October 2023 - Linux-stable-mirror

[net PATCH] leds: trigger: netdev: move size check in set_device_name

by Christian Marangi

GCC 13.2 complains about array subscript 17 is above array bounds of 'char[16]' with IFNAMSIZ set to 16. The warning is correct but this scenario is impossible. set_device_name is called by device_name_store (store sysfs entry) and netdev_trig_activate. device_name_store already check if size is >= of IFNAMSIZ and return -EINVAL. (making the warning scenario impossible) netdev_trig_activate works on already defined interface, where the name has already been checked and should already follow the condition of strlen() < IFNAMSIZ. Aside from the scenario being impossible, set_device_name can be improved to both mute the warning and make the function safer. To make it safer, move size check from device_name_store directly to set_device_name and prevent any out of bounds scenario. Cc: stable(a)vger.kernel.org Fixes: 28a6a2ef18ad ("leds: trigger: netdev: refactor code setting device name") Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202309192035.GTJEEbem-lkp@intel.com/ Signed-off-by: Christian Marangi <ansuelsmth(a)gmail.com> --- drivers/leds/trigger/ledtrig-netdev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c index 58f3352539e8..e358e77e4b38 100644 --- a/drivers/leds/trigger/ledtrig-netdev.c +++ b/drivers/leds/trigger/ledtrig-netdev.c @@ -221,6 +221,9 @@ static ssize_t device_name_show(struct device *dev, static int set_device_name(struct led_netdev_data *trigger_data, const char *name, size_t size) { + if (size >= IFNAMSIZ) + return -EINVAL; + cancel_delayed_work_sync(&trigger_data->work); mutex_lock(&trigger_data->lock); @@ -263,9 +266,6 @@ static ssize_t device_name_store(struct device *dev, struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev); int ret; - if (size >= IFNAMSIZ) - return -EINVAL; - ret = set_device_name(trigger_data, buf, size); if (ret < 0) -- 2.40.1

1 year, 4 months

2
1
0 0

[PATCH] sched/core: Fix wrong warning check in rq_clock_start_loop_update()

by Hao Jia

Igor Raits and Bagas Sanjaya report a RQCF_ACT_SKIP leak warning. Link: https://lore.kernel.org/all/a5dd536d-041a-2ce9-f4b7-64d8d85c86dc@gmail.com Commit ebb83d84e49b54 ("sched/core: Avoid multiple calling update_rq_clock() in __cfsb_csd_unthrottle()") add RQCF_ACT_SKIP leak warning in rq_clock_start_loop_update(). But this warning is inaccurate and may be triggered incorrectly in the following situations: CPU0 CPU1 __schedule() *rq->clock_update_flags <<= 1;* unregister_fair_sched_group() pick_next_task_fair+0x4a/0x410 destroy_cfs_bandwidth() newidle_balance+0x115/0x3e0 for_each_possible_cpu(i) *i=0* rq_unpin_lock(this_rq, rf) __cfsb_csd_unthrottle() raw_spin_rq_unlock(this_rq) rq_lock(*CPU0_rq*, &rf) rq_clock_start_loop_update() rq->clock_update_flags & RQCF_ACT_SKIP <-- raw_spin_rq_lock(this_rq) So we remove this wrong check. Add assert_clock_updated() to check that rq clock has been updated before calling rq_clock_start_loop_update(). And we cannot unconditionally set rq->clock_update_flags to RQCF_ACT_SKIP in rq_clock_start_loop_update(). So we use the variable rq_clock_flags in rq_clock_start_loop_update() to record the previous state of rq->clock_update_flags. Correspondingly, restore rq->clock_update_flags through rq_clock_flags in rq_clock_stop_loop_update() to prevent losing its previous information. Fixes: ebb83d84e49b ("sched/core: Avoid multiple calling update_rq_clock() in __cfsb_csd_unthrottle()") Cc: stable(a)vger.kernel.org Reported-by: Igor Raits <igor.raits(a)gmail.com> Reported-by: Bagas Sanjaya <bagasdotme(a)gmail.com> Signed-off-by: Hao Jia <jiahao.os(a)bytedance.com> --- kernel/sched/fair.c | 10 ++++++---- kernel/sched/sched.h | 12 +++++++----- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8dbff6e7ad4f..a64a002573d9 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5679,6 +5679,7 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq) #ifdef CONFIG_SMP static void __cfsb_csd_unthrottle(void *arg) { + unsigned int rq_clock_flags; struct cfs_rq *cursor, *tmp; struct rq *rq = arg; struct rq_flags rf; @@ -5691,7 +5692,7 @@ static void __cfsb_csd_unthrottle(void *arg) * Do it once and skip the potential next ones. */ update_rq_clock(rq); - rq_clock_start_loop_update(rq); + rq_clock_start_loop_update(rq, &rq_clock_flags); /* * Since we hold rq lock we're safe from concurrent manipulation of @@ -5712,7 +5713,7 @@ static void __cfsb_csd_unthrottle(void *arg) rcu_read_unlock(); - rq_clock_stop_loop_update(rq); + rq_clock_stop_loop_update(rq, &rq_clock_flags); rq_unlock(rq, &rf); } @@ -6230,6 +6231,7 @@ static void __maybe_unused update_runtime_enabled(struct rq *rq) /* cpu offline callback */ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq) { + unsigned int rq_clock_flags; struct task_group *tg; lockdep_assert_rq_held(rq); @@ -6239,7 +6241,7 @@ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq) * set_rq_offline(), so we should skip updating * the rq clock again in unthrottle_cfs_rq(). */ - rq_clock_start_loop_update(rq); + rq_clock_start_loop_update(rq, &rq_clock_flags); rcu_read_lock(); list_for_each_entry_rcu(tg, &task_groups, list) { @@ -6264,7 +6266,7 @@ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq) } rcu_read_unlock(); - rq_clock_stop_loop_update(rq); + rq_clock_stop_loop_update(rq, &rq_clock_flags); } bool cfs_task_bw_constrained(struct task_struct *p) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 04846272409c..ff2864f202f5 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -1558,20 +1558,22 @@ static inline void rq_clock_cancel_skipupdate(struct rq *rq) * when using list_for_each_entry_*) * rq_clock_start_loop_update() can be called after updating the clock * once and before iterating over the list to prevent multiple update. + * And use @rq_clock_flags to record the previous state of rq->clock_update_flags. * After the iterative traversal, we need to call rq_clock_stop_loop_update() - * to clear RQCF_ACT_SKIP of rq->clock_update_flags. + * to restore rq->clock_update_flags through @rq_clock_flags. */ -static inline void rq_clock_start_loop_update(struct rq *rq) +static inline void rq_clock_start_loop_update(struct rq *rq, unsigned int *rq_clock_flags) { lockdep_assert_rq_held(rq); - SCHED_WARN_ON(rq->clock_update_flags & RQCF_ACT_SKIP); + assert_clock_updated(rq); + *rq_clock_flags = rq->clock_update_flags; rq->clock_update_flags |= RQCF_ACT_SKIP; } -static inline void rq_clock_stop_loop_update(struct rq *rq) +static inline void rq_clock_stop_loop_update(struct rq *rq, unsigned int *rq_clock_flags) { lockdep_assert_rq_held(rq); - rq->clock_update_flags &= ~RQCF_ACT_SKIP; + rq->clock_update_flags = *rq_clock_flags; } struct rq_flags { -- 2.39.2

1 year, 4 months

2
4
0 0

[PATCH] drm: Do not overrun array in drm_gem_get_pages()

by Matthew Wilcox (Oracle)

If the shared memory object is larger than the DRM object that it backs, we can overrun the page array. Limit the number of pages we install from each folio to prevent this. Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reported-by: Oleksandr Natalenko <oleksandr(a)natalenko.name> Tested-by: Oleksandr Natalenko <oleksandr(a)natalenko.name> Link: https://lore.kernel.org/lkml/13360591.uLZWGnKmhe@natalenko.name/ Fixes: 3291e09a4638 ("drm: convert drm_gem_put_pages() to use a folio_batch") Cc: stable(a)vger.kernel.org # 6.5.x --- drivers/gpu/drm/drm_gem.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 6129b89bb366..44a948b80ee1 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -540,7 +540,7 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj) struct page **pages; struct folio *folio; struct folio_batch fbatch; - int i, j, npages; + long i, j, npages; if (WARN_ON(!obj->filp)) return ERR_PTR(-EINVAL); @@ -564,11 +564,13 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj) i = 0; while (i < npages) { + long nr; folio = shmem_read_folio_gfp(mapping, i, mapping_gfp_mask(mapping)); if (IS_ERR(folio)) goto fail; - for (j = 0; j < folio_nr_pages(folio); j++, i++) + nr = min(npages - i, folio_nr_pages(folio)); + for (j = 0; j < nr; j++, i++) pages[i] = folio_file_page(folio, i); /* Make sure shmem keeps __GFP_DMA32 allocated pages in the -- 2.40.1

1 year, 4 months

3
2
0 0

[PATCH net] net: davicom: dm9000: dm9000_phy_write(): fix deadlock during netdev watchdog handling

by Marc Kleine-Budde

The dm9000 takes the db->lock spin lock in dm9000_timeout() and calls into dm9000_init_dm9000(). For the DM9000B the PHY is reset with dm9000_phy_write(). That function again takes the db->lock spin lock, which results in a deadlock. For reference the backtrace: | [<c0425050>] (rt_spin_lock_slowlock_locked) from [<c0425100>] (rt_spin_lock_slowlock+0x60/0xc4) | [<c0425100>] (rt_spin_lock_slowlock) from [<c02e1174>] (dm9000_phy_write+0x2c/0x1a4) | [<c02e1174>] (dm9000_phy_write) from [<c02e16b0>] (dm9000_init_dm9000+0x288/0x2a4) | [<c02e16b0>] (dm9000_init_dm9000) from [<c02e1724>] (dm9000_timeout+0x58/0xd4) | [<c02e1724>] (dm9000_timeout) from [<c036f298>] (dev_watchdog+0x258/0x2a8) | [<c036f298>] (dev_watchdog) from [<c0068168>] (call_timer_fn+0x20/0x88) | [<c0068168>] (call_timer_fn) from [<c00687c8>] (expire_timers+0xf0/0x194) | [<c00687c8>] (expire_timers) from [<c0068920>] (run_timer_softirq+0xb4/0x25c) | [<c0068920>] (run_timer_softirq) from [<c0021a30>] (do_current_softirqs+0x16c/0x228) | [<c0021a30>] (do_current_softirqs) from [<c0021b14>] (run_ksoftirqd+0x28/0x4c) | [<c0021b14>] (run_ksoftirqd) from [<c0040488>] (smpboot_thread_fn+0x278/0x290) | [<c0040488>] (smpboot_thread_fn) from [<c003c28c>] (kthread+0x124/0x164) | [<c003c28c>] (kthread) from [<c00090f0>] (ret_from_fork+0x14/0x24) To workaround similar problem (take mutex inside spin lock ) , a "in_timeout" variable was added in 582379839bbd ("dm9000: avoid sleeping in dm9000_timeout callback"). Use this variable and not take the spin lock inside dm9000_phy_write() if in_timeout is true. Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> --- During the netdev watchdog handling the dm9000 driver takes the same spin lock twice. Avoid this by extending an existing workaround. --- drivers/net/ethernet/davicom/dm9000.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c index 05a89ab6766c..3a056a54aaf9 100644 --- a/drivers/net/ethernet/davicom/dm9000.c +++ b/drivers/net/ethernet/davicom/dm9000.c @@ -325,10 +325,10 @@ dm9000_phy_write(struct net_device *dev, unsigned long reg_save; dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value); - if (!db->in_timeout) + if (!db->in_timeout) { mutex_lock(&db->addr_lock); - - spin_lock_irqsave(&db->lock, flags); + spin_lock_irqsave(&db->lock, flags); + } /* Save previous register address */ reg_save = readb(db->io_addr); @@ -344,11 +344,13 @@ dm9000_phy_write(struct net_device *dev, iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW); writeb(reg_save, db->io_addr); - spin_unlock_irqrestore(&db->lock, flags); + if (!db->in_timeout) + spin_unlock_irqrestore(&db->lock, flags); dm9000_msleep(db, 1); /* Wait write complete */ - spin_lock_irqsave(&db->lock, flags); + if (!db->in_timeout) + spin_lock_irqsave(&db->lock, flags); reg_save = readb(db->io_addr); iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */ @@ -356,9 +358,10 @@ dm9000_phy_write(struct net_device *dev, /* restore the previous address */ writeb(reg_save, db->io_addr); - spin_unlock_irqrestore(&db->lock, flags); - if (!db->in_timeout) + if (!db->in_timeout) { + spin_unlock_irqrestore(&db->lock, flags); mutex_unlock(&db->addr_lock); + } } /* dm9000_set_io --- base-commit: 776fe19953b0e0af00399e50fb3b205101d4b3c1 change-id: 20231010-dm9000-fix-deadlock-ffb1e5295ee1 Best regards, -- Marc Kleine-Budde <mkl(a)pengutronix.de>

1 year, 4 months

3
4
0 0

[PATCH] KEYS: trusted: Rollback init_trusted() consistently

by Jarkko Sakkinen

Do bind neither static calls nor trusted_key_exit() before a successful init, in order to maintain a consistent state. In addition, depart the init_trusted() in the case of a real error (i.e. getting back something else than -ENODEV). Reported-by: Linus Torvalds <torvalds(a)linux-foundation.org> Closes: https://lore.kernel.org/linux-integrity/CAHk-=whOPoLaWM8S8GgoOPT7a2+nMH5h3T… Cc: stable(a)vger.kernel.org # v5.13+ Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework") Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- security/keys/trusted-keys/trusted_core.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c index 85fb5c22529a..fee1ab2c734d 100644 --- a/security/keys/trusted-keys/trusted_core.c +++ b/security/keys/trusted-keys/trusted_core.c @@ -358,17 +358,17 @@ static int __init init_trusted(void) if (!get_random) get_random = kernel_get_random; - static_call_update(trusted_key_seal, - trusted_key_sources[i].ops->seal); - static_call_update(trusted_key_unseal, - trusted_key_sources[i].ops->unseal); - static_call_update(trusted_key_get_random, - get_random); - trusted_key_exit = trusted_key_sources[i].ops->exit; - migratable = trusted_key_sources[i].ops->migratable; - ret = trusted_key_sources[i].ops->init(); - if (!ret) + if (!ret) { + static_call_update(trusted_key_seal, trusted_key_sources[i].ops->seal); + static_call_update(trusted_key_unseal, trusted_key_sources[i].ops->unseal); + static_call_update(trusted_key_get_random, get_random); + + trusted_key_exit = trusted_key_sources[i].ops->exit; + migratable = trusted_key_sources[i].ops->migratable; + } + + if (!ret || ret != -ENODEV) break; } -- 2.39.2

1 year, 4 months

2
12
0 0

Re: Empowerment Grant

by IN FO

Final Notice: Congratulations!!! You are among the 50 beneficiaries of 2023 IMF-UN-World Bank Grant. Reconfirm if this email id is active for more details Regards, Mrs. Oliva Pathe Communication Secretary

1 year, 4 months

1
0
0 0

FAILED: patch "[PATCH] ata: libata-scsi: Disable scsi device" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x aa3998dbeb3abce63653b7f6d4542e7dcd022590 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023100752-margarita-unbuckled-133f@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") 3cc2ffe5c16d ("scsi: sd: Differentiate system and runtime start/stop management") 4b3d6e0c6c4c ("Merge tag 'ata-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From aa3998dbeb3abce63653b7f6d4542e7dcd022590 Mon Sep 17 00:00:00 2001 From: Damien Le Moal <dlemoal(a)kernel.org> Date: Sat, 26 Aug 2023 09:43:39 +0900 Subject: [PATCH] ata: libata-scsi: Disable scsi device manage_system_start_stop The introduction of a device link to create a consumer/supplier relationship between the scsi device of an ATA device and the ATA port of that ATA device fixes the ordering of system suspend and resume operations. For suspend, the scsi device is suspended first and the ata port after it. This is fine as this allows the synchronize cache and START STOP UNIT commands issued by the scsi disk driver to be executed before the ata port is disabled. For resume operations, the ata port is resumed first, followed by the scsi device. This allows having the request queue of the scsi device to be unfrozen after the ata port resume is scheduled in EH, thus avoiding to see new requests prematurely issued to the ATA device. Since libata sets manage_system_start_stop to 1, the scsi disk resume operation also results in issuing a START STOP UNIT command to the device being resumed so that the device exits standby power mode. However, restoring the ATA device to the active power mode must be synchronized with libata EH processing of the port resume operation to avoid either 1) seeing the start stop unit command being received too early when the port is not yet resumed and ready to accept commands, or after the port resume process issues commands such as IDENTIFY to revalidate the device. In this last case, the risk is that the device revalidation fails with timeout errors as the drive is still spun down. Commit 0a8589055936 ("ata,scsi: do not issue START STOP UNIT on resume") disabled issuing the START STOP UNIT command to avoid issues with it. But this is incorrect as transitioning a device to the active power mode from the standby power mode set on suspend requires a media access command. The IDENTIFY, READ LOG and SET FEATURES commands executed in libata EH context triggered by the ata port resume operation may thus fail. Fix these synchronization issues is by handling a device power mode transitions for system suspend and resume directly in libata EH context, without relying on the scsi disk driver management triggered with the manage_system_start_stop flag. To do this, the following libata helper functions are introduced: 1) ata_dev_power_set_standby(): This function issues a STANDBY IMMEDIATE command to transitiom a device to the standby power mode. For HDDs, this spins down the disks. This function applies only to ATA and ZAC devices and does nothing otherwise. This function also does nothing for devices that have the ATA_FLAG_NO_POWEROFF_SPINDOWN or ATA_FLAG_NO_HIBERNATE_SPINDOWN flag set. For suspend, call ata_dev_power_set_standby() in ata_eh_handle_port_suspend() before the port is disabled and frozen. ata_eh_unload() is also modified to transition all enabled devices to the standby power mode when the system is shutdown or devices removed. 2) ata_dev_power_set_active() and This function applies to ATA or ZAC devices and issues a VERIFY command for 1 sector at LBA 0 to transition the device to the active power mode. For HDDs, since this function will complete only once the disk spin up. Its execution uses the same timeouts as for reset, to give the drive enough time to complete spinup without triggering a command timeout. For resume, call ata_dev_power_set_active() in ata_eh_revalidate_and_attach() after the port has been enabled and before any other command is issued to the device. With these changes, the manage_system_start_stop and no_start_on_resume scsi device flags do not need to be set in ata_scsi_dev_config(). The flag manage_runtime_start_stop is still set to allow the sd driver to spinup/spindown a disk through the sd runtime operations. Fixes: 0a8589055936 ("ata,scsi: do not issue START STOP UNIT on resume") Cc: stable(a)vger.kernel.org Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Tested-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Reviewed-by: Martin K. Petersen <martin.petersen(a)oracle.com> diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 8e35afe5e560..a0bc01606b30 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -1972,6 +1972,96 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class, return rc; } +/** + * ata_dev_power_set_standby - Set a device power mode to standby + * @dev: target device + * + * Issue a STANDBY IMMEDIATE command to set a device power mode to standby. + * For an HDD device, this spins down the disks. + * + * LOCKING: + * Kernel thread context (may sleep). + */ +void ata_dev_power_set_standby(struct ata_device *dev) +{ + unsigned long ap_flags = dev->link->ap->flags; + struct ata_taskfile tf; + unsigned int err_mask; + + /* Issue STANDBY IMMEDIATE command only if supported by the device */ + if (dev->class != ATA_DEV_ATA && dev->class != ATA_DEV_ZAC) + return; + + /* + * Some odd clown BIOSes issue spindown on power off (ACPI S4 or S5) + * causing some drives to spin up and down again. For these, do nothing + * if we are being called on shutdown. + */ + if ((ap_flags & ATA_FLAG_NO_POWEROFF_SPINDOWN) && + system_state == SYSTEM_POWER_OFF) + return; + + if ((ap_flags & ATA_FLAG_NO_HIBERNATE_SPINDOWN) && + system_entering_hibernation()) + return; + + ata_tf_init(dev, &tf); + tf.flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR; + tf.protocol = ATA_PROT_NODATA; + tf.command = ATA_CMD_STANDBYNOW1; + + ata_dev_notice(dev, "Entering standby power mode\n"); + + err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); + if (err_mask) + ata_dev_err(dev, "STANDBY IMMEDIATE failed (err_mask=0x%x)\n", + err_mask); +} + +/** + * ata_dev_power_set_active - Set a device power mode to active + * @dev: target device + * + * Issue a VERIFY command to enter to ensure that the device is in the + * active power mode. For a spun-down HDD (standby or idle power mode), + * the VERIFY command will complete after the disk spins up. + * + * LOCKING: + * Kernel thread context (may sleep). + */ +void ata_dev_power_set_active(struct ata_device *dev) +{ + struct ata_taskfile tf; + unsigned int err_mask; + + /* + * Issue READ VERIFY SECTORS command for 1 sector at lba=0 only + * if supported by the device. + */ + if (dev->class != ATA_DEV_ATA && dev->class != ATA_DEV_ZAC) + return; + + ata_tf_init(dev, &tf); + tf.flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR; + tf.protocol = ATA_PROT_NODATA; + tf.command = ATA_CMD_VERIFY; + tf.nsect = 1; + if (dev->flags & ATA_DFLAG_LBA) { + tf.flags |= ATA_TFLAG_LBA; + tf.device |= ATA_LBA; + } else { + /* CHS */ + tf.lbal = 0x1; /* sect */ + } + + ata_dev_notice(dev, "Entering active power mode\n"); + + err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); + if (err_mask) + ata_dev_err(dev, "VERIFY failed (err_mask=0x%x)\n", + err_mask); +} + /** * ata_read_log_page - read a specific log page * @dev: target device diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c index 4cf4f57e57b8..b1b2c276371e 100644 --- a/drivers/ata/libata-eh.c +++ b/drivers/ata/libata-eh.c @@ -147,6 +147,8 @@ ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = { .timeouts = ata_eh_other_timeouts, }, { .commands = CMDS(ATA_CMD_FLUSH, ATA_CMD_FLUSH_EXT), .timeouts = ata_eh_flush_timeouts }, + { .commands = CMDS(ATA_CMD_VERIFY), + .timeouts = ata_eh_reset_timeouts }, }; #undef CMDS @@ -498,7 +500,19 @@ static void ata_eh_unload(struct ata_port *ap) struct ata_device *dev; unsigned long flags; - /* Restore SControl IPM and SPD for the next driver and + /* + * Unless we are restarting, transition all enabled devices to + * standby power mode. + */ + if (system_state != SYSTEM_RESTART) { + ata_for_each_link(link, ap, PMP_FIRST) { + ata_for_each_dev(dev, link, ENABLED) + ata_dev_power_set_standby(dev); + } + } + + /* + * Restore SControl IPM and SPD for the next driver and * disable attached devices. */ ata_for_each_link(link, ap, PMP_FIRST) { @@ -684,6 +698,10 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap) ehc->saved_xfer_mode[devno] = dev->xfer_mode; if (ata_ncq_enabled(dev)) ehc->saved_ncq_enabled |= 1 << devno; + + /* If we are resuming, wake up the device */ + if (ap->pflags & ATA_PFLAG_RESUMING) + ehc->i.dev_action[devno] |= ATA_EH_SET_ACTIVE; } } @@ -743,6 +761,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap) /* clean up */ spin_lock_irqsave(ap->lock, flags); + ap->pflags &= ~ATA_PFLAG_RESUMING; + if (ap->pflags & ATA_PFLAG_LOADING) ap->pflags &= ~ATA_PFLAG_LOADING; else if ((ap->pflags & ATA_PFLAG_SCSI_HOTPLUG) && @@ -1218,6 +1238,13 @@ void ata_eh_detach_dev(struct ata_device *dev) struct ata_eh_context *ehc = &link->eh_context; unsigned long flags; + /* + * If the device is still enabled, transition it to standby power mode + * (i.e. spin down HDDs). + */ + if (ata_dev_enabled(dev)) + ata_dev_power_set_standby(dev); + ata_dev_disable(dev); spin_lock_irqsave(ap->lock, flags); @@ -3016,6 +3043,15 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link, if (ehc->i.flags & ATA_EHI_DID_RESET) readid_flags |= ATA_READID_POSTRESET; + /* + * When resuming, before executing any command, make sure to + * transition the device to the active power mode. + */ + if ((action & ATA_EH_SET_ACTIVE) && ata_dev_enabled(dev)) { + ata_dev_power_set_active(dev); + ata_eh_done(link, dev, ATA_EH_SET_ACTIVE); + } + if ((action & ATA_EH_REVALIDATE) && ata_dev_enabled(dev)) { WARN_ON(dev->class == ATA_DEV_PMP); @@ -3989,6 +4025,7 @@ static void ata_eh_handle_port_suspend(struct ata_port *ap) unsigned long flags; int rc = 0; struct ata_device *dev; + struct ata_link *link; /* are we suspending? */ spin_lock_irqsave(ap->lock, flags); @@ -4001,6 +4038,12 @@ static void ata_eh_handle_port_suspend(struct ata_port *ap) WARN_ON(ap->pflags & ATA_PFLAG_SUSPENDED); + /* Set all devices attached to the port in standby mode */ + ata_for_each_link(link, ap, HOST_FIRST) { + ata_for_each_dev(dev, link, ENABLED) + ata_dev_power_set_standby(dev); + } + /* * If we have a ZPODD attached, check its zero * power ready status before the port is frozen. @@ -4083,6 +4126,7 @@ static void ata_eh_handle_port_resume(struct ata_port *ap) /* update the flags */ spin_lock_irqsave(ap->lock, flags); ap->pflags &= ~(ATA_PFLAG_PM_PENDING | ATA_PFLAG_SUSPENDED); + ap->pflags |= ATA_PFLAG_RESUMING; spin_unlock_irqrestore(ap->lock, flags); } #endif /* CONFIG_PM */ diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index 73428ad0c8d2..a0e58d22d222 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -1050,15 +1050,13 @@ int ata_scsi_dev_config(struct scsi_device *sdev, struct ata_device *dev) } } else { sdev->sector_size = ata_id_logical_sector_size(dev->id); + /* - * Stop the drive on suspend but do not issue START STOP UNIT - * on resume as this is not necessary and may fail: the device - * will be woken up by ata_port_pm_resume() with a port reset - * and device revalidation. + * Ask the sd driver to issue START STOP UNIT on runtime suspend + * and resume only. For system level suspend/resume, devices + * power state is handled directly by libata EH. */ - sdev->manage_system_start_stop = true; sdev->manage_runtime_start_stop = true; - sdev->no_start_on_resume = 1; } /* @@ -1231,7 +1229,7 @@ static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc) } if (cdb[4] & 0x1) { - tf->nsect = 1; /* 1 sector, lba=0 */ + tf->nsect = 1; /* 1 sector, lba=0 */ if (qc->dev->flags & ATA_DFLAG_LBA) { tf->flags |= ATA_TFLAG_LBA; @@ -1247,7 +1245,7 @@ static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc) tf->lbah = 0x0; /* cyl high */ } - tf->command = ATA_CMD_VERIFY; /* READ VERIFY */ + tf->command = ATA_CMD_VERIFY; /* READ VERIFY */ } else { /* Some odd clown BIOSen issue spindown on power off (ACPI S4 * or S5) causing some drives to spin up and down again. @@ -1257,7 +1255,7 @@ static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc) goto skip; if ((qc->ap->flags & ATA_FLAG_NO_HIBERNATE_SPINDOWN) && - system_entering_hibernation()) + system_entering_hibernation()) goto skip; /* Issue ATA STANDBY IMMEDIATE command */ diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h index 6e7d352803bd..820299bd9d06 100644 --- a/drivers/ata/libata.h +++ b/drivers/ata/libata.h @@ -60,6 +60,8 @@ extern int ata_dev_reread_id(struct ata_device *dev, unsigned int readid_flags); extern int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class, unsigned int readid_flags); extern int ata_dev_configure(struct ata_device *dev); +extern void ata_dev_power_set_standby(struct ata_device *dev); +extern void ata_dev_power_set_active(struct ata_device *dev); extern int sata_down_spd_limit(struct ata_link *link, u32 spd_limit); extern int ata_down_xfermask_limit(struct ata_device *dev, unsigned int sel); extern unsigned int ata_dev_set_feature(struct ata_device *dev, diff --git a/include/linux/libata.h b/include/linux/libata.h index 3ce1ab408114..2a7d2af0ed80 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h @@ -192,6 +192,7 @@ enum { ATA_PFLAG_UNLOADING = (1 << 9), /* driver is being unloaded */ ATA_PFLAG_UNLOADED = (1 << 10), /* driver is unloaded */ + ATA_PFLAG_RESUMING = (1 << 16), /* port is being resumed */ ATA_PFLAG_SUSPENDED = (1 << 17), /* port is suspended (power) */ ATA_PFLAG_PM_PENDING = (1 << 18), /* PM operation pending */ ATA_PFLAG_INIT_GTM_VALID = (1 << 19), /* initial gtm data valid */ @@ -318,9 +319,10 @@ enum { ATA_EH_ENABLE_LINK = (1 << 3), ATA_EH_PARK = (1 << 5), /* unload heads and stop I/O */ ATA_EH_GET_SUCCESS_SENSE = (1 << 6), /* Get sense data for successful cmd */ + ATA_EH_SET_ACTIVE = (1 << 7), /* Set a device to active power mode */ ATA_EH_PERDEV_MASK = ATA_EH_REVALIDATE | ATA_EH_PARK | - ATA_EH_GET_SUCCESS_SENSE, + ATA_EH_GET_SUCCESS_SENSE | ATA_EH_SET_ACTIVE, ATA_EH_ALL_ACTIONS = ATA_EH_REVALIDATE | ATA_EH_RESET | ATA_EH_ENABLE_LINK, @@ -357,7 +359,7 @@ enum { /* This should match the actual table size of * ata_eh_cmd_timeout_table in libata-eh.c. */ - ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7, + ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 8, /* Horkage types. May be set by libata or controller on drives (some horkage may be drive/controller pair dependent */

1 year, 4 months

2
1
0 0

Linux 6.1.57

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.57 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/arm64/silicon-errata.rst | 2 Documentation/networking/ip-sysctl.rst | 8 Makefile | 2 arch/arm64/Kconfig | 13 arch/arm64/include/asm/cpufeature.h | 8 arch/arm64/include/asm/cputype.h | 2 arch/arm64/kernel/cpu_errata.c | 8 arch/arm64/kernel/cpufeature.c | 3 arch/arm64/kernel/entry.S | 4 arch/arm64/tools/cpucaps | 1 arch/arm64/tools/sysreg | 6 arch/parisc/include/asm/ldcw.h | 36 - arch/parisc/include/asm/spinlock_types.h | 5 arch/parisc/kernel/smp.c | 4 arch/x86/events/amd/core.c | 24 arch/x86/kernel/sev-shared.c | 69 ++ block/blk-sysfs.c | 3 drivers/ata/libata-core.c | 16 drivers/ata/libata-scsi.c | 43 - drivers/base/regmap/regcache-rbtree.c | 3 drivers/block/rbd.c | 412 ++++++++-------- drivers/firewire/sbp2.c | 9 drivers/gpio/gpio-aspeed.c | 2 drivers/gpio/gpio-pxa.c | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 93 +++ drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 41 - drivers/hid/hid-sony.c | 2 drivers/hid/intel-ish-hid/ipc/pci-ish.c | 8 drivers/hwmon/nzxt-smart2.c | 2 drivers/idle/intel_idle.c | 2 drivers/infiniband/core/cma.c | 2 drivers/infiniband/core/cma_configfs.c | 2 drivers/infiniband/core/nldev.c | 1 drivers/infiniband/core/uverbs_main.c | 2 drivers/infiniband/hw/mlx4/sysfs.c | 2 drivers/infiniband/hw/mlx5/fs.c | 2 drivers/infiniband/hw/mlx5/main.c | 2 drivers/infiniband/sw/siw/siw_cm.c | 16 drivers/infiniband/ulp/srp/ib_srp.c | 16 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 18 drivers/iommu/intel/iommu.c | 16 drivers/iommu/intel/iommu.h | 2 drivers/iommu/mtk_iommu.c | 9 drivers/leds/led-core.c | 4 drivers/md/dm-zoned-target.c | 15 drivers/md/raid5.c | 7 drivers/mtd/ubi/build.c | 7 drivers/net/dsa/mv88e6xxx/chip.c | 6 drivers/net/dsa/mv88e6xxx/global1.c | 31 - drivers/net/dsa/mv88e6xxx/global1.h | 1 drivers/net/dsa/mv88e6xxx/global2.c | 2 drivers/net/dsa/mv88e6xxx/global2.h | 1 drivers/net/ethernet/ibm/ibmveth.c | 25 drivers/net/ethernet/intel/i40e/i40e_ptp.c | 4 drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 drivers/net/ethernet/qlogic/qed/qed_ll2.h | 2 drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c | 7 drivers/net/ethernet/ti/am65-cpsw-nuss.c | 1 drivers/net/usb/smsc75xx.c | 4 drivers/net/vrf.c | 12 drivers/net/vxlan/vxlan_core.c | 4 drivers/net/wan/fsl_ucc_hdlc.c | 12 drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 6 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 drivers/net/wireless/marvell/mwifiex/sta_rx.c | 16 drivers/net/wireless/mediatek/mt76/mt76x02_eeprom.c | 7 drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c | 13 drivers/of/dynamic.c | 6 drivers/pci/controller/dwc/pcie-qcom.c | 4 drivers/ptp/ptp_ocp.c | 1 drivers/regulator/core.c | 4 drivers/regulator/mt6358-regulator.c | 153 ++--- drivers/s390/scsi/zfcp_aux.c | 9 drivers/scsi/aacraid/commsup.c | 2 drivers/scsi/mvumi.c | 2 drivers/scsi/scsi_lib.c | 2 drivers/scsi/scsi_priv.h | 1 drivers/scsi/scsi_scan.c | 20 drivers/scsi/scsi_sysfs.c | 4 drivers/scsi/sd.c | 110 +++- drivers/scsi/sd.h | 1 drivers/scsi/smartpqi/smartpqi_init.c | 2 drivers/scsi/storvsc_drv.c | 2 drivers/scsi/virtio_scsi.c | 2 drivers/spi/spi-zynqmp-gqspi.c | 12 drivers/target/target_core_device.c | 11 drivers/vhost/vringh.c | 12 drivers/xen/events/events_base.c | 87 +-- fs/btrfs/ctree.h | 28 - fs/btrfs/dir-item.c | 50 - fs/btrfs/file.c | 16 fs/btrfs/inode-item.c | 73 +- fs/btrfs/inode-item.h | 20 fs/btrfs/inode.c | 267 ++++++---- fs/btrfs/ioctl.c | 7 fs/btrfs/root-tree.c | 19 fs/btrfs/send.c | 12 fs/btrfs/super.c | 3 fs/btrfs/transaction.c | 40 + fs/btrfs/tree-log.c | 279 +++++----- fs/btrfs/tree-log.h | 4 fs/erofs/decompressor_lzma.c | 5 fs/nfs/nfs4proc.c | 10 fs/nfs/nfs4state.c | 47 + fs/nfs/sysfs.c | 16 fs/smb/client/connect.c | 10 fs/smb/server/connection.c | 2 fs/smb/server/connection.h | 1 fs/smb/server/mgmt/user_session.c | 10 fs/smb/server/smb2pdu.c | 4 include/linux/bpf.h | 2 include/linux/ipv6.h | 1 include/linux/mm.h | 2 include/linux/netfilter/nf_conntrack_sctp.h | 1 include/linux/regulator/mt6358-regulator.h | 4 include/net/arp.h | 8 include/net/cfg80211.h | 99 +++ include/net/ndisc.h | 12 include/net/neighbour.h | 10 include/net/netlink.h | 21 include/net/nexthop.h | 23 include/net/tcp.h | 6 include/scsi/scsi_device.h | 6 include/scsi/scsi_host.h | 2 include/uapi/linux/bpf.h | 6 include/uapi/linux/ipv6.h | 1 kernel/trace/ring_buffer.c | 32 - mm/memory.c | 10 mm/mempolicy.c | 122 ++-- mm/page_alloc.c | 138 ++--- net/bluetooth/hci_core.c | 1 net/bluetooth/hci_event.c | 1 net/bluetooth/hci_request.h | 2 net/bluetooth/hci_sync.c | 14 net/bluetooth/iso.c | 9 net/bridge/br_arp_nd_proxy.c | 4 net/bridge/br_netfilter_hooks.c | 5 net/core/filter.c | 59 +- net/core/neighbour.c | 106 ++-- net/core/sock_map.c | 4 net/ipv4/arp.c | 8 net/ipv4/fib_semantics.c | 8 net/ipv4/ip_output.c | 6 net/ipv4/nexthop.c | 12 net/ipv4/route.c | 8 net/ipv4/tcp.c | 10 net/ipv4/tcp_bpf.c | 4 net/ipv4/tcp_input.c | 13 net/ipv4/tcp_output.c | 7 net/ipv6/addrconf.c | 27 - net/ipv6/ip6_fib.c | 16 net/ipv6/ip6_output.c | 12 net/ipv6/ndisc.c | 17 net/ipv6/route.c | 22 net/ipv6/tcp_ipv6.c | 10 net/l2tp/l2tp_ip6.c | 2 net/mac80211/cfg.c | 3 net/mac80211/key.c | 2 net/mptcp/pm_netlink.c | 2 net/mptcp/pm_userspace.c | 6 net/mptcp/protocol.c | 177 ++++-- net/mptcp/protocol.h | 24 net/mptcp/subflow.c | 41 - net/netfilter/ipvs/ip_vs_sync.c | 4 net/netfilter/nf_conntrack_proto_sctp.c | 43 + net/netfilter/nf_tables_api.c | 44 + net/netfilter/nft_set_rbtree.c | 46 + net/netlink/af_netlink.c | 37 - net/nfc/llcp_core.c | 2 net/rds/tcp_connect.c | 2 net/sctp/associola.c | 3 net/sctp/socket.c | 1 net/socket.c | 29 - net/tipc/crypto.c | 4 net/wireless/core.c | 150 +++++ net/wireless/core.h | 14 net/wireless/nl80211.c | 93 ++- net/wireless/sme.c | 4 net/wireless/sysfs.c | 8 scripts/mod/file2alias.c | 2 security/integrity/ima/Kconfig | 22 sound/soc/soc-utils.c | 1 sound/soc/tegra/tegra_audio_graph_card.c | 30 - tools/include/uapi/linux/bpf.h | 6 tools/testing/selftests/netfilter/.gitignore | 1 tools/testing/selftests/netfilter/Makefile | 4 tools/testing/selftests/netfilter/audit_logread.c | 165 ++++++ tools/testing/selftests/netfilter/config | 1 tools/testing/selftests/netfilter/nft_audit.sh | 193 +++++++ 191 files changed, 2867 insertions(+), 1681 deletions(-) Aleksandr Mezin (1): hwmon: (nzxt-smart2) add another USB ID Alexandra Diupina (1): drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() Arnd Bergmann (2): wifi: iwlwifi: dbg_ini: fix structure packing ima: rework CONFIG_IMA dependency block Artem Bityutskiy (1): intel_idle: add Emerald Rapids Xeon support Bart Van Assche (2): scsi: core: Improve type safety of scsi_rescan_device() RDMA/srp: Do not call scsi_done() from srp_abort() Bartosz Golaszewski (1): gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() Ben Wolsieffer (1): net: stmmac: dwmac-stm32: fix resume on STM32 MCU Benjamin Coddington (3): NFS: Cleanup unused rpc_clnt variable NFS: rename nfs_client_kset to nfs_kset Revert "NFSv4: Retry LOCK on OLD_STATEID during delegation return" Benjamin Poirier (1): ipv4: Set offload_failed flag in fibmatch results Bernard Metzler (1): RDMA/siw: Fix connection failure handling Bernd Schubert (1): btrfs: file_remove_privs needs an exclusive lock in direct io write Breno Leitao (1): perf/x86/amd: Do not WARN() on every IRQ Chen-Yu Tsai (3): regulator: mt6358: Drop *_SSHUB regulators regulator: mt6358: Use linear voltage helpers for single range regulators regulator: mt6358: split ops for buck and linear range LDO regulators Chengfeng Ye (1): tipc: fix a potential deadlock on &tx->lock Christian Marangi (1): net: ethernet: mediatek: disable irq before schedule napi Christophe JAILLET (4): HID: sony: Fix a potential memory leak in sony_probe() wifi: iwlwifi: mvm: Fix a memory corruption issue IB/mlx4: Fix the size of a buffer in add_port_entries() btrfs: fix an error handling path in btrfs_rename() Damien Le Moal (5): ata,scsi: do not issue START STOP UNIT on resume scsi: sd: Differentiate system and runtime start/stop management scsi: sd: Do not issue commands to suspended disks on shutdown scsi: Do not attempt to rescan suspended devices ata: libata-scsi: Fix delayed scsi_rescan_device() execution Dan Carpenter (2): net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns() of: dynamic: Fix potential memory leak in of_changeset_action() David Howells (1): ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() David Jeffery (1): md/raid5: release batch_last before waiting for another stripe_head David Wilder (1): ibmveth: Remove condition to recompute TCP header checksum. Dinghao Liu (2): scsi: zfcp: Fix a double put in zfcp_port_enqueue() ptp: ocp: Fix error handling in ptp_ocp_device_init Duje Mihanović (1): gpio: pxa: disable pinctrl calls for MMP_GPIO Eric Dumazet (8): mptcp: annotate lockless accesses to sk->sk_err net: fix possible store tearing in neigh_periodic_work() neighbour: annotate lockless accesses to n->nud_state neighbour: switch to standard rcu, instead of rcu_bh neighbour: fix data-races around n->output netlink: annotate data-races around sk->sk_err ipv6: remove nexthop_fib6_nh_bh() ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh() Fabio Estevam (1): net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent Fedor Pchelkin (1): dm zoned: free dmz->ddev array in dmz_put_zoned_devices Felix Fietkau (1): wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling Filipe Manana (1): btrfs: fix fscrypt name leak after failure to join log transaction Florian Westphal (1): netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure Gabriel Krisman Bertazi (1): arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault path Gao Xiang (1): erofs: fix memory leak of LZMA global compressed deduplication Geliang Tang (1): mptcp: userspace pm allow creating id 0 subflow Greg Kroah-Hartman (1): Linux 6.1.57 Gustavo A. R. Silva (2): qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info wifi: mwifiex: Fix tlv_buf_left calculation Hamdan Igbaria (1): RDMA/mlx5: Fix mutex unlocking on error flow for steering anchor creation Helge Deller (1): parisc: Fix crash with nr_cpus=1 option Herman Fries (1): hwmon: (nzxt-smart2) Add device id Ido Schimmel (1): vrf: Fix lockdep splat in output path Ilya Dryomov (4): rbd: move rbd_dev_refresh() definition rbd: decouple header read-in from updating rbd_dev->header rbd: decouple parent info read-in from updating rbd_dev rbd: take header_rwsem in rbd_dev_refresh() only when updating Ilya Maximets (1): ipv6: tcp: add a missing nf_reset_ct() in 3WHS handling Jakub Kicinski (2): netlink: split up copies in the ack construction netlink: remove the flex array from struct nlmsghdr Jakub Sitnicki (1): bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets Jeremy Cline (1): net: nfc: llcp: Add lock when modifying device list Jiri Kosina (1): HID: sony: remove duplicate NULL check before calling usb_free_urb() Johan Hovold (1): spi: zynqmp-gqspi: fix clock imbalance on probe failure Johannes Berg (6): wifi: cfg80211: hold wiphy lock in auto-disconnect wifi: cfg80211: move wowlan disable under locks wifi: cfg80211: add a work abstraction with special semantics wifi: cfg80211: fix cqm_config access race wifi: cfg80211: add missing kernel-doc for cqm_rssi_work wifi: mac80211: fix potential key use-after-free Johannes Weiner (1): mm: page_alloc: fix CMA and HIGHATOMIC landing on the wrong buddy list John David Anglin (1): parisc: Restore __ldcw_align for PA-RISC 2.0 processors John Fastabend (2): bpf: tcp_read_skb needs to pop skb regardless of seq bpf, sockmap: Do not inc copied_seq when PEEK flag set Jordan Rife (3): net: replace calls to sock->ops->connect() with kernel_connect() net: prevent rewrite of msg_name in sock_sendmsg() smb: use kernel_connect() and kernel_bind() Juergen Gross (1): xen/events: replace evtchn_rwlock with RCU Junxiao Bi (1): scsi: target: core: Fix deadlock due to recursive locking Konstantin Meskhidze (1): RDMA/uverbs: Fix typo of sizeof argument Kristina Martsenko (1): arm64: cpufeature: Fix CLRBHB and BC detection Leon Hwang (1): bpf: Fix tr dereferencing Leon Romanovsky (2): RDMA/core: Require admin capabilities to set system parameters RDMA/cma: Fix truncation compilation warning in make_cma_ports Luiz Augusto von Dentz (3): Bluetooth: hci_codec: Fix leaking content of local_codecs Bluetooth: hci_sync: Fix handling of HCI_QUIRK_STRICT_DUPLICATE_FILTER Bluetooth: ISO: Fix handling of listen for unicast Marek Behún (1): leds: Drop BUG_ON check for LED_COLOR_ID_MULTI Mario Limonciello (2): drm/amd: Fix detection of _PR3 on the PCIe root port drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() Mark Zhang (1): RDMA/cma: Initialize ib_sa_multicast structure to 0 when join Martin KaFai Lau (1): bpf: Add BPF_FIB_LOOKUP_SKIP_NEIGH for bpf_fib_lookup Mauricio Faria de Oliveira (1): modpost: add missing else to the "of" check Mel Gorman (2): mm/page_alloc: always remove pages from temporary list mm/page_alloc: leave IRQs enabled for per-cpu page allocations Michał Mirosław (1): regulator/core: regulator_register: set device->class earlier Ming Lei (1): block: fix use-after-free of q->q_usage_counter Namjae Jeon (1): ksmbd: fix race condition between session lookup and expire Neal Cardwell (2): tcp: fix quick-ack counting to count actual ACKs of new data tcp: fix delayed ACKs for MSS boundary condition Oleksandr Tymoshenko (1): ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig Paolo Abeni (4): mptcp: rename timer related helper to less confusing names mptcp: fix dangling connection hang-up mptcp: move __mptcp_error_report in protocol.c mptcp: process pending subflow error on close Patrick Rohr (3): net: add sysctl accept_ra_min_rtr_lft net: change accept_ra_min_rtr_lft to affect all RA lifetimes net: release reference to inet6_dev pointer Phil Sutter (3): selftests: netfilter: Test nf_tables audit logging selftests: netfilter: Extend nft_audit.sh netfilter: nf_tables: Deduplicate nft_register_obj audit logs Pin-yen Lin (1): wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet Richard Fitzgerald (1): regmap: rbtree: Fix wrong register marked as in-cache when creating new node Rob Herring (2): arm64: Add Cortex-A520 CPU part definition arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Robin Murphy (2): iommu/arm-smmu-v3: Set TTL invalidation hint better iommu/arm-smmu-v3: Avoid constructing invalid range commands Sameer Pujar (2): ASoC: soc-utils: Export snd_soc_dai_is_dummy() symbol ASoC: tegra: Fix redundant PLLA and PLLA_OUT0 updates Sandipan Das (1): perf/x86/amd/core: Fix overflow reset on hotplug Shay Drory (1): RDMA/mlx5: Fix NULL string error Shigeru Yoshida (1): net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg Sricharan Ramabadhran (1): PCI: qcom: Fix IPQ8074 enumeration Srinivas Pandruvada (1): HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit Stefano Garzarella (1): vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() Sweet Tea Dorminy (3): btrfs: use struct qstr instead of name and namelen pairs btrfs: setup qstr from dentrys using fscrypt helper btrfs: use struct fscrypt_str instead of struct qstr Tao Chen (1): netlink: Fix potential skb memleak in netlink_ack Tom Lendacky (1): x86/sev: Use the GHCB protocol when available for SNP CPUID requests Trond Myklebust (2): NFSv4: Fix a state manager thread deadlock regression NFSv4: Fix a nfs4_state_manager() race Vishal Moola (Oracle) (4): mm/memory: add vm_normal_folio() mm/mempolicy: convert queue_pages_pmd() to queue_folios_pmd() mm/mempolicy: convert queue_pages_pte_range() to queue_folios_pte_range() mm/mempolicy: convert migrate_page_add() to migrate_folio_add() Vlastimil Babka (1): ring-buffer: remove obsolete comment for free_buffer_page() Wayne Lin (1): drm/amd/display: Adjust the MST resume flow Xin Long (3): netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp sctp: update transport state when processing a dupcook packet sctp: update hb timer immediately after users change hb_interval Yajun Deng (1): i40e: fix the wrong PTP frequency calculation Yang Shi (1): mm: mempolicy: keep VMA walk if both MPOL_MF_STRICT and MPOL_MF_MOVE are specified Yao Xiao (1): Bluetooth: Delete unused hci_req_prepare_suspend() declaration Yong Wu (1): iommu/mediatek: Fix share pgtable for iova over 4GB Zhang Rui (1): iommu/vt-d: Avoid memory allocation in iommu_suspend() Zheng Yejian (1): ring-buffer: Fix bytes info in per_cpu buffer stats Zhihao Cheng (1): ubi: Refuse attaching if mtd's erasesize is 0 luosili (1): ksmbd: fix uaf in smb20_oplock_break_ack

1 year, 4 months

2
2
0 0

[PATCH] block: Don't invalidate pagecache for invalid falloc modes

by Sarthak Kukreti

Only call truncate_bdev_range() if the fallocate mode is supported. This fixes a bug where data in the pagecache could be invalidated if the fallocate() was called on the block device with an invalid mode. Fixes: 25f4c41415e5 ("block: implement (some of) fallocate for block devices") Cc: stable(a)vger.kernel.org Reported-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Sarthak Kukreti <sarthakkukreti(a)chromium.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> --- block/fops.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/block/fops.c b/block/fops.c index acff3d5d22d4..73e42742543f 100644 --- a/block/fops.c +++ b/block/fops.c @@ -772,24 +772,35 @@ static long blkdev_fallocate(struct file *file, int mode, loff_t start, filemap_invalidate_lock(inode->i_mapping); - /* Invalidate the page cache, including dirty pages. */ - error = truncate_bdev_range(bdev, file_to_blk_mode(file), start, end); - if (error) - goto fail; - + /* + * Invalidate the page cache, including dirty pages, for valid + * de-allocate mode calls to fallocate(). + */ switch (mode) { case FALLOC_FL_ZERO_RANGE: case FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE: + error = truncate_bdev_range(bdev, file_to_blk_mode(file), start, end); + if (error) + goto fail; + error = blkdev_issue_zeroout(bdev, start >> SECTOR_SHIFT, len >> SECTOR_SHIFT, GFP_KERNEL, BLKDEV_ZERO_NOUNMAP); break; case FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE: + error = truncate_bdev_range(bdev, file_to_blk_mode(file), start, end); + if (error) + goto fail; + error = blkdev_issue_zeroout(bdev, start >> SECTOR_SHIFT, len >> SECTOR_SHIFT, GFP_KERNEL, BLKDEV_ZERO_NOFALLBACK); break; case FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE | FALLOC_FL_NO_HIDE_STALE: + error = truncate_bdev_range(bdev, file_to_blk_mode(file), start, end); + if (error) + goto fail; + error = blkdev_issue_discard(bdev, start >> SECTOR_SHIFT, len >> SECTOR_SHIFT, GFP_KERNEL); break; -- 2.42.0.609.gbb76f46606-goog

1 year, 4 months

3
7
0 0

[PATCHv2] x86/alternatives: Disable KASAN in apply_alternatives()

by Kirill A. Shutemov

Fei has reported that KASAN triggers during apply_alternatives() on 5-level paging machine: BUG: KASAN: out-of-bounds in rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:444 ./include/linux/context_tracking.h:122 kernel/rcu/tree.c:699) Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.6.0-rc5 #12 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:365 mm/kasan/report.c:475) ? __phys_addr (arch/x86/mm/physaddr.h:7 arch/x86/mm/physaddr.c:28) ? kasan_addr_to_slab (./include/linux/mm.h:1265 (discriminator 1) mm/kasan/../slab.h:213 (discriminator 1) mm/kasan/common.c:36 (discriminator 1)) kasan_report (mm/kasan/report.c:590) ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:444 ./include/linux/context_tracking.h:122 kernel/rcu/tree.c:699) ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:444 ./include/linux/context_tracking.h:122 kernel/rcu/tree.c:699) ? apply_alternatives (arch/x86/kernel/alternative.c:415 (discriminator 1)) __asan_load4 (mm/kasan/generic.c:259) rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:444 ./include/linux/context_tracking.h:122 kernel/rcu/tree.c:699) ? text_poke_early (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:77 ./arch/x86/include/asm/irqflags.h:135 arch/x86/kernel/alternative.c:1675) trace_hardirqs_on (./include/trace/events/preemptirq.h:40 (discriminator 2) ./include/trace/events/preemptirq.h:40 (discriminator 2) kernel/trace/trace_preemptirq.c:56 (discriminator 2)) ? __asan_load4 (./arch/x86/include/asm/cpufeature.h:171 mm/kasan/kasan.h:306 mm/kasan/generic.c:175 mm/kasan/generic.c:259) text_poke_early (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:77 ./arch/x86/include/asm/irqflags.h:135 arch/x86/kernel/alternative.c:1675) apply_alternatives (arch/x86/kernel/alternative.c:415 (discriminator 1)) ? __asan_load4 (./arch/x86/include/asm/cpufeature.h:171 mm/kasan/kasan.h:306 mm/kasan/generic.c:175 mm/kasan/generic.c:259) ? __pfx_apply_alternatives (arch/x86/kernel/alternative.c:400) ? __pfx_apply_returns (arch/x86/kernel/alternative.c:720) ? __this_cpu_preempt_check (lib/smp_processor_id.c:67) ? _sub_I_65535_1 (init/main.c:1573) ? int3_selftest_ip (arch/x86/kernel/alternative.c:1496) ? __pfx_int3_selftest (arch/x86/kernel/alternative.c:1496) ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4422) ? fpu__init_cpu_generic (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:77 ./arch/x86/include/asm/irqflags.h:135 ./arch/x86/include/asm/tlbflush.h:47 arch/x86/kernel/fpu/init.c:30) alternative_instructions (arch/x86/kernel/alternative.c:1618) arch_cpu_finalize_init (arch/x86/kernel/cpu/common.c:2404) start_kernel (init/main.c:1037) x86_64_start_reservations (arch/x86/kernel/head64.c:544) x86_64_start_kernel (arch/x86/kernel/head64.c:486 (discriminator 5)) secondary_startup_64_no_verify (arch/x86/kernel/head_64.S:433) </TASK> The buggy address belongs to the physical page: page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3ee641 flags: 0x20000000004000(reserved|node=0|zone=2) page_type: 0xffffffff() raw: 0020000000004000 ffd400000fb99048 ffd400000fb99048 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ff110003ee641880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110003ee641900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ff110003ee641980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ff110003ee641a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110003ee641a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) got patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is defined with the cpu_feature_enabled(). KASAN gets confused when apply_alternatives() patches the KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing __VIRTUAL_MASK_SHIFT with 56, fixes the issue. Disable KASAN while kernel patches alternatives. Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Reported-by: Fei Yang <fei.yang(a)intel.com> Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEVEL=y") Cc: stable(a)vger.kernel.org --- v2: - Move kasan_disable/_enable_current() to cover whole loop, not only text_poke_early(); - Adjust commit message. --- arch/x86/kernel/alternative.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index 517ee01503be..b4cc4d7c0825 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -403,6 +403,17 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start, u8 insn_buff[MAX_PATCH_LEN]; DPRINTK(ALT, "alt table %px, -> %px", start, end); + + /* + * In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using + * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here. + * During the process, KASAN becomes confused and triggers + * a false-positive out-of-bound report. + * + * Disable KASAN until the patching is complete. + */ + kasan_disable_current(); + /* * The scan order should be from start to end. A later scanned * alternative code can overwrite previously scanned alternative code. @@ -452,6 +463,8 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start, text_poke_early(instr, insn_buff, insn_buff_sz); } + + kasan_enable_current(); } static inline bool is_jcc32(struct insn *insn) -- 2.41.0

1 year, 4 months

3
5
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2023