March 2023 - Linux-stable-mirror

[PATCH 3/3] xhci: Free the command allocated for setting LPM if we return early

by Mathias Nyman

The command allocated to set exit latency LPM values need to be freed in case the command is never queued. This would be the case if there is no change in exit latency values, or device is missing. Reported-by: Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr> Link: https://lore.kernel.org/linux-usb/24263902-c9b3-ce29-237b-1c3d6918f4fe@alu.… Tested-by: Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr> Fixes: 5c2a380a5aa8 ("xhci: Allocate separate command structures for each LPM command") Cc: <Stable(a)vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index bdb6dd819a3b..6307bae9cddf 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -4442,6 +4442,7 @@ static int __maybe_unused xhci_change_max_exit_latency(struct xhci_hcd *xhci, if (!virt_dev || max_exit_latency == virt_dev->current_mel) { spin_unlock_irqrestore(&xhci->lock, flags); + xhci_free_command(xhci, command); return 0; } -- 2.25.1

2 years, 2 months

3
7
0 0

[PATCH v1] drm/bridge: lt8912b: Fix DSI Video Mode

by Francesco Dolcini

From: Francesco Dolcini <francesco.dolcini(a)toradex.com> LT8912 DSI port supports only Non-Burst mode video operation with Sync Events and continuous clock on clock lane, correct dsi mode flags according to that removing MIPI_DSI_MODE_VIDEO_BURST flag. Cc: <stable(a)vger.kernel.org> Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com> --- drivers/gpu/drm/bridge/lontium-lt8912b.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c index b40baced1331..13c131ade268 100644 --- a/drivers/gpu/drm/bridge/lontium-lt8912b.c +++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c @@ -504,7 +504,6 @@ static int lt8912_attach_dsi(struct lt8912 *lt) dsi->format = MIPI_DSI_FMT_RGB888; dsi->mode_flags = MIPI_DSI_MODE_VIDEO | - MIPI_DSI_MODE_VIDEO_BURST | MIPI_DSI_MODE_LPM | MIPI_DSI_MODE_NO_EOT_PACKET; -- 2.25.1

2 years, 2 months

3
2
0 0

[PATCH v2] mm: Take a page reference when removing device exclusive entries

by Alistair Popple

Device exclusive page table entries are used to prevent CPU access to a page whilst it is being accessed from a device. Typically this is used to implement atomic operations when the underlying bus does not support atomic access. When a CPU thread encounters a device exclusive entry it locks the page and restores the original entry after calling mmu notifiers to signal drivers that exclusive access is no longer available. The device exclusive entry holds a reference to the page making it safe to access the struct page whilst the entry is present. However the fault handling code does not hold the PTL when taking the page lock. This means if there are multiple threads faulting concurrently on the device exclusive entry one will remove the entry whilst others will wait on the page lock without holding a reference. This can lead to threads locking or waiting on a folio with a zero refcount. Whilst mmap_lock prevents the pages getting freed via munmap() they may still be freed by a migration. This leads to warnings such as PAGE_FLAGS_CHECK_AT_FREE due to the page being locked when the refcount drops to zero. Fix this by trying to take a reference on the folio before locking it. The code already checks the PTE under the PTL and aborts if the entry is no longer there. It is also possible the folio has been unmapped, freed and re-allocated allowing a reference to be taken on an unrelated folio. This case is also detected by the PTE check and the folio is unlocked without further changes. Signed-off-by: Alistair Popple <apopple(a)nvidia.com> Reviewed-by: Ralph Campbell <rcampbell(a)nvidia.com> Reviewed-by: John Hubbard <jhubbard(a)nvidia.com> Fixes: b756a3b5e7ea ("mm: device exclusive memory access") Cc: stable(a)vger.kernel.org --- Changes for v2: - Rebased to Linus master - Reworded commit message - Switched to using folios (thanks Matthew!) - Added Reviewed-by's --- mm/memory.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index f456f3b5049c..01a23ad48a04 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3563,8 +3563,21 @@ static vm_fault_t remove_device_exclusive_entry(struct vm_fault *vmf) struct vm_area_struct *vma = vmf->vma; struct mmu_notifier_range range; - if (!folio_lock_or_retry(folio, vma->vm_mm, vmf->flags)) + /* + * We need a reference to lock the folio because we don't hold + * the PTL so a racing thread can remove the device-exclusive + * entry and unmap it. If the folio is free the entry must + * have been removed already. If it happens to have already + * been re-allocated after being freed all we do is lock and + * unlock it. + */ + if (!folio_try_get(folio)) + return 0; + + if (!folio_lock_or_retry(folio, vma->vm_mm, vmf->flags)) { + folio_put(folio); return VM_FAULT_RETRY; + } mmu_notifier_range_init_owner(&range, MMU_NOTIFY_EXCLUSIVE, 0, vma->vm_mm, vmf->address & PAGE_MASK, (vmf->address & PAGE_MASK) + PAGE_SIZE, NULL); @@ -3577,6 +3590,7 @@ static vm_fault_t remove_device_exclusive_entry(struct vm_fault *vmf) pte_unmap_unlock(vmf->pte, vmf->ptl); folio_unlock(folio); + folio_put(folio); mmu_notifier_invalidate_range_end(&range); return 0; -- 2.39.2

2 years, 2 months

4
4
0 0

[PATCH] xhci: Free the command allocated for setting LPM if we return early

by Mathias Nyman

The command allocated to set exit latency LPM values need to be freed in case the command is never queued. This would be the case if there is no change in exit latency values, or device is missing. Fixes: 5c2a380a5aa8 ("xhci: Allocate separate command structures for each LPM command") Cc: <Stable(a)vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index bdb6dd819a3b..6307bae9cddf 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -4442,6 +4442,7 @@ static int __maybe_unused xhci_change_max_exit_latency(struct xhci_hcd *xhci, if (!virt_dev || max_exit_latency == virt_dev->current_mel) { spin_unlock_irqrestore(&xhci->lock, flags); + xhci_free_command(xhci, command); return 0; } -- 2.25.1

2 years, 2 months

3
6
0 0

FAILED: patch "[PATCH] block/io_uring: pass in issue_flags for uring_cmd task_work" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 9d2789ac9d60c049d26ef6d3005d9c94c5a559e9 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '168000366614476(a)kroah.com' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 9d2789ac9d60 ("block/io_uring: pass in issue_flags for uring_cmd task_work handling") b2cf789f6cb6 ("Merge branch 'for-6.2/io_uring' into for-6.2/io_uring-next") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9d2789ac9d60c049d26ef6d3005d9c94c5a559e9 Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe(a)kernel.dk> Date: Mon, 20 Mar 2023 20:01:25 -0600 Subject: [PATCH] block/io_uring: pass in issue_flags for uring_cmd task_work handling io_uring_cmd_done() currently assumes that the uring_lock is held when invoked, and while it generally is, this is not guaranteed. Pass in the issue_flags associated with it, so that we have IO_URING_F_UNLOCKED available to be able to lock the CQ ring appropriately when completing events. Cc: stable(a)vger.kernel.org Fixes: ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd") Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index fb5a557afde8..c73cc57ec547 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -715,7 +715,8 @@ static void __ublk_fail_req(struct ublk_queue *ubq, struct ublk_io *io, } } -static void ubq_complete_io_cmd(struct ublk_io *io, int res) +static void ubq_complete_io_cmd(struct ublk_io *io, int res, + unsigned issue_flags) { /* mark this cmd owned by ublksrv */ io->flags |= UBLK_IO_FLAG_OWNED_BY_SRV; @@ -727,7 +728,7 @@ static void ubq_complete_io_cmd(struct ublk_io *io, int res) io->flags &= ~UBLK_IO_FLAG_ACTIVE; /* tell ublksrv one io request is coming */ - io_uring_cmd_done(io->cmd, res, 0); + io_uring_cmd_done(io->cmd, res, 0, issue_flags); } #define UBLK_REQUEUE_DELAY_MS 3 @@ -744,7 +745,8 @@ static inline void __ublk_abort_rq(struct ublk_queue *ubq, mod_delayed_work(system_wq, &ubq->dev->monitor_work, 0); } -static inline void __ublk_rq_task_work(struct request *req) +static inline void __ublk_rq_task_work(struct request *req, + unsigned issue_flags) { struct ublk_queue *ubq = req->mq_hctx->driver_data; int tag = req->tag; @@ -782,7 +784,7 @@ static inline void __ublk_rq_task_work(struct request *req) pr_devel("%s: need get data. op %d, qid %d tag %d io_flags %x\n", __func__, io->cmd->cmd_op, ubq->q_id, req->tag, io->flags); - ubq_complete_io_cmd(io, UBLK_IO_RES_NEED_GET_DATA); + ubq_complete_io_cmd(io, UBLK_IO_RES_NEED_GET_DATA, issue_flags); return; } /* @@ -820,17 +822,18 @@ static inline void __ublk_rq_task_work(struct request *req) mapped_bytes >> 9; } - ubq_complete_io_cmd(io, UBLK_IO_RES_OK); + ubq_complete_io_cmd(io, UBLK_IO_RES_OK, issue_flags); } -static inline void ublk_forward_io_cmds(struct ublk_queue *ubq) +static inline void ublk_forward_io_cmds(struct ublk_queue *ubq, + unsigned issue_flags) { struct llist_node *io_cmds = llist_del_all(&ubq->io_cmds); struct ublk_rq_data *data, *tmp; io_cmds = llist_reverse_order(io_cmds); llist_for_each_entry_safe(data, tmp, io_cmds, node) - __ublk_rq_task_work(blk_mq_rq_from_pdu(data)); + __ublk_rq_task_work(blk_mq_rq_from_pdu(data), issue_flags); } static inline void ublk_abort_io_cmds(struct ublk_queue *ubq) @@ -842,12 +845,12 @@ static inline void ublk_abort_io_cmds(struct ublk_queue *ubq) __ublk_abort_rq(ubq, blk_mq_rq_from_pdu(data)); } -static void ublk_rq_task_work_cb(struct io_uring_cmd *cmd) +static void ublk_rq_task_work_cb(struct io_uring_cmd *cmd, unsigned issue_flags) { struct ublk_uring_cmd_pdu *pdu = ublk_get_uring_cmd_pdu(cmd); struct ublk_queue *ubq = pdu->ubq; - ublk_forward_io_cmds(ubq); + ublk_forward_io_cmds(ubq, issue_flags); } static void ublk_rq_task_work_fn(struct callback_head *work) @@ -856,8 +859,9 @@ static void ublk_rq_task_work_fn(struct callback_head *work) struct ublk_rq_data, work); struct request *req = blk_mq_rq_from_pdu(data); struct ublk_queue *ubq = req->mq_hctx->driver_data; + unsigned issue_flags = IO_URING_F_UNLOCKED; - ublk_forward_io_cmds(ubq); + ublk_forward_io_cmds(ubq, issue_flags); } static void ublk_queue_cmd(struct ublk_queue *ubq, struct request *rq) @@ -1111,7 +1115,8 @@ static void ublk_cancel_queue(struct ublk_queue *ubq) struct ublk_io *io = &ubq->ios[i]; if (io->flags & UBLK_IO_FLAG_ACTIVE) - io_uring_cmd_done(io->cmd, UBLK_IO_RES_ABORT, 0); + io_uring_cmd_done(io->cmd, UBLK_IO_RES_ABORT, 0, + IO_URING_F_UNLOCKED); } /* all io commands are canceled */ @@ -1351,7 +1356,7 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) return -EIOCBQUEUED; out: - io_uring_cmd_done(cmd, ret, 0); + io_uring_cmd_done(cmd, ret, 0, issue_flags); pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n", __func__, cmd_op, tag, ret, io->flags); return -EIOCBQUEUED; @@ -2234,7 +2239,7 @@ static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, if (ub) ublk_put_device(ub); out: - io_uring_cmd_done(cmd, ret, 0); + io_uring_cmd_done(cmd, ret, 0, issue_flags); pr_devel("%s: cmd done ret %d cmd_op %x, dev id %d qid %d\n", __func__, ret, cmd->cmd_op, header->dev_id, header->queue_id); return -EIOCBQUEUED; diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index 723e7d5b778f..d24ea2e05156 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -464,7 +464,8 @@ static inline struct nvme_uring_cmd_pdu *nvme_uring_cmd_pdu( return (struct nvme_uring_cmd_pdu *)&ioucmd->pdu; } -static void nvme_uring_task_meta_cb(struct io_uring_cmd *ioucmd) +static void nvme_uring_task_meta_cb(struct io_uring_cmd *ioucmd, + unsigned issue_flags) { struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd); struct request *req = pdu->req; @@ -485,17 +486,18 @@ static void nvme_uring_task_meta_cb(struct io_uring_cmd *ioucmd) blk_rq_unmap_user(req->bio); blk_mq_free_request(req); - io_uring_cmd_done(ioucmd, status, result); + io_uring_cmd_done(ioucmd, status, result, issue_flags); } -static void nvme_uring_task_cb(struct io_uring_cmd *ioucmd) +static void nvme_uring_task_cb(struct io_uring_cmd *ioucmd, + unsigned issue_flags) { struct nvme_uring_cmd_pdu *pdu = nvme_uring_cmd_pdu(ioucmd); if (pdu->bio) blk_rq_unmap_user(pdu->bio); - io_uring_cmd_done(ioucmd, pdu->nvme_status, pdu->u.result); + io_uring_cmd_done(ioucmd, pdu->nvme_status, pdu->u.result, issue_flags); } static enum rq_end_io_ret nvme_uring_cmd_end_io(struct request *req, @@ -517,7 +519,7 @@ static enum rq_end_io_ret nvme_uring_cmd_end_io(struct request *req, * Otherwise, move the completion to task work. */ if (cookie != NULL && blk_rq_is_poll(req)) - nvme_uring_task_cb(ioucmd); + nvme_uring_task_cb(ioucmd, IO_URING_F_UNLOCKED); else io_uring_cmd_complete_in_task(ioucmd, nvme_uring_task_cb); @@ -539,7 +541,7 @@ static enum rq_end_io_ret nvme_uring_cmd_end_io_meta(struct request *req, * Otherwise, move the completion to task work. */ if (cookie != NULL && blk_rq_is_poll(req)) - nvme_uring_task_meta_cb(ioucmd); + nvme_uring_task_meta_cb(ioucmd, IO_URING_F_UNLOCKED); else io_uring_cmd_complete_in_task(ioucmd, nvme_uring_task_meta_cb); diff --git a/include/linux/io_uring.h b/include/linux/io_uring.h index 934e5dd4ccc0..35b9328ca335 100644 --- a/include/linux/io_uring.h +++ b/include/linux/io_uring.h @@ -27,7 +27,7 @@ struct io_uring_cmd { const void *cmd; union { /* callback to defer completions to task context */ - void (*task_work_cb)(struct io_uring_cmd *cmd); + void (*task_work_cb)(struct io_uring_cmd *cmd, unsigned); /* used for polled completion */ void *cookie; }; @@ -39,9 +39,10 @@ struct io_uring_cmd { #if defined(CONFIG_IO_URING) int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw, struct iov_iter *iter, void *ioucmd); -void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, ssize_t res2); +void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, ssize_t res2, + unsigned issue_flags); void io_uring_cmd_complete_in_task(struct io_uring_cmd *ioucmd, - void (*task_work_cb)(struct io_uring_cmd *)); + void (*task_work_cb)(struct io_uring_cmd *, unsigned)); struct sock *io_uring_get_socket(struct file *file); void __io_uring_cancel(bool cancel_all); void __io_uring_free(struct task_struct *tsk); @@ -72,11 +73,11 @@ static inline int io_uring_cmd_import_fixed(u64 ubuf, unsigned long len, int rw, return -EOPNOTSUPP; } static inline void io_uring_cmd_done(struct io_uring_cmd *cmd, ssize_t ret, - ssize_t ret2) + ssize_t ret2, unsigned issue_flags) { } static inline void io_uring_cmd_complete_in_task(struct io_uring_cmd *ioucmd, - void (*task_work_cb)(struct io_uring_cmd *)) + void (*task_work_cb)(struct io_uring_cmd *, unsigned)) { } static inline struct sock *io_uring_get_socket(struct file *file) diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c index 446a189b78b0..e535e8db01e3 100644 --- a/io_uring/uring_cmd.c +++ b/io_uring/uring_cmd.c @@ -15,12 +15,13 @@ static void io_uring_cmd_work(struct io_kiocb *req, bool *locked) { struct io_uring_cmd *ioucmd = io_kiocb_to_cmd(req, struct io_uring_cmd); + unsigned issue_flags = *locked ? 0 : IO_URING_F_UNLOCKED; - ioucmd->task_work_cb(ioucmd); + ioucmd->task_work_cb(ioucmd, issue_flags); } void io_uring_cmd_complete_in_task(struct io_uring_cmd *ioucmd, - void (*task_work_cb)(struct io_uring_cmd *)) + void (*task_work_cb)(struct io_uring_cmd *, unsigned)) { struct io_kiocb *req = cmd_to_io_kiocb(ioucmd); @@ -42,7 +43,8 @@ static inline void io_req_set_cqe32_extra(struct io_kiocb *req, * Called by consumers of io_uring_cmd, if they originally returned * -EIOCBQUEUED upon receiving the command. */ -void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2) +void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2, + unsigned issue_flags) { struct io_kiocb *req = cmd_to_io_kiocb(ioucmd); @@ -56,7 +58,7 @@ void io_uring_cmd_done(struct io_uring_cmd *ioucmd, ssize_t ret, ssize_t res2) /* order with io_iopoll_req_issued() checking ->iopoll_complete */ smp_store_release(&req->iopoll_completed, 1); else - io_req_complete_post(req, 0); + io_req_complete_post(req, issue_flags); } EXPORT_SYMBOL_GPL(io_uring_cmd_done);

2 years, 2 months

3
2
0 0

[PATCH 01/29] Revert "userfaultfd: don't fail on unrecognized features"

by Peter Xu

This is a proposal to revert commit 914eedcb9ba0ff53c33808. I found this when writting a simple UFFDIO_API test to be the first unit test in this set. Two things breaks with the commit: - UFFDIO_API check was lost and missing. According to man page, the kernel should reject ioctl(UFFDIO_API) if uffdio_api.api != 0xaa. This check is needed if the api version will be extended in the future, or user app won't be able to identify which is a new kernel. - Feature flags checks were removed, which means UFFDIO_API with a feature that does not exist will also succeed. According to the man page, we should (and it makes sense) to reject ioctl(UFFDIO_API) if unknown features passed in. Link: https://lore.kernel.org/r/20220722201513.1624158-1-axelrasmussen@google.com Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: linux-stable <stable(a)vger.kernel.org> Signed-off-by: Peter Xu <peterx(a)redhat.com> --- fs/userfaultfd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 8395605790f6..3b2a41c330e6 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -1977,8 +1977,10 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, ret = -EFAULT; if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api))) goto out; - /* Ignore unsupported features (userspace built against newer kernel) */ - features = uffdio_api.features & UFFD_API_FEATURES; + features = uffdio_api.features; + ret = -EINVAL; + if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) + goto err_out; ret = -EPERM; if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE)) goto err_out; -- 2.39.1

2 years, 2 months

4
8
0 0

Linux 5.15.103

by Greg Kroah-Hartman

I'm announcing the release of the 5.15.103 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/kernel-parameters.txt | 51 +- Documentation/trace/ftrace.rst | 2 Makefile | 3 arch/alpha/kernel/module.c | 4 arch/arm64/include/asm/efi.h | 6 arch/arm64/kernel/efi.c | 2 arch/mips/include/asm/mach-rc32434/pci.h | 2 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 1 arch/powerpc/kernel/iommu.c | 4 arch/powerpc/kernel/time.c | 4 arch/powerpc/kernel/vmlinux.lds.S | 6 arch/riscv/include/asm/ftrace.h | 2 arch/riscv/include/asm/parse_asm.h | 5 arch/riscv/include/asm/patch.h | 2 arch/riscv/kernel/ftrace.c | 14 arch/riscv/kernel/patch.c | 28 + arch/riscv/kernel/stacktrace.c | 2 arch/riscv/kernel/traps.c | 14 arch/s390/kernel/ftrace.c | 86 --- arch/s390/kernel/vmlinux.lds.S | 2 arch/sh/kernel/vmlinux.lds.S | 1 arch/um/kernel/vmlinux.lds.S | 2 arch/x86/kernel/cpu/amd.c | 9 arch/x86/kvm/lapic.c | 1 arch/x86/kvm/svm/avic.c | 28 - arch/x86/kvm/vmx/evmcs.h | 11 arch/x86/kvm/vmx/vmx.c | 44 + drivers/block/brd.c | 10 drivers/block/nbd.c | 14 drivers/char/ipmi/ipmi_ssif.c | 34 + drivers/char/tpm/eventlog/acpi.c | 6 drivers/gpu/drm/amd/amdgpu/soc15.c | 5 drivers/gpu/drm/drm_atomic.c | 1 drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 6 drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 4 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 6 drivers/gpu/drm/msm/msm_gem_submit.c | 5 drivers/gpu/drm/nouveau/dispnv50/disp.c | 16 drivers/gpu/drm/nouveau/dispnv50/wndw.c | 12 drivers/gpu/drm/nouveau/dispnv50/wndw.h | 7 drivers/iommu/amd/init.c | 105 +++- drivers/iommu/intel/pasid.c | 7 drivers/macintosh/windfarm_lm75_sensor.c | 4 drivers/macintosh/windfarm_smu_sensors.c | 4 drivers/media/i2c/ov5640.c | 2 drivers/media/rc/gpio-ir-recv.c | 18 drivers/net/dsa/mt7530.c | 35 - drivers/net/ethernet/broadcom/bgmac.c | 8 drivers/net/ethernet/broadcom/bgmac.h | 2 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 - drivers/net/ethernet/intel/ice/ice_ethtool.c | 6 drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 5 drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 7 drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 16 drivers/net/ethernet/marvell/octeontx2/af/rvu_npa.c | 58 ++ drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h | 3 drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 drivers/net/phy/microchip.c | 32 + drivers/net/phy/phy_device.c | 8 drivers/net/phy/smsc.c | 20 drivers/net/usb/lan78xx.c | 27 - drivers/nfc/fdp/i2c.c | 4 drivers/platform/x86/Kconfig | 3 drivers/regulator/core.c | 27 + drivers/scsi/hosts.c | 2 drivers/scsi/megaraid/megaraid_sas.h | 2 drivers/scsi/megaraid/megaraid_sas_fp.c | 2 drivers/staging/rtl8723bs/core/rtw_ap.c | 20 drivers/staging/rtl8723bs/core/rtw_cmd.c | 96 ++-- drivers/staging/rtl8723bs/core/rtw_ioctl_set.c | 4 drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 56 +- drivers/staging/rtl8723bs/core/rtw_security.c | 6 drivers/staging/rtl8723bs/include/rtw_security.h | 8 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 355 +++++----------- drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 51 +- drivers/staging/rtl8723bs/os_dep/os_intfs.c | 4 fs/attr.c | 72 +++ fs/btrfs/block-group.c | 3 fs/dlm/lockspace.c | 21 fs/dlm/lowcomms.c | 16 fs/dlm/lowcomms.h | 1 fs/dlm/main.c | 7 fs/dlm/midcomms.c | 17 fs/dlm/midcomms.h | 3 fs/ext4/block_validity.c | 26 - fs/ext4/ext4.h | 3 fs/ext4/fsmap.c | 2 fs/ext4/inline.c | 1 fs/ext4/inode.c | 7 fs/ext4/ioctl.c | 1 fs/ext4/mballoc.c | 205 +++++---- fs/ext4/namei.c | 36 + fs/ext4/page-io.c | 11 fs/ext4/xattr.c | 3 fs/f2fs/checkpoint.c | 2 fs/f2fs/compress.c | 2 fs/f2fs/data.c | 8 fs/f2fs/f2fs.h | 2 fs/f2fs/file.c | 2 fs/f2fs/gc.c | 6 fs/f2fs/inline.c | 4 fs/f2fs/inode.c | 14 fs/f2fs/node.c | 23 - fs/f2fs/recovery.c | 2 fs/f2fs/segment.c | 2 fs/file.c | 1 fs/fuse/file.c | 2 fs/inode.c | 90 ++-- fs/internal.h | 10 fs/locks.c | 3 fs/namei.c | 82 +++ fs/namespace.c | 29 - fs/ocfs2/file.c | 4 fs/ocfs2/namei.c | 1 fs/open.c | 8 fs/udf/inode.c | 2 fs/xfs/xfs_bmap_util.c | 9 fs/xfs/xfs_file.c | 24 - fs/xfs/xfs_iops.c | 56 -- fs/xfs/xfs_iops.h | 1 fs/xfs/xfs_pnfs.c | 9 include/asm-generic/vmlinux.lds.h | 5 include/linux/fs.h | 6 include/linux/pci_ids.h | 2 include/net/netfilter/nf_tproxy.h | 7 kernel/bpf/btf.c | 1 kernel/fork.c | 2 kernel/irq/irqdomain.c | 152 ++++-- kernel/watch_queue.c | 1 net/caif/caif_usb.c | 3 net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 net/ipv4/tcp_bpf.c | 6 net/ipv4/udp_bpf.c | 3 net/ipv6/ila/ila_xlat.c | 1 net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 net/netfilter/nf_conntrack_core.c | 4 net/netfilter/nf_conntrack_netlink.c | 14 net/nfc/netlink.c | 2 net/smc/af_smc.c | 13 net/sunrpc/svc.c | 6 net/unix/af_unix.c | 16 net/unix/unix_bpf.c | 3 scripts/checkkconfigsymbols.py | 13 scripts/clang-tools/run-clang-tools.py | 21 scripts/diffconfig | 16 tools/bpf/Makefile | 5 tools/bpf/bpf_jit_disasm.c | 5 tools/bpf/bpftool/Makefile | 5 tools/bpf/bpftool/jit_disasm.c | 42 + tools/build/Makefile.feature | 1 tools/build/feature/Makefile | 4 tools/build/feature/test-all.c | 4 tools/build/feature/test-disassembler-init-styled.c | 13 tools/include/tools/dis-asm-compat.h | 55 ++ tools/perf/Makefile.config | 8 tools/perf/builtin-inject.c | 1 tools/perf/builtin-stat.c | 15 tools/perf/util/annotate.c | 7 tools/perf/util/stat.c | 6 tools/perf/util/stat.h | 1 tools/perf/util/target.h | 12 tools/testing/selftests/netfilter/nft_nat.sh | 2 virt/kvm/kvm_main.c | 145 ++++-- 166 files changed, 1779 insertions(+), 1189 deletions(-) Alex Deucher (1): drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 Alexander Aring (3): fs: dlm: fix log of lowcomms vs midcomms fs: dlm: add midcomms init/start functions fs: dlm: start midcomms before scand Alexandre Ghiti (1): riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode Alexandru Matei (1): KVM: VMX: Fix crash due to uninitialized current_vmcs Alvaro Karsz (1): PCI: Add SolidRun vendor ID Andres Freund (5): tools build: Add feature test for init_disassemble_info API changes tools include: add dis-asm-compat.h to handle version differences tools perf: Fix compilation error with new binutils tools bpf_jit_disasm: Fix compilation error with new binutils tools bpftool: Fix compilation error with new binutils Andrew Cooper (1): x86/CPU/AMD: Disable XSAVES on AMD family 0x17 Bart Van Assche (1): scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Ben Skeggs (1): drm/nouveau/kms/nv50-: remove unused functions Benjamin Coddington (1): SUNRPC: Fix a server shutdown leak Chandrakanth Patil (1): scsi: megaraid_sas: Update max supported LD IDs to 240 Changbin Du (1): perf stat: Fix counting when initial delay configured Christian Brauner (6): attr: add in_group_or_capable() fs: move should_remove_suid() attr: add setattr_should_drop_sgid() attr: use consistent sgid stripping checks fs: use consistent setgid checks in is_sxid() fs: hold writers when changing mount's idmapping Christian Kohlschütter (1): regulator: core: Fix off-on-delay-us for always-on/boot-on regulators Christoph Hellwig (1): nbd: use the correct block_device in nbd_bdev_reset Conor Dooley (1): RISC-V: Don't check text_mutex during stop_machine Corey Minyard (2): ipmi:ssif: Increase the message retry time ipmi:ssif: Add a timer between request retries D. Wythe (1): net/smc: fix fallback failed while sendmsg with fastopen Daniel Golle (1): net: ethernet: mtk_eth_soc: fix RX data corruption issue Darrick J. Wong (2): ext4: fix another off-by-one fsmap error on 1k block filesystems xfs: use setattr_copy to set vfs inode attributes Dave Chinner (3): xfs: remove XFS_PREALLOC_SYNC xfs: fallocate() should call file_modified() xfs: set prealloc flag in xfs_alloc_file_space() David Disseldorp (1): watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths Dmitry Baryshkov (5): drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register drm/msm/a5xx: fix highest bank bit for a530 drm/msm/a5xx: fix the emptyness check in the preempt code drm/msm/a5xx: fix context faults during ring switch drm/msm/dpu: fix len of sc7180 ctl blocks Edward Humes (1): alpha: fix R_ALPHA_LITERAL reloc for large modules Eric Biggers (1): ext4: fix cgroup writeback accounting with fs-layer encryption Eric Dumazet (3): ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() netfilter: conntrack: adopt safer max chain length af_unix: fix struct pid leaks in OOB support Eric Whitney (1): ext4: fix RENAME_WHITEOUT handling for inline directories Fedor Pchelkin (1): nfc: change order inside nfc_se_io error path Florian Westphal (1): netfilter: tproxy: fix deadlock due to missing BH disable Gaosheng Cui (1): xfs: remove xfs_setattr_time() declaration Gavrilov Ilia (1): iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter Greg Kroah-Hartman (2): powerpc/iommu: fix memory leak with using debugfs_lookup() Linux 5.15.103 Hangbin Liu (1): selftests: nft_nat: ensuring the listening side is up before starting the client Hannes Braun (1): staging: rtl8723bs: fix placement of braces Hans de Goede (2): staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss() staging: rtl8723bs: Fix key-store index handling Harry Wentland (1): drm/connector: print max_requested_bpc in state debugfs Heiko Carstens (1): s390/ftrace: remove dead code Heiner Kallweit (1): net: phy: smsc: fix link up detection in forced irq mode Ivan Delalande (1): netfilter: ctnetlink: revert to dumping mark regardless of event type Jacob Pan (1): iommu/vt-d: Fix PASID directory pointer coherency Jaegeuk Kim (3): f2fs: avoid down_write on nat_tree_lock during checkpoint f2fs: do not bother checkpoint by f2fs_get_node_info f2fs: retry to update the inode page given data corruption Jagath Jog J (1): Staging: rtl8723bs: Placing opening { braces in previous line Jan Kara (3): udf: Fix off-by-one error when discarding preallocation ext4: Fix possible corruption when moving a directory ext4: Fix deadlock during directory rename Jens Axboe (1): brd: mark as nowait compatible Jiri Slaby (SUSE) (1): drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype Johan Hovold (2): irqdomain: Refactor __irq_domain_alloc_irqs() irqdomain: Fix mapping-creation race Johannes Thumshirn (1): btrfs: fix percent calculation for bg reclaim message Kang Chen (1): nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties Kim Phillips (1): iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options Kuniyuki Iwashima (1): af_unix: Remove unnecessary brackets around CONFIG_AF_UNIX_OOB. Li Jun (1): media: rc: gpio-ir-recv: add remove function Liao Chang (1): riscv: Add header include guards to insn.h Liu Jian (1): bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() Lorenz Bauer (1): btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR Luis Chamberlain (1): block/brd: add error handling support for add_disk() Lukas Czerner (1): ext4: block range must be validated before use in ext4_mb_clear_bb() Lukas Wunner (1): net: phy: smsc: Cache interrupt mask Mark Brown (1): regulator: Flag uncontrollable regulators as always_on Masahiro Yamada (4): scripts: handle BrokenPipeError for python scripts arch: fix broken BuildID for arm64 and riscv s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 UML: define RUNTIME_DISCARD_EXIT Matthias Kaehlcke (1): regulator: core: Use ktime_get_boottime() to determine how long a regulator was off Mattias Nissler (1): riscv: Avoid enabling interrupts in die() Miaohe Lin (1): KVM: fix memoryleak in kvm_init() Michael Chan (1): bnxt_en: Avoid order-5 memory allocation for TPA data Michael Ellerman (2): powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds Michael Straube (1): staging: rtl8723bs: clean up comparsions to NULL Morten Linderud (1): tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address Namhyung Kim (1): perf inject: Fix --buildid-all not to eat up MMAP2 Nathan Chancellor (1): macintosh: windfarm: Use unsigned type for 1-bit bitfields Nick Desaulniers (1): Makefile: use -gdwarf-{4|5} for assembler for DEBUG_INFO_DWARF{4|5} Palmer Dabbelt (1): RISC-V: Avoid dereferening NULL regs in die() Paul Elder (1): media: ov5640: Fix analogue gain control Petr Oros (1): ice: copy last block omitted in ice_get_module_eeprom() Pierre Gondois (1): arm64: efi: Make efi_rt_lock a raw_spinlock Rafał Miłecki (1): bgmac: fix *initial* chip reset to support BCM5358 Randy Dunlap (1): platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it Ritesh Harjani (3): ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb() ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid() ext4: add strict range checks while freeing blocks Rob Clark (1): drm/msm: Fix potential invalid ptr free Rohan McLure (1): powerpc/kcsan: Exclude udelay to prevent recursive instrumentation Rongguang Wei (1): net: stmmac: add to set device wake up flag when stmmac init phy Russell King (Oracle) (1): net: phylib: get rid of unnecessary locking Sean Christopherson (3): KVM: Register /dev/kvm as the _very_ last thing during initialization KVM: SVM: Don't rewrite guest ICR on AVIC IPI virtualization failure KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target Seth Forshee (1): filelocks: use mount idmapping for setlease permission check Shigeru Yoshida (1): net: caif: Fix use-after-free in cfusbl_device_notify() Suman Ghosh (1): octeontx2-af: Unlock contexts in the queue context cache in case of fault detection Suravee Suthikulpanit (1): iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands Theodore Ts'o (1): fs: prevent out-of-bounds array speculation when closing a file descriptor Tobias Klauser (1): fork: allow CLONE_NEWTIME in clone3 flags Tom Saeger (1): sh: define RUNTIME_DISCARD_EXIT Vitaly Kuznetsov (4): KVM: Optimize kvm_make_vcpus_request_mask() a bit KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except() KVM: nVMX: Don't use Enlightened MSR Bitmap for L3 KVM: VMX: Introduce vmx_msr_bitmap_l01_changed() helper Vladimir Oltean (2): powerpc: dts: t1040rdb: fix compatible string for Rev A boards net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC Yang Xu (2): fs: add mode_strip_sgid() helper fs: move S_ISGID stripping into the vfs_*() helpers Ye Bin (2): ext4: move where set the MAY_INLINE_DATA flag is set ext4: fix WARNING in ext4_update_inline_data Yuiko Oshino (1): net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver Zhihao Cheng (1): ext4: zero i_disksize when initializing the bootloader inode xurui (1): MIPS: Fix a compilation issue

2 years, 2 months

3
6
0 0

[PATCH] drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path

by Boris Brezillon

Make sure all bo->base.pages entries are either NULL or pointing to a valid page before calling drm_gem_shmem_put_pages(). Reported-by: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Cc: <stable(a)vger.kernel.org> Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") Signed-off-by: Boris Brezillon <boris.brezillon(a)collabora.com> --- drivers/gpu/drm/panfrost/panfrost_mmu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c index 569509c2ba27..d76dff201ea6 100644 --- a/drivers/gpu/drm/panfrost/panfrost_mmu.c +++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c @@ -460,6 +460,7 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, if (IS_ERR(pages[i])) { mutex_unlock(&bo->base.pages_lock); ret = PTR_ERR(pages[i]); + pages[i] = NULL; goto err_pages; } } -- 2.31.1

2 years, 2 months

2
2
0 0

[PATCH v2] bus: mhi: host: Range check CHDBOFF and ERDBOFF

by Jeffrey Hugo

If the value read from the CHDBOFF and ERDBOFF registers is outside the range of the MHI register space then an invalid address might be computed which later causes a kernel panic. Range check the read value to prevent a crash due to bad data from the device. Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells") Cc: stable(a)vger.kernel.org Signed-off-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy(a)quicinc.com> --- v2: -CC stable -Use ERANGE for the error code drivers/bus/mhi/host/init.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c index 3d779ee..b46a082 100644 --- a/drivers/bus/mhi/host/init.c +++ b/drivers/bus/mhi/host/init.c @@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl) return -EIO; } + if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) { + dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n", + val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)); + return -ERANGE; + } + /* Setup wake db */ mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB); mhi_cntrl->wake_set = false; @@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl) return -EIO; } + if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) { + dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n", + val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)); + return -ERANGE; + } + /* Setup event db address for each ev_ring */ mhi_event = mhi_cntrl->mhi_event; for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) { -- 2.7.4

2 years, 2 months

2
2
0 0

[PATCH] [i915] avoid infinite retries in GuC/HuC loading

by Alexandre Oliva

If two or more suitable entries with the same filename are found in __uc_fw_auto_select's fw_blobs, and that filename fails to load in the first attempt and in the retry, when __uc_fw_auto_select is called for the third time, the coincidence of strings will cause it to clear file_selected.path at the first hit, so it will return the second hit over and over again, indefinitely. Of course this doesn't occur with the pristine blob lists, but a modified version could run into this, e.g., patching in a duplicate entry, or (as in our case) disarming blob loading by remapping their names to "/*(DEBLOBBED)*/", given a toolchain that unifies identical string literals. Of course I'm ready to carry a patchlet to avoid this problem triggered by our (GNU Linux-libre's) intentional changes, but I figured you might be interested in fail-safing it even in accidental backporting circumstances. I realize it's not entirely foolproof: if the same string appears in two entries separated by a different one, the infinite loop might still occur. Catching that even more unlikely situation seemed too expensive. Link: https://www.fsfla.org/pipermail/linux-libre/2023-March/003506.html Cc: intel-gfx(a)lists.freedesktop.org Cc: stable(a)vger.kernel.org # 6.[12].x Signed-off-by: Alexandre Oliva <lxoliva(a)fsfla.org> --- drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c index 9d6f571097e6..2b7564a3ed82 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c @@ -259,7 +259,10 @@ __uc_fw_auto_select(struct drm_i915_private *i915, struct intel_uc_fw *uc_fw) uc_fw->file_selected.path = NULL; continue; - } + } else if (uc_fw->file_wanted.path == blob->path) + /* Avoid retrying forever when neighbor + entries point to the same path. */ + continue; uc_fw->file_selected.path = blob->path; uc_fw->file_wanted.path = blob->path; -- 2.25.1 -- Alexandre Oliva, happy hacker https://FSFLA.org/blogs/lxo/ Free Software Activist GNU Toolchain Engineer Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>

2 years, 2 months

3
6
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2023