February 2023 - Linux-stable-mirror

[PATCH v2 1/2] thunderbolt: Adjust how NVM reading works

by Mario Limonciello

Some TBT3 devices have a hard time reliably responding to bit banging requests correctly when connected to AMD USB4 hosts running Linux. These problems are not reported in any other CM supported on AMD platforms, and comparing the Windows and Pre-OS implementations the Linux CM is the only one that utilizes bit banging to access the DROM. Other CM implementations access the DROM directly from the NVM instead of bit banging. Adjust the flow to use this method to fetch the NVM when the downstream device is Thunderbolt 3 and only use bit banging to access TBT 2 or TBT 1 devices. As the flow is modified, also remove the retry sequence that was introduced from commit f022ff7bf377 ("thunderbolt: Retry DROM read once if parsing fails") as it will not be necessary if the NVM is fetched this way. Cc: stable(a)vger.kernel.org Fixes: f022ff7bf377 ("thunderbolt: Retry DROM read once if parsing fails") Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> --- v1->v2: * Update commit message to indicate which CMs are tested * Adjust flow to only fetch DROM from NVM on TBT3 and bit bang on TBT1/2 --- drivers/thunderbolt/eeprom.c | 145 +++++++++++++++++++---------------- 1 file changed, 80 insertions(+), 65 deletions(-) diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c index c90d22f56d4e..d1be72b6afdb 100644 --- a/drivers/thunderbolt/eeprom.c +++ b/drivers/thunderbolt/eeprom.c @@ -416,7 +416,7 @@ static int tb_drom_parse_entries(struct tb_switch *sw, size_t header_size) if (pos + 1 == drom_size || pos + entry->len > drom_size || !entry->len) { tb_sw_warn(sw, "DROM buffer overrun\n"); - return -EILSEQ; + return -EIO; } switch (entry->type) { @@ -544,7 +544,37 @@ static int tb_drom_read_n(struct tb_switch *sw, u16 offset, u8 *val, return tb_eeprom_read_n(sw, offset, val, count); } -static int tb_drom_parse(struct tb_switch *sw) +static int tb_drom_bit_bang(struct tb_switch *sw, u16 *size) +{ + int res; + + res = tb_drom_read_n(sw, 14, (u8 *) size, 2); + if (res) + return res; + *size &= 0x3ff; + *size += TB_DROM_DATA_START; + tb_sw_dbg(sw, "reading drom (length: %#x)\n", *size); + if (*size < sizeof(struct tb_drom_header)) { + tb_sw_warn(sw, "drom too small, aborting\n"); + return -EIO; + } + + sw->drom = kzalloc(*size, GFP_KERNEL); + if (!sw->drom) + return -ENOMEM; + + res = tb_drom_read_n(sw, 0, sw->drom, *size); + if (res) + goto err; + + return 0; +err: + kfree(sw->drom); + sw->drom = NULL; + return res; +} + +static int tb_drom_parse_v1(struct tb_switch *sw) { const struct tb_drom_header *header = (const struct tb_drom_header *)sw->drom; @@ -555,7 +585,7 @@ static int tb_drom_parse(struct tb_switch *sw) tb_sw_warn(sw, "DROM UID CRC8 mismatch (expected: %#x, got: %#x)\n", header->uid_crc8, crc); - return -EILSEQ; + return -EIO; } if (!sw->uid) sw->uid = header->uid; @@ -589,6 +619,43 @@ static int usb4_drom_parse(struct tb_switch *sw) return tb_drom_parse_entries(sw, USB4_DROM_HEADER_SIZE); } +static int tb_drom_parse(struct tb_switch *sw, u16 *size) +{ + struct tb_drom_header *header = (void *) sw->drom; + int res; + + if (header->data_len + TB_DROM_DATA_START != *size) { + tb_sw_warn(sw, "drom size mismatch\n"); + goto err; + } + + tb_sw_dbg(sw, "DROM version: %d\n", header->device_rom_revision); + + switch (header->device_rom_revision) { + case 3: + res = usb4_drom_parse(sw); + break; + default: + tb_sw_warn(sw, "DROM device_rom_revision %#x unknown\n", + header->device_rom_revision); + fallthrough; + case 1: + res = tb_drom_parse_v1(sw); + break; + } + + if (res) { + tb_sw_warn(sw, "parsing DROM failed\n"); + goto err; + } + + return 0; +err: + kfree(sw->drom); + sw->drom = NULL; + return -EIO; +} + /** * tb_drom_read() - Copy DROM to sw->drom and parse it * @sw: Router whose DROM to read and parse @@ -602,8 +669,7 @@ static int usb4_drom_parse(struct tb_switch *sw) int tb_drom_read(struct tb_switch *sw) { u16 size; - struct tb_drom_header *header; - int res, retries = 1; + int res; if (sw->drom) return 0; @@ -614,11 +680,11 @@ int tb_drom_read(struct tb_switch *sw) * in a device property. Use it if available. */ if (tb_drom_copy_efi(sw, &size) == 0) - goto parse; + return tb_drom_parse(sw, &size); /* Non-Apple hardware has the DROM as part of NVM */ if (tb_drom_copy_nvm(sw, &size) == 0) - goto parse; + return tb_drom_parse(sw, &size); /* * USB4 hosts may support reading DROM through router @@ -627,7 +693,7 @@ int tb_drom_read(struct tb_switch *sw) if (tb_switch_is_usb4(sw)) { usb4_switch_read_uid(sw, &sw->uid); if (!usb4_copy_host_drom(sw, &size)) - goto parse; + return tb_drom_parse(sw, &size); } else { /* * The root switch contains only a dummy drom @@ -640,64 +706,13 @@ int tb_drom_read(struct tb_switch *sw) return 0; } - res = tb_drom_read_n(sw, 14, (u8 *) &size, 2); + /* TBT3 devices have the DROM as part of NVM */ + if (sw->generation < 3) + res = tb_drom_bit_bang(sw, &size); + else + res = tb_drom_copy_nvm(sw, &size); if (res) return res; - size &= 0x3ff; - size += TB_DROM_DATA_START; - tb_sw_dbg(sw, "reading drom (length: %#x)\n", size); - if (size < sizeof(*header)) { - tb_sw_warn(sw, "drom too small, aborting\n"); - return -EIO; - } - - sw->drom = kzalloc(size, GFP_KERNEL); - if (!sw->drom) - return -ENOMEM; -read: - res = tb_drom_read_n(sw, 0, sw->drom, size); - if (res) - goto err; - -parse: - header = (void *) sw->drom; - - if (header->data_len + TB_DROM_DATA_START != size) { - tb_sw_warn(sw, "drom size mismatch\n"); - if (retries--) { - msleep(100); - goto read; - } - goto err; - } - tb_sw_dbg(sw, "DROM version: %d\n", header->device_rom_revision); - - switch (header->device_rom_revision) { - case 3: - res = usb4_drom_parse(sw); - break; - default: - tb_sw_warn(sw, "DROM device_rom_revision %#x unknown\n", - header->device_rom_revision); - fallthrough; - case 1: - res = tb_drom_parse(sw); - break; - } - - /* If the DROM parsing fails, wait a moment and retry once */ - if (res == -EILSEQ && retries--) { - tb_sw_warn(sw, "parsing DROM failed\n"); - msleep(100); - goto read; - } - - if (!res) - return 0; - -err: - kfree(sw->drom); - sw->drom = NULL; - return -EIO; + return tb_drom_parse(sw, &size); } -- 2.34.1

1 year, 10 months

2
2
0 0

[PATCH v2 1/2] drm/i915: Don't use stolen memory for ring buffers with LLC

by John.C.Harrison＠Intel.com

From: John Harrison <John.C.Harrison(a)Intel.com> Direction from hardware is that stolen memory should never be used for ring buffer allocations on platforms with LLC. There are too many caching pitfalls due to the way stolen memory accesses are routed. So it is safest to just not use it. Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com> Fixes: c58b735fc762 ("drm/i915: Allocate rings from stolen") Cc: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com> Cc: Jani Nikula <jani.nikula(a)linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com> Cc: intel-gfx(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v4.9+ --- drivers/gpu/drm/i915/gt/intel_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c index 15ec64d881c44..fb1d2595392ed 100644 --- a/drivers/gpu/drm/i915/gt/intel_ring.c +++ b/drivers/gpu/drm/i915/gt/intel_ring.c @@ -116,7 +116,7 @@ static struct i915_vma *create_ring_vma(struct i915_ggtt *ggtt, int size) obj = i915_gem_object_create_lmem(i915, size, I915_BO_ALLOC_VOLATILE | I915_BO_ALLOC_PM_VOLATILE); - if (IS_ERR(obj) && i915_ggtt_has_aperture(ggtt)) + if (IS_ERR(obj) && i915_ggtt_has_aperture(ggtt) && !HAS_LLC(i915)) obj = i915_gem_object_create_stolen(i915, size); if (IS_ERR(obj)) obj = i915_gem_object_create_internal(i915, size); -- 2.39.1

1 year, 10 months

1
0
0 0

[PATCH AUTOSEL 6.1 01/24] Fix XFRM-I support for nested ESP tunnels

by Sasha Levin

From: Benedict Wong <benedictwong(a)google.com> [ Upstream commit b0355dbbf13c0052931dd14c38c789efed64d3de ] This change adds support for nested IPsec tunnels by ensuring that XFRM-I verifies existing policies before decapsulating a subsequent policies. Addtionally, this clears the secpath entries after policies are verified, ensuring that previous tunnels with no-longer-valid do not pollute subsequent policy checks. This is necessary especially for nested tunnels, as the IP addresses, protocol and ports may all change, thus not matching the previous policies. In order to ensure that packets match the relevant inbound templates, the xfrm_policy_check should be done before handing off to the inner XFRM protocol to decrypt and decapsulate. Notably, raw ESP/AH packets did not perform policy checks inherently, whereas all other encapsulated packets (UDP, TCP encapsulated) do policy checks after calling xfrm_input handling in the respective encapsulation layer. Test: Verified with additional Android Kernel Unit tests Signed-off-by: Benedict Wong <benedictwong(a)google.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++++++++++++++++--- net/xfrm/xfrm_policy.c | 3 +++ 2 files changed, 53 insertions(+), 4 deletions(-) diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index 5a67b120c4dbd..94a3609548b11 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -310,6 +310,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet) skb->mark = 0; } +static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi, + int encap_type, unsigned short family) +{ + struct sec_path *sp; + + sp = skb_sec_path(skb); + if (sp && (sp->len || sp->olen) && + !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) + goto discard; + + XFRM_SPI_SKB_CB(skb)->family = family; + if (family == AF_INET) { + XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; + } else { + XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL; + } + + return xfrm_input(skb, nexthdr, spi, encap_type); +discard: + kfree_skb(skb); + return 0; +} + +static int xfrmi4_rcv(struct sk_buff *skb) +{ + return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET); +} + +static int xfrmi6_rcv(struct sk_buff *skb) +{ + return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], + 0, 0, AF_INET6); +} + +static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) +{ + return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET); +} + +static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) +{ + return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6); +} + static int xfrmi_rcv_cb(struct sk_buff *skb, int err) { const struct xfrm_mode *inner_mode; @@ -937,8 +983,8 @@ static struct pernet_operations xfrmi_net_ops = { }; static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = { - .handler = xfrm6_rcv, - .input_handler = xfrm_input, + .handler = xfrmi6_rcv, + .input_handler = xfrmi6_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, .priority = 10, @@ -988,8 +1034,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = { #endif static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = { - .handler = xfrm4_rcv, - .input_handler = xfrm_input, + .handler = xfrmi4_rcv, + .input_handler = xfrmi4_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, .priority = 10, diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 52538d5360673..7f49dab3b6b59 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -3670,6 +3670,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, goto reject; } + if (if_id) + secpath_reset(skb); + xfrm_pols_put(pols, npols); return 1; } -- 2.39.0

1 year, 10 months

2
25
0 0

[PATCH AUTOSEL 4.14 1/3] ARM: dts: rockchip: add power-domains property to dp node on rk3288

by Sasha Levin

From: Johan Jonker <jbx6244(a)gmail.com> [ Upstream commit 80422339a75088322b4d3884bd12fa0fe5d11050 ] The clocks in the Rockchip rk3288 DisplayPort node are included in the power-domain@RK3288_PD_VIO logic, but the power-domains property in the dp node is missing, so fix it. Signed-off-by: Johan Jonker <jbx6244(a)gmail.com> Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- arch/arm/boot/dts/rk3288.dtsi | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi index 872e4e690beb4..c3440adc763ce 100644 --- a/arch/arm/boot/dts/rk3288.dtsi +++ b/arch/arm/boot/dts/rk3288.dtsi @@ -1096,6 +1096,7 @@ edp: dp@ff970000 { clock-names = "dp", "pclk"; phys = <&edp_phy>; phy-names = "dp"; + power-domains = <&power RK3288_PD_VIO>; resets = <&cru SRST_EDP>; reset-names = "dp"; rockchip,grf = <&grf>; -- 2.39.0

1 year, 10 months

1
2
0 0

[PATCH AUTOSEL 4.19 1/4] ARM: dts: rockchip: add power-domains property to dp node on rk3288

by Sasha Levin

From: Johan Jonker <jbx6244(a)gmail.com> [ Upstream commit 80422339a75088322b4d3884bd12fa0fe5d11050 ] The clocks in the Rockchip rk3288 DisplayPort node are included in the power-domain@RK3288_PD_VIO logic, but the power-domains property in the dp node is missing, so fix it. Signed-off-by: Johan Jonker <jbx6244(a)gmail.com> Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- arch/arm/boot/dts/rk3288.dtsi | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi index e442bf7427ae1..402b5e0fd616c 100644 --- a/arch/arm/boot/dts/rk3288.dtsi +++ b/arch/arm/boot/dts/rk3288.dtsi @@ -1172,6 +1172,7 @@ edp: dp@ff970000 { clock-names = "dp", "pclk"; phys = <&edp_phy>; phy-names = "dp"; + power-domains = <&power RK3288_PD_VIO>; resets = <&cru SRST_EDP>; reset-names = "dp"; rockchip,grf = <&grf>; -- 2.39.0

1 year, 10 months

1
3
0 0

[PATCH AUTOSEL 5.4 1/7] arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc

by Sasha Levin

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> [ Upstream commit 1692bffec674551163a7a4be32f59fdde04ecd27 ] GPIO LEDs do not have a 'mode' property: rockchip/rk3328-roc-pc.dtb: leds: led-0: Unevaluated properties are not allowed ('mode' was unexpected) Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20221125144135.477144-1-krzysztof.kozlowski@linar… Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts index 6c3368f795ca3..fbd942b46c542 100644 --- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts @@ -90,7 +90,6 @@ power { linux,default-trigger = "heartbeat"; gpios = <&rk805 1 GPIO_ACTIVE_LOW>; default-state = "on"; - mode = <0x23>; }; user { @@ -98,7 +97,6 @@ user { linux,default-trigger = "mmc1"; gpios = <&rk805 0 GPIO_ACTIVE_LOW>; default-state = "off"; - mode = <0x05>; }; }; }; -- 2.39.0

1 year, 10 months

1
6
0 0

[PATCH AUTOSEL 5.10 1/8] Fix XFRM-I support for nested ESP tunnels

by Sasha Levin

From: Benedict Wong <benedictwong(a)google.com> [ Upstream commit b0355dbbf13c0052931dd14c38c789efed64d3de ] This change adds support for nested IPsec tunnels by ensuring that XFRM-I verifies existing policies before decapsulating a subsequent policies. Addtionally, this clears the secpath entries after policies are verified, ensuring that previous tunnels with no-longer-valid do not pollute subsequent policy checks. This is necessary especially for nested tunnels, as the IP addresses, protocol and ports may all change, thus not matching the previous policies. In order to ensure that packets match the relevant inbound templates, the xfrm_policy_check should be done before handing off to the inner XFRM protocol to decrypt and decapsulate. Notably, raw ESP/AH packets did not perform policy checks inherently, whereas all other encapsulated packets (UDP, TCP encapsulated) do policy checks after calling xfrm_input handling in the respective encapsulation layer. Test: Verified with additional Android Kernel Unit tests Signed-off-by: Benedict Wong <benedictwong(a)google.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++++++++++++++++--- net/xfrm/xfrm_policy.c | 3 +++ 2 files changed, 53 insertions(+), 4 deletions(-) diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index da518b4ca84c6..e4f21a6924153 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -207,6 +207,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet) skb->mark = 0; } +static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi, + int encap_type, unsigned short family) +{ + struct sec_path *sp; + + sp = skb_sec_path(skb); + if (sp && (sp->len || sp->olen) && + !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) + goto discard; + + XFRM_SPI_SKB_CB(skb)->family = family; + if (family == AF_INET) { + XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; + } else { + XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); + XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL; + } + + return xfrm_input(skb, nexthdr, spi, encap_type); +discard: + kfree_skb(skb); + return 0; +} + +static int xfrmi4_rcv(struct sk_buff *skb) +{ + return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET); +} + +static int xfrmi6_rcv(struct sk_buff *skb) +{ + return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], + 0, 0, AF_INET6); +} + +static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) +{ + return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET); +} + +static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) +{ + return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6); +} + static int xfrmi_rcv_cb(struct sk_buff *skb, int err) { const struct xfrm_mode *inner_mode; @@ -780,8 +826,8 @@ static struct pernet_operations xfrmi_net_ops = { }; static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = { - .handler = xfrm6_rcv, - .input_handler = xfrm_input, + .handler = xfrmi6_rcv, + .input_handler = xfrmi6_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, .priority = 10, @@ -831,8 +877,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = { #endif static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = { - .handler = xfrm4_rcv, - .input_handler = xfrm_input, + .handler = xfrmi4_rcv, + .input_handler = xfrmi4_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, .priority = 10, diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 0d12bdf59d4cc..d15aa62887de0 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -3710,6 +3710,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, goto reject; } + if (if_id) + secpath_reset(skb); + xfrm_pols_put(pols, npols); return 1; } -- 2.39.0

1 year, 10 months

1
7
0 0

[PATCH AUTOSEL 5.15 01/12] ionic: refactor use of ionic_rx_fill()

by Sasha Levin

From: Neel Patel <neel(a)pensando.io> [ Upstream commit e55f0f5befc26e2ba6bb8c1f945ea8e37ee0e334 ] The same pre-work code is used before each call to ionic_rx_fill(), so bring it in and make it a part of the routine. Signed-off-by: Neel Patel <neel(a)pensando.io> Signed-off-by: Shannon Nelson <snelson(a)pensando.io> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- .../net/ethernet/pensando/ionic/ionic_txrx.c | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c index 37c39581b6599..376f97b4008bb 100644 --- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c @@ -353,16 +353,25 @@ void ionic_rx_fill(struct ionic_queue *q) struct ionic_rxq_sg_desc *sg_desc; struct ionic_rxq_sg_elem *sg_elem; struct ionic_buf_info *buf_info; + unsigned int fill_threshold; struct ionic_rxq_desc *desc; unsigned int remain_len; unsigned int frag_len; unsigned int nfrags; + unsigned int n_fill; unsigned int i, j; unsigned int len; + n_fill = ionic_q_space_avail(q); + + fill_threshold = min_t(unsigned int, IONIC_RX_FILL_THRESHOLD, + q->num_descs / IONIC_RX_FILL_DIV); + if (n_fill < fill_threshold) + return; + len = netdev->mtu + ETH_HLEN + VLAN_HLEN; - for (i = ionic_q_space_avail(q); i; i--) { + for (i = n_fill; i; i--) { nfrags = 0; remain_len = len; desc_info = &q->info[q->head_idx]; @@ -518,7 +527,6 @@ int ionic_rx_napi(struct napi_struct *napi, int budget) struct ionic_cq *cq = napi_to_cq(napi); struct ionic_dev *idev; struct ionic_lif *lif; - u16 rx_fill_threshold; u32 work_done = 0; u32 flags = 0; @@ -528,10 +536,7 @@ int ionic_rx_napi(struct napi_struct *napi, int budget) work_done = ionic_cq_service(cq, budget, ionic_rx_service, NULL, NULL); - rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD, - cq->num_descs / IONIC_RX_FILL_DIV); - if (work_done && ionic_q_space_avail(cq->bound_q) >= rx_fill_threshold) - ionic_rx_fill(cq->bound_q); + ionic_rx_fill(cq->bound_q); if (work_done < budget && napi_complete_done(napi, work_done)) { ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR); @@ -559,7 +564,6 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) struct ionic_dev *idev; struct ionic_lif *lif; struct ionic_cq *txcq; - u16 rx_fill_threshold; u32 rx_work_done = 0; u32 tx_work_done = 0; u32 flags = 0; @@ -574,10 +578,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) rx_work_done = ionic_cq_service(rxcq, budget, ionic_rx_service, NULL, NULL); - rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD, - rxcq->num_descs / IONIC_RX_FILL_DIV); - if (rx_work_done && ionic_q_space_avail(rxcq->bound_q) >= rx_fill_threshold) - ionic_rx_fill(rxcq->bound_q); + ionic_rx_fill(rxcq->bound_q); if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) { ionic_dim_update(qcq, 0); -- 2.39.0

1 year, 10 months

1
11
0 0

[PATCH 5.10 000/134] 5.10.168-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.168 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 16 Feb 2023 17:25:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.168-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.168-rc2 David Chen <david.chen(a)nutanix.com> Fix page corruption caused by racy check in __free_pages Heiner Kallweit <hkallweit1(a)gmail.com> arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive Heiner Kallweit <hkallweit1(a)gmail.com> arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive Heiner Kallweit <hkallweit1(a)gmail.com> arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive Guo Ren <guoren(a)linux.alibaba.com> riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte Xiubo Li <xiubli(a)redhat.com> ceph: flush cap releases when the session is flushed Prashant Malani <pmalani(a)chromium.org> usb: typec: altmodes/displayport: Fix probe pin assign check Mark Pearson <mpearson-lenovo(a)squebb.ca> usb: core: add quirk for Alcor Link AK9563 smartcard reader Anand Jain <anand.jain(a)oracle.com> btrfs: free device in btrfs_close_devices for a single device filesystem Alan Stern <stern(a)rowland.harvard.edu> net: USB: Fix wrong-direction WARNING in plusb.c ZhaoLong Wang <wangzhaolong1(a)huawei.com> cifs: Fix use-after-free in rdata->read_into_pages() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Restore the pins that used to be in Direct IRQ mode Serge Semin <Sergey.Semin(a)baikalelectronics.ru> spi: dw: Fix wrong FIFO level setting for long xfers Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: fix potential NULL dereference Joel Stanley <joel(a)jms.id.au> pinctrl: aspeed: Fix confusing types in return value Dan Carpenter <error27(a)gmail.com> ALSA: pci: lx6464es: fix a debug loop Hangbin Liu <liuhangbin(a)gmail.com> selftests: forwarding: lib: quote the sysctl values Pietro Borrello <borrello(a)diag.uniroma1.it> rds: rds_rm_zerocopy_callback() use list_first_entry() Shay Drory <shayd(a)nvidia.com> net/mlx5: fw_tracer, Zero consumer index when reloading the tracer Shay Drory <shayd(a)nvidia.com> net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: IPoIB, Show unknown speed instead of error Vladimir Oltean <vladimir.oltean(a)nxp.com> net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q" Anirudh Venkataramanan <anirudh.venkataramanan(a)intel.com> ice: Do not use WQ_MEM_RECLAIM flag for workqueue Herton R. Krzesinski <herton(a)redhat.com> uapi: add missing ip/ipv6 header dependencies for linux/stddef.h Neel Patel <neel.patel(a)amd.com> ionic: clean interrupt before enabling queue to avoid credit race Heiner Kallweit <hkallweit1(a)gmail.com> net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY Qi Zheng <zhengqi.arch(a)bytedance.com> bonding: fix error checking in bond_debug_reregister() Christian Hopps <chopps(a)chopps.org> xfrm: fix bug with DSCP copy to v6 from v4 tunnel Yang Yingliang <yangyingliang(a)huawei.com> RDMA/usnic: use iommu_map_atomic() under spin_lock() Dragos Tatulea <dtatulea(a)nvidia.com> IB/IPoIB: Fix legacy IPoIB due to wrong number of queues Eric Dumazet <edumazet(a)google.com> xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr() Dean Luick <dean.luick(a)cornelisnetworks.com> IB/hfi1: Restore allocated resources on failed copyout Anastasia Belova <abelova(a)astralinux.ru> xfrm: compat: change expression for switch in xfrm_xlate64 Devid Antonio Filoni <devid.filoni(a)egluetechnologies.com> can: j1939: do not wait 250 ms if the same addr was already claimed Mark Brown <broonie(a)kernel.org> of/address: Return an error when no valid dma-ranges are found Shiju Jose <shiju.jose(a)huawei.com> tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw Guillaume Pinot <texitoi(a)texitoi.eu> ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 Artemii Karasev <karasev(a)ispras.ru> ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() Edson Juliano Drosdeck <edson.drosdeck(a)gmail.com> ALSA: hda/realtek: Add Positivo N14KP6-TG Alexander Potapenko <glider(a)google.com> btrfs: zlib: zero-initialize zlib workspace Josef Bacik <josef(a)toxicpanda.com> btrfs: limit device extents to the device size Mike Kravetz <mike.kravetz(a)oracle.com> migrate: hugetlb: check for hugetlb shared PMD in node migration Miaohe Lin <linmiaohe(a)huawei.com> mm/migration: return errno when isolate_huge_page failed Andreas Kemnade <andreas(a)kemnade.info> iio:adc:twl6030: Enable measurement of VAC Martin KaFai Lau <kafai(a)fb.com> bpf: Do not reject when the stack read size is different from the tracked scalar size Christophe Kerello <christophe.kerello(a)foss.st.com> nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on i_extra_isize in is_alive() Dongliang Mu <dzm91(a)hust.edu.cn> fbdev: smscufx: fix error handling code in ufx_usb_probe Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: 8250_dma: Fix DMA Rx rearm race Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: 8250_dma: Fix DMA Rx completion race Michael Walle <michael(a)walle.cc> nvmem: core: fix cell removal on error Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> nvmem: core: initialise nvmem->id early Rob Clark <robdclark(a)chromium.org> drm/i915: Fix potential bit_17 double-free Phillip Lougher <phillip(a)squashfs.org.uk> Squashfs: fix handling and sanity checking of xattr_ids count Longlong Xia <xialonglong1(a)huawei.com> mm/swapfile: add cond_resched() in get_swap_pages() Zheng Yongjun <zhengyongjun3(a)huawei.com> fpga: stratix10-soc: Fix return value check in s10_ops_write_init() Joerg Roedel <jroedel(a)suse.de> x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses Mike Kravetz <mike.kravetz(a)oracle.com> mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps Andreas Schwab <schwab(a)suse.de> riscv: disable generation of unwind tables Helge Deller <deller(a)gmx.de> parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case Helge Deller <deller(a)gmx.de> parisc: Fix return code of pdc_iodc_print() Johan Hovold <johan+linaro(a)kernel.org> nvmem: qcom-spmi-sdam: fix module autoloading Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix MAGN sensor scale and unit Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix failed initialization ODR mode assignment Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix incorrect ODR mode readback Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix map label of channel type to MAGN sensor Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix IMU data bits returned to user space Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback Carlos Song <carlos.song(a)nxp.com> iio: imu: fxos8700: fix ACCEL measurement range selection Andreas Kemnade <andreas(a)kemnade.info> iio:adc:twl6030: Enable measurements of VUSB, VBAT and others Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iio: adc: berlin2-adc: Add missing of_node_put() in error path Dmitry Perchanov <dmitry.perchanov(a)intel.com> iio: hid: fix the retval in accel_3d_capture_sample Ard Biesheuvel <ardb(a)kernel.org> efi: Accept version 2 of memory attributes table Victor Shyba <victor1984(a)riseup.net> ALSA: hda/realtek: Add Acer Predator PH315-54 Alexander Egorenkov <egorenar(a)linux.ibm.com> watchdog: diag288_wdt: fix __diag288() inline assembly Alexander Egorenkov <egorenar(a)linux.ibm.com> watchdog: diag288_wdt: do not use stack buffers for hardware data Natalia Petrova <n.petrova(a)fintech.ru> net: qrtr: free memory on error path in radix_tree_insert() Samuel Thibault <samuel.thibault(a)ens-lyon.org> fbcon: Check font dimension limits Werner Sembach <wse(a)tuxedocomputers.com> Input: i8042 - add Clevo PCX0DX to i8042 quirk table Werner Sembach <wse(a)tuxedocomputers.com> Input: i8042 - add TUXEDO devices to i8042 quirk tables Werner Sembach <wse(a)tuxedocomputers.com> Input: i8042 - merge quirk tables Werner Sembach <wse(a)tuxedocomputers.com> Input: i8042 - move __initconst to fix code styling warning George Kennedy <george.kennedy(a)oracle.com> vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Udipto Goswami <quic_ugoswami(a)quicinc.com> usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait Neil Armstrong <neil.armstrong(a)linaro.org> usb: dwc3: qcom: enable vbus override when in OTG dr-mode Wesley Cheng <wcheng(a)codeaurora.org> usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API Olivier Moysan <olivier.moysan(a)foss.st.com> iio: adc: stm32-dfsdm: fill module aliases Hyunwoo Kim <v4bel(a)theori.io> net/x25: Fix to not accept on connected socket Koba Ko <koba.ko(a)canonical.com> platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table Randy Dunlap <rdunlap(a)infradead.org> i2c: rk3x: fix a bunch of kernel-doc warnings Mike Christie <michael.christie(a)oracle.com> scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress Maurizio Lombardi <mlombard(a)redhat.com> scsi: target: core: Fix warning on RT kernels Stefan Wahren <stefan.wahren(a)i2se.com> i2c: mxs: suppress probe-deferral error message Magnus Karlsson <magnus.karlsson(a)intel.com> qede: execute xdp_do_flush() before napi_complete_done() Bhaskar Upadhaya <bupadhaya(a)marvell.com> qede: add netpoll support for qede driver Anton Gusev <aagusev(a)ispras.ru> efi: fix potential NULL deref in efi_mem_reserve_persistent Fedor Pchelkin <pchelkin(a)ispras.ru> net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Parav Pandit <parav(a)nvidia.com> virtio-net: Keep stop() to follow mirror sequence of open() Andrei Gherzan <andrei.gherzan(a)canonical.com> selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking Andrei Gherzan <andrei.gherzan(a)canonical.com> selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs Andrei Gherzan <andrei.gherzan(a)canonical.com> selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided Andrei Gherzan <andrei.gherzan(a)canonical.com> selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning Damien Le Moal <damien.lemoal(a)opensource.wdc.com> ata: libata: Fix sata_down_spd_limit() when no link speed is reported Ziyang Xuan <william.xuanziyang(a)huawei.com> can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate Tom Rix <trix(a)redhat.com> igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() Chris Healy <healych(a)amazon.com> net: phy: meson-gxl: Add generic dummy stubs for MMD register access Fedor Pchelkin <pchelkin(a)ispras.ru> squashfs: harden sanity check in squashfs_read_xattr_id_table Florian Westphal <fw(a)strlen.de> netfilter: br_netfilter: disable sabotage_in hook after first suppression Hyunwoo Kim <v4bel(a)theori.io> netrom: Fix use-after-free caused by accept on already connected socket Andre Kalb <andre.kalb(a)sma.de> net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices Íñigo Huguet <ihuguet(a)redhat.com> sfc: correctly advertise tunneled IPv6 segmentation Magnus Karlsson <magnus.karlsson(a)intel.com> virtio-net: execute xdp_do_flush() before napi_complete_done() Al Viro <viro(a)zeniv.linux.org.uk> fix "direction" argument of iov_iter_kvec() Al Viro <viro(a)zeniv.linux.org.uk> fix iov_iter_bvec() "direction" argument Al Viro <viro(a)zeniv.linux.org.uk> READ is "data destination", not source... Al Viro <viro(a)zeniv.linux.org.uk> WRITE is "data source", not destination... Eric Auger <eric.auger(a)redhat.com> vhost/net: Clear the pending messages when the backend is removed Martin K. Petersen <martin.petersen(a)oracle.com> scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" Hans Verkuil <hverkuil-cisco(a)xs4all.nl> drm/vc4: hdmi: make CEC adapter name unique Pierluigi Passaro <pierluigi.p(a)variscite.com> arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX Jakub Sitnicki <jakub(a)cloudflare.com> bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener Eduard Zingerman <eddyz87(a)gmail.com> bpf: Fix to preserve reg parent/live fields when copying range info Martin KaFai Lau <kafai(a)fb.com> bpf: Support <8-byte scalar spill and refill Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/bpf: Move common helpers into bpf_jit.h Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/bpf: Change register numbering for bpf_set/is_seen_register() Artemii Karasev <karasev(a)ispras.ru> ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() Yonghong Song <yhs(a)fb.com> bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers Michael Ellerman <mpe(a)ellerman.id.au> powerpc/imc-pmu: Revert nest_init_lock to being a mutex Paul Chaignon <paul(a)isovalent.com> bpf: Fix incorrect state pruning for <8B spill/fill Yuan Can <yuancan(a)huawei.com> bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() Takashi Sakamoto <o-takashi(a)sakamocchi.jp> firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 6 +- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +- arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h | 2 +- arch/parisc/kernel/firmware.c | 5 +- arch/parisc/kernel/ptrace.c | 15 +- arch/powerpc/net/bpf_jit.h | 35 + arch/powerpc/net/bpf_jit64.h | 19 - arch/powerpc/net/bpf_jit_comp64.c | 28 +- arch/powerpc/perf/imc-pmu.c | 14 +- arch/riscv/Makefile | 3 + arch/riscv/mm/cacheflush.c | 4 +- arch/x86/include/asm/debugreg.h | 26 +- drivers/ata/libata-core.c | 2 +- drivers/bus/sunxi-rsb.c | 8 +- drivers/firewire/core-cdev.c | 4 +- drivers/firmware/efi/efi.c | 2 + drivers/firmware/efi/memattr.c | 2 +- drivers/fpga/stratix10-soc.c | 4 +- drivers/fsi/fsi-sbefifo.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_tiling.c | 9 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +- drivers/i2c/busses/i2c-mxs.c | 4 +- drivers/i2c/busses/i2c-rk3x.c | 44 +- drivers/iio/accel/hid-sensor-accel-3d.c | 1 + drivers/iio/adc/berlin2-adc.c | 4 +- drivers/iio/adc/stm32-dfsdm-adc.c | 1 + drivers/iio/adc/twl6030-gpadc.c | 32 + drivers/iio/imu/fxos8700_core.c | 111 +- drivers/infiniband/hw/hfi1/file_ops.c | 7 +- drivers/infiniband/hw/usnic/usnic_uiom.c | 8 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- drivers/input/serio/i8042-x86ia64io.h | 1188 ++++++++++++-------- drivers/net/bonding/bond_debugfs.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/igc/igc_ptp.c | 14 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 3 +- .../ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 13 +- drivers/net/ethernet/mscc/ocelot_flower.c | 24 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 15 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 10 +- drivers/net/ethernet/sfc/efx.c | 5 +- drivers/net/phy/dp83822.c | 6 +- drivers/net/phy/meson-gxl.c | 4 + drivers/net/usb/plusb.c | 4 +- drivers/net/virtio_net.c | 8 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 17 + drivers/nvmem/core.c | 8 +- drivers/nvmem/qcom-spmi-sdam.c | 1 + drivers/of/address.c | 21 +- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 2 +- drivers/pinctrl/intel/pinctrl-intel.c | 16 +- drivers/pinctrl/pinctrl-single.c | 2 + drivers/platform/x86/dell-wmi.c | 3 + drivers/scsi/iscsi_tcp.c | 9 +- drivers/scsi/scsi_scan.c | 7 +- drivers/spi/spi-dw-core.c | 2 +- drivers/target/target_core_file.c | 4 +- drivers/target/target_core_tmr.c | 4 +- drivers/tty/serial/8250/8250_dma.c | 26 +- drivers/tty/vt/vc_screen.c | 9 +- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/dwc3-qcom.c | 10 +- drivers/usb/gadget/function/f_fs.c | 4 +- drivers/usb/typec/altmodes/displayport.c | 8 +- drivers/vhost/net.c | 3 + drivers/vhost/vhost.c | 3 +- drivers/vhost/vhost.h | 1 + drivers/video/fbdev/core/fbcon.c | 7 +- drivers/video/fbdev/smscufx.c | 46 +- drivers/watchdog/diag288_wdt.c | 15 +- drivers/xen/pvcalls-back.c | 8 +- fs/btrfs/volumes.c | 22 +- fs/btrfs/zlib.c | 2 +- fs/ceph/mds_client.c | 6 + fs/cifs/file.c | 4 +- fs/f2fs/gc.c | 18 +- fs/proc/task_mmu.c | 4 +- fs/squashfs/squashfs_fs.h | 2 +- fs/squashfs/squashfs_fs_sb.h | 2 +- fs/squashfs/xattr.h | 4 +- fs/squashfs/xattr_id.c | 4 +- include/linux/hugetlb.h | 19 +- include/linux/nvmem-provider.h | 4 +- include/linux/util_macros.h | 12 + include/uapi/linux/ip.h | 1 + include/uapi/linux/ipv6.h | 1 + kernel/bpf/verifier.c | 102 +- kernel/trace/bpf_trace.c | 3 +- kernel/trace/trace.c | 3 - mm/gup.c | 2 +- mm/hugetlb.c | 6 +- mm/memory-failure.c | 2 +- mm/memory_hotplug.c | 2 +- mm/mempolicy.c | 5 +- mm/migrate.c | 7 +- mm/page_alloc.c | 5 +- mm/swapfile.c | 1 + net/bridge/br_netfilter_hooks.c | 1 + net/can/j1939/address-claim.c | 40 + net/can/j1939/transport.c | 4 - net/ipv4/tcp_bpf.c | 4 +- net/netrom/af_netrom.c | 5 + net/openvswitch/datapath.c | 12 +- net/qrtr/ns.c | 5 +- net/rds/message.c | 6 +- net/x25/af_x25.c | 6 + net/xfrm/xfrm_compat.c | 4 +- net/xfrm/xfrm_input.c | 3 +- sound/pci/hda/patch_realtek.c | 3 + sound/pci/hda/patch_via.c | 3 + sound/pci/lx6464es/lx_core.c | 11 +- sound/synth/emux/emux_nrpn.c | 3 + tools/testing/selftests/net/forwarding/lib.sh | 4 +- tools/testing/selftests/net/udpgso_bench.sh | 24 +- tools/testing/selftests/net/udpgso_bench_rx.c | 4 +- tools/testing/selftests/net/udpgso_bench_tx.c | 36 +- 119 files changed, 1552 insertions(+), 839 deletions(-)

1 year, 10 months

8
8
0 0

[PATCH AUTOSEL 5.4 01/10] selftests/bpf: Verify copy_register_state() preserves parent/live fields

by Sasha Levin

From: Eduard Zingerman <eddyz87(a)gmail.com> [ Upstream commit b9fa9bc839291020b362ab5392e5f18ba79657ac ] A testcase to check that verifier.c:copy_register_state() preserves register parentage chain and livness information. Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20230106142214.1040390-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- .../selftests/bpf/verifier/search_pruning.c | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/tools/testing/selftests/bpf/verifier/search_pruning.c b/tools/testing/selftests/bpf/verifier/search_pruning.c index 7e50cb80873a5..7e36078f8f482 100644 --- a/tools/testing/selftests/bpf/verifier/search_pruning.c +++ b/tools/testing/selftests/bpf/verifier/search_pruning.c @@ -154,3 +154,39 @@ .result_unpriv = ACCEPT, .insn_processed = 15, }, +/* The test performs a conditional 64-bit write to a stack location + * fp[-8], this is followed by an unconditional 8-bit write to fp[-8], + * then data is read from fp[-8]. This sequence is unsafe. + * + * The test would be mistakenly marked as safe w/o dst register parent + * preservation in verifier.c:copy_register_state() function. + * + * Note the usage of BPF_F_TEST_STATE_FREQ to force creation of the + * checkpoint state after conditional 64-bit assignment. + */ +{ + "write tracking and register parent chain bug", + .insns = { + /* r6 = ktime_get_ns() */ + BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), + /* r0 = ktime_get_ns() */ + BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns), + /* if r0 > r6 goto +1 */ + BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_6, 1), + /* *(u64 *)(r10 - 8) = 0xdeadbeef */ + BPF_ST_MEM(BPF_DW, BPF_REG_FP, -8, 0xdeadbeef), + /* r1 = 42 */ + BPF_MOV64_IMM(BPF_REG_1, 42), + /* *(u8 *)(r10 - 8) = r1 */ + BPF_STX_MEM(BPF_B, BPF_REG_FP, BPF_REG_1, -8), + /* r2 = *(u64 *)(r10 - 8) */ + BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_FP, -8), + /* exit(0) */ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .flags = BPF_F_TEST_STATE_FREQ, + .errstr = "invalid read from stack off -8+1 size 8", + .result = REJECT, +}, -- 2.39.0

1 year, 10 months

2
10
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2023