Hi,
please consider applying the following patch to v5.15.y to fix
a build error seen with various test builds (m68k:allmodconfig,
powerpc:allmodconfig, powerpc:ppc32_allmodconfig, and
xtensa:allmodconfig).
b4909252da9b ("drivers: lkdtm: fix clang -Wformat warning")
Thanks,
Guenter
Correction: The subject line in my previous message erroneously stated
"5.10.y" in patch 2/3 and 3/3, instead of the correct "5.15.y." Sending
again after correction.
Here are the three backported patches aimed at addressing a potential
crash and an actual crash.
Patch 1 Fix potential OOB access in receive_encrypted_standard() if
server returned a large shdr->NextCommand in cifs.
Patch 2 fix validate offsets and lengths before dereferencing create
contexts in smb2_parse_contexts().
Patch 3 fix issue in patch 2.
The original patches were authored by Paulo Alcantara <pc(a)manguebit.com>.
Original Patches:
1. eec04ea11969 ("smb: client: fix OOB in receive_encrypted_standard()")
2. af1689a9b770 ("smb: client: fix potential OOBs in smb2_parse_contexts()")
3. 76025cc2285d ("smb: client: fix parsing of SMB3.1.1 POSIX create context")
Please review and consider applying these patches.
https://lore.kernel.org/all/2023121834-semisoft-snarl-49ad@gregkh/
fs/cifs/smb2ops.c | 4 +++-
fs/cifs/smb2pdu.c | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++-------------------------------------
fs/cifs/smb2proto.h | 12 +++++++-----
3 files changed, 66 insertions(+), 43 deletions(-)
This reverts commit 1e35f074399dece73d5df11847d4a0d7a6f49434.
Given that ERROR_RECOVERY calls into PORT_RESET for Hi-Zing
the CC pins, setting CC pins to default state during PORT_RESET
breaks error recovery.
4.5.2.2.2.1 ErrorRecovery State Requirements
The port shall not drive VBUS or VCONN, and shall present a
high-impedance to ground (above zOPEN) on its CC1 and CC2 pins.
Hi-Zing the CC pins is the inteded behavior for PORT_RESET.
CC pins are set to default state after tErrorRecovery in
PORT_RESET_WAIT_OFF.
4.5.2.2.2.2 Exiting From ErrorRecovery State
A Sink shall transition to Unattached.SNK after tErrorRecovery.
A Source shall transition to Unattached.SRC after tErrorRecovery.
Cc: stable(a)vger.kernel.org
Cc: Frank Wang <frank.wang(a)rock-chips.com>
Fixes: 1e35f074399d ("usb: typec: tcpm: fix cc role at port reset")
Signed-off-by: Badhri Jagan Sridharan <badhri(a)google.com>
---
drivers/usb/typec/tcpm/tcpm.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 5945e3a2b0f7..9d410718eaf4 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -4876,8 +4876,7 @@ static void run_state_machine(struct tcpm_port *port)
break;
case PORT_RESET:
tcpm_reset_port(port);
- tcpm_set_cc(port, tcpm_default_state(port) == SNK_UNATTACHED ?
- TYPEC_CC_RD : tcpm_rp_cc(port));
+ tcpm_set_cc(port, TYPEC_CC_OPEN);
tcpm_set_state(port, PORT_RESET_WAIT_OFF,
PD_T_ERROR_RECOVERY);
break;
base-commit: 933bb7b878ddd0f8c094db45551a7daddf806e00
--
2.43.0.429.g432eaa2c6b-goog
I'm relatively new here, first time reporting a regression, so apologies in
advance if I'm doing something wrong.
I'm using Arch Linux (linux-mainline kernel) on my chromebook Acer Spin 713-2W
(Voxel), and after upgrading linux-mainline from 6.7-rc4 to 6.7-rc5 the audio
setup isn't working anymore. Firstly I suspected its some changes in the sof-
firmware, yet got no luck in upgrading sof-firmware (2023.09.2 -> 2023.12).
On certain chromebooks, audio setup needs custom ALSA ucm confs [1], but after
contacting the chromebook-linux-audio developer [2], I think it's not a conf
problem, but rather a kernel regression.
After hours of bisecting, the first bad commit 31ed8da (ASoC: SOF: sof-audio:
Modify logic for enabling/disabling topology cores) ensures the regression.
demsg log pasted below:
// before 31ed8da, working
[ 61.572587] sof-audio-pci-intel-tgl 0000:00:1f.3: ipc tx error for
0x60010000 (msg/reply size: 108/20): -22
[ 61.572593] sof-audio-pci-intel-tgl 0000:00:1f.3: HW params ipc failed for
stream 1
[ 61.572594] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_hw_params on 0000:00:1f.3: -22
[ 61.573247] sof-audio-pci-intel-tgl 0000:00:1f.3: ipc tx error for
0x60010000 (msg/reply size: 108/20): -22
[ 61.573250] sof-audio-pci-intel-tgl 0000:00:1f.3: HW params ipc failed for
stream 1
[ 61.573251] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_hw_params on 0000:00:1f.3: -22
[ 61.573888] sof-audio-pci-intel-tgl 0000:00:1f.3: ipc tx error for
0x60010000 (msg/reply size: 108/20): -22
[ 61.573892] sof-audio-pci-intel-tgl 0000:00:1f.3: HW params ipc failed for
stream 1
[ 61.573893] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_hw_params on 0000:00:1f.3: -22
[ 61.574570] sof-audio-pci-intel-tgl 0000:00:1f.3: ipc tx error for
0x60010000 (msg/reply size: 108/20): -22
[ 61.574572] sof-audio-pci-intel-tgl 0000:00:1f.3: HW params ipc failed for
stream 1
[ 61.574573] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_hw_params on 0000:00:1f.3: -22
// after 31ed8da, broken
[ 48.930740] sof-audio-pci-intel-tgl 0000:00:1f.3: ipc tx error for
0x30020000 (msg/reply size: 12/0): -13
[ 48.930762] sof-audio-pci-intel-tgl 0000:00:1f.3: failed to free widget
DMIC0.IN
[ 57.235697] sof-audio-pci-intel-tgl 0000:00:1f.3: ipc tx error for
0x30030000 (msg/reply size: 16/0): -22
[ 57.235701] sof-audio-pci-intel-tgl 0000:00:1f.3: sof_ipc3_route_setup:
route DMIC0.IN -> BUF4.0 failed
[ 57.235703] sof-audio-pci-intel-tgl 0000:00:1f.3:
sof_ipc3_set_up_all_pipelines: route set up failed
[ 57.235704] sof-audio-pci-intel-tgl 0000:00:1f.3: Failed to restore
pipeline after resume -22
[ 57.235706] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.235926] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.235966] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236006] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236041] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236074] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236107] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236141] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236173] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236205] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
[ 57.236239] sof-audio-pci-intel-tgl 0000:00:1f.3: ASoC: error at
snd_soc_pcm_component_pm_runtime_get on 0000:00:1f.3: -22
Steps to reproduce:
- Run chromebook-linux-audio script [2] (this would install custom sof-rt5682
ucm confs [1] into /usr/share/alsa/ucm2/conf.d/sof-rt5682 and write a line
`options snd-intel-dspcfg dsp_driver=3` to /etc/modprobe.d/snd-sof.conf)
- Reboot, gets audio working on kernels before 31ed8da
- Install latest stable kernel (6.7.3), audio broken
- Install latest git kernel (6.8-rc2), audio broken
- Revert 31ed8da, build upon latest linux-git (6.8-rc2), audio working
Apologies for my busyiness that I should have reported it long before the
regression enters stable and lts, but sadly linux-lts (6.6.13) seems to be
affected too [3].
Please let me know if there's any other thing that I can help debugging.
-- Mole Shang
[1]: https://github.com/WeirdTreeThing/chromebook-ucm-conf/tree/main/sof-rt5682
[2]: https://github.com/WeirdTreeThing/chromebook-linux-audio/issues/70
[3]: https://github.com/WeirdTreeThing/chromebook-linux-audio/issues/
70#issuecomment-1911048309
#regzbot introduced: 31ed8da1c8e5e504710bb36863700e3389f8fc81
On 3/2/23 09:54, Qu Wenruo wrote:
> [BUG]
> During my scrub rework, I did a stupid thing like this:
>
> bio->bi_iter.bi_sector = stripe->logical;
> btrfs_submit_bio(fs_info, bio, stripe->mirror_num);
>
> Above bi_sector assignment is using logical address directly, which
> lacks ">> SECTOR_SHIFT".
>
> This results a read on a range which has no chunk mapping.
>
> This results the following crash:
>
> BTRFS critical (device dm-1): unable to find logical 11274289152 length 65536
> assertion failed: !IS_ERR(em), in fs/btrfs/volumes.c:6387
> ------------[ cut here ]------------
>
> Sure this is all my fault, but this shows a possible problem in real
> world, that some bitflip in file extents/tree block can point to
> unmapped ranges, and trigger above ASSERT(), or if CONFIG_BTRFS_ASSERT
> is not configured, cause invalid pointer.
>
> [PROBLEMS]
> In above call chain, we just don't handle the possible error from
> btrfs_get_chunk_map() inside __btrfs_map_block().
>
> [FIX]
> The fix is pretty straightforward, just replace the ASSERT() with proper
> error handling.
>
> Signed-off-by: Qu Wenruo <wqu(a)suse.com>
> ---
> Changelog:
> v2:
> - Rebased to latest misc-next
> The error path in bio.c is already fixed, thus only need to replace
> the ASSERT() in __btrfs_map_block().
> ---
> fs/btrfs/volumes.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index 4d479ac233a4..93bc45001e68 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -6242,7 +6242,8 @@ int __btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
> return -EINVAL;
>
> em = btrfs_get_chunk_map(fs_info, logical, *length);
> - ASSERT(!IS_ERR(em));
> + if (IS_ERR(em))
> + return PTR_ERR(em);
>
> map = em->map_lookup;
> data_stripes = nr_data_stripes(map);
This bug affects 6.1.y LTS branch but no backport commit of this fix in
6.1.y branch. Please include it. Thanks.
The patch titled
Subject: mm/memblock: add MEMBLOCK_RSRV_NOINIT into flagname[] array
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-memblock-add-memblock_rsrv_noinit-into-flagname-array.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Anshuman Khandual <anshuman.khandual(a)arm.com>
Subject: mm/memblock: add MEMBLOCK_RSRV_NOINIT into flagname[] array
Date: Fri, 9 Feb 2024 08:39:12 +0530
The commit 77e6c43e137c ("memblock: introduce MEMBLOCK_RSRV_NOINIT flag")
skipped adding this newly introduced memblock flag into flagname[] array,
thus preventing a correct memblock flags output for applicable memblock
regions.
Link: https://lkml.kernel.org/r/20240209030912.1382251-1-anshuman.khandual@arm.com
Fixes: 77e6c43e137c ("memblock: introduce MEMBLOCK_RSRV_NOINIT flag")
Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com>
Cc: Mike Rapoport <rppt(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memblock.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/memblock.c~mm-memblock-add-memblock_rsrv_noinit-into-flagname-array
+++ a/mm/memblock.c
@@ -2249,6 +2249,7 @@ static const char * const flagname[] = {
[ilog2(MEMBLOCK_MIRROR)] = "MIRROR",
[ilog2(MEMBLOCK_NOMAP)] = "NOMAP",
[ilog2(MEMBLOCK_DRIVER_MANAGED)] = "DRV_MNG",
+ [ilog2(MEMBLOCK_RSRV_NOINIT)] = "RSV_NIT",
};
static int memblock_debug_show(struct seq_file *m, void *private)
_
Patches currently in -mm which might be from anshuman.khandual(a)arm.com are
fs-proc-task_mmu-add-display-flag-for-vm_mayoverlay.patch
mm-memblock-add-memblock_rsrv_noinit-into-flagname-array.patch
mm-cma-dont-treat-bad-input-arguments-for-cma_alloc-as-its-failure.patch
mm-cma-drop-config_cma_debug.patch
mm-cma-make-max_cma_areas-=-config_cma_areas.patch
mm-cma-add-sysfs-file-release_pages_success.patch
Few users have observed display corruption when they boot
the machine to KDE Plasma or playing games. We have root
caused the problem that whenever alloc_range() couldn't
find the required memory blocks the function was returning
SUCCESS in some of the corner cases.
The right approach would be if the total allocated size
is less than the required size, the function should
return -ENOSPC.
Cc: <stable(a)vger.kernel.org> # 6.7+
Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation")
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3097
Tested-by: Mario Limonciello <mario.limonciello(a)amd.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20240207174456.341121-…
Acked-by: Christian König <christian.koenig(a)amd.com>
Reviewed-by: Matthew Auld <matthew.auld(a)intel.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam(a)amd.com>
---
drivers/gpu/drm/drm_buddy.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_buddy.c b/drivers/gpu/drm/drm_buddy.c
index f57e6d74fb0e..c1a99bf4dffd 100644
--- a/drivers/gpu/drm/drm_buddy.c
+++ b/drivers/gpu/drm/drm_buddy.c
@@ -539,6 +539,12 @@ static int __alloc_range(struct drm_buddy *mm,
} while (1);
list_splice_tail(&allocated, blocks);
+
+ if (total_allocated < size) {
+ err = -ENOSPC;
+ goto err_free;
+ }
+
return 0;
err_undo:
--
2.25.1
Hello,
This series contains backports for 6.6 from the 6.7 release. This patchset
has gone through xfs testing and review.
Anthony Iliopoulos (1):
xfs: fix again select in kconfig XFS_ONLINE_SCRUB_STATS
Catherine Hoang (2):
MAINTAINERS: add Catherine as xfs maintainer for 6.6.y
xfs: allow read IO and FICLONE to run concurrently
Cheng Lin (1):
xfs: introduce protection for drop nlink
Christoph Hellwig (4):
xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space
xfs: only remap the written blocks in xfs_reflink_end_cow_extent
xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags
xfs: respect the stable writes flag on the RT device
Darrick J. Wong (8):
xfs: bump max fsgeom struct version
xfs: hoist freeing of rt data fork extent mappings
xfs: prevent rt growfs when quota is enabled
xfs: rt stubs should return negative errnos when rt disabled
xfs: fix units conversion error in xfs_bmap_del_extent_delay
xfs: make sure maxlen is still congruent with prod when rounding down
xfs: clean up dqblk extraction
xfs: dquot recovery does not validate the recovered dquot
Dave Chinner (1):
xfs: inode recovery does not validate the recovered inode
Leah Rumancik (1):
xfs: up(ic_sema) if flushing data device fails
Long Li (2):
xfs: factor out xfs_defer_pending_abort
xfs: abort intent items when recovery intents fail
Omar Sandoval (1):
xfs: fix internal error from AGFL exhaustion
MAINTAINERS | 1 +
fs/xfs/Kconfig | 2 +-
fs/xfs/libxfs/xfs_alloc.c | 27 ++++++++++++--
fs/xfs/libxfs/xfs_bmap.c | 21 +++--------
fs/xfs/libxfs/xfs_defer.c | 28 +++++++++------
fs/xfs/libxfs/xfs_defer.h | 2 +-
fs/xfs/libxfs/xfs_inode_buf.c | 3 ++
fs/xfs/libxfs/xfs_rtbitmap.c | 33 +++++++++++++++++
fs/xfs/libxfs/xfs_sb.h | 2 +-
fs/xfs/xfs_bmap_util.c | 24 +++++++------
fs/xfs/xfs_dquot.c | 5 +--
fs/xfs/xfs_dquot_item_recover.c | 21 +++++++++--
fs/xfs/xfs_file.c | 63 ++++++++++++++++++++++++++-------
fs/xfs/xfs_inode.c | 24 +++++++++++++
fs/xfs/xfs_inode.h | 17 +++++++++
fs/xfs/xfs_inode_item_recover.c | 14 +++++++-
fs/xfs/xfs_ioctl.c | 30 ++++++++++------
fs/xfs/xfs_iops.c | 7 ++++
fs/xfs/xfs_log.c | 23 ++++++------
fs/xfs/xfs_log_recover.c | 2 +-
fs/xfs/xfs_reflink.c | 5 +++
fs/xfs/xfs_rtalloc.c | 33 +++++++++++++----
fs/xfs/xfs_rtalloc.h | 27 ++++++++------
23 files changed, 312 insertions(+), 102 deletions(-)
--
2.39.3