Backport of upstream fixes to NFSD's duplicate reply cache. These
have been hand-applied and tested with the same reproducer as was
used to create the upstream fixes.
---
Chuck Lever (8):
NFSD: Refactor nfsd_reply_cache_free_locked()
NFSD: Rename nfsd_reply_cache_alloc()
NFSD: Replace nfsd_prune_bucket()
NFSD: Refactor the duplicate reply cache shrinker
NFSD: Remove svc_rqst::rq_cacherep
NFSD: Rename struct svc_cacherep
NFSD: Fix "start of NFS reply" pointer passed to nfsd_cache_update()
NFSD: Fix checksum mismatches in the duplicate reply cache
fs/nfsd/cache.h | 8 +-
fs/nfsd/nfscache.c | 266 ++++++++++++++++++++++++-------------
fs/nfsd/nfssvc.c | 20 ++-
fs/nfsd/trace.h | 26 +++-
include/linux/sunrpc/svc.h | 1 -
5 files changed, 218 insertions(+), 103 deletions(-)
--
Chuck Lever
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 8001f49394e353f035306a45bcf504f06fca6355
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112228-racoon-mossy-ce5e@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
8001f49394e3 ("proc: sysctl: prevent aliased sysctls from getting passed to init")
1998f19324d2 ("fs: move pipe sysctls to is own file")
66ad398634c2 ("fs: move fs/exec.c sysctls into its own file")
d1d8ac9edf10 ("fs: move shared sysctls to fs/sysctls.c")
54771613e8a7 ("sysctl: move maxolduid as a sysctl specific const")
c8c0c239d5ab ("fs: move dcache sysctls to its own file")
204d5a24e155 ("fs: move fs stat sysctls to file_table.c")
1d67fe585049 ("fs: move inode sysctls to its own file")
b1f2aff888af ("sysctl: share unsigned long const values")
3ba442d5331f ("fs: move binfmt_misc sysctl to its own file")
2452dcb9f7f2 ("sysctl: use SYSCTL_ZERO to replace some static int zero uses")
d73840ec2f74 ("sysctl: use const for typically used max/min proc sysctls")
f628867da46f ("sysctl: make ngroups_max const")
bbe7a10ed83a ("hung_task: move hung_task sysctl interface to hung_task.c")
78e36f3b0dae ("sysctl: move some boundary constants from sysctl.c to sysctl_vals")
39c65a94cd96 ("mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30%")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 8001f49394e353f035306a45bcf504f06fca6355 Mon Sep 17 00:00:00 2001
From: Krister Johansen <kjlx(a)templeofstupid.com>
Date: Fri, 27 Oct 2023 14:46:40 -0700
Subject: [PATCH] proc: sysctl: prevent aliased sysctls from getting passed to
init
The code that checks for unknown boot options is unaware of the sysctl
alias facility, which maps bootparams to sysctl values. If a user sets
an old value that has a valid alias, a message about an invalid
parameter will be printed during boot, and the parameter will get passed
to init. Fix by checking for the existence of aliased parameters in the
unknown boot parameter code. If an alias exists, don't return an error
or pass the value to init.
Signed-off-by: Krister Johansen <kjlx(a)templeofstupid.com>
Cc: stable(a)vger.kernel.org
Fixes: 0a477e1ae21b ("kernel/sysctl: support handling command line aliases")
Signed-off-by: Luis Chamberlain <mcgrof(a)kernel.org>
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index c88854df0b62..1c9635dddb70 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1592,6 +1592,13 @@ static const char *sysctl_find_alias(char *param)
return NULL;
}
+bool sysctl_is_alias(char *param)
+{
+ const char *alias = sysctl_find_alias(param);
+
+ return alias != NULL;
+}
+
/* Set sysctl value passed on kernel command line. */
static int process_sysctl_arg(char *param, char *val,
const char *unused, void *arg)
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 09d7429d67c0..61b40ea81f4d 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -242,6 +242,7 @@ extern void __register_sysctl_init(const char *path, struct ctl_table *table,
extern struct ctl_table_header *register_sysctl_mount_point(const char *path);
void do_sysctl_args(void);
+bool sysctl_is_alias(char *param);
int do_proc_douintvec(struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos,
int (*conv)(unsigned long *lvalp,
@@ -287,6 +288,11 @@ static inline void setup_sysctl_set(struct ctl_table_set *p,
static inline void do_sysctl_args(void)
{
}
+
+static inline bool sysctl_is_alias(char *param)
+{
+ return false;
+}
#endif /* CONFIG_SYSCTL */
int sysctl_max_threads(struct ctl_table *table, int write, void *buffer,
diff --git a/init/main.c b/init/main.c
index 436d73261810..e24b0780fdff 100644
--- a/init/main.c
+++ b/init/main.c
@@ -530,6 +530,10 @@ static int __init unknown_bootoption(char *param, char *val,
{
size_t len = strlen(param);
+ /* Handle params aliased to sysctls */
+ if (sysctl_is_alias(param))
+ return 0;
+
repair_env_string(param, val);
/* Handle obsolete-style parameters */
From: Claire Lin <claire.lin(a)broadcom.com>
commit 7f852cc1579297fd763789f8cd370639d0c654b6 upstream.
In brcmstb_nand_verify_erased_page(), the ECC chunk pointer calculation
while correcting erased page bitflips is wrong, fix it.
Fixes: 02b88eea9f9c ("mtd: brcmnand: Add check for erased page bitflips")
Signed-off-by: Claire Lin <claire.lin(a)broadcom.com>
Reviewed-by: Ray Jui <ray.jui(a)broadcom.com>
Signed-off-by: Kamal Dasu <kdasu.kdev(a)gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
Signed-off-by: Yuta Hayama <hayama(a)lineo.co.jp>
---
After applying e44b9a9c1357 ("mtd: nand: brcmnand: Zero bitflip is not an
error"), the return value 0 of brcmstb_nand_verify_erased_page() is
*correctly* interpreted as "no bit flips, no errors". However, that
function still has the issue that it may incorrectly return 0 for a page
that contains bitflips. Without this patch, the data buffer of the erased
page could be passed to a upper layer (e.g. UBIFS) without bitflips being
detected and corrected.
In active stable, 4.14.y and 4.19.y seem to have a same issue.
drivers/mtd/nand/brcmnand/brcmnand.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index fa66663df6e8..267bbba09afb 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -1753,6 +1753,7 @@ static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
int bitflips = 0;
int page = addr >> chip->page_shift;
int ret;
+ void *ecc_chunk;
if (!buf) {
buf = chip->buffers->databuf;
@@ -1769,7 +1770,9 @@ static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
return ret;
for (i = 0; i < chip->ecc.steps; i++, oob += sas) {
- ret = nand_check_erased_ecc_chunk(buf, chip->ecc.size,
+ ecc_chunk = buf + chip->ecc.size * i;
+ ret = nand_check_erased_ecc_chunk(ecc_chunk,
+ chip->ecc.size,
oob, sas, NULL, 0,
chip->ecc.strength);
if (ret < 0)
--
2.25.1
We need to backport patch #1 as well because it introduced a helper used
by patch #2.
Andrew Murray (2):
arm64: cpufeature: Extract capped perfmon fields
KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
arch/arm64/include/asm/cpufeature.h | 23 +++++++++++++++++++++++
arch/arm64/include/asm/sysreg.h | 6 ++++++
arch/arm64/kvm/sys_regs.c | 10 ++++++++++
3 files changed, 39 insertions(+)
--
2.33.0
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102140-tartly-democrat-140d@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001
From: Francis Laniel <flaniel(a)linux.microsoft.com>
Date: Fri, 20 Oct 2023 13:42:49 +0300
Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches
several symbols
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 3d7a180a8427..a8fef6ab0872 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = {
.priority = 1 /* Invoked after kprobe module callback */
};
+static int count_symbols(void *data, unsigned long unused)
+{
+ unsigned int *count = data;
+
+ (*count)++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ unsigned int count;
+
+ count = 0;
+ kallsyms_on_each_match_symbol(count_symbols, func_name, &count);
+
+ return count;
+}
+
static int __trace_kprobe_create(int argc, const char *argv[])
{
/*
@@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[])
}
}
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1) {
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+ ret = -EADDRNOTAVAIL;
+
+ goto error;
+ } else if (count == 0) {
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ trace_probe_log_err(0, BAD_PROBE_ADDR);
+ ret = -ENOENT;
+
+ goto error;
+ }
+ }
+
trace_probe_log_set_index(0);
if (event) {
ret = traceprobe_parse_event_name(&event, &group, gbuf,
@@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
}
#ifdef CONFIG_PERF_EVENTS
+
/* create a trace_kprobe, but don't add it to global lists */
struct trace_event_call *
create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
int ret;
char *event;
+ if (func) {
+ unsigned int count;
+
+ count = number_of_same_symbols(func);
+ if (count > 1)
+ /*
+ * Users should use addr to remove the ambiguity of
+ * using func only.
+ */
+ return ERR_PTR(-EADDRNOTAVAIL);
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return ERR_PTR(-ENOENT);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 02b432ae7513..850d9ecb6765 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(BAD_MAXACT, "Invalid maxactive number"), \
C(MAXACT_TOO_BIG, "Maxactive is too big"), \
C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \
+ C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \
C(BAD_RETPROBE, "Retprobe address must be an function entry"), \
C(NO_TRACEPOINT, "Tracepoint is not found"), \
C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \
> Hi,
>
> We would like to apply this patch to version 6.1 of the LTS branch.
> This is to add a project ID for Android support for a gamepad
> controller. We would like it to apply sooner than waiting for the
> next LTS branch due to project schedules.
>
> commite28a0974d749e5105d77233c0a84d35c37da047e
>
> Regards,
>
> Max
>
Hi Linux team,
We would like to have this patch backported to LTS versions 4.19, 5.4,
5.10, and 5.15 as well. The main purpose would to add our device ID for
support across older android devices. Feel free to let us know if there
are any concerns or issues.
>
> *CAUTION: External Email *
>
> 6.5-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Max Nguyen <maxwell.nguyen(a)hp.com>
>
> commit e28a0974d749e5105d77233c0a84d35c37da047e upstream.
>
> Add HyperX controller support to xpad_device and xpad_table.
>
> Suggested-by: Chris Toledanes <chris.toledanes(a)hp.com>
> Reviewed-by: Carl Ng <carl.ng(a)hp.com>
> Signed-off-by: Max Nguyen <maxwell.nguyen(a)hp.com>
> Reviewed-by: Rahul Rameshbabu <rrameshbabu(a)nvidia.com>
> Link:
> https://lore.kernel.org/r/20230906231514.4291-1-hphyperxdev@gmail.com
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
> ---
> drivers/input/joystick/xpad.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> --- a/drivers/input/joystick/xpad.c
> +++ b/drivers/input/joystick/xpad.c
> @@ -130,6 +130,7 @@ static const struct xpad_device {
> { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 },
> { 0x03eb, 0xff01, "Wooting One (Legacy)", 0, XTYPE_XBOX360 },
> { 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 },
> + { 0x03f0, 0x0495, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE },
> { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
> { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
> { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
> @@ -458,6 +459,7 @@ static const struct usb_device_id xpad_t
> { USB_INTERFACE_INFO('X', 'B', 0) }, /* Xbox USB-IF not-approved class */
> XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 controller */
> XPAD_XBOX360_VENDOR(0x03eb), /* Wooting Keyboards (Legacy) */
> + XPAD_XBOXONE_VENDOR(0x03f0), /* HP HyperX Xbox One controllers */
> XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster Xbox 360 controllers */
> XPAD_XBOX360_VENDOR(0x045e), /* Microsoft Xbox 360 controllers */
> XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft Xbox One controllers */
>
Backport of upstream fixes to NFSD's duplicate reply cache. These
have been hand-applied and tested with the same reproducer as was
used to create the upstream fixes.
---
Chuck Lever (2):
NFSD: Fix "start of NFS reply" pointer passed to nfsd_cache_update()
NFSD: Fix checksum mismatches in the duplicate reply cache
fs/nfsd/cache.h | 4 +--
fs/nfsd/nfscache.c | 64 +++++++++++++++++++++++++++++++---------------
fs/nfsd/nfssvc.c | 14 ++++++++--
3 files changed, 57 insertions(+), 25 deletions(-)
--
Chuck Lever
This commit has no upstream equivalent.
After commit db5ebaeb8fda ("PCI: keystone: Don't discard .probe()
callback") in 5.10, there are two modpost warnings when building with
clang:
WARNING: modpost: vmlinux.o(.text+0x5aa6dc): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_port()
The function ks_pcie_probe() references
the function __init ks_pcie_add_pcie_port().
This is often because ks_pcie_probe lacks a __init
annotation or the annotation of ks_pcie_add_pcie_port is wrong.
WARNING: modpost: vmlinux.o(.text+0x5aa6f4): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_ep()
The function ks_pcie_probe() references
the function __init ks_pcie_add_pcie_ep().
This is often because ks_pcie_probe lacks a __init
annotation or the annotation of ks_pcie_add_pcie_ep is wrong.
ks_pcie_add_pcie_ep() was removed in upstream commit a0fd361db8e5 ("PCI:
dwc: Move "dbi", "dbi2", and "addr_space" resource setup into common
code") and ks_pcie_add_pcie_port() was removed in upstream
commit 60f5b73fa0f2 ("PCI: dwc: Remove unnecessary wrappers around
dw_pcie_host_init()"), both of which happened before upstream
commit 7994db905c0f ("PCI: keystone: Don't discard .probe() callback").
As neither of these removal changes are really suitable for stable, just
remove __init from these functions in stable, as it is no longer a
correct annotation after dropping __init from ks_pcie_probe().
Fixes: db5ebaeb8fda ("PCI: keystone: Don't discard .probe() callback")
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Signed-off-by: Nathan Chancellor <nathan(a)kernel.org>
---
This is not an issue in mainline but I still cc'd the author and
committer of 7994db905c0f in case they would like to check my analysis.
---
drivers/pci/controller/dwc/pci-keystone.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index 5b722287aac9..afaea201a5af 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -865,8 +865,8 @@ static irqreturn_t ks_pcie_err_irq_handler(int irq, void *priv)
return ks_pcie_handle_error_irq(ks_pcie);
}
-static int __init ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
- struct platform_device *pdev)
+static int ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
+ struct platform_device *pdev)
{
struct dw_pcie *pci = ks_pcie->pci;
struct pcie_port *pp = &pci->pp;
@@ -978,8 +978,8 @@ static const struct dw_pcie_ep_ops ks_pcie_am654_ep_ops = {
.get_features = &ks_pcie_am654_get_features,
};
-static int __init ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
- struct platform_device *pdev)
+static int ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
+ struct platform_device *pdev)
{
int ret;
struct dw_pcie_ep *ep;
---
base-commit: 479e8b8925415420b31e2aa65f9b0db3dea2adf4
change-id: 20231128-5-10-fix-pci-keystone-modpost-warning-a8e886bdc0f7
Best regards,
--
Nathan Chancellor <nathan(a)kernel.org>
In commit f8ff23429c62 ("kernel/Kconfig.kexec: drop select of KEXEC for
CRASH_DUMP") we tried to fix a config regression, where CONFIG_CRASH_DUMP
required CONFIG_KEXEC.
However, it was not enough at least for arm64 platforms. While further testing
the patch with our arm64 config I noticed that CONFIG_CRASH_DUMP is unavailable
in menuconfig. This is because CONFIG_CRASH_DUMP still depends on the new
CONFIG_ARCH_SUPPORTS_KEXEC introduced in commit 91506f7e5d21 ("arm64/kexec:
refactor for kernel/Kconfig.kexec") and on arm64 CONFIG_ARCH_SUPPORTS_KEXEC
requires CONFIG_PM_SLEEP_SMP=y, which in turn requires either CONFIG_SUSPEND=y
or CONFIG_HIBERNATION=y neither of which are set in our config.
Given that we already established that CONFIG_KEXEC (which is a switch for kexec
system call itself) is not required for CONFIG_CRASH_DUMP drop
CONFIG_ARCH_SUPPORTS_KEXEC dependency as well. The arm64 kernel builds just fine
with CONFIG_CRASH_DUMP=y and with both CONFIG_KEXEC=n and CONFIG_KEXEC_FILE=n
after f8ff23429c62 ("kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP")
and this patch are applied given that the necessary shared bits are included via
CONFIG_KEXEC_CORE dependency.
Fixes: 91506f7e5d21 ("arm64/kexec: refactor for kernel/Kconfig.kexec")
Cc: stable(a)vger.kernel.org # 6.6+: f8ff234: kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP
Cc: stable(a)vger.kernel.org # 6.6+
Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com>
---
kernel/Kconfig.kexec | 1 -
1 file changed, 1 deletion(-)
diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
index fc38f1ae3a30..946dffa048b7 100644
--- a/kernel/Kconfig.kexec
+++ b/kernel/Kconfig.kexec
@@ -96,7 +96,6 @@ config KEXEC_JUMP
config CRASH_DUMP
bool "kernel crash dumps"
depends on ARCH_SUPPORTS_CRASH_DUMP
- depends on ARCH_SUPPORTS_KEXEC
select CRASH_CORE
select KEXEC_CORE
help
--
2.39.2
Since commit 8e1f385104ac ("kill task_struct->thread_group") remove
the thread_group, we will encounter below issue.
(gdb) lx-ps
TASK PID COMM
0xffff800086503340 0 swapper/0
Python Exception <class 'gdb.error'>: There is no member named thread_group.
Error occurred in Python: There is no member named thread_group.
We use signal->thread_head to iterate all threads instead.
Fixes: 8e1f385104ac ("kill task_struct->thread_group")
Cc: stable(a)vger.kernel.org
Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
---
scripts/gdb/linux/tasks.py | 18 +++++++-----------
1 file changed, 7 insertions(+), 11 deletions(-)
diff --git a/scripts/gdb/linux/tasks.py b/scripts/gdb/linux/tasks.py
index 17ec19e9b5bf..aa5ab6251f76 100644
--- a/scripts/gdb/linux/tasks.py
+++ b/scripts/gdb/linux/tasks.py
@@ -13,7 +13,7 @@
import gdb
-from linux import utils
+from linux import utils, lists
task_type = utils.CachedType("struct task_struct")
@@ -22,19 +22,15 @@ task_type = utils.CachedType("struct task_struct")
def task_lists():
task_ptr_type = task_type.get_type().pointer()
init_task = gdb.parse_and_eval("init_task").address
- t = g = init_task
+ t = init_task
while True:
- while True:
- yield t
+ thread_head = t['signal']['thread_head']
+ for thread in lists.list_for_each_entry(thread_head, task_ptr_type, 'thread_node'):
+ yield thread
- t = utils.container_of(t['thread_group']['next'],
- task_ptr_type, "thread_group")
- if t == g:
- break
-
- t = g = utils.container_of(g['tasks']['next'],
- task_ptr_type, "tasks")
+ t = utils.container_of(t['tasks']['next'],
+ task_ptr_type, "tasks")
if t == init_task:
return
--
2.18.0
The patch titled
Subject: kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
kexec-drop-dependency-on-arch_supports_kexec-from-crash_dump.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Ignat Korchagin <ignat(a)cloudflare.com>
Subject: kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP
Date: Wed, 29 Nov 2023 22:04:09 +0000
In commit f8ff23429c62 ("kernel/Kconfig.kexec: drop select of KEXEC for
CRASH_DUMP") we tried to fix a config regression, where CONFIG_CRASH_DUMP
required CONFIG_KEXEC.
However, it was not enough at least for arm64 platforms. While further
testing the patch with our arm64 config I noticed that CONFIG_CRASH_DUMP
is unavailable in menuconfig. This is because CONFIG_CRASH_DUMP still
depends on the new CONFIG_ARCH_SUPPORTS_KEXEC introduced in commit
91506f7e5d21 ("arm64/kexec: refactor for kernel/Kconfig.kexec") and on
arm64 CONFIG_ARCH_SUPPORTS_KEXEC requires CONFIG_PM_SLEEP_SMP=y, which in
turn requires either CONFIG_SUSPEND=y or CONFIG_HIBERNATION=y neither of
which are set in our config.
Given that we already established that CONFIG_KEXEC (which is a switch for
kexec system call itself) is not required for CONFIG_CRASH_DUMP drop
CONFIG_ARCH_SUPPORTS_KEXEC dependency as well. The arm64 kernel builds
just fine with CONFIG_CRASH_DUMP=y and with both CONFIG_KEXEC=n and
CONFIG_KEXEC_FILE=n after f8ff23429c62 ("kernel/Kconfig.kexec: drop select
of KEXEC for CRASH_DUMP") and this patch are applied given that the
necessary shared bits are included via CONFIG_KEXEC_CORE dependency.
Link: https://lkml.kernel.org/r/20231129220409.55006-1-ignat@cloudflare.com
Fixes: 91506f7e5d21 ("arm64/kexec: refactor for kernel/Kconfig.kexec")
Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com>
Cc: <stable(a)vger.kernel.org>
Cc: Alexander Gordeev <agordeev(a)linux.ibm.com>
Cc: Baoquan He <bhe(a)redhat.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/Kconfig.kexec | 1 -
1 file changed, 1 deletion(-)
--- a/kernel/Kconfig.kexec~kexec-drop-dependency-on-arch_supports_kexec-from-crash_dump
+++ a/kernel/Kconfig.kexec
@@ -94,7 +94,6 @@ config KEXEC_JUMP
config CRASH_DUMP
bool "kernel crash dumps"
depends on ARCH_SUPPORTS_CRASH_DUMP
- depends on ARCH_SUPPORTS_KEXEC
select CRASH_CORE
select KEXEC_CORE
help
_
Patches currently in -mm which might be from ignat(a)cloudflare.com are
kexec-drop-dependency-on-arch_supports_kexec-from-crash_dump.patch
The patch titled
Subject: nilfs2: fix missing error check for sb_set_blocksize call
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
nilfs2-fix-missing-error-check-for-sb_set_blocksize-call.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: fix missing error check for sb_set_blocksize call
Date: Wed, 29 Nov 2023 23:15:47 +0900
When mounting a filesystem image with a block size larger than the page
size, nilfs2 repeatedly outputs long error messages with stack traces to
the kernel log, such as the following:
getblk(): invalid block size 8192 requested
logical block size: 512
...
Call Trace:
dump_stack_lvl+0x92/0xd4
dump_stack+0xd/0x10
bdev_getblk+0x33a/0x354
__breadahead+0x11/0x80
nilfs_search_super_root+0xe2/0x704 [nilfs2]
load_nilfs+0x72/0x504 [nilfs2]
nilfs_mount+0x30f/0x518 [nilfs2]
legacy_get_tree+0x1b/0x40
vfs_get_tree+0x18/0xc4
path_mount+0x786/0xa88
__ia32_sys_mount+0x147/0x1a8
__do_fast_syscall_32+0x56/0xc8
do_fast_syscall_32+0x29/0x58
do_SYSENTER_32+0x15/0x18
entry_SYSENTER_32+0x98/0xf1
...
This overloads the system logger. And to make matters worse, it sometimes
crashes the kernel with a memory access violation.
This is because the return value of the sb_set_blocksize() call, which
should be checked for errors, is not checked.
The latter issue is due to out-of-buffer memory being accessed based on a
large block size that caused sb_set_blocksize() to fail for buffers read
with the initial minimum block size that remained unupdated in the
super_block structure.
Since nilfs2 mkfs tool does not accept block sizes larger than the system
page size, this has been overlooked. However, it is possible to create
this situation by intentionally modifying the tool or by passing a
filesystem image created on a system with a large page size to a system
with a smaller page size and mounting it.
Fix this issue by inserting the expected error handling for the call to
sb_set_blocksize().
Link: https://lkml.kernel.org/r/20231129141547.4726-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/nilfs2/the_nilfs.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/nilfs2/the_nilfs.c~nilfs2-fix-missing-error-check-for-sb_set_blocksize-call
+++ a/fs/nilfs2/the_nilfs.c
@@ -716,7 +716,11 @@ int init_nilfs(struct the_nilfs *nilfs,
goto failed_sbh;
}
nilfs_release_super_block(nilfs);
- sb_set_blocksize(sb, blocksize);
+ if (!sb_set_blocksize(sb, blocksize)) {
+ nilfs_err(sb, "bad blocksize %d", blocksize);
+ err = -EINVAL;
+ goto out;
+ }
err = nilfs_load_super_block(nilfs, sb, blocksize, &sbp);
if (err)
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
nilfs2-fix-missing-error-check-for-sb_set_blocksize-call.patch
nilfs2-move-page-release-outside-of-nilfs_delete_entry-and-nilfs_set_link.patch
nilfs2-eliminate-staggered-calls-to-kunmap-in-nilfs_rename.patch
+Cc: Cong Wang <cong.wang(a)bytedance.com>
Hi all,
On Tue, Nov 28, 2023 at 09:52:46PM -0500, Sasha Levin wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> bpf: Fix dev's rx stats for bpf_redirect_peer traffic
>
> to the 6.6-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> bpf-fix-dev-s-rx-stats-for-bpf_redirect_peer-traffic.patch
> and it can be found in the queue-6.6 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
Seems like only patch 1, 2 and 5 in this [1] series are selected? We
also need patch 4, upstream commit 6f2684bf2b44 ("veth: Use tstats
per-CPU traffic counters"). Otherwise the fix won't work, and the code
will be wrong [2] .
We should've included a "Depends on patch..." note for stable in the
commit message.
Thanks,
Peilin Ye
[1] https://lore.kernel.org/all/170050562585.4532.1588179408610417971.git-patch…
[2] veth still uses @lstats, but patch 5 makes skb_do_redirect() update
it as @tstats.
I'm seeing this too, but on 6.6.3 (6.6.2 is fine).
Bisected it down to commit 2e8b4e0992e16 ("gcc-plugins: randstruct:
Only warn about true flexible arrays"). Reverting that commit on top
of v6.6.3 makes it go away.
I do wonder if content such as that (which *looks* like it's purely
preparing for future changes) is appropriate for the stable trees.
Cheers,
-- Dan
This is the start of the stable review cycle for the 4.14.331 release.
There are 53 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 27 Nov 2023 16:30:48 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.331-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.331-rc2
Eric Dumazet <edumazet(a)google.com>
net: sched: fix race condition in qdisc_graft()
Dongli Zhang <dongli.zhang(a)oracle.com>
scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: correct return value of ext4_convert_meta_bg
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: correct offset of gdb backup in non meta_bg group to update_backups
Max Kellermann <max.kellermann(a)ionos.com>
ext4: apply umask if ACL support is disabled
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: fix the check to handle session buffer requirement
Sean Young <sean(a)mess.org>
media: sharp: fix sharp encoding
Heiner Kallweit <hkallweit1(a)gmail.com>
i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
Alexander Sverdlin <alexander.sverdlin(a)siemens.com>
net: dsa: lan9303: consequently nested-lock physical MDIO
Takashi Iwai <tiwai(a)suse.de>
ALSA: info: Fix potential deadlock at disconnection
Helge Deller <deller(a)gmx.de>
parisc/pgtable: Do not drop upper 5 address bits of physical address
Helge Deller <deller(a)gmx.de>
parisc: Prevent booting 64-bit kernels on PA1.x machines
Sanjuán García, Jorge <Jorge.SanjuanGarcia(a)duagon.com>
mcb: fix error handling for different scenarios when parsing
Zhihao Cheng <chengzhihao1(a)huawei.com>
jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
Herve Codina <herve.codina(a)bootlin.com>
genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
Rong Chen <rong.chen(a)amlogic.com>
mmc: meson-gx: Remove setting of CMD_CFG_ERROR
Brian Geffon <bgeffon(a)google.com>
PM: hibernate: Clean up sync_read handling in snapshot_write_next()
Brian Geffon <bgeffon(a)google.com>
PM: hibernate: Use __get_safe_page() rather than touching the list
Dan Carpenter <dan.carpenter(a)linaro.org>
mmc: vub300: fix an error code
Lukas Wunner <lukas(a)wunner.de>
PCI/sysfs: Protect driver's D3cold preference from user space
David Woodhouse <dwmw(a)amazon.co.uk>
hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
Paul Moore <paul(a)paul-moore.com>
audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
Paul Moore <paul(a)paul-moore.com>
audit: don't take task_lock() in audit_exe_compare() code path
Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com>
KVM: x86: Ignore MSR_AMD64_TW_CFG access
Kees Cook <keescook(a)chromium.org>
randstruct: Fix gcc-plugin performance mode to stay in group
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: add checks to perform sanity on queue pointers
Dan Carpenter <dan.carpenter(a)linaro.org>
pwm: Fix double shift bug
Bob Peterson <rpeterso(a)redhat.com>
gfs2: ignore negated quota changes
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: avoid integer overflow
Rajeshwar R Shinde <coolrrsh(a)gmail.com>
media: gspca: cpia1: shift-out-of-bounds in set_flicker
Axel Lin <axel.lin(a)ingics.com>
i2c: sun6i-p2wi: Prevent potential division by zero
Yi Yang <yiyang13(a)huawei.com>
tty: vcc: Add check for kstrdup() in vcc_probe()
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
atm: iphase: Do PCI error checks on own line
Cezary Rojewski <cezary.rojewski(a)intel.com>
ALSA: hda: Fix possible null-ptr-deref when assigning a stream
Manas Ghandat <ghandatmanas(a)gmail.com>
jfs: fix array-index-out-of-bounds in diAlloc
Manas Ghandat <ghandatmanas(a)gmail.com>
jfs: fix array-index-out-of-bounds in dbFindLeaf
Juntong Deng <juntong.deng(a)outlook.com>
fs/jfs: Add validity check for db_maxag and db_agpref
Juntong Deng <juntong.deng(a)outlook.com>
fs/jfs: Add check for negative db_l2nbperpage
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
RDMA/hfi1: Use FIELD_GET() to extract Link Width
Lu Jialin <lujialin4(a)huawei.com>
crypto: pcrypt - Fix hungtask for PADATA_RESET
zhujun2 <zhujun2(a)cmss.chinamobile.com>
selftests/efivarfs: create-read: fix a resource leak
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
Eric Dumazet <edumazet(a)google.com>
net: annotate data-races around sk->sk_dst_pending_confirm
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: ath10k: fix clang-specific fortify warning
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: ath9k: fix clang-specific fortify warnings
Ping-Ke Shih <pkshih(a)realtek.com>
wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
Mike Rapoport (IBM) <rppt(a)kernel.org>
x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
Ronald Wahl <ronald.wahl(a)raritan.com>
clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
Jacky Bai <ping.bai(a)nxp.com>
clocksource/drivers/timer-imx-gpt: Fix potential memory leak
John Stultz <jstultz(a)google.com>
locking/ww_mutex/test: Fix potential workqueue corruption
-------------
Diffstat:
Makefile | 4 ++--
arch/parisc/kernel/entry.S | 7 +++---
arch/parisc/kernel/head.S | 5 ++---
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/include/asm/numa.h | 7 ------
arch/x86/kvm/x86.c | 2 ++
arch/x86/mm/numa.c | 7 ------
crypto/pcrypt.c | 4 ++++
drivers/atm/iphase.c | 20 +++++++++--------
drivers/clocksource/tcb_clksrc.c | 1 +
drivers/clocksource/timer-imx-gpt.c | 18 +++++++++++-----
drivers/gpu/drm/amd/include/pptable.h | 4 ++--
drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 16 +++++++-------
drivers/i2c/busses/i2c-i801.c | 19 ++++++++--------
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
drivers/infiniband/hw/hfi1/pcie.c | 9 ++------
drivers/mcb/mcb-core.c | 1 +
drivers/mcb/mcb-parse.c | 2 +-
drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +-
drivers/media/platform/qcom/venus/hfi_venus.c | 10 +++++++++
drivers/media/platform/vivid/vivid-rds-gen.c | 2 +-
drivers/media/rc/ir-sharp-decoder.c | 8 ++++---
drivers/media/usb/gspca/cpia1.c | 3 +++
drivers/mmc/host/meson-gx-mmc.c | 1 -
drivers/mmc/host/vub300.c | 1 +
drivers/net/dsa/lan9303_mdio.c | 4 ++--
drivers/net/wireless/ath/ath10k/debug.c | 2 +-
drivers/net/wireless/ath/ath9k/debug.c | 2 +-
drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
drivers/pci/pci-acpi.c | 2 +-
drivers/pci/pci-sysfs.c | 5 +----
drivers/scsi/libfc/fc_lport.c | 6 ++++++
drivers/scsi/virtio_scsi.c | 1 +
drivers/tty/hvc/hvc_xen.c | 5 +++--
drivers/tty/vcc.c | 16 +++++++++++---
fs/ext4/acl.h | 5 +++++
fs/ext4/resize.c | 19 ++++++----------
fs/gfs2/quota.c | 11 ++++++++++
fs/jbd2/recovery.c | 8 +++++++
fs/jfs/jfs_dmap.c | 23 +++++++++++++++-----
fs/jfs/jfs_imap.c | 5 ++++-
include/linux/pwm.h | 4 ++--
include/net/sock.h | 6 +++---
kernel/audit_watch.c | 9 +++++++-
kernel/irq/generic-chip.c | 25 ++++++++++++++++------
kernel/locking/test-ww_mutex.c | 20 ++++++++++-------
kernel/padata.c | 2 +-
kernel/power/snapshot.c | 16 ++++++--------
net/core/sock.c | 2 +-
net/ipv4/tcp_output.c | 2 +-
net/mac80211/cfg.c | 4 ++++
net/sched/sch_api.c | 5 +++--
scripts/gcc-plugins/randomize_layout_plugin.c | 11 +++++++---
sound/core/info.c | 21 +++++++++++-------
sound/hda/hdac_stream.c | 6 ++++--
tools/testing/selftests/efivarfs/create-read.c | 2 ++
56 files changed, 259 insertions(+), 151 deletions(-)
We found an issue under Android OTA scenario that many BIOs have to do
FEC where the data under dm-verity is 100% complete and no corruption.
Android OTA has many dm-block layers, from upper to lower:
dm-verity
dm-snapshot
dm-origin & dm-cow
dm-linear
ufs
Dm tables have to change 2 times during Android OTA merging process.
When doing table change, the dm-snapshot will be suspended for a while.
During this interval, we found there are many readahead IOs are
submitted to dm_verity from filesystem. Then the kverity works are busy
doing FEC process which cost too much time to finish dm-verity IO. And
cause system stuck.
We add some debug log and find that each readahead IO need around 10s to
finish when this situation occurred. Because here has a IO
amplification:
dm-snapshot suspend
erofs_readahead // 300+ io is submitted
dm_submit_bio (dm_verity)
dm_submit_bio (dm_snapshot)
bio return EIO
bio got nothing, it's empty
verity_end_io
verity_verify_io
forloop range(0, io->n_blocks) // each io->nblocks ~= 20
verity_fec_decode
fec_decode_rsb
fec_read_bufs
forloop range(0, v->fec->rsn) // v->fec->rsn = 253
new_read
submit_bio (dm_snapshot)
end loop
end loop
dm-snapshot resume
Readahead BIO got nothing during dm-snapshot suspended. So all of them
will do FEC.
Each readahead BIO need to do io->n_blocks ~= 20 times verify.
Each block need to do fec, and every block need to do v->fec->rsn = 253
times read.
So during the suspend interval(~200ms), 300 readahead BIO make
300*20*253 IOs on dm-snapshot.
As readahead IO is not required by user space, and to fix this issue,
I think it would be better to pass it to upper layer to handle it.
Cc: stable(a)vger.kernel.org
Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
Signed-off-by: Wu Bo <bo.wu(a)vivo.com>
---
drivers/md/dm-verity-target.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index beec14b6b044..14e58ae70521 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -667,7 +667,9 @@ static void verity_end_io(struct bio *bio)
struct dm_verity_io *io = bio->bi_private;
if (bio->bi_status &&
- (!verity_fec_is_enabled(io->v) || verity_is_system_shutting_down())) {
+ (!verity_fec_is_enabled(io->v) ||
+ verity_is_system_shutting_down() ||
+ (bio->bi_opf & REQ_RAHEAD))) {
verity_finish_io(io, bio->bi_status);
return;
}
--
2.25.1
When FIFO reach near full state, device will issue pause frame.
If pause slot is enabled(set to 1), in this time, device will issue
pause frame once. But if pause slot is disabled(set to 0), device
will keep sending pause frames until FIFO reach near empty state.
When pause slot is disabled, if there is no one to handle receive
packets (ex. unexpected shutdown), device FIFO will reach near full
state and keep sending pause frames. That will impact entire local
area network.
In this patch default enable pause slot to prevent this kind of
situation.
Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125")
Cc: stable(a)vger.kernel.org
Signed-off-by: ChunHao Lin <hau(a)realtek.com>
---
drivers/net/ethernet/realtek/r8169_main.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 295366a85c63..473b3245754f 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -196,6 +196,7 @@ enum rtl_registers {
/* No threshold before first PCI xfer */
#define RX_FIFO_THRESH (7 << RXCFG_FIFO_SHIFT)
#define RX_EARLY_OFF (1 << 11)
+#define RX_PAUSE_SLOT_ON (1 << 11)
#define RXCFG_DMA_SHIFT 8
/* Unlimited maximum PCI burst. */
#define RX_DMA_BURST (7 << RXCFG_DMA_SHIFT)
@@ -2305,9 +2306,13 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_53:
RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
break;
- case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_63:
+ case RTL_GIGA_MAC_VER_61:
RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
break;
+ case RTL_GIGA_MAC_VER_63:
+ RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
+ RX_PAUSE_SLOT_ON);
+ break;
default:
RTL_W32(tp, RxConfig, RX128_INT_EN | RX_DMA_BURST);
break;
--
2.39.2
Invoke drm_plane_helper_funcs.end_fb_access before
drm_atomic_helper_commit_hw_done(). The latter function hands over
ownership of the plane state to the following commit, which might
free it. Releasing resources in end_fb_access then operates on undefined
state. This bug has been observed with non-blocking commits when they
are being queued up quickly.
Here is an example stack trace from the bug report. The plane state has
been free'd already, so the pages for drm_gem_fb_vunmap() are gone.
Unable to handle kernel paging request at virtual address 0000000100000049
[...]
drm_gem_fb_vunmap+0x18/0x74
drm_gem_end_shadow_fb_access+0x1c/0x2c
drm_atomic_helper_cleanup_planes+0x58/0xd8
drm_atomic_helper_commit_tail+0x90/0xa0
commit_tail+0x15c/0x188
commit_work+0x14/0x20
For aborted commits, it is still ok to run end_fb_access as part of the
plane's cleanup. Add a test to drm_atomic_helper_cleanup_planes().
v2:
* fix test in drm_atomic_helper_cleanup_planes()
Reported-by: Alyssa Ross <hi(a)alyssa.is>
Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/
Suggested-by: Daniel Vetter <daniel(a)ffwll.ch>
Fixes: 94d879eaf7fb ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers")
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: <stable(a)vger.kernel.org> # v6.2+
---
drivers/gpu/drm/drm_atomic_helper.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index c3f677130def0..bedb42ddd1341 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -2784,6 +2784,17 @@ void drm_atomic_helper_commit_planes(struct drm_device *dev,
funcs->atomic_flush(crtc, old_state);
}
+
+ /*
+ * Signal end of framebuffer access here before hw_done. After hw_done,
+ * a later commit might have already released the plane state.
+ */
+ for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->end_fb_access)
+ funcs->end_fb_access(plane, new_plane_state);
+ }
}
EXPORT_SYMBOL(drm_atomic_helper_commit_planes);
@@ -2924,6 +2935,12 @@ void drm_atomic_helper_cleanup_planes(struct drm_device *dev,
for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+ /*
+ * Only clean up here if we're aborting the commit.
+ */
+ if (old_plane_state == plane->state)
+ continue;
+
if (funcs->end_fb_access)
funcs->end_fb_access(plane, new_plane_state);
}
--
2.43.0
From: Francesco Dolcini <francesco.dolcini(a)toradex.com>
Serdev recv_buf() callback is supposed to return the amount of bytes
consumed, therefore an int in between 0 and count.
Do not return negative number in case of issue, when
ssam_controller_receive_buf() returns ESHUTDOWN just returns 0, e.g. no
bytes consumed, this keep the exact same behavior as it was before.
This fixes a potential WARN in serdev-ttyport.c:ttyport_receive_buf().
Cc: <stable(a)vger.kernel.org>
Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem")
Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com>
---
drivers/platform/surface/aggregator/core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/surface/aggregator/core.c b/drivers/platform/surface/aggregator/core.c
index 1a6373dea109..6152be38398c 100644
--- a/drivers/platform/surface/aggregator/core.c
+++ b/drivers/platform/surface/aggregator/core.c
@@ -231,9 +231,12 @@ static int ssam_receive_buf(struct serdev_device *dev, const unsigned char *buf,
size_t n)
{
struct ssam_controller *ctrl;
+ int ret;
ctrl = serdev_device_get_drvdata(dev);
- return ssam_controller_receive_buf(ctrl, buf, n);
+ ret = ssam_controller_receive_buf(ctrl, buf, n);
+
+ return ret < 0 ? 0 : ret;
}
static void ssam_write_wakeup(struct serdev_device *dev)
--
2.25.1
Hi,
On Sun, Nov 19, 2023 at 06:14:50AM -0700, Jens Axboe wrote:
> On 11/18/23 4:45 PM, Timothy Pearson wrote:
> > During floating point and vector save to thread data fr0/vs0 are clobbered
> > by the FPSCR/VSCR store routine. This leads to userspace register corruption
> > and application data corruption / crash under the following rare condition:
> >
> > * A userspace thread is executing with VSX/FP mode enabled
> > * The userspace thread is making active use of fr0 and/or vs0
> > * An IPI is taken in kernel mode, forcing the userspace thread to reschedule
> > * The userspace thread is interrupted by the IPI before accessing data it
> > previously stored in fr0/vs0
> > * The thread being switched in by the IPI has a pending signal
> >
> > If these exact criteria are met, then the following sequence happens:
> >
> > * The existing thread FP storage is still valid before the IPI, due to a
> > prior call to save_fpu() or store_fp_state(). Note that the current
> > fr0/vs0 registers have been clobbered, so the FP/VSX state in registers
> > is now invalid pending a call to restore_fp()/restore_altivec().
> > * IPI -- FP/VSX register state remains invalid
> > * interrupt_exit_user_prepare_main() calls do_notify_resume(),
> > due to the pending signal
> > * do_notify_resume() eventually calls save_fpu() via giveup_fpu(), which
> > merrily reads and saves the invalid FP/VSX state to thread local storage.
> > * interrupt_exit_user_prepare_main() calls restore_math(), writing the invalid
> > FP/VSX state back to registers.
> > * Execution is released to userspace, and the application crashes or corrupts
> > data.
>
> What an epic bug hunt! Hats off to you for seeing it through and getting
> to the bottom of it. Particularly difficult as the commit that made it
> easier to trigger was in no way related to where the actual bug was.
>
> I ran this on the vm I have access to, and it survived 2x500 iterations.
> Happy to call that good:
>
> Tested-by: Jens Axboe <axboe(a)kernel.dk>
Thanks to all involved!
Is this going to land soon in mainline so it can be picked as well for
the affected stable trees?
Regards,
Salvatore
This commit has no upstream equivalent.
After commit 012dba0ab814 ("PCI: keystone: Don't discard .probe()
callback") in 5.4, there are two modpost warnings when building with
clang:
WARNING: modpost: vmlinux.o(.text+0x5aa6dc): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_port()
The function ks_pcie_probe() references
the function __init ks_pcie_add_pcie_port().
This is often because ks_pcie_probe lacks a __init
annotation or the annotation of ks_pcie_add_pcie_port is wrong.
WARNING: modpost: vmlinux.o(.text+0x5aa6f4): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_ep()
The function ks_pcie_probe() references
the function __init ks_pcie_add_pcie_ep().
This is often because ks_pcie_probe lacks a __init
annotation or the annotation of ks_pcie_add_pcie_ep is wrong.
ks_pcie_add_pcie_ep() was removed in upstream commit a0fd361db8e5 ("PCI:
dwc: Move "dbi", "dbi2", and "addr_space" resource setup into common
code") and ks_pcie_add_pcie_port() was removed in upstream
commit 60f5b73fa0f2 ("PCI: dwc: Remove unnecessary wrappers around
dw_pcie_host_init()"), both of which happened before upstream
commit 7994db905c0f ("PCI: keystone: Don't discard .probe() callback").
As neither of these removal changes are really suitable for stable, just
remove __init from these functions in stable, as it is no longer a
correct annotation after dropping __init from ks_pcie_probe().
Fixes: 012dba0ab814 ("PCI: keystone: Don't discard .probe() callback")
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Signed-off-by: Nathan Chancellor <nathan(a)kernel.org>
---
This is not an issue in mainline but I still cc'd the author and
committer of 7994db905c0f in case they would like to check my analysis.
---
drivers/pci/controller/dwc/pci-keystone.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index ddbb2b3db74a..920444b1cfc7 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -861,8 +861,8 @@ static irqreturn_t ks_pcie_err_irq_handler(int irq, void *priv)
return ks_pcie_handle_error_irq(ks_pcie);
}
-static int __init ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
- struct platform_device *pdev)
+static int ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
+ struct platform_device *pdev)
{
struct dw_pcie *pci = ks_pcie->pci;
struct pcie_port *pp = &pci->pp;
@@ -992,8 +992,8 @@ static const struct dw_pcie_ep_ops ks_pcie_am654_ep_ops = {
.get_features = &ks_pcie_am654_get_features,
};
-static int __init ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
- struct platform_device *pdev)
+static int ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
+ struct platform_device *pdev)
{
int ret;
struct dw_pcie_ep *ep;
---
base-commit: 8e221b47173d59e1b2877f6d8dc91e8be2031746
change-id: 20231128-5-4-fix-pci-keystone-modpost-warning-2a8a9c3fa1ca
Best regards,
--
Nathan Chancellor <nathan(a)kernel.org>
From: Claire Lin <claire.lin(a)broadcom.com>
commit 7f852cc1579297fd763789f8cd370639d0c654b6 upstream.
In brcmstb_nand_verify_erased_page(), the ECC chunk pointer calculation
while correcting erased page bitflips is wrong, fix it.
Fixes: 02b88eea9f9c ("mtd: brcmnand: Add check for erased page bitflips")
Signed-off-by: Claire Lin <claire.lin(a)broadcom.com>
Reviewed-by: Ray Jui <ray.jui(a)broadcom.com>
Signed-off-by: Kamal Dasu <kdasu.kdev(a)gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
Signed-off-by: Yuta Hayama <hayama(a)lineo.co.jp>
---
After applying e44b9a9c1357 ("mtd: nand: brcmnand: Zero bitflip is not an
error"), the return value 0 of brcmstb_nand_verify_erased_page() is
*correctly* interpreted as "no bit flips, no errors". However, that
function still has the issue that it may incorrectly return 0 for a page
that contains bitflips. Without this patch, the data buffer of the erased
page could be passed to a upper layer (e.g. UBIFS) without bitflips being
detected and corrected.
In active stable, 4.14.y and 4.19.y seem to have a same issue.
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index 0e14892ff926..dc7650ae0464 100644
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -1753,6 +1753,7 @@ static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
int bitflips = 0;
int page = addr >> chip->page_shift;
int ret;
+ void *ecc_chunk;
if (!buf) {
buf = chip->data_buf;
@@ -1768,7 +1769,9 @@ static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
return ret;
for (i = 0; i < chip->ecc.steps; i++, oob += sas) {
- ret = nand_check_erased_ecc_chunk(buf, chip->ecc.size,
+ ecc_chunk = buf + chip->ecc.size * i;
+ ret = nand_check_erased_ecc_chunk(ecc_chunk,
+ chip->ecc.size,
oob, sas, NULL, 0,
chip->ecc.strength);
if (ret < 0)
--
2.25.1
The patch titled
Subject: drivers/base/cpu: crash data showing should depends on KEXEC_CORE
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
drivers-base-cpu-crash-data-showing-should-depends-on-kexec_core.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Baoquan He <bhe(a)redhat.com>
Subject: drivers/base/cpu: crash data showing should depends on KEXEC_CORE
Date: Tue, 28 Nov 2023 13:52:48 +0800
After commit 88a6f8994421 ("crash: memory and CPU hotplug sysfs
attributes"), on x86_64, if only below kernel configs related to kdump are
set, compiling error are triggered.
----
CONFIG_CRASH_CORE=y
CONFIG_KEXEC_CORE=y
CONFIG_CRASH_DUMP=y
CONFIG_CRASH_HOTPLUG=y
------
------------------------------------------------------
drivers/base/cpu.c: In function `crash_hotplug_show':
drivers/base/cpu.c:309:40: error: implicit declaration of function `crash_hotplug_cpu_support'; did you mean `crash_hotplug_show'? [-Werror=implicit-function-declaration]
309 | return sysfs_emit(buf, "%d\n", crash_hotplug_cpu_support());
| ^~~~~~~~~~~~~~~~~~~~~~~~~
| crash_hotplug_show
cc1: some warnings being treated as errors
------------------------------------------------------
CONFIG_KEXEC is used to enable kexec_load interface, the
crash_notes/crash_notes_size/crash_hotplug showing depends on
CONFIG_KEXEC is incorrect. It should depend on KEXEC_CORE instead.
Fix it now.
Link: https://lkml.kernel.org/r/20231128055248.659808-1-bhe@redhat.com
Fixes: commit 88a6f8994421 ("crash: memory and CPU hotplug sysfs attributes")
Signed-off-by: Baoquan He <bhe(a)redhat.com>
Tested-by: Ignat Korchagin <ignat(a)cloudflare.com> [compile-time only]
Tested-by: Alexander Gordeev <agordeev(a)linux.ibm.com>
Reviewed-by: Eric DeVolder <eric_devolder(a)yahoo.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
drivers/base/cpu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/base/cpu.c~drivers-base-cpu-crash-data-showing-should-depends-on-kexec_core
+++ a/drivers/base/cpu.c
@@ -144,7 +144,7 @@ static DEVICE_ATTR(release, S_IWUSR, NUL
#endif /* CONFIG_ARCH_CPU_PROBE_RELEASE */
#endif /* CONFIG_HOTPLUG_CPU */
-#ifdef CONFIG_KEXEC
+#ifdef CONFIG_KEXEC_CORE
#include <linux/kexec.h>
static ssize_t crash_notes_show(struct device *dev,
@@ -189,14 +189,14 @@ static const struct attribute_group cras
#endif
static const struct attribute_group *common_cpu_attr_groups[] = {
-#ifdef CONFIG_KEXEC
+#ifdef CONFIG_KEXEC_CORE
&crash_note_cpu_attr_group,
#endif
NULL
};
static const struct attribute_group *hotplugable_cpu_attr_groups[] = {
-#ifdef CONFIG_KEXEC
+#ifdef CONFIG_KEXEC_CORE
&crash_note_cpu_attr_group,
#endif
NULL
_
Patches currently in -mm which might be from bhe(a)redhat.com are
drivers-base-cpu-crash-data-showing-should-depends-on-kexec_core.patch
resource-add-walk_system_ram_res_rev.patch
kexec_file-load-kernel-at-top-of-system-ram-if-required.patch
The KOBJ_CHANGE uevent is sent before gadget unbind is actually
executed, resulting in inaccurate uevent emitted at incorrect timing
(the uevent would have USB_UDC_DRIVER variable set while it would
soon be removed).
Move the KOBJ_CHANGE uevent to the end of the unbind function so that
uevent is sent only after the change has been made.
Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class")
Cc: stable(a)vger.kernel.org
Signed-off-by: Roy Luo <royluo(a)google.com>
---
Changes since v1: add Fixes tag
Changes since v2: add cc stable(a)vger.kernel.org
---
drivers/usb/gadget/udc/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index ded9531f141b..d59f94464b87 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1646,8 +1646,6 @@ static void gadget_unbind_driver(struct device *dev)
dev_dbg(&udc->dev, "unbinding gadget driver [%s]\n", driver->function);
- kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
-
udc->allow_connect = false;
cancel_work_sync(&udc->vbus_work);
mutex_lock(&udc->connect_lock);
@@ -1667,6 +1665,8 @@ static void gadget_unbind_driver(struct device *dev)
driver->is_bound = false;
udc->driver = NULL;
mutex_unlock(&udc_lock);
+
+ kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
}
/* ------------------------------------------------------------------------- */
base-commit: 9b6de136b5f0158c60844f85286a593cb70fb364
--
2.43.0.rc1.413.gea7ed67945-goog
Backport of upstream fixes to NFSD's duplicate reply cache. These
have been hand-applied and tested with the same reproducer as was
used to create the upstream fixes.
---
Chuck Lever (2):
NFSD: Fix "start of NFS reply" pointer passed to nfsd_cache_update()
NFSD: Fix checksum mismatches in the duplicate reply cache
fs/nfsd/cache.h | 3 ++-
fs/nfsd/nfscache.c | 65 +++++++++++++++++++++++++++++++---------------
fs/nfsd/nfssvc.c | 15 +++++++++--
3 files changed, 59 insertions(+), 24 deletions(-)
--
Chuck Lever
From: Oliver Neukum <oneukum(a)suse.com>
[ Upstream commit ccab434e674ca95d483788b1895a70c21b7f016a ]
If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.
The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.
The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
Signed-off-by: Oliver Neukum <oneukum(a)suse.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/usb/aqc111.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index 68912e266826b..892d58b38cf5b 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c
@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
u16 pkt_count = 0;
u64 desc_hdr = 0;
u16 vlan_tag = 0;
- u32 skb_len = 0;
+ u32 skb_len;
if (!skb)
goto err;
- if (skb->len == 0)
+ skb_len = skb->len;
+ if (skb_len < sizeof(desc_hdr))
goto err;
- skb_len = skb->len;
/* RX Descriptor Header */
- skb_trim(skb, skb->len - sizeof(desc_hdr));
+ skb_trim(skb, skb_len - sizeof(desc_hdr));
desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
/* Check these packets */
--
2.42.0
From: Oliver Neukum <oneukum(a)suse.com>
[ Upstream commit ccab434e674ca95d483788b1895a70c21b7f016a ]
If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.
The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.
The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
Signed-off-by: Oliver Neukum <oneukum(a)suse.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/usb/aqc111.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index c9c4095181744..4ea02116be182 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c
@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
u16 pkt_count = 0;
u64 desc_hdr = 0;
u16 vlan_tag = 0;
- u32 skb_len = 0;
+ u32 skb_len;
if (!skb)
goto err;
- if (skb->len == 0)
+ skb_len = skb->len;
+ if (skb_len < sizeof(desc_hdr))
goto err;
- skb_len = skb->len;
/* RX Descriptor Header */
- skb_trim(skb, skb->len - sizeof(desc_hdr));
+ skb_trim(skb, skb_len - sizeof(desc_hdr));
desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
/* Check these packets */
--
2.42.0
From: Oliver Neukum <oneukum(a)suse.com>
[ Upstream commit ccab434e674ca95d483788b1895a70c21b7f016a ]
If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.
The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.
The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.
Signed-off-by: Oliver Neukum <oneukum(a)suse.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/usb/aqc111.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index e8d49886d6953..bc5e3f45c499e 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c
@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
u16 pkt_count = 0;
u64 desc_hdr = 0;
u16 vlan_tag = 0;
- u32 skb_len = 0;
+ u32 skb_len;
if (!skb)
goto err;
- if (skb->len == 0)
+ skb_len = skb->len;
+ if (skb_len < sizeof(desc_hdr))
goto err;
- skb_len = skb->len;
/* RX Descriptor Header */
- skb_trim(skb, skb->len - sizeof(desc_hdr));
+ skb_trim(skb, skb_len - sizeof(desc_hdr));
desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
/* Check these packets */
--
2.42.0
From: Saurabh Sengar <ssengar(a)linux.microsoft.com>
[ Upstream commit 7e8037b099c0bbe8f2109dc452dbcab8d400fc53 ]
A Gen2 VM doesn't support legacy PCI/PCIe, so both raw_pci_ops and
raw_pci_ext_ops are NULL, and pci_subsys_init() -> pcibios_init()
doesn't call pcibios_resource_survey() -> e820__reserve_resources_late();
as a result, any emulated persistent memory of E820_TYPE_PRAM (12) via
the kernel parameter memmap=nn[KMG]!ss is not added into iomem_resource
and hence can't be detected by register_e820_pmem().
Fix this by directly calling e820__reserve_resources_late() in
hv_pci_init(), which is called from arch_initcall(pci_arch_init).
It's ok to move a Gen2 VM's e820__reserve_resources_late() from
subsys_initcall(pci_subsys_init) to arch_initcall(pci_arch_init) because
the code in-between doesn't depend on the E820 resources.
e820__reserve_resources_late() depends on e820__reserve_resources(),
which has been called earlier from setup_arch().
For a Gen-2 VM, the new hv_pci_init() also adds any memory of
E820_TYPE_PMEM (7) into iomem_resource, and acpi_nfit_register_region() ->
acpi_nfit_insert_resource() -> region_intersects() returns
REGION_INTERSECTS, so the memory of E820_TYPE_PMEM won't get added twice.
Changed the local variable "int gen2vm" to "bool gen2vm".
Signed-off-by: Saurabh Sengar <ssengar(a)linux.microsoft.com>
Signed-off-by: Dexuan Cui <decui(a)microsoft.com>
Signed-off-by: Wei Liu <wei.liu(a)kernel.org>
Message-ID: <1699691867-9827-1-git-send-email-ssengar(a)linux.microsoft.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/x86/hyperv/hv_init.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 189ae92de4d06..c18e5c764643b 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -13,6 +13,7 @@
#include <linux/io.h>
#include <asm/apic.h>
#include <asm/desc.h>
+#include <asm/e820/api.h>
#include <asm/sev.h>
#include <asm/ibt.h>
#include <asm/hypervisor.h>
@@ -267,15 +268,31 @@ static int hv_cpu_die(unsigned int cpu)
static int __init hv_pci_init(void)
{
- int gen2vm = efi_enabled(EFI_BOOT);
+ bool gen2vm = efi_enabled(EFI_BOOT);
/*
- * For Generation-2 VM, we exit from pci_arch_init() by returning 0.
- * The purpose is to suppress the harmless warning:
+ * A Generation-2 VM doesn't support legacy PCI/PCIe, so both
+ * raw_pci_ops and raw_pci_ext_ops are NULL, and pci_subsys_init() ->
+ * pcibios_init() doesn't call pcibios_resource_survey() ->
+ * e820__reserve_resources_late(); as a result, any emulated persistent
+ * memory of E820_TYPE_PRAM (12) via the kernel parameter
+ * memmap=nn[KMG]!ss is not added into iomem_resource and hence can't be
+ * detected by register_e820_pmem(). Fix this by directly calling
+ * e820__reserve_resources_late() here: e820__reserve_resources_late()
+ * depends on e820__reserve_resources(), which has been called earlier
+ * from setup_arch(). Note: e820__reserve_resources_late() also adds
+ * any memory of E820_TYPE_PMEM (7) into iomem_resource, and
+ * acpi_nfit_register_region() -> acpi_nfit_insert_resource() ->
+ * region_intersects() returns REGION_INTERSECTS, so the memory of
+ * E820_TYPE_PMEM won't get added twice.
+ *
+ * We return 0 here so that pci_arch_init() won't print the warning:
* "PCI: Fatal: No config space access function found"
*/
- if (gen2vm)
+ if (gen2vm) {
+ e820__reserve_resources_late();
return 0;
+ }
/* For Generation-1 VM, we'll proceed in pci_arch_init(). */
return 1;
--
2.42.0
From: Saurabh Sengar <ssengar(a)linux.microsoft.com>
[ Upstream commit 7e8037b099c0bbe8f2109dc452dbcab8d400fc53 ]
A Gen2 VM doesn't support legacy PCI/PCIe, so both raw_pci_ops and
raw_pci_ext_ops are NULL, and pci_subsys_init() -> pcibios_init()
doesn't call pcibios_resource_survey() -> e820__reserve_resources_late();
as a result, any emulated persistent memory of E820_TYPE_PRAM (12) via
the kernel parameter memmap=nn[KMG]!ss is not added into iomem_resource
and hence can't be detected by register_e820_pmem().
Fix this by directly calling e820__reserve_resources_late() in
hv_pci_init(), which is called from arch_initcall(pci_arch_init).
It's ok to move a Gen2 VM's e820__reserve_resources_late() from
subsys_initcall(pci_subsys_init) to arch_initcall(pci_arch_init) because
the code in-between doesn't depend on the E820 resources.
e820__reserve_resources_late() depends on e820__reserve_resources(),
which has been called earlier from setup_arch().
For a Gen-2 VM, the new hv_pci_init() also adds any memory of
E820_TYPE_PMEM (7) into iomem_resource, and acpi_nfit_register_region() ->
acpi_nfit_insert_resource() -> region_intersects() returns
REGION_INTERSECTS, so the memory of E820_TYPE_PMEM won't get added twice.
Changed the local variable "int gen2vm" to "bool gen2vm".
Signed-off-by: Saurabh Sengar <ssengar(a)linux.microsoft.com>
Signed-off-by: Dexuan Cui <decui(a)microsoft.com>
Signed-off-by: Wei Liu <wei.liu(a)kernel.org>
Message-ID: <1699691867-9827-1-git-send-email-ssengar(a)linux.microsoft.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/x86/hyperv/hv_init.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 21556ad87f4ba..8f3a4d16bb791 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -15,6 +15,7 @@
#include <linux/io.h>
#include <asm/apic.h>
#include <asm/desc.h>
+#include <asm/e820/api.h>
#include <asm/sev.h>
#include <asm/ibt.h>
#include <asm/hypervisor.h>
@@ -286,15 +287,31 @@ static int hv_cpu_die(unsigned int cpu)
static int __init hv_pci_init(void)
{
- int gen2vm = efi_enabled(EFI_BOOT);
+ bool gen2vm = efi_enabled(EFI_BOOT);
/*
- * For Generation-2 VM, we exit from pci_arch_init() by returning 0.
- * The purpose is to suppress the harmless warning:
+ * A Generation-2 VM doesn't support legacy PCI/PCIe, so both
+ * raw_pci_ops and raw_pci_ext_ops are NULL, and pci_subsys_init() ->
+ * pcibios_init() doesn't call pcibios_resource_survey() ->
+ * e820__reserve_resources_late(); as a result, any emulated persistent
+ * memory of E820_TYPE_PRAM (12) via the kernel parameter
+ * memmap=nn[KMG]!ss is not added into iomem_resource and hence can't be
+ * detected by register_e820_pmem(). Fix this by directly calling
+ * e820__reserve_resources_late() here: e820__reserve_resources_late()
+ * depends on e820__reserve_resources(), which has been called earlier
+ * from setup_arch(). Note: e820__reserve_resources_late() also adds
+ * any memory of E820_TYPE_PMEM (7) into iomem_resource, and
+ * acpi_nfit_register_region() -> acpi_nfit_insert_resource() ->
+ * region_intersects() returns REGION_INTERSECTS, so the memory of
+ * E820_TYPE_PMEM won't get added twice.
+ *
+ * We return 0 here so that pci_arch_init() won't print the warning:
* "PCI: Fatal: No config space access function found"
*/
- if (gen2vm)
+ if (gen2vm) {
+ e820__reserve_resources_late();
return 0;
+ }
/* For Generation-1 VM, we'll proceed in pci_arch_init(). */
return 1;
--
2.42.0
Hej,
usb hotplug doesn't work for me running stable kernel v6.5.12 on an AMD
based Thinkpad t495s. Bisect pointed to 7b8ae3c24ef ("xhci: Loosen RPM as
default policy to cover for AMD xHC 1.1") - which is 4baf1218150 upstream.
Reverting that from 6.5.12 fixes the issue for me.
Current upstream rc kernel contains this patch but doesn't show the issue.
Regards,
Sebastian
The Power values coming from the Energy Model are already in uW.
The PowerCap and DTPM framework operate on uW, thus all places should
just use the values from EM. Fix the code which left and still does
the unneeded conversion.
Fixes: ae6ccaa65038 (PM: EM: convert power field to micro-Watts precision and align drivers)
Cc: <stable(a)vger.kernel.org> # v5.19+
Signed-off-by: Lukasz Luba <lukasz.luba(a)arm.com>
---
Hi Daniel,
I have found an issue due to the uW in the EM. My apologies for that.
I have check those with the Rockpi dev board with your DTPM module there.
BTW, if you like to check the DTPM_devfreq there, you can apply that
patch. It should create EM for your GPU there and setup DTPM GPU:
https://lore.kernel.org/all/20231127081511.1911706-1-lukasz.luba@arm.com/
Regards,
Lukasz
drivers/powercap/dtpm_cpu.c | 6 +-----
drivers/powercap/dtpm_devfreq.c | 11 +++--------
2 files changed, 4 insertions(+), 13 deletions(-)
diff --git a/drivers/powercap/dtpm_cpu.c b/drivers/powercap/dtpm_cpu.c
index 2ff7717530bf..8a2f18fa3faf 100644
--- a/drivers/powercap/dtpm_cpu.c
+++ b/drivers/powercap/dtpm_cpu.c
@@ -24,7 +24,6 @@
#include <linux/of.h>
#include <linux/pm_qos.h>
#include <linux/slab.h>
-#include <linux/units.h>
struct dtpm_cpu {
struct dtpm dtpm;
@@ -104,8 +103,7 @@ static u64 get_pd_power_uw(struct dtpm *dtpm)
if (pd->table[i].frequency < freq)
continue;
- return scale_pd_power_uw(pd_mask, pd->table[i].power *
- MICROWATT_PER_MILLIWATT);
+ return scale_pd_power_uw(pd_mask, pd->table[i].power);
}
return 0;
@@ -122,11 +120,9 @@ static int update_pd_power_uw(struct dtpm *dtpm)
nr_cpus = cpumask_weight(&cpus);
dtpm->power_min = em->table[0].power;
- dtpm->power_min *= MICROWATT_PER_MILLIWATT;
dtpm->power_min *= nr_cpus;
dtpm->power_max = em->table[em->nr_perf_states - 1].power;
- dtpm->power_max *= MICROWATT_PER_MILLIWATT;
dtpm->power_max *= nr_cpus;
return 0;
diff --git a/drivers/powercap/dtpm_devfreq.c b/drivers/powercap/dtpm_devfreq.c
index 91276761a31d..612c3b59dd5b 100644
--- a/drivers/powercap/dtpm_devfreq.c
+++ b/drivers/powercap/dtpm_devfreq.c
@@ -39,10 +39,8 @@ static int update_pd_power_uw(struct dtpm *dtpm)
struct em_perf_domain *pd = em_pd_get(dev);
dtpm->power_min = pd->table[0].power;
- dtpm->power_min *= MICROWATT_PER_MILLIWATT;
dtpm->power_max = pd->table[pd->nr_perf_states - 1].power;
- dtpm->power_max *= MICROWATT_PER_MILLIWATT;
return 0;
}
@@ -54,13 +52,10 @@ static u64 set_pd_power_limit(struct dtpm *dtpm, u64 power_limit)
struct device *dev = devfreq->dev.parent;
struct em_perf_domain *pd = em_pd_get(dev);
unsigned long freq;
- u64 power;
int i;
for (i = 0; i < pd->nr_perf_states; i++) {
-
- power = pd->table[i].power * MICROWATT_PER_MILLIWATT;
- if (power > power_limit)
+ if (pd->table[i].power > power_limit)
break;
}
@@ -68,7 +63,7 @@ static u64 set_pd_power_limit(struct dtpm *dtpm, u64 power_limit)
dev_pm_qos_update_request(&dtpm_devfreq->qos_req, freq);
- power_limit = pd->table[i - 1].power * MICROWATT_PER_MILLIWATT;
+ power_limit = pd->table[i - 1].power;
return power_limit;
}
@@ -110,7 +105,7 @@ static u64 get_pd_power_uw(struct dtpm *dtpm)
if (pd->table[i].frequency < freq)
continue;
- power = pd->table[i].power * MICROWATT_PER_MILLIWATT;
+ power = pd->table[i].power;
power *= status.busy_time;
power >>= 10;
--
2.25.1
cpufreq_driver->fast_switch() callback expects a frequency as a return
value. amd_pstate_fast_switch() was returning the return value of
amd_pstate_update_freq(), which only indicates a success or failure.
Fix this by making amd_pstate_fast_switch() return the target_freq
when the call to amd_pstate_update_freq() is successful, and return
the current frequency from policy->cur when the call to
amd_pstate_update_freq() is unsuccessful.
Fixes: 4badf2eb1e98 ("cpufreq: amd-pstate: Add ->fast_switch() callback")
Acked-by: Huang Rui <ray.huang(a)amd.com>
Reviewed-by: Wyes Karny <wyes.karny(a)amd.com>
Reviewed-by: Perry Yuan <perry.yuan(a)amd.com>
Cc: stable(a)vger.kernel.org # v6.4+
Signed-off-by: Gautham R. Shenoy <gautham.shenoy(a)amd.com>
---
drivers/cpufreq/amd-pstate.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index 9a1e194d5cf8..300f81d36291 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -518,7 +518,9 @@ static int amd_pstate_target(struct cpufreq_policy *policy,
static unsigned int amd_pstate_fast_switch(struct cpufreq_policy *policy,
unsigned int target_freq)
{
- return amd_pstate_update_freq(policy, target_freq, true);
+ if (!amd_pstate_update_freq(policy, target_freq, true))
+ return target_freq;
+ return policy->cur;
}
static void amd_pstate_adjust_perf(unsigned int cpu,
--
2.25.1
Since commit 8e1f385104ac ("kill task_struct->thread_group") remove
the thread_group, we will encounter below issue.
(gdb) lx-ps
TASK PID COMM
0xffff800086503340 0 swapper/0
Python Exception <class 'gdb.error'>: There is no member named thread_group.
Error occurred in Python: There is no member named thread_group.
We use signal->thread_head to iterate all threads instead.
Fixes: 8e1f385104ac ("kill task_struct->thread_group")
Cc: stable(a)vger.kernel.org
Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
---
scripts/gdb/linux/tasks.py | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/scripts/gdb/linux/tasks.py b/scripts/gdb/linux/tasks.py
index 17ec19e9b5bf..7c32f4c8284b 100644
--- a/scripts/gdb/linux/tasks.py
+++ b/scripts/gdb/linux/tasks.py
@@ -13,7 +13,7 @@
import gdb
-from linux import utils
+from linux import utils, lists
task_type = utils.CachedType("struct task_struct")
@@ -25,13 +25,9 @@ def task_lists():
t = g = init_task
while True:
- while True:
- yield t
-
- t = utils.container_of(t['thread_group']['next'],
- task_ptr_type, "thread_group")
- if t == g:
- break
+ thread_head = t['signal']['thread_head']
+ for thread in lists.list_for_each_entry(thread_head, task_ptr_type, 'thread_node'):
+ yield thread
t = g = utils.container_of(g['tasks']['next'],
task_ptr_type, "tasks")
--
2.18.0
This is the start of the stable review cycle for the 5.4.262 release.
There are 152 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 28 Nov 2023 15:43:06 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.262-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.262-rc4
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 5.4)
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: disable toggling dormant table state more than once
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: fix table flag updates
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nftables: update table flags from the commit phase
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: double hook unregistration in netns path
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: unregister flowtable hooks on netns exit
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: fix memleak when more than 255 elements expired
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
Florian Westphal <fw(a)strlen.de>
netfilter: nf_tables: defer gc run if previous batch is still pending
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: use correct lock to protect gc_list
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: GC transaction race with abort path
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: GC transaction race with netns dismantle
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: remove busy mark and gc batch API
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: adapt set backend to use GC transaction API
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: GC transaction API to avoid race with control plane
Florian Westphal <fw(a)strlen.de>
netfilter: nf_tables: don't skip expired elements during walk
Florian Westphal <fw(a)strlen.de>
netfilter: nft_set_rbtree: fix overlap expiration walk
Florian Westphal <fw(a)strlen.de>
netfilter: nft_set_rbtree: fix null deref on element insertion
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: drop map element references from preparation phase
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nftables: rename set element data activation/deactivation functions
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: pass context to nft_set_destroy()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Have trace_event_file have ref counters
Christian König <christian.koenig(a)amd.com>
drm/amdgpu: fix error handling in amdgpu_bo_list_get()
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
Zhang Yi <yi.zhang(a)huawei.com>
ext4: correct the start block of counting reserved clusters
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: correct return value of ext4_convert_meta_bg
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: correct offset of gdb backup in non meta_bg group to update_backups
Max Kellermann <max.kellermann(a)ionos.com>
ext4: apply umask if ACL support is disabled
Heiner Kallweit <hkallweit1(a)gmail.com>
Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
Mahmoud Adam <mngyadam(a)amazon.com>
nfsd: fix file memleak on client_opens_release
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: add checks to handle capabilities from firmware
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: fix the check to handle session buffer requirement
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi_parser: Add check to keep the number of codecs within range
Sean Young <sean(a)mess.org>
media: sharp: fix sharp encoding
Sean Young <sean(a)mess.org>
media: lirc: drop trailing space from scancode transmit
Heiner Kallweit <hkallweit1(a)gmail.com>
i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
Alexander Sverdlin <alexander.sverdlin(a)siemens.com>
net: dsa: lan9303: consequently nested-lock physical MDIO
Johnathan Mantey <johnathanx.mantey(a)intel.com>
Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
Guan Wentao <guanwentao(a)uniontech.com>
Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
Masum Reza <masumrezarock100(a)gmail.com>
Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
Larry Finger <Larry.Finger(a)lwfinger.net>
bluetooth: Add device 13d3:3571 to device tables
Larry Finger <Larry.Finger(a)lwfinger.net>
bluetooth: Add device 0bda:887b to device tables
Artem Lukyanov <dukzcry(a)ya.ru>
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
Joseph Hwang <josephsih(a)chromium.org>
Bluetooth: btusb: add Realtek 8822CE to usb_device_id table
Alain Michaud <alainm(a)chromium.org>
Bluetooth: btusb: Add flag to define wideband speech capability
Pavel Krasavin <pkrasavin(a)imaqliq.com>
tty: serial: meson: fix hard LOCKUP on crtscts mode
Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com>
serial: meson: Use platform_get_irq() to get the interrupt
Neil Armstrong <narmstrong(a)baylibre.com>
tty: serial: meson: retrieve port FIFO size from DT
Colin Ian King <colin.king(a)canonical.com>
serial: meson: remove redundant initialization of variable id
Chandradeep Dey <codesigning(a)chandradeepdey.com>
ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
Takashi Iwai <tiwai(a)suse.de>
ALSA: info: Fix potential deadlock at disconnection
Helge Deller <deller(a)gmx.de>
parisc/pgtable: Do not drop upper 5 address bits of physical address
Helge Deller <deller(a)gmx.de>
parisc: Prevent booting 64-bit kernels on PA1.x machines
Joshua Yeong <joshua.yeong(a)starfivetech.com>
i3c: master: cdns: Fix reading status register
Zi Yan <ziy(a)nvidia.com>
mm/cma: use nth_page() in place of direct struct page manipulation
Alain Volmat <alain.volmat(a)foss.st.com>
dmaengine: stm32-mdma: correct desc prep when channel running
Sanjuán García, Jorge <Jorge.SanjuanGarcia(a)duagon.com>
mcb: fix error handling for different scenarios when parsing
Benjamin Bara <benjamin.bara(a)skidata.com>
i2c: core: Run atomic i2c xfer when !preemptible
Benjamin Bara <benjamin.bara(a)skidata.com>
kernel/reboot: emergency_restart: Set correct system_state
Eric Biggers <ebiggers(a)google.com>
quota: explicitly forbid quota files from being encrypted
Zhihao Cheng <chengzhihao1(a)huawei.com>
jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
Josef Bacik <josef(a)toxicpanda.com>
btrfs: don't arbitrarily slow down delalloc if we're committing
Brian Geffon <bgeffon(a)google.com>
PM: hibernate: Clean up sync_read handling in snapshot_write_next()
Brian Geffon <bgeffon(a)google.com>
PM: hibernate: Use __get_safe_page() rather than touching the list
Dan Carpenter <dan.carpenter(a)linaro.org>
mmc: vub300: fix an error code
Kathiravan Thirumoorthy <quic_kathirav(a)quicinc.com>
clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
Helge Deller <deller(a)gmx.de>
parisc/pdc: Add width field to struct pdc_model
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
PCI: keystone: Don't discard .probe() callback
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
PCI: keystone: Don't discard .remove() callback
Herve Codina <herve.codina(a)bootlin.com>
genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
Rong Chen <rong.chen(a)amlogic.com>
mmc: meson-gx: Remove setting of CMD_CFG_ERROR
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: resource: Do IRQ override on TongFang GMxXGxx
Lukas Wunner <lukas(a)wunner.de>
PCI/sysfs: Protect driver's D3cold preference from user space
David Woodhouse <dwmw(a)amazon.co.uk>
hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
Paul Moore <paul(a)paul-moore.com>
audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
Paul Moore <paul(a)paul-moore.com>
audit: don't take task_lock() in audit_exe_compare() code path
Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com>
KVM: x86: Ignore MSR_AMD64_TW_CFG access
Nicolas Saenz Julienne <nsaenz(a)amazon.com>
KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
Pu Wen <puwen(a)hygon.cn>
x86/cpu/hygon: Fix the CPU topology evaluation for real
Chandrakanth patil <chandrakanth.patil(a)broadcom.com>
scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
Shung-Hsi Yu <shung-hsi.yu(a)suse.com>
bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
Kees Cook <keescook(a)chromium.org>
randstruct: Fix gcc-plugin performance mode to stay in group
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: add checks to perform sanity on queue pointers
Anastasia Belova <abelova(a)astralinux.ru>
cifs: spnego: add ';' in HOST_KEY_LEN
Zhang Rui <rui.zhang(a)intel.com>
tools/power/turbostat: Fix a knl bug
Vlad Buslov <vladbu(a)nvidia.com>
macvlan: Don't propagate promisc change to lower dev in passthru
Rahul Rameshbabu <rrameshbabu(a)nvidia.com>
net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
Leon Romanovsky <leonro(a)nvidia.com>
net/mlx5_core: Clean driver version and name
Dust Li <dust.li(a)linux.alibaba.com>
net/mlx5e: fix double free of encap_header
Baruch Siach <baruch(a)tkos.co.il>
net: stmmac: fix rx budget limit check
Jose Abreu <Jose.Abreu(a)synopsys.com>
net: stmmac: Rework stmmac_rx()
Linkui Xiao <xiaolinkui(a)kylinos.cn>
netfilter: nf_conntrack_bridge: initialize err to 0
Linus Walleij <linus.walleij(a)linaro.org>
net: ethernet: cortina: Fix MTU max setting
Linus Walleij <linus.walleij(a)linaro.org>
net: ethernet: cortina: Handle large frames
Linus Walleij <linus.walleij(a)linaro.org>
net: ethernet: cortina: Fix max RX frame define
Eric Dumazet <edumazet(a)google.com>
bonding: stop the device in bond_setup_by_slave()
Eric Dumazet <edumazet(a)google.com>
ptp: annotate data-race around q->head and q->tail
Juergen Gross <jgross(a)suse.com>
xen/events: fix delayed eoi list handling
Willem de Bruijn <willemb(a)google.com>
ppp: limit MRU to 64K
Shigeru Yoshida <syoshida(a)redhat.com>
tipc: Fix kernel-infoleak due to uninitialized TLV value
Yonglong Liu <liuyonglong(a)huawei.com>
net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
Shigeru Yoshida <syoshida(a)redhat.com>
tty: Fix uninit-value access in ppp_sync_receive()
Eric Dumazet <edumazet(a)google.com>
ipvlan: add ipvlan_route_v6_outbound() helper
Olga Kornievskaia <kolga(a)netapp.com>
NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
Miri Korenblit <miriam.rachel.korenblit(a)intel.com>
wifi: iwlwifi: Use FW rate for non-data frames
Dan Carpenter <dan.carpenter(a)linaro.org>
pwm: Fix double shift bug
Tony Lindgren <tony(a)atomide.com>
ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
Douglas Anderson <dianders(a)chromium.org>
kgdb: Flush console before entering kgdb on panic
Wayne Lin <wayne.lin(a)amd.com>
drm/amd/display: Avoid NULL dereference of timing generator
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
media: cobalt: Use FIELD_GET() to extract Link Width
Bob Peterson <rpeterso(a)redhat.com>
gfs2: ignore negated quota changes
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: avoid integer overflow
Rajeshwar R Shinde <coolrrsh(a)gmail.com>
media: gspca: cpia1: shift-out-of-bounds in set_flicker
Axel Lin <axel.lin(a)ingics.com>
i2c: sun6i-p2wi: Prevent potential division by zero
Hardik Gajjar <hgajjar(a)de.adit-jv.com>
usb: gadget: f_ncm: Always set current gadget in ncm_bind()
Yi Yang <yiyang13(a)huawei.com>
tty: vcc: Add check for kstrdup() in vcc_probe()
Jiri Kosina <jkosina(a)suse.cz>
HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
atm: iphase: Do PCI error checks on own line
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
Cezary Rojewski <cezary.rojewski(a)intel.com>
ALSA: hda: Fix possible null-ptr-deref when assigning a stream
Vincent Whitchurch <vincent.whitchurch(a)axis.com>
ARM: 9320/1: fix stack depot IRQ stack filter
Manas Ghandat <ghandatmanas(a)gmail.com>
jfs: fix array-index-out-of-bounds in diAlloc
Manas Ghandat <ghandatmanas(a)gmail.com>
jfs: fix array-index-out-of-bounds in dbFindLeaf
Juntong Deng <juntong.deng(a)outlook.com>
fs/jfs: Add validity check for db_maxag and db_agpref
Juntong Deng <juntong.deng(a)outlook.com>
fs/jfs: Add check for negative db_l2nbperpage
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
RDMA/hfi1: Use FIELD_GET() to extract Link Width
Lu Jialin <lujialin4(a)huawei.com>
crypto: pcrypt - Fix hungtask for PADATA_RESET
zhujun2 <zhujun2(a)cmss.chinamobile.com>
selftests/efivarfs: create-read: fix a resource leak
Qu Huang <qu.huang(a)linux.dev>
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
baozhu.liu <lucas.liu(a)siengine.com>
drm/komeda: drop all currently held locks if deadlock happens
Olli Asikainen <olli.asikainen(a)gmail.com>
platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
ZhengHan Wang <wzhmmmmm(a)gmail.com>
Bluetooth: Fix double free in hci_conn_cleanup
Douglas Anderson <dianders(a)chromium.org>
wifi: ath10k: Don't touch the CE interrupt registers after power up
Eric Dumazet <edumazet(a)google.com>
net: annotate data-races around sk->sk_dst_pending_confirm
Eric Dumazet <edumazet(a)google.com>
net: annotate data-races around sk->sk_tx_queue_mapping
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: ath10k: fix clang-specific fortify warning
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: ath9k: fix clang-specific fortify warnings
Ping-Ke Shih <pkshih(a)realtek.com>
wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: mac80211_hwsim: fix clang-specific fortify warning
Mike Rapoport (IBM) <rppt(a)kernel.org>
x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
Ronald Wahl <ronald.wahl(a)raritan.com>
clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
Jacky Bai <ping.bai(a)nxp.com>
clocksource/drivers/timer-imx-gpt: Fix potential memory leak
Shuai Xue <xueshuai(a)linux.alibaba.com>
perf/core: Bail out early if the request AUX area is out of bound
John Stultz <jstultz(a)google.com>
locking/ww_mutex/test: Fix potential workqueue corruption
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/exception.h | 4 -
arch/parisc/include/uapi/asm/pdc.h | 1 +
arch/parisc/kernel/entry.S | 7 +-
arch/parisc/kernel/head.S | 5 +-
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/include/asm/numa.h | 7 -
arch/x86/kernel/cpu/hygon.c | 8 +-
arch/x86/kvm/hyperv.c | 10 +-
arch/x86/kvm/x86.c | 2 +
arch/x86/mm/numa.c | 7 -
crypto/pcrypt.c | 4 +
drivers/acpi/resource.c | 12 +
drivers/atm/iphase.c | 20 +-
drivers/bluetooth/btusb.c | 35 +-
drivers/clk/qcom/gcc-ipq8074.c | 6 -
drivers/clocksource/timer-atmel-tcb.c | 1 +
drivers/clocksource/timer-imx-gpt.c | 18 +-
drivers/dma/stm32-mdma.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 +-
drivers/gpu/drm/amd/include/pptable.h | 4 +-
drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 16 +-
.../drm/arm/display/komeda/komeda_pipeline_state.c | 9 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
drivers/i2c/busses/i2c-i801.c | 19 +-
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +
drivers/i2c/i2c-core.h | 2 +-
drivers/i3c/master/i3c-master-cdns.c | 6 +-
drivers/infiniband/hw/hfi1/pcie.c | 9 +-
drivers/mcb/mcb-core.c | 1 +
drivers/mcb/mcb-parse.c | 2 +-
drivers/media/pci/cobalt/cobalt-driver.c | 11 +-
drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +-
drivers/media/platform/qcom/venus/hfi_parser.c | 15 +
drivers/media/platform/qcom/venus/hfi_venus.c | 10 +
drivers/media/platform/vivid/vivid-rds-gen.c | 2 +-
drivers/media/rc/ir-sharp-decoder.c | 8 +-
drivers/media/rc/lirc_dev.c | 6 +-
drivers/media/usb/gspca/cpia1.c | 3 +
drivers/mmc/host/meson-gx-mmc.c | 1 -
drivers/mmc/host/vub300.c | 1 +
drivers/net/bonding/bond_main.c | 6 +
drivers/net/dsa/lan9303_mdio.c | 4 +-
drivers/net/ethernet/cortina/gemini.c | 45 +-
drivers/net/ethernet/cortina/gemini.h | 4 +-
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 10 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 13 +-
.../ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 10 +-
.../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 3 -
drivers/net/ethernet/realtek/r8169_main.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 148 +++---
drivers/net/ipvlan/ipvlan_core.c | 41 +-
drivers/net/macvlan.c | 2 +-
drivers/net/ppp/ppp_synctty.c | 6 +-
drivers/net/wireless/ath/ath10k/debug.c | 2 +-
drivers/net/wireless/ath/ath10k/snoc.c | 18 +-
drivers/net/wireless/ath/ath9k/debug.c | 2 +-
drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 14 +-
drivers/net/wireless/mac80211_hwsim.c | 2 +-
drivers/pci/controller/dwc/pci-keystone.c | 8 +-
drivers/pci/controller/dwc/pcie-tegra194.c | 9 +-
drivers/pci/pci-acpi.c | 2 +-
drivers/pci/pci-sysfs.c | 5 +-
drivers/platform/x86/thinkpad_acpi.c | 1 +
drivers/ptp/ptp_chardev.c | 3 +-
drivers/ptp/ptp_clock.c | 5 +-
drivers/ptp/ptp_private.h | 8 +-
drivers/ptp/ptp_sysfs.c | 3 +-
drivers/scsi/libfc/fc_lport.c | 6 +
drivers/scsi/megaraid/megaraid_sas_base.c | 4 +-
drivers/tty/hvc/hvc_xen.c | 5 +-
drivers/tty/serial/meson_uart.c | 33 +-
drivers/tty/vcc.c | 16 +-
drivers/usb/gadget/function/f_ncm.c | 27 +-
drivers/xen/events/events_base.c | 4 +-
fs/btrfs/delalloc-space.c | 3 -
fs/cifs/cifs_spnego.c | 4 +-
fs/ext4/acl.h | 5 +
fs/ext4/extents_status.c | 4 +-
fs/ext4/resize.c | 19 +-
fs/gfs2/quota.c | 11 +
fs/jbd2/recovery.c | 8 +
fs/jfs/jfs_dmap.c | 23 +-
fs/jfs/jfs_imap.c | 5 +-
fs/nfs/nfs4proc.c | 5 +-
fs/nfsd/nfs4state.c | 2 +-
fs/quota/dquot.c | 14 +
include/linux/mlx5/driver.h | 2 +
include/linux/pwm.h | 4 +-
include/linux/trace_events.h | 4 +
include/net/netfilter/nf_tables.h | 129 ++----
include/net/sock.h | 26 +-
include/uapi/linux/netfilter/nf_tables.h | 1 +
kernel/audit_watch.c | 9 +-
kernel/bpf/verifier.c | 7 +-
kernel/debug/debug_core.c | 3 +
kernel/events/ring_buffer.c | 6 +
kernel/irq/generic-chip.c | 25 +-
kernel/locking/test-ww_mutex.c | 20 +-
kernel/padata.c | 2 +-
kernel/power/snapshot.c | 16 +-
kernel/reboot.c | 1 +
kernel/trace/trace.c | 15 +
kernel/trace/trace.h | 3 +
kernel/trace/trace_events.c | 39 +-
kernel/trace/trace_events_filter.c | 3 +
mm/cma.c | 2 +-
net/bluetooth/hci_conn.c | 6 +-
net/bluetooth/hci_sysfs.c | 23 +-
net/bridge/netfilter/nf_conntrack_bridge.c | 2 +-
net/core/sock.c | 2 +-
net/ipv4/tcp_output.c | 2 +-
net/mac80211/cfg.c | 4 +
net/ncsi/ncsi-aen.c | 5 -
net/netfilter/nf_tables_api.c | 512 +++++++++++++++++----
net/netfilter/nft_chain_filter.c | 3 +
net/netfilter/nft_set_bitmap.c | 5 +-
net/netfilter/nft_set_hash.c | 110 +++--
net/netfilter/nft_set_rbtree.c | 375 ++++++++++++---
net/tipc/netlink_compat.c | 1 +
scripts/gcc-plugins/randomize_layout_plugin.c | 11 +-
sound/core/info.c | 21 +-
sound/hda/hdac_stream.c | 6 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/ti/omap-mcbsp.c | 6 +-
tools/power/x86/turbostat/turbostat.c | 2 +-
tools/testing/selftests/efivarfs/create-read.c | 2 +
135 files changed, 1626 insertions(+), 679 deletions(-)
If bus is marked as multi_link, but number of masters in the stream is
not higher than bus->hw_sync_min_links (bus->multi_link && m_rt_count >=
bus->hw_sync_min_links), bank switching should not happen. The first
part of do_bank_switch() code properly takes these conditions into
account, but second part (sdw_ml_sync_bank_switch()) relies purely on
bus->multi_link property. This is not balanced and leads to NULL
pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
...
Call trace:
wait_for_completion_timeout+0x124/0x1f0
do_bank_switch+0x370/0x6f8
sdw_prepare_stream+0x2d0/0x438
qcom_snd_sdw_prepare+0xa0/0x118
sm8450_snd_prepare+0x128/0x148
snd_soc_link_prepare+0x5c/0xe8
__soc_pcm_prepare+0x28/0x1ec
dpcm_be_dai_prepare+0x1e0/0x2c0
dpcm_fe_dai_prepare+0x108/0x28c
snd_pcm_do_prepare+0x44/0x68
snd_pcm_action_single+0x54/0xc0
snd_pcm_action_nonatomic+0xe4/0xec
snd_pcm_prepare+0xc4/0x114
snd_pcm_common_ioctl+0x1154/0x1cc0
snd_pcm_ioctl+0x54/0x74
Fixes: ce6e74d008ff ("soundwire: Add support for multi link bank switch")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
---
drivers/soundwire/stream.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
index 9dc6399f206a..f9c0adc0738d 100644
--- a/drivers/soundwire/stream.c
+++ b/drivers/soundwire/stream.c
@@ -742,14 +742,15 @@ static int sdw_bank_switch(struct sdw_bus *bus, int m_rt_count)
* sdw_ml_sync_bank_switch: Multilink register bank switch
*
* @bus: SDW bus instance
+ * @multi_link: whether this is a multi-link stream with hardware-based sync
*
* Caller function should free the buffers on error
*/
-static int sdw_ml_sync_bank_switch(struct sdw_bus *bus)
+static int sdw_ml_sync_bank_switch(struct sdw_bus *bus, bool multi_link)
{
unsigned long time_left;
- if (!bus->multi_link)
+ if (!multi_link)
return 0;
/* Wait for completion of transfer */
@@ -847,7 +848,7 @@ static int do_bank_switch(struct sdw_stream_runtime *stream)
bus->bank_switch_timeout = DEFAULT_BANK_SWITCH_TIMEOUT;
/* Check if bank switch was successful */
- ret = sdw_ml_sync_bank_switch(bus);
+ ret = sdw_ml_sync_bank_switch(bus, multi_link);
if (ret < 0) {
dev_err(bus->dev,
"multi link bank switch failed: %d\n", ret);
--
2.34.1
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102138-riverbed-senator-e356@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001
From: Francis Laniel <flaniel(a)linux.microsoft.com>
Date: Fri, 20 Oct 2023 13:42:49 +0300
Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches
several symbols
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 3d7a180a8427..a8fef6ab0872 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = {
.priority = 1 /* Invoked after kprobe module callback */
};
+static int count_symbols(void *data, unsigned long unused)
+{
+ unsigned int *count = data;
+
+ (*count)++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ unsigned int count;
+
+ count = 0;
+ kallsyms_on_each_match_symbol(count_symbols, func_name, &count);
+
+ return count;
+}
+
static int __trace_kprobe_create(int argc, const char *argv[])
{
/*
@@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[])
}
}
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1) {
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+ ret = -EADDRNOTAVAIL;
+
+ goto error;
+ } else if (count == 0) {
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ trace_probe_log_err(0, BAD_PROBE_ADDR);
+ ret = -ENOENT;
+
+ goto error;
+ }
+ }
+
trace_probe_log_set_index(0);
if (event) {
ret = traceprobe_parse_event_name(&event, &group, gbuf,
@@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
}
#ifdef CONFIG_PERF_EVENTS
+
/* create a trace_kprobe, but don't add it to global lists */
struct trace_event_call *
create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
int ret;
char *event;
+ if (func) {
+ unsigned int count;
+
+ count = number_of_same_symbols(func);
+ if (count > 1)
+ /*
+ * Users should use addr to remove the ambiguity of
+ * using func only.
+ */
+ return ERR_PTR(-EADDRNOTAVAIL);
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return ERR_PTR(-ENOENT);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 02b432ae7513..850d9ecb6765 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(BAD_MAXACT, "Invalid maxactive number"), \
C(MAXACT_TOO_BIG, "Maxactive is too big"), \
C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \
+ C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \
C(BAD_RETPROBE, "Retprobe address must be an function entry"), \
C(NO_TRACEPOINT, "Tracepoint is not found"), \
C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \
The vmd_pm_enable_quirk() helper is called from pci_walk_bus() during
probe to enable ASPM for controllers with VMD_FEAT_BIOS_PM_QUIRK set.
Since pci_walk_bus() already holds a pci_bus_sem read lock, use the new
locked helper to enable link states in order to avoid a potential
deadlock (e.g. in case someone takes a write lock before reacquiring
the read lock).
Fixes: f492edb40b54 ("PCI: vmd: Add quirk to configure PCIe ASPM and LTR")
Cc: stable(a)vger.kernel.org # 6.3
Cc: Michael Bottini <michael.a.bottini(a)linux.intel.com>
Cc: David E. Box <david.e.box(a)linux.intel.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/pci/controller/vmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index 94ba61fe1c44..0452cbc362ee 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -751,7 +751,7 @@ static int vmd_pm_enable_quirk(struct pci_dev *pdev, void *userdata)
if (!(features & VMD_FEAT_BIOS_PM_QUIRK))
return 0;
- pci_enable_link_state(pdev, PCIE_LINK_STATE_ALL);
+ pci_enable_link_state_locked(pdev, PCIE_LINK_STATE_ALL);
pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_LTR);
if (!pos)
--
2.41.0
When typec_altmode_put_partner is called by a plug altmode upon release,
the port altmode the plug belongs to will not remove its reference to the
plug. The check to see if the altmode being released evaluates against the
released altmode's partner instead of the calling altmode itself, so change
adev in typec_altmode_put_partner to properly refer to the altmode being
released.
typec_altmode_set_partner is not run for port altmodes, so also add a check
in typec_altmode_release to prevent typec_altmode_put_partner() calls on
port altmode release.
---
Changes since v1:
* Changed commit message for clarity
* Added check to typec_altmode_release to only call put_partner if altmode
belongs to port partner or plug
---
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Cc: stable(a)vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera(a)google.com>
---
drivers/usb/typec/class.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 2e0451bd336e..16a670828dde 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -267,7 +267,7 @@ static void typec_altmode_put_partner(struct altmode *altmode)
if (!partner)
return;
- adev = &partner->adev;
+ adev = &altmode->adev;
if (is_typec_plug(adev->dev.parent)) {
struct typec_plug *plug = to_typec_plug(adev->dev.parent);
@@ -497,7 +497,8 @@ static void typec_altmode_release(struct device *dev)
{
struct altmode *alt = to_altmode(to_typec_altmode(dev));
- typec_altmode_put_partner(alt);
+ if (!is_typec_port(dev->parent))
+ typec_altmode_put_partner(alt);
altmode_id_remove(alt->adev.dev.parent, alt->id);
kfree(alt);
base-commit: b85ea95d086471afb4ad062012a4d73cd328fa86
--
2.43.0.rc1.413.gea7ed67945-goog
This is the start of the stable review cycle for the 4.19.300 release.
There are 92 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 28 Nov 2023 15:43:06 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.300-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.300-rc3
Eric Dumazet <edumazet(a)google.com>
net: sched: fix race condition in qdisc_graft()
Matthew Wilcox (Oracle) <willy(a)infradead.org>
iomap: Set all uptodate bits for an Uptodate page
Dongli Zhang <dongli.zhang(a)oracle.com>
scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids
Christian König <christian.koenig(a)amd.com>
drm/amdgpu: fix error handling in amdgpu_bo_list_get()
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: correct return value of ext4_convert_meta_bg
Kemeng Shi <shikemeng(a)huaweicloud.com>
ext4: correct offset of gdb backup in non meta_bg group to update_backups
Max Kellermann <max.kellermann(a)ionos.com>
ext4: apply umask if ACL support is disabled
Heiner Kallweit <hkallweit1(a)gmail.com>
Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: add checks to handle capabilities from firmware
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: fix the check to handle session buffer requirement
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi_parser: Add check to keep the number of codecs within range
Sean Young <sean(a)mess.org>
media: sharp: fix sharp encoding
Sean Young <sean(a)mess.org>
media: lirc: drop trailing space from scancode transmit
Heiner Kallweit <hkallweit1(a)gmail.com>
i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
Alexander Sverdlin <alexander.sverdlin(a)siemens.com>
net: dsa: lan9303: consequently nested-lock physical MDIO
Pavel Krasavin <pkrasavin(a)imaqliq.com>
tty: serial: meson: fix hard LOCKUP on crtscts mode
Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com>
serial: meson: Use platform_get_irq() to get the interrupt
Neil Armstrong <narmstrong(a)baylibre.com>
tty: serial: meson: retrieve port FIFO size from DT
Colin Ian King <colin.king(a)canonical.com>
serial: meson: remove redundant initialization of variable id
Loys Ollivier <lollivier(a)baylibre.com>
tty: serial: meson: if no alias specified use an available id
Chandradeep Dey <codesigning(a)chandradeepdey.com>
ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
Takashi Iwai <tiwai(a)suse.de>
ALSA: info: Fix potential deadlock at disconnection
Helge Deller <deller(a)gmx.de>
parisc/pgtable: Do not drop upper 5 address bits of physical address
Helge Deller <deller(a)gmx.de>
parisc: Prevent booting 64-bit kernels on PA1.x machines
Alain Volmat <alain.volmat(a)foss.st.com>
dmaengine: stm32-mdma: correct desc prep when channel running
Sanjuán García, Jorge <Jorge.SanjuanGarcia(a)duagon.com>
mcb: fix error handling for different scenarios when parsing
Eric Biggers <ebiggers(a)google.com>
quota: explicitly forbid quota files from being encrypted
Zhihao Cheng <chengzhihao1(a)huawei.com>
jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
Brian Geffon <bgeffon(a)google.com>
PM: hibernate: Clean up sync_read handling in snapshot_write_next()
Brian Geffon <bgeffon(a)google.com>
PM: hibernate: Use __get_safe_page() rather than touching the list
Dan Carpenter <dan.carpenter(a)linaro.org>
mmc: vub300: fix an error code
Kathiravan Thirumoorthy <quic_kathirav(a)quicinc.com>
clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
Helge Deller <deller(a)gmx.de>
parisc/pdc: Add width field to struct pdc_model
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
PCI: keystone: Don't discard .probe() callback
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
PCI: keystone: Don't discard .remove() callback
Herve Codina <herve.codina(a)bootlin.com>
genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
Rong Chen <rong.chen(a)amlogic.com>
mmc: meson-gx: Remove setting of CMD_CFG_ERROR
Lukas Wunner <lukas(a)wunner.de>
PCI/sysfs: Protect driver's D3cold preference from user space
David Woodhouse <dwmw(a)amazon.co.uk>
hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
Paul Moore <paul(a)paul-moore.com>
audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
Paul Moore <paul(a)paul-moore.com>
audit: don't take task_lock() in audit_exe_compare() code path
Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com>
KVM: x86: Ignore MSR_AMD64_TW_CFG access
Kees Cook <keescook(a)chromium.org>
randstruct: Fix gcc-plugin performance mode to stay in group
Vikash Garodia <quic_vgarodia(a)quicinc.com>
media: venus: hfi: add checks to perform sanity on queue pointers
Anastasia Belova <abelova(a)astralinux.ru>
cifs: spnego: add ';' in HOST_KEY_LEN
Vlad Buslov <vladbu(a)nvidia.com>
macvlan: Don't propagate promisc change to lower dev in passthru
Linus Walleij <linus.walleij(a)linaro.org>
net: ethernet: cortina: Fix MTU max setting
Linus Walleij <linus.walleij(a)linaro.org>
net: ethernet: cortina: Handle large frames
Linus Walleij <linus.walleij(a)linaro.org>
net: ethernet: cortina: Fix max RX frame define
Eric Dumazet <edumazet(a)google.com>
ptp: annotate data-race around q->head and q->tail
Juergen Gross <jgross(a)suse.com>
xen/events: fix delayed eoi list handling
Willem de Bruijn <willemb(a)google.com>
ppp: limit MRU to 64K
Shigeru Yoshida <syoshida(a)redhat.com>
tipc: Fix kernel-infoleak due to uninitialized TLV value
Shigeru Yoshida <syoshida(a)redhat.com>
tty: Fix uninit-value access in ppp_sync_receive()
Eric Dumazet <edumazet(a)google.com>
ipvlan: add ipvlan_route_v6_outbound() helper
Olga Kornievskaia <kolga(a)netapp.com>
NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
Dan Carpenter <dan.carpenter(a)linaro.org>
pwm: Fix double shift bug
Wayne Lin <wayne.lin(a)amd.com>
drm/amd/display: Avoid NULL dereference of timing generator
Bob Peterson <rpeterso(a)redhat.com>
gfs2: ignore negated quota changes
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: avoid integer overflow
Rajeshwar R Shinde <coolrrsh(a)gmail.com>
media: gspca: cpia1: shift-out-of-bounds in set_flicker
Axel Lin <axel.lin(a)ingics.com>
i2c: sun6i-p2wi: Prevent potential division by zero
Hardik Gajjar <hgajjar(a)de.adit-jv.com>
usb: gadget: f_ncm: Always set current gadget in ncm_bind()
Yi Yang <yiyang13(a)huawei.com>
tty: vcc: Add check for kstrdup() in vcc_probe()
Jiri Kosina <jkosina(a)suse.cz>
HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
atm: iphase: Do PCI error checks on own line
Cezary Rojewski <cezary.rojewski(a)intel.com>
ALSA: hda: Fix possible null-ptr-deref when assigning a stream
Vincent Whitchurch <vincent.whitchurch(a)axis.com>
ARM: 9320/1: fix stack depot IRQ stack filter
Manas Ghandat <ghandatmanas(a)gmail.com>
jfs: fix array-index-out-of-bounds in diAlloc
Manas Ghandat <ghandatmanas(a)gmail.com>
jfs: fix array-index-out-of-bounds in dbFindLeaf
Juntong Deng <juntong.deng(a)outlook.com>
fs/jfs: Add validity check for db_maxag and db_agpref
Juntong Deng <juntong.deng(a)outlook.com>
fs/jfs: Add check for negative db_l2nbperpage
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
RDMA/hfi1: Use FIELD_GET() to extract Link Width
Lu Jialin <lujialin4(a)huawei.com>
crypto: pcrypt - Fix hungtask for PADATA_RESET
zhujun2 <zhujun2(a)cmss.chinamobile.com>
selftests/efivarfs: create-read: fix a resource leak
Qu Huang <qu.huang(a)linux.dev>
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
Olli Asikainen <olli.asikainen(a)gmail.com>
platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
ZhengHan Wang <wzhmmmmm(a)gmail.com>
Bluetooth: Fix double free in hci_conn_cleanup
Eric Dumazet <edumazet(a)google.com>
net: annotate data-races around sk->sk_dst_pending_confirm
Eric Dumazet <edumazet(a)google.com>
net: annotate data-races around sk->sk_tx_queue_mapping
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: ath10k: fix clang-specific fortify warning
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: ath9k: fix clang-specific fortify warnings
Ping-Ke Shih <pkshih(a)realtek.com>
wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
Mike Rapoport (IBM) <rppt(a)kernel.org>
x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
Ronald Wahl <ronald.wahl(a)raritan.com>
clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
Jacky Bai <ping.bai(a)nxp.com>
clocksource/drivers/timer-imx-gpt: Fix potential memory leak
Shuai Xue <xueshuai(a)linux.alibaba.com>
perf/core: Bail out early if the request AUX area is out of bound
John Stultz <jstultz(a)google.com>
locking/ww_mutex/test: Fix potential workqueue corruption
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/exception.h | 4 --
arch/parisc/include/uapi/asm/pdc.h | 1 +
arch/parisc/kernel/entry.S | 7 ++--
arch/parisc/kernel/head.S | 5 +--
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/include/asm/numa.h | 7 ----
arch/x86/kvm/x86.c | 2 +
arch/x86/mm/numa.c | 7 ----
crypto/pcrypt.c | 4 ++
drivers/atm/iphase.c | 20 +++++-----
drivers/clk/qcom/gcc-ipq8074.c | 6 ---
drivers/clocksource/tcb_clksrc.c | 1 +
drivers/clocksource/timer-imx-gpt.c | 18 ++++++---
drivers/dma/stm32-mdma.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +++
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 +-
drivers/gpu/drm/amd/include/pptable.h | 4 +-
drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 16 ++++----
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
drivers/i2c/busses/i2c-i801.c | 19 +++++----
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++
drivers/infiniband/hw/hfi1/pcie.c | 9 +----
drivers/mcb/mcb-core.c | 1 +
drivers/mcb/mcb-parse.c | 2 +-
drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +-
drivers/media/platform/qcom/venus/hfi_parser.c | 15 ++++++++
drivers/media/platform/qcom/venus/hfi_venus.c | 10 +++++
drivers/media/platform/vivid/vivid-rds-gen.c | 2 +-
drivers/media/rc/ir-sharp-decoder.c | 8 ++--
drivers/media/rc/lirc_dev.c | 6 ++-
drivers/media/usb/gspca/cpia1.c | 3 ++
drivers/mmc/host/meson-gx-mmc.c | 1 -
drivers/mmc/host/vub300.c | 1 +
drivers/net/dsa/lan9303_mdio.c | 4 +-
drivers/net/ethernet/cortina/gemini.c | 45 ++++++++++++++--------
drivers/net/ethernet/cortina/gemini.h | 4 +-
drivers/net/ethernet/realtek/r8169_main.c | 4 +-
drivers/net/ipvlan/ipvlan_core.c | 41 ++++++++++++--------
drivers/net/macvlan.c | 2 +-
drivers/net/ppp/ppp_synctty.c | 6 ++-
drivers/net/wireless/ath/ath10k/debug.c | 2 +-
drivers/net/wireless/ath/ath9k/debug.c | 2 +-
drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
drivers/pci/controller/dwc/pci-keystone.c | 8 ++--
drivers/pci/pci-acpi.c | 2 +-
drivers/pci/pci-sysfs.c | 5 +--
drivers/platform/x86/thinkpad_acpi.c | 1 +
drivers/ptp/ptp_chardev.c | 3 +-
drivers/ptp/ptp_clock.c | 5 ++-
drivers/ptp/ptp_private.h | 8 +++-
drivers/ptp/ptp_sysfs.c | 3 +-
drivers/scsi/libfc/fc_lport.c | 6 +++
drivers/scsi/virtio_scsi.c | 1 +
drivers/tty/hvc/hvc_xen.c | 5 ++-
drivers/tty/serial/meson_uart.c | 44 ++++++++++++++++-----
drivers/tty/vcc.c | 16 ++++++--
drivers/usb/gadget/function/f_ncm.c | 27 ++++++-------
drivers/xen/events/events_base.c | 4 +-
fs/cifs/cifs_spnego.c | 4 +-
fs/ext4/acl.h | 5 +++
fs/ext4/resize.c | 19 ++++-----
fs/gfs2/quota.c | 11 ++++++
fs/iomap.c | 3 ++
fs/jbd2/recovery.c | 8 ++++
fs/jfs/jfs_dmap.c | 23 ++++++++---
fs/jfs/jfs_imap.c | 5 ++-
fs/nfs/nfs4proc.c | 5 ++-
fs/quota/dquot.c | 14 +++++++
include/linux/pwm.h | 4 +-
include/net/sock.h | 26 +++++++++----
kernel/audit_watch.c | 9 ++++-
kernel/events/ring_buffer.c | 6 +++
kernel/irq/generic-chip.c | 25 +++++++++---
kernel/locking/test-ww_mutex.c | 20 ++++++----
kernel/padata.c | 2 +-
kernel/power/snapshot.c | 16 ++++----
net/bluetooth/hci_conn.c | 6 +--
net/bluetooth/hci_sysfs.c | 23 +++++------
net/core/sock.c | 2 +-
net/ipv4/tcp_output.c | 2 +-
net/mac80211/cfg.c | 4 ++
net/sched/sch_api.c | 5 ++-
net/tipc/netlink_compat.c | 1 +
scripts/gcc-plugins/randomize_layout_plugin.c | 11 ++++--
sound/core/info.c | 21 ++++++----
sound/hda/hdac_stream.c | 6 ++-
sound/pci/hda/patch_realtek.c | 1 +
tools/testing/selftests/efivarfs/create-read.c | 2 +
91 files changed, 482 insertions(+), 265 deletions(-)
Non-KMS drivers have been removed from DRM. Update the TODO list
accordingly.
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Fixes: a276afc19eec ("drm: Remove some obsolete drm pciids(tdfx, mga, i810, savage, r128, sis, via)")
Cc: Cai Huoqing <cai.huoqing(a)linux.dev>
Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch>
Cc: Dave Airlie <airlied(a)redhat.com>
Cc: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Cc: Maxime Ripard <mripard(a)kernel.org>
Cc: David Airlie <airlied(a)gmail.com>
Cc: Daniel Vetter <daniel(a)ffwll.ch>
Cc: Jonathan Corbet <corbet(a)lwn.net>
Cc: dri-devel(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v6.3+
Cc: linux-doc(a)vger.kernel.org
---
Documentation/gpu/todo.rst | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst
index b62c7fa0c2bcc..3bdb8787960be 100644
--- a/Documentation/gpu/todo.rst
+++ b/Documentation/gpu/todo.rst
@@ -337,8 +337,8 @@ connector register/unregister fixes
Level: Intermediate
-Remove load/unload callbacks from all non-DRIVER_LEGACY drivers
----------------------------------------------------------------
+Remove load/unload callbacks
+----------------------------
The load/unload callbacks in struct &drm_driver are very much midlayers, plus
for historical reasons they get the ordering wrong (and we can't fix that)
@@ -347,8 +347,7 @@ between setting up the &drm_driver structure and calling drm_dev_register().
- Rework drivers to no longer use the load/unload callbacks, directly coding the
load/unload sequence into the driver's probe function.
-- Once all non-DRIVER_LEGACY drivers are converted, disallow the load/unload
- callbacks for all modern drivers.
+- Once all drivers are converted, remove the load/unload callbacks.
Contact: Daniel Vetter
--
2.42.1
The acpi_video code was storing the acpi_video_device as driver-data
in the acpi_device children of the acpi_video_bus acpi_device.
But the acpi_video driver only binds to the bus acpi_device.
It uses, but does not bind to, the children. Since it is not
the driver it should not be using the driver_data of the children's
acpi_device-s.
Since commit 0d16710146a1 ("ACPI: bus: Set driver_data to NULL every
time .add() fails") the childen's driver_data ends up getting set
to NULL after a driver fails to bind to the children leading to a NULL
pointer deref in video_get_max_state when registering the cooling-dev:
[ 3.148958] BUG: kernel NULL pointer dereference, address: 0000000000000090
<snip>
[ 3.149015] Hardware name: Sony Corporation VPCSB2X9R/VAIO, BIOS R2087H4 06/15/2012
[ 3.149021] RIP: 0010:video_get_max_state+0x17/0x30 [video]
<snip>
[ 3.149105] Call Trace:
[ 3.149110] <TASK>
[ 3.149114] ? __die+0x23/0x70
[ 3.149126] ? page_fault_oops+0x171/0x4e0
[ 3.149137] ? exc_page_fault+0x7f/0x180
[ 3.149147] ? asm_exc_page_fault+0x26/0x30
[ 3.149158] ? video_get_max_state+0x17/0x30 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f]
[ 3.149176] ? __pfx_video_get_max_state+0x10/0x10 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f]
[ 3.149192] __thermal_cooling_device_register.part.0+0xf2/0x2f0
[ 3.149205] acpi_video_bus_register_backlight.part.0.isra.0+0x414/0x570 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f]
[ 3.149227] acpi_video_register_backlight+0x57/0x80 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f]
[ 3.149245] intel_acpi_video_register+0x68/0x90 [i915 1f3a758130b32ef13d301d4f8f78c7d766d57f2a]
[ 3.149669] intel_display_driver_register+0x28/0x50 [i915 1f3a758130b32ef13d301d4f8f78c7d766d57f2a]
[ 3.150064] i915_driver_probe+0x790/0xb90 [i915 1f3a758130b32ef13d301d4f8f78c7d766d57f2a]
[ 3.150402] local_pci_probe+0x45/0xa0
[ 3.150412] pci_device_probe+0xc1/0x260
<snip>
Fix this by directly using the acpi_video_device as devdata for
the cooling-device, which avoids the need to set driver-data on
the children at all.
Fixes: 0d16710146a1 ("ACPI: bus: Set driver_data to NULL every time .add() fails")
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9718
Cc: Michal Wilczynski <michal.wilczynski(a)intel.com>
Cc: 6.6+ <stable(a)vger.kernel.org> # 6.6+
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
---
drivers/acpi/acpi_video.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 5eded14f8853..7cd91e85c62a 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -253,8 +253,7 @@ static const struct backlight_ops acpi_backlight_ops = {
static int video_get_max_state(struct thermal_cooling_device *cooling_dev,
unsigned long *state)
{
- struct acpi_device *device = cooling_dev->devdata;
- struct acpi_video_device *video = acpi_driver_data(device);
+ struct acpi_video_device *video = cooling_dev->devdata;
*state = video->brightness->count - ACPI_VIDEO_FIRST_LEVEL - 1;
return 0;
@@ -263,8 +262,7 @@ static int video_get_max_state(struct thermal_cooling_device *cooling_dev,
static int video_get_cur_state(struct thermal_cooling_device *cooling_dev,
unsigned long *state)
{
- struct acpi_device *device = cooling_dev->devdata;
- struct acpi_video_device *video = acpi_driver_data(device);
+ struct acpi_video_device *video = cooling_dev->devdata;
unsigned long long level;
int offset;
@@ -283,8 +281,7 @@ static int video_get_cur_state(struct thermal_cooling_device *cooling_dev,
static int
video_set_cur_state(struct thermal_cooling_device *cooling_dev, unsigned long state)
{
- struct acpi_device *device = cooling_dev->devdata;
- struct acpi_video_device *video = acpi_driver_data(device);
+ struct acpi_video_device *video = cooling_dev->devdata;
int level;
if (state >= video->brightness->count - ACPI_VIDEO_FIRST_LEVEL)
@@ -1125,7 +1122,6 @@ static int acpi_video_bus_get_one_device(struct acpi_device *device, void *arg)
strcpy(acpi_device_name(device), ACPI_VIDEO_DEVICE_NAME);
strcpy(acpi_device_class(device), ACPI_VIDEO_CLASS);
- device->driver_data = data;
data->device_id = device_id;
data->video = video;
@@ -1747,8 +1743,8 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)
device->backlight->props.brightness =
acpi_video_get_brightness(device->backlight);
- device->cooling_dev = thermal_cooling_device_register("LCD",
- device->dev, &video_cooling_ops);
+ device->cooling_dev = thermal_cooling_device_register("LCD", device,
+ &video_cooling_ops);
if (IS_ERR(device->cooling_dev)) {
/*
* Set cooling_dev to NULL so we don't crash trying to free it.
--
2.43.0
In "r8169_phylink_handler", for rtl8125, it will call "rtl_reset_work"->
"rtl_hw_start"->"rtl_jumbo_config"->"phy_start_aneg". When call
"r8169_phylink_handler", PHY lock is acquired. But "phy_start_aneg"
will also try to acquire PHY lock. That will cause deadlock.
In this path, use "_phy_start_aneg", unlocked version "phy_start_aneg",
to prevent deadlock in "r8169_phylink_handler".
Fixes: 453a77894efa ("r8169: don't advertise pause in jumbo mode")
Cc: stable(a)vger.kernel.org
Signed-off-by: ChunHao Lin <hau(a)realtek.com>
---
drivers/net/ethernet/realtek/r8169_main.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 473b3245754f..2e3e42a98edd 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -2415,11 +2415,22 @@ static void rtl_jumbo_config(struct rtl8169_private *tp)
/* Chip doesn't support pause in jumbo mode */
if (jumbo) {
+ int lock;
+
linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
tp->phydev->advertising);
linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
tp->phydev->advertising);
- phy_start_aneg(tp->phydev);
+
+ if (!mutex_trylock(&tp->phydev->lock))
+ lock = 0;
+ else
+ lock = 1;
+
+ _phy_start_aneg(tp->phydev);
+
+ if (lock)
+ mutex_unlock(&tp->phydev->lock);
}
}
--
2.39.2
The patch titled
Subject: scripts/gdb/tasks: fix lx-ps command error
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
scripts-gdb-tasks-fix-lx-ps-command-error.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
Subject: scripts/gdb/tasks: fix lx-ps command error
Date: Mon, 27 Nov 2023 15:04:01 +0800
Since commit 8e1f385104ac ("kill task_struct->thread_group") remove
the thread_group, we will encounter below issue.
(gdb) lx-ps
TASK PID COMM
0xffff800086503340 0 swapper/0
Python Exception <class 'gdb.error'>: There is no member named thread_group.
Error occurred in Python: There is no member named thread_group.
We use signal->thread_head to iterate all threads instead.
Link: https://lkml.kernel.org/r/20231127070404.4192-2-Kuan-Ying.Lee@mediatek.com
Fixes: 8e1f385104ac ("kill task_struct->thread_group")
Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
Cc: Chinwen Chang <chinwen.chang(a)mediatek.com>
Cc: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
Cc: Matthias Brugger <matthias.bgg(a)gmail.com>
Cc: Qun-Wei Lin <qun-wei.lin(a)mediatek.com>
Cc: Oleg Nesterov <oleg(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Cc: Andrey Konovalov <andreyknvl(a)google.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
scripts/gdb/linux/tasks.py | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
--- a/scripts/gdb/linux/tasks.py~scripts-gdb-tasks-fix-lx-ps-command-error
+++ a/scripts/gdb/linux/tasks.py
@@ -13,7 +13,7 @@
import gdb
-from linux import utils
+from linux import utils, lists
task_type = utils.CachedType("struct task_struct")
@@ -25,13 +25,9 @@ def task_lists():
t = g = init_task
while True:
- while True:
- yield t
-
- t = utils.container_of(t['thread_group']['next'],
- task_ptr_type, "thread_group")
- if t == g:
- break
+ thread_head = t['signal']['thread_head']
+ for thread in lists.list_for_each_entry(thread_head, task_ptr_type, 'thread_node'):
+ yield thread
t = g = utils.container_of(g['tasks']['next'],
task_ptr_type, "tasks")
_
Patches currently in -mm which might be from Kuan-Ying.Lee(a)mediatek.com are
scripts-gdb-tasks-fix-lx-ps-command-error.patch
scripts-gdb-stackdepot-rename-pool_index_cached-to-pools_num.patch
scripts-gdb-remove-exception-handling-and-refine-print-format.patch
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102127-unbeaten-sandlot-da45@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001
From: Francis Laniel <flaniel(a)linux.microsoft.com>
Date: Fri, 20 Oct 2023 13:42:49 +0300
Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches
several symbols
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 3d7a180a8427..a8fef6ab0872 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = {
.priority = 1 /* Invoked after kprobe module callback */
};
+static int count_symbols(void *data, unsigned long unused)
+{
+ unsigned int *count = data;
+
+ (*count)++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ unsigned int count;
+
+ count = 0;
+ kallsyms_on_each_match_symbol(count_symbols, func_name, &count);
+
+ return count;
+}
+
static int __trace_kprobe_create(int argc, const char *argv[])
{
/*
@@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[])
}
}
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1) {
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+ ret = -EADDRNOTAVAIL;
+
+ goto error;
+ } else if (count == 0) {
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ trace_probe_log_err(0, BAD_PROBE_ADDR);
+ ret = -ENOENT;
+
+ goto error;
+ }
+ }
+
trace_probe_log_set_index(0);
if (event) {
ret = traceprobe_parse_event_name(&event, &group, gbuf,
@@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
}
#ifdef CONFIG_PERF_EVENTS
+
/* create a trace_kprobe, but don't add it to global lists */
struct trace_event_call *
create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
int ret;
char *event;
+ if (func) {
+ unsigned int count;
+
+ count = number_of_same_symbols(func);
+ if (count > 1)
+ /*
+ * Users should use addr to remove the ambiguity of
+ * using func only.
+ */
+ return ERR_PTR(-EADDRNOTAVAIL);
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return ERR_PTR(-ENOENT);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 02b432ae7513..850d9ecb6765 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(BAD_MAXACT, "Invalid maxactive number"), \
C(MAXACT_TOO_BIG, "Maxactive is too big"), \
C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \
+ C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \
C(BAD_RETPROBE, "Retprobe address must be an function entry"), \
C(NO_TRACEPOINT, "Tracepoint is not found"), \
C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102135-shuffle-blank-783e@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001
From: Francis Laniel <flaniel(a)linux.microsoft.com>
Date: Fri, 20 Oct 2023 13:42:49 +0300
Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches
several symbols
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 3d7a180a8427..a8fef6ab0872 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = {
.priority = 1 /* Invoked after kprobe module callback */
};
+static int count_symbols(void *data, unsigned long unused)
+{
+ unsigned int *count = data;
+
+ (*count)++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ unsigned int count;
+
+ count = 0;
+ kallsyms_on_each_match_symbol(count_symbols, func_name, &count);
+
+ return count;
+}
+
static int __trace_kprobe_create(int argc, const char *argv[])
{
/*
@@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[])
}
}
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1) {
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+ ret = -EADDRNOTAVAIL;
+
+ goto error;
+ } else if (count == 0) {
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ trace_probe_log_err(0, BAD_PROBE_ADDR);
+ ret = -ENOENT;
+
+ goto error;
+ }
+ }
+
trace_probe_log_set_index(0);
if (event) {
ret = traceprobe_parse_event_name(&event, &group, gbuf,
@@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
}
#ifdef CONFIG_PERF_EVENTS
+
/* create a trace_kprobe, but don't add it to global lists */
struct trace_event_call *
create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
int ret;
char *event;
+ if (func) {
+ unsigned int count;
+
+ count = number_of_same_symbols(func);
+ if (count > 1)
+ /*
+ * Users should use addr to remove the ambiguity of
+ * using func only.
+ */
+ return ERR_PTR(-EADDRNOTAVAIL);
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return ERR_PTR(-ENOENT);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 02b432ae7513..850d9ecb6765 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(BAD_MAXACT, "Invalid maxactive number"), \
C(MAXACT_TOO_BIG, "Maxactive is too big"), \
C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \
+ C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \
C(BAD_RETPROBE, "Retprobe address must be an function entry"), \
C(NO_TRACEPOINT, "Tracepoint is not found"), \
C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102137-mobster-sheath-bfb3@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001
From: Francis Laniel <flaniel(a)linux.microsoft.com>
Date: Fri, 20 Oct 2023 13:42:49 +0300
Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches
several symbols
When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.
Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.
Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c…
Cc: stable(a)vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel…
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 3d7a180a8427..a8fef6ab0872 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = {
.priority = 1 /* Invoked after kprobe module callback */
};
+static int count_symbols(void *data, unsigned long unused)
+{
+ unsigned int *count = data;
+
+ (*count)++;
+
+ return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+ unsigned int count;
+
+ count = 0;
+ kallsyms_on_each_match_symbol(count_symbols, func_name, &count);
+
+ return count;
+}
+
static int __trace_kprobe_create(int argc, const char *argv[])
{
/*
@@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[])
}
}
+ if (symbol && !strchr(symbol, ':')) {
+ unsigned int count;
+
+ count = number_of_same_symbols(symbol);
+ if (count > 1) {
+ /*
+ * Users should use ADDR to remove the ambiguity of
+ * using KSYM only.
+ */
+ trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+ ret = -EADDRNOTAVAIL;
+
+ goto error;
+ } else if (count == 0) {
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ trace_probe_log_err(0, BAD_PROBE_ADDR);
+ ret = -ENOENT;
+
+ goto error;
+ }
+ }
+
trace_probe_log_set_index(0);
if (event) {
ret = traceprobe_parse_event_name(&event, &group, gbuf,
@@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
}
#ifdef CONFIG_PERF_EVENTS
+
/* create a trace_kprobe, but don't add it to global lists */
struct trace_event_call *
create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
int ret;
char *event;
+ if (func) {
+ unsigned int count;
+
+ count = number_of_same_symbols(func);
+ if (count > 1)
+ /*
+ * Users should use addr to remove the ambiguity of
+ * using func only.
+ */
+ return ERR_PTR(-EADDRNOTAVAIL);
+ else if (count == 0)
+ /*
+ * We can return ENOENT earlier than when register the
+ * kprobe.
+ */
+ return ERR_PTR(-ENOENT);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 02b432ae7513..850d9ecb6765 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(BAD_MAXACT, "Invalid maxactive number"), \
C(MAXACT_TOO_BIG, "Maxactive is too big"), \
C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \
+ C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \
C(BAD_RETPROBE, "Retprobe address must be an function entry"), \
C(NO_TRACEPOINT, "Tracepoint is not found"), \
C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \
Hi,
We provide estimation & quantities takeoff services. We are providing 98-100 accuracy in our estimates and take-offs. Please tell us if you need any estimating services regarding your projects.
Send over the plans and mention the exact scope of work and shortly we will get back with a proposal on which our charges and turnaround time will be mentioned
You may ask for sample estimates and take-offs. Thanks.
Kind Regards
Callahan Bryson
Dreamland Estimation, LLC
Like other ASUS models the Asus Vivobook E1504FA requires an entry in
the quirk list to enable the internal microphone.
Showing
with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions 7
sound/soc/amd/yc/acp6x-mach.c
@@ -283,6 +283,13 @@ static const struct dmi_system_id
yc_acp_quirk_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"),
}
},
{
.driver_data = &acp6x_card,
.matches = {
DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER
INC."),
DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"),
}
},
{
I have this laptop and I have tested this patch successfully.
Malcolm
The patch below does not apply to the 6.5-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y
git checkout FETCH_HEAD
git cherry-pick -x 793838138c157d4c49f4fb744b170747e3dabf58
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112456-linked-nape-bf19@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^..
Possible dependencies:
793838138c15 ("prctl: Disable prctl(PR_SET_MDWE) on parisc")
24e41bf8a6b4 ("mm: add a NO_INHERIT flag to the PR_SET_MDWE prctl")
0da668333fb0 ("mm: make PR_MDWE_REFUSE_EXEC_GAIN an unsigned long")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 793838138c157d4c49f4fb744b170747e3dabf58 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller(a)gmx.de>
Date: Sat, 18 Nov 2023 19:33:35 +0100
Subject: [PATCH] prctl: Disable prctl(PR_SET_MDWE) on parisc
systemd-254 tries to use prctl(PR_SET_MDWE) for it's MemoryDenyWriteExecute
functionality, but fails on parisc which still needs executable stacks in
certain combinations of gcc/glibc/kernel.
Disable prctl(PR_SET_MDWE) by returning -EINVAL for now on parisc, until
userspace has catched up.
Signed-off-by: Helge Deller <deller(a)gmx.de>
Co-developed-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Reported-by: Sam James <sam(a)gentoo.org>
Closes: https://github.com/systemd/systemd/issues/29775
Tested-by: Sam James <sam(a)gentoo.org>
Link: https://lore.kernel.org/all/875y2jro9a.fsf@gentoo.org/
Cc: <stable(a)vger.kernel.org> # v6.3+
diff --git a/kernel/sys.c b/kernel/sys.c
index 420d9cb9cc8e..e219fcfa112d 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2394,6 +2394,10 @@ static inline int prctl_set_mdwe(unsigned long bits, unsigned long arg3,
if (bits & PR_MDWE_NO_INHERIT && !(bits & PR_MDWE_REFUSE_EXEC_GAIN))
return -EINVAL;
+ /* PARISC cannot allow mdwe as it needs writable stacks */
+ if (IS_ENABLED(CONFIG_PARISC))
+ return -EINVAL;
+
current_bits = get_current_mdwe();
if (current_bits && current_bits != bits)
return -EPERM; /* Cannot unset the flags */
Invoke drm_plane_helper_funcs.end_fb_access before
drm_atomic_helper_commit_hw_done(). The latter function hands over
ownership of the plane state to the following commit, which might
free it. Releasing resources in end_fb_access then operates on undefined
state. This bug has been observed with non-blocking commits when they
are being queued up quickly.
Here is an example stack trace from the bug report. The plane state has
been free'd already, so the pages for drm_gem_fb_vunmap() are gone.
Unable to handle kernel paging request at virtual address 0000000100000049
[...]
drm_gem_fb_vunmap+0x18/0x74
drm_gem_end_shadow_fb_access+0x1c/0x2c
drm_atomic_helper_cleanup_planes+0x58/0xd8
drm_atomic_helper_commit_tail+0x90/0xa0
commit_tail+0x15c/0x188
commit_work+0x14/0x20
For aborted commits, it is still ok to run end_fb_access as part of the
plane's cleanup. Add a test to drm_atomic_helper_cleanup_planes().
Reported-by: Alyssa Ross <hi(a)alyssa.is>
Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/
Suggested-by: Daniel Vetter <daniel(a)ffwll.ch>
Fixes: 94d879eaf7fb ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers")
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: <stable(a)vger.kernel.org> # v6.2+
---
drivers/gpu/drm/drm_atomic_helper.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index c3f677130def0..08d0511405e90 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -2784,6 +2784,17 @@ void drm_atomic_helper_commit_planes(struct drm_device *dev,
funcs->atomic_flush(crtc, old_state);
}
+
+ /*
+ * Signal end of framebuffer access here before hw_done. After hw_done,
+ * a later commit might have already released the plane state.
+ */
+ for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
+ const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+
+ if (funcs->end_fb_access)
+ funcs->end_fb_access(plane, new_plane_state);
+ }
}
EXPORT_SYMBOL(drm_atomic_helper_commit_planes);
@@ -2924,6 +2935,12 @@ void drm_atomic_helper_cleanup_planes(struct drm_device *dev,
for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) {
const struct drm_plane_helper_funcs *funcs = plane->helper_private;
+ /*
+ * Only clean up here if we're aborting the commit.
+ */
+ if (new_plane_state == plane->state)
+ continue;
+
if (funcs->end_fb_access)
funcs->end_fb_access(plane, new_plane_state);
}
--
2.42.1
The ttyname buffer for the ledtrig_tty_data struct is allocated in the
sysfs ttyname_store() function. This buffer must be released on trigger
deactivation. This was missing and is thus a memory leak.
While we are at it, the tty handler in the ledtrig_tty_data struct should
also be returned in case of the trigger deactivation call.
Cc: stable(a)vger.kernel.org
Fixes: fd4a641ac88f ("leds: trigger: implement a tty trigger")
Signed-off-by: Florian Eckert <fe(a)dev.tdt.de>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
---
v1 -> v2:
Add Cc: tag
v2 -> v3:
Add Reviewed-by and resend witout changes
drivers/leds/trigger/ledtrig-tty.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/leds/trigger/ledtrig-tty.c b/drivers/leds/trigger/ledtrig-tty.c
index 8ae0d2d284af..3e69a7bde928 100644
--- a/drivers/leds/trigger/ledtrig-tty.c
+++ b/drivers/leds/trigger/ledtrig-tty.c
@@ -168,6 +168,10 @@ static void ledtrig_tty_deactivate(struct led_classdev *led_cdev)
cancel_delayed_work_sync(&trigger_data->dwork);
+ kfree(trigger_data->ttyname);
+ tty_kref_put(trigger_data->tty);
+ trigger_data->tty = NULL;
+
kfree(trigger_data);
}
--
2.30.2
Two series lived in parallel for some time, which led to this situation:
- The nvmem-layout container is used for dynamic layouts
- We now expect fixed layouts to also use the nvmem-layout container but
this does not require any additional driver, the support is built-in the
nvmem core.
Ensure we don't refuse to probe for wrong reasons.
Fixes: 27f699e578b1 ("nvmem: core: add support for fixed cells *layout*")
Cc: stable(a)vger.kernel.org
Reported-by: Luca Ceresoli <luca.ceresoli(a)bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
---
Please note this is a temporary fix as this piece of code is going to
disappear when the NVMEM layouts 'as devices' series gets in.
drivers/nvmem/core.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index bf42b7e826db..608b352a7d91 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -796,6 +796,12 @@ static struct nvmem_layout *nvmem_layout_get(struct nvmem_device *nvmem)
if (!layout_np)
return NULL;
+ /* Fixed layouts don't have a matching driver */
+ if (of_device_is_compatible(layout_np, "fixed-layout")) {
+ of_node_put(layout_np);
+ return NULL;
+ }
+
/*
* In case the nvmem device was built-in while the layout was built as a
* module, we shall manually request the layout driver loading otherwise
--
2.34.1
The power domain scaling setup for QCS404 and MSM8909 in
cpufreq-com-nvmem does not work correctly at the moment because the
genpd core ignores all the performance state votes that are specified in
the CPU OPP table. This happens because nothing in the driver makes the
genpd core aware that the power domains are actively being consumed by
the CPU.
Fix this by marking the devices as runtime active. Also mark the devices
to be in the "awake path" during system suspend so that performance
state votes necessary for the CPU are preserved during system suspend.
While all the patches in this series are needed for full functionality,
the cpufreq and pmdomain patches can be merged independently. There is
no compile-time dependency between those two.
Signed-off-by: Stephan Gerhold <stephan.gerhold(a)kernkonzept.com>
---
Changes in v3:
- Drop patches with MSM8909 definitions that were applied already
- Add extra patch to fix system suspend properly by using
device_set_awake_path() instead of dev_pm_syscore_device()
- Set GENPD_FLAG_ACTIVE_WAKEUP for rpmpd so that performance state votes
needed by the CPU are preserved during suspend
- Link to v2: https://lore.kernel.org/r/20231018-msm8909-cpufreq-v2-0-0962df95f654@kernko…
Changes in v2:
- Reword commit messages based on discussion with Uffe
- Use generic power domain name "perf" (Uffe)
- Fix pm_runtime error handling (Uffe)
- Add allocation cleanup patch as preparation
- Fix ordering of qcom,msm8909 compatible (Konrad)
- cpufreq-dt-platdev blocklist/dt-bindings patches were applied already
- Link to v1: https://lore.kernel.org/r/20230912-msm8909-cpufreq-v1-0-767ce66b544b@kernko…
---
Stephan Gerhold (3):
cpufreq: qcom-nvmem: Enable virtual power domain devices
cpufreq: qcom-nvmem: Preserve PM domain votes in system suspend
pmdomain: qcom: rpmpd: Set GENPD_FLAG_ACTIVE_WAKEUP
drivers/cpufreq/qcom-cpufreq-nvmem.c | 73 ++++++++++++++++++++++++++++++++++--
drivers/pmdomain/qcom/rpmpd.c | 1 +
2 files changed, 71 insertions(+), 3 deletions(-)
---
base-commit: b85ea95d086471afb4ad062012a4d73cd328fa86
change-id: 20230906-msm8909-cpufreq-dff238de9ff3
Best regards,
--
Stephan Gerhold <stephan.gerhold(a)kernkonzept.com>
Kernkonzept GmbH at Dresden, Germany, HRB 31129, CEO Dr.-Ing. Michael Hohmuth
In https://github.com/szabgab/perlmaven.com/issues/583 we see to find
the simple answer to "What printed 'Out of memory', one must consult the
experts.
Therefore the "Out of memory" message needs to be prefixed with the name
of the kernel, or something. Anything. Thanks.