230307185922.125907-1-leah.rumancik@gma…
Amir Goldstein (4):
attr: add in_group_or_capable()
fs: move should_remove_suid()
attr: add setattr_should_drop_sgid()
attr: use consistent sgid stripping checks
Christian Brauner (1):
fs: use consistent setgid checks in is_sxid()
Darrick J. Wong (3):
xfs: purge dquots after inode walk fails during quotacheck
xfs: don't leak btree cursor when insrec fails after a split
xfs: use setattr_copy to set vfs inode attributes
Dave Chinner (4):
xfs: don't assert fail on perag references on teardown
xfs: remove XFS_PREALLOC_SYNC
xfs: fallocate() should call file_modified()
xfs: set prealloc flag in xfs_alloc_file_space()
Gaosheng Cui (1):
xfs: remove xfs_setattr_time() declaration
Yang Xu (2):
fs: add mode_strip_sgid() helper
fs: move S_ISGID stripping into the vfs_*() helpers
Documentation/trace/ftrace.rst | 2 +-
fs/attr.c | 70 ++++++++++++++++++++++++++---
fs/inode.c | 80 +++++++++++++++++++---------------
fs/internal.h | 6 +++
fs/namei.c | 80 ++++++++++++++++++++++++++++------
fs/ocfs2/file.c | 4 +-
fs/ocfs2/namei.c | 1 +
fs/open.c | 6 +--
fs/xfs/libxfs/xfs_btree.c | 8 ++--
fs/xfs/xfs_bmap_util.c | 9 ++--
fs/xfs/xfs_file.c | 24 +++++-----
fs/xfs/xfs_iops.c | 56 ++----------------------
fs/xfs/xfs_iops.h | 1 -
fs/xfs/xfs_mount.c | 3 +-
fs/xfs/xfs_pnfs.c | 9 ++--
fs/xfs/xfs_qm.c | 9 +++-
include/linux/fs.h | 5 ++-
17 files changed, 229 insertions(+), 144 deletions(-)
--
2.34.1
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '16793039081369(a)kroah.com' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
a52e5cdbe801 ("s390/ipl: add missing intersection check to ipl_report handling")
84733284f67b ("s390/boot: introduce boot data 'initrd_data'")
9f744abb4639 ("s390/boot: replace magic string check with a bootdata flag")
73045a08cf55 ("s390: unify identity mapping limits handling")
d7e7fbba67a3 ("s390/early: rewrite program parameter setup in C")
0c4ec024a481 ("s390/kasan: move memory needs estimation into a function")
92bca2fe61f5 ("s390/kasan: avoid confusing naming")
90178c190079 ("s390/mm: let vmalloc area size depend on physical memory size")
a3453d923ece ("s390/kasan: remove 3-level paging support")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9 Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens(a)linux.ibm.com>
Date: Tue, 7 Mar 2023 14:35:23 +0100
Subject: [PATCH] s390/ipl: add missing intersection check to ipl_report
handling
The code which handles the ipl report is searching for a free location
in memory where it could copy the component and certificate entries to.
It checks for intersection between the sections required for the kernel
and the component/certificate data area, but fails to check whether
the data structures linking these data areas together intersect.
This might cause the iplreport copy code to overwrite the iplreport
itself. Fix this by adding two addtional intersection checks.
Cc: <stable(a)vger.kernel.org>
Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot")
Signed-off-by: Sven Schnelle <svens(a)linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor(a)linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor(a)linux.ibm.com>
diff --git a/arch/s390/boot/ipl_report.c b/arch/s390/boot/ipl_report.c
index 9b14045065b6..74b5cd264862 100644
--- a/arch/s390/boot/ipl_report.c
+++ b/arch/s390/boot/ipl_report.c
@@ -57,11 +57,19 @@ static unsigned long find_bootdata_space(struct ipl_rb_components *comps,
if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size &&
intersects(initrd_data.start, initrd_data.size, safe_addr, size))
safe_addr = initrd_data.start + initrd_data.size;
+ if (intersects(safe_addr, size, (unsigned long)comps, comps->len)) {
+ safe_addr = (unsigned long)comps + comps->len;
+ goto repeat;
+ }
for_each_rb_entry(comp, comps)
if (intersects(safe_addr, size, comp->addr, comp->len)) {
safe_addr = comp->addr + comp->len;
goto repeat;
}
+ if (intersects(safe_addr, size, (unsigned long)certs, certs->len)) {
+ safe_addr = (unsigned long)certs + certs->len;
+ goto repeat;
+ }
for_each_rb_entry(cert, certs)
if (intersects(safe_addr, size, cert->addr, cert->len)) {
safe_addr = cert->addr + cert->len;
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x e0e6b416b25ee14716f3549e0cbec1011b193809
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679307444199182(a)kroah.com' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
e0e6b416b25e ("drm/i915/active: Fix misuse of non-idle barriers as fence trackers")
ad5c99e02047 ("drm/i915: Remove unused bits of i915_vma/active api")
f6c466b84cfa ("drm/i915: Add support for moving fence waiting")
544460c33821 ("drm/i915: Multi-BB execbuf")
5851387a422c ("drm/i915/guc: Implement no mid batch preemption for multi-lrc")
e5e32171a2cf ("drm/i915/guc: Connect UAPI to GuC multi-lrc interface")
d38a9294491d ("drm/i915/guc: Update debugfs for GuC multi-lrc")
bc955204919e ("drm/i915/guc: Insert submit fences between requests in parent-child relationship")
6b540bf6f143 ("drm/i915/guc: Implement multi-lrc submission")
99b47aaddfa9 ("drm/i915/guc: Implement parallel context pin / unpin functions")
c2aa552ff09d ("drm/i915/guc: Add multi-lrc context registration")
3897df4c0187 ("drm/i915/guc: Introduce context parent-child relationship")
4f3059dc2dbb ("drm/i915: Add logical engine mapping")
1a52faed3131 ("drm/i915/guc: Take GT PM ref when deregistering context")
0ea92ace8b95 ("drm/i915/guc: Move GuC guc_id allocation under submission state sub-struct")
0d8ee5ba8db4 ("drm/i915: Don't back up pinned LMEM context images and rings during suspend")
c56ce9565374 ("drm/i915 Implement LMEM backup and restore for suspend / resume")
0d9388635a22 ("drm/i915/ttm: Implement a function to copy the contents of two TTM-based objects")
68c03c0e985e ("drm/i915/debugfs: Do not report currently active engine when describing objects")
48b096126954 ("drm/i915: Move __i915_gem_free_object to ttm_bo_destroy")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e0e6b416b25ee14716f3549e0cbec1011b193809 Mon Sep 17 00:00:00 2001
From: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
Date: Thu, 2 Mar 2023 13:08:20 +0100
Subject: [PATCH] drm/i915/active: Fix misuse of non-idle barriers as fence
trackers
Users reported oopses on list corruptions when using i915 perf with a
number of concurrently running graphics applications. Root cause analysis
pointed at an issue in barrier processing code -- a race among perf open /
close replacing active barriers with perf requests on kernel context and
concurrent barrier preallocate / acquire operations performed during user
context first pin / last unpin.
When adding a request to a composite tracker, we try to reuse an existing
fence tracker, already allocated and registered with that composite. The
tracker we obtain may already track another fence, may be an idle barrier,
or an active barrier.
If the tracker we get occurs a non-idle barrier then we try to delete that
barrier from a list of barrier tasks it belongs to. However, while doing
that we don't respect return value from a function that performs the
barrier deletion. Should the deletion ever fail, we would end up reusing
the tracker still registered as a barrier task. Since the same structure
field is reused with both fence callback lists and barrier tasks list,
list corruptions would likely occur.
Barriers are now deleted from a barrier tasks list by temporarily removing
the list content, traversing that content with skip over the node to be
deleted, then populating the list back with the modified content. Should
that intentionally racy concurrent deletion attempts be not serialized,
one or more of those may fail because of the list being temporary empty.
Related code that ignores the results of barrier deletion was initially
introduced in v5.4 by commit d8af05ff38ae ("drm/i915: Allow sharing the
idle-barrier from other kernel requests"). However, all users of the
barrier deletion routine were apparently serialized at that time, then the
issue didn't exhibit itself. Results of git bisect with help of a newly
developed igt@gem_barrier_race@remote-request IGT test indicate that list
corruptions might start to appear after commit 311770173fac ("drm/i915/gt:
Schedule request retirement when timeline idles"), introduced in v5.5.
Respect results of barrier deletion attempts -- mark the barrier as idle
only if successfully deleted from the list. Then, before proceeding with
setting our fence as the one currently tracked, make sure that the tracker
we've got is not a non-idle barrier. If that check fails then don't use
that tracker but go back and try to acquire a new, usable one.
v3: use unlikely() to document what outcome we expect (Andi),
- fix bad grammar in commit description.
v2: no code changes,
- blame commit 311770173fac ("drm/i915/gt: Schedule request retirement
when timeline idles"), v5.5, not commit d8af05ff38ae ("drm/i915: Allow
sharing the idle-barrier from other kernel requests"), v5.4,
- reword commit description.
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6333
Fixes: 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles")
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: stable(a)vger.kernel.org # v5.5
Cc: Andi Shyti <andi.shyti(a)linux.intel.com>
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230302120820.48740-1-janusz…
(cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
index 7412abf166a8..a9fea115f2d2 100644
--- a/drivers/gpu/drm/i915/i915_active.c
+++ b/drivers/gpu/drm/i915/i915_active.c
@@ -422,12 +422,12 @@ replace_barrier(struct i915_active *ref, struct i915_active_fence *active)
* we can use it to substitute for the pending idle-barrer
* request that we want to emit on the kernel_context.
*/
- __active_del_barrier(ref, node_from_active(active));
- return true;
+ return __active_del_barrier(ref, node_from_active(active));
}
int i915_active_add_request(struct i915_active *ref, struct i915_request *rq)
{
+ u64 idx = i915_request_timeline(rq)->fence_context;
struct dma_fence *fence = &rq->fence;
struct i915_active_fence *active;
int err;
@@ -437,16 +437,19 @@ int i915_active_add_request(struct i915_active *ref, struct i915_request *rq)
if (err)
return err;
- active = active_instance(ref, i915_request_timeline(rq)->fence_context);
- if (!active) {
- err = -ENOMEM;
- goto out;
- }
+ do {
+ active = active_instance(ref, idx);
+ if (!active) {
+ err = -ENOMEM;
+ goto out;
+ }
+
+ if (replace_barrier(ref, active)) {
+ RCU_INIT_POINTER(active->fence, NULL);
+ atomic_dec(&ref->count);
+ }
+ } while (unlikely(is_barrier(active)));
- if (replace_barrier(ref, active)) {
- RCU_INIT_POINTER(active->fence, NULL);
- atomic_dec(&ref->count);
- }
if (!__i915_active_fence_set(active, fence))
__i915_active_acquire(ref);
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 85636167e3206c3fbd52254fc432991cc4e90194
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167820543971229(a)kroah.com' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
85636167e320 ("drm/i915: Don't use BAR mappings for ring buffers with LLC")
fa85bfd19c26 ("drm/i915: Update the helper to set correct mapping")
e09e903a6e89 ("drm/i915/selftests: Prepare execlists and lrc selftests for obj->mm.lock removal")
17b7ab92bec3 ("drm/i915/selftests: Prepare hangcheck for obj->mm.lock removal")
d3ad29567d4e ("drm/i915/selftests: Prepare context selftest for obj->mm.lock removal")
c858ffa17716 ("drm/i915: Lock ww in ucode objects correctly")
c05258889ed4 ("drm/i915: Add igt_spinner_pin() to allow for ww locking around spinner.")
6895649bf13f ("drm/i915/selftests: Set error returns")
a0d3fdb628b8 ("drm/i915/gt: Split logical ring contexts from execlist submission")
d0d829e56674 ("drm/i915: split gen8+ flush and bb_start emission functions")
70a2b431c364 ("drm/i915/gt: Rename lrc.c to execlists_submission.c")
d33fcd798cb7 ("drm/i915/gt: Ignore dt==0 for reporting underflows")
09212e81e545 ("drm/i915/gt: Flush xcs before tgl breadcrumbs")
c10f6019d0b2 ("drm/i915/gt: Use the local HWSP offset during submission")
89db95377be4 ("drm/i915/gt: Confirm the context survives execution")
052e04f17056 ("drm/i915/selftests: Fix locking inversion in lrc selftest.")
47b086934f42 ("drm/i915: Make sure execbuffer always passes ww state to i915_vma_pin.")
3999a7087989 ("drm/i915: Rework intel_context pinning to do everything outside of pin_mutex")
2bf541ff6d06 ("drm/i915: Pin engine before pinning all objects, v5.")
b49a7d51c32e ("drm/i915: Nuke arguments to eb_pin_engine")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 85636167e3206c3fbd52254fc432991cc4e90194 Mon Sep 17 00:00:00 2001
From: John Harrison <John.C.Harrison(a)Intel.com>
Date: Wed, 15 Feb 2023 17:11:01 -0800
Subject: [PATCH] drm/i915: Don't use BAR mappings for ring buffers with LLC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Direction from hardware is that ring buffers should never be mapped
via the BAR on systems with LLC. There are too many caching pitfalls
due to the way BAR accesses are routed. So it is safest to just not
use it.
Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com>
Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere")
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com>
Cc: intel-gfx(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v4.9+
Tested-by: Jouni Högander <jouni.hogander(a)intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-3-John…
(cherry picked from commit 65c08339db1ada87afd6cfe7db8e60bb4851d919)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c
index fb1d2595392e..fb99143be98e 100644
--- a/drivers/gpu/drm/i915/gt/intel_ring.c
+++ b/drivers/gpu/drm/i915/gt/intel_ring.c
@@ -53,7 +53,7 @@ int intel_ring_pin(struct intel_ring *ring, struct i915_gem_ww_ctx *ww)
if (unlikely(ret))
goto err_unpin;
- if (i915_vma_is_map_and_fenceable(vma)) {
+ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) {
addr = (void __force *)i915_vma_pin_iomap(vma);
} else {
int type = i915_coherent_map_type(vma->vm->i915, vma->obj, false);
@@ -98,7 +98,7 @@ void intel_ring_unpin(struct intel_ring *ring)
return;
i915_vma_unset_ggtt_write(vma);
- if (i915_vma_is_map_and_fenceable(vma))
+ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915))
i915_vma_unpin_iomap(vma);
else
i915_gem_object_unpin_map(vma->obj);
Portion of the fixes were ported in 5.15 but missed some.
This ports the remainder of the fixes.
Based on 5.15.98.
Build tested on x86 with and without uclamp config enabled.
Boot tested on android 5.15 GKI with slight modifications due to other
conflicts there. I need more time to be able to do full functional testing on
5.15 - but since some patches were already taken - posting the remainder now.
Sorry due to job/email change I missed the emails when the other backports were
partially taken.
Qais Yousef (7):
sched/uclamp: Fix fits_capacity() check in feec()
sched/uclamp: Make cpu_overutilized() use util_fits_cpu()
sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early
exit condition
sched/fair: Detect capacity inversion
sched/fair: Consider capacity inversion in util_fits_cpu()
sched/uclamp: Fix a uninitialized variable warnings
sched/fair: Fixes for capacity inversion detection
kernel/sched/core.c | 10 ++--
kernel/sched/fair.c | 128 +++++++++++++++++++++++++++++++++++++------
kernel/sched/sched.h | 61 ++++++++++++++++++++-
3 files changed, 174 insertions(+), 25 deletions(-)
--
2.25.1
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.
Signed-off-by: Lee Jones <lee(a)kernel.org>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[Lee: Backported to v4.14.y]
Signed-off-by: Lee Jones <lee(a)kernel.org>
---
drivers/hid/hid-core.c | 18 +++++++++++++-----
include/linux/hid.h | 3 +++
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index ab78c1e6f37d8..fe3824a6af5c1 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -245,6 +245,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
unsigned usages;
unsigned offset;
unsigned i;
+ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
report = hid_register_report(parser->device, report_type, parser->global.report_id);
if (!report) {
@@ -268,8 +269,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
offset = report->size;
report->size += parser->global.report_size * parser->global.report_count;
+ if (parser->device->ll_driver->max_buffer_size)
+ max_buffer_size = parser->device->ll_driver->max_buffer_size;
+
/* Total size check: Allow for possible report index byte */
- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
+ if (report->size > (max_buffer_size - 1) << 3) {
hid_err(parser->device, "report is too long\n");
return -1;
}
@@ -1568,6 +1572,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int a;
u32 rsize, csize = size;
u8 *cdata = data;
@@ -1584,10 +1589,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
rsize = hid_compute_report_size(report);
- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE - 1;
- else if (rsize > HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE;
+ if (hid->ll_driver->max_buffer_size)
+ max_buffer_size = hid->ll_driver->max_buffer_size;
+
+ if (report_enum->numbered && rsize >= max_buffer_size)
+ rsize = max_buffer_size - 1;
+ else if (rsize > max_buffer_size)
+ rsize = max_buffer_size;
if (csize < rsize) {
dbg_hid("report %d is too short, (%d < %d)\n", report->id,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index f2a1f34f41e8f..b5fcc8b0b7ce1 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -770,6 +770,7 @@ struct hid_driver {
* @raw_request: send raw report request to device (e.g. feature report)
* @output_report: send output report to device
* @idle: send idle request to device
+ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE)
*/
struct hid_ll_driver {
int (*start)(struct hid_device *hdev);
@@ -794,6 +795,8 @@ struct hid_ll_driver {
int (*output_report) (struct hid_device *hdev, __u8 *buf, size_t len);
int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype);
+
+ unsigned int max_buffer_size;
};
extern struct hid_ll_driver i2c_hid_ll_driver;
--
2.40.0.rc1.284.g88254d51c5-goog
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.
Signed-off-by: Lee Jones <lee(a)kernel.org>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[Lee: Backported to v4.19.y]
Signed-off-by: Lee Jones <lee(a)kernel.org>
---
drivers/hid/hid-core.c | 18 +++++++++++++-----
include/linux/hid.h | 3 +++
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8cc79d0d11fb2..c8d687f795caa 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -258,6 +258,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
{
struct hid_report *report;
struct hid_field *field;
+ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int usages;
unsigned int offset;
unsigned int i;
@@ -288,8 +289,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
offset = report->size;
report->size += parser->global.report_size * parser->global.report_count;
+ if (parser->device->ll_driver->max_buffer_size)
+ max_buffer_size = parser->device->ll_driver->max_buffer_size;
+
/* Total size check: Allow for possible report index byte */
- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
+ if (report->size > (max_buffer_size - 1) << 3) {
hid_err(parser->device, "report is too long\n");
return -1;
}
@@ -1567,6 +1571,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int a;
u32 rsize, csize = size;
u8 *cdata = data;
@@ -1583,10 +1588,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
rsize = hid_compute_report_size(report);
- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE - 1;
- else if (rsize > HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE;
+ if (hid->ll_driver->max_buffer_size)
+ max_buffer_size = hid->ll_driver->max_buffer_size;
+
+ if (report_enum->numbered && rsize >= max_buffer_size)
+ rsize = max_buffer_size - 1;
+ else if (rsize > max_buffer_size)
+ rsize = max_buffer_size;
if (csize < rsize) {
dbg_hid("report %d is too short, (%d < %d)\n", report->id,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index c51ebce2197e0..79c6c3b4e0044 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -799,6 +799,7 @@ struct hid_driver {
* @raw_request: send raw report request to device (e.g. feature report)
* @output_report: send output report to device
* @idle: send idle request to device
+ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE)
*/
struct hid_ll_driver {
int (*start)(struct hid_device *hdev);
@@ -823,6 +824,8 @@ struct hid_ll_driver {
int (*output_report) (struct hid_device *hdev, __u8 *buf, size_t len);
int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype);
+
+ unsigned int max_buffer_size;
};
extern struct hid_ll_driver i2c_hid_ll_driver;
--
2.40.0.rc1.284.g88254d51c5-goog
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.
Signed-off-by: Lee Jones <lee(a)kernel.org>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[Lee: Backported to v5.4.y]
Signed-off-by: Lee Jones <lee(a)kernel.org>
---
drivers/hid/hid-core.c | 18 +++++++++++++-----
include/linux/hid.h | 3 +++
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 0c8075d9717cb..8248cdc30e1d3 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -258,6 +258,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
{
struct hid_report *report;
struct hid_field *field;
+ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int usages;
unsigned int offset;
unsigned int i;
@@ -288,8 +289,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
offset = report->size;
report->size += parser->global.report_size * parser->global.report_count;
+ if (parser->device->ll_driver->max_buffer_size)
+ max_buffer_size = parser->device->ll_driver->max_buffer_size;
+
/* Total size check: Allow for possible report index byte */
- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
+ if (report->size > (max_buffer_size - 1) << 3) {
hid_err(parser->device, "report is too long\n");
return -1;
}
@@ -1745,6 +1749,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int a;
u32 rsize, csize = size;
u8 *cdata = data;
@@ -1761,10 +1766,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
rsize = hid_compute_report_size(report);
- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE - 1;
- else if (rsize > HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE;
+ if (hid->ll_driver->max_buffer_size)
+ max_buffer_size = hid->ll_driver->max_buffer_size;
+
+ if (report_enum->numbered && rsize >= max_buffer_size)
+ rsize = max_buffer_size - 1;
+ else if (rsize > max_buffer_size)
+ rsize = max_buffer_size;
if (csize < rsize) {
dbg_hid("report %d is too short, (%d < %d)\n", report->id,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index d5f9bbf8afa51..20266127cf666 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -796,6 +796,7 @@ struct hid_driver {
* @raw_request: send raw report request to device (e.g. feature report)
* @output_report: send output report to device
* @idle: send idle request to device
+ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE)
*/
struct hid_ll_driver {
int (*start)(struct hid_device *hdev);
@@ -820,6 +821,8 @@ struct hid_ll_driver {
int (*output_report) (struct hid_device *hdev, __u8 *buf, size_t len);
int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype);
+
+ unsigned int max_buffer_size;
};
extern struct hid_ll_driver i2c_hid_ll_driver;
--
2.40.0.rc1.284.g88254d51c5-goog
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.
Signed-off-by: Lee Jones <lee(a)kernel.org>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[Lee: Backported to v5.10.y]
Signed-off-by: Lee Jones <lee(a)kernel.org>
---
drivers/hid/hid-core.c | 18 +++++++++++++-----
include/linux/hid.h | 3 +++
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5f9ec1d1464a2..524d6d712e724 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -258,6 +258,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
{
struct hid_report *report;
struct hid_field *field;
+ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int usages;
unsigned int offset;
unsigned int i;
@@ -288,8 +289,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
offset = report->size;
report->size += parser->global.report_size * parser->global.report_count;
+ if (parser->device->ll_driver->max_buffer_size)
+ max_buffer_size = parser->device->ll_driver->max_buffer_size;
+
/* Total size check: Allow for possible report index byte */
- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
+ if (report->size > (max_buffer_size - 1) << 3) {
hid_err(parser->device, "report is too long\n");
return -1;
}
@@ -1752,6 +1756,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int a;
u32 rsize, csize = size;
u8 *cdata = data;
@@ -1768,10 +1773,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
rsize = hid_compute_report_size(report);
- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE - 1;
- else if (rsize > HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE;
+ if (hid->ll_driver->max_buffer_size)
+ max_buffer_size = hid->ll_driver->max_buffer_size;
+
+ if (report_enum->numbered && rsize >= max_buffer_size)
+ rsize = max_buffer_size - 1;
+ else if (rsize > max_buffer_size)
+ rsize = max_buffer_size;
if (csize < rsize) {
dbg_hid("report %d is too short, (%d < %d)\n", report->id,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 2ba33d708942c..256f34f49167c 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -798,6 +798,7 @@ struct hid_driver {
* @raw_request: send raw report request to device (e.g. feature report)
* @output_report: send output report to device
* @idle: send idle request to device
+ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE)
*/
struct hid_ll_driver {
int (*start)(struct hid_device *hdev);
@@ -822,6 +823,8 @@ struct hid_ll_driver {
int (*output_report) (struct hid_device *hdev, __u8 *buf, size_t len);
int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype);
+
+ unsigned int max_buffer_size;
};
extern struct hid_ll_driver i2c_hid_ll_driver;
--
2.40.0.rc1.284.g88254d51c5-goog
commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc upstream.
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This patch introduces a new variable into 'struct hid_ll_driver' where
individual low-level drivers can over-ride the default maximum value of
HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the
interface.
Signed-off-by: Lee Jones <lee(a)kernel.org>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[Lee: Backported to v5.15.y]
Signed-off-by: Lee Jones <lee(a)kernel.org>
---
drivers/hid/hid-core.c | 18 +++++++++++++-----
include/linux/hid.h | 3 +++
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f1ea883db5de1..d941023c56289 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -258,6 +258,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
{
struct hid_report *report;
struct hid_field *field;
+ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int usages;
unsigned int offset;
unsigned int i;
@@ -288,8 +289,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
offset = report->size;
report->size += parser->global.report_size * parser->global.report_count;
+ if (parser->device->ll_driver->max_buffer_size)
+ max_buffer_size = parser->device->ll_driver->max_buffer_size;
+
/* Total size check: Allow for possible report index byte */
- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
+ if (report->size > (max_buffer_size - 1) << 3) {
hid_err(parser->device, "report is too long\n");
return -1;
}
@@ -1752,6 +1756,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
unsigned int a;
u32 rsize, csize = size;
u8 *cdata = data;
@@ -1768,10 +1773,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
rsize = hid_compute_report_size(report);
- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE - 1;
- else if (rsize > HID_MAX_BUFFER_SIZE)
- rsize = HID_MAX_BUFFER_SIZE;
+ if (hid->ll_driver->max_buffer_size)
+ max_buffer_size = hid->ll_driver->max_buffer_size;
+
+ if (report_enum->numbered && rsize >= max_buffer_size)
+ rsize = max_buffer_size - 1;
+ else if (rsize > max_buffer_size)
+ rsize = max_buffer_size;
if (csize < rsize) {
dbg_hid("report %d is too short, (%d < %d)\n", report->id,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 3cfbffd94a058..c3478e396829e 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -805,6 +805,7 @@ struct hid_driver {
* @output_report: send output report to device
* @idle: send idle request to device
* @may_wakeup: return if device may act as a wakeup source during system-suspend
+ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE)
*/
struct hid_ll_driver {
int (*start)(struct hid_device *hdev);
@@ -830,6 +831,8 @@ struct hid_ll_driver {
int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype);
bool (*may_wakeup)(struct hid_device *hdev);
+
+ unsigned int max_buffer_size;
};
extern struct hid_ll_driver i2c_hid_ll_driver;
--
2.40.0.rc1.284.g88254d51c5-goog
This is a note to let you know that I've just added the patch titled
counter: 104-quad-8: Fix Synapse action reported for Index signals
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From 00f4bc5184c19cb33f468f1ea409d70d19f8f502 Mon Sep 17 00:00:00 2001
From: William Breathitt Gray <william.gray(a)linaro.org>
Date: Thu, 16 Mar 2023 16:34:26 -0400
Subject: counter: 104-quad-8: Fix Synapse action reported for Index signals
Signal 16 and higher represent the device's Index lines. The
priv->preset_enable array holds the device configuration for these Index
lines. The preset_enable configuration is active low on the device, so
invert the conditional check in quad8_action_read() to properly handle
the logical state of preset_enable.
Fixes: f1d8a071d45b ("counter: 104-quad-8: Add Generic Counter interface support")
Cc: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20230316203426.224745-1-william.gray@linaro.org/
Signed-off-by: William Breathitt Gray <william.gray(a)linaro.org>
---
drivers/counter/104-quad-8.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c
index d59e4f34a680..d9cb937665cf 100644
--- a/drivers/counter/104-quad-8.c
+++ b/drivers/counter/104-quad-8.c
@@ -368,7 +368,7 @@ static int quad8_action_read(struct counter_device *counter,
/* Handle Index signals */
if (synapse->signal->id >= 16) {
- if (priv->preset_enable[count->id])
+ if (!priv->preset_enable[count->id])
*action = COUNTER_SYNAPSE_ACTION_RISING_EDGE;
else
*action = COUNTER_SYNAPSE_ACTION_NONE;
--
2.40.0
This is a note to let you know that I've just added the patch titled
counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed Mon Sep 17 00:00:00 2001
From: William Breathitt Gray <william.gray(a)linaro.org>
Date: Sun, 12 Mar 2023 19:15:49 -0400
Subject: counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
The Counter (CNTR) register is 24 bits wide, but we can have an
effective 25-bit count value by setting bit 24 to the XOR of the Borrow
flag and Carry flag. The flags can be read from the FLAG register, but a
race condition exists: the Borrow flag and Carry flag are instantaneous
and could change by the time the count value is read from the CNTR
register.
Since the race condition could result in an incorrect 25-bit count
value, remove support for 25-bit count values from this driver;
hard-coded maximum count values are replaced by a LS7267_CNTR_MAX define
for consistency and clarity.
Fixes: 28e5d3bb0325 ("iio: 104-quad-8: Add IIO support for the ACCES 104-QUAD-8")
Cc: <stable(a)vger.kernel.org> # 6.1.x
Cc: <stable(a)vger.kernel.org> # 6.2.x
Link: https://lore.kernel.org/r/20230312231554.134858-1-william.gray@linaro.org/
Signed-off-by: William Breathitt Gray <william.gray(a)linaro.org>
---
drivers/counter/104-quad-8.c | 29 ++++++++---------------------
1 file changed, 8 insertions(+), 21 deletions(-)
diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c
index deed4afadb29..d59e4f34a680 100644
--- a/drivers/counter/104-quad-8.c
+++ b/drivers/counter/104-quad-8.c
@@ -97,10 +97,6 @@ struct quad8 {
struct quad8_reg __iomem *reg;
};
-/* Borrow Toggle flip-flop */
-#define QUAD8_FLAG_BT BIT(0)
-/* Carry Toggle flip-flop */
-#define QUAD8_FLAG_CT BIT(1)
/* Error flag */
#define QUAD8_FLAG_E BIT(4)
/* Up/Down flag */
@@ -133,6 +129,9 @@ struct quad8 {
#define QUAD8_CMR_QUADRATURE_X2 0x10
#define QUAD8_CMR_QUADRATURE_X4 0x18
+/* Each Counter is 24 bits wide */
+#define LS7267_CNTR_MAX GENMASK(23, 0)
+
static int quad8_signal_read(struct counter_device *counter,
struct counter_signal *signal,
enum counter_signal_level *level)
@@ -156,18 +155,10 @@ static int quad8_count_read(struct counter_device *counter,
{
struct quad8 *const priv = counter_priv(counter);
struct channel_reg __iomem *const chan = priv->reg->channel + count->id;
- unsigned int flags;
- unsigned int borrow;
- unsigned int carry;
unsigned long irqflags;
int i;
- flags = ioread8(&chan->control);
- borrow = flags & QUAD8_FLAG_BT;
- carry = !!(flags & QUAD8_FLAG_CT);
-
- /* Borrow XOR Carry effectively doubles count range */
- *val = (unsigned long)(borrow ^ carry) << 24;
+ *val = 0;
spin_lock_irqsave(&priv->lock, irqflags);
@@ -191,8 +182,7 @@ static int quad8_count_write(struct counter_device *counter,
unsigned long irqflags;
int i;
- /* Only 24-bit values are supported */
- if (val > 0xFFFFFF)
+ if (val > LS7267_CNTR_MAX)
return -ERANGE;
spin_lock_irqsave(&priv->lock, irqflags);
@@ -806,8 +796,7 @@ static int quad8_count_preset_write(struct counter_device *counter,
struct quad8 *const priv = counter_priv(counter);
unsigned long irqflags;
- /* Only 24-bit values are supported */
- if (preset > 0xFFFFFF)
+ if (preset > LS7267_CNTR_MAX)
return -ERANGE;
spin_lock_irqsave(&priv->lock, irqflags);
@@ -834,8 +823,7 @@ static int quad8_count_ceiling_read(struct counter_device *counter,
*ceiling = priv->preset[count->id];
break;
default:
- /* By default 0x1FFFFFF (25 bits unsigned) is maximum count */
- *ceiling = 0x1FFFFFF;
+ *ceiling = LS7267_CNTR_MAX;
break;
}
@@ -850,8 +838,7 @@ static int quad8_count_ceiling_write(struct counter_device *counter,
struct quad8 *const priv = counter_priv(counter);
unsigned long irqflags;
- /* Only 24-bit values are supported */
- if (ceiling > 0xFFFFFF)
+ if (ceiling > LS7267_CNTR_MAX)
return -ERANGE;
spin_lock_irqsave(&priv->lock, irqflags);
--
2.40.0
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x 90410bcf873cf05f54a32183afff0161f44f9715
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167931344833141(a)kroah.com' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
90410bcf873c ("ocfs2: fix data corruption after failed write")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 90410bcf873cf05f54a32183afff0161f44f9715 Mon Sep 17 00:00:00 2001
From: Jan Kara via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com>
Date: Thu, 2 Mar 2023 16:38:43 +0100
Subject: [PATCH] ocfs2: fix data corruption after failed write
When buffered write fails to copy data into underlying page cache page,
ocfs2_write_end_nolock() just zeroes out and dirties the page. This can
leave dirty page beyond EOF and if page writeback tries to write this page
before write succeeds and expands i_size, page gets into inconsistent
state where page dirty bit is clear but buffer dirty bits stay set
resulting in page data never getting written and so data copied to the
page is lost. Fix the problem by invalidating page beyond EOF after
failed write.
Link: https://lkml.kernel.org/r/20230302153843.18499-1-jack@suse.cz
Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()")
Signed-off-by: Jan Kara <jack(a)suse.cz>
Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com>
Cc: Mark Fasheh <mark(a)fasheh.com>
Cc: Joel Becker <jlbec(a)evilplan.org>
Cc: Junxiao Bi <junxiao.bi(a)oracle.com>
Cc: Changwei Ge <gechangwei(a)live.cn>
Cc: Gang He <ghe(a)suse.com>
Cc: Jun Piao <piaojun(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 1d65f6ef00ca..0394505fdce3 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1977,11 +1977,26 @@ int ocfs2_write_end_nolock(struct address_space *mapping,
}
if (unlikely(copied < len) && wc->w_target_page) {
+ loff_t new_isize;
+
if (!PageUptodate(wc->w_target_page))
copied = 0;
- ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
- start+len);
+ new_isize = max_t(loff_t, i_size_read(inode), pos + copied);
+ if (new_isize > page_offset(wc->w_target_page))
+ ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
+ start+len);
+ else {
+ /*
+ * When page is fully beyond new isize (data copy
+ * failed), do not bother zeroing the page. Invalidate
+ * it instead so that writeback does not get confused
+ * put page & buffer dirty bits into inconsistent
+ * state.
+ */
+ block_invalidate_folio(page_folio(wc->w_target_page),
+ 0, PAGE_SIZE);
+ }
}
if (wc->w_target_page)
flush_dcache_page(wc->w_target_page);
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 90410bcf873cf05f54a32183afff0161f44f9715
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167931344613222(a)kroah.com' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
90410bcf873c ("ocfs2: fix data corruption after failed write")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 90410bcf873cf05f54a32183afff0161f44f9715 Mon Sep 17 00:00:00 2001
From: Jan Kara via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com>
Date: Thu, 2 Mar 2023 16:38:43 +0100
Subject: [PATCH] ocfs2: fix data corruption after failed write
When buffered write fails to copy data into underlying page cache page,
ocfs2_write_end_nolock() just zeroes out and dirties the page. This can
leave dirty page beyond EOF and if page writeback tries to write this page
before write succeeds and expands i_size, page gets into inconsistent
state where page dirty bit is clear but buffer dirty bits stay set
resulting in page data never getting written and so data copied to the
page is lost. Fix the problem by invalidating page beyond EOF after
failed write.
Link: https://lkml.kernel.org/r/20230302153843.18499-1-jack@suse.cz
Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()")
Signed-off-by: Jan Kara <jack(a)suse.cz>
Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com>
Cc: Mark Fasheh <mark(a)fasheh.com>
Cc: Joel Becker <jlbec(a)evilplan.org>
Cc: Junxiao Bi <junxiao.bi(a)oracle.com>
Cc: Changwei Ge <gechangwei(a)live.cn>
Cc: Gang He <ghe(a)suse.com>
Cc: Jun Piao <piaojun(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 1d65f6ef00ca..0394505fdce3 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1977,11 +1977,26 @@ int ocfs2_write_end_nolock(struct address_space *mapping,
}
if (unlikely(copied < len) && wc->w_target_page) {
+ loff_t new_isize;
+
if (!PageUptodate(wc->w_target_page))
copied = 0;
- ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
- start+len);
+ new_isize = max_t(loff_t, i_size_read(inode), pos + copied);
+ if (new_isize > page_offset(wc->w_target_page))
+ ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
+ start+len);
+ else {
+ /*
+ * When page is fully beyond new isize (data copy
+ * failed), do not bother zeroing the page. Invalidate
+ * it instead so that writeback does not get confused
+ * put page & buffer dirty bits into inconsistent
+ * state.
+ */
+ block_invalidate_folio(page_folio(wc->w_target_page),
+ 0, PAGE_SIZE);
+ }
}
if (wc->w_target_page)
flush_dcache_page(wc->w_target_page);
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 90410bcf873cf05f54a32183afff0161f44f9715
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '16793134449912(a)kroah.com' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
90410bcf873c ("ocfs2: fix data corruption after failed write")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 90410bcf873cf05f54a32183afff0161f44f9715 Mon Sep 17 00:00:00 2001
From: Jan Kara via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com>
Date: Thu, 2 Mar 2023 16:38:43 +0100
Subject: [PATCH] ocfs2: fix data corruption after failed write
When buffered write fails to copy data into underlying page cache page,
ocfs2_write_end_nolock() just zeroes out and dirties the page. This can
leave dirty page beyond EOF and if page writeback tries to write this page
before write succeeds and expands i_size, page gets into inconsistent
state where page dirty bit is clear but buffer dirty bits stay set
resulting in page data never getting written and so data copied to the
page is lost. Fix the problem by invalidating page beyond EOF after
failed write.
Link: https://lkml.kernel.org/r/20230302153843.18499-1-jack@suse.cz
Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()")
Signed-off-by: Jan Kara <jack(a)suse.cz>
Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com>
Cc: Mark Fasheh <mark(a)fasheh.com>
Cc: Joel Becker <jlbec(a)evilplan.org>
Cc: Junxiao Bi <junxiao.bi(a)oracle.com>
Cc: Changwei Ge <gechangwei(a)live.cn>
Cc: Gang He <ghe(a)suse.com>
Cc: Jun Piao <piaojun(a)huawei.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 1d65f6ef00ca..0394505fdce3 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1977,11 +1977,26 @@ int ocfs2_write_end_nolock(struct address_space *mapping,
}
if (unlikely(copied < len) && wc->w_target_page) {
+ loff_t new_isize;
+
if (!PageUptodate(wc->w_target_page))
copied = 0;
- ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
- start+len);
+ new_isize = max_t(loff_t, i_size_read(inode), pos + copied);
+ if (new_isize > page_offset(wc->w_target_page))
+ ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
+ start+len);
+ else {
+ /*
+ * When page is fully beyond new isize (data copy
+ * failed), do not bother zeroing the page. Invalidate
+ * it instead so that writeback does not get confused
+ * put page & buffer dirty bits into inconsistent
+ * state.
+ */
+ block_invalidate_folio(page_folio(wc->w_target_page),
+ 0, PAGE_SIZE);
+ }
}
if (wc->w_target_page)
flush_dcache_page(wc->w_target_page);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x cbebd68f59f03633469f3ecf9bea99cd6cce3854
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167931308586149(a)kroah.com' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
cbebd68f59f0 ("x86/mm: Fix use of uninitialized buffer in sme_enable()")
1cd9c22fee3a ("x86/mm/encrypt: Move page table helpers into separate translation unit")
91cfc88c66bf ("x86: Use __nostackprotect for sme_encrypt_kernel")
107cd2532181 ("x86/mm: Encrypt the initrd earlier for BSP microcode update")
cc5f01e28d6c ("x86/mm: Prepare sme_encrypt_kernel() for PAGE aligned encryption")
2b5d00b6c2cd ("x86/mm: Centralize PMD flags in sme_encrypt_kernel()")
bacf6b499e11 ("x86/mm: Use a struct to reduce parameters for SME PGD mapping")
1303880179e6 ("x86/mm: Clean up register saving in the __enc_copy() assembly code")
dfaaec9033b8 ("x86: Add support for changing memory encryption attribute in early boot")
1958b5fc4010 ("x86/boot: Add early boot support when running with SEV active")
d7b417fa08d1 ("x86/mm: Add DMA support for SEV memory encryption")
682af54399b6 ("x86/mm: Don't attempt to encrypt initrd under SEV")
d8aa7eea78a1 ("x86/mm: Add Secure Encrypted Virtualization (SEV) support")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From cbebd68f59f03633469f3ecf9bea99cd6cce3854 Mon Sep 17 00:00:00 2001
From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
Date: Mon, 6 Mar 2023 08:06:56 -0800
Subject: [PATCH] x86/mm: Fix use of uninitialized buffer in sme_enable()
cmdline_find_option() may fail before doing any initialization of
the buffer array. This may lead to unpredictable results when the same
buffer is used later in calls to strncmp() function. Fix the issue by
returning early if cmdline_find_option() returns an error.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: aca20d546214 ("x86/mm: Add support to make use of Secure Memory Encryption")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de>
Acked-by: Tom Lendacky <thomas.lendacky(a)amd.com>
Cc: <stable(a)kernel.org>
Link: https://lore.kernel.org/r/20230306160656.14844-1-n.zhandarovich@fintech.ru
diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index 88cccd65029d..c6efcf559d88 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -600,7 +600,8 @@ void __init sme_enable(struct boot_params *bp)
cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr |
((u64)bp->ext_cmd_line_ptr << 32));
- cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer));
+ if (cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer)) < 0)
+ return;
if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
sme_me_mask = me_mask;
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 08697bca9bbba15f2058fdbd9f970bd5f6a8a2e8
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167931291995243(a)kroah.com' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
08697bca9bbb ("trace/hwlat: Do not start per-cpu thread if it is already running")
ff78f6679d2e ("trace/hwlat: make use of the helper function kthread_run_on_cpu()")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 08697bca9bbba15f2058fdbd9f970bd5f6a8a2e8 Mon Sep 17 00:00:00 2001
From: Tero Kristo <tero.kristo(a)linux.intel.com>
Date: Fri, 10 Mar 2023 12:04:51 +0200
Subject: [PATCH] trace/hwlat: Do not start per-cpu thread if it is already
running
The hwlatd tracer will end up starting multiple per-cpu threads with
the following script:
#!/bin/sh
cd /sys/kernel/debug/tracing
echo 0 > tracing_on
echo hwlat > current_tracer
echo per-cpu > hwlat_detector/mode
echo 100000 > hwlat_detector/width
echo 200000 > hwlat_detector/window
echo 1 > tracing_on
To fix the issue, check if the hwlatd thread for the cpu is already
running, before starting a new one. Along with the previous patch, this
avoids running multiple instances of the same CPU thread on the system.
Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.inte…
Link: https://lkml.kernel.org/r/20230310100451.3948583-3-tero.kristo@linux.intel.…
Cc: stable(a)vger.kernel.org
Fixes: f46b16520a087 ("trace/hwlat: Implement the per-cpu mode")
Signed-off-by: Tero Kristo <tero.kristo(a)linux.intel.com>
Acked-by: Daniel Bristot de Oliveira <bristot(a)kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
index edc26dc22c3f..c4945f8adc11 100644
--- a/kernel/trace/trace_hwlat.c
+++ b/kernel/trace/trace_hwlat.c
@@ -492,6 +492,10 @@ static int start_cpu_kthread(unsigned int cpu)
{
struct task_struct *kthread;
+ /* Do not start a new hwlatd thread if it is already running */
+ if (per_cpu(hwlat_per_cpu_data, cpu).kthread)
+ return 0;
+
kthread = kthread_run_on_cpu(kthread_fn, NULL, cpu, "hwlatd/%u");
if (IS_ERR(kthread)) {
pr_err(BANNER "could not start sampling thread\n");
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x ff7c76f66d8bad4e694c264c789249e1d3a8205d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1678953691202116(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
ff7c76f66d8b ("powerpc/boot: Don't always pass -mcpu=powerpc when building 32-bit uImage")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ff7c76f66d8bad4e694c264c789249e1d3a8205d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali(a)kernel.org>
Date: Wed, 25 Jan 2023 08:39:00 +0100
Subject: [PATCH] powerpc/boot: Don't always pass -mcpu=powerpc when building
32-bit uImage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When CONFIG_TARGET_CPU is specified then pass its value to the compiler
-mcpu option. This fixes following build error when building kernel with
powerpc e500 SPE capable cross compilers:
BOOTAS arch/powerpc/boot/crt0.o
powerpc-linux-gnuspe-gcc: error: unrecognized argument in option ‘-mcpu=powerpc’
powerpc-linux-gnuspe-gcc: note: valid arguments to ‘-mcpu=’ are: 8540 8548 native
make[1]: *** [arch/powerpc/boot/Makefile:231: arch/powerpc/boot/crt0.o] Error 1
Similar change was already introduced for the main powerpc Makefile in
commit 446cda1b21d9 ("powerpc/32: Don't always pass -mcpu=powerpc to the
compiler").
Fixes: 40a75584e526 ("powerpc/boot: Build wrapper for an appropriate CPU")
Cc: stable(a)vger.kernel.org # v5.19+
Signed-off-by: Pali Rohár <pali(a)kernel.org>
Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu>
Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au>
Link: https://lore.kernel.org/r/2ae3ae5887babfdacc34435bff0944b3f336100a.16746323…
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index d32d95aea5d6..295f76df13b5 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -39,13 +39,19 @@ BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
$(LINUXINCLUDE)
ifdef CONFIG_PPC64_BOOT_WRAPPER
-ifdef CONFIG_CPU_LITTLE_ENDIAN
-BOOTCFLAGS += -m64 -mcpu=powerpc64le
+BOOTCFLAGS += -m64
else
-BOOTCFLAGS += -m64 -mcpu=powerpc64
+BOOTCFLAGS += -m32
endif
+
+ifdef CONFIG_TARGET_CPU_BOOL
+BOOTCFLAGS += -mcpu=$(CONFIG_TARGET_CPU)
+else ifdef CONFIG_PPC64_BOOT_WRAPPER
+ifdef CONFIG_CPU_LITTLE_ENDIAN
+BOOTCFLAGS += -mcpu=powerpc64le
else
-BOOTCFLAGS += -m32 -mcpu=powerpc
+BOOTCFLAGS += -mcpu=powerpc64
+endif
endif
BOOTCFLAGS += -isystem $(shell $(BOOTCC) -print-file-name=include)
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x e0e6b416b25ee14716f3549e0cbec1011b193809
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167930744720516(a)kroah.com' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
e0e6b416b25e ("drm/i915/active: Fix misuse of non-idle barriers as fence trackers")
ad5c99e02047 ("drm/i915: Remove unused bits of i915_vma/active api")
f6c466b84cfa ("drm/i915: Add support for moving fence waiting")
544460c33821 ("drm/i915: Multi-BB execbuf")
5851387a422c ("drm/i915/guc: Implement no mid batch preemption for multi-lrc")
e5e32171a2cf ("drm/i915/guc: Connect UAPI to GuC multi-lrc interface")
d38a9294491d ("drm/i915/guc: Update debugfs for GuC multi-lrc")
bc955204919e ("drm/i915/guc: Insert submit fences between requests in parent-child relationship")
6b540bf6f143 ("drm/i915/guc: Implement multi-lrc submission")
99b47aaddfa9 ("drm/i915/guc: Implement parallel context pin / unpin functions")
c2aa552ff09d ("drm/i915/guc: Add multi-lrc context registration")
3897df4c0187 ("drm/i915/guc: Introduce context parent-child relationship")
4f3059dc2dbb ("drm/i915: Add logical engine mapping")
1a52faed3131 ("drm/i915/guc: Take GT PM ref when deregistering context")
0ea92ace8b95 ("drm/i915/guc: Move GuC guc_id allocation under submission state sub-struct")
0d8ee5ba8db4 ("drm/i915: Don't back up pinned LMEM context images and rings during suspend")
c56ce9565374 ("drm/i915 Implement LMEM backup and restore for suspend / resume")
0d9388635a22 ("drm/i915/ttm: Implement a function to copy the contents of two TTM-based objects")
68c03c0e985e ("drm/i915/debugfs: Do not report currently active engine when describing objects")
48b096126954 ("drm/i915: Move __i915_gem_free_object to ttm_bo_destroy")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e0e6b416b25ee14716f3549e0cbec1011b193809 Mon Sep 17 00:00:00 2001
From: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
Date: Thu, 2 Mar 2023 13:08:20 +0100
Subject: [PATCH] drm/i915/active: Fix misuse of non-idle barriers as fence
trackers
Users reported oopses on list corruptions when using i915 perf with a
number of concurrently running graphics applications. Root cause analysis
pointed at an issue in barrier processing code -- a race among perf open /
close replacing active barriers with perf requests on kernel context and
concurrent barrier preallocate / acquire operations performed during user
context first pin / last unpin.
When adding a request to a composite tracker, we try to reuse an existing
fence tracker, already allocated and registered with that composite. The
tracker we obtain may already track another fence, may be an idle barrier,
or an active barrier.
If the tracker we get occurs a non-idle barrier then we try to delete that
barrier from a list of barrier tasks it belongs to. However, while doing
that we don't respect return value from a function that performs the
barrier deletion. Should the deletion ever fail, we would end up reusing
the tracker still registered as a barrier task. Since the same structure
field is reused with both fence callback lists and barrier tasks list,
list corruptions would likely occur.
Barriers are now deleted from a barrier tasks list by temporarily removing
the list content, traversing that content with skip over the node to be
deleted, then populating the list back with the modified content. Should
that intentionally racy concurrent deletion attempts be not serialized,
one or more of those may fail because of the list being temporary empty.
Related code that ignores the results of barrier deletion was initially
introduced in v5.4 by commit d8af05ff38ae ("drm/i915: Allow sharing the
idle-barrier from other kernel requests"). However, all users of the
barrier deletion routine were apparently serialized at that time, then the
issue didn't exhibit itself. Results of git bisect with help of a newly
developed igt@gem_barrier_race@remote-request IGT test indicate that list
corruptions might start to appear after commit 311770173fac ("drm/i915/gt:
Schedule request retirement when timeline idles"), introduced in v5.5.
Respect results of barrier deletion attempts -- mark the barrier as idle
only if successfully deleted from the list. Then, before proceeding with
setting our fence as the one currently tracked, make sure that the tracker
we've got is not a non-idle barrier. If that check fails then don't use
that tracker but go back and try to acquire a new, usable one.
v3: use unlikely() to document what outcome we expect (Andi),
- fix bad grammar in commit description.
v2: no code changes,
- blame commit 311770173fac ("drm/i915/gt: Schedule request retirement
when timeline idles"), v5.5, not commit d8af05ff38ae ("drm/i915: Allow
sharing the idle-barrier from other kernel requests"), v5.4,
- reword commit description.
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6333
Fixes: 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles")
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: stable(a)vger.kernel.org # v5.5
Cc: Andi Shyti <andi.shyti(a)linux.intel.com>
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230302120820.48740-1-janusz…
(cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
index 7412abf166a8..a9fea115f2d2 100644
--- a/drivers/gpu/drm/i915/i915_active.c
+++ b/drivers/gpu/drm/i915/i915_active.c
@@ -422,12 +422,12 @@ replace_barrier(struct i915_active *ref, struct i915_active_fence *active)
* we can use it to substitute for the pending idle-barrer
* request that we want to emit on the kernel_context.
*/
- __active_del_barrier(ref, node_from_active(active));
- return true;
+ return __active_del_barrier(ref, node_from_active(active));
}
int i915_active_add_request(struct i915_active *ref, struct i915_request *rq)
{
+ u64 idx = i915_request_timeline(rq)->fence_context;
struct dma_fence *fence = &rq->fence;
struct i915_active_fence *active;
int err;
@@ -437,16 +437,19 @@ int i915_active_add_request(struct i915_active *ref, struct i915_request *rq)
if (err)
return err;
- active = active_instance(ref, i915_request_timeline(rq)->fence_context);
- if (!active) {
- err = -ENOMEM;
- goto out;
- }
+ do {
+ active = active_instance(ref, idx);
+ if (!active) {
+ err = -ENOMEM;
+ goto out;
+ }
+
+ if (replace_barrier(ref, active)) {
+ RCU_INIT_POINTER(active->fence, NULL);
+ atomic_dec(&ref->count);
+ }
+ } while (unlikely(is_barrier(active)));
- if (replace_barrier(ref, active)) {
- RCU_INIT_POINTER(active->fence, NULL);
- atomic_dec(&ref->count);
- }
if (!__i915_active_fence_set(active, fence))
__i915_active_acquire(ref);
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 32e293be736b853f168cd065d9cbc1b0c69f545d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167930353815674(a)kroah.com' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
32e293be736b ("serial: 8250_em: Fix UART port type")
2a1dbd259e63 ("serial: 8250_em: Switch to use platform_get_irq()")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 32e293be736b853f168cd065d9cbc1b0c69f545d Mon Sep 17 00:00:00 2001
From: Biju Das <biju.das.jz(a)bp.renesas.com>
Date: Mon, 27 Feb 2023 11:41:46 +0000
Subject: [PATCH] serial: 8250_em: Fix UART port type
As per HW manual for EMEV2 "R19UH0040EJ0400 Rev.4.00", the UART
IP found on EMMA mobile SoC is Register-compatible with the
general-purpose 16750 UART chip. Fix UART port type as 16750 and
enable 64-bytes fifo support.
Fixes: 22886ee96895 ("serial8250-em: Emma Mobile UART driver V2")
Cc: stable(a)vger.kernel.org
Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com>
Link: https://lore.kernel.org/r/20230227114152.22265-2-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/tty/serial/8250/8250_em.c b/drivers/tty/serial/8250/8250_em.c
index f8e99995eee9..d94c3811a8f7 100644
--- a/drivers/tty/serial/8250/8250_em.c
+++ b/drivers/tty/serial/8250/8250_em.c
@@ -106,8 +106,8 @@ static int serial8250_em_probe(struct platform_device *pdev)
memset(&up, 0, sizeof(up));
up.port.mapbase = regs->start;
up.port.irq = irq;
- up.port.type = PORT_UNKNOWN;
- up.port.flags = UPF_BOOT_AUTOCONF | UPF_FIXED_PORT | UPF_IOREMAP;
+ up.port.type = PORT_16750;
+ up.port.flags = UPF_FIXED_PORT | UPF_IOREMAP | UPF_FIXED_TYPE;
up.port.dev = &pdev->dev;
up.port.private_data = priv;
The fourth interrupt on SCI port is transmit end interrupt compared to
the break interrupt on other port types. So, shuffle the interrupts to fix
the transmit end interrupt handler.
Fixes: e1d0be616186 ("sh-sci: Add h8300 SCI")
Cc: stable(a)vger.kernel.org
Suggested-by: Geert Uytterhoeven <geert+renesas(a)glider.be>
Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com>
---
v2->v3:
* Cced stable(a)vger.kernel.org
v1->v2:
* Replaced the wrong fixes tag
* Added a simpler check in sci_init_single() and added a check in
probe to catch invalid interrupt count.
Tested the SCI0 interface on RZ/G2UL by connecting to PMOD USBUART.
39: 0 GICv3 437 Level 1004d000.serial:rx err
40: 12 GICv3 438 Edge 1004d000.serial:rx full
41: 70 GICv3 439 Edge 1004d000.serial:tx empty
42: 18 GICv3 440 Level 1004d000.serial:tx end
---
drivers/tty/serial/sh-sci.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index af4a7a865764..616041faab55 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -31,6 +31,7 @@
#include <linux/ioport.h>
#include <linux/ktime.h>
#include <linux/major.h>
+#include <linux/minmax.h>
#include <linux/module.h>
#include <linux/mm.h>
#include <linux/of.h>
@@ -2864,6 +2865,13 @@ static int sci_init_single(struct platform_device *dev,
sci_port->irqs[i] = platform_get_irq(dev, i);
}
+ /*
+ * The fourth interrupt on SCI port is transmit end interrupt, so
+ * shuffle the interrupts.
+ */
+ if (p->type == PORT_SCI)
+ swap(sci_port->irqs[SCIx_BRI_IRQ], sci_port->irqs[SCIx_TEI_IRQ]);
+
/* The SCI generates several interrupts. They can be muxed together or
* connected to different interrupt lines. In the muxed case only one
* interrupt resource is specified as there is only one interrupt ID.
--
2.25.1
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679303913560(a)kroah.com' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
a52e5cdbe801 ("s390/ipl: add missing intersection check to ipl_report handling")
84733284f67b ("s390/boot: introduce boot data 'initrd_data'")
9f744abb4639 ("s390/boot: replace magic string check with a bootdata flag")
73045a08cf55 ("s390: unify identity mapping limits handling")
d7e7fbba67a3 ("s390/early: rewrite program parameter setup in C")
0c4ec024a481 ("s390/kasan: move memory needs estimation into a function")
92bca2fe61f5 ("s390/kasan: avoid confusing naming")
90178c190079 ("s390/mm: let vmalloc area size depend on physical memory size")
a3453d923ece ("s390/kasan: remove 3-level paging support")
847d4287a0c6 ("Merge tag 's390-5.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9 Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens(a)linux.ibm.com>
Date: Tue, 7 Mar 2023 14:35:23 +0100
Subject: [PATCH] s390/ipl: add missing intersection check to ipl_report
handling
The code which handles the ipl report is searching for a free location
in memory where it could copy the component and certificate entries to.
It checks for intersection between the sections required for the kernel
and the component/certificate data area, but fails to check whether
the data structures linking these data areas together intersect.
This might cause the iplreport copy code to overwrite the iplreport
itself. Fix this by adding two addtional intersection checks.
Cc: <stable(a)vger.kernel.org>
Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot")
Signed-off-by: Sven Schnelle <svens(a)linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor(a)linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor(a)linux.ibm.com>
diff --git a/arch/s390/boot/ipl_report.c b/arch/s390/boot/ipl_report.c
index 9b14045065b6..74b5cd264862 100644
--- a/arch/s390/boot/ipl_report.c
+++ b/arch/s390/boot/ipl_report.c
@@ -57,11 +57,19 @@ static unsigned long find_bootdata_space(struct ipl_rb_components *comps,
if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size &&
intersects(initrd_data.start, initrd_data.size, safe_addr, size))
safe_addr = initrd_data.start + initrd_data.size;
+ if (intersects(safe_addr, size, (unsigned long)comps, comps->len)) {
+ safe_addr = (unsigned long)comps + comps->len;
+ goto repeat;
+ }
for_each_rb_entry(comp, comps)
if (intersects(safe_addr, size, comp->addr, comp->len)) {
safe_addr = comp->addr + comp->len;
goto repeat;
}
+ if (intersects(safe_addr, size, (unsigned long)certs, certs->len)) {
+ safe_addr = (unsigned long)certs + certs->len;
+ goto repeat;
+ }
for_each_rb_entry(cert, certs)
if (intersects(safe_addr, size, cert->addr, cert->len)) {
safe_addr = cert->addr + cert->len;
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x b6985b9b82954caa53f862d6059d06c0526254f0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679309291125228(a)kroah.com' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
b6985b9b8295 ("mptcp: use the workqueue to destroy unaccepted sockets")
7d803344fdc3 ("mptcp: fix deadlock in fastopen error path")
f2bb566f5c97 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b6985b9b82954caa53f862d6059d06c0526254f0 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni(a)redhat.com>
Date: Thu, 9 Mar 2023 15:49:59 +0100
Subject: [PATCH] mptcp: use the workqueue to destroy unaccepted sockets
Christoph reported a UaF at token lookup time after having
refactored the passive socket initialization part:
BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260
Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198
CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6e/0x91
print_report+0x16a/0x46f
kasan_report+0xad/0x130
__token_bucket_busy+0x253/0x260
mptcp_token_new_connect+0x13d/0x490
mptcp_connect+0x4ed/0x860
__inet_stream_connect+0x80e/0xd90
tcp_sendmsg_fastopen+0x3ce/0x710
mptcp_sendmsg+0xff1/0x1a20
inet_sendmsg+0x11d/0x140
__sys_sendto+0x405/0x490
__x64_sys_sendto+0xdc/0x1b0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
We need to properly clean-up all the paired MPTCP-level
resources and be sure to release the msk last, even when
the unaccepted subflow is destroyed by the TCP internals
via inet_child_forget().
We can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra,
explicitly checking that for the critical scenario: the
closed subflow is the MPC one, the msk is not accepted and
eventually going through full cleanup.
With such change, __mptcp_destroy_sock() is always called
on msk sockets, even on accepted ones. We don't need anymore
to transiently drop one sk reference at msk clone time.
Please note this commit depends on the parent one:
mptcp: refactor passive socket initialization
Fixes: 58b09919626b ("mptcp: create msk early")
Cc: stable(a)vger.kernel.org
Reported-and-tested-by: Christoph Paasch <cpaasch(a)apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/347
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 447641d34c2c..2a2093d61835 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2342,7 +2342,6 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
goto out;
}
- sock_orphan(ssk);
subflow->disposable = 1;
/* if ssk hit tcp_done(), tcp_cleanup_ulp() cleared the related ops
@@ -2350,7 +2349,20 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
* reference owned by msk;
*/
if (!inet_csk(ssk)->icsk_ulp_ops) {
+ WARN_ON_ONCE(!sock_flag(ssk, SOCK_DEAD));
kfree_rcu(subflow, rcu);
+ } else if (msk->in_accept_queue && msk->first == ssk) {
+ /* if the first subflow moved to a close state, e.g. due to
+ * incoming reset and we reach here before inet_child_forget()
+ * the TCP stack could later try to close it via
+ * inet_csk_listen_stop(), or deliver it to the user space via
+ * accept().
+ * We can't delete the subflow - or risk a double free - nor let
+ * the msk survive - or will be leaked in the non accept scenario:
+ * fallback and let TCP cope with the subflow cleanup.
+ */
+ WARN_ON_ONCE(sock_flag(ssk, SOCK_DEAD));
+ mptcp_subflow_drop_ctx(ssk);
} else {
/* otherwise tcp will dispose of the ssk and subflow ctx */
if (ssk->sk_state == TCP_LISTEN) {
@@ -2398,9 +2410,10 @@ static unsigned int mptcp_sync_mss(struct sock *sk, u32 pmtu)
return 0;
}
-static void __mptcp_close_subflow(struct mptcp_sock *msk)
+static void __mptcp_close_subflow(struct sock *sk)
{
struct mptcp_subflow_context *subflow, *tmp;
+ struct mptcp_sock *msk = mptcp_sk(sk);
might_sleep();
@@ -2414,7 +2427,15 @@ static void __mptcp_close_subflow(struct mptcp_sock *msk)
if (!skb_queue_empty_lockless(&ssk->sk_receive_queue))
continue;
- mptcp_close_ssk((struct sock *)msk, ssk, subflow);
+ mptcp_close_ssk(sk, ssk, subflow);
+ }
+
+ /* if the MPC subflow has been closed before the msk is accepted,
+ * msk will never be accept-ed, close it now
+ */
+ if (!msk->first && msk->in_accept_queue) {
+ sock_set_flag(sk, SOCK_DEAD);
+ inet_sk_state_store(sk, TCP_CLOSE);
}
}
@@ -2623,6 +2644,9 @@ static void mptcp_worker(struct work_struct *work)
__mptcp_check_send_data_fin(sk);
mptcp_check_data_fin(sk);
+ if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
+ __mptcp_close_subflow(sk);
+
/* There is no point in keeping around an orphaned sk timedout or
* closed, but we need the msk around to reply to incoming DATA_FIN,
* even if it is orphaned and in FIN_WAIT2 state
@@ -2638,9 +2662,6 @@ static void mptcp_worker(struct work_struct *work)
}
}
- if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
- __mptcp_close_subflow(msk);
-
if (test_and_clear_bit(MPTCP_WORK_RTX, &msk->flags))
__mptcp_retrans(sk);
@@ -3078,6 +3099,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
msk->local_key = subflow_req->local_key;
msk->token = subflow_req->token;
msk->subflow = NULL;
+ msk->in_accept_queue = 1;
WRITE_ONCE(msk->fully_established, false);
if (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD)
WRITE_ONCE(msk->csum_enabled, true);
@@ -3095,8 +3117,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
security_inet_csk_clone(nsk, req);
bh_unlock_sock(nsk);
- /* keep a single reference */
- __sock_put(nsk);
+ /* note: the newly allocated socket refcount is 2 now */
return nsk;
}
@@ -3152,8 +3173,6 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
goto out;
}
- /* acquire the 2nd reference for the owning socket */
- sock_hold(new_mptcp_sock);
newsk = new_mptcp_sock;
MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPCAPABLEPASSIVEACK);
} else {
@@ -3704,6 +3723,7 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
struct sock *newsk = newsock->sk;
set_bit(SOCK_CUSTOM_SOCKOPT, &newsock->flags);
+ msk->in_accept_queue = 0;
lock_sock(newsk);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 61fd8eabfca2..3a2db1b862dd 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -295,7 +295,8 @@ struct mptcp_sock {
u8 recvmsg_inq:1,
cork:1,
nodelay:1,
- fastopening:1;
+ fastopening:1,
+ in_accept_queue:1;
int connect_flags;
struct work_struct work;
struct sk_buff *ooo_last_skb;
@@ -666,6 +667,8 @@ void mptcp_subflow_set_active(struct mptcp_subflow_context *subflow);
bool mptcp_subflow_active(struct mptcp_subflow_context *subflow);
+void mptcp_subflow_drop_ctx(struct sock *ssk);
+
static inline void mptcp_subflow_tcp_fallback(struct sock *sk,
struct mptcp_subflow_context *ctx)
{
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index a631a5e6fc7b..932a3e0eb22d 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -699,9 +699,10 @@ static bool subflow_hmac_valid(const struct request_sock *req,
static void mptcp_force_close(struct sock *sk)
{
- /* the msk is not yet exposed to user-space */
+ /* the msk is not yet exposed to user-space, and refcount is 2 */
inet_sk_state_store(sk, TCP_CLOSE);
sk_common_release(sk);
+ sock_put(sk);
}
static void subflow_ulp_fallback(struct sock *sk,
@@ -717,7 +718,7 @@ static void subflow_ulp_fallback(struct sock *sk,
mptcp_subflow_ops_undo_override(sk);
}
-static void subflow_drop_ctx(struct sock *ssk)
+void mptcp_subflow_drop_ctx(struct sock *ssk)
{
struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(ssk);
@@ -823,7 +824,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
if (new_msk)
mptcp_copy_inaddrs(new_msk, child);
- subflow_drop_ctx(child);
+ mptcp_subflow_drop_ctx(child);
goto out;
}
@@ -914,7 +915,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
return child;
dispose_child:
- subflow_drop_ctx(child);
+ mptcp_subflow_drop_ctx(child);
tcp_rsk(req)->drop_req = true;
inet_csk_prepare_for_destroy_sock(child);
tcp_done(child);
@@ -1866,7 +1867,6 @@ void mptcp_subflow_queue_clean(struct sock *listener_sk, struct sock *listener_s
struct sock *sk = (struct sock *)msk;
bool do_cancel_work;
- sock_hold(sk);
lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
next = msk->dl_next;
msk->first = NULL;
@@ -1954,6 +1954,13 @@ static void subflow_ulp_release(struct sock *ssk)
* when the subflow is still unaccepted
*/
release = ctx->disposable || list_empty(&ctx->node);
+
+ /* inet_child_forget() does not call sk_state_change(),
+ * explicitly trigger the socket close machinery
+ */
+ if (!release && !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW,
+ &mptcp_sk(sk)->flags))
+ mptcp_schedule_work(sk);
sock_put(sk);
}
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x b6985b9b82954caa53f862d6059d06c0526254f0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167930928897214(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
b6985b9b8295 ("mptcp: use the workqueue to destroy unaccepted sockets")
7d803344fdc3 ("mptcp: fix deadlock in fastopen error path")
f2bb566f5c97 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b6985b9b82954caa53f862d6059d06c0526254f0 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni(a)redhat.com>
Date: Thu, 9 Mar 2023 15:49:59 +0100
Subject: [PATCH] mptcp: use the workqueue to destroy unaccepted sockets
Christoph reported a UaF at token lookup time after having
refactored the passive socket initialization part:
BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260
Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198
CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6e/0x91
print_report+0x16a/0x46f
kasan_report+0xad/0x130
__token_bucket_busy+0x253/0x260
mptcp_token_new_connect+0x13d/0x490
mptcp_connect+0x4ed/0x860
__inet_stream_connect+0x80e/0xd90
tcp_sendmsg_fastopen+0x3ce/0x710
mptcp_sendmsg+0xff1/0x1a20
inet_sendmsg+0x11d/0x140
__sys_sendto+0x405/0x490
__x64_sys_sendto+0xdc/0x1b0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
We need to properly clean-up all the paired MPTCP-level
resources and be sure to release the msk last, even when
the unaccepted subflow is destroyed by the TCP internals
via inet_child_forget().
We can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra,
explicitly checking that for the critical scenario: the
closed subflow is the MPC one, the msk is not accepted and
eventually going through full cleanup.
With such change, __mptcp_destroy_sock() is always called
on msk sockets, even on accepted ones. We don't need anymore
to transiently drop one sk reference at msk clone time.
Please note this commit depends on the parent one:
mptcp: refactor passive socket initialization
Fixes: 58b09919626b ("mptcp: create msk early")
Cc: stable(a)vger.kernel.org
Reported-and-tested-by: Christoph Paasch <cpaasch(a)apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/347
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 447641d34c2c..2a2093d61835 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2342,7 +2342,6 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
goto out;
}
- sock_orphan(ssk);
subflow->disposable = 1;
/* if ssk hit tcp_done(), tcp_cleanup_ulp() cleared the related ops
@@ -2350,7 +2349,20 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
* reference owned by msk;
*/
if (!inet_csk(ssk)->icsk_ulp_ops) {
+ WARN_ON_ONCE(!sock_flag(ssk, SOCK_DEAD));
kfree_rcu(subflow, rcu);
+ } else if (msk->in_accept_queue && msk->first == ssk) {
+ /* if the first subflow moved to a close state, e.g. due to
+ * incoming reset and we reach here before inet_child_forget()
+ * the TCP stack could later try to close it via
+ * inet_csk_listen_stop(), or deliver it to the user space via
+ * accept().
+ * We can't delete the subflow - or risk a double free - nor let
+ * the msk survive - or will be leaked in the non accept scenario:
+ * fallback and let TCP cope with the subflow cleanup.
+ */
+ WARN_ON_ONCE(sock_flag(ssk, SOCK_DEAD));
+ mptcp_subflow_drop_ctx(ssk);
} else {
/* otherwise tcp will dispose of the ssk and subflow ctx */
if (ssk->sk_state == TCP_LISTEN) {
@@ -2398,9 +2410,10 @@ static unsigned int mptcp_sync_mss(struct sock *sk, u32 pmtu)
return 0;
}
-static void __mptcp_close_subflow(struct mptcp_sock *msk)
+static void __mptcp_close_subflow(struct sock *sk)
{
struct mptcp_subflow_context *subflow, *tmp;
+ struct mptcp_sock *msk = mptcp_sk(sk);
might_sleep();
@@ -2414,7 +2427,15 @@ static void __mptcp_close_subflow(struct mptcp_sock *msk)
if (!skb_queue_empty_lockless(&ssk->sk_receive_queue))
continue;
- mptcp_close_ssk((struct sock *)msk, ssk, subflow);
+ mptcp_close_ssk(sk, ssk, subflow);
+ }
+
+ /* if the MPC subflow has been closed before the msk is accepted,
+ * msk will never be accept-ed, close it now
+ */
+ if (!msk->first && msk->in_accept_queue) {
+ sock_set_flag(sk, SOCK_DEAD);
+ inet_sk_state_store(sk, TCP_CLOSE);
}
}
@@ -2623,6 +2644,9 @@ static void mptcp_worker(struct work_struct *work)
__mptcp_check_send_data_fin(sk);
mptcp_check_data_fin(sk);
+ if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
+ __mptcp_close_subflow(sk);
+
/* There is no point in keeping around an orphaned sk timedout or
* closed, but we need the msk around to reply to incoming DATA_FIN,
* even if it is orphaned and in FIN_WAIT2 state
@@ -2638,9 +2662,6 @@ static void mptcp_worker(struct work_struct *work)
}
}
- if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
- __mptcp_close_subflow(msk);
-
if (test_and_clear_bit(MPTCP_WORK_RTX, &msk->flags))
__mptcp_retrans(sk);
@@ -3078,6 +3099,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
msk->local_key = subflow_req->local_key;
msk->token = subflow_req->token;
msk->subflow = NULL;
+ msk->in_accept_queue = 1;
WRITE_ONCE(msk->fully_established, false);
if (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD)
WRITE_ONCE(msk->csum_enabled, true);
@@ -3095,8 +3117,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
security_inet_csk_clone(nsk, req);
bh_unlock_sock(nsk);
- /* keep a single reference */
- __sock_put(nsk);
+ /* note: the newly allocated socket refcount is 2 now */
return nsk;
}
@@ -3152,8 +3173,6 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
goto out;
}
- /* acquire the 2nd reference for the owning socket */
- sock_hold(new_mptcp_sock);
newsk = new_mptcp_sock;
MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPCAPABLEPASSIVEACK);
} else {
@@ -3704,6 +3723,7 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
struct sock *newsk = newsock->sk;
set_bit(SOCK_CUSTOM_SOCKOPT, &newsock->flags);
+ msk->in_accept_queue = 0;
lock_sock(newsk);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 61fd8eabfca2..3a2db1b862dd 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -295,7 +295,8 @@ struct mptcp_sock {
u8 recvmsg_inq:1,
cork:1,
nodelay:1,
- fastopening:1;
+ fastopening:1,
+ in_accept_queue:1;
int connect_flags;
struct work_struct work;
struct sk_buff *ooo_last_skb;
@@ -666,6 +667,8 @@ void mptcp_subflow_set_active(struct mptcp_subflow_context *subflow);
bool mptcp_subflow_active(struct mptcp_subflow_context *subflow);
+void mptcp_subflow_drop_ctx(struct sock *ssk);
+
static inline void mptcp_subflow_tcp_fallback(struct sock *sk,
struct mptcp_subflow_context *ctx)
{
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index a631a5e6fc7b..932a3e0eb22d 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -699,9 +699,10 @@ static bool subflow_hmac_valid(const struct request_sock *req,
static void mptcp_force_close(struct sock *sk)
{
- /* the msk is not yet exposed to user-space */
+ /* the msk is not yet exposed to user-space, and refcount is 2 */
inet_sk_state_store(sk, TCP_CLOSE);
sk_common_release(sk);
+ sock_put(sk);
}
static void subflow_ulp_fallback(struct sock *sk,
@@ -717,7 +718,7 @@ static void subflow_ulp_fallback(struct sock *sk,
mptcp_subflow_ops_undo_override(sk);
}
-static void subflow_drop_ctx(struct sock *ssk)
+void mptcp_subflow_drop_ctx(struct sock *ssk)
{
struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(ssk);
@@ -823,7 +824,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
if (new_msk)
mptcp_copy_inaddrs(new_msk, child);
- subflow_drop_ctx(child);
+ mptcp_subflow_drop_ctx(child);
goto out;
}
@@ -914,7 +915,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
return child;
dispose_child:
- subflow_drop_ctx(child);
+ mptcp_subflow_drop_ctx(child);
tcp_rsk(req)->drop_req = true;
inet_csk_prepare_for_destroy_sock(child);
tcp_done(child);
@@ -1866,7 +1867,6 @@ void mptcp_subflow_queue_clean(struct sock *listener_sk, struct sock *listener_s
struct sock *sk = (struct sock *)msk;
bool do_cancel_work;
- sock_hold(sk);
lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
next = msk->dl_next;
msk->first = NULL;
@@ -1954,6 +1954,13 @@ static void subflow_ulp_release(struct sock *ssk)
* when the subflow is still unaccepted
*/
release = ctx->disposable || list_empty(&ctx->node);
+
+ /* inet_child_forget() does not call sk_state_change(),
+ * explicitly trigger the socket close machinery
+ */
+ if (!release && !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW,
+ &mptcp_sk(sk)->flags))
+ mptcp_schedule_work(sk);
sock_put(sk);
}
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 3a236aef280ed5122b2d47087eb514d0921ae033
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167930925942146(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
3a236aef280e ("mptcp: refactor passive socket initialization")
dfc8d0603033 ("mptcp: implement delayed seq generation for passive fastopen")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3a236aef280ed5122b2d47087eb514d0921ae033 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni(a)redhat.com>
Date: Thu, 9 Mar 2023 15:49:58 +0100
Subject: [PATCH] mptcp: refactor passive socket initialization
After commit 30e51b923e43 ("mptcp: fix unreleased socket in accept queue")
unaccepted msk sockets go throu complete shutdown, we don't need anymore
to delay inserting the first subflow into the subflow lists.
The reference counting deserve some extra care, as __mptcp_close() is
unaware of the request socket linkage to the first subflow.
Please note that this is more a refactoring than a fix but because this
modification is needed to include other corrections, see the following
commits. Then a Fixes tag has been added here to help the stable team.
Fixes: 30e51b923e43 ("mptcp: fix unreleased socket in accept queue")
Cc: stable(a)vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Tested-by: Christoph Paasch <cpaasch(a)apple.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 3ad9c46202fc..447641d34c2c 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -825,7 +825,6 @@ static bool __mptcp_finish_join(struct mptcp_sock *msk, struct sock *ssk)
if (sk->sk_socket && !ssk->sk_socket)
mptcp_sock_graft(ssk, sk->sk_socket);
- mptcp_propagate_sndbuf((struct sock *)msk, ssk);
mptcp_sockopt_sync_locked(msk, ssk);
return true;
}
@@ -3708,22 +3707,6 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
lock_sock(newsk);
- /* PM/worker can now acquire the first subflow socket
- * lock without racing with listener queue cleanup,
- * we can notify it, if needed.
- *
- * Even if remote has reset the initial subflow by now
- * the refcnt is still at least one.
- */
- subflow = mptcp_subflow_ctx(msk->first);
- list_add(&subflow->node, &msk->conn_list);
- sock_hold(msk->first);
- if (mptcp_is_fully_established(newsk))
- mptcp_pm_fully_established(msk, msk->first, GFP_KERNEL);
-
- mptcp_rcv_space_init(msk, msk->first);
- mptcp_propagate_sndbuf(newsk, msk->first);
-
/* set ssk->sk_socket of accept()ed flows to mptcp socket.
* This is needed so NOSPACE flag can be set from tcp stack.
*/
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 5070dc33675d..a631a5e6fc7b 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -397,6 +397,12 @@ void mptcp_subflow_reset(struct sock *ssk)
struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
struct sock *sk = subflow->conn;
+ /* mptcp_mp_fail_no_response() can reach here on an already closed
+ * socket
+ */
+ if (ssk->sk_state == TCP_CLOSE)
+ return;
+
/* must hold: tcp_done() could drop last reference on parent */
sock_hold(sk);
@@ -750,6 +756,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
struct mptcp_options_received mp_opt;
bool fallback, fallback_is_fatal;
struct sock *new_msk = NULL;
+ struct mptcp_sock *owner;
struct sock *child;
pr_debug("listener=%p, req=%p, conn=%p", listener, req, listener->conn);
@@ -824,6 +831,8 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
ctx->setsockopt_seq = listener->setsockopt_seq;
if (ctx->mp_capable) {
+ owner = mptcp_sk(new_msk);
+
/* this can't race with mptcp_close(), as the msk is
* not yet exposted to user-space
*/
@@ -832,14 +841,14 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
/* record the newly created socket as the first msk
* subflow, but don't link it yet into conn_list
*/
- WRITE_ONCE(mptcp_sk(new_msk)->first, child);
+ WRITE_ONCE(owner->first, child);
/* new mpc subflow takes ownership of the newly
* created mptcp socket
*/
mptcp_sk(new_msk)->setsockopt_seq = ctx->setsockopt_seq;
- mptcp_pm_new_connection(mptcp_sk(new_msk), child, 1);
- mptcp_token_accept(subflow_req, mptcp_sk(new_msk));
+ mptcp_pm_new_connection(owner, child, 1);
+ mptcp_token_accept(subflow_req, owner);
ctx->conn = new_msk;
new_msk = NULL;
@@ -847,15 +856,21 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
* uses the correct data
*/
mptcp_copy_inaddrs(ctx->conn, child);
+ mptcp_propagate_sndbuf(ctx->conn, child);
+
+ mptcp_rcv_space_init(owner, child);
+ list_add(&ctx->node, &owner->conn_list);
+ sock_hold(child);
/* with OoO packets we can reach here without ingress
* mpc option
*/
- if (mp_opt.suboptions & OPTION_MPTCP_MPC_ACK)
+ if (mp_opt.suboptions & OPTION_MPTCP_MPC_ACK) {
mptcp_subflow_fully_established(ctx, &mp_opt);
+ mptcp_pm_fully_established(owner, child, GFP_ATOMIC);
+ ctx->pm_notified = 1;
+ }
} else if (ctx->mp_join) {
- struct mptcp_sock *owner;
-
owner = subflow_req->msk;
if (!owner) {
subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT);
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 3fadda5de8073e2cb65744803a6941736411d55b
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '16793076164157(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
3fadda5de807 ("drm/amdgpu: move poll enabled/disable into non DC path")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3fadda5de8073e2cb65744803a6941736411d55b Mon Sep 17 00:00:00 2001
From: Guchun Chen <guchun.chen(a)amd.com>
Date: Thu, 9 Mar 2023 10:02:45 +0800
Subject: [PATCH] drm/amdgpu: move poll enabled/disable into non DC path
Some amd asics having reliable hotplug support don't call
drm_kms_helper_poll_init in driver init sequence. However,
due to the unified suspend/resume path for all asics, because
the output_poll_work->func is not set for these asics, a warning
arrives when suspending.
[ 90.656049] <TASK>
[ 90.656050] ? console_unlock+0x4d/0x100
[ 90.656053] ? __irq_work_queue_local+0x27/0x60
[ 90.656056] ? irq_work_queue+0x2b/0x50
[ 90.656057] ? __wake_up_klogd+0x40/0x60
[ 90.656059] __cancel_work_timer+0xed/0x180
[ 90.656061] drm_kms_helper_poll_disable.cold+0x1f/0x2c [drm_kms_helper]
[ 90.656072] amdgpu_device_suspend+0x81/0x170 [amdgpu]
[ 90.656180] amdgpu_pmops_runtime_suspend+0xb5/0x1b0 [amdgpu]
[ 90.656269] pci_pm_runtime_suspend+0x61/0x1b0
drm_kms_helper_poll_enable/disable is valid when poll_init is called in
amdgpu code, which is only used in non DC path. So move such codes into
non-DC path code to get rid of such warnings.
v1: introduce use_kms_poll flag in amdgpu as the poll stuff check
v2: use dc_enabled as the flag to simply code
v3: move code into non DC path instead of relying on any flag
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2411
Fixes: a4e771729a51 ("drm/probe_helper: sort out poll_running vs poll_enabled")
Reported-by: Bert Karwatzki <spasswolf(a)web.de>
Suggested-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Suggested-by: Alex Deucher <alexander.deucher(a)amd.com>
Signed-off-by: Guchun Chen <guchun.chen(a)amd.com>
Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index c4a4e2fe6681..da5b0258a237 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4145,8 +4145,6 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
if (amdgpu_acpi_smart_shift_update(dev, AMDGPU_SS_DEV_D3))
DRM_WARN("smart shift update failed\n");
- drm_kms_helper_poll_disable(dev);
-
if (fbcon)
drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, true);
@@ -4243,8 +4241,6 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)
if (fbcon)
drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, false);
- drm_kms_helper_poll_enable(dev);
-
amdgpu_ras_resume(adev);
if (adev->mode_info.num_crtc) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 503f89a766c3..d60fe7eb5579 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -1618,6 +1618,8 @@ int amdgpu_display_suspend_helper(struct amdgpu_device *adev)
struct drm_connector_list_iter iter;
int r;
+ drm_kms_helper_poll_disable(dev);
+
/* turn off display hw */
drm_modeset_lock_all(dev);
drm_connector_list_iter_begin(dev, &iter);
@@ -1694,6 +1696,8 @@ int amdgpu_display_resume_helper(struct amdgpu_device *adev)
drm_modeset_unlock_all(dev);
+ drm_kms_helper_poll_enable(dev);
+
return 0;
}
The patch below does not apply to the 6.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.2.y
git checkout FETCH_HEAD
git cherry-pick -x 3fadda5de8073e2cb65744803a6941736411d55b
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679307614196155(a)kroah.com' --subject-prefix 'PATCH 6.2.y' HEAD^..
Possible dependencies:
3fadda5de807 ("drm/amdgpu: move poll enabled/disable into non DC path")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3fadda5de8073e2cb65744803a6941736411d55b Mon Sep 17 00:00:00 2001
From: Guchun Chen <guchun.chen(a)amd.com>
Date: Thu, 9 Mar 2023 10:02:45 +0800
Subject: [PATCH] drm/amdgpu: move poll enabled/disable into non DC path
Some amd asics having reliable hotplug support don't call
drm_kms_helper_poll_init in driver init sequence. However,
due to the unified suspend/resume path for all asics, because
the output_poll_work->func is not set for these asics, a warning
arrives when suspending.
[ 90.656049] <TASK>
[ 90.656050] ? console_unlock+0x4d/0x100
[ 90.656053] ? __irq_work_queue_local+0x27/0x60
[ 90.656056] ? irq_work_queue+0x2b/0x50
[ 90.656057] ? __wake_up_klogd+0x40/0x60
[ 90.656059] __cancel_work_timer+0xed/0x180
[ 90.656061] drm_kms_helper_poll_disable.cold+0x1f/0x2c [drm_kms_helper]
[ 90.656072] amdgpu_device_suspend+0x81/0x170 [amdgpu]
[ 90.656180] amdgpu_pmops_runtime_suspend+0xb5/0x1b0 [amdgpu]
[ 90.656269] pci_pm_runtime_suspend+0x61/0x1b0
drm_kms_helper_poll_enable/disable is valid when poll_init is called in
amdgpu code, which is only used in non DC path. So move such codes into
non-DC path code to get rid of such warnings.
v1: introduce use_kms_poll flag in amdgpu as the poll stuff check
v2: use dc_enabled as the flag to simply code
v3: move code into non DC path instead of relying on any flag
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2411
Fixes: a4e771729a51 ("drm/probe_helper: sort out poll_running vs poll_enabled")
Reported-by: Bert Karwatzki <spasswolf(a)web.de>
Suggested-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Suggested-by: Alex Deucher <alexander.deucher(a)amd.com>
Signed-off-by: Guchun Chen <guchun.chen(a)amd.com>
Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index c4a4e2fe6681..da5b0258a237 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4145,8 +4145,6 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
if (amdgpu_acpi_smart_shift_update(dev, AMDGPU_SS_DEV_D3))
DRM_WARN("smart shift update failed\n");
- drm_kms_helper_poll_disable(dev);
-
if (fbcon)
drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, true);
@@ -4243,8 +4241,6 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)
if (fbcon)
drm_fb_helper_set_suspend_unlocked(adev_to_drm(adev)->fb_helper, false);
- drm_kms_helper_poll_enable(dev);
-
amdgpu_ras_resume(adev);
if (adev->mode_info.num_crtc) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 503f89a766c3..d60fe7eb5579 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -1618,6 +1618,8 @@ int amdgpu_display_suspend_helper(struct amdgpu_device *adev)
struct drm_connector_list_iter iter;
int r;
+ drm_kms_helper_poll_disable(dev);
+
/* turn off display hw */
drm_modeset_lock_all(dev);
drm_connector_list_iter_begin(dev, &iter);
@@ -1694,6 +1696,8 @@ int amdgpu_display_resume_helper(struct amdgpu_device *adev)
drm_modeset_unlock_all(dev);
+ drm_kms_helper_poll_enable(dev);
+
return 0;
}
The patch below does not apply to the 6.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.2.y
git checkout FETCH_HEAD
git cherry-pick -x cbd6c1b17d3b42b7935526a86ad5f66838767d03
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '167930760511153(a)kroah.com' --subject-prefix 'PATCH 6.2.y' HEAD^..
Possible dependencies:
cbd6c1b17d3b ("drm/amd/display: Fix DP MST sinks removal issue")
48e99fe4d3ba ("drm/amd/display: Remove the unused variable pre_connection_type")
54618888d1ea ("drm/amd/display: break down dc_link.c")
71d7e8904d54 ("drm/amd/display: Add HDMI manufacturer OUI and device id read")
65a4cfb45e0e ("drm/amdgpu/display: remove duplicate include header in files")
e322843e5e33 ("drm/amd/display: fix linux dp link lost handled only one time")
0c2bfcc338eb ("drm/amd/display: Add Function declaration in dc_link")
6ca7415f11af ("drm/amd/display: merge dc_link_dp into dc_link")
de3fb390175b ("drm/amd/display: move dp cts functions from dc_link_dp to link_dp_cts")
c5a31f178e35 ("drm/amd/display: move dp irq handler functions from dc_link_dp to link_dp_irq_handler")
0078c924e733 ("drm/amd/display: move eDP panel control logic to link_edp_panel_control")
bc33f5e5f05b ("drm/amd/display: create accessories, hwss and protocols sub folders in link")
2daeb74b7d66 ("drm/amdgpu/display/mst: update mst_mgr relevant variable when long HPD")
028c4ccfb812 ("drm/amd/display: force connector state when bpc changes during compliance")
603a521ec279 ("drm/amd/display: remove duplicate included header files")
bd3149014dff ("drm/amd/display: Decrease messaging about DP alt mode state to debug")
d5a43956b73b ("drm/amd/display: move dp capability related logic to link_dp_capability")
94dfeaa46925 ("drm/amd/display: move dp phy related logic to link_dp_phy")
630168a97314 ("drm/amd/display: move dp link training logic to link_dp_training")
d144b40a4833 ("drm/amd/display: move dc_link_dpia logic to link_dp_dpia")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From cbd6c1b17d3b42b7935526a86ad5f66838767d03 Mon Sep 17 00:00:00 2001
From: Cruise Hung <Cruise.Hung(a)amd.com>
Date: Thu, 2 Mar 2023 10:33:51 +0800
Subject: [PATCH] drm/amd/display: Fix DP MST sinks removal issue
[Why]
In USB4 DP tunneling, it's possible to have this scenario that
the path becomes unavailable and CM tears down the path a little bit late.
So, in this case, the HPD is high but fails to read any DPCD register.
That causes the link connection type to be set to sst.
And not all sinks are removed behind the MST branch.
[How]
Restore the link connection type if it fails to read DPCD register.
Cc: stable(a)vger.kernel.org
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Wenjing Liu <Wenjing.Liu(a)amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo(a)amd.com>
Signed-off-by: Cruise Hung <Cruise.Hung(a)amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
index 38216c789d77..f70025ef7b69 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
@@ -855,6 +855,7 @@ static bool detect_link_and_local_sink(struct dc_link *link,
struct dc_sink *prev_sink = NULL;
struct dpcd_caps prev_dpcd_caps;
enum dc_connection_type new_connection_type = dc_connection_none;
+ enum dc_connection_type pre_connection_type = link->type;
const uint32_t post_oui_delay = 30; // 30ms
DC_LOGGER_INIT(link->ctx->logger);
@@ -957,6 +958,8 @@ static bool detect_link_and_local_sink(struct dc_link *link,
}
if (!detect_dp(link, &sink_caps, reason)) {
+ link->type = pre_connection_type;
+
if (prev_sink)
dc_sink_release(prev_sink);
return false;
@@ -1244,11 +1247,16 @@ bool link_detect(struct dc_link *link, enum dc_detect_reason reason)
bool is_delegated_to_mst_top_mgr = false;
enum dc_connection_type pre_link_type = link->type;
+ DC_LOGGER_INIT(link->ctx->logger);
+
is_local_sink_detect_success = detect_link_and_local_sink(link, reason);
if (is_local_sink_detect_success && link->local_sink)
verify_link_capability(link, link->local_sink, reason);
+ DC_LOG_DC("%s: link_index=%d is_local_sink_detect_success=%d pre_link_type=%d link_type=%d\n", __func__,
+ link->link_index, is_local_sink_detect_success, pre_link_type, link->type);
+
if (is_local_sink_detect_success && link->local_sink &&
dc_is_dp_signal(link->local_sink->sink_signal) &&
link->dpcd_caps.is_mst_capable)
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x cbd6c1b17d3b42b7935526a86ad5f66838767d03
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679307604218103(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
cbd6c1b17d3b ("drm/amd/display: Fix DP MST sinks removal issue")
48e99fe4d3ba ("drm/amd/display: Remove the unused variable pre_connection_type")
54618888d1ea ("drm/amd/display: break down dc_link.c")
71d7e8904d54 ("drm/amd/display: Add HDMI manufacturer OUI and device id read")
65a4cfb45e0e ("drm/amdgpu/display: remove duplicate include header in files")
e322843e5e33 ("drm/amd/display: fix linux dp link lost handled only one time")
0c2bfcc338eb ("drm/amd/display: Add Function declaration in dc_link")
6ca7415f11af ("drm/amd/display: merge dc_link_dp into dc_link")
de3fb390175b ("drm/amd/display: move dp cts functions from dc_link_dp to link_dp_cts")
c5a31f178e35 ("drm/amd/display: move dp irq handler functions from dc_link_dp to link_dp_irq_handler")
0078c924e733 ("drm/amd/display: move eDP panel control logic to link_edp_panel_control")
bc33f5e5f05b ("drm/amd/display: create accessories, hwss and protocols sub folders in link")
2daeb74b7d66 ("drm/amdgpu/display/mst: update mst_mgr relevant variable when long HPD")
028c4ccfb812 ("drm/amd/display: force connector state when bpc changes during compliance")
603a521ec279 ("drm/amd/display: remove duplicate included header files")
bd3149014dff ("drm/amd/display: Decrease messaging about DP alt mode state to debug")
d5a43956b73b ("drm/amd/display: move dp capability related logic to link_dp_capability")
94dfeaa46925 ("drm/amd/display: move dp phy related logic to link_dp_phy")
630168a97314 ("drm/amd/display: move dp link training logic to link_dp_training")
d144b40a4833 ("drm/amd/display: move dc_link_dpia logic to link_dp_dpia")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From cbd6c1b17d3b42b7935526a86ad5f66838767d03 Mon Sep 17 00:00:00 2001
From: Cruise Hung <Cruise.Hung(a)amd.com>
Date: Thu, 2 Mar 2023 10:33:51 +0800
Subject: [PATCH] drm/amd/display: Fix DP MST sinks removal issue
[Why]
In USB4 DP tunneling, it's possible to have this scenario that
the path becomes unavailable and CM tears down the path a little bit late.
So, in this case, the HPD is high but fails to read any DPCD register.
That causes the link connection type to be set to sst.
And not all sinks are removed behind the MST branch.
[How]
Restore the link connection type if it fails to read DPCD register.
Cc: stable(a)vger.kernel.org
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Wenjing Liu <Wenjing.Liu(a)amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo(a)amd.com>
Signed-off-by: Cruise Hung <Cruise.Hung(a)amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
index 38216c789d77..f70025ef7b69 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
@@ -855,6 +855,7 @@ static bool detect_link_and_local_sink(struct dc_link *link,
struct dc_sink *prev_sink = NULL;
struct dpcd_caps prev_dpcd_caps;
enum dc_connection_type new_connection_type = dc_connection_none;
+ enum dc_connection_type pre_connection_type = link->type;
const uint32_t post_oui_delay = 30; // 30ms
DC_LOGGER_INIT(link->ctx->logger);
@@ -957,6 +958,8 @@ static bool detect_link_and_local_sink(struct dc_link *link,
}
if (!detect_dp(link, &sink_caps, reason)) {
+ link->type = pre_connection_type;
+
if (prev_sink)
dc_sink_release(prev_sink);
return false;
@@ -1244,11 +1247,16 @@ bool link_detect(struct dc_link *link, enum dc_detect_reason reason)
bool is_delegated_to_mst_top_mgr = false;
enum dc_connection_type pre_link_type = link->type;
+ DC_LOGGER_INIT(link->ctx->logger);
+
is_local_sink_detect_success = detect_link_and_local_sink(link, reason);
if (is_local_sink_detect_success && link->local_sink)
verify_link_capability(link, link->local_sink, reason);
+ DC_LOG_DC("%s: link_index=%d is_local_sink_detect_success=%d pre_link_type=%d link_type=%d\n", __func__,
+ link->link_index, is_local_sink_detect_success, pre_link_type, link->type);
+
if (is_local_sink_detect_success && link->local_sink &&
dc_is_dp_signal(link->local_sink->sink_signal) &&
link->dpcd_caps.is_mst_capable)
The patch below does not apply to the 6.2-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.2.y
git checkout FETCH_HEAD
git cherry-pick -x 709671ffb15dcd1b4f6afe2a9d8c67c7c4ead4a1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '16793075944778(a)kroah.com' --subject-prefix 'PATCH 6.2.y' HEAD^..
Possible dependencies:
709671ffb15d ("drm/amd/display: Remove OTG DIV register write for Virtual signals.")
3b214bb7185d ("drm/amd/display: fix k1 k2 divider programming for phantom streams")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 709671ffb15dcd1b4f6afe2a9d8c67c7c4ead4a1 Mon Sep 17 00:00:00 2001
From: Saaem Rizvi <SyedSaaem.Rizvi(a)amd.com>
Date: Mon, 27 Feb 2023 18:55:07 -0500
Subject: [PATCH] drm/amd/display: Remove OTG DIV register write for Virtual
signals.
[WHY]
Hot plugging and then hot unplugging leads to k1 and k2 values to
change, as signal is detected as a virtual signal on hot unplug. Writing
these values to OTG_PIXEL_RATE_DIV register might cause primary display
to blank (known hw bug).
[HOW]
No longer write k1 and k2 values to register if signal is virtual, we
have safe guards in place in the case that k1 and k2 is unassigned so
that an unknown value is not written to the register either.
Cc: stable(a)vger.kernel.org
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Samson Tam <Samson.Tam(a)amd.com>
Reviewed-by: Alvin Lee <Alvin.Lee2(a)amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo(a)amd.com>
Signed-off-by: Saaem Rizvi <SyedSaaem.Rizvi(a)amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
index 16f892125b6f..9d14045cccd6 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -1104,7 +1104,7 @@ unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsign
*k2_div = PIXEL_RATE_DIV_BY_2;
else
*k2_div = PIXEL_RATE_DIV_BY_4;
- } else if (dc_is_dp_signal(stream->signal) || dc_is_virtual_signal(stream->signal)) {
+ } else if (dc_is_dp_signal(stream->signal)) {
if (two_pix_per_container) {
*k1_div = PIXEL_RATE_DIV_BY_1;
*k2_div = PIXEL_RATE_DIV_BY_2;
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 709671ffb15dcd1b4f6afe2a9d8c67c7c4ead4a1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679307593223218(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
709671ffb15d ("drm/amd/display: Remove OTG DIV register write for Virtual signals.")
3b214bb7185d ("drm/amd/display: fix k1 k2 divider programming for phantom streams")
368307cef69c ("drm/amd/display: Include virtual signal to set k1 and k2 values")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 709671ffb15dcd1b4f6afe2a9d8c67c7c4ead4a1 Mon Sep 17 00:00:00 2001
From: Saaem Rizvi <SyedSaaem.Rizvi(a)amd.com>
Date: Mon, 27 Feb 2023 18:55:07 -0500
Subject: [PATCH] drm/amd/display: Remove OTG DIV register write for Virtual
signals.
[WHY]
Hot plugging and then hot unplugging leads to k1 and k2 values to
change, as signal is detected as a virtual signal on hot unplug. Writing
these values to OTG_PIXEL_RATE_DIV register might cause primary display
to blank (known hw bug).
[HOW]
No longer write k1 and k2 values to register if signal is virtual, we
have safe guards in place in the case that k1 and k2 is unassigned so
that an unknown value is not written to the register either.
Cc: stable(a)vger.kernel.org
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Samson Tam <Samson.Tam(a)amd.com>
Reviewed-by: Alvin Lee <Alvin.Lee2(a)amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo(a)amd.com>
Signed-off-by: Saaem Rizvi <SyedSaaem.Rizvi(a)amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
index 16f892125b6f..9d14045cccd6 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -1104,7 +1104,7 @@ unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsign
*k2_div = PIXEL_RATE_DIV_BY_2;
else
*k2_div = PIXEL_RATE_DIV_BY_4;
- } else if (dc_is_dp_signal(stream->signal) || dc_is_virtual_signal(stream->signal)) {
+ } else if (dc_is_dp_signal(stream->signal)) {
if (two_pix_per_container) {
*k1_div = PIXEL_RATE_DIV_BY_1;
*k2_div = PIXEL_RATE_DIV_BY_2;
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 751281c55579f0cb0e56c9797d4663f689909681
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '1679307576136187(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
751281c55579 ("drm/amd/display: Write to correct dirty_rect")
30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 751281c55579f0cb0e56c9797d4663f689909681 Mon Sep 17 00:00:00 2001
From: Benjamin Cheng <ben(a)bcheng.me>
Date: Sun, 12 Mar 2023 20:47:39 -0400
Subject: [PATCH] drm/amd/display: Write to correct dirty_rect
When FB_DAMAGE_CLIPS are provided in a non-MPO scenario, the loop does
not use the counter i. This causes the fill_dc_dity_rect() to always
fill dirty_rects[0], causing graphical artifacts when a damage clip
aware DRM client sends more than 1 damage clip.
Instead, use the flip_addrs->dirty_rect_count which is incremented by
fill_dc_dirty_rect() on a successful fill.
Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support")
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2453
Signed-off-by: Benjamin Cheng <ben(a)bcheng.me>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org # 6.1.x
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 009ef917dad4..32abbafd43fa 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5105,9 +5105,9 @@ static void fill_dc_dirty_rects(struct drm_plane *plane,
for (; flip_addrs->dirty_rect_count < num_clips; clips++)
fill_dc_dirty_rect(new_plane_state->plane,
- &dirty_rects[i], clips->x1,
- clips->y1, clips->x2 - clips->x1,
- clips->y2 - clips->y1,
+ &dirty_rects[flip_addrs->dirty_rect_count],
+ clips->x1, clips->y1,
+ clips->x2 - clips->x1, clips->y2 - clips->y1,
&flip_addrs->dirty_rect_count,
false);
return;