November 2024 - Linux-stable-mirror

Re: Patch "lib: alloc_tag_module_unload must wait for pending kfree_rcu calls" has been added to the 6.11-stable tree

by Suren Baghdasaryan

On Fri, Nov 1, 2024 at 6:58 AM Sasha Levin <sashal(a)kernel.org> wrote: > > This is a note to let you know that I've just added the patch titled > > lib: alloc_tag_module_unload must wait for pending kfree_rcu calls > > to the 6.11-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > lib-alloc_tag_module_unload-must-wait-for-pending-kf.patch > and it can be found in the queue-6.11 subdirectory. Thanks Sasha! Could you please double-check that the prerequisite patch https://lore.kernel.org/all/20241021171003.2907935-1-surenb@google.com/ was also picked up? I don't see it in the queue-6.11 directory. Without that patch this one will cause build errors, that's why I sent them as a patchset. Thanks, Suren. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > > > commit 536dfe685ebd28b27ebfbc3d4b9168207b7e28a3 > Author: Florian Westphal <fw(a)strlen.de> > Date: Mon Oct 7 22:52:24 2024 +0200 > > lib: alloc_tag_module_unload must wait for pending kfree_rcu calls > > [ Upstream commit dc783ba4b9df3fb3e76e968b2cbeb9960069263c ] > > Ben Greear reports following splat: > ------------[ cut here ]------------ > net/netfilter/nf_nat_core.c:1114 module nf_nat func:nf_nat_register_fn has 256 allocated at module unload > WARNING: CPU: 1 PID: 10421 at lib/alloc_tag.c:168 alloc_tag_module_unload+0x22b/0x3f0 > Modules linked in: nf_nat(-) btrfs ufs qnx4 hfsplus hfs minix vfat msdos fat > ... > Hardware name: Default string Default string/SKYBAY, BIOS 5.12 08/04/2020 > RIP: 0010:alloc_tag_module_unload+0x22b/0x3f0 > codetag_unload_module+0x19b/0x2a0 > ? codetag_load_module+0x80/0x80 > > nf_nat module exit calls kfree_rcu on those addresses, but the free > operation is likely still pending by the time alloc_tag checks for leaks. > > Wait for outstanding kfree_rcu operations to complete before checking > resolves this warning. > > Reproducer: > unshare -n iptables-nft -t nat -A PREROUTING -p tcp > grep nf_nat /proc/allocinfo # will list 4 allocations > rmmod nft_chain_nat > rmmod nf_nat # will WARN. > > [akpm(a)linux-foundation.org: add comment] > Link: https://lkml.kernel.org/r/20241007205236.11847-1-fw@strlen.de > Fixes: a473573964e5 ("lib: code tagging module support") > Signed-off-by: Florian Westphal <fw(a)strlen.de> > Reported-by: Ben Greear <greearb(a)candelatech.com> > Closes: https://lore.kernel.org/netdev/bdaaef9d-4364-4171-b82b-bcfc12e207eb@candela… > Cc: Uladzislau Rezki <urezki(a)gmail.com> > Cc: Vlastimil Babka <vbabka(a)suse.cz> > Cc: Suren Baghdasaryan <surenb(a)google.com> > Cc: Kent Overstreet <kent.overstreet(a)linux.dev> > Cc: <stable(a)vger.kernel.org> > Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/lib/codetag.c b/lib/codetag.c > index afa8a2d4f3173..d1fbbb7c2ec3d 100644 > --- a/lib/codetag.c > +++ b/lib/codetag.c > @@ -228,6 +228,9 @@ bool codetag_unload_module(struct module *mod) > if (!mod) > return true; > > + /* await any module's kfree_rcu() operations to complete */ > + kvfree_rcu_barrier(); > + > mutex_lock(&codetag_lock); > list_for_each_entry(cttype, &codetag_types, link) { > struct codetag_module *found = NULL;

1 year

1
0
0 0

[PATCH] nvme: rdma: Add check for queue in nvmet_rdma_cm_handler()

by George Rurikov

From: MrRurikov <grurikov(a)gmal.com> After having been assigned to a NULL value at rdma.c:1758, pointer 'queue' is passed as 1st parameter in call to function 'nvmet_rdma_queue_established' at rdma.c:1773, as 1st parameter in call to function 'nvmet_rdma_queue_disconnect' at rdma.c:1787 and as 2nd parameter in call to function 'nvmet_rdma_queue_connect_fail' at rdma.c:1800, where it is dereferenced. I understand, that driver is confident that the RDMA_CM_EVENT_CONNECT_REQUEST event will occur first and perform initialization, but maliciously prepared hardware could send events in violation of the protocol. Nothing guarantees that the sequence of events will start with RDMA_CM_EVENT_CONNECT_REQUEST. Found by Linux Verification Center (linuxtesting.org) with SVACE Fixes: e1a2ee249b19 ("nvmet-rdma: Fix use after free in nvmet_rdma_cm_handler()") Cc: stable(a)vger.kernel.org Signed-off-by: George Rurikov <g.ryurikov(a)securitycode.ru> --- drivers/nvme/target/rdma.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c index 1b6264fa5803..becebc95f349 100644 --- a/drivers/nvme/target/rdma.c +++ b/drivers/nvme/target/rdma.c @@ -1770,8 +1770,10 @@ static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id, ret = nvmet_rdma_queue_connect(cm_id, event); break; case RDMA_CM_EVENT_ESTABLISHED: - nvmet_rdma_queue_established(queue); - break; + if (!queue) { + nvmet_rdma_queue_established(queue); + break; + } case RDMA_CM_EVENT_ADDR_CHANGE: if (!queue) { struct nvmet_rdma_port *port = cm_id->context; @@ -1782,8 +1784,10 @@ static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id, fallthrough; case RDMA_CM_EVENT_DISCONNECTED: case RDMA_CM_EVENT_TIMEWAIT_EXIT: - nvmet_rdma_queue_disconnect(queue); - break; + if (!queue) { + nvmet_rdma_queue_disconnect(queue); + break; + } case RDMA_CM_EVENT_DEVICE_REMOVAL: ret = nvmet_rdma_device_removal(cm_id, queue); break; @@ -1793,8 +1797,10 @@ static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id, fallthrough; case RDMA_CM_EVENT_UNREACHABLE: case RDMA_CM_EVENT_CONNECT_ERROR: - nvmet_rdma_queue_connect_fail(cm_id, queue); - break; + if (!queue) { + nvmet_rdma_queue_connect_fail(cm_id, queue); + break; + } default: pr_err("received unrecognized RDMA CM event %d\n", event->event); -- 2.34.1

1 year

3
3
0 0

Passenger traffic 2024

by Camille Batiste

Hey, Would you be interested in acquiring the attendees list of Passenger traffic Expo 2024? List contains: Names, Titles, Phone Numbers, Company Details, and more… Interested? Let me know so that I’ll send you the pricing for the same. Kind Regards, Camille Batiste Marketing Executive If you do not wish to receive our emails, please reply with "Not Interested."

1 year

1
0
0 0

[PATCH 0/1: 5.10/5.15] net: bridge: xmit: make sure we have at least eth header len bytes

by Randy.MacLeod＠windriver.com

From: Randy MacLeod <Randy.MacLeod(a)windriver.com> This is my first commit to -stable so I'm going to carefully explain what I've done. I work on the Yocto Project and I have done some work on the Linux network stack a long time ago so I'm not quite a complete newbie. I took the commit found here: https://lore.kernel.org/stable/20240527185645.658299380@linuxfoundation.org/ and backported as per my commit log: Based on above commit but simplified since pskb_may_pull_reason() does not exist until 6.1. I also trimmed the original commit log of the "Tested by dropwatch" section as well as the full stack trace since that may have changed in 5.10/5.15 and It compiles fine for 5.10 and 5.15 but I have not tested with dropwatch since the patch is just dropping short xmit packets for bridging. Finally, since the patch is much simpler than the original, I've removed the original patch author's SOB line. Please let me know if any of this is not what y'all'd like to see. Randy MacLeod (1): net: bridge: xmit: make sure we have at least eth header len bytes net/bridge/br_device.c | 5 +++++ 1 file changed, 5 insertions(+) base-commit: 5a8fa04b2a4de1d52be4a04690dcb52ac7998943 -- 2.34.1

1 year

1
1
0 0

[PATCH v2] drm/bridge: Fix assignment of the of_node of the parent to aux bridge

by Abel Vesa

The assignment of the of_node to the aux bridge needs to mark the of_node as reused as well, otherwise resource providers like pinctrl will report a gpio as already requested by a different device when both pinconf and gpios property are present. Fix that by using the device_set_of_node_from_dev() helper instead. Fixes: 6914968a0b52 ("drm/bridge: properly refcount DT nodes in aux bridge drivers") Cc: stable(a)vger.kernel.org # 6.8 Cc: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Abel Vesa <abel.vesa(a)linaro.org> --- Changes in v2: - Re-worded commit to be more explicit of what it fixes, as Johan suggested - Used device_set_of_node_from_dev() helper, as per Johan's suggestion - Added Fixes tag and cc'ed stable - Link to v1: https://lore.kernel.org/r/20241017-drm-aux-bridge-mark-of-node-reused-v1-1-… --- drivers/gpu/drm/bridge/aux-bridge.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/aux-bridge.c b/drivers/gpu/drm/bridge/aux-bridge.c index b29980f95379ec7af873ed6e0fb79a9abb663c7b..295e9d031e2dc86cbfd2a7350718fca181c99487 100644 --- a/drivers/gpu/drm/bridge/aux-bridge.c +++ b/drivers/gpu/drm/bridge/aux-bridge.c @@ -58,9 +58,10 @@ int drm_aux_bridge_register(struct device *parent) adev->id = ret; adev->name = "aux_bridge"; adev->dev.parent = parent; - adev->dev.of_node = of_node_get(parent->of_node); adev->dev.release = drm_aux_bridge_release; + device_set_of_node_from_dev(&adev->dev, parent); + ret = auxiliary_device_init(adev); if (ret) { ida_free(&drm_aux_bridge_ida, adev->id); --- base-commit: d61a00525464bfc5fe92c6ad713350988e492b88 change-id: 20241017-drm-aux-bridge-mark-of-node-reused-5c2ee740ff19 Best regards, -- Abel Vesa <abel.vesa(a)linaro.org>

1 year

6
25
0 0

[PATCH] vfio/qat: fix overflow check in qat_vf_resume_write()

by Giovanni Cabiddu

The unsigned variable `size_t len` is cast to the signed type `loff_t` when passed to the function check_add_overflow(). This function considers the type of the destination, which is of type loff_t (signed), potentially leading to an overflow. This issue is similar to the one described in the link below. Remove the cast. Note that even if check_add_overflow() is bypassed, by setting `len` to a value that is greater than LONG_MAX (which is considered as a negative value after the cast), the function copy_from_user(), invoked a few lines later, will not perform any copy and return `len` as (len > INT_MAX) causing qat_vf_resume_write() to fail with -EFAULT. Fixes: bb208810b1ab ("vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices") CC: stable(a)vger.kernel.org # 6.10+ Link: https://lore.kernel.org/all/138bd2e2-ede8-4bcc-aa7b-f3d9de167a37@moroto.mou… Reported-by: Zijie Zhao <zzjas98(a)gmail.com> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Reviewed-by: Xin Zeng <xin.zeng(a)intel.com> --- drivers/vfio/pci/qat/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vfio/pci/qat/main.c b/drivers/vfio/pci/qat/main.c index e36740a282e7..1e3563fe7cab 100644 --- a/drivers/vfio/pci/qat/main.c +++ b/drivers/vfio/pci/qat/main.c @@ -305,7 +305,7 @@ static ssize_t qat_vf_resume_write(struct file *filp, const char __user *buf, offs = &filp->f_pos; if (*offs < 0 || - check_add_overflow((loff_t)len, *offs, &end)) + check_add_overflow(len, *offs, &end)) return -EOVERFLOW; if (end > mig_dev->state_size) -- 2.47.0

1 year

2
1
0 0

[PATCH v2 1/5] xhci: Combine two if statements for Etron xHCI host

by Kuangyi Chiang

Combine two if statements, because these hosts have the same quirk flags applied. Fixes: 91f7a1524a92 ("xhci: Apply broken streams quirk to Etron EJ188 xHCI host") Cc: <stable(a)vger.kernel.org> Signed-off-by: Kuangyi Chiang <ki.chiang65(a)gmail.com> --- drivers/usb/host/xhci-pci.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c index 7e538194a0a4..33a6d99afc10 100644 --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c @@ -395,12 +395,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; if (pdev->vendor == PCI_VENDOR_ID_ETRON && - pdev->device == PCI_DEVICE_ID_EJ168) { - xhci->quirks |= XHCI_RESET_ON_RESUME; - xhci->quirks |= XHCI_BROKEN_STREAMS; - } - if (pdev->vendor == PCI_VENDOR_ID_ETRON && - pdev->device == PCI_DEVICE_ID_EJ188) { + (pdev->device == PCI_DEVICE_ID_EJ168 || + pdev->device == PCI_DEVICE_ID_EJ188)) { xhci->quirks |= XHCI_RESET_ON_RESUME; xhci->quirks |= XHCI_BROKEN_STREAMS; } -- 2.25.1

1 year

2
3
0 0

[PATCH 6.6] rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()

by liwei

From: Zqiang <qiang.zhang1211(a)gmail.com> [ Upstream commit fd70e9f1d85f5323096ad313ba73f5fe3d15ea41 ] For kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is defined as NR_CPUS instead of the number of possible cpus, this will cause the following system panic: smpboot: Allowing 4 CPUs, 0 hotplug CPUs ... setup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1 ... BUG: unable to handle page fault for address: ffffffff9911c8c8 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W 6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6 RIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0 RSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082 CR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0 Call Trace: <TASK> ? __die+0x23/0x80 ? page_fault_oops+0xa4/0x180 ? exc_page_fault+0x152/0x180 ? asm_exc_page_fault+0x26/0x40 ? rcu_tasks_need_gpcb+0x25d/0x2c0 ? __pfx_rcu_tasks_kthread+0x40/0x40 rcu_tasks_one_gp+0x69/0x180 rcu_tasks_kthread+0x94/0xc0 kthread+0xe8/0x140 ? __pfx_kthread+0x40/0x40 ret_from_fork+0x34/0x80 ? __pfx_kthread+0x40/0x40 ret_from_fork_asm+0x1b/0x80 </TASK> Considering that there may be holes in the CPU numbers, use the maximum possible cpu number, instead of nr_cpu_ids, for configuring enqueue and dequeue limits. [ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ] Closes: https://lore.kernel.org/linux-input/CALMA0xaTSMN+p4xUXkzrtR5r6k7hgoswcaXx7b… Reported-by: Zhixu Liu <zhixu.liu(a)gmail.com> Signed-off-by: Zqiang <qiang.zhang1211(a)gmail.com> Signed-off-by: Neeraj Upadhyay <neeraj.upadhyay(a)kernel.org> [liwei: adaptation context conflict] Signed-off-by: liwei <liwei728(a)huawei.com> --- kernel/rcu/tasks.h | 83 ++++++++++++++++++++++++++++++---------------- 1 file changed, 54 insertions(+), 29 deletions(-) diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h index df81506cf2bd..fbfa0f90f884 100644 --- a/kernel/rcu/tasks.h +++ b/kernel/rcu/tasks.h @@ -33,6 +33,7 @@ typedef void (*postgp_func_t)(struct rcu_tasks *rtp); * @barrier_q_head: RCU callback for barrier operation. * @rtp_blkd_tasks: List of tasks blocked as readers. * @cpu: CPU number corresponding to this entry. + * @index: Index of this CPU in rtpcp_array of the rcu_tasks structure. * @rtpp: Pointer to the rcu_tasks structure. */ struct rcu_tasks_percpu { @@ -47,6 +48,7 @@ struct rcu_tasks_percpu { struct rcu_head barrier_q_head; struct list_head rtp_blkd_tasks; int cpu; + int index; struct rcu_tasks *rtpp; }; @@ -73,6 +75,7 @@ struct rcu_tasks_percpu { * @postgp_func: This flavor's post-grace-period function (optional). * @call_func: This flavor's call_rcu()-equivalent function. * @rtpcpu: This flavor's rcu_tasks_percpu structure. + * @rtpcp_array: Array of pointers to rcu_tasks_percpu structure of CPUs in cpu_possible_mask. * @percpu_enqueue_shift: Shift down CPU ID this much when enqueuing callbacks. * @percpu_enqueue_lim: Number of per-CPU callback queues in use for enqueuing. * @percpu_dequeue_lim: Number of per-CPU callback queues in use for dequeuing. @@ -106,6 +109,7 @@ struct rcu_tasks { postgp_func_t postgp_func; call_rcu_func_t call_func; struct rcu_tasks_percpu __percpu *rtpcpu; + struct rcu_tasks_percpu **rtpcp_array; int percpu_enqueue_shift; int percpu_enqueue_lim; int percpu_dequeue_lim; @@ -179,6 +183,8 @@ module_param(rcu_task_collapse_lim, int, 0444); static int rcu_task_lazy_lim __read_mostly = 32; module_param(rcu_task_lazy_lim, int, 0444); +static int rcu_task_cpu_ids; + /* RCU tasks grace-period state for debugging. */ #define RTGS_INIT 0 #define RTGS_WAIT_WAIT_CBS 1 @@ -243,6 +249,8 @@ static void cblist_init_generic(struct rcu_tasks *rtp) unsigned long flags; int lim; int shift; + int maxcpu; + int index = 0; if (rcu_task_enqueue_lim < 0) { rcu_task_enqueue_lim = 1; @@ -252,14 +260,9 @@ static void cblist_init_generic(struct rcu_tasks *rtp) } lim = rcu_task_enqueue_lim; - if (lim > nr_cpu_ids) - lim = nr_cpu_ids; - shift = ilog2(nr_cpu_ids / lim); - if (((nr_cpu_ids - 1) >> shift) >= lim) - shift++; - WRITE_ONCE(rtp->percpu_enqueue_shift, shift); - WRITE_ONCE(rtp->percpu_dequeue_lim, lim); - smp_store_release(&rtp->percpu_enqueue_lim, lim); + rtp->rtpcp_array = kcalloc(num_possible_cpus(), sizeof(struct rcu_tasks_percpu *), GFP_KERNEL); + BUG_ON(!rtp->rtpcp_array); + for_each_possible_cpu(cpu) { struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu); @@ -273,12 +276,28 @@ static void cblist_init_generic(struct rcu_tasks *rtp) INIT_WORK(&rtpcp->rtp_work, rcu_tasks_invoke_cbs_wq); rtpcp->cpu = cpu; rtpcp->rtpp = rtp; + rtpcp->index = index; + rtp->rtpcp_array[index] = rtpcp; + index++; if (!rtpcp->rtp_blkd_tasks.next) INIT_LIST_HEAD(&rtpcp->rtp_blkd_tasks); + + maxcpu = cpu; } - pr_info("%s: Setting shift to %d and lim to %d rcu_task_cb_adjust=%d.\n", rtp->name, - data_race(rtp->percpu_enqueue_shift), data_race(rtp->percpu_enqueue_lim), rcu_task_cb_adjust); + rcu_task_cpu_ids = maxcpu + 1; + if (lim > rcu_task_cpu_ids) + lim = rcu_task_cpu_ids; + shift = ilog2(rcu_task_cpu_ids / lim); + if (((rcu_task_cpu_ids - 1) >> shift) >= lim) + shift++; + WRITE_ONCE(rtp->percpu_enqueue_shift, shift); + WRITE_ONCE(rtp->percpu_dequeue_lim, lim); + smp_store_release(&rtp->percpu_enqueue_lim, lim); + + pr_info("%s: Setting shift to %d and lim to %d rcu_task_cb_adjust=%d rcu_task_cpu_ids=%d.\n", + rtp->name, data_race(rtp->percpu_enqueue_shift), data_race(rtp->percpu_enqueue_lim), + rcu_task_cb_adjust, rcu_task_cpu_ids); } // Compute wakeup time for lazy callback timer. @@ -346,7 +365,7 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func, rtpcp->rtp_n_lock_retries = 0; } if (rcu_task_cb_adjust && ++rtpcp->rtp_n_lock_retries > rcu_task_contend_lim && - READ_ONCE(rtp->percpu_enqueue_lim) != nr_cpu_ids) + READ_ONCE(rtp->percpu_enqueue_lim) != rcu_task_cpu_ids) needadjust = true; // Defer adjustment to avoid deadlock. } // Queuing callbacks before initialization not yet supported. @@ -366,10 +385,10 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func, raw_spin_unlock_irqrestore_rcu_node(rtpcp, flags); if (unlikely(needadjust)) { raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags); - if (rtp->percpu_enqueue_lim != nr_cpu_ids) { + if (rtp->percpu_enqueue_lim != rcu_task_cpu_ids) { WRITE_ONCE(rtp->percpu_enqueue_shift, 0); - WRITE_ONCE(rtp->percpu_dequeue_lim, nr_cpu_ids); - smp_store_release(&rtp->percpu_enqueue_lim, nr_cpu_ids); + WRITE_ONCE(rtp->percpu_dequeue_lim, rcu_task_cpu_ids); + smp_store_release(&rtp->percpu_enqueue_lim, rcu_task_cpu_ids); pr_info("Switching %s to per-CPU callback queuing.\n", rtp->name); } raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags); @@ -440,6 +459,8 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) int needgpcb = 0; for (cpu = 0; cpu < smp_load_acquire(&rtp->percpu_dequeue_lim); cpu++) { + if (!cpu_possible(cpu)) + continue; struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu); /* Advance and accelerate any new callbacks. */ @@ -477,7 +498,7 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) if (rcu_task_cb_adjust && ncbs <= rcu_task_collapse_lim) { raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags); if (rtp->percpu_enqueue_lim > 1) { - WRITE_ONCE(rtp->percpu_enqueue_shift, order_base_2(nr_cpu_ids)); + WRITE_ONCE(rtp->percpu_enqueue_shift, order_base_2(rcu_task_cpu_ids)); smp_store_release(&rtp->percpu_enqueue_lim, 1); rtp->percpu_dequeue_gpseq = get_state_synchronize_rcu(); gpdone = false; @@ -492,7 +513,9 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) pr_info("Completing switch %s to CPU-0 callback queuing.\n", rtp->name); } if (rtp->percpu_dequeue_lim == 1) { - for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) { + for (cpu = rtp->percpu_dequeue_lim; cpu < rcu_task_cpu_ids; cpu++) { + if (!cpu_possible(cpu)) + continue; struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu); WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist)); @@ -507,30 +530,32 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) // Advance callbacks and invoke any that are ready. static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpu *rtpcp) { - int cpu; - int cpunext; int cpuwq; unsigned long flags; int len; + int index; struct rcu_head *rhp; struct rcu_cblist rcl = RCU_CBLIST_INITIALIZER(rcl); struct rcu_tasks_percpu *rtpcp_next; - cpu = rtpcp->cpu; - cpunext = cpu * 2 + 1; - if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) { - rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext); - cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND; - queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work); - cpunext++; - if (cpunext < smp_load_acquire(&rtp->percpu_dequeue_lim)) { - rtpcp_next = per_cpu_ptr(rtp->rtpcpu, cpunext); - cpuwq = rcu_cpu_beenfullyonline(cpunext) ? cpunext : WORK_CPU_UNBOUND; + index = rtpcp->index * 2 + 1; + if (index < num_possible_cpus()) { + rtpcp_next = rtp->rtpcp_array[index]; + if (rtpcp_next->cpu < smp_load_acquire(&rtp->percpu_dequeue_lim)) { + cpuwq = rcu_cpu_beenfullyonline(rtpcp_next->cpu) ? rtpcp_next->cpu : WORK_CPU_UNBOUND; queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work); + index++; + if (index < num_possible_cpus()) { + rtpcp_next = rtp->rtpcp_array[index]; + if (rtpcp_next->cpu < smp_load_acquire(&rtp->percpu_dequeue_lim)) { + cpuwq = rcu_cpu_beenfullyonline(rtpcp_next->cpu) ? rtpcp_next->cpu : WORK_CPU_UNBOUND; + queue_work_on(cpuwq, system_wq, &rtpcp_next->rtp_work); + } + } } } - if (rcu_segcblist_empty(&rtpcp->cblist) || !cpu_possible(cpu)) + if (rcu_segcblist_empty(&rtpcp->cblist)) return; raw_spin_lock_irqsave_rcu_node(rtpcp, flags); rcu_segcblist_advance(&rtpcp->cblist, rcu_seq_current(&rtp->tasks_gp_seq)); -- 2.25.1

1 year

1
0
0 0

[PATCH] counter: stm32-timer-cnt: fix device_node handling in probe_encoder()

by Javier Carrasco

Device nodes accessed via of_get_compatible_child() require of_node_put() to be called when the node is no longer required to avoid leaving a reference to the node behind, leaking the resource. In this case, the usage of 'tnode' is straightforward and there are no error paths, allowing for a single of_node_put() when 'tnode' is no longer required. Cc: stable(a)vger.kernel.org Fixes: 29646ee33cc3 ("counter: stm32-timer-cnt: add checks on quadrature encoder capability") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> --- drivers/counter/stm32-timer-cnt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/counter/stm32-timer-cnt.c b/drivers/counter/stm32-timer-cnt.c index 186e73d6ccb4..0d8206adccb3 100644 --- a/drivers/counter/stm32-timer-cnt.c +++ b/drivers/counter/stm32-timer-cnt.c @@ -694,6 +694,7 @@ static int stm32_timer_cnt_probe_encoder(struct device *dev, } ret = of_property_read_u32(tnode, "reg", &idx); + of_node_put(tnode); if (ret) { dev_err(dev, "Can't get index (%d)\n", ret); return ret; --- base-commit: a39230ecf6b3057f5897bc4744a790070cfbe7a8 change-id: 20241027-stm32-timer-cnt-of_node_put-8c6695e7a373 Best regards, -- Javier Carrasco <javier.carrasco.cruz(a)gmail.com>

1 year

2
1
0 0

Linux 6.11.6

by Greg Kroah-Hartman

I'm announcing the release of the 6.11.6 kernel. All users of the 6.11 kernel series must upgrade. The updated 6.11.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.11.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml | 18 Makefile | 2 arch/arm/boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts | 2 arch/arm64/Makefile | 2 arch/arm64/kvm/arm.c | 3 arch/arm64/kvm/sys_regs.c | 2 arch/arm64/kvm/vgic/vgic-init.c | 28 + arch/arm64/net/bpf_jit_comp.c | 12 arch/loongarch/include/asm/bootinfo.h | 4 arch/loongarch/include/asm/kasan.h | 2 arch/loongarch/kernel/process.c | 16 arch/loongarch/kernel/setup.c | 3 arch/loongarch/kernel/traps.c | 5 arch/riscv/net/bpf_jit_comp64.c | 8 arch/s390/include/asm/perf_event.h | 1 arch/s390/pci/pci_event.c | 17 arch/x86/Kconfig | 1 arch/x86/events/rapl.c | 47 ++ arch/x86/include/asm/runtime-const.h | 4 arch/x86/include/asm/uaccess_64.h | 45 +- arch/x86/kernel/amd_nb.c | 6 arch/x86/kernel/cpu/common.c | 10 arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 23 - arch/x86/kernel/vmlinux.lds.S | 1 arch/x86/kvm/svm/nested.c | 6 arch/x86/lib/getuser.S | 9 arch/x86/virt/svm/sev.c | 2 block/elevator.c | 17 drivers/accel/qaic/qaic_control.c | 2 drivers/accel/qaic/qaic_data.c | 6 drivers/acpi/button.c | 11 drivers/acpi/cppc_acpi.c | 22 - drivers/acpi/prmt.c | 29 + drivers/acpi/resource.c | 7 drivers/ata/libata-eh.c | 1 drivers/cdrom/cdrom.c | 2 drivers/clk/rockchip/clk.c | 2 drivers/cpufreq/amd-pstate.c | 10 drivers/firewire/core-topology.c | 2 drivers/firmware/arm_scmi/driver.c | 4 drivers/firmware/arm_scmi/mailbox.c | 32 + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 5 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 13 drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 drivers/gpu/drm/bridge/aux-bridge.c | 3 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 16 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 20 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 68 ++- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 7 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 5 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 19 drivers/gpu/drm/msm/dsi/dsi_host.c | 4 drivers/gpu/drm/panel/panel-himax-hx83102.c | 12 drivers/gpu/drm/vboxvideo/hgsmi_base.c | 10 drivers/gpu/drm/vboxvideo/vboxvideo.h | 4 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 4 drivers/gpu/drm/xe/xe_device.c | 4 drivers/gpu/drm/xe/xe_exec.c | 12 drivers/gpu/drm/xe/xe_gpu_scheduler.h | 2 drivers/gpu/drm/xe/xe_gt_mcr.c | 2 drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 29 - drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 1 drivers/gpu/drm/xe/xe_guc_submit.c | 7 drivers/gpu/drm/xe/xe_vm.c | 8 drivers/hwmon/jc42.c | 2 drivers/iio/accel/bma400_core.c | 3 drivers/iio/adc/Kconfig | 2 drivers/iio/frequency/Kconfig | 33 - drivers/infiniband/core/addr.c | 2 drivers/infiniband/hw/bnxt_re/hw_counters.c | 2 drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1 drivers/infiniband/hw/bnxt_re/main.c | 29 - drivers/infiniband/hw/bnxt_re/qplib_fp.c | 16 drivers/infiniband/hw/bnxt_re/qplib_fp.h | 3 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 drivers/infiniband/hw/bnxt_re/qplib_res.c | 21 - drivers/infiniband/hw/bnxt_re/qplib_sp.c | 11 drivers/infiniband/hw/bnxt_re/qplib_sp.h | 1 drivers/infiniband/hw/cxgb4/cm.c | 9 drivers/infiniband/hw/irdma/cm.c | 2 drivers/infiniband/ulp/srpt/ib_srpt.c | 80 +++ drivers/irqchip/irq-renesas-rzg2l.c | 16 drivers/irqchip/irq-riscv-imsic-platform.c | 2 drivers/md/raid10.c | 7 drivers/net/dsa/microchip/ksz_common.c | 21 - drivers/net/dsa/mv88e6xxx/chip.c | 2 drivers/net/dsa/mv88e6xxx/chip.h | 6 drivers/net/dsa/mv88e6xxx/port.c | 1 drivers/net/dsa/mv88e6xxx/ptp.c | 108 +++-- drivers/net/dsa/vitesse-vsc73xx-core.c | 1 drivers/net/ethernet/aeroflex/greth.c | 3 drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 1 drivers/net/ethernet/broadcom/bcmsysport.c | 1 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 22 - drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 70 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 12 drivers/net/ethernet/emulex/benet/be_main.c | 10 drivers/net/ethernet/freescale/fman/mac.c | 68 ++- drivers/net/ethernet/freescale/fman/mac.h | 6 drivers/net/ethernet/i825xx/sun3_82586.c | 1 drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 82 ++-- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 drivers/net/ethernet/mellanox/mlx5/core/eq.c | 6 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 5 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 9 drivers/net/ethernet/microchip/sparx5/sparx5_mirror.c | 12 drivers/net/ethernet/realtek/r8169_main.c | 4 drivers/net/ethernet/renesas/ravb_main.c | 25 - drivers/net/ethernet/renesas/rtsn.c | 1 drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 14 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 drivers/net/hyperv/netvsc_drv.c | 30 + drivers/net/macsec.c | 18 drivers/net/netdevsim/dev.c | 15 drivers/net/phy/dp83822.c | 4 drivers/net/plip/plip.c | 2 drivers/net/pse-pd/pse_core.c | 4 drivers/net/usb/usbnet.c | 4 drivers/net/virtio_net.c | 2 drivers/net/vmxnet3/vmxnet3_xdp.c | 2 drivers/net/wwan/wwan_core.c | 2 drivers/nvme/host/pci.c | 19 drivers/pci/probe.c | 2 drivers/pci/pwrctl/pci-pwrctl-pwrseq.c | 58 ++ drivers/platform/x86/dell/dell-wmi-base.c | 9 drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 1 drivers/platform/x86/intel/pmc/core_ssram.c | 4 drivers/powercap/dtpm_devfreq.c | 2 drivers/reset/starfive/reset-starfive-jh71x0.c | 3 drivers/soundwire/intel_ace2x.c | 19 drivers/target/target_core_device.c | 2 drivers/target/target_core_user.c | 2 drivers/usb/host/xhci-dbgcap.h | 2 drivers/usb/host/xhci-dbgtty.c | 73 ++- drivers/usb/typec/class.c | 3 drivers/video/fbdev/Kconfig | 1 fs/9p/v9fs.h | 34 + fs/9p/v9fs_vfs.h | 2 fs/9p/vfs_inode.c | 129 ++++-- fs/9p/vfs_inode_dotl.c | 112 ++++- fs/9p/vfs_super.c | 2 fs/backing-file.c | 8 fs/btrfs/block-group.c | 2 fs/btrfs/dir-item.c | 4 fs/btrfs/disk-io.c | 2 fs/btrfs/extent_map.c | 31 - fs/btrfs/inode.c | 7 fs/btrfs/qgroup.c | 2 fs/btrfs/qgroup.h | 2 fs/btrfs/super.c | 12 fs/fuse/passthrough.c | 8 fs/jfs/jfs_dmap.c | 2 fs/namespace.c | 4 fs/nfsd/nfs4state.c | 50 ++ fs/nfsd/state.h | 2 fs/nilfs2/page.c | 6 fs/notify/fsnotify.c | 21 - fs/notify/inotify/inotify_user.c | 2 fs/notify/mark.c | 8 fs/open.c | 2 fs/overlayfs/file.c | 9 fs/select.c | 4 fs/smb/client/cifsfs.c | 2 fs/smb/client/fs_context.c | 7 fs/smb/client/reparse.c | 23 + fs/smb/client/smb2ops.c | 3 fs/smb/client/smb2pdu.c | 9 fs/udf/balloc.c | 38 + fs/udf/directory.c | 23 - fs/udf/inode.c | 202 ++++++---- fs/udf/partition.c | 6 fs/udf/super.c | 3 fs/udf/truncate.c | 43 +- fs/udf/udfdecl.h | 15 fs/xfs/scrub/repair.c | 8 include/linux/backing-file.h | 2 include/linux/bpf.h | 14 include/linux/bpf_types.h | 1 include/linux/huge_mm.h | 18 include/linux/netdevice.h | 12 include/linux/shmem_fs.h | 11 include/linux/task_work.h | 5 include/linux/uaccess.h | 7 include/net/bluetooth/bluetooth.h | 1 include/net/genetlink.h | 3 include/net/sock.h | 5 include/net/xfrm.h | 28 - include/uapi/linux/bpf.h | 16 include/uapi/sound/asoc.h | 2 kernel/bpf/btf.c | 15 kernel/bpf/devmap.c | 11 kernel/bpf/helpers.c | 10 kernel/bpf/inode.c | 5 kernel/bpf/log.c | 3 kernel/bpf/ringbuf.c | 14 kernel/bpf/syscall.c | 31 + kernel/bpf/task_iter.c | 2 kernel/bpf/verifier.c | 107 ++--- kernel/sched/core.c | 4 kernel/task_work.c | 15 kernel/time/posix-clock.c | 6 kernel/trace/bpf_trace.c | 42 -- kernel/trace/fgraph.c | 15 kernel/trace/ring_buffer.c | 44 +- kernel/trace/trace_eprobe.c | 7 kernel/trace/trace_fprobe.c | 6 kernel/trace/trace_kprobe.c | 6 kernel/trace/trace_probe.c | 2 kernel/trace/trace_uprobe.c | 13 lib/Kconfig.debug | 2 lib/objpool.c | 2 lib/strncpy_from_user.c | 9 lib/strnlen_user.c | 9 mm/huge_memory.c | 24 - mm/memory.c | 9 mm/shmem.c | 55 +- net/bluetooth/af_bluetooth.c | 22 + net/bluetooth/bnep/core.c | 3 net/bluetooth/hci_core.c | 24 - net/bluetooth/hci_sync.c | 12 net/bluetooth/iso.c | 18 net/bluetooth/sco.c | 18 net/core/filter.c | 50 -- net/core/sock_map.c | 8 net/ipv4/devinet.c | 35 + net/ipv4/inet_connection_sock.c | 21 - net/ipv4/xfrm4_policy.c | 40 - net/ipv6/xfrm6_policy.c | 31 - net/l2tp/l2tp_netlink.c | 4 net/netfilter/nf_bpf_link.c | 7 net/netfilter/xt_NFLOG.c | 2 net/netfilter/xt_TRACE.c | 1 net/netfilter/xt_mark.c | 2 net/netlink/genetlink.c | 28 - net/sched/act_api.c | 23 + net/sched/sch_generic.c | 8 net/sched/sch_taprio.c | 21 - net/smc/smc_pnet.c | 2 net/smc/smc_wr.c | 6 net/vmw_vsock/virtio_transport_common.c | 14 net/vmw_vsock/vsock_bpf.c | 8 net/wireless/nl80211.c | 8 net/xfrm/xfrm_device.c | 11 net/xfrm/xfrm_policy.c | 50 +- net/xfrm/xfrm_user.c | 10 sound/firewire/amdtp-stream.c | 3 sound/pci/hda/Kconfig | 2 sound/pci/hda/patch_cs8409.c | 5 sound/pci/hda/patch_realtek.c | 48 +- sound/soc/amd/yc/acp6x-mach.c | 7 sound/soc/codecs/lpass-rx-macro.c | 2 sound/soc/codecs/max98388.c | 1 sound/soc/fsl/fsl_micfil.c | 43 ++ sound/soc/fsl/fsl_sai.c | 5 sound/soc/fsl/fsl_sai.h | 1 sound/soc/loongson/loongson_card.c | 1 sound/soc/qcom/Kconfig | 2 sound/soc/qcom/lpass-cpu.c | 2 sound/soc/qcom/sc7280.c | 10 sound/soc/qcom/sdm845.c | 7 sound/soc/qcom/sm8250.c | 1 sound/soc/sh/rcar/core.c | 7 sound/soc/soc-dapm.c | 4 sound/soc/sof/intel/hda-dai-ops.c | 23 - sound/soc/sof/intel/hda-dai.c | 37 + sound/soc/sof/intel/hda-loader.c | 17 sound/soc/sof/ipc4-topology.c | 15 tools/include/uapi/linux/bpf.h | 3 tools/testing/selftests/bpf/Makefile | 2 tools/testing/selftests/bpf/prog_tests/fill_link_info.c | 9 274 files changed, 2654 insertions(+), 1268 deletions(-) Abel Vesa (1): drm/bridge: Fix assignment of the of_node of the parent to aux bridge Abhishek Mohapatra (1): RDMA/bnxt_re: Fix the max CQ WQEs for older adapters Aleksa Sarai (1): openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) Aleksandr Mishin (4): octeon_ep: Implement helper for iterating packets in Rx queue octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() fsl/fman: Save device references taken in mac_probe() fsl/fman: Fix refcount handling of fman-related devices Alexander Zubkov (1): RDMA/irdma: Fix misspelling of "accept*" Alexey Klimov (3): ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string ASoC: qcom: sdm845: add missing soundwire runtime stream alloc Amadeusz Sławiński (1): ASoC: topology: Bump minimal topology ABI version Amir Goldstein (2): fs: pass offset and result to backing_file end_write() callback fuse: update inode size after extending passthrough write Andrea Parri (1): riscv, bpf: Make BPF_CMPXCHG fully ordered Andrew Jones (1): irqchip/riscv-imsic: Fix output text of base address Andrey Shumilin (1): ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() Andrii Nakryiko (1): bpf: fix do_misc_fixups() for bpf_get_branch_snapshot() Anumula Murali Mohan Reddy (2): RDMA/core: Fix ENODEV error for iWARP test over vlan RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP Armin Wolf (1): platform/x86: dell-wmi: Ignore suspend notifications Arnd Bergmann (1): fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS Ashish Kalra (1): x86/sev: Ensure that RMP table fixups are reserved Aurabindo Pillai (1): drm/amd/display: temp w/a for DP Link Layer compliance Baolin Wang (2): mm: shmem: rename shmem_is_huge() to shmem_huge_global_enabled() mm: shmem: move shmem_huge_global_enabled() into shmem_allowable_huge_orders() Bart Van Assche (1): RDMA/srpt: Make slab cache names unique Bartosz Golaszewski (2): PCI: Hold rescan lock while adding devices during host probe PCI/pwrctl: Abandon QCom WCN probe on pre-pwrseq device-trees Benjamin Bara (1): ASoC: dapm: avoid container_of() to get component Bhargava Chenna Marreddy (1): RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Binbin Zhou (1): ASoC: loongson: Fix component check failed on FDT systems Boris Burkov (1): btrfs: fix read corruption due to race with extent map merging Breno Leitao (2): elevator: do not request_module if elevator exists elevator: Remove argument from elevator_find_get Chancel Liu (1): ASoC: fsl_micfil: Add a flag to distinguish with different volume control types Chandramohan Akula (1): RDMA/bnxt_re: Change the sequence of updating the CQ toggle value Changhuang Liang (1): reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC Christian Brauner (1): fs: don't try and remove empty rbtree node Christian Heusel (1): ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] Colin Ian King (2): octeontx2-af: Fix potential integer overflows on integer shifts ASoC: max98388: Fix missing increment of variable slot_found Cong Yang (1): drm/panel: himax-hx83102: Adjust power and gamma to optimize brightness Cosmin Ratiu (2): net/mlx5: Unregister notifier on eswitch init failure net/mlx5e: Don't call cleanup on profile rollback failure Crag Wang (1): platform/x86: dell-sysman: add support for alienware products Dan Carpenter (1): ACPI: PRM: Clean up guid type in struct prm_handler_info Daniel Borkmann (6): vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame bpf: Fix incorrect delta propagation between linked registers bpf: Fix print_reg_state's constant scalar dump bpf: Add MEM_WRITE attribute bpf: Fix overloading of MEM_UNINIT's meaning bpf: Remove MEM_UNINIT from skb/xdp MTU helpers Daniel Machon (1): net: sparx5: fix source port register when mirroring Darrick J. Wong (1): xfs: don't fail repairs on metadata files with no attr fork Dave Kleikamp (1): jfs: Fix sanity check in dbMount David Hildenbrand (1): mm: don't install PMD mappings when THPs are disabled by the hw/process/vma David Lawrence Glanzman (1): ASoC: amd: yc: Add quirk for HP Dragonfly pro one Dhananjay Ugwekar (2): cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems perf/x86/rapl: Fix the energy-pkg event for AMD CPUs Dimitar Kanaliev (1): bpf: Fix truncation bug in coerce_reg_to_size_sx() Dmitry Antipov (2): net: sched: fix use-after-free in taprio_change() net: sched: use RCU read-side critical section in taprio_dump() Dmitry Baryshkov (3): drm/msm/dpu: make sure phys resources are properly initialized drm/msm/dpu: move CRTC resource assignment to dpu_encoder_virt_atomic_check drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds() Dominique Martinet (4): Revert " fs/9p: mitigate inode collisions" Revert "fs/9p: remove redundant pointer v9ses" Revert "fs/9p: fix uaf in in v9fs_stat2inode_dotl" Revert "fs/9p: simplify iget to remove unnecessary paths" Douglas Anderson (2): drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() drm/msm: Allocate memory for disp snapshot with kvzalloc() Eduard Zingerman (1): bpf: sync_linked_regs() must preserve subreg_def Eric Biggers (1): ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE Eric Dumazet (3): netdevsim: use cond_resched() in nsim_dev_trap_report_work() genetlink: hold RCU in genlmsg_mcast() net: fix races in netdev_tx_sent_queue()/dev_watchdog() Eyal Birger (2): xfrm: extract dst lookup parameters into a struct xfrm: respect ip protocols rules criteria when performing dst lookups Fabrizio Castro (1): irqchip/renesas-rzg2l: Fix missing put_device Felix Fietkau (1): net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init Filipe Manana (1): btrfs: clear force-compress on remount when compress mount option is given Florian Kauer (1): bpf: devmap: provide rxq after redirect Florian Klink (1): ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin Florian Westphal (1): netfilter: bpf: must hold reference on net namespace Gal Pressman (1): ravb: Remove setting of RX software timestamp Gianfranco Trad (1): udf: fix uninit-value use in udf_get_fileshortad Greg Kroah-Hartman (1): Linux 6.11.6 Gustavo Sousa (1): drm/xe/mcr: Use Xe2_LPM steering tables for Xe2_HPM Haiyang Zhang (1): hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event Hans de Goede (1): drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Heiko Carstens (1): s390: Initialize psw mask in perf_arch_fetch_caller_regs() Heiner Kallweit (1): r8169: avoid unsolicited interrupts Henrique Carvalho (1): smb: client: Handle kstrdup failures for passwords Hongguang Gao (1): RDMA/bnxt_re: Get the toggle bits from SRQ events Hou Tao (3): bpf: Check the remaining info_cnt before repeating btf fields bpf: Preserve param->string when parsing mount options bpf: Add the missing BPF_LINK_TYPE invocation for sockmap Huacai Chen (3): LoongArch: Get correct cores_per_package for SMT systems LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context LoongArch: Make KASAN usable for variable cpu_vabits Ian Forbes (1): drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check Ilkka Koskinen (1): KVM: arm64: Fix shift-out-of-bounds bug Jakub Boehm (1): net: plip: fix break; causing plip to never transmit Jan Kara (1): fsnotify: Avoid data race between fsnotify_recalc_mask() and fsnotify_object_watched() Javier Carrasco (3): iio: frequency: {admv4420,adrf6780}: format Kconfig entries iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Jean Delvare (1): [PATCH} hwmon: (jc42) Properly detect TSE2004-compliant devices again Jessica Zhang (2): drm/msm/dpu: Don't always set merge_3d pending flush drm/msm/dpu: don't always program merge_3d block Jinjie Ruan (1): posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() Jiri Olsa (2): bpf: Fix memory leak in bpf_core_apply bpf,perf: Fix perf_event_detach_bpf_prog error handling Jiri Slaby (SUSE) (2): xhci: dbgtty: remove kfifo_out() wrapper xhci: dbgtty: use kfifo from tty_port struct Jonathan Marek (2): drm/msm/dsi: improve/fix dsc pclk calculation drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation Jordan Rome (1): bpf: Fix iter/task tid filtering Josh Poimboeuf (1): cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() José Relvas (1): ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 Justin Chen (1): firmware: arm_scmi: Queue in scmi layer for mailbox implementation Kai Shen (1): net/smc: Fix memory leak when using percpu refs Kai Vehmanen (1): ASoC: SOF: Intel: hda-loader: do not wait for HDaudio IOC Kailang Yang (1): ALSA: hda/realtek: Update default depop procedure Kalesh AP (5): RDMA/bnxt_re: Fix a possible memory leak RDMA/bnxt_re: Add a check for memory allocation RDMA/bnxt_re: Fix out of bound check RDMA/bnxt_re: Return more meaningful error RDMA/bnxt_re: Fix the GID table length Kashyap Desai (1): RDMA/bnxt_re: Fix incorrect dereference of srq in async event Kefeng Wang (1): mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw() Koba Ko (1): ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context Konrad Dybcio (1): PCI/pwrctl: Add WCN6855 support Kory Maincent (1): net: pse-pd: Fix out of bound for loop Krzysztof Kozlowski (2): ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc ASoC: qcom: Select missing common Soundwire module code on SDM845 Kuniyuki Iwashima (1): tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Lad Prabhakar (1): ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing Leo Yan (1): tracing: Consider the NULL character when validating the event length Li Huafei (1): fgraph: Fix missing unlock in register_ftrace_graph() Li RongQing (1): net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid Lin Ma (1): net: wwan: fix global oob in wwan_rtnl_policy Linus Torvalds (3): x86: support user address masking instead of non-speculative conditional x86: fix whitespace in runtime-const assembler output x86: fix user address masking non-canonical speculation issue Luiz Augusto von Dentz (3): Bluetooth: hci_core: Disable works on hci_unregister_dev Bluetooth: SCO: Fix UAF on sco_sock_timeout Bluetooth: ISO: Fix UAF on iso_sock_timeout Maher Sanalla (1): net/mlx5: Check for invalid vector index on EQ creation Marc Zyngier (1): KVM: arm64: Don't eagerly teardown the vgic on init error Mario Limonciello (2): drm/amd: Guard against bad data for ATIF ACPI method drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too Mark Rutland (1): arm64: Force position-independent veneers Martin Kletzander (1): x86/resctrl: Avoid overflow in MB settings in bw_validate() Mathias Nyman (1): xhci: dbc: honor usb transfer size boundaries. Matthew Auld (2): drm/xe: fix unbalanced rpm put() with fence_fini() drm/xe: fix unbalanced rpm put() with declare_wedged() Matthew Brost (3): drm/xe: Take job list lock in xe_sched_add_pending_job drm/xe: Don't free job in TDR drm/xe: Use bookkeep slots for external BO's in exec IOCTL Maurizio Lombardi (1): nvme-pci: fix race condition between reset and nvme_dev_disable() Michael S. Tsirkin (1): virtio_net: fix integer overflow in stats Michal Luczaj (4): bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock vsock: Update rx_bytes on read_skb() vsock: Update msg_count on read_skb() bpf, vsock: Drop static vsock_bpf_prot initialization Michel Alex (1): net: phy: dp83822: Fix reset pin definitions Mikel Rychliski (1): tracing/probes: Fix MAX_TRACE_ARGS limit handling Mikhail Lobanov (1): iio: accel: bma400: Fix uninitialized variable field_value in tap event handling. Miquel Raynal (2): ASoC: dt-bindings: davinci-mcasp: Fix interrupts property ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties Murad Masimov (1): ALSA: hda/cs8409: Fix possible NULL dereference Naohiro Aota (1): btrfs: zoned: fix zone unusable accounting for freed reserved extent Niklas Cassel (1): ata: libata: Set DID_TIME_OUT for commands that actually timed out Niklas Schnelle (1): s390/pci: Handle PCI error codes other than 0x3a Niklas Söderlund (1): net: ravb: Only advertise Rx/Tx timestamps if hardware supports it Olga Kornievskaia (1): nfsd: fix race between laundromat and free_stateid Oliver Neukum (2): net: usb: usbnet: fix race in probe failure net: usb: usbnet: fix name regression Oliver Upton (1): KVM: arm64: Unregister redistributor for failed vCPU creation Pablo Neira Ayuso (1): netfilter: xtables: fix typo causing some targets not to load on IPv6 Pali Rohár (1): cifs: Validate content of NFS reparse point buffer Paritosh Dixit (1): net: stmmac: dwmac-tegra: Fix link bring-up sequence Paulo Alcantara (1): smb: client: fix OOBs when building SMB2_IOCTL request Pawan Gupta (1): x86/lam: Disable ADDRESS_MASKING in most cases Peter Collingbourne (1): bpf, arm64: Fix address emission with tag-based KASAN enabled Peter Rashleigh (2): net: dsa: mv88e6xxx: Fix the max_vid definition for the MV88E6361 net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x Petr Pavlu (1): ring-buffer: Fix reader locking when changing the sub buffer order Petr Vaganov (1): xfrm: fix one more kernel-infoleak in algo dumping Pranjal Ramajor Asha Kanojiya (1): accel/qaic: Fix the for loop used to walk SG table Pu Lehui (1): riscv, bpf: Fix possible infinite tailcall when CONFIG_CFI_CLANG is enabled Qiao Ma (1): uprobe: avoid out-of-bounds memory access of fetching args Qu Wenruo (2): btrfs: qgroup: set a more sane default value for subtree drop threshold btrfs: reject ro->rw reconfiguration if there are hard ro requirements Ranjani Sridharan (4): ASoC: SOF: Intel: hda: Handle prepare without close for non-HDA DAI's ASoC: SOF: Intel: hda: Always clean up link DMA during stop ASoC: SOF: ipc4-topology: Do not set ALH node_id for aggregated DAIs soundwire: intel_ace2x: Send PDI stream number during prepare Richard Gong (2): x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h Rob Clark (1): drm/msm/a6xx+: Insert a fence wait before SMMU table update Ryusuke Konishi (1): nilfs2: fix kernel bug due to missing clearing of buffer delay flag Sabrina Dubroca (2): macsec: don't increment counters for an unrelated SA xfrm: validate new SA's prefixlen using SA family when sel.family is unset Saravanan Vajravel (1): RDMA/bnxt_re: Fix incorrect AVID type in WQE structure Sean Christopherson (1): KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Selvin Xavier (1): RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop Shay Drory (1): net/mlx5: Fix command bitmask initialization Shenghao Yang (3): net: dsa: mv88e6xxx: group cycle counter coefficients net: dsa: mv88e6xxx: read cycle counter period from hardware net: dsa: mv88e6xxx: support 4000ps cycle counter period Shengjiu Wang (1): ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit Shubham Panwar (1): ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue Srinivasan Shanmugam (1): drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring Steven Rostedt (2): fgraph: Allocate ret_stack_list with proper size fgraph: Change the name of cpuhp state to "fgraph:online" Su Hui (2): firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() smb: client: fix possible double free in smb2_set_ea() Takashi Sakamoto (1): firewire: core: fix invalid port index for parent device Thadeu Lima de Souza Cascardo (1): usb: typec: altmode should keep reference to parent Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO Tim Harvey (1): net: dsa: microchip: disable EEE for KSZ879x/KSZ877x/KSZ876x Timo Grautstueck (1): lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW Toke Høiland-Jørgensen (2): bpf: Make sure internal and UAPI bpf_redirect flags don't overlap bpf: fix kfunc btf caching for modules Tony Ambardar (1): selftests/bpf: Fix cross-compiling urandom_read Tyrone Wu (4): bpf: fix unpopulated name_len field in perf_event link info selftests/bpf: fix perf_event link info name_len assertion bpf: Fix unpopulated path_size when uprobe_multi fields unset bpf: Fix link info netfilter flags to populate defrag flag Vadim Fedorenko (1): bnxt_en: replace ptp_lock with irqsave variant Vamsi Krishna Brahmajosyula (1): platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses Viktor Malik (1): objpool: fix choosing allocation for percpu slots Vladimir Oltean (2): net: dsa: vsc73xx: fix reception from VLAN-unaware bridges net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers Waiman Long (1): sched/core: Disable page allocation in task_tick_mm_cid() Wander Lairson Costa (1): bpf: Use raw_spinlock_t in ringbuf Wang Hai (8): net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() net: ethernet: rtsn: fix potential memory leak in rtsn_start_xmit() net: systemport: fix potential memory leak in bcm_sysport_xmit() net: bcmasp: fix potential memory leak in bcmasp_xmit() scsi: target: core: Fix null-ptr-deref in target_alloc_device() net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() Xin Long (1): ipv4: give an IPv4 dev to blackhole_netdev Yang Erkun (1): nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net Yao Zi (1): clk: rockchip: fix finding of maximum clock ID Ye Bin (2): Bluetooth: bnep: fix wild-memory-access in proto_unregister cifs: fix warning when destroy 'cifs_io_request_pool' Yu Kuai (1): md/raid10: fix null ptr dereference in raid10_size() Yuan Can (2): mlxsw: spectrum_router: fix xa_store() error checking powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() Yue Haibing (1): btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item() Zhao Mengmeng (3): udf: refactor udf_current_aext() to handle error udf: refactor udf_next_aext() to handle error udf: refactor inode_bmap() to handle error Zichen Xie (1): ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() liwei (1): cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception

1 year

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2024