From: Douglas Anderson <dianders(a)chromium.org>
[ Upstream commit dd712d3d45807db9fcae28a522deee85c1f2fde6 ]
When entering kdb/kgdb on a kernel panic, it was be observed that the
console isn't flushed before the `kdb` prompt came up. Specifically,
when using the buddy lockup detector on arm64 and running:
echo HARDLOCKUP > /sys/kernel/debug/provoke-crash/DIRECT
I could see:
[ 26.161099] lkdtm: Performing direct entry HARDLOCKUP
[ 32.499881] watchdog: Watchdog detected hard LOCKUP on cpu 6
[ 32.552865] Sending NMI from CPU 5 to CPUs 6:
[ 32.557359] NMI backtrace for cpu 6
... [backtrace for cpu 6] ...
[ 32.558353] NMI backtrace for cpu 5
... [backtrace for cpu 5] ...
[ 32.867471] Sending NMI from CPU 5 to CPUs 0-4,7:
[ 32.872321] NMI backtrace forP cpuANC: Hard LOCKUP
Entering kdb (current=..., pid 0) on processor 5 due to Keyboard Entry
[5]kdb>
As you can see, backtraces for the other CPUs start printing and get
interleaved with the kdb PANIC print.
Let's replicate the commands to flush the console in the kdb panic
entry point to avoid this.
Signed-off-by: Douglas Anderson <dianders(a)chromium.org>
Link: https://lore.kernel.org/r/20230822131945.1.I5b460ae8f954e4c4f628a373d6e7471…
Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/debug/debug_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 0f31b22abe8d9..ef54254a5dd13 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -1022,6 +1022,9 @@ void kgdb_panic(const char *msg)
if (panic_timeout)
return;
+ debug_locks_off();
+ console_flush_on_panic(CONSOLE_FLUSH_PENDING);
+
if (dbg_kdb_mode)
kdb_printf("PANIC: %s\n", msg);
--
2.42.0
From: Douglas Anderson <dianders(a)chromium.org>
[ Upstream commit dd712d3d45807db9fcae28a522deee85c1f2fde6 ]
When entering kdb/kgdb on a kernel panic, it was be observed that the
console isn't flushed before the `kdb` prompt came up. Specifically,
when using the buddy lockup detector on arm64 and running:
echo HARDLOCKUP > /sys/kernel/debug/provoke-crash/DIRECT
I could see:
[ 26.161099] lkdtm: Performing direct entry HARDLOCKUP
[ 32.499881] watchdog: Watchdog detected hard LOCKUP on cpu 6
[ 32.552865] Sending NMI from CPU 5 to CPUs 6:
[ 32.557359] NMI backtrace for cpu 6
... [backtrace for cpu 6] ...
[ 32.558353] NMI backtrace for cpu 5
... [backtrace for cpu 5] ...
[ 32.867471] Sending NMI from CPU 5 to CPUs 0-4,7:
[ 32.872321] NMI backtrace forP cpuANC: Hard LOCKUP
Entering kdb (current=..., pid 0) on processor 5 due to Keyboard Entry
[5]kdb>
As you can see, backtraces for the other CPUs start printing and get
interleaved with the kdb PANIC print.
Let's replicate the commands to flush the console in the kdb panic
entry point to avoid this.
Signed-off-by: Douglas Anderson <dianders(a)chromium.org>
Link: https://lore.kernel.org/r/20230822131945.1.I5b460ae8f954e4c4f628a373d6e7471…
Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/debug/debug_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 7beceb447211d..f40ca4f09afce 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -1018,6 +1018,9 @@ void kgdb_panic(const char *msg)
if (panic_timeout)
return;
+ debug_locks_off();
+ console_flush_on_panic(CONSOLE_FLUSH_PENDING);
+
if (dbg_kdb_mode)
kdb_printf("PANIC: %s\n", msg);
--
2.42.0
From: Douglas Anderson <dianders(a)chromium.org>
[ Upstream commit dd712d3d45807db9fcae28a522deee85c1f2fde6 ]
When entering kdb/kgdb on a kernel panic, it was be observed that the
console isn't flushed before the `kdb` prompt came up. Specifically,
when using the buddy lockup detector on arm64 and running:
echo HARDLOCKUP > /sys/kernel/debug/provoke-crash/DIRECT
I could see:
[ 26.161099] lkdtm: Performing direct entry HARDLOCKUP
[ 32.499881] watchdog: Watchdog detected hard LOCKUP on cpu 6
[ 32.552865] Sending NMI from CPU 5 to CPUs 6:
[ 32.557359] NMI backtrace for cpu 6
... [backtrace for cpu 6] ...
[ 32.558353] NMI backtrace for cpu 5
... [backtrace for cpu 5] ...
[ 32.867471] Sending NMI from CPU 5 to CPUs 0-4,7:
[ 32.872321] NMI backtrace forP cpuANC: Hard LOCKUP
Entering kdb (current=..., pid 0) on processor 5 due to Keyboard Entry
[5]kdb>
As you can see, backtraces for the other CPUs start printing and get
interleaved with the kdb PANIC print.
Let's replicate the commands to flush the console in the kdb panic
entry point to avoid this.
Signed-off-by: Douglas Anderson <dianders(a)chromium.org>
Link: https://lore.kernel.org/r/20230822131945.1.I5b460ae8f954e4c4f628a373d6e7471…
Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/debug/debug_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index d5e9ccde3ab8e..3a904d8697c8f 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -1006,6 +1006,9 @@ void kgdb_panic(const char *msg)
if (panic_timeout)
return;
+ debug_locks_off();
+ console_flush_on_panic(CONSOLE_FLUSH_PENDING);
+
if (dbg_kdb_mode)
kdb_printf("PANIC: %s\n", msg);
--
2.42.0
From: Douglas Anderson <dianders(a)chromium.org>
[ Upstream commit dd712d3d45807db9fcae28a522deee85c1f2fde6 ]
When entering kdb/kgdb on a kernel panic, it was be observed that the
console isn't flushed before the `kdb` prompt came up. Specifically,
when using the buddy lockup detector on arm64 and running:
echo HARDLOCKUP > /sys/kernel/debug/provoke-crash/DIRECT
I could see:
[ 26.161099] lkdtm: Performing direct entry HARDLOCKUP
[ 32.499881] watchdog: Watchdog detected hard LOCKUP on cpu 6
[ 32.552865] Sending NMI from CPU 5 to CPUs 6:
[ 32.557359] NMI backtrace for cpu 6
... [backtrace for cpu 6] ...
[ 32.558353] NMI backtrace for cpu 5
... [backtrace for cpu 5] ...
[ 32.867471] Sending NMI from CPU 5 to CPUs 0-4,7:
[ 32.872321] NMI backtrace forP cpuANC: Hard LOCKUP
Entering kdb (current=..., pid 0) on processor 5 due to Keyboard Entry
[5]kdb>
As you can see, backtraces for the other CPUs start printing and get
interleaved with the kdb PANIC print.
Let's replicate the commands to flush the console in the kdb panic
entry point to avoid this.
Signed-off-by: Douglas Anderson <dianders(a)chromium.org>
Link: https://lore.kernel.org/r/20230822131945.1.I5b460ae8f954e4c4f628a373d6e7471…
Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/debug/debug_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index d5e9ccde3ab8e..3a904d8697c8f 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -1006,6 +1006,9 @@ void kgdb_panic(const char *msg)
if (panic_timeout)
return;
+ debug_locks_off();
+ console_flush_on_panic(CONSOLE_FLUSH_PENDING);
+
if (dbg_kdb_mode)
kdb_printf("PANIC: %s\n", msg);
--
2.42.0
From: Douglas Anderson <dianders(a)chromium.org>
[ Upstream commit dd712d3d45807db9fcae28a522deee85c1f2fde6 ]
When entering kdb/kgdb on a kernel panic, it was be observed that the
console isn't flushed before the `kdb` prompt came up. Specifically,
when using the buddy lockup detector on arm64 and running:
echo HARDLOCKUP > /sys/kernel/debug/provoke-crash/DIRECT
I could see:
[ 26.161099] lkdtm: Performing direct entry HARDLOCKUP
[ 32.499881] watchdog: Watchdog detected hard LOCKUP on cpu 6
[ 32.552865] Sending NMI from CPU 5 to CPUs 6:
[ 32.557359] NMI backtrace for cpu 6
... [backtrace for cpu 6] ...
[ 32.558353] NMI backtrace for cpu 5
... [backtrace for cpu 5] ...
[ 32.867471] Sending NMI from CPU 5 to CPUs 0-4,7:
[ 32.872321] NMI backtrace forP cpuANC: Hard LOCKUP
Entering kdb (current=..., pid 0) on processor 5 due to Keyboard Entry
[5]kdb>
As you can see, backtraces for the other CPUs start printing and get
interleaved with the kdb PANIC print.
Let's replicate the commands to flush the console in the kdb panic
entry point to avoid this.
Signed-off-by: Douglas Anderson <dianders(a)chromium.org>
Link: https://lore.kernel.org/r/20230822131945.1.I5b460ae8f954e4c4f628a373d6e7471…
Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/debug/debug_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 621037a0aa870..ce1bb2301c061 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -1006,6 +1006,9 @@ void kgdb_panic(const char *msg)
if (panic_timeout)
return;
+ debug_locks_off();
+ console_flush_on_panic(CONSOLE_FLUSH_PENDING);
+
if (dbg_kdb_mode)
kdb_printf("PANIC: %s\n", msg);
--
2.42.0
From: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.
Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/usb/gspca/cpia1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index e91d00762e94b..bf34479a87cc5 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -28,6 +28,7 @@
#include <linux/input.h>
#include <linux/sched/signal.h>
+#include <linux/bitops.h>
#include "gspca.h"
@@ -1032,6 +1033,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
sd->params.exposure.expMode = 2;
sd->exposure_status = EXPOSURE_NORMAL;
}
+ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+ return -EINVAL;
currentexp = currentexp << sd->params.exposure.gain;
sd->params.exposure.gain = 0;
/* round down current exposure to nearest value */
--
2.42.0
From: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.
Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/usb/gspca/cpia1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index 2b09af8865f40..5e785343528cc 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -28,6 +28,7 @@
#include <linux/input.h>
#include <linux/sched/signal.h>
+#include <linux/bitops.h>
#include "gspca.h"
@@ -1033,6 +1034,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
sd->params.exposure.expMode = 2;
sd->exposure_status = EXPOSURE_NORMAL;
}
+ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+ return -EINVAL;
currentexp = currentexp << sd->params.exposure.gain;
sd->params.exposure.gain = 0;
/* round down current exposure to nearest value */
--
2.42.0
From: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.
Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/usb/gspca/cpia1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index d93d384286c16..de945e13c7c6b 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -18,6 +18,7 @@
#include <linux/input.h>
#include <linux/sched/signal.h>
+#include <linux/bitops.h>
#include "gspca.h"
@@ -1027,6 +1028,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
sd->params.exposure.expMode = 2;
sd->exposure_status = EXPOSURE_NORMAL;
}
+ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+ return -EINVAL;
currentexp = currentexp << sd->params.exposure.gain;
sd->params.exposure.gain = 0;
/* round down current exposure to nearest value */
--
2.42.0
From: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.
Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/usb/gspca/cpia1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index d93d384286c16..de945e13c7c6b 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -18,6 +18,7 @@
#include <linux/input.h>
#include <linux/sched/signal.h>
+#include <linux/bitops.h>
#include "gspca.h"
@@ -1027,6 +1028,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
sd->params.exposure.expMode = 2;
sd->exposure_status = EXPOSURE_NORMAL;
}
+ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+ return -EINVAL;
currentexp = currentexp << sd->params.exposure.gain;
sd->params.exposure.gain = 0;
/* round down current exposure to nearest value */
--
2.42.0
From: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.
Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/usb/gspca/cpia1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index 46ed95483e222..5f5fa851ca640 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -18,6 +18,7 @@
#include <linux/input.h>
#include <linux/sched/signal.h>
+#include <linux/bitops.h>
#include "gspca.h"
@@ -1028,6 +1029,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
sd->params.exposure.expMode = 2;
sd->exposure_status = EXPOSURE_NORMAL;
}
+ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+ return -EINVAL;
currentexp = currentexp << sd->params.exposure.gain;
sd->params.exposure.gain = 0;
/* round down current exposure to nearest value */
--
2.42.0
From: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.
Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/usb/gspca/cpia1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index 46ed95483e222..5f5fa851ca640 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -18,6 +18,7 @@
#include <linux/input.h>
#include <linux/sched/signal.h>
+#include <linux/bitops.h>
#include "gspca.h"
@@ -1028,6 +1029,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
sd->params.exposure.expMode = 2;
sd->exposure_status = EXPOSURE_NORMAL;
}
+ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+ return -EINVAL;
currentexp = currentexp << sd->params.exposure.gain;
sd->params.exposure.gain = 0;
/* round down current exposure to nearest value */
--
2.42.0
From: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.
Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/usb/gspca/cpia1.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index 46ed95483e222..5f5fa851ca640 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -18,6 +18,7 @@
#include <linux/input.h>
#include <linux/sched/signal.h>
+#include <linux/bitops.h>
#include "gspca.h"
@@ -1028,6 +1029,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
sd->params.exposure.expMode = 2;
sd->exposure_status = EXPOSURE_NORMAL;
}
+ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+ return -EINVAL;
currentexp = currentexp << sd->params.exposure.gain;
sd->params.exposure.gain = 0;
/* round down current exposure to nearest value */
--
2.42.0
From: Axel Lin <axel.lin(a)ingics.com>
[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]
Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The
variable set here is later used as a divisor.
Signed-off-by: Axel Lin <axel.lin(a)ingics.com>
Acked-by: Boris Brezillon <boris.brezillon(a)free-electrons.com>
Signed-off-by: Wolfram Sang <wsa(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
index 7c07ce116e384..540c33f4e3500 100644
--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
@@ -202,6 +202,11 @@ static int p2wi_probe(struct platform_device *pdev)
return -EINVAL;
}
+ if (clk_freq == 0) {
+ dev_err(dev, "clock-frequency is set to 0 in DT\n");
+ return -EINVAL;
+ }
+
if (of_get_child_count(np) > 1) {
dev_err(dev, "P2WI only supports one slave device\n");
return -EINVAL;
--
2.42.0
From: Axel Lin <axel.lin(a)ingics.com>
[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]
Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The
variable set here is later used as a divisor.
Signed-off-by: Axel Lin <axel.lin(a)ingics.com>
Acked-by: Boris Brezillon <boris.brezillon(a)free-electrons.com>
Signed-off-by: Wolfram Sang <wsa(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
index 7c07ce116e384..540c33f4e3500 100644
--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
@@ -202,6 +202,11 @@ static int p2wi_probe(struct platform_device *pdev)
return -EINVAL;
}
+ if (clk_freq == 0) {
+ dev_err(dev, "clock-frequency is set to 0 in DT\n");
+ return -EINVAL;
+ }
+
if (of_get_child_count(np) > 1) {
dev_err(dev, "P2WI only supports one slave device\n");
return -EINVAL;
--
2.42.0
From: Axel Lin <axel.lin(a)ingics.com>
[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]
Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The
variable set here is later used as a divisor.
Signed-off-by: Axel Lin <axel.lin(a)ingics.com>
Acked-by: Boris Brezillon <boris.brezillon(a)free-electrons.com>
Signed-off-by: Wolfram Sang <wsa(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
index 7c07ce116e384..540c33f4e3500 100644
--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
@@ -202,6 +202,11 @@ static int p2wi_probe(struct platform_device *pdev)
return -EINVAL;
}
+ if (clk_freq == 0) {
+ dev_err(dev, "clock-frequency is set to 0 in DT\n");
+ return -EINVAL;
+ }
+
if (of_get_child_count(np) > 1) {
dev_err(dev, "P2WI only supports one slave device\n");
return -EINVAL;
--
2.42.0
From: Axel Lin <axel.lin(a)ingics.com>
[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]
Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The
variable set here is later used as a divisor.
Signed-off-by: Axel Lin <axel.lin(a)ingics.com>
Acked-by: Boris Brezillon <boris.brezillon(a)free-electrons.com>
Signed-off-by: Wolfram Sang <wsa(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
index 2f6f6468214dd..4f7a4f5a1150a 100644
--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
@@ -201,6 +201,11 @@ static int p2wi_probe(struct platform_device *pdev)
return -EINVAL;
}
+ if (clk_freq == 0) {
+ dev_err(dev, "clock-frequency is set to 0 in DT\n");
+ return -EINVAL;
+ }
+
if (of_get_child_count(np) > 1) {
dev_err(dev, "P2WI only supports one slave device\n");
return -EINVAL;
--
2.42.0
From: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]
Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.
Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.inte…
Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index af873a9be0507..dd2dc00399600 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)
unsigned int i;
bool handled = false;
- for (i = 0; mask && i < 8; i++) {
+ for (i = 0; mask && i < rings->total; i++) {
struct hci_rh_data *rh;
u32 status;
--
2.42.0
From: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]
Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.
Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.inte…
Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index 2990ac9eaade7..71b5dbe45c45c 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)
unsigned int i;
bool handled = false;
- for (i = 0; mask && i < 8; i++) {
+ for (i = 0; mask && i < rings->total; i++) {
struct hci_rh_data *rh;
u32 status;
--
2.42.0
From: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]
Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.
Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.inte…
Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index 2990ac9eaade7..71b5dbe45c45c 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)
unsigned int i;
bool handled = false;
- for (i = 0; mask && i < 8; i++) {
+ for (i = 0; mask && i < rings->total; i++) {
struct hci_rh_data *rh;
u32 status;
--
2.42.0
From: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]
Do not loop over ring headers in hci_dma_irq_handler() that are not
allocated and enabled in hci_dma_init(). Otherwise out of bounds access
will occur from rings->headers[i] access when i >= number of allocated
ring headers.
Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
Link: https://lore.kernel.org/r/20230921055704.1087277-5-jarkko.nikula@linux.inte…
Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index 2990ac9eaade7..71b5dbe45c45c 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)
unsigned int i;
bool handled = false;
- for (i = 0; mask && i < 8; i++) {
+ for (i = 0; mask && i < rings->total; i++) {
struct hci_rh_data *rh;
u32 status;
--
2.42.0
Greetings of the day,
We are inviting your esteemed company for vendor registration and
intending partners for Abu Dhabi National Oil Company (ADNOC)
2023/2024 projects.
These projects are open for all companies around the world, if
you have intention to participate in the process, please confirm
your interest by asking for Vendor Questionnaire and EOI.
We appreciate your interest in this invitation, and look forward
to your early response.
Kind Regards,
Mr. Mohamed Ghazi B.
Senior Project Manager
projects(a)adnoc-suppplier.com
Goededag,
Ik ben mevrouw Joanna Liu en een medewerker van Citi Bank Hong Kong.
Kan ik € 100.000.000 aan u overmaken? Kan ik je vertrouwen
Ik wacht op jullie reacties
Met vriendelijke groeten
mevrouw Joanna Liu
The patch titled
Subject: mm/damon/core.c: avoid unintentional filtering out of schemes
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-damon-corec-avoid-unintentional-filtering-out-of-schemes.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Hyeongtak Ji <hyeongtak.ji(a)gmail.com>
Subject: mm/damon/core.c: avoid unintentional filtering out of schemes
Date: Fri, 10 Nov 2023 14:37:09 +0900
The function '__damos_filter_out()' causes DAMON to always filter out
schemes whose filter type is anon or memcg if its matching value is set
to false.
This commit addresses the issue by ensuring that '__damos_filter_out()'
no longer applies to filters whose type is 'anon' or 'memcg'.
Link: https://lkml.kernel.org/r/1699594629-3816-1-git-send-email-hyeongtak.ji@gma…
Fixes: ab9bda001b681 ("mm/damon/core: introduce address range type damos filter")
Signed-off-by: Hyeongtak Ji <hyeongtak.ji(a)sk.com>
Reviewed-by: SeongJae Park <sj(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/damon/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/damon/core.c~mm-damon-corec-avoid-unintentional-filtering-out-of-schemes
+++ a/mm/damon/core.c
@@ -924,7 +924,7 @@ static bool __damos_filter_out(struct da
matched = true;
break;
default:
- break;
+ return false;
}
return matched == filter->matching;
_
Patches currently in -mm which might be from hyeongtak.ji(a)gmail.com are
mm-damon-corec-avoid-unintentional-filtering-out-of-schemes.patch
On Fri, 10 Nov 2023 18:22:40 +0000 SeongJae Park <sj(a)kernel.org> wrote:
> Hello Hyueongtak,
>
> On Fri, 10 Nov 2023 14:37:09 +0900 Hyeongtak Ji <hyeongtak.ji(a)gmail.com> wrote:
>
> > The function '__damos_filter_out()' causes DAMON to always filter out
> > schemes whose filter type is anon or memcg if its matching value is set
> > to false.
> >
> > This commit addresses the issue by ensuring that '__damos_filter_out()'
> > no longer applies to filters whose type is 'anon' or 'memcg'.
>
> Nice catch, thank you!
>
> checkpatch.pl shows one warning, though:
>
> WARNING: From:/Signed-off-by: email address mismatch: 'From: Hyeongtak Ji <hyeongtak.ji(a)gmail.com>' != 'Signed-off-by: Hyeongtak Ji <hyeongtak.ji(a)sk.com>'
>
Also, I think we need to add below?
Fixes: ab9bda001b68 ("mm/damon/core: introduce address range type damos filter")
Cc: <stable(a)vger.kernel.org> # 6.6.y
> >
> > Signed-off-by: Hyeongtak Ji <hyeongtak.ji(a)sk.com>
>
> Reviewed-by: SeongJae Park <sj(a)kernel.org>
Thanks,
SJ
[...]
Hello Friend,
My name is Jim Jones, I am a Laboratory Scientist in a leading multinational Pharmaceutical company and I have a business proposal for you. You do not need experience or expertise to participate and make good returns. Kindly respond if interested and I will provide details.
Jim
We need a similar drm_atomic_helper_buffer_damage_merged() helper function
that takes into account if a framebuffer attached to the plane has changed
since the last plane update (page-flip).
Since both damage helpers will share most of the current logic, move it to
an internal helper. The drm_atomic_helper_buffer_damage_merged() will have
to use a different drm_atomic_helper_buffer_damage_iter_init() function so
move that logic also to an internal helper.
Fixes: 01f05940a9a7 ("drm/virtio: Enable fb damage clips property for the primary plane")
Cc: <stable(a)vger.kernel.org> # v6.4+
Reported-by: nerdopolis <bluescreen_avenger(a)verizon.net>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218115
Suggested-by: Sima Vetter <daniel.vetter(a)ffwll.ch>
Signed-off-by: Javier Martinez Canillas <javierm(a)redhat.com>
---
drivers/gpu/drm/drm_damage_helper.c | 95 +++++++++++++++++------------
1 file changed, 55 insertions(+), 40 deletions(-)
diff --git a/drivers/gpu/drm/drm_damage_helper.c b/drivers/gpu/drm/drm_damage_helper.c
index d8b2955e88fd..aa2325567918 100644
--- a/drivers/gpu/drm/drm_damage_helper.c
+++ b/drivers/gpu/drm/drm_damage_helper.c
@@ -201,28 +201,10 @@ int drm_atomic_helper_dirtyfb(struct drm_framebuffer *fb,
}
EXPORT_SYMBOL(drm_atomic_helper_dirtyfb);
-/**
- * drm_atomic_helper_damage_iter_init - Initialize the damage iterator.
- * @iter: The iterator to initialize.
- * @old_state: Old plane state for validation.
- * @state: Plane state from which to iterate the damage clips.
- *
- * Initialize an iterator, which clips plane damage
- * &drm_plane_state.fb_damage_clips to plane &drm_plane_state.src. This iterator
- * returns full plane src in case damage is not present because either
- * user-space didn't sent or driver discarded it (it want to do full plane
- * update). Currently this iterator returns full plane src in case plane src
- * changed but that can be changed in future to return damage.
- *
- * For the case when plane is not visible or plane update should not happen the
- * first call to iter_next will return false. Note that this helper use clipped
- * &drm_plane_state.src, so driver calling this helper should have called
- * drm_atomic_helper_check_plane_state() earlier.
- */
-void
-drm_atomic_helper_damage_iter_init(struct drm_atomic_helper_damage_iter *iter,
- const struct drm_plane_state *old_state,
- const struct drm_plane_state *state)
+static void
+__drm_atomic_helper_damage_iter_init(struct drm_atomic_helper_damage_iter *iter,
+ const struct drm_plane_state *old_state,
+ const struct drm_plane_state *state)
{
struct drm_rect src;
memset(iter, 0, sizeof(*iter));
@@ -247,6 +229,32 @@ drm_atomic_helper_damage_iter_init(struct drm_atomic_helper_damage_iter *iter,
iter->full_update = true;
}
}
+
+/**
+ * drm_atomic_helper_damage_iter_init - Initialize the damage iterator.
+ * @iter: The iterator to initialize.
+ * @old_state: Old plane state for validation.
+ * @state: Plane state from which to iterate the damage clips.
+ *
+ * Initialize an iterator, which clips plane damage
+ * &drm_plane_state.fb_damage_clips to plane &drm_plane_state.src. This iterator
+ * returns full plane src in case damage is not present because either
+ * user-space didn't sent or driver discarded it (it want to do full plane
+ * update). Currently this iterator returns full plane src in case plane src
+ * changed but that can be changed in future to return damage.
+ *
+ * For the case when plane is not visible or plane update should not happen the
+ * first call to iter_next will return false. Note that this helper use clipped
+ * &drm_plane_state.src, so driver calling this helper should have called
+ * drm_atomic_helper_check_plane_state() earlier.
+ */
+void
+drm_atomic_helper_damage_iter_init(struct drm_atomic_helper_damage_iter *iter,
+ const struct drm_plane_state *old_state,
+ const struct drm_plane_state *state)
+{
+ __drm_atomic_helper_damage_iter_init(iter, old_state, state);
+}
EXPORT_SYMBOL(drm_atomic_helper_damage_iter_init);
/**
@@ -291,24 +299,9 @@ drm_atomic_helper_damage_iter_next(struct drm_atomic_helper_damage_iter *iter,
}
EXPORT_SYMBOL(drm_atomic_helper_damage_iter_next);
-/**
- * drm_atomic_helper_damage_merged - Merged plane damage
- * @old_state: Old plane state for validation.
- * @state: Plane state from which to iterate the damage clips.
- * @rect: Returns the merged damage rectangle
- *
- * This function merges any valid plane damage clips into one rectangle and
- * returns it in @rect.
- *
- * For details see: drm_atomic_helper_damage_iter_init() and
- * drm_atomic_helper_damage_iter_next().
- *
- * Returns:
- * True if there is valid plane damage otherwise false.
- */
-bool drm_atomic_helper_damage_merged(const struct drm_plane_state *old_state,
- struct drm_plane_state *state,
- struct drm_rect *rect)
+static bool __drm_atomic_helper_damage_merged(const struct drm_plane_state *old_state,
+ struct drm_plane_state *state,
+ struct drm_rect *rect)
{
struct drm_atomic_helper_damage_iter iter;
struct drm_rect clip;
@@ -330,4 +323,26 @@ bool drm_atomic_helper_damage_merged(const struct drm_plane_state *old_state,
return valid;
}
+
+/**
+ * drm_atomic_helper_damage_merged - Merged plane damage
+ * @old_state: Old plane state for validation.
+ * @state: Plane state from which to iterate the damage clips.
+ * @rect: Returns the merged damage rectangle
+ *
+ * This function merges any valid plane damage clips into one rectangle and
+ * returns it in @rect.
+ *
+ * For details see: drm_atomic_helper_damage_iter_init() and
+ * drm_atomic_helper_damage_iter_next().
+ *
+ * Returns:
+ * True if there is valid plane damage otherwise false.
+ */
+bool drm_atomic_helper_damage_merged(const struct drm_plane_state *old_state,
+ struct drm_plane_state *state,
+ struct drm_rect *rect)
+{
+ return __drm_atomic_helper_damage_merged(old_state, state, rect);
+}
EXPORT_SYMBOL(drm_atomic_helper_damage_merged);
--
2.41.0
From: Anthony Krowiak <akrowiak(a)linux.ibm.com>
In the vfio_ap_irq_enable function, after the page containing the
notification indicator byte (NIB) is pinned, the function attempts
to register the guest ISC. If registration fails, the function sets the
status response code and returns without unpinning the page containing
the NIB. In order to avoid a memory leak, the NIB should be unpinned before
returning from the vfio_ap_irq_enable function.
Co-developed-by: Janosch Frank <frankja(a)linux.ibm.com>
Signed-off-by: Janosch Frank <frankja(a)linux.ibm.com>
Signed-off-by: Anthony Krowiak <akrowiak(a)linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato(a)linux.ibm.com>
Fixes: 783f0a3ccd79 ("s390/vfio-ap: add s390dbf logging to the vfio_ap_irq_enable function")
Cc: <stable(a)vger.kernel.org>
---
drivers/s390/crypto/vfio_ap_ops.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
index 4db538a55192..9cb28978c186 100644
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -457,6 +457,7 @@ static struct ap_queue_status vfio_ap_irq_enable(struct vfio_ap_queue *q,
VFIO_AP_DBF_WARN("%s: gisc registration failed: nisc=%d, isc=%d, apqn=%#04x\n",
__func__, nisc, isc, q->apqn);
+ vfio_unpin_pages(&q->matrix_mdev->vdev, nib, 1);
status.response_code = AP_RESPONSE_INVALID_GISA;
return status;
}
--
2.41.0
Though we do check the event ring read pointer by "is_valid_ring_ptr"
to make sure it is in the buffer range, but there is another risk the
pointer may be not aligned. Since we are expecting event ring elements
are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer
could lead to multiple issues like DoS or ring buffer memory corruption.
So add a alignment check for event ring read pointer.
Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use")
cc: stable(a)vger.kernel.org
Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com>
---
Changes in v2:
- Change the modulus operation to bit-wise & operation as suggested by Jeff.
- Link to v1: https://lore.kernel.org/r/20231023-alignment_check-v1-1-2ca5716d5c15@quicin…
---
drivers/bus/mhi/host/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c
index 499590437e9b..e765c16a99d1 100644
--- a/drivers/bus/mhi/host/main.c
+++ b/drivers/bus/mhi/host/main.c
@@ -268,7 +268,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl,
static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr)
{
- return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len;
+ return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len &&
+ !(addr & (sizeof(struct mhi_ring_element) - 1));
}
int mhi_destroy_device(struct device *dev, void *data)
---
base-commit: 71e68e182e382e951d6248bccc3c960dcec5a718
change-id: 20231013-alignment_check-c013f509d24a
Best regards,
--
Krishna chaitanya chundru <quic_krichai(a)quicinc.com>
From: Petr Tesarik <petr.tesarik1(a)huawei-partners.com>
Limit the free list length to the size of the IO TLB. Transient pool can be
smaller than IO_TLB_SEGSIZE, but the free list is initialized with the
assumption that the total number of slots is a multiple of IO_TLB_SEGSIZE.
As a result, swiotlb_area_find_slots() may allocate slots past the end of
a transient IO TLB buffer.
Reported-by: Niklas Schnelle <schnelle(a)linux.ibm.com>
Closes: https://lore.kernel.org/linux-iommu/104a8c8fedffd1ff8a2890983e2ec1c26bff681…
Fixes: 79636caad361 ("swiotlb: if swiotlb is full, fall back to a transient memory pool")
Cc: Halil Pasic <pasic(a)linux.ibm.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Petr Tesarik <petr.tesarik1(a)huawei-partners.com>
---
kernel/dma/swiotlb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index 26202274784f..ec82524ba902 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -283,7 +283,8 @@ static void swiotlb_init_io_tlb_pool(struct io_tlb_pool *mem, phys_addr_t start,
}
for (i = 0; i < mem->nslabs; i++) {
- mem->slots[i].list = IO_TLB_SEGSIZE - io_tlb_offset(i);
+ mem->slots[i].list = min(IO_TLB_SEGSIZE - io_tlb_offset(i),
+ mem->nslabs - i);
mem->slots[i].orig_addr = INVALID_PHYS_ADDR;
mem->slots[i].alloc_size = 0;
}
--
2.42.1
From: Christian König <christian.koenig(a)amd.com>
When a fence signals there is a very small race window where the timestamp
isn't updated yet. sync_file solves this by busy waiting for the
timestamp to appear, but on other ocassions didn't handled this
correctly.
Provide a dma_fence_timestamp() helper function for this and use it in
all appropriate cases.
Another alternative would be to grab the spinlock when that happens.
v2 by teddy: add a wait parameter to wait for the timestamp to show up, in case
the accurate timestamp is needed and/or the timestamp is not based on
ktime (e.g. hw timestamp)
v3 chk: drop the parameter again for unified handling
Signed-off-by: Yunxiang Li <Yunxiang.Li(a)amd.com>
Signed-off-by: Christian König <christian.koenig(a)amd.com>
Fixes: 1774baa64f93 ("drm/scheduler: Change scheduled fence track v2")
Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com>
CC: stable(a)vger.kernel.org
Link: https://patchwork.freedesktop.org/patch/msgid/20230929104725.2358-1-christi…
(cherry picked from commit 0da611a8702101814257a7c03f6caf0574c83b98)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
---
drivers/dma-buf/dma-fence-unwrap.c | 13 ++++---------
drivers/dma-buf/sync_file.c | 9 +++------
drivers/gpu/drm/scheduler/sched_main.c | 2 +-
include/linux/dma-fence.h | 19 +++++++++++++++++++
4 files changed, 27 insertions(+), 16 deletions(-)
diff --git a/drivers/dma-buf/dma-fence-unwrap.c b/drivers/dma-buf/dma-fence-unwrap.c
index c625bb2b5d56..628af51c81af 100644
--- a/drivers/dma-buf/dma-fence-unwrap.c
+++ b/drivers/dma-buf/dma-fence-unwrap.c
@@ -76,16 +76,11 @@ struct dma_fence *__dma_fence_unwrap_merge(unsigned int num_fences,
dma_fence_unwrap_for_each(tmp, &iter[i], fences[i]) {
if (!dma_fence_is_signaled(tmp)) {
++count;
- } else if (test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT,
- &tmp->flags)) {
- if (ktime_after(tmp->timestamp, timestamp))
- timestamp = tmp->timestamp;
} else {
- /*
- * Use the current time if the fence is
- * currently signaling.
- */
- timestamp = ktime_get();
+ ktime_t t = dma_fence_timestamp(tmp);
+
+ if (ktime_after(t, timestamp))
+ timestamp = t;
}
}
}
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index af57799c86ce..2e9a316c596a 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -268,13 +268,10 @@ static int sync_fill_fence_info(struct dma_fence *fence,
sizeof(info->driver_name));
info->status = dma_fence_get_status(fence);
- while (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags) &&
- !test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags))
- cpu_relax();
info->timestamp_ns =
- test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags) ?
- ktime_to_ns(fence->timestamp) :
- ktime_set(0, 0);
+ dma_fence_is_signaled(fence) ?
+ ktime_to_ns(dma_fence_timestamp(fence)) :
+ ktime_set(0, 0);
return info->status;
}
diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index fd755e953487..99797a8c836a 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -935,7 +935,7 @@ drm_sched_get_cleanup_job(struct drm_gpu_scheduler *sched)
if (next) {
next->s_fence->scheduled.timestamp =
- job->s_fence->finished.timestamp;
+ dma_fence_timestamp(&job->s_fence->finished);
/* start TO timer for next job */
drm_sched_start_timeout(sched);
}
diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index 0d678e9a7b24..ebe78bd3d121 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -568,6 +568,25 @@ static inline void dma_fence_set_error(struct dma_fence *fence,
fence->error = error;
}
+/**
+ * dma_fence_timestamp - helper to get the completion timestamp of a fence
+ * @fence: fence to get the timestamp from.
+ *
+ * After a fence is signaled the timestamp is updated with the signaling time,
+ * but setting the timestamp can race with tasks waiting for the signaling. This
+ * helper busy waits for the correct timestamp to appear.
+ */
+static inline ktime_t dma_fence_timestamp(struct dma_fence *fence)
+{
+ if (WARN_ON(!test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)))
+ return ktime_get();
+
+ while (!test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags))
+ cpu_relax();
+
+ return fence->timestamp;
+}
+
signed long dma_fence_wait_timeout(struct dma_fence *,
bool intr, signed long timeout);
signed long dma_fence_wait_any_timeout(struct dma_fence **fences,
--
2.41.0
If VF NIC is registered earlier, NETDEV_REGISTER event is replayed,
but NETDEV_POST_INIT is not.
Move register_netdevice_notifier() earlier, so the call back
function is set before probing.
Cc: stable(a)vger.kernel.org
Fixes: e04e7a7bbd4b ("hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()")
Signed-off-by: Haiyang Zhang <haiyangz(a)microsoft.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek(a)intel.com>
---
v3:
Divide it into two patches, suggested by Jakub Kicinski.
v2:
Fix rtnl_unlock() in error handling as found by Wojciech Drewek.
---
drivers/net/hyperv/netvsc_drv.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 5e528a76f5f5..1d1491da303b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2793,11 +2793,14 @@ static int __init netvsc_drv_init(void)
}
netvsc_ring_bytes = ring_size * PAGE_SIZE;
+ register_netdevice_notifier(&netvsc_netdev_notifier);
+
ret = vmbus_driver_register(&netvsc_drv);
- if (ret)
+ if (ret) {
+ unregister_netdevice_notifier(&netvsc_netdev_notifier);
return ret;
+ }
- register_netdevice_notifier(&netvsc_netdev_notifier);
return 0;
}
--
2.25.1
From: Dongli Zhang <dongli.zhang(a)oracle.com>
[ Upstream commit 1978f30a87732d4d9072a20abeded9fe17884f1b ]
When tag_set->nr_maps is 1, the block layer limits the number of hw queues
by nr_cpu_ids. No matter how many hw queues are used by virtio-scsi, as it
has (tag_set->nr_maps == 1), it can use at most nr_cpu_ids hw queues.
In addition, specifically for pci scenario, when the 'num_queues' specified
by qemu is more than maxcpus, virtio-scsi would not be able to allocate
more than maxcpus vectors in order to have a vector for each queue. As a
result, it falls back into MSI-X with one vector for config and one shared
for queues.
Considering above reasons, this patch limits the number of hw queues used
by virtio-scsi by nr_cpu_ids.
Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com>
Signed-off-by: Dongli Zhang <dongli.zhang(a)oracle.com>
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com>
---
drivers/scsi/virtio_scsi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 2839701ffab5..427bd88c1647 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -891,6 +891,7 @@ static int virtscsi_probe(struct virtio_device *vdev)
/* We need to know how many queues before we allocate. */
num_queues = virtscsi_config_get(vdev, num_queues) ? : 1;
+ num_queues = min_t(unsigned int, nr_cpu_ids, num_queues);
num_targets = virtscsi_config_get(vdev, max_target) + 1;
--
2.33.0
Add error handling to check NULL input in
mtk_drm_crtc_dma_dev_get function.
While display path is not configured correctly, none of crtc is
established. So the caller of mtk_drm_crtc_dma_dev_get may pass
input parameter *crtc as NULL, Which may cause coredump when
we try to get the container of NULL pointer.
Fixes: cb1d6bcca542 ("drm/mediatek: Add dma dev get function")
Signed-off-by: Stuart Lee <stuart.lee(a)mediatek.com>
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index c277b9fae950..047c9a31d306 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -921,7 +921,14 @@ static int mtk_drm_crtc_init_comp_planes(struct drm_device *drm_dev,
struct device *mtk_drm_crtc_dma_dev_get(struct drm_crtc *crtc)
{
- struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
+ struct mtk_drm_crtc *mtk_crtc = NULL;
+
+ if (!crtc)
+ return NULL;
+
+ mtk_crtc = to_mtk_crtc(crtc);
+ if (!mtk_crtc)
+ return NULL;
return mtk_crtc->dma_dev;
}
--
2.18.0
Convert vmf->page to a folio as soon as we're going to use it. This fixes
a bug if the fault handler returns a tail page with hardware poison;
tail pages have an invalid page->index, so we would fail to unmap the
page from the page tables. We actually have to unmap the entire folio (or
mapping_evict_folio() will fail), so use unmap_mapping_folio() instead.
This also saves various calls to compound_head() hidden in lock_page(),
put_page(), etc.
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Fixes: 793917d997df ("mm/readahead: Add large folio readahead")
Cc: stable(a)vger.kernel.org
---
mm/memory.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/mm/memory.c b/mm/memory.c
index 1f18ed4a5497..c2ee303ba6b3 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4239,6 +4239,7 @@ static vm_fault_t do_anonymous_page(struct vm_fault *vmf)
static vm_fault_t __do_fault(struct vm_fault *vmf)
{
struct vm_area_struct *vma = vmf->vma;
+ struct folio *folio;
vm_fault_t ret;
/*
@@ -4267,27 +4268,26 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
VM_FAULT_DONE_COW)))
return ret;
+ folio = page_folio(vmf->page);
if (unlikely(PageHWPoison(vmf->page))) {
- struct page *page = vmf->page;
vm_fault_t poisonret = VM_FAULT_HWPOISON;
if (ret & VM_FAULT_LOCKED) {
- if (page_mapped(page))
- unmap_mapping_pages(page_mapping(page),
- page->index, 1, false);
- /* Retry if a clean page was removed from the cache. */
- if (invalidate_inode_page(page))
+ if (page_mapped(vmf->page))
+ unmap_mapping_folio(folio);
+ /* Retry if a clean folio was removed from the cache. */
+ if (mapping_evict_folio(folio->mapping, folio))
poisonret = VM_FAULT_NOPAGE;
- unlock_page(page);
+ folio_unlock(folio);
}
- put_page(page);
+ folio_put(folio);
vmf->page = NULL;
return poisonret;
}
if (unlikely(!(ret & VM_FAULT_LOCKED)))
- lock_page(vmf->page);
+ folio_lock(folio);
else
- VM_BUG_ON_PAGE(!PageLocked(vmf->page), vmf->page);
+ VM_BUG_ON_PAGE(!folio_test_locked(folio), vmf->page);
return ret;
}
--
2.42.0
The patch titled
Subject: mm-fix-for-negative-counter-nr_file_hugepages-v3
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-fix-for-negative-counter-nr_file_hugepages-v3.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Stefan Roesch <shr(a)devkernel.io>
Subject: mm-fix-for-negative-counter-nr_file_hugepages-v3
Date: Wed, 8 Nov 2023 09:15:17 -0800
test for folio_test_pmd_mappable()
Link: https://lkml.kernel.org/r/20231108171517.2436103-1-shr@devkernel.io
Signed-off-by: Stefan Roesch <shr(a)devkernel.io>
Co-debugged-by: Johannes Weiner <hannes(a)cmpxchg.org>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/huge_memory.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
--- a/mm/huge_memory.c~mm-fix-for-negative-counter-nr_file_hugepages-v3
+++ a/mm/huge_memory.c
@@ -2769,13 +2769,15 @@ int split_huge_page_to_list(struct page
int nr = folio_nr_pages(folio);
xas_split(&xas, folio, folio_order(folio));
- if (folio_test_swapbacked(folio)) {
- __lruvec_stat_mod_folio(folio, NR_SHMEM_THPS,
- -nr);
- } else if (folio_test_pmd_mappable(folio)) {
- __lruvec_stat_mod_folio(folio, NR_FILE_THPS,
- -nr);
- filemap_nr_thps_dec(mapping);
+ if (folio_test_pmd_mappable(folio)) {
+ if (folio_test_swapbacked(folio)) {
+ __lruvec_stat_mod_folio(folio,
+ NR_SHMEM_THPS, -nr);
+ } else {
+ __lruvec_stat_mod_folio(folio,
+ NR_FILE_THPS, -nr);
+ filemap_nr_thps_dec(mapping);
+ }
}
}
_
Patches currently in -mm which might be from shr(a)devkernel.io are
mm-fix-for-negative-counter-nr_file_hugepages.patch
mm-fix-for-negative-counter-nr_file_hugepages-v3.patch
From: Roger Pau Monne <roger.pau(a)citrix.com>
The Processor capability bits notify ACPI of the OS capabilities, and
so ACPI can adjust the return of other Processor methods taking the OS
capabilities into account.
When Linux is running as a Xen dom0, the hypervisor is the entity
in charge of processor power management, and hence Xen needs to make
sure the capabilities reported by _OSC/_PDC match the capabilities of
the driver in Xen.
Introduce a small helper to sanitize the buffer when running as Xen
dom0.
When Xen supports HWP, this serves as the equivalent of commit
a21211672c9a ("ACPI / processor: Request native thermal interrupt
handling via _OSC") to avoid SMM crashes. Xen will set bit
ACPI_PROC_CAP_COLLAB_PROC_PERF (bit 12) in the capability bits and the
_OSC/_PDC call will apply it.
[ jandryuk: Mention Xen HWP's need. Support _OSC & _PDC ]
Signed-off-by: Roger Pau Monné <roger.pau(a)citrix.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Jason Andryuk <jandryuk(a)gmail.com>
Reviewed-by: Michal Wilczynski <michal.wilczynski(a)intel.com>
Reviewed-by: Juergen Gross <jgross(a)suse.com>
---
v5:
Only update caps on hypercall success - Roger
Add Juergen & Michal Reviewed-by: - hopefully okay with above change
v4:
Use xen_santize_proc_cap_bits() name - Michal
Rephrase comment - Michal
v3:
Move xen_sanitize_pdc() call to arch_acpi_set_proc_cap_bits() to cover
_OSC and _PDC.
drivers/xen/pcpu.c is CONFIG_DOM0 && CONFIG_X86
v2:
Move local variables in acpi_processor_eval_pdc() to reuse in both conditions.
---
arch/x86/include/asm/acpi.h | 14 ++++++++++++++
arch/x86/include/asm/xen/hypervisor.h | 9 +++++++++
drivers/xen/pcpu.c | 22 ++++++++++++++++++++++
3 files changed, 45 insertions(+)
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index c8a7fc23f63c..f896eed4516c 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -16,6 +16,9 @@
#include <asm/x86_init.h>
#include <asm/cpufeature.h>
#include <asm/irq_vectors.h>
+#include <asm/xen/hypervisor.h>
+
+#include <xen/xen.h>
#ifdef CONFIG_ACPI_APEI
# include <asm/pgtable_types.h>
@@ -127,6 +130,17 @@ static inline void arch_acpi_set_proc_cap_bits(u32 *cap)
if (!cpu_has(c, X86_FEATURE_MWAIT) ||
boot_option_idle_override == IDLE_NOMWAIT)
*cap &= ~(ACPI_PROC_CAP_C_C1_FFH | ACPI_PROC_CAP_C_C2C3_FFH);
+
+ if (xen_initial_domain()) {
+ /*
+ * When Linux is running as Xen dom0, the hypervisor is the
+ * entity in charge of the processor power management, and so
+ * Xen needs to check the OS capabilities reported in the
+ * processor capabilities buffer matches what the hypervisor
+ * driver supports.
+ */
+ xen_sanitize_proc_cap_bits(cap);
+ }
}
static inline bool acpi_has_cpu_in_madt(void)
diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
index 7048dfacc04b..a9088250770f 100644
--- a/arch/x86/include/asm/xen/hypervisor.h
+++ b/arch/x86/include/asm/xen/hypervisor.h
@@ -100,4 +100,13 @@ static inline void leave_lazy(enum xen_lazy_mode mode)
enum xen_lazy_mode xen_get_lazy_mode(void);
+#if defined(CONFIG_XEN_DOM0) && defined(CONFIG_ACPI)
+void xen_sanitize_proc_cap_bits(uint32_t *buf);
+#else
+static inline void xen_sanitize_proc_cap_bits(uint32_t *buf)
+{
+ BUG();
+}
+#endif
+
#endif /* _ASM_X86_XEN_HYPERVISOR_H */
diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c
index b3e3d1bb37f3..508655273145 100644
--- a/drivers/xen/pcpu.c
+++ b/drivers/xen/pcpu.c
@@ -47,6 +47,9 @@
#include <asm/xen/hypervisor.h>
#include <asm/xen/hypercall.h>
+#ifdef CONFIG_ACPI
+#include <acpi/processor.h>
+#endif
/*
* @cpu_id: Xen physical cpu logic number
@@ -400,4 +403,23 @@ bool __init xen_processor_present(uint32_t acpi_id)
return online;
}
+
+void xen_sanitize_proc_cap_bits(uint32_t *cap)
+{
+ struct xen_platform_op op = {
+ .cmd = XENPF_set_processor_pminfo,
+ .u.set_pminfo.id = -1,
+ .u.set_pminfo.type = XEN_PM_PDC,
+ };
+ u32 buf[3] = { ACPI_PDC_REVISION_ID, 1, *cap };
+ int ret;
+
+ set_xen_guest_handle(op.u.set_pminfo.pdc, buf);
+ ret = HYPERVISOR_platform_op(&op);
+ if (ret)
+ pr_err("sanitize of _PDC buffer bits from Xen failed: %d\n",
+ ret);
+ else
+ *cap = buf[2];
+}
#endif
--
2.41.0
The patch titled
Subject: mm: remove invalidate_inode_page()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-remove-invalidate_inode_page.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm: remove invalidate_inode_page()
Date: Wed, 8 Nov 2023 18:28:09 +0000
All callers are now converted to call mapping_evict_folio().
Link: https://lkml.kernel.org/r/20231108182809.602073-7-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/internal.h | 1 -
mm/truncate.c | 11 ++---------
2 files changed, 2 insertions(+), 10 deletions(-)
--- a/mm/internal.h~mm-remove-invalidate_inode_page
+++ a/mm/internal.h
@@ -139,7 +139,6 @@ int truncate_inode_folio(struct address_
bool truncate_inode_partial_folio(struct folio *folio, loff_t start,
loff_t end);
long mapping_evict_folio(struct address_space *mapping, struct folio *folio);
-long invalidate_inode_page(struct page *page);
unsigned long mapping_try_invalidate(struct address_space *mapping,
pgoff_t start, pgoff_t end, unsigned long *nr_failed);
--- a/mm/truncate.c~mm-remove-invalidate_inode_page
+++ a/mm/truncate.c
@@ -294,13 +294,6 @@ long mapping_evict_folio(struct address_
return remove_mapping(mapping, folio);
}
-long invalidate_inode_page(struct page *page)
-{
- struct folio *folio = page_folio(page);
-
- return mapping_evict_folio(folio_mapping(folio), folio);
-}
-
/**
* truncate_inode_pages_range - truncate range of pages specified by start & end byte offsets
* @mapping: mapping to truncate
@@ -559,9 +552,9 @@ unsigned long invalidate_mapping_pages(s
EXPORT_SYMBOL(invalidate_mapping_pages);
/*
- * This is like invalidate_inode_page(), except it ignores the page's
+ * This is like mapping_evict_folio(), except it ignores the folio's
* refcount. We do this because invalidate_inode_pages2() needs stronger
- * invalidation guarantees, and cannot afford to leave pages behind because
+ * invalidation guarantees, and cannot afford to leave folios behind because
* shrink_page_list() has a temp ref on them, or because they're transiently
* sitting in the folio_add_lru() caches.
*/
_
Patches currently in -mm which might be from willy(a)infradead.org are
mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios.patch
mm-convert-__do_fault-to-use-a-folio.patch
mm-use-mapping_evict_folio-in-truncate_error_page.patch
mm-convert-soft_offline_in_use_page-to-use-a-folio.patch
mm-convert-isolate_page-to-mf_isolate_folio.patch
mm-remove-invalidate_inode_page.patch
The patch titled
Subject: mm: convert isolate_page() to mf_isolate_folio()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-convert-isolate_page-to-mf_isolate_folio.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm: convert isolate_page() to mf_isolate_folio()
Date: Wed, 8 Nov 2023 18:28:08 +0000
The only caller now has a folio, so pass it in and operate on it. Saves
many page->folio conversions and introduces only one folio->page
conversion when calling isolate_movable_page().
Link: https://lkml.kernel.org/r/20231108182809.602073-6-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory-failure.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
--- a/mm/memory-failure.c~mm-convert-isolate_page-to-mf_isolate_folio
+++ a/mm/memory-failure.c
@@ -2602,37 +2602,37 @@ unlock_mutex:
}
EXPORT_SYMBOL(unpoison_memory);
-static bool isolate_page(struct page *page, struct list_head *pagelist)
+static bool mf_isolate_folio(struct folio *folio, struct list_head *pagelist)
{
bool isolated = false;
- if (PageHuge(page)) {
- isolated = isolate_hugetlb(page_folio(page), pagelist);
+ if (folio_test_hugetlb(folio)) {
+ isolated = isolate_hugetlb(folio, pagelist);
} else {
- bool lru = !__PageMovable(page);
+ bool lru = !__folio_test_movable(folio);
if (lru)
- isolated = isolate_lru_page(page);
+ isolated = folio_isolate_lru(folio);
else
- isolated = isolate_movable_page(page,
+ isolated = isolate_movable_page(&folio->page,
ISOLATE_UNEVICTABLE);
if (isolated) {
- list_add(&page->lru, pagelist);
+ list_add(&folio->lru, pagelist);
if (lru)
- inc_node_page_state(page, NR_ISOLATED_ANON +
- page_is_file_lru(page));
+ node_stat_add_folio(folio, NR_ISOLATED_ANON +
+ folio_is_file_lru(folio));
}
}
/*
- * If we succeed to isolate the page, we grabbed another refcount on
- * the page, so we can safely drop the one we got from get_any_page().
- * If we failed to isolate the page, it means that we cannot go further
+ * If we succeed to isolate the folio, we grabbed another refcount on
+ * the folio, so we can safely drop the one we got from get_any_page().
+ * If we failed to isolate the folio, it means that we cannot go further
* and we will return an error, so drop the reference we got from
* get_any_page() as well.
*/
- put_page(page);
+ folio_put(folio);
return isolated;
}
@@ -2686,7 +2686,7 @@ static int soft_offline_in_use_page(stru
return 0;
}
- if (isolate_page(&folio->page, &pagelist)) {
+ if (mf_isolate_folio(folio, &pagelist)) {
ret = migrate_pages(&pagelist, alloc_migration_target, NULL,
(unsigned long)&mtc, MIGRATE_SYNC, MR_MEMORY_FAILURE, NULL);
if (!ret) {
_
Patches currently in -mm which might be from willy(a)infradead.org are
mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios.patch
mm-convert-__do_fault-to-use-a-folio.patch
mm-use-mapping_evict_folio-in-truncate_error_page.patch
mm-convert-soft_offline_in_use_page-to-use-a-folio.patch
mm-convert-isolate_page-to-mf_isolate_folio.patch
mm-remove-invalidate_inode_page.patch
The patch titled
Subject: mm: convert soft_offline_in_use_page() to use a folio
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-convert-soft_offline_in_use_page-to-use-a-folio.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm: convert soft_offline_in_use_page() to use a folio
Date: Wed, 8 Nov 2023 18:28:07 +0000
Replace the existing head-page logic with folio logic.
Link: https://lkml.kernel.org/r/20231108182809.602073-5-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory-failure.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/mm/memory-failure.c~mm-convert-soft_offline_in_use_page-to-use-a-folio
+++ a/mm/memory-failure.c
@@ -2645,40 +2645,40 @@ static int soft_offline_in_use_page(stru
{
long ret = 0;
unsigned long pfn = page_to_pfn(page);
- struct page *hpage = compound_head(page);
+ struct folio *folio = page_folio(page);
char const *msg_page[] = {"page", "hugepage"};
- bool huge = PageHuge(page);
+ bool huge = folio_test_hugetlb(folio);
LIST_HEAD(pagelist);
struct migration_target_control mtc = {
.nid = NUMA_NO_NODE,
.gfp_mask = GFP_USER | __GFP_MOVABLE | __GFP_RETRY_MAYFAIL,
};
- if (!huge && PageTransHuge(hpage)) {
+ if (!huge && folio_test_large(folio)) {
if (try_to_split_thp_page(page)) {
pr_info("soft offline: %#lx: thp split failed\n", pfn);
return -EBUSY;
}
- hpage = page;
+ folio = page_folio(page);
}
- lock_page(page);
+ folio_lock(folio);
if (!huge)
- wait_on_page_writeback(page);
+ folio_wait_writeback(folio);
if (PageHWPoison(page)) {
- unlock_page(page);
- put_page(page);
+ folio_unlock(folio);
+ folio_put(folio);
pr_info("soft offline: %#lx page already poisoned\n", pfn);
return 0;
}
- if (!huge && PageLRU(page) && !PageSwapCache(page))
+ if (!huge && folio_test_lru(folio) && !folio_test_swapcache(folio))
/*
* Try to invalidate first. This should work for
* non dirty unmapped page cache pages.
*/
- ret = invalidate_inode_page(page);
- unlock_page(page);
+ ret = mapping_evict_folio(folio_mapping(folio), folio);
+ folio_unlock(folio);
if (ret) {
pr_info("soft_offline: %#lx: invalidated\n", pfn);
@@ -2686,7 +2686,7 @@ static int soft_offline_in_use_page(stru
return 0;
}
- if (isolate_page(hpage, &pagelist)) {
+ if (isolate_page(&folio->page, &pagelist)) {
ret = migrate_pages(&pagelist, alloc_migration_target, NULL,
(unsigned long)&mtc, MIGRATE_SYNC, MR_MEMORY_FAILURE, NULL);
if (!ret) {
_
Patches currently in -mm which might be from willy(a)infradead.org are
mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios.patch
mm-convert-__do_fault-to-use-a-folio.patch
mm-use-mapping_evict_folio-in-truncate_error_page.patch
mm-convert-soft_offline_in_use_page-to-use-a-folio.patch
mm-convert-isolate_page-to-mf_isolate_folio.patch
mm-remove-invalidate_inode_page.patch
The patch titled
Subject: mm: use mapping_evict_folio() in truncate_error_page()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-use-mapping_evict_folio-in-truncate_error_page.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm: use mapping_evict_folio() in truncate_error_page()
Date: Wed, 8 Nov 2023 18:28:06 +0000
We already have the folio and the mapping, so replace the call to
invalidate_inode_page() with mapping_evict_folio().
Link: https://lkml.kernel.org/r/20231108182809.602073-4-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory-failure.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/memory-failure.c~mm-use-mapping_evict_folio-in-truncate_error_page
+++ a/mm/memory-failure.c
@@ -930,10 +930,10 @@ static int delete_from_lru_cache(struct
static int truncate_error_page(struct page *p, unsigned long pfn,
struct address_space *mapping)
{
+ struct folio *folio = page_folio(p);
int ret = MF_FAILED;
if (mapping->a_ops->error_remove_page) {
- struct folio *folio = page_folio(p);
int err = mapping->a_ops->error_remove_page(mapping, p);
if (err != 0)
@@ -947,7 +947,7 @@ static int truncate_error_page(struct pa
* If the file system doesn't support it just invalidate
* This fails on dirty or anything with private pages
*/
- if (invalidate_inode_page(p))
+ if (mapping_evict_folio(mapping, folio))
ret = MF_RECOVERED;
else
pr_info("%#lx: Failed to invalidate\n", pfn);
_
Patches currently in -mm which might be from willy(a)infradead.org are
mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios.patch
mm-convert-__do_fault-to-use-a-folio.patch
mm-use-mapping_evict_folio-in-truncate_error_page.patch
mm-convert-soft_offline_in_use_page-to-use-a-folio.patch
mm-convert-isolate_page-to-mf_isolate_folio.patch
mm-remove-invalidate_inode_page.patch
The patch titled
Subject: mm: convert __do_fault() to use a folio
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-convert-__do_fault-to-use-a-folio.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm: convert __do_fault() to use a folio
Date: Wed, 8 Nov 2023 18:28:05 +0000
Convert vmf->page to a folio as soon as we're going to use it. This fixes
a bug if the fault handler returns a tail page with hardware poison; tail
pages have an invalid page->index, so we would fail to unmap the page from
the page tables. We actually have to unmap the entire folio (or
mapping_evict_folio() will fail), so use unmap_mapping_folio() instead.
This also saves various calls to compound_head() hidden in lock_page(),
put_page(), etc.
Link: https://lkml.kernel.org/r/20231108182809.602073-3-willy@infradead.org
Fixes: 793917d997df ("mm/readahead: Add large folio readahead")
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
--- a/mm/memory.c~mm-convert-__do_fault-to-use-a-folio
+++ a/mm/memory.c
@@ -4239,6 +4239,7 @@ oom:
static vm_fault_t __do_fault(struct vm_fault *vmf)
{
struct vm_area_struct *vma = vmf->vma;
+ struct folio *folio;
vm_fault_t ret;
/*
@@ -4267,27 +4268,26 @@ static vm_fault_t __do_fault(struct vm_f
VM_FAULT_DONE_COW)))
return ret;
+ folio = page_folio(vmf->page);
if (unlikely(PageHWPoison(vmf->page))) {
- struct page *page = vmf->page;
vm_fault_t poisonret = VM_FAULT_HWPOISON;
if (ret & VM_FAULT_LOCKED) {
- if (page_mapped(page))
- unmap_mapping_pages(page_mapping(page),
- page->index, 1, false);
- /* Retry if a clean page was removed from the cache. */
- if (invalidate_inode_page(page))
+ if (page_mapped(vmf->page))
+ unmap_mapping_folio(folio);
+ /* Retry if a clean folio was removed from the cache. */
+ if (mapping_evict_folio(folio->mapping, folio))
poisonret = VM_FAULT_NOPAGE;
- unlock_page(page);
+ folio_unlock(folio);
}
- put_page(page);
+ folio_put(folio);
vmf->page = NULL;
return poisonret;
}
if (unlikely(!(ret & VM_FAULT_LOCKED)))
- lock_page(vmf->page);
+ folio_lock(folio);
else
- VM_BUG_ON_PAGE(!PageLocked(vmf->page), vmf->page);
+ VM_BUG_ON_PAGE(!folio_test_locked(folio), vmf->page);
return ret;
}
_
Patches currently in -mm which might be from willy(a)infradead.org are
mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios.patch
mm-convert-__do_fault-to-use-a-folio.patch
mm-use-mapping_evict_folio-in-truncate_error_page.patch
mm-convert-soft_offline_in_use_page-to-use-a-folio.patch
mm-convert-isolate_page-to-mf_isolate_folio.patch
mm-remove-invalidate_inode_page.patch
The patch titled
Subject: mm: make mapping_evict_folio() the preferred way to evict clean folios
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm: make mapping_evict_folio() the preferred way to evict clean folios
Date: Wed, 8 Nov 2023 18:28:04 +0000
Patch series "Fix fault handler's handling of poisoned tail pages".
Since introducing the ability to have large folios in the page cache, it's
been possible to have a hwpoisoned tail page returned from the fault
handler. We handle this situation poorly; failing to remove the affected
page from use.
This isn't a minimal patch to fix it, it's a full conversion of all the
code surrounding it.
This patch (of 6):
invalidate_inode_page() does very little beyond calling
mapping_evict_folio(). Move the check for mapping being NULL into
mapping_evict_folio() and make it available to the rest of the MM for use
in the next few patches.
Link: https://lkml.kernel.org/r/20231108182809.602073-1-willy@infradead.org
Link: https://lkml.kernel.org/r/20231108182809.602073-2-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/internal.h | 1 +
mm/truncate.c | 33 ++++++++++++++++-----------------
2 files changed, 17 insertions(+), 17 deletions(-)
--- a/mm/internal.h~mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios
+++ a/mm/internal.h
@@ -138,6 +138,7 @@ void filemap_free_folio(struct address_s
int truncate_inode_folio(struct address_space *mapping, struct folio *folio);
bool truncate_inode_partial_folio(struct folio *folio, loff_t start,
loff_t end);
+long mapping_evict_folio(struct address_space *mapping, struct folio *folio);
long invalidate_inode_page(struct page *page);
unsigned long mapping_try_invalidate(struct address_space *mapping,
pgoff_t start, pgoff_t end, unsigned long *nr_failed);
--- a/mm/truncate.c~mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios
+++ a/mm/truncate.c
@@ -266,9 +266,22 @@ int generic_error_remove_page(struct add
}
EXPORT_SYMBOL(generic_error_remove_page);
-static long mapping_evict_folio(struct address_space *mapping,
- struct folio *folio)
+/**
+ * mapping_evict_folio() - Remove an unused folio from the page-cache.
+ * @mapping: The mapping this folio belongs to.
+ * @folio: The folio to remove.
+ *
+ * Safely remove one folio from the page cache.
+ * It only drops clean, unused folios.
+ *
+ * Context: Folio must be locked.
+ * Return: The number of pages successfully removed.
+ */
+long mapping_evict_folio(struct address_space *mapping, struct folio *folio)
{
+ /* The page may have been truncated before it was locked */
+ if (!mapping)
+ return 0;
if (folio_test_dirty(folio) || folio_test_writeback(folio))
return 0;
/* The refcount will be elevated if any page in the folio is mapped */
@@ -281,25 +294,11 @@ static long mapping_evict_folio(struct a
return remove_mapping(mapping, folio);
}
-/**
- * invalidate_inode_page() - Remove an unused page from the pagecache.
- * @page: The page to remove.
- *
- * Safely invalidate one page from its pagecache mapping.
- * It only drops clean, unused pages.
- *
- * Context: Page must be locked.
- * Return: The number of pages successfully removed.
- */
long invalidate_inode_page(struct page *page)
{
struct folio *folio = page_folio(page);
- struct address_space *mapping = folio_mapping(folio);
- /* The page may have been truncated before it was locked */
- if (!mapping)
- return 0;
- return mapping_evict_folio(mapping, folio);
+ return mapping_evict_folio(folio_mapping(folio), folio);
}
/**
_
Patches currently in -mm which might be from willy(a)infradead.org are
mm-make-mapping_evict_folio-the-preferred-way-to-evict-clean-folios.patch
mm-convert-__do_fault-to-use-a-folio.patch
mm-use-mapping_evict_folio-in-truncate_error_page.patch
mm-convert-soft_offline_in_use_page-to-use-a-folio.patch
mm-convert-isolate_page-to-mf_isolate_folio.patch
mm-remove-invalidate_inode_page.patch
From: Duncan Ma <duncan.ma(a)amd.com>
[WHY]
On s0i3, IPS mask isn't saved and restored.
It is reset to zero on exit.
If it is cleared unexpectedly, driver will
proceed operations while DCN is in IPS2 and
cause a hang.
[HOW]
Negate the bit logic. Default value of
zero indicates it is still in IPS2. Driver
must poll for the bit to assert.
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Cc: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Charlene Liu <charlene.liu(a)amd.com>
Acked-by: Alex Hung <alex.hung(a)amd.com>
Signed-off-by: Duncan Ma <duncan.ma(a)amd.com>
---
.../display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 18 +++++++++---------
drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++--
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +++++-----
3 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
index 0fa4fcd00de2..507a7cf56711 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
@@ -820,22 +820,22 @@ static void dcn35_set_idle_state(struct clk_mgr *clk_mgr_base, bool allow_idle)
if (dc->config.disable_ips == DMUB_IPS_ENABLE ||
dc->config.disable_ips == DMUB_IPS_DISABLE_DYNAMIC) {
- val |= DMUB_IPS1_ALLOW_MASK;
- val |= DMUB_IPS2_ALLOW_MASK;
- } else if (dc->config.disable_ips == DMUB_IPS_DISABLE_IPS1) {
val = val & ~DMUB_IPS1_ALLOW_MASK;
val = val & ~DMUB_IPS2_ALLOW_MASK;
- } else if (dc->config.disable_ips == DMUB_IPS_DISABLE_IPS2) {
- val |= DMUB_IPS1_ALLOW_MASK;
- val = val & ~DMUB_IPS2_ALLOW_MASK;
- } else if (dc->config.disable_ips == DMUB_IPS_DISABLE_IPS2_Z10) {
+ } else if (dc->config.disable_ips == DMUB_IPS_DISABLE_IPS1) {
val |= DMUB_IPS1_ALLOW_MASK;
val |= DMUB_IPS2_ALLOW_MASK;
+ } else if (dc->config.disable_ips == DMUB_IPS_DISABLE_IPS2) {
+ val = val & ~DMUB_IPS1_ALLOW_MASK;
+ val |= DMUB_IPS2_ALLOW_MASK;
+ } else if (dc->config.disable_ips == DMUB_IPS_DISABLE_IPS2_Z10) {
+ val = val & ~DMUB_IPS1_ALLOW_MASK;
+ val = val & ~DMUB_IPS2_ALLOW_MASK;
}
if (!allow_idle) {
- val = val & ~DMUB_IPS1_ALLOW_MASK;
- val = val & ~DMUB_IPS2_ALLOW_MASK;
+ val |= DMUB_IPS1_ALLOW_MASK;
+ val |= DMUB_IPS2_ALLOW_MASK;
}
dcn35_smu_write_ips_scratch(clk_mgr, val);
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index d8f434738212..76b47f178127 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -4934,8 +4934,8 @@ bool dc_dmub_is_ips_idle_state(struct dc *dc)
if (dc->hwss.get_idle_state)
idle_state = dc->hwss.get_idle_state(dc);
- if ((idle_state & DMUB_IPS1_ALLOW_MASK) ||
- (idle_state & DMUB_IPS2_ALLOW_MASK))
+ if (!(idle_state & DMUB_IPS1_ALLOW_MASK) ||
+ !(idle_state & DMUB_IPS2_ALLOW_MASK))
return true;
return false;
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index e4c007203318..0e07699c1e83 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -1202,11 +1202,11 @@ void dc_dmub_srv_exit_low_power_state(const struct dc *dc)
allow_state = dc->hwss.get_idle_state(dc);
dc->hwss.set_idle_state(dc, false);
- if (allow_state & DMUB_IPS2_ALLOW_MASK) {
+ if (!(allow_state & DMUB_IPS2_ALLOW_MASK)) {
// Wait for evaluation time
udelay(dc->debug.ips2_eval_delay_us);
commit_state = dc->hwss.get_idle_state(dc);
- if (commit_state & DMUB_IPS2_COMMIT_MASK) {
+ if (!(commit_state & DMUB_IPS2_COMMIT_MASK)) {
// Tell PMFW to exit low power state
dc->clk_mgr->funcs->exit_low_power_state(dc->clk_mgr);
@@ -1216,7 +1216,7 @@ void dc_dmub_srv_exit_low_power_state(const struct dc *dc)
for (i = 0; i < max_num_polls; ++i) {
commit_state = dc->hwss.get_idle_state(dc);
- if (!(commit_state & DMUB_IPS2_COMMIT_MASK))
+ if (commit_state & DMUB_IPS2_COMMIT_MASK)
break;
udelay(1);
@@ -1235,10 +1235,10 @@ void dc_dmub_srv_exit_low_power_state(const struct dc *dc)
}
dc_dmub_srv_notify_idle(dc, false);
- if (allow_state & DMUB_IPS1_ALLOW_MASK) {
+ if (!(allow_state & DMUB_IPS1_ALLOW_MASK)) {
for (i = 0; i < max_num_polls; ++i) {
commit_state = dc->hwss.get_idle_state(dc);
- if (!(commit_state & DMUB_IPS1_COMMIT_MASK))
+ if (commit_state & DMUB_IPS1_COMMIT_MASK)
break;
udelay(1);
--
2.42.0
From: Paul Hsieh <paul.hsieh(a)amd.com>
[WHY]
Some eDP panels' ext caps don't set initial values
and the value of dpcd_addr (0x317) is random.
It means that sometimes the eDP can be OLED, miniLED and etc,
and cause incorrect backlight control interface.
[HOW]
Add remove_sink_ext_caps to remove sink ext caps (HDR, OLED and etc)
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Cc: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Anthony Koo <anthony.koo(a)amd.com>
Acked-by: Alex Hung <alex.hung(a)amd.com>
Signed-off-by: Paul Hsieh <paul.hsieh(a)amd.com>
---
drivers/gpu/drm/amd/display/dc/dc_types.h | 1 +
drivers/gpu/drm/amd/display/dc/link/link_detection.c | 3 +++
2 files changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h
index cea666ea66c6..fcb825e4f1bb 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_types.h
@@ -177,6 +177,7 @@ struct dc_panel_patch {
unsigned int disable_fams;
unsigned int skip_avmute;
unsigned int mst_start_top_delay;
+ unsigned int remove_sink_ext_caps;
};
struct dc_edid_caps {
diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
index d6f0f857c05a..f2fe523f914f 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
@@ -1088,6 +1088,9 @@ static bool detect_link_and_local_sink(struct dc_link *link,
if (sink->edid_caps.panel_patch.skip_scdc_overwrite)
link->ctx->dc->debug.hdmi20_disable = true;
+ if (sink->edid_caps.panel_patch.remove_sink_ext_caps)
+ link->dpcd_sink_ext_caps.raw = 0;
+
if (dc_is_hdmi_signal(link->connector_signal))
read_scdc_caps(link->ddc, link->local_sink);
--
2.42.0
From: Tianci Yin <tianci.yin(a)amd.com>
[WHY]
When cursor moves across screen boarder, lag cursor observed,
since subvp settings need to sync up with vblank that causes
cursor updates being delayed.
[HOW]
Enable fast plane updates on DCN3.2 to fix it.
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Cc: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com>
Acked-by: Alex Hung <alex.hung(a)amd.com>
Signed-off-by: Tianci Yin <tianci.yin(a)amd.com>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index adbeb2c897b5..8ebdbfbbb691 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9585,14 +9585,14 @@ static bool should_reset_plane(struct drm_atomic_state *state,
struct drm_plane *other;
struct drm_plane_state *old_other_state, *new_other_state;
struct drm_crtc_state *new_crtc_state;
+ struct amdgpu_device *adev = drm_to_adev(plane->dev);
int i;
/*
- * TODO: Remove this hack once the checks below are sufficient
- * enough to determine when we need to reset all the planes on
- * the stream.
+ * TODO: Remove this hack for all asics once it proves that the
+ * fast updates works fine on DCN3.2+.
*/
- if (state->allow_modeset)
+ if (adev->ip_versions[DCE_HWIP][0] < IP_VERSION(3, 2, 0) && state->allow_modeset)
return true;
/* Exit early if we know that we're adding or removing the plane. */
--
2.42.0
From: Fangzhi Zuo <jerry.zuo(a)amd.com>
[WHY & HOW]
For the scenario when a dsc capable MST sink device is directly
connected, it needs to use max dsc compression as the link bw constraint.
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Cc: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Roman Li <roman.li(a)amd.com>
Acked-by: Alex Hung <alex.hung(a)amd.com>
Signed-off-by: Fangzhi Zuo <jerry.zuo(a)amd.com>
---
.../display/amdgpu_dm/amdgpu_dm_mst_types.c | 29 +++++++++----------
1 file changed, 14 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index d3b13d362eda..11da0eebee6c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -1604,31 +1604,31 @@ enum dc_status dm_dp_mst_is_port_support_mode(
unsigned int upper_link_bw_in_kbps = 0, down_link_bw_in_kbps = 0;
unsigned int max_compressed_bw_in_kbps = 0;
struct dc_dsc_bw_range bw_range = {0};
- struct drm_dp_mst_topology_mgr *mst_mgr;
+ uint16_t full_pbn = aconnector->mst_output_port->full_pbn;
/*
- * check if the mode could be supported if DSC pass-through is supported
- * AND check if there enough bandwidth available to support the mode
- * with DSC enabled.
+ * Consider the case with the depth of the mst topology tree is equal or less than 2
+ * A. When dsc bitstream can be transmitted along the entire path
+ * 1. dsc is possible between source and branch/leaf device (common dsc params is possible), AND
+ * 2. dsc passthrough supported at MST branch, or
+ * 3. dsc decoding supported at leaf MST device
+ * Use maximum dsc compression as bw constraint
+ * B. When dsc bitstream cannot be transmitted along the entire path
+ * Use native bw as bw constraint
*/
if (is_dsc_common_config_possible(stream, &bw_range) &&
- aconnector->mst_output_port->passthrough_aux) {
- mst_mgr = aconnector->mst_output_port->mgr;
- mutex_lock(&mst_mgr->lock);
-
+ (aconnector->mst_output_port->passthrough_aux ||
+ aconnector->dsc_aux == &aconnector->mst_output_port->aux)) {
cur_link_settings = stream->link->verified_link_cap;
upper_link_bw_in_kbps = dc_link_bandwidth_kbps(aconnector->dc_link,
- &cur_link_settings
- );
- down_link_bw_in_kbps = kbps_from_pbn(aconnector->mst_output_port->full_pbn);
+ &cur_link_settings);
+ down_link_bw_in_kbps = kbps_from_pbn(full_pbn);
/* pick the bottleneck */
end_to_end_bw_in_kbps = min(upper_link_bw_in_kbps,
down_link_bw_in_kbps);
- mutex_unlock(&mst_mgr->lock);
-
/*
* use the maximum dsc compression bandwidth as the required
* bandwidth for the mode
@@ -1643,8 +1643,7 @@ enum dc_status dm_dp_mst_is_port_support_mode(
/* check if mode could be supported within full_pbn */
bpp = convert_dc_color_depth_into_bpc(stream->timing.display_color_depth) * 3;
pbn = drm_dp_calc_pbn_mode(stream->timing.pix_clk_100hz / 10, bpp, false);
-
- if (pbn > aconnector->mst_output_port->full_pbn)
+ if (pbn > full_pbn)
return DC_FAIL_BANDWIDTH_VALIDATE;
}
--
2.42.0
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 31255e072b2e91f97645d792d25b2db744186dd1
Gitweb: https://git.kernel.org/tip/31255e072b2e91f97645d792d25b2db744186dd1
Author: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
AuthorDate: Tue, 07 Nov 2023 10:22:51 -08:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 08 Nov 2023 08:55:37 -08:00
x86/shstk: Delay signal entry SSP write until after user accesses
When a signal is being delivered, the kernel needs to make accesses to
userspace. These accesses could encounter an access error, in which case
the signal delivery itself will trigger a segfault. Usually this would
result in the kernel killing the process. But in the case of a SEGV signal
handler being configured, the failure of the first signal delivery will
result in *another* signal getting delivered. The second signal may
succeed if another thread has resolved the issue that triggered the
segfault (i.e. a well timed mprotect()/mmap()), or the second signal is
being delivered to another stack (i.e. an alt stack).
On x86, in the non-shadow stack case, all the accesses to userspace are
done before changes to the registers (in pt_regs). The operation is
aborted when an access error occurs, so although there may be writes done
for the first signal, control flow changes for the signal (regs->ip,
regs->sp, etc) are not committed until all the accesses have already
completed successfully. This means that the second signal will be
delivered as if it happened at the time of the first signal. It will
effectively replace the first aborted signal, overwriting the half-written
frame of the aborted signal. So on sigreturn from the second signal,
control flow will resume happily from the point of control flow where the
original signal was delivered.
The problem is, when shadow stack is active, the shadow stack SSP
register/MSR is updated *before* some of the userspace accesses. This
means if the earlier accesses succeed and the later ones fail, the second
signal will not be delivered at the same spot on the shadow stack as the
first one. So on sigreturn from the second signal, the SSP will be
pointing to the wrong location on the shadow stack (off by a frame).
Pengfei privately reported that while using a shadow stack enabled glibc,
the “signal06” test in the LTP test-suite hung. It turns out it is
testing the above described double signal scenario. When this test was
compiled with shadow stack, the first signal pushed a shadow stack
sigframe, then the second pushed another. When the second signal was
handled, the SSP was at the first shadow stack signal frame instead of
the original location. The test then got stuck as the #CP from the twice
incremented SSP was incorrect and generated segfaults in a loop.
Fix this by adjusting the SSP register only after any userspace accesses,
such that there can be no failures after the SSP is adjusted. Do this by
moving the shadow stack sigframe push logic to happen after all other
userspace accesses.
Note, sigreturn (as opposed to the signal delivery dealt with in this
patch) has ordering behavior that could lead to similar failures. The
ordering issues there extend beyond shadow stack to include the alt stack
restoration. Fixing that would require cross-arch changes, and the
ordering today does not cause any known test or apps breakages. So leave
it as is, for now.
[ dhansen: minor changelog/subject tweak ]
Fixes: 05e36022c054 ("x86/shstk: Handle signals for shadow stack")
Reported-by: Pengfei Xu <pengfei.xu(a)intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Tested-by: Pengfei Xu <pengfei.xu(a)intel.com>
Cc:stable@vger.kernel.org
Link: https://lore.kernel.org/all/20231107182251.91276-1-rick.p.edgecombe%40intel…
Link: https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/sysc…
---
arch/x86/kernel/signal_64.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
index cacf2ed..23d8aaf 100644
--- a/arch/x86/kernel/signal_64.c
+++ b/arch/x86/kernel/signal_64.c
@@ -175,9 +175,6 @@ int x64_setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
frame = get_sigframe(ksig, regs, sizeof(struct rt_sigframe), &fp);
uc_flags = frame_uc_flags(regs);
- if (setup_signal_shadow_stack(ksig))
- return -EFAULT;
-
if (!user_access_begin(frame, sizeof(*frame)))
return -EFAULT;
@@ -198,6 +195,9 @@ int x64_setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
return -EFAULT;
}
+ if (setup_signal_shadow_stack(ksig))
+ return -EFAULT;
+
/* Set up registers for signal handler */
regs->di = ksig->sig;
/* In case the signal handler was declared without prototypes */
While qualifiying the 6.4 release, the following warning was detected in
messages:
vmstat_refresh: nr_file_hugepages -15664
The warning is caused by the incorrect updating of the NR_FILE_THPS
counter in the function split_huge_page_to_list. The if case is checking
for folio_test_swapbacked, but the else case is missing the check for
folio_test_pmd_mappable. The other functions that manipulate the counter
like __filemap_add_folio and filemap_unaccount_folio have the
corresponding check.
I have a test case, which reproduces the problem. It can be found here:
https://github.com/sroeschus/testcase/blob/main/vmstat_refresh/madv.c
The test case reproduces on an XFS filesystem. Running the same test
case on a BTRFS filesystem does not reproduce the problem.
AFAIK version 6.1 until 6.6 are affected by this problem.
Signed-off-by: Stefan Roesch <shr(a)devkernel.io>
Co-debugged-by: Johannes Weiner <hannes(a)cmpxchg.org>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
---
mm/huge_memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 064fbd90822b4..9dbd5ef5a3902 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2740,7 +2740,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
if (folio_test_swapbacked(folio)) {
__lruvec_stat_mod_folio(folio, NR_SHMEM_THPS,
-nr);
- } else {
+ } else if (folio_test_pmd_mappable(folio)) {
__lruvec_stat_mod_folio(folio, NR_FILE_THPS,
-nr);
filemap_nr_thps_dec(mapping);
base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa
--
2.39.3
From: Roger Pau Monne <roger.pau(a)citrix.com>
The Processor capability bits notify ACPI of the OS capabilities, and
so ACPI can adjust the return of other Processor methods taking the OS
capabilities into account.
When Linux is running as a Xen dom0, the hypervisor is the entity
in charge of processor power management, and hence Xen needs to make
sure the capabilities reported by _OSC/_PDC match the capabilities of
the driver in Xen.
Introduce a small helper to sanitize the buffer when running as Xen
dom0.
When Xen supports HWP, this serves as the equivalent of commit
a21211672c9a ("ACPI / processor: Request native thermal interrupt
handling via _OSC") to avoid SMM crashes. Xen will set bit
ACPI_PROC_CAP_COLLAB_PROC_PERF (bit 12) in the capability bits and the
_OSC/_PDC call will apply it.
[ jandryuk: Mention Xen HWP's need. Support _OSC & _PDC ]
Signed-off-by: Roger Pau Monné <roger.pau(a)citrix.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Jason Andryuk <jandryuk(a)gmail.com>
---
v4:
Use xen_santize_proc_cap_bits() name - Michal
Rephrase comment - Michal
v3:
Move xen_sanitize_pdc() call to arch_acpi_set_proc_cap_bits() to cover
_OSC and _PDC.
drivers/xen/pcpu.c is CONFIG_DOM0 && CONFIG_X86
v2:
Move local variables in acpi_processor_eval_pdc() to reuse in both conditions.
---
arch/x86/include/asm/acpi.h | 14 ++++++++++++++
arch/x86/include/asm/xen/hypervisor.h | 9 +++++++++
drivers/xen/pcpu.c | 21 +++++++++++++++++++++
3 files changed, 44 insertions(+)
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index c8a7fc23f63c..f896eed4516c 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -16,6 +16,9 @@
#include <asm/x86_init.h>
#include <asm/cpufeature.h>
#include <asm/irq_vectors.h>
+#include <asm/xen/hypervisor.h>
+
+#include <xen/xen.h>
#ifdef CONFIG_ACPI_APEI
# include <asm/pgtable_types.h>
@@ -127,6 +130,17 @@ static inline void arch_acpi_set_proc_cap_bits(u32 *cap)
if (!cpu_has(c, X86_FEATURE_MWAIT) ||
boot_option_idle_override == IDLE_NOMWAIT)
*cap &= ~(ACPI_PROC_CAP_C_C1_FFH | ACPI_PROC_CAP_C_C2C3_FFH);
+
+ if (xen_initial_domain()) {
+ /*
+ * When Linux is running as Xen dom0, the hypervisor is the
+ * entity in charge of the processor power management, and so
+ * Xen needs to check the OS capabilities reported in the
+ * processor capabilities buffer matches what the hypervisor
+ * driver supports.
+ */
+ xen_sanitize_proc_cap_bits(cap);
+ }
}
static inline bool acpi_has_cpu_in_madt(void)
diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
index 7048dfacc04b..a9088250770f 100644
--- a/arch/x86/include/asm/xen/hypervisor.h
+++ b/arch/x86/include/asm/xen/hypervisor.h
@@ -100,4 +100,13 @@ static inline void leave_lazy(enum xen_lazy_mode mode)
enum xen_lazy_mode xen_get_lazy_mode(void);
+#if defined(CONFIG_XEN_DOM0) && defined(CONFIG_ACPI)
+void xen_sanitize_proc_cap_bits(uint32_t *buf);
+#else
+static inline void xen_sanitize_proc_cap_bits(uint32_t *buf)
+{
+ BUG();
+}
+#endif
+
#endif /* _ASM_X86_XEN_HYPERVISOR_H */
diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c
index b3e3d1bb37f3..7000701dff8f 100644
--- a/drivers/xen/pcpu.c
+++ b/drivers/xen/pcpu.c
@@ -47,6 +47,9 @@
#include <asm/xen/hypervisor.h>
#include <asm/xen/hypercall.h>
+#ifdef CONFIG_ACPI
+#include <acpi/processor.h>
+#endif
/*
* @cpu_id: Xen physical cpu logic number
@@ -400,4 +403,22 @@ bool __init xen_processor_present(uint32_t acpi_id)
return online;
}
+
+void xen_sanitize_proc_cap_bits(uint32_t *cap)
+{
+ struct xen_platform_op op = {
+ .cmd = XENPF_set_processor_pminfo,
+ .u.set_pminfo.id = -1,
+ .u.set_pminfo.type = XEN_PM_PDC,
+ };
+ u32 buf[3] = { ACPI_PDC_REVISION_ID, 1, *cap };
+ int ret;
+
+ set_xen_guest_handle(op.u.set_pminfo.pdc, buf);
+ ret = HYPERVISOR_platform_op(&op);
+ if (ret)
+ pr_err("sanitize of _PDC buffer bits from Xen failed: %d\n",
+ ret);
+ *cap = buf[2];
+}
#endif
--
2.41.0
I'm announcing the release of the 5.10.200 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/powerpc/kernel/setup-common.c | 2
arch/powerpc/mm/mem.c | 1
arch/sparc/lib/checksum_32.S | 2
arch/x86/include/asm/i8259.h | 2
arch/x86/include/asm/setup.h | 46 -
arch/x86/kernel/acpi/boot.c | 3
arch/x86/kernel/i8259.c | 38
arch/x86/kernel/setup.c | 5
arch/x86/kernel/vmlinux.lds.S | 2
drivers/base/driver.c | 69 +
drivers/base/platform.c | 28
drivers/clk/clk.c | 21
drivers/dma/ste_dma40.c | 1
drivers/gpu/drm/drm_dp_mst_topology.c | 6
drivers/i2c/busses/i2c-aspeed.c | 3
drivers/i2c/busses/i2c-stm32f7.c | 9
drivers/i2c/muxes/i2c-demux-pinctrl.c | 2
drivers/i2c/muxes/i2c-mux-gpmux.c | 2
drivers/i2c/muxes/i2c-mux-pinctrl.c | 2
drivers/iio/adc/exynos_adc.c | 24
drivers/iio/adc/xilinx-xadc-core.c | 179 +---
drivers/input/mouse/synaptics.c | 1
drivers/input/rmi4/rmi_smbus.c | 50 -
drivers/irqchip/irq-stm32-exti.c | 1
drivers/mcb/mcb-lpc.c | 35
drivers/mcb/mcb-parse.c | 15
drivers/misc/fastrpc.c | 10
drivers/mmc/host/renesas_sdhi_core.c | 3
drivers/mmc/host/tmio_mmc.h | 2
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2
drivers/net/ethernet/intel/igb/igb_ethtool.c | 6
drivers/net/ethernet/intel/igc/igc_ethtool.c | 35
drivers/net/ethernet/realtek/r8169_main.c | 4
drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2
drivers/net/gtp.c | 5
drivers/net/ieee802154/adf7242.c | 5
drivers/net/usb/r8152.c | 11
drivers/net/usb/smsc95xx.c | 4
drivers/nvmem/imx-ocotp.c | 6
drivers/pci/quirks.c | 8
drivers/platform/mellanox/mlxbf-tmfifo.c | 21
drivers/rpmsg/qcom_glink_native.c | 2
drivers/rpmsg/rpmsg_core.c | 37
drivers/rpmsg/rpmsg_internal.h | 5
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4
drivers/spi/spi-npcm-fiu.c | 5
drivers/tty/serial/8250/8250_pci.c | 122 ++
drivers/usb/gadget/legacy/raw_gadget.c | 26
drivers/usb/storage/unusual_cypress.h | 2
drivers/video/fbdev/aty/atyfb_base.c | 4
drivers/video/fbdev/uvesafb.c | 2
drivers/virtio/virtio_balloon.c | 6
drivers/virtio/virtio_mmio.c | 19
fs/cifs/smbdirect.c | 14
fs/ext4/mballoc.c | 51 -
fs/ext4/mballoc.h | 14
fs/f2fs/gc.c | 3
include/linux/device/driver.h | 2
include/linux/kasan.h | 6
include/linux/pci_ids.h | 1
include/linux/platform_device.h | 6
include/linux/rpmsg.h | 14
include/uapi/linux/can/isotp.h | 25
include/uapi/linux/gtp.h | 2
kernel/events/core.c | 3
kernel/trace/trace_kprobe.c | 4
lib/kobject.c | 12
mm/kasan/report.c | 4
mm/page_alloc.c | 2
net/can/isotp.c | 434 ++++++----
net/core/neighbour.c | 67 -
net/ipv4/tcp_input.c | 9
net/netfilter/nfnetlink_log.c | 2
net/sched/cls_u32.c | 2
sound/hda/intel-dsp-config.c | 6
sound/soc/codecs/rt5645.c | 2
tools/objtool/check.c | 2
tools/testing/selftests/ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13
80 files changed, 1046 insertions(+), 565 deletions(-)
Al Viro (1):
sparc32: fix a braino in fault handling in csum_and_copy_..._user()
Alain Volmat (1):
i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
Alessandro Carminati (1):
clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
Andrey Konovalov (1):
usb: raw-gadget: properly handle interrupted requests
Arnd Bergmann (1):
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Baokun Li (3):
ext4: add two helper functions extent_logical_end() and pa_logical_end()
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
ext4: avoid overlapping preallocations due to overflow
Bartosz Golaszewski (3):
iio: adc: xilinx: use helper variable for &pdev->dev
iio: adc: xilinx: use devm_krealloc() instead of kfree() + kcalloc()
iio: adc: xilinx: use more devres helpers and remove remove()
Ben Wolsieffer (1):
irqchip/stm32-exti: add missing DT IRQ flag translation
Bjorn Andersson (1):
rpmsg: glink: Release driver_override
Cameron Williams (4):
tty: 8250: Remove UC-257 and UC-431
tty: 8250: Add support for additional Brainboxes UC cards
tty: 8250: Add support for Brainboxes UP cards
tty: 8250: Add support for Intashield IS-100
Chao Yu (1):
f2fs: fix to do sanity check on inode type during garbage collection
Christophe JAILLET (1):
net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
Dmitry Torokhov (1):
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Douglas Anderson (4):
r8152: Increase USB control msg timeout to 5000ms as per spec
r8152: Run the unload routine if we have errors during probe
r8152: Cancel hw_phy_work if we have an error in probe
r8152: Release firmware if we have an error in probe
Ekansh Gupta (1):
misc: fastrpc: Clean buffers on remote invocation failures
Eric Dumazet (1):
neighbour: fix various data-races
Florian Westphal (1):
netfilter: nfnetlink_log: silence bogus compiler warning
Francis Laniel (1):
selftests/ftrace: Add new test case which checks non unique symbol
Fred Chen (1):
tcp: fix wrong RTO timeout when received SACK reneging
Gavin Shan (1):
virtio_balloon: Fix endless deflation and inflation on arm64
Greg Kroah-Hartman (1):
Linux 5.10.200
Gustavo A. R. Silva (1):
net: sched: cls_u32: Fix allocation size in u32_init()
Haibo Li (1):
kasan: print the original fault addr when access invalid shadow
Hangyu Hua (1):
rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
Herve Codina (3):
i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
Ivan Vecera (1):
i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
Jian Zhang (1):
i2c: aspeed: Fix i2c bus hang in slave read
John Sperbeck (1):
objtool/x86: add missing embedded_insn check
Jorge Maidana (1):
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Josh Poimboeuf (2):
x86/mm: Simplify RESERVE_BRK()
x86/mm: Fix RESERVE_BRK() for older binutils
Juergen Gross (1):
x86: Fix .brk attribute in linker script
Kemeng Shi (1):
mm/page_alloc: correct start page when guard page debug is enabled
Krzysztof Kozlowski (4):
driver: platform: Add helper for safer setting of driver_override
rpmsg: Constify local variable in field store macro
rpmsg: Fix kfree() of static memory on setting driver_override
rpmsg: Fix calling device_lock() on non-initialized device
Kunwu Chan (1):
treewide: Spelling fix in comment
LihaSika (1):
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Liming Sun (1):
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Lukas Magel (1):
can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
Lukasz Majczak (1):
drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
Marek Szyprowski (1):
iio: exynos-adc: request second interupt only when touchscreen mode is used
Mark Hasemeyer (1):
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Mateusz Palczewski (1):
igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
Maximilian Heyne (1):
virtio-mmio: fix memory leak of vm_dev
Michael Ellerman (1):
powerpc/mm: Fix boot crash with FLATMEM
Mirsad Goran Todorovac (2):
r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
Oliver Hartkopp (6):
can: isotp: set max PDU size to 64 kByte
can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
can: isotp: check CAN address family in isotp_bind()
can: isotp: handle wait_event_interruptible() return values
can: isotp: add local echo tx processing and tx without FC
can: isotp: isotp_bind(): do not validate unused address information
Pablo Neira Ayuso (2):
gtp: uapi: fix GTPA_MAX
gtp: fix fragmentation needed check with gso
Patrick Menschel (3):
can: isotp: change error format from decimal to symbolic error names
can: isotp: add symbolic error message to isotp_module_init()
can: isotp: Add error message if txqueuelen is too small
Peng Fan (3):
nvmem: imx: correct nregs for i.MX6ULL
nvmem: imx: correct nregs for i.MX6SLL
nvmem: imx: correct nregs for i.MX6UL
Peter Zijlstra (1):
perf/core: Fix potential NULL deref
Robert Hancock (1):
iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
Rodríguez Barbarin, José Javier (2):
mcb: Return actual parsed size when reading chameleon table
mcb-lpc: Reallocate memory region to avoid memory overlapping
Sasha Neftin (1):
igc: Fix ambiguity in the ethtool advertising
Shigeru Yoshida (1):
net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
Shuming Fan (1):
ASoC: rt5650: fix the wrong result of key button
Steve French (1):
smbdirect: missing rc checks while waiting for rdma events
Su Hui (1):
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Thomas Gleixner (1):
x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
Tomas Henzl (1):
scsi: mpt3sas: Fix in error path
Vicki Pfau (1):
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Wang Hai (1):
kobject: Fix slab-out-of-bounds in fill_kobj_path()
William A. Kennington III (1):
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Wolfram Sang (1):
mmc: renesas_sdhi: use custom mask for TMIO_MASK_ALL
Yujie Liu (1):
tracing/kprobes: Fix the description of variable length arguments
Zhang Shurong (1):
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
The 'status' attribute for AP queue devices bound to the vfio_ap device
driver displays incorrect status when the mediated device is attached to a
guest, but the queue device is not passed through. In the current
implementation, the status displayed is 'in_use' which is not correct; it
should be 'assigned'. This can happen if one of the queue devices
associated with a given adapter is not bound to the vfio_ap device driver.
For example:
Queues listed in /sys/bus/ap/drivers/vfio_ap:
14.0005
14.0006
14.000d
16.0006
16.000d
Queues listed in /sys/devices/vfio_ap/matrix/$UUID/matrix
14.0005
14.0006
14.000d
16.0005
16.0006
16.000d
Queues listed in /sys/devices/vfio_ap/matrix/$UUID/guest_matrix
14.0005
14.0006
14.000d
The reason no queues for adapter 0x16 are listed in the guest_matrix is
because queue 16.0005 is not bound to the vfio_ap device driver, so no
queue associated with the adapter is passed through to the guest;
therefore, each queue device for adapter 0x16 should display 'assigned'
instead of 'in_use', because those queues are not in use by a guest, but
only assigned to the mediated device.
Let's check the AP configuration for the guest to determine whether a
queue device is passed through before displaying a status of 'in_use'.
Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com>
Fixes: f139862b92cf ("s390/vfio-ap: add status attribute to AP queue device's sysfs dir")
Cc: stable(a)vger.kernel.org
---
drivers/s390/crypto/vfio_ap_ops.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
index 4db538a55192..871c14a6921f 100644
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -1976,6 +1976,7 @@ static ssize_t status_show(struct device *dev,
{
ssize_t nchars = 0;
struct vfio_ap_queue *q;
+ unsigned long apid, apqi;
struct ap_matrix_mdev *matrix_mdev;
struct ap_device *apdev = to_ap_dev(dev);
@@ -1984,7 +1985,11 @@ static ssize_t status_show(struct device *dev,
matrix_mdev = vfio_ap_mdev_for_queue(q);
if (matrix_mdev) {
- if (matrix_mdev->kvm)
+ apid = AP_QID_CARD(q->apqn);
+ apqi = AP_QID_QUEUE(q->apqn);
+ if (matrix_mdev->kvm &&
+ test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) &&
+ test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm))
nchars = scnprintf(buf, PAGE_SIZE, "%s\n",
AP_QUEUE_IN_USE);
else
--
2.41.0
This is the start of the stable review cycle for the 5.15.138 release.
There are 125 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Nov 2023 20:22:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.138-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.138-rc2
Mark Hasemeyer <markhas(a)chromium.org>
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Siddharth Vadapalli <s-vadapalli(a)ti.com>
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes PX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix up PX-803/PX-857
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix port count of PX-257
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix race condition in status line change on dead connections
Andrey Konovalov <andreyknvl(a)gmail.com>
usb: raw-gadget: properly handle interrupted requests
Jimmy Hu <hhhuuu(a)google.com>
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Disable ASPM for VI w/ all Intel systems
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Move helper for dynamic speed switch check out of smu13
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): do not validate unused address information
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: add local echo tx processing and tx without FC
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: handle wait_event_interruptible() return values
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: check CAN address family in isotp_bind()
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: set max PDU size to 64 kByte
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix boot crash with FLATMEM
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in rtl_phy_patch_request()
Su Hui <suhui(a)nfschina.com>
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Liming Sun <limings(a)nvidia.com>
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Tomas Henzl <thenzl(a)redhat.com>
scsi: mpt3sas: Fix in error path
Jorge Maidana <jorgem.linux(a)gmail.com>
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Karolina Stolarek <karolina.stolarek(a)intel.com>
drm/ttm: Reorder sys manager cleanup step
Shuming Fan <shumingf(a)realtek.com>
ASoC: rt5650: fix the wrong result of key button
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink_log: silence bogus compiler warning
William A. Kennington III <william(a)wkennington.com>
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Su Hui <suhui(a)nfschina.com>
fs/ntfs3: Avoid possible memory leak
Gabriel Marcano <gabemarcano(a)yahoo.com>
fs/ntfs3: Fix directory element type detection
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Write immediately updated ntfs state
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Add ckeck in ni_update_parent()
Arnd Bergmann <arnd(a)arndb.de>
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/85xx: Fix math emulation exception
Zhang Shurong <zhang_shurong(a)foxmail.com>
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
Ben Wolsieffer <ben.wolsieffer(a)hefring.com>
irqchip/stm32-exti: add missing DT IRQ flag translation
Anup Patel <apatel(a)ventanamicro.com>
irqchip/riscv-intc: Mark all INTC nodes as initialized
Gustavo A. R. Silva <gustavoars(a)kernel.org>
net: sched: cls_u32: Fix allocation size in u32_init()
Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com>
ASoC: simple-card: fixup asoc_simple_probe() error handling
Juergen Gross <jgross(a)suse.com>
x86: Fix .brk attribute in linker script
Hangyu Hua <hbh25y(a)gmail.com>
rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
Bjorn Andersson <quic_bjorande(a)quicinc.com>
rpmsg: glink: Release driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix calling device_lock() on non-initialized device
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix kfree() of static memory on setting driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Constify local variable in field store macro
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
driver: platform: Add helper for safer setting of driver_override
John Sperbeck <jsperbeck(a)google.com>
objtool/x86: add missing embedded_insn check
Baokun Li <libaokun1(a)huawei.com>
ext4: avoid overlapping preallocations due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: add two helper functions extent_logical_end() and pa_logical_end()
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/mm: Fix RESERVE_BRK() for older binutils
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/mm: Simplify RESERVE_BRK()
Thomas Gleixner <tglx(a)linutronix.de>
x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
Shailend Chand <shailend(a)google.com>
gve: Fix GFP flags when allocing pages
Linus Walleij <linus.walleij(a)linaro.org>
iio: afe: rescale: Accept only offset channels
Liam Beguin <liambeguin(a)gmail.com>
iio: afe: rescale: add offset support
Liam Beguin <liambeguin(a)gmail.com>
iio: afe: rescale: expose scale processing function
Liam Beguin <liambeguin(a)gmail.com>
iio: afe: rescale: reorder includes
Alessandro Carminati <alessandro.carminati(a)gmail.com>
clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a braino in fault handling in csum_and_copy_..._user()
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix potential NULL deref
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6UL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6SLL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6ULL
Ekansh Gupta <quic_ekangupt(a)quicinc.com>
misc: fastrpc: Clean buffers on remote invocation failures
Yujie Liu <yujie.liu(a)intel.com>
tracing/kprobes: Fix the description of variable length arguments
Jian Zhang <zhangjian.3032(a)bytedance.com>
i2c: aspeed: Fix i2c bus hang in slave read
Alain Volmat <alain.volmat(a)foss.st.com>
i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
Robert Hancock <robert.hancock(a)calian.com>
iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale
Robert Hancock <robert.hancock(a)calian.com>
iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
Marek Szyprowski <m.szyprowski(a)samsung.com>
iio: exynos-adc: request second interupt only when touchscreen mode is used
Haibo Li <haibo.li(a)mediatek.com>
kasan: print the original fault addr when access invalid shadow
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: fix fragmentation needed check with gso
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: uapi: fix GTPA_MAX
Fred Chen <fred.chenchen03(a)gmail.com>
tcp: fix wrong RTO timeout when received SACK reneging
Douglas Anderson <dianders(a)chromium.org>
r8152: Release firmware if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Cancel hw_phy_work if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Run the unload routine if we have errors during probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Increase USB control msg timeout to 5000ms as per spec
Shigeru Yoshida <syoshida(a)redhat.com>
net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
Sasha Neftin <sasha.neftin(a)intel.com>
igc: Fix ambiguity in the ethtool advertising
Eric Dumazet <edumazet(a)google.com>
neighbour: fix various data-races
Mateusz Palczewski <mateusz.palczewski(a)intel.com>
igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
Kunwu Chan <chentao(a)kylinos.cn>
treewide: Spelling fix in comment
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix I40E_FLAG_VF_VLAN_PRUNING value
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data-race in rtl_tx() while reading tp->cur_tx
Hao Ge <gehao(a)kylinos.cn>
firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
Lukasz Majczak <lma(a)semihalf.com>
drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
Alexandru Matei <alexandru.matei(a)uipath.com>
vsock/virtio: initialize the_virtio_vsock before using VQs
Stefano Garzarella <sgarzare(a)redhat.com>
vsock/virtio: add support for device suspend/resume
Stefano Garzarella <sgarzare(a)redhat.com>
vsock/virtio: factor our the code to initialize and delete VQs
Umesh Nerlige Ramappa <umesh.nerlige.ramappa(a)intel.com>
drm/i915/pmu: Check if pmu is closed before stopping event
Al Viro <viro(a)zeniv.linux.org.uk>
nfsd: lock_rename() needs both directories to live on the same fs
Gregory Price <gourry.memverge(a)gmail.com>
mm/migrate: fix do_pages_move for compat pointers
Kemeng Shi <shikemeng(a)huaweicloud.com>
mm/page_alloc: correct start page when guard page debug is enabled
Eric Auger <eric.auger(a)redhat.com>
vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE
Maximilian Heyne <mheyne(a)amazon.de>
virtio-mmio: fix memory leak of vm_dev
Gavin Shan <gshan(a)redhat.com>
virtio_balloon: Fix endless deflation and inflation on arm64
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb-lpc: Reallocate memory region to avoid memory overlapping
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb: Return actual parsed size when reading chameleon table
Paolo Abeni <pabeni(a)redhat.com>
mptcp: more conservative check for zero probes
Eric Dumazet <edumazet(a)google.com>
tcp: cleanup tcp_remove_empty_skb() use
Eric Dumazet <edumazet(a)google.com>
tcp: remove dead code from tcp_sendmsg_locked()
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
pinctrl: qcom: lpass-lpi: fix concurrent register updates
Johan Hovold <johan+linaro(a)kernel.org>
ASoC: codecs: wcd938x: fix runtime PM imbalance on remove
Johan Hovold <johan+linaro(a)kernel.org>
ASoC: codecs: wcd938x: fix resource leaks on bind errors
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/head_fsl_booke.S | 2 +-
arch/powerpc/kernel/setup-common.c | 2 +
arch/powerpc/mm/mem.c | 1 -
arch/sparc/lib/checksum_32.S | 2 +-
arch/x86/include/asm/i8259.h | 2 +
arch/x86/include/asm/setup.h | 46 ++-
arch/x86/kernel/acpi/boot.c | 3 +
arch/x86/kernel/i8259.c | 38 +-
arch/x86/kernel/setup.c | 5 -
arch/x86/kernel/vmlinux.lds.S | 2 +-
drivers/base/driver.c | 69 ++++
drivers/base/platform.c | 28 +-
drivers/clk/clk.c | 21 +-
drivers/dma/ste_dma40.c | 1 +
drivers/firmware/imx/imx-dsp.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 19 +
drivers/gpu/drm/amd/amdgpu/vi.c | 2 +-
drivers/gpu/drm/drm_dp_mst_topology.c | 6 +-
drivers/gpu/drm/i915/i915_pmu.c | 9 +
drivers/gpu/drm/ttm/ttm_device.c | 8 +-
drivers/i2c/busses/i2c-aspeed.c | 3 +-
drivers/i2c/busses/i2c-stm32f7.c | 9 +-
drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
drivers/i2c/muxes/i2c-mux-gpmux.c | 2 +-
drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +-
drivers/iio/adc/exynos_adc.c | 24 +-
drivers/iio/adc/xilinx-xadc-core.c | 39 +-
drivers/iio/adc/xilinx-xadc.h | 2 +
drivers/iio/afe/iio-rescale.c | 162 ++++++--
drivers/input/mouse/synaptics.c | 1 +
drivers/input/rmi4/rmi_smbus.c | 50 +--
drivers/irqchip/irq-riscv-intc.c | 10 +-
drivers/irqchip/irq-stm32-exti.c | 1 +
drivers/mcb/mcb-lpc.c | 35 +-
drivers/mcb/mcb-parse.c | 15 +-
drivers/misc/fastrpc.c | 10 +-
drivers/misc/pci_endpoint_test.c | 4 +
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +
drivers/net/ethernet/google/gve/gve_rx_dqo.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e.h | 2 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +-
drivers/net/ethernet/intel/igc/igc_ethtool.c | 35 +-
drivers/net/ethernet/realtek/r8169_main.c | 6 +-
drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +-
drivers/net/gtp.c | 5 +-
drivers/net/ieee802154/adf7242.c | 5 +-
drivers/net/usb/r8152.c | 18 +-
drivers/net/usb/smsc95xx.c | 4 +-
drivers/nvmem/imx-ocotp.c | 6 +-
drivers/pci/quirks.c | 8 +-
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +-
drivers/rpmsg/qcom_glink_native.c | 2 +
drivers/rpmsg/rpmsg_core.c | 37 +-
drivers/rpmsg/rpmsg_internal.h | 5 +-
drivers/rpmsg/rpmsg_ns.c | 4 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +-
drivers/spi/spi-npcm-fiu.c | 5 +-
drivers/tty/n_gsm.c | 2 +
drivers/tty/serial/8250/8250_pci.c | 327 +++++++++++++++-
drivers/usb/gadget/legacy/raw_gadget.c | 26 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/usb/typec/tcpm/tcpm.c | 3 +
drivers/vhost/vhost.c | 4 +-
drivers/video/fbdev/aty/atyfb_base.c | 4 +
drivers/video/fbdev/uvesafb.c | 2 +-
drivers/virtio/virtio_balloon.c | 6 +-
drivers/virtio/virtio_mmio.c | 19 +-
fs/ext4/mballoc.c | 51 ++-
fs/ext4/mballoc.h | 14 +
fs/nfsd/vfs.c | 12 +-
fs/ntfs3/attrib.c | 6 +-
fs/ntfs3/attrlist.c | 15 +-
fs/ntfs3/bitmap.c | 3 +-
fs/ntfs3/dir.c | 6 +-
fs/ntfs3/frecord.c | 8 +-
fs/ntfs3/fslog.c | 6 +-
fs/ntfs3/fsntfs.c | 13 +-
fs/ntfs3/super.c | 2 +-
include/linux/device/driver.h | 2 +
include/linux/iio/afe/rescale.h | 36 ++
include/linux/kasan.h | 6 +-
include/linux/pci_ids.h | 1 +
include/linux/platform_device.h | 6 +-
include/linux/rpmsg.h | 14 +-
include/net/tcp.h | 2 +-
include/uapi/linux/can/isotp.h | 25 +-
include/uapi/linux/gtp.h | 2 +-
kernel/events/core.c | 3 +-
kernel/trace/trace_kprobe.c | 4 +-
mm/kasan/report.c | 4 +-
mm/migrate.c | 14 +-
mm/page_alloc.c | 2 +-
net/can/isotp.c | 438 ++++++++++++++--------
net/core/neighbour.c | 67 ++--
net/ipv4/tcp.c | 19 +-
net/ipv4/tcp_input.c | 9 +-
net/mptcp/protocol.c | 12 +-
net/netfilter/nfnetlink_log.c | 2 +-
net/sched/cls_u32.c | 2 +-
net/vmw_vsock/virtio_transport.c | 215 +++++++----
sound/hda/intel-dsp-config.c | 6 +
sound/soc/codecs/rt5645.c | 2 +
sound/soc/codecs/wcd938x.c | 52 ++-
sound/soc/generic/simple-card.c | 6 +-
tools/objtool/check.c | 2 +-
109 files changed, 1648 insertions(+), 678 deletions(-)
This is the start of the stable review cycle for the 5.10.200 release.
There are 91 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 09 Nov 2023 20:24:28 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.200-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.200-rc2
Mark Hasemeyer <markhas(a)chromium.org>
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
Andrey Konovalov <andreyknvl(a)gmail.com>
usb: raw-gadget: properly handle interrupted requests
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Lukas Magel <lukas.magel(a)posteo.net>
can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): do not validate unused address information
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: add local echo tx processing and tx without FC
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: handle wait_event_interruptible() return values
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: check CAN address family in isotp_bind()
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: set max PDU size to 64 kByte
Patrick Menschel <menschel.p(a)posteo.de>
can: isotp: Add error message if txqueuelen is too small
Patrick Menschel <menschel.p(a)posteo.de>
can: isotp: add symbolic error message to isotp_module_init()
Patrick Menschel <menschel.p(a)posteo.de>
can: isotp: change error format from decimal to symbolic error names
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix boot crash with FLATMEM
Su Hui <suhui(a)nfschina.com>
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Liming Sun <limings(a)nvidia.com>
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Tomas Henzl <thenzl(a)redhat.com>
scsi: mpt3sas: Fix in error path
Jorge Maidana <jorgem.linux(a)gmail.com>
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Shuming Fan <shumingf(a)realtek.com>
ASoC: rt5650: fix the wrong result of key button
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink_log: silence bogus compiler warning
William A. Kennington III <william(a)wkennington.com>
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Arnd Bergmann <arnd(a)arndb.de>
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Zhang Shurong <zhang_shurong(a)foxmail.com>
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
Ben Wolsieffer <ben.wolsieffer(a)hefring.com>
irqchip/stm32-exti: add missing DT IRQ flag translation
Gustavo A. R. Silva <gustavoars(a)kernel.org>
net: sched: cls_u32: Fix allocation size in u32_init()
Juergen Gross <jgross(a)suse.com>
x86: Fix .brk attribute in linker script
Hangyu Hua <hbh25y(a)gmail.com>
rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
Bjorn Andersson <quic_bjorande(a)quicinc.com>
rpmsg: glink: Release driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix calling device_lock() on non-initialized device
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix kfree() of static memory on setting driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Constify local variable in field store macro
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
driver: platform: Add helper for safer setting of driver_override
John Sperbeck <jsperbeck(a)google.com>
objtool/x86: add missing embedded_insn check
Baokun Li <libaokun1(a)huawei.com>
ext4: avoid overlapping preallocations due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: add two helper functions extent_logical_end() and pa_logical_end()
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/mm: Fix RESERVE_BRK() for older binutils
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/mm: Simplify RESERVE_BRK()
Chao Yu <chao(a)kernel.org>
f2fs: fix to do sanity check on inode type during garbage collection
Steve French <stfrench(a)microsoft.com>
smbdirect: missing rc checks while waiting for rdma events
Wang Hai <wanghai38(a)huawei.com>
kobject: Fix slab-out-of-bounds in fill_kobj_path()
Thomas Gleixner <tglx(a)linutronix.de>
x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
Robert Hancock <robert.hancock(a)calian.com>
iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
iio: adc: xilinx: use more devres helpers and remove remove()
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
iio: adc: xilinx: use devm_krealloc() instead of kfree() + kcalloc()
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
iio: adc: xilinx: use helper variable for &pdev->dev
Alessandro Carminati <alessandro.carminati(a)gmail.com>
clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a braino in fault handling in csum_and_copy_..._user()
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix potential NULL deref
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6UL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6SLL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6ULL
Ekansh Gupta <quic_ekangupt(a)quicinc.com>
misc: fastrpc: Clean buffers on remote invocation failures
Yujie Liu <yujie.liu(a)intel.com>
tracing/kprobes: Fix the description of variable length arguments
Jian Zhang <zhangjian.3032(a)bytedance.com>
i2c: aspeed: Fix i2c bus hang in slave read
Alain Volmat <alain.volmat(a)foss.st.com>
i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
Marek Szyprowski <m.szyprowski(a)samsung.com>
iio: exynos-adc: request second interupt only when touchscreen mode is used
Haibo Li <haibo.li(a)mediatek.com>
kasan: print the original fault addr when access invalid shadow
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: fix fragmentation needed check with gso
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: uapi: fix GTPA_MAX
Fred Chen <fred.chenchen03(a)gmail.com>
tcp: fix wrong RTO timeout when received SACK reneging
Douglas Anderson <dianders(a)chromium.org>
r8152: Release firmware if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Cancel hw_phy_work if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Run the unload routine if we have errors during probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Increase USB control msg timeout to 5000ms as per spec
Shigeru Yoshida <syoshida(a)redhat.com>
net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
Sasha Neftin <sasha.neftin(a)intel.com>
igc: Fix ambiguity in the ethtool advertising
Eric Dumazet <edumazet(a)google.com>
neighbour: fix various data-races
Mateusz Palczewski <mateusz.palczewski(a)intel.com>
igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
Kunwu Chan <chentao(a)kylinos.cn>
treewide: Spelling fix in comment
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
Lukasz Majczak <lma(a)semihalf.com>
drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
mmc: renesas_sdhi: use custom mask for TMIO_MASK_ALL
Kemeng Shi <shikemeng(a)huaweicloud.com>
mm/page_alloc: correct start page when guard page debug is enabled
Maximilian Heyne <mheyne(a)amazon.de>
virtio-mmio: fix memory leak of vm_dev
Gavin Shan <gshan(a)redhat.com>
virtio_balloon: Fix endless deflation and inflation on arm64
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb-lpc: Reallocate memory region to avoid memory overlapping
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb: Return actual parsed size when reading chameleon table
Francis Laniel <flaniel(a)linux.microsoft.com>
selftests/ftrace: Add new test case which checks non unique symbol
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/setup-common.c | 2 +
arch/powerpc/mm/mem.c | 1 -
arch/sparc/lib/checksum_32.S | 2 +-
arch/x86/include/asm/i8259.h | 2 +
arch/x86/include/asm/setup.h | 46 +--
arch/x86/kernel/acpi/boot.c | 3 +
arch/x86/kernel/i8259.c | 38 +-
arch/x86/kernel/setup.c | 5 -
arch/x86/kernel/vmlinux.lds.S | 2 +-
drivers/base/driver.c | 69 ++++
drivers/base/platform.c | 28 +-
drivers/clk/clk.c | 21 +-
drivers/dma/ste_dma40.c | 1 +
drivers/gpu/drm/drm_dp_mst_topology.c | 6 +-
drivers/i2c/busses/i2c-aspeed.c | 3 +-
drivers/i2c/busses/i2c-stm32f7.c | 9 +-
drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
drivers/i2c/muxes/i2c-mux-gpmux.c | 2 +-
drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +-
drivers/iio/adc/exynos_adc.c | 24 +-
drivers/iio/adc/xilinx-xadc-core.c | 179 ++++-----
drivers/input/mouse/synaptics.c | 1 +
drivers/input/rmi4/rmi_smbus.c | 50 ++-
drivers/irqchip/irq-stm32-exti.c | 1 +
drivers/mcb/mcb-lpc.c | 35 +-
drivers/mcb/mcb-parse.c | 15 +-
drivers/misc/fastrpc.c | 10 +-
drivers/mmc/host/renesas_sdhi_core.c | 3 +-
drivers/mmc/host/tmio_mmc.h | 2 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +-
drivers/net/ethernet/intel/igc/igc_ethtool.c | 35 +-
drivers/net/ethernet/realtek/r8169_main.c | 4 +-
drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +-
drivers/net/gtp.c | 5 +-
drivers/net/ieee802154/adf7242.c | 5 +-
drivers/net/usb/r8152.c | 11 +-
drivers/net/usb/smsc95xx.c | 4 +-
drivers/nvmem/imx-ocotp.c | 6 +-
drivers/pci/quirks.c | 8 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +-
drivers/rpmsg/qcom_glink_native.c | 2 +
drivers/rpmsg/rpmsg_core.c | 37 +-
drivers/rpmsg/rpmsg_internal.h | 5 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +-
drivers/spi/spi-npcm-fiu.c | 5 +-
drivers/tty/serial/8250/8250_pci.c | 122 +++++-
drivers/usb/gadget/legacy/raw_gadget.c | 26 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/video/fbdev/aty/atyfb_base.c | 4 +
drivers/video/fbdev/uvesafb.c | 2 +-
drivers/virtio/virtio_balloon.c | 6 +-
drivers/virtio/virtio_mmio.c | 19 +-
fs/cifs/smbdirect.c | 14 +-
fs/ext4/mballoc.c | 51 +--
fs/ext4/mballoc.h | 14 +
fs/f2fs/gc.c | 3 +-
include/linux/device/driver.h | 2 +
include/linux/kasan.h | 6 +-
include/linux/pci_ids.h | 1 +
include/linux/platform_device.h | 6 +-
include/linux/rpmsg.h | 14 +-
include/uapi/linux/can/isotp.h | 25 +-
include/uapi/linux/gtp.h | 2 +-
kernel/events/core.c | 3 +-
kernel/trace/trace_kprobe.c | 4 +-
lib/kobject.c | 12 +-
mm/kasan/report.c | 4 +-
mm/page_alloc.c | 2 +-
net/can/isotp.c | 446 +++++++++++++--------
net/core/neighbour.c | 67 ++--
net/ipv4/tcp_input.c | 9 +-
net/netfilter/nfnetlink_log.c | 2 +-
net/sched/cls_u32.c | 2 +-
sound/hda/intel-dsp-config.c | 6 +
sound/soc/codecs/rt5645.c | 2 +
tools/objtool/check.c | 2 +-
.../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13 +
80 files changed, 1053 insertions(+), 572 deletions(-)
I'm announcing the release of the 6.6.1 kernel.
All users of the 6.6 kernel series must upgrade.
The updated 6.6.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/devicetree/bindings/serial/rs485.yaml | 4
Makefile | 2
drivers/bluetooth/hci_bcm4377.c | 5
drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c | 3
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 3
drivers/misc/pci_endpoint_test.c | 4
drivers/pci/quirks.c | 8
drivers/power/supply/power_supply_core.c | 8
drivers/tty/n_gsm.c | 2
drivers/tty/serial/8250/8250_pci.c | 327 +++++++++++++++++++-
drivers/tty/serial/serial_core.c | 2
drivers/usb/gadget/legacy/raw_gadget.c | 26 -
drivers/usb/storage/unusual_cypress.h | 2
drivers/usb/typec/tcpm/tcpm.c | 5
fs/tracefs/event_inode.c | 288 ++++++++++-------
include/linux/pci_ids.h | 1
include/linux/power_supply.h | 2
include/linux/trace_events.h | 4
kernel/trace/trace.c | 15
kernel/trace/trace.h | 3
kernel/trace/trace_events.c | 31 +
kernel/trace/trace_events_filter.c | 3
sound/hda/intel-dsp-config.c | 6
sound/soc/sof/sof-pci-dev.c | 7
sound/usb/quirks.c | 2
tools/perf/util/evlist.c | 5
26 files changed, 623 insertions(+), 145 deletions(-)
Andrey Konovalov (1):
usb: raw-gadget: properly handle interrupted requests
Badhri Jagan Sridharan (1):
usb: typec: tcpm: Add additional checks for contaminant
Cameron Williams (9):
tty: 8250: Remove UC-257 and UC-431
tty: 8250: Add support for additional Brainboxes UC cards
tty: 8250: Add support for Brainboxes UP cards
tty: 8250: Add support for Intashield IS-100
tty: 8250: Fix port count of PX-257
tty: 8250: Fix up PX-803/PX-857
tty: 8250: Add support for additional Brainboxes PX cards
tty: 8250: Add support for Intashield IX cards
tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
Daniel Starke (1):
tty: n_gsm: fix race condition in status line change on dead connections
Francesco Dolcini (1):
dt-bindings: serial: rs485: Add rs485-rts-active-high
Greg Kroah-Hartman (1):
Linux 6.6.1
Ian Rogers (1):
perf evlist: Avoid frequency mode for the dummy event
Janne Grunau (1):
Bluetooth: hci_bcm4377: Mark bcm4378/bcm4387 as BROKEN_LE_CODED
Jimmy Hu (1):
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
Kai-Heng Feng (1):
power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint
LihaSika (1):
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Mark Hasemeyer (2):
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
ASoC: SOF: sof-pci-dev: Fix community key quirk detection
Max McCarthy (1):
ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices
Nicholas Kazlauskas (1):
drm/amd/display: Don't use fsleep for PSR exit waits
Siddharth Vadapalli (1):
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Steven Rostedt (Google) (5):
tracing: Have trace_event_file have ref counters
eventfs: Remove "is_freed" union with rcu head
eventfs: Save ownership and mode
eventfs: Delete eventfs_inode when the last dentry is freed
eventfs: Use simple_recursive_removal() to clean up dentries
Tony Lindgren (1):
serial: core: Fix runtime PM handling for pending tx
Vicki Pfau (1):
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
This is the start of the stable review cycle for the 6.6.1 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Nov 2023 13:02:46 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.1-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.6.1-rc1
Mark Hasemeyer <markhas(a)chromium.org>
ASoC: SOF: sof-pci-dev: Fix community key quirk detection
Mark Hasemeyer <markhas(a)chromium.org>
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Tony Lindgren <tony(a)atomide.com>
serial: core: Fix runtime PM handling for pending tx
Siddharth Vadapalli <s-vadapalli(a)ti.com>
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Francesco Dolcini <francesco.dolcini(a)toradex.com>
dt-bindings: serial: rs485: Add rs485-rts-active-high
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes PX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix up PX-803/PX-857
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix port count of PX-257
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix race condition in status line change on dead connections
Janne Grunau <j(a)jannau.net>
Bluetooth: hci_bcm4377: Mark bcm4378/bcm4387 as BROKEN_LE_CODED
Andrey Konovalov <andreyknvl(a)gmail.com>
usb: raw-gadget: properly handle interrupted requests
Jimmy Hu <hhhuuu(a)google.com>
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
Badhri Jagan Sridharan <badhri(a)google.com>
usb: typec: tcpm: Add additional checks for contaminant
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Max McCarthy <mmccarthy(a)mcintoshlabs.com>
ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices
Steven Rostedt (Google) <rostedt(a)goodmis.org>
eventfs: Use simple_recursive_removal() to clean up dentries
Steven Rostedt (Google) <rostedt(a)goodmis.org>
eventfs: Delete eventfs_inode when the last dentry is freed
Steven Rostedt (Google) <rostedt(a)goodmis.org>
eventfs: Save ownership and mode
Steven Rostedt (Google) <rostedt(a)goodmis.org>
eventfs: Remove "is_freed" union with rcu head
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Have trace_event_file have ref counters
Ian Rogers <irogers(a)google.com>
perf evlist: Avoid frequency mode for the dummy event
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint
Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
drm/amd/display: Don't use fsleep for PSR exit waits
-------------
Diffstat:
.../devicetree/bindings/serial/rs485.yaml | 4 +
Makefile | 4 +-
drivers/bluetooth/hci_bcm4377.c | 5 +
drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c | 3 +-
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 3 +-
drivers/misc/pci_endpoint_test.c | 4 +
drivers/pci/quirks.c | 8 +-
drivers/power/supply/power_supply_core.c | 8 +-
drivers/tty/n_gsm.c | 2 +
drivers/tty/serial/8250/8250_pci.c | 327 ++++++++++++++++++++-
drivers/tty/serial/serial_core.c | 2 +-
drivers/usb/gadget/legacy/raw_gadget.c | 26 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/usb/typec/tcpm/tcpm.c | 5 +
fs/tracefs/event_inode.c | 288 +++++++++++-------
include/linux/pci_ids.h | 1 +
include/linux/power_supply.h | 2 +-
include/linux/trace_events.h | 4 +
kernel/trace/trace.c | 15 +
kernel/trace/trace.h | 3 +
kernel/trace/trace_events.c | 31 +-
kernel/trace/trace_events_filter.c | 3 +
sound/hda/intel-dsp-config.c | 6 +
sound/soc/sof/sof-pci-dev.c | 7 +
sound/usb/quirks.c | 2 +
tools/perf/util/evlist.c | 5 +-
26 files changed, 624 insertions(+), 146 deletions(-)
During SMBus block data read process, we have seen high interrupt rate
because of TX_EMPTY irq status while waiting for block length byte (the
first data byte after the address phase). The interrupt handler does not
do anything because the internal state is kept as STATUS_WRITE_IN_PROGRESS.
Hence, we should disable TX_EMPTY IRQ until I2C DesignWare receives
first data byte from I2C device, then re-enable it to resume SMBus
transaction.
It takes 0.789 ms for host to receive data length from slave.
Without the patch, i2c_dw_isr() is called 99 times by TX_EMPTY interrupt.
And it is none after applying the patch.
Cc: stable(a)vger.kernel.org
Co-developed-by: Chuong Tran <chuong(a)os.amperecomputing.com>
Signed-off-by: Chuong Tran <chuong(a)os.amperecomputing.com>
Signed-off-by: Tam Nguyen <tamnguyenchi(a)os.amperecomputing.com>
---
v2:
+ Reduce the indentations level
+ Use regmap_update_bits for bitfield update
+ Rewrite comment statement [Serge]
+ Update commit message
+ Add Co-developed-by tag for co-authors [Andy]
v1:
https://lore.kernel.org/lkml/avd7jhwexehgbvi6euzdwvf5zvqqgjx4ozo6uxu2qpmlar…
---
drivers/i2c/busses/i2c-designware-master.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index 55ea91a63382..ae76620ef35e 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -456,10 +456,16 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
/*
* Because we don't know the buffer length in the
- * I2C_FUNC_SMBUS_BLOCK_DATA case, we can't stop
- * the transaction here.
+ * I2C_FUNC_SMBUS_BLOCK_DATA case, we can't stop the
+ * transaction here. Also disable the TX_EMPTY IRQ
+ * while waiting for the data length byte to avoid the
+ * bogus interrupts flood.
*/
- if (buf_len > 0 || flags & I2C_M_RECV_LEN) {
+ if (flags & I2C_M_RECV_LEN) {
+ dev->status |= STATUS_WRITE_IN_PROGRESS;
+ intr_mask &= ~DW_IC_INTR_TX_EMPTY;
+ break;
+ } else if (buf_len > 0) {
/* more bytes to be written */
dev->status |= STATUS_WRITE_IN_PROGRESS;
break;
@@ -495,6 +501,13 @@ i2c_dw_recv_len(struct dw_i2c_dev *dev, u8 len)
msgs[dev->msg_read_idx].len = len;
msgs[dev->msg_read_idx].flags &= ~I2C_M_RECV_LEN;
+ /*
+ * Received buffer length, re-enable TX_EMPTY interrupt
+ * to resume the SMBUS transaction.
+ */
+ regmap_update_bits(dev->map, DW_IC_INTR_MASK, DW_IC_INTR_TX_EMPTY,
+ DW_IC_INTR_TX_EMPTY);
+
return len;
}
--
2.25.1
From: Heiner Kallweit <hkallweit1(a)gmail.com>
This effectively reverts 4b5f82f6aaef. On a number of systems ASPM L1
causes tx timeouts with RTL8168h, see referenced bug report.
Fixes: 4b5f82f6aaef ("r8169: enable ASPM L1/L1.1 from RTL8168h")
Cc: stable(a)vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217814
Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
(cherry picked from commit 90ca51e8c654699b672ba61aeaa418dfb3252e5e)
---
drivers/net/ethernet/realtek/r8169_main.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 45147a1016be..27efd07f09ef 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -5224,13 +5224,9 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
/* Disable ASPM L1 as that cause random device stop working
* problems as well as full system hangs for some PCIe devices users.
- * Chips from RTL8168h partially have issues with L1.2, but seem
- * to work fine with L1 and L1.1.
*/
if (rtl_aspm_is_safe(tp))
rc = 0;
- else if (tp->mac_version >= RTL_GIGA_MAC_VER_46)
- rc = pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2);
else
rc = pci_disable_link_state(pdev, PCIE_LINK_STATE_L1);
tp->aspm_manageable = !rc;
--
2.25.1
A recent change to the optimization pipeline in LLVM reveals some
fragility around the inlining of LoongArch's __percpu functions, which
manifests as a BUILD_BUG() failure:
In file included from kernel/sched/build_policy.c:17:
In file included from include/linux/sched/cputime.h:5:
In file included from include/linux/sched/signal.h:5:
In file included from include/linux/rculist.h:11:
In file included from include/linux/rcupdate.h:26:
In file included from include/linux/irqflags.h:18:
arch/loongarch/include/asm/percpu.h:97:3: error: call to '__compiletime_assert_51' declared with 'error' attribute: BUILD_BUG failed
97 | BUILD_BUG();
| ^
include/linux/build_bug.h:59:21: note: expanded from macro 'BUILD_BUG'
59 | #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed")
| ^
include/linux/build_bug.h:39:37: note: expanded from macro 'BUILD_BUG_ON_MSG'
39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^
include/linux/compiler_types.h:425:2: note: expanded from macro 'compiletime_assert'
425 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:413:2: note: expanded from macro '_compiletime_assert'
413 | __compiletime_assert(condition, msg, prefix, suffix)
| ^
include/linux/compiler_types.h:406:4: note: expanded from macro '__compiletime_assert'
406 | prefix ## suffix(); \
| ^
<scratch space>:86:1: note: expanded from here
86 | __compiletime_assert_51
| ^
1 error generated.
If these functions are not inlined (which the compiler is free to do
even with functions marked with the standard 'inline' keyword), the
BUILD_BUG() in the default case cannot be eliminated since the compiler
cannot prove it is never used, resulting in a build failure due to the
error attribute.
Mark these functions as __always_inline to guarantee inlining so that
the BUILD_BUG() only triggers when the default case genuinely cannot be
eliminated due to an unexpected size.
Cc: <stable(a)vger.kernel.org>
Closes: https://github.com/ClangBuiltLinux/linux/issues/1955
Fixes: 46859ac8af52 ("LoongArch: Add multi-processor (SMP) support")
Link: https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a5…
Suggested-by: Nick Desaulniers <ndesaulniers(a)google.com>
Signed-off-by: Nathan Chancellor <nathan(a)kernel.org>
---
Changes in v2:
- Change 'inline' to __always_inline for all functions that contain
BUILD_BUG() (Huacai)
- Notate that 'inline' does not guarantee inlining in the commit message
to further clarify the change to __always_inline.
- Link to v1: https://lore.kernel.org/r/20231101-loongarch-always-inline-percpu-ops-v1-1-…
---
arch/loongarch/include/asm/percpu.h | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/loongarch/include/asm/percpu.h b/arch/loongarch/include/asm/percpu.h
index b9f567e66016..313852fba845 100644
--- a/arch/loongarch/include/asm/percpu.h
+++ b/arch/loongarch/include/asm/percpu.h
@@ -32,7 +32,7 @@ static inline void set_my_cpu_offset(unsigned long off)
#define __my_cpu_offset __my_cpu_offset
#define PERCPU_OP(op, asm_op, c_op) \
-static inline unsigned long __percpu_##op(void *ptr, \
+static __always_inline unsigned long __percpu_##op(void *ptr, \
unsigned long val, int size) \
{ \
unsigned long ret; \
@@ -63,7 +63,7 @@ PERCPU_OP(and, and, &)
PERCPU_OP(or, or, |)
#undef PERCPU_OP
-static inline unsigned long __percpu_read(void *ptr, int size)
+static __always_inline unsigned long __percpu_read(void *ptr, int size)
{
unsigned long ret;
@@ -100,7 +100,8 @@ static inline unsigned long __percpu_read(void *ptr, int size)
return ret;
}
-static inline void __percpu_write(void *ptr, unsigned long val, int size)
+static __always_inline void __percpu_write(void *ptr, unsigned long val,
+ int size)
{
switch (size) {
case 1:
@@ -132,8 +133,8 @@ static inline void __percpu_write(void *ptr, unsigned long val, int size)
}
}
-static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
- int size)
+static __always_inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
+ int size)
{
switch (size) {
case 1:
---
base-commit: 278be83601dd1725d4732241f066d528e160a39d
change-id: 20231101-loongarch-always-inline-percpu-ops-cf77c161871f
Best regards,
--
Nathan Chancellor <nathan(a)kernel.org>
Hello,
This v2 series fixes the use-after-free bug in mtk_jpeg_dec_device_run.
This patch fixes the security bug in chrome-os.
It inclues reverting the incomplete fix before and make the right fix.
Also,it fixes the error of timeout-worker-schedule in multiple-core
devices.
1. Remove cancel worker in mtk_jpeg_remove for the worker is only
registered in single-core device but we try to cacnel it in both
single-core and multiple-core devices.
2. Fix use-after-free bug by delay the schedule_delayed_work only if
mtk_jpeg_set_dec_dst runs successfully.
3. Delay the schedule_delayed_work in mtk_jpegdec_worker as it has same
code logic in mtk_jpeg_dec_device_run.
version 2 changes
-put the patches into on series suggested by Dmitry
Zheng Wang (3):
media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the
crash of multi-core JPEG devices
media: mtk-jpeg: Fix use after free bug due to error path handling
in mtk_jpeg_dec_device_run
media: mtk-jpeg: Fix timeout schedule error in mtk_jpegdec_worker.
.../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--
2.25.1
From: Heiner Kallweit <hkallweit1(a)gmail.com>
[Backport: commit 90ca51e8c654699b672ba61aeaa418dfb3252e5e]
This backport to avoid the bug caused by r8169.
This effectively reverts 4b5f82f6aaef. On a number of systems ASPM L1
causes tx timeouts with RTL8168h, see referenced bug report.
Fixes: 4b5f82f6aaef ("r8169: enable ASPM L1/L1.1 from RTL8168h")
Cc: stable(a)vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217814
Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
---
drivers/net/ethernet/realtek/r8169_main.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 45147a1016be..27efd07f09ef 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -5224,13 +5224,9 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
/* Disable ASPM L1 as that cause random device stop working
* problems as well as full system hangs for some PCIe devices users.
- * Chips from RTL8168h partially have issues with L1.2, but seem
- * to work fine with L1 and L1.1.
*/
if (rtl_aspm_is_safe(tp))
rc = 0;
- else if (tp->mac_version >= RTL_GIGA_MAC_VER_46)
- rc = pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2);
else
rc = pci_disable_link_state(pdev, PCIE_LINK_STATE_L1);
tp->aspm_manageable = !rc;
--
2.25.1
Background: Turris Omnia (Armada 385); eth2 (mvneta) connected to SFP bus;
SFP module is present, but no fiber connected, so definitely no carrier.
After booting, eth2 is down, but netdev LED trigger surprisingly reports
link active. Then, after "ip link set eth2 up", the link indicator goes
away - as I would have expected it from the beginning.
It turns out, that the default carrier state after netdev creation is
"carrier ok". Some ethernet drivers explicitly call netif_carrier_off
during probing, others (like mvneta) don't - which explains the current
behaviour: only when the device is brought up, phylink_start calls
netif_carrier_off.
Fix this for all drivers using phylink, by calling netif_carrier_off in
phylink_create.
Fixes: 089381b27abe ("leds: initial support for Turris Omnia LEDs")
Cc: stable(a)vger.kernel.org
Suggested-by: Andrew Lunn <andrew(a)lunn.ch>
Signed-off-by: Klaus Kudielka <klaus.kudielka(a)gmail.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew(a)lunn.ch>
---
v2: clarified fixed drivers; added fixes tag & cc stable
drivers/net/phy/phylink.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 6712883498..a28da80bde 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -1616,6 +1616,7 @@ struct phylink *phylink_create(struct phylink_config *config,
pl->config = config;
if (config->type == PHYLINK_NETDEV) {
pl->netdev = to_net_dev(config->dev);
+ netif_carrier_off(pl->netdev);
} else if (config->type == PHYLINK_DEV) {
pl->dev = config->dev;
} else {
--
2.42.0
The rtnl lock also needs to be held before rndis_filter_device_add()
which advertises nvsp_2_vsc_capability / sriov bit, and triggers
VF NIC offering and registering. If VF NIC finished register_netdev()
earlier it may cause name based config failure.
To fix this issue, move the call to rtnl_lock() before
rndis_filter_device_add(), so VF will be registered later than netvsc
/ synthetic NIC, and gets a name numbered (ethX) after netvsc.
Cc: stable(a)vger.kernel.org
Fixes: e04e7a7bbd4b ("hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()")
Signed-off-by: Haiyang Zhang <haiyangz(a)microsoft.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek(a)intel.com>
---
v3:
Divide it into two patches, suggested by Jakub Kicinski.
v2:
Fix rtnl_unlock() in error handling as found by Wojciech Drewek.
---
drivers/net/hyperv/netvsc_drv.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 3ba3c8fb28a5..5e528a76f5f5 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2531,15 +2531,6 @@ static int netvsc_probe(struct hv_device *dev,
goto devinfo_failed;
}
- nvdev = rndis_filter_device_add(dev, device_info);
- if (IS_ERR(nvdev)) {
- ret = PTR_ERR(nvdev);
- netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
- goto rndis_failed;
- }
-
- eth_hw_addr_set(net, device_info->mac_adr);
-
/* We must get rtnl lock before scheduling nvdev->subchan_work,
* otherwise netvsc_subchan_work() can get rtnl lock first and wait
* all subchannels to show up, but that may not happen because
@@ -2547,9 +2538,23 @@ static int netvsc_probe(struct hv_device *dev,
* -> ... -> device_add() -> ... -> __device_attach() can't get
* the device lock, so all the subchannels can't be processed --
* finally netvsc_subchan_work() hangs forever.
+ *
+ * The rtnl lock also needs to be held before rndis_filter_device_add()
+ * which advertises nvsp_2_vsc_capability / sriov bit, and triggers
+ * VF NIC offering and registering. If VF NIC finished register_netdev()
+ * earlier it may cause name based config failure.
*/
rtnl_lock();
+ nvdev = rndis_filter_device_add(dev, device_info);
+ if (IS_ERR(nvdev)) {
+ ret = PTR_ERR(nvdev);
+ netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
+ goto rndis_failed;
+ }
+
+ eth_hw_addr_set(net, device_info->mac_adr);
+
if (nvdev->num_chn > 1)
schedule_work(&nvdev->subchan_work);
@@ -2586,9 +2591,9 @@ static int netvsc_probe(struct hv_device *dev,
return 0;
register_failed:
- rtnl_unlock();
rndis_filter_device_remove(dev, nvdev);
rndis_failed:
+ rtnl_unlock();
netvsc_devinfo_put(device_info);
devinfo_failed:
free_percpu(net_device_ctx->vf_stats);
--
2.25.1
This is the start of the stable review cycle for the 5.10.200 release.
There are 95 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Nov 2023 13:02:46 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.200-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.200-rc1
Mark Hasemeyer <markhas(a)chromium.org>
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
Andrey Konovalov <andreyknvl(a)gmail.com>
usb: raw-gadget: properly handle interrupted requests
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Lukas Magel <lukas.magel(a)posteo.net>
can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): do not validate unused address information
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: add local echo tx processing and tx without FC
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: handle wait_event_interruptible() return values
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: check CAN address family in isotp_bind()
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: set max PDU size to 64 kByte
Patrick Menschel <menschel.p(a)posteo.de>
can: isotp: Add error message if txqueuelen is too small
Patrick Menschel <menschel.p(a)posteo.de>
can: isotp: add symbolic error message to isotp_module_init()
Patrick Menschel <menschel.p(a)posteo.de>
can: isotp: change error format from decimal to symbolic error names
Ian Rogers <irogers(a)google.com>
perf evlist: Avoid frequency mode for the dummy event
Namhyung Kim <namhyung(a)kernel.org>
perf tools: Get rid of evlist__add_on_all_cpus()
Adrian Hunter <adrian.hunter(a)intel.com>
perf evlist: Add evlist__add_dummy_on_all_cpus()
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix boot crash with FLATMEM
Su Hui <suhui(a)nfschina.com>
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Liming Sun <limings(a)nvidia.com>
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Tomas Henzl <thenzl(a)redhat.com>
scsi: mpt3sas: Fix in error path
Jorge Maidana <jorgem.linux(a)gmail.com>
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Shuming Fan <shumingf(a)realtek.com>
ASoC: rt5650: fix the wrong result of key button
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink_log: silence bogus compiler warning
William A. Kennington III <william(a)wkennington.com>
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Arnd Bergmann <arnd(a)arndb.de>
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Zhang Shurong <zhang_shurong(a)foxmail.com>
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
Ben Wolsieffer <ben.wolsieffer(a)hefring.com>
irqchip/stm32-exti: add missing DT IRQ flag translation
Anup Patel <apatel(a)ventanamicro.com>
irqchip/riscv-intc: Mark all INTC nodes as initialized
Gustavo A. R. Silva <gustavoars(a)kernel.org>
net: sched: cls_u32: Fix allocation size in u32_init()
Juergen Gross <jgross(a)suse.com>
x86: Fix .brk attribute in linker script
Hangyu Hua <hbh25y(a)gmail.com>
rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
Bjorn Andersson <quic_bjorande(a)quicinc.com>
rpmsg: glink: Release driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix calling device_lock() on non-initialized device
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix kfree() of static memory on setting driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Constify local variable in field store macro
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
driver: platform: Add helper for safer setting of driver_override
John Sperbeck <jsperbeck(a)google.com>
objtool/x86: add missing embedded_insn check
Baokun Li <libaokun1(a)huawei.com>
ext4: avoid overlapping preallocations due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: add two helper functions extent_logical_end() and pa_logical_end()
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/mm: Fix RESERVE_BRK() for older binutils
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/mm: Simplify RESERVE_BRK()
Chao Yu <chao(a)kernel.org>
f2fs: fix to do sanity check on inode type during garbage collection
Steve French <stfrench(a)microsoft.com>
smbdirect: missing rc checks while waiting for rdma events
Wang Hai <wanghai38(a)huawei.com>
kobject: Fix slab-out-of-bounds in fill_kobj_path()
Thomas Gleixner <tglx(a)linutronix.de>
x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
Robert Hancock <robert.hancock(a)calian.com>
iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
iio: adc: xilinx: use more devres helpers and remove remove()
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
iio: adc: xilinx: use devm_krealloc() instead of kfree() + kcalloc()
Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
iio: adc: xilinx: use helper variable for &pdev->dev
Alessandro Carminati <alessandro.carminati(a)gmail.com>
clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a braino in fault handling in csum_and_copy_..._user()
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix potential NULL deref
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6UL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6SLL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6ULL
Ekansh Gupta <quic_ekangupt(a)quicinc.com>
misc: fastrpc: Clean buffers on remote invocation failures
Yujie Liu <yujie.liu(a)intel.com>
tracing/kprobes: Fix the description of variable length arguments
Jian Zhang <zhangjian.3032(a)bytedance.com>
i2c: aspeed: Fix i2c bus hang in slave read
Alain Volmat <alain.volmat(a)foss.st.com>
i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
Marek Szyprowski <m.szyprowski(a)samsung.com>
iio: exynos-adc: request second interupt only when touchscreen mode is used
Haibo Li <haibo.li(a)mediatek.com>
kasan: print the original fault addr when access invalid shadow
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: fix fragmentation needed check with gso
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: uapi: fix GTPA_MAX
Fred Chen <fred.chenchen03(a)gmail.com>
tcp: fix wrong RTO timeout when received SACK reneging
Douglas Anderson <dianders(a)chromium.org>
r8152: Release firmware if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Cancel hw_phy_work if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Run the unload routine if we have errors during probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Increase USB control msg timeout to 5000ms as per spec
Shigeru Yoshida <syoshida(a)redhat.com>
net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
Sasha Neftin <sasha.neftin(a)intel.com>
igc: Fix ambiguity in the ethtool advertising
Eric Dumazet <edumazet(a)google.com>
neighbour: fix various data-races
Mateusz Palczewski <mateusz.palczewski(a)intel.com>
igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
Kunwu Chan <chentao(a)kylinos.cn>
treewide: Spelling fix in comment
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
Lukasz Majczak <lma(a)semihalf.com>
drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
mmc: renesas_sdhi: use custom mask for TMIO_MASK_ALL
Kemeng Shi <shikemeng(a)huaweicloud.com>
mm/page_alloc: correct start page when guard page debug is enabled
Maximilian Heyne <mheyne(a)amazon.de>
virtio-mmio: fix memory leak of vm_dev
Gavin Shan <gshan(a)redhat.com>
virtio_balloon: Fix endless deflation and inflation on arm64
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb-lpc: Reallocate memory region to avoid memory overlapping
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb: Return actual parsed size when reading chameleon table
Francis Laniel <flaniel(a)linux.microsoft.com>
selftests/ftrace: Add new test case which checks non unique symbol
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/setup-common.c | 2 +
arch/powerpc/mm/mem.c | 1 -
arch/sparc/lib/checksum_32.S | 2 +-
arch/x86/include/asm/i8259.h | 2 +
arch/x86/include/asm/setup.h | 46 +--
arch/x86/kernel/acpi/boot.c | 3 +
arch/x86/kernel/i8259.c | 38 +-
arch/x86/kernel/setup.c | 5 -
arch/x86/kernel/vmlinux.lds.S | 2 +-
drivers/base/driver.c | 69 ++++
drivers/base/platform.c | 28 +-
drivers/clk/clk.c | 21 +-
drivers/dma/ste_dma40.c | 1 +
drivers/gpu/drm/drm_dp_mst_topology.c | 6 +-
drivers/i2c/busses/i2c-aspeed.c | 3 +-
drivers/i2c/busses/i2c-stm32f7.c | 9 +-
drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
drivers/i2c/muxes/i2c-mux-gpmux.c | 2 +-
drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +-
drivers/iio/adc/exynos_adc.c | 24 +-
drivers/iio/adc/xilinx-xadc-core.c | 179 ++++-----
drivers/input/mouse/synaptics.c | 1 +
drivers/input/rmi4/rmi_smbus.c | 50 ++-
drivers/irqchip/irq-riscv-intc.c | 10 +-
drivers/irqchip/irq-stm32-exti.c | 1 +
drivers/mcb/mcb-lpc.c | 35 +-
drivers/mcb/mcb-parse.c | 15 +-
drivers/misc/fastrpc.c | 10 +-
drivers/mmc/host/renesas_sdhi_core.c | 3 +-
drivers/mmc/host/tmio_mmc.h | 2 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +-
drivers/net/ethernet/intel/igc/igc_ethtool.c | 35 +-
drivers/net/ethernet/realtek/r8169_main.c | 4 +-
drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +-
drivers/net/gtp.c | 5 +-
drivers/net/ieee802154/adf7242.c | 5 +-
drivers/net/usb/r8152.c | 11 +-
drivers/net/usb/smsc95xx.c | 4 +-
drivers/nvmem/imx-ocotp.c | 6 +-
drivers/pci/quirks.c | 8 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +-
drivers/rpmsg/qcom_glink_native.c | 2 +
drivers/rpmsg/rpmsg_core.c | 37 +-
drivers/rpmsg/rpmsg_internal.h | 5 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +-
drivers/spi/spi-npcm-fiu.c | 5 +-
drivers/tty/serial/8250/8250_pci.c | 122 +++++-
drivers/usb/gadget/legacy/raw_gadget.c | 26 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/video/fbdev/aty/atyfb_base.c | 4 +
drivers/video/fbdev/uvesafb.c | 2 +-
drivers/virtio/virtio_balloon.c | 6 +-
drivers/virtio/virtio_mmio.c | 19 +-
fs/cifs/smbdirect.c | 14 +-
fs/ext4/mballoc.c | 51 +--
fs/ext4/mballoc.h | 14 +
fs/f2fs/gc.c | 3 +-
include/linux/device/driver.h | 2 +
include/linux/kasan.h | 6 +-
include/linux/pci_ids.h | 1 +
include/linux/platform_device.h | 6 +-
include/linux/rpmsg.h | 14 +-
include/uapi/linux/can/isotp.h | 25 +-
include/uapi/linux/gtp.h | 2 +-
kernel/events/core.c | 3 +-
kernel/trace/trace_kprobe.c | 4 +-
lib/kobject.c | 12 +-
mm/kasan/report.c | 4 +-
mm/page_alloc.c | 2 +-
net/can/isotp.c | 446 +++++++++++++--------
net/core/neighbour.c | 67 ++--
net/ipv4/tcp_input.c | 9 +-
net/netfilter/nfnetlink_log.c | 2 +-
net/sched/cls_u32.c | 2 +-
sound/hda/intel-dsp-config.c | 6 +
sound/soc/codecs/rt5645.c | 2 +
tools/objtool/check.c | 2 +-
tools/perf/util/evlist.c | 21 +
tools/perf/util/evlist.h | 5 +
.../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13 +
83 files changed, 1088 insertions(+), 573 deletions(-)
This is the start of the stable review cycle for the 5.15.138 release.
There are 128 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Nov 2023 13:02:46 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.138-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.138-rc1
Mark Hasemeyer <markhas(a)chromium.org>
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Siddharth Vadapalli <s-vadapalli(a)ti.com>
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes PX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix up PX-803/PX-857
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix port count of PX-257
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix race condition in status line change on dead connections
Andrey Konovalov <andreyknvl(a)gmail.com>
usb: raw-gadget: properly handle interrupted requests
Jimmy Hu <hhhuuu(a)google.com>
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Disable ASPM for VI w/ all Intel systems
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Move helper for dynamic speed switch check out of smu13
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): do not validate unused address information
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: add local echo tx processing and tx without FC
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: handle wait_event_interruptible() return values
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: check CAN address family in isotp_bind()
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: set max PDU size to 64 kByte
Ian Rogers <irogers(a)google.com>
perf evlist: Avoid frequency mode for the dummy event
Namhyung Kim <namhyung(a)kernel.org>
perf tools: Get rid of evlist__add_on_all_cpus()
Adrian Hunter <adrian.hunter(a)intel.com>
perf evlist: Add evlist__add_dummy_on_all_cpus()
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix boot crash with FLATMEM
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in rtl_phy_patch_request()
Su Hui <suhui(a)nfschina.com>
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Liming Sun <limings(a)nvidia.com>
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Tomas Henzl <thenzl(a)redhat.com>
scsi: mpt3sas: Fix in error path
Jorge Maidana <jorgem.linux(a)gmail.com>
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Karolina Stolarek <karolina.stolarek(a)intel.com>
drm/ttm: Reorder sys manager cleanup step
Shuming Fan <shumingf(a)realtek.com>
ASoC: rt5650: fix the wrong result of key button
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink_log: silence bogus compiler warning
William A. Kennington III <william(a)wkennington.com>
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Su Hui <suhui(a)nfschina.com>
fs/ntfs3: Avoid possible memory leak
Gabriel Marcano <gabemarcano(a)yahoo.com>
fs/ntfs3: Fix directory element type detection
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Write immediately updated ntfs state
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Add ckeck in ni_update_parent()
Arnd Bergmann <arnd(a)arndb.de>
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/85xx: Fix math emulation exception
Zhang Shurong <zhang_shurong(a)foxmail.com>
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
Ben Wolsieffer <ben.wolsieffer(a)hefring.com>
irqchip/stm32-exti: add missing DT IRQ flag translation
Anup Patel <apatel(a)ventanamicro.com>
irqchip/riscv-intc: Mark all INTC nodes as initialized
Gustavo A. R. Silva <gustavoars(a)kernel.org>
net: sched: cls_u32: Fix allocation size in u32_init()
Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com>
ASoC: simple-card: fixup asoc_simple_probe() error handling
Juergen Gross <jgross(a)suse.com>
x86: Fix .brk attribute in linker script
Hangyu Hua <hbh25y(a)gmail.com>
rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
Bjorn Andersson <quic_bjorande(a)quicinc.com>
rpmsg: glink: Release driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix calling device_lock() on non-initialized device
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix kfree() of static memory on setting driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Constify local variable in field store macro
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
driver: platform: Add helper for safer setting of driver_override
John Sperbeck <jsperbeck(a)google.com>
objtool/x86: add missing embedded_insn check
Baokun Li <libaokun1(a)huawei.com>
ext4: avoid overlapping preallocations due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: add two helper functions extent_logical_end() and pa_logical_end()
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/mm: Fix RESERVE_BRK() for older binutils
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/mm: Simplify RESERVE_BRK()
Thomas Gleixner <tglx(a)linutronix.de>
x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
Shailend Chand <shailend(a)google.com>
gve: Fix GFP flags when allocing pages
Linus Walleij <linus.walleij(a)linaro.org>
iio: afe: rescale: Accept only offset channels
Liam Beguin <liambeguin(a)gmail.com>
iio: afe: rescale: add offset support
Liam Beguin <liambeguin(a)gmail.com>
iio: afe: rescale: expose scale processing function
Liam Beguin <liambeguin(a)gmail.com>
iio: afe: rescale: reorder includes
Alessandro Carminati <alessandro.carminati(a)gmail.com>
clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
Al Viro <viro(a)zeniv.linux.org.uk>
sparc32: fix a braino in fault handling in csum_and_copy_..._user()
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix potential NULL deref
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6UL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6SLL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6ULL
Ekansh Gupta <quic_ekangupt(a)quicinc.com>
misc: fastrpc: Clean buffers on remote invocation failures
Yujie Liu <yujie.liu(a)intel.com>
tracing/kprobes: Fix the description of variable length arguments
Jian Zhang <zhangjian.3032(a)bytedance.com>
i2c: aspeed: Fix i2c bus hang in slave read
Alain Volmat <alain.volmat(a)foss.st.com>
i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
Robert Hancock <robert.hancock(a)calian.com>
iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale
Robert Hancock <robert.hancock(a)calian.com>
iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
Marek Szyprowski <m.szyprowski(a)samsung.com>
iio: exynos-adc: request second interupt only when touchscreen mode is used
Haibo Li <haibo.li(a)mediatek.com>
kasan: print the original fault addr when access invalid shadow
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: fix fragmentation needed check with gso
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: uapi: fix GTPA_MAX
Fred Chen <fred.chenchen03(a)gmail.com>
tcp: fix wrong RTO timeout when received SACK reneging
Douglas Anderson <dianders(a)chromium.org>
r8152: Release firmware if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Cancel hw_phy_work if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Run the unload routine if we have errors during probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Increase USB control msg timeout to 5000ms as per spec
Shigeru Yoshida <syoshida(a)redhat.com>
net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
Sasha Neftin <sasha.neftin(a)intel.com>
igc: Fix ambiguity in the ethtool advertising
Eric Dumazet <edumazet(a)google.com>
neighbour: fix various data-races
Mateusz Palczewski <mateusz.palczewski(a)intel.com>
igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
Kunwu Chan <chentao(a)kylinos.cn>
treewide: Spelling fix in comment
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix I40E_FLAG_VF_VLAN_PRUNING value
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data-race in rtl_tx() while reading tp->cur_tx
Hao Ge <gehao(a)kylinos.cn>
firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
Lukasz Majczak <lma(a)semihalf.com>
drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
Alexandru Matei <alexandru.matei(a)uipath.com>
vsock/virtio: initialize the_virtio_vsock before using VQs
Stefano Garzarella <sgarzare(a)redhat.com>
vsock/virtio: add support for device suspend/resume
Stefano Garzarella <sgarzare(a)redhat.com>
vsock/virtio: factor our the code to initialize and delete VQs
Umesh Nerlige Ramappa <umesh.nerlige.ramappa(a)intel.com>
drm/i915/pmu: Check if pmu is closed before stopping event
Al Viro <viro(a)zeniv.linux.org.uk>
nfsd: lock_rename() needs both directories to live on the same fs
Gregory Price <gourry.memverge(a)gmail.com>
mm/migrate: fix do_pages_move for compat pointers
Kemeng Shi <shikemeng(a)huaweicloud.com>
mm/page_alloc: correct start page when guard page debug is enabled
Eric Auger <eric.auger(a)redhat.com>
vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE
Maximilian Heyne <mheyne(a)amazon.de>
virtio-mmio: fix memory leak of vm_dev
Gavin Shan <gshan(a)redhat.com>
virtio_balloon: Fix endless deflation and inflation on arm64
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb-lpc: Reallocate memory region to avoid memory overlapping
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb: Return actual parsed size when reading chameleon table
Paolo Abeni <pabeni(a)redhat.com>
mptcp: more conservative check for zero probes
Eric Dumazet <edumazet(a)google.com>
tcp: cleanup tcp_remove_empty_skb() use
Eric Dumazet <edumazet(a)google.com>
tcp: remove dead code from tcp_sendmsg_locked()
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
pinctrl: qcom: lpass-lpi: fix concurrent register updates
Johan Hovold <johan+linaro(a)kernel.org>
ASoC: codecs: wcd938x: fix runtime PM imbalance on remove
Johan Hovold <johan+linaro(a)kernel.org>
ASoC: codecs: wcd938x: fix resource leaks on bind errors
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/head_fsl_booke.S | 2 +-
arch/powerpc/kernel/setup-common.c | 2 +
arch/powerpc/mm/mem.c | 1 -
arch/sparc/lib/checksum_32.S | 2 +-
arch/x86/include/asm/i8259.h | 2 +
arch/x86/include/asm/setup.h | 46 ++-
arch/x86/kernel/acpi/boot.c | 3 +
arch/x86/kernel/i8259.c | 38 +-
arch/x86/kernel/setup.c | 5 -
arch/x86/kernel/vmlinux.lds.S | 2 +-
drivers/base/driver.c | 69 ++++
drivers/base/platform.c | 28 +-
drivers/clk/clk.c | 21 +-
drivers/dma/ste_dma40.c | 1 +
drivers/firmware/imx/imx-dsp.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 19 +
drivers/gpu/drm/amd/amdgpu/vi.c | 2 +-
drivers/gpu/drm/drm_dp_mst_topology.c | 6 +-
drivers/gpu/drm/i915/i915_pmu.c | 9 +
drivers/gpu/drm/ttm/ttm_device.c | 8 +-
drivers/i2c/busses/i2c-aspeed.c | 3 +-
drivers/i2c/busses/i2c-stm32f7.c | 9 +-
drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
drivers/i2c/muxes/i2c-mux-gpmux.c | 2 +-
drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +-
drivers/iio/adc/exynos_adc.c | 24 +-
drivers/iio/adc/xilinx-xadc-core.c | 39 +-
drivers/iio/adc/xilinx-xadc.h | 2 +
drivers/iio/afe/iio-rescale.c | 162 ++++++--
drivers/input/mouse/synaptics.c | 1 +
drivers/input/rmi4/rmi_smbus.c | 50 +--
drivers/irqchip/irq-riscv-intc.c | 10 +-
drivers/irqchip/irq-stm32-exti.c | 1 +
drivers/mcb/mcb-lpc.c | 35 +-
drivers/mcb/mcb-parse.c | 15 +-
drivers/misc/fastrpc.c | 10 +-
drivers/misc/pci_endpoint_test.c | 4 +
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +
drivers/net/ethernet/google/gve/gve_rx_dqo.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e.h | 2 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +-
drivers/net/ethernet/intel/igc/igc_ethtool.c | 35 +-
drivers/net/ethernet/realtek/r8169_main.c | 6 +-
drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +-
drivers/net/gtp.c | 5 +-
drivers/net/ieee802154/adf7242.c | 5 +-
drivers/net/usb/r8152.c | 18 +-
drivers/net/usb/smsc95xx.c | 4 +-
drivers/nvmem/imx-ocotp.c | 6 +-
drivers/pci/quirks.c | 8 +-
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +-
drivers/rpmsg/qcom_glink_native.c | 2 +
drivers/rpmsg/rpmsg_core.c | 37 +-
drivers/rpmsg/rpmsg_internal.h | 5 +-
drivers/rpmsg/rpmsg_ns.c | 4 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +-
drivers/spi/spi-npcm-fiu.c | 5 +-
drivers/tty/n_gsm.c | 2 +
drivers/tty/serial/8250/8250_pci.c | 327 +++++++++++++++-
drivers/usb/gadget/legacy/raw_gadget.c | 26 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/usb/typec/tcpm/tcpm.c | 3 +
drivers/vhost/vhost.c | 4 +-
drivers/video/fbdev/aty/atyfb_base.c | 4 +
drivers/video/fbdev/uvesafb.c | 2 +-
drivers/virtio/virtio_balloon.c | 6 +-
drivers/virtio/virtio_mmio.c | 19 +-
fs/ext4/mballoc.c | 51 ++-
fs/ext4/mballoc.h | 14 +
fs/nfsd/vfs.c | 12 +-
fs/ntfs3/attrib.c | 6 +-
fs/ntfs3/attrlist.c | 15 +-
fs/ntfs3/bitmap.c | 3 +-
fs/ntfs3/dir.c | 6 +-
fs/ntfs3/frecord.c | 8 +-
fs/ntfs3/fslog.c | 6 +-
fs/ntfs3/fsntfs.c | 13 +-
fs/ntfs3/super.c | 2 +-
include/linux/device/driver.h | 2 +
include/linux/iio/afe/rescale.h | 36 ++
include/linux/kasan.h | 6 +-
include/linux/pci_ids.h | 1 +
include/linux/platform_device.h | 6 +-
include/linux/rpmsg.h | 14 +-
include/net/tcp.h | 2 +-
include/uapi/linux/can/isotp.h | 25 +-
include/uapi/linux/gtp.h | 2 +-
kernel/events/core.c | 3 +-
kernel/trace/trace_kprobe.c | 4 +-
mm/kasan/report.c | 4 +-
mm/migrate.c | 14 +-
mm/page_alloc.c | 2 +-
net/can/isotp.c | 438 ++++++++++++++--------
net/core/neighbour.c | 67 ++--
net/ipv4/tcp.c | 19 +-
net/ipv4/tcp_input.c | 9 +-
net/mptcp/protocol.c | 12 +-
net/netfilter/nfnetlink_log.c | 2 +-
net/sched/cls_u32.c | 2 +-
net/vmw_vsock/virtio_transport.c | 215 +++++++----
sound/hda/intel-dsp-config.c | 6 +
sound/soc/codecs/rt5645.c | 2 +
sound/soc/codecs/wcd938x.c | 52 ++-
sound/soc/generic/simple-card.c | 6 +-
tools/objtool/check.c | 2 +-
tools/perf/util/evlist.c | 21 ++
tools/perf/util/evlist.h | 5 +
111 files changed, 1674 insertions(+), 678 deletions(-)
This is the start of the stable review cycle for the 6.5.11 release.
There are 88 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Nov 2023 13:02:46 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.5.11-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.5.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.5.11-rc1
Mark Hasemeyer <markhas(a)chromium.org>
ASoC: SOF: sof-pci-dev: Fix community key quirk detection
Mark Hasemeyer <markhas(a)chromium.org>
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Tony Lindgren <tony(a)atomide.com>
serial: core: Fix runtime PM handling for pending tx
Siddharth Vadapalli <s-vadapalli(a)ti.com>
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Francesco Dolcini <francesco.dolcini(a)toradex.com>
dt-bindings: serial: rs485: Add rs485-rts-active-high
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes PX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix up PX-803/PX-857
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix port count of PX-257
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix race condition in status line change on dead connections
Janne Grunau <j(a)jannau.net>
Bluetooth: hci_bcm4377: Mark bcm4378/bcm4387 as BROKEN_LE_CODED
Andrey Konovalov <andreyknvl(a)gmail.com>
usb: raw-gadget: properly handle interrupted requests
Jimmy Hu <hhhuuu(a)google.com>
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
Badhri Jagan Sridharan <badhri(a)google.com>
usb: typec: tcpm: Add additional checks for contaminant
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Max McCarthy <mmccarthy(a)mcintoshlabs.com>
ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices
Liam R. Howlett <Liam.Howlett(a)oracle.com>
mmap: fix error paths with dup_anon_vma()
Liam R. Howlett <Liam.Howlett(a)oracle.com>
mmap: fix vma_iterator in error path of vma_merge()
Ian Rogers <irogers(a)google.com>
perf evlist: Avoid frequency mode for the dummy event
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint
Benno Lossin <benno.lossin(a)proton.me>
rust: types: make `Opaque` be `!Unpin`
Alice Ryhl <aliceryhl(a)google.com>
rust: make `UnsafeCell` the outer type in `Opaque`
Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
drm/amd/display: Don't use fsleep for PSR exit waits
Al Viro <viro(a)zeniv.linux.org.uk>
ceph_wait_on_conflict_unlink(): grab reference before dropping ->d_lock
Al Viro <viro(a)zeniv.linux.org.uk>
io_uring: kiocb_done() should *not* trust ->ki_pos if ->{read,write}_iter() failed
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix boot crash with FLATMEM
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in rtl_phy_patch_request()
Su Hui <suhui(a)nfschina.com>
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Jisheng Zhang <jszhang(a)kernel.org>
riscv: dts: thead: set dma-noncoherent to soc bus
Felix Kuehling <Felix.Kuehling(a)amd.com>
drm/amdgpu: Reserve fences for VM update
Liming Sun <limings(a)nvidia.com>
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Phil Sutter <phil(a)nwl.cc>
netfilter: nf_tables: audit log object reset once per table
Icenowy Zheng <uwu(a)icenowy.me>
LoongArch: Disable WUC for pgprot_writecombine() like ioremap_wc()
Huacai Chen <chenhuacai(a)kernel.org>
LoongArch: Replace kmap_atomic() with kmap_local_page() in copy_user_highpage()
Huacai Chen <chenhuacai(a)kernel.org>
LoongArch: Export symbol invalid_pud_table for modules building
Tiezhu Yang <yangtiezhu(a)loongson.cn>
LoongArch: Use SYM_CODE_* to annotate exception handlers
Luben Tuikov <luben.tuikov(a)amd.com>
gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET
Luben Tuikov <luben.tuikov(a)amd.com>
drm/amdgpu: Unset context priority is now invalid
David Rau <David.Rau.opensource(a)dm.renesas.com>
ASoC: da7219: Correct the process of setting up Gnd switch in AAD
Tomas Henzl <thenzl(a)redhat.com>
scsi: mpt3sas: Fix in error path
Jorge Maidana <jorgem.linux(a)gmail.com>
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Dan Carpenter <dan.carpenter(a)linaro.org>
fbdev: omapfb: fix some error codes
Karolina Stolarek <karolina.stolarek(a)intel.com>
drm/ttm: Reorder sys manager cleanup step
Vasily Gorbik <gor(a)linux.ibm.com>
s390/kasan: handle DCSS mapping in memory holes
Roy Chateau <roy.chateau(a)mep-info.com>
ASoC: codecs: tas2780: Fix log of failed reset via I2C.
Shuming Fan <shumingf(a)realtek.com>
ASoC: rt5650: fix the wrong result of key button
Kuan-Wei Chiu <visitorckw(a)gmail.com>
efi: fix memory leak in krealloc failure handling
Nikolay Borisov <nik.borisov(a)suse.com>
x86/efistub: Don't try to print after ExitBootService()
Vlad Buslov <vladbu(a)nvidia.com>
net/mlx5: Bridge, fix peer entry ageing in LAG mode
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink_log: silence bogus compiler warning
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
ASoC: soc-dapm: Add helper for comparing widget name
William A. Kennington III <william(a)wkennington.com>
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Su Hui <suhui(a)nfschina.com>
fs/ntfs3: Avoid possible memory leak
Gabriel Marcano <gabemarcano(a)yahoo.com>
fs/ntfs3: Fix directory element type detection
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Do not allow to change label if volume is read-only
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Add more info into /proc/fs/ntfs3/<dev>/volinfo
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix alternative boot searching
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Add more attributes checks in mi_enum_attr()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Write immediately updated ntfs state
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Add ckeck in ni_update_parent()
Arnd Bergmann <arnd(a)arndb.de>
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Ondrej Jirman <megi(a)xff.cz>
media: i2c: ov8858: Don't set fwnode in the driver
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/85xx: Fix math emulation exception
Ondrej Zary <linux(a)zary.sk>
ata: pata_parport: fit3: implement IDE command set registers
Ondrej Zary <linux(a)zary.sk>
ata: pata_parport: add custom version of wait_after_reset
Zhang Shurong <zhang_shurong(a)foxmail.com>
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
Ben Wolsieffer <ben.wolsieffer(a)hefring.com>
irqchip/stm32-exti: add missing DT IRQ flag translation
Anup Patel <apatel(a)ventanamicro.com>
irqchip/riscv-intc: Mark all INTC nodes as initialized
Haibo Chen <haibo.chen(a)nxp.com>
can: flexcan: remove the auto stop mode for IMX93
Haibo Chen <haibo.chen(a)nxp.com>
arm64: dts: imx93: add the Flex-CAN stop mode by GPR
Gustavo A. R. Silva <gustavoars(a)kernel.org>
net: sched: cls_u32: Fix allocation size in u32_init()
Antoine Gennart <gennartan(a)disroot.org>
ASoC: tlv320adc3xxx: BUG: Correct micbias setting
Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com>
ASoC: core: Do not call link_exit() on uninitialized rtd objects
Shengjiu Wang <shengjiu.wang(a)nxp.com>
ASoC: fsl-asoc-card: use integer type for fll_id and pll_id
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: tmc-etr: Disable warnings for allocation failures
Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com>
ASoC: simple-card: fixup asoc_simple_probe() error handling
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: Intel: sof_sdw: add support for SKU 0B14
-------------
Diffstat:
.../devicetree/bindings/serial/rs485.yaml | 4 +
Makefile | 4 +-
arch/arm64/boot/dts/freescale/imx93.dtsi | 4 +-
arch/loongarch/include/asm/io.h | 5 +-
arch/loongarch/include/asm/linkage.h | 8 +
arch/loongarch/include/asm/pgtable-bits.h | 4 +-
arch/loongarch/kernel/entry.S | 4 +-
arch/loongarch/kernel/genex.S | 16 +-
arch/loongarch/kernel/setup.c | 10 +-
arch/loongarch/mm/init.c | 9 +-
arch/loongarch/mm/tlbex.S | 36 +--
arch/powerpc/kernel/head_85xx.S | 2 +-
arch/powerpc/kernel/setup-common.c | 2 +
arch/powerpc/mm/mem.c | 1 -
arch/riscv/boot/dts/thead/th1520.dtsi | 1 +
arch/s390/boot/vmem.c | 7 +-
drivers/ata/pata_parport/fit3.c | 14 +-
drivers/ata/pata_parport/pata_parport.c | 68 ++++-
drivers/bluetooth/hci_bcm4377.c | 5 +
drivers/dma/ste_dma40.c | 1 +
drivers/firmware/efi/efi.c | 8 +-
drivers/firmware/efi/libstub/x86-stub.c | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 +-
drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c | 3 +-
drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 3 +-
drivers/gpu/drm/ttm/ttm_device.c | 8 +-
drivers/hwtracing/coresight/coresight-tmc-etr.c | 3 +-
drivers/input/mouse/synaptics.c | 1 +
drivers/input/rmi4/rmi_smbus.c | 50 ++--
drivers/irqchip/irq-riscv-intc.c | 10 +-
drivers/irqchip/irq-stm32-exti.c | 1 +
drivers/media/i2c/ov8858.c | 10 +-
drivers/misc/pci_endpoint_test.c | 4 +
drivers/net/can/flexcan/flexcan-core.c | 46 +--
drivers/net/can/flexcan/flexcan.h | 2 -
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +
.../ethernet/mellanox/mlx5/core/en/rep/bridge.c | 11 +
.../net/ethernet/mellanox/mlx5/core/esw/bridge.c | 25 +-
.../net/ethernet/mellanox/mlx5/core/esw/bridge.h | 3 +
.../ethernet/mellanox/mlx5/core/esw/bridge_priv.h | 1 +
drivers/net/usb/r8152.c | 7 +
drivers/pci/quirks.c | 8 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +-
drivers/power/supply/power_supply_core.c | 8 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +-
drivers/spi/spi-npcm-fiu.c | 5 +-
drivers/tty/n_gsm.c | 2 +
drivers/tty/serial/8250/8250_pci.c | 327 ++++++++++++++++++++-
drivers/tty/serial/serial_core.c | 2 +-
drivers/usb/gadget/legacy/raw_gadget.c | 26 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/usb/typec/tcpm/tcpm.c | 5 +
drivers/video/fbdev/aty/atyfb_base.c | 4 +
drivers/video/fbdev/omap/omapfb_main.c | 4 +-
drivers/video/fbdev/uvesafb.c | 2 +-
fs/ceph/mds_client.c | 2 +-
fs/ntfs3/attrib.c | 6 +-
fs/ntfs3/attrlist.c | 15 +-
fs/ntfs3/bitmap.c | 3 +-
fs/ntfs3/dir.c | 6 +-
fs/ntfs3/frecord.c | 8 +-
fs/ntfs3/fslog.c | 6 +-
fs/ntfs3/fsntfs.c | 13 +-
fs/ntfs3/record.c | 68 ++++-
fs/ntfs3/super.c | 33 ++-
include/drm/gpu_scheduler.h | 3 +-
include/linux/pci_ids.h | 1 +
include/linux/power_supply.h | 2 +-
include/sound/soc-dapm.h | 1 +
include/sound/soc.h | 2 +
io_uring/rw.c | 2 +-
mm/mmap.c | 40 ++-
net/netfilter/nf_tables_api.c | 50 ++--
net/netfilter/nfnetlink_log.c | 2 +-
net/sched/cls_u32.c | 2 +-
rust/kernel/types.rs | 21 +-
sound/hda/intel-dsp-config.c | 6 +
sound/soc/codecs/da7219-aad.c | 11 +-
sound/soc/codecs/rt5645.c | 2 +
sound/soc/codecs/tas2780.c | 2 +-
sound/soc/codecs/tlv320adc3xxx.c | 4 +-
sound/soc/fsl/fsl-asoc-card.c | 12 +-
sound/soc/generic/simple-card.c | 6 +-
sound/soc/intel/boards/sof_sdw.c | 10 +
sound/soc/soc-component.c | 1 +
sound/soc/soc-core.c | 20 +-
sound/soc/soc-dapm.c | 12 +
sound/soc/sof/sof-pci-dev.c | 7 +
sound/usb/quirks.c | 2 +
tools/perf/util/evlist.c | 5 +-
tools/testing/selftests/netfilter/nft_audit.sh | 46 +++
92 files changed, 973 insertions(+), 297 deletions(-)
This is the start of the stable review cycle for the 6.1.62 release.
There are 62 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Nov 2023 13:02:46 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.62-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.62-rc1
Mark Hasemeyer <markhas(a)chromium.org>
ASoC: SOF: sof-pci-dev: Fix community key quirk detection
Mark Hasemeyer <markhas(a)chromium.org>
ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
Siddharth Vadapalli <s-vadapalli(a)ti.com>
misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes PX cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix up PX-803/PX-857
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Fix port count of PX-257
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
Daniel Starke <daniel.starke(a)siemens.com>
tty: n_gsm: fix race condition in status line change on dead connections
Andrey Konovalov <andreyknvl(a)gmail.com>
usb: raw-gadget: properly handle interrupted requests
Jimmy Hu <hhhuuu(a)google.com>
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Max McCarthy <mmccarthy(a)mcintoshlabs.com>
ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices
Liam R. Howlett <Liam.Howlett(a)oracle.com>
mmap: fix error paths with dup_anon_vma()
Liam R. Howlett <Liam.Howlett(a)oracle.com>
mm/mempolicy: fix set_mempolicy_home_node() previous VMA pointer
Maxim Levitsky <mlevitsk(a)redhat.com>
x86: KVM: SVM: always update the x2avic msr interception
Ian Rogers <irogers(a)google.com>
perf evlist: Avoid frequency mode for the dummy event
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint
Al Viro <viro(a)zeniv.linux.org.uk>
ceph_wait_on_conflict_unlink(): grab reference before dropping ->d_lock
Al Viro <viro(a)zeniv.linux.org.uk>
io_uring: kiocb_done() should *not* trust ->ki_pos if ->{read,write}_iter() failed
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/mm: Fix boot crash with FLATMEM
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
Douglas Anderson <dianders(a)chromium.org>
r8152: Check for unplug in rtl_phy_patch_request()
Su Hui <suhui(a)nfschina.com>
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Felix Kuehling <Felix.Kuehling(a)amd.com>
drm/amdgpu: Reserve fences for VM update
Liming Sun <limings(a)nvidia.com>
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Phil Sutter <phil(a)nwl.cc>
netfilter: nf_tables: audit log object reset once per table
Huacai Chen <chenhuacai(a)kernel.org>
LoongArch: Replace kmap_atomic() with kmap_local_page() in copy_user_highpage()
Huacai Chen <chenhuacai(a)kernel.org>
LoongArch: Export symbol invalid_pud_table for modules building
Luben Tuikov <luben.tuikov(a)amd.com>
gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET
Luben Tuikov <luben.tuikov(a)amd.com>
drm/amdgpu: Unset context priority is now invalid
Tomas Henzl <thenzl(a)redhat.com>
scsi: mpt3sas: Fix in error path
Jorge Maidana <jorgem.linux(a)gmail.com>
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Dan Carpenter <dan.carpenter(a)linaro.org>
fbdev: omapfb: fix some error codes
Karolina Stolarek <karolina.stolarek(a)intel.com>
drm/ttm: Reorder sys manager cleanup step
Roy Chateau <roy.chateau(a)mep-info.com>
ASoC: codecs: tas2780: Fix log of failed reset via I2C.
Shuming Fan <shumingf(a)realtek.com>
ASoC: rt5650: fix the wrong result of key button
Kuan-Wei Chiu <visitorckw(a)gmail.com>
efi: fix memory leak in krealloc failure handling
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink_log: silence bogus compiler warning
William A. Kennington III <william(a)wkennington.com>
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Su Hui <suhui(a)nfschina.com>
fs/ntfs3: Avoid possible memory leak
Gabriel Marcano <gabemarcano(a)yahoo.com>
fs/ntfs3: Fix directory element type detection
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Write immediately updated ntfs state
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Add ckeck in ni_update_parent()
Arnd Bergmann <arnd(a)arndb.de>
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/85xx: Fix math emulation exception
Zhang Shurong <zhang_shurong(a)foxmail.com>
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
Ben Wolsieffer <ben.wolsieffer(a)hefring.com>
irqchip/stm32-exti: add missing DT IRQ flag translation
Anup Patel <apatel(a)ventanamicro.com>
irqchip/riscv-intc: Mark all INTC nodes as initialized
Gustavo A. R. Silva <gustavoars(a)kernel.org>
net: sched: cls_u32: Fix allocation size in u32_init()
Antoine Gennart <gennartan(a)disroot.org>
ASoC: tlv320adc3xxx: BUG: Correct micbias setting
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: tmc-etr: Disable warnings for allocation failures
Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com>
ASoC: simple-card: fixup asoc_simple_probe() error handling
-------------
Diffstat:
Makefile | 4 +-
arch/loongarch/mm/init.c | 9 +-
arch/powerpc/kernel/head_85xx.S | 2 +-
arch/powerpc/kernel/setup-common.c | 2 +
arch/powerpc/mm/mem.c | 1 -
arch/x86/kvm/svm/svm.c | 3 +-
drivers/dma/ste_dma40.c | 1 +
drivers/firmware/efi/efi.c | 8 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 +-
drivers/gpu/drm/ttm/ttm_device.c | 8 +-
drivers/hwtracing/coresight/coresight-tmc-etr.c | 3 +-
drivers/input/mouse/synaptics.c | 1 +
drivers/input/rmi4/rmi_smbus.c | 50 ++--
drivers/irqchip/irq-riscv-intc.c | 10 +-
drivers/irqchip/irq-stm32-exti.c | 1 +
drivers/misc/pci_endpoint_test.c | 4 +
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +
drivers/net/usb/r8152.c | 7 +
drivers/pci/quirks.c | 8 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +-
drivers/power/supply/power_supply_core.c | 8 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +-
drivers/spi/spi-npcm-fiu.c | 5 +-
drivers/tty/n_gsm.c | 2 +
drivers/tty/serial/8250/8250_pci.c | 327 +++++++++++++++++++++++-
drivers/usb/gadget/legacy/raw_gadget.c | 26 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/usb/typec/tcpm/tcpm.c | 3 +
drivers/video/fbdev/aty/atyfb_base.c | 4 +
drivers/video/fbdev/omap/omapfb_main.c | 4 +-
drivers/video/fbdev/uvesafb.c | 2 +-
fs/ceph/mds_client.c | 2 +-
fs/ntfs3/attrib.c | 6 +-
fs/ntfs3/attrlist.c | 15 +-
fs/ntfs3/bitmap.c | 3 +-
fs/ntfs3/dir.c | 6 +-
fs/ntfs3/frecord.c | 8 +-
fs/ntfs3/fslog.c | 6 +-
fs/ntfs3/fsntfs.c | 13 +-
fs/ntfs3/super.c | 2 +-
include/drm/gpu_scheduler.h | 3 +-
include/linux/pci_ids.h | 1 +
include/linux/power_supply.h | 2 +-
io_uring/rw.c | 2 +-
mm/mempolicy.c | 4 +-
mm/mmap.c | 15 +-
net/netfilter/nf_tables_api.c | 50 ++--
net/netfilter/nfnetlink_log.c | 2 +-
net/sched/cls_u32.c | 2 +-
sound/hda/intel-dsp-config.c | 6 +
sound/soc/codecs/rt5645.c | 2 +
sound/soc/codecs/tas2780.c | 2 +-
sound/soc/codecs/tlv320adc3xxx.c | 4 +-
sound/soc/generic/simple-card.c | 6 +-
sound/soc/sof/sof-pci-dev.c | 7 +
sound/usb/quirks.c | 2 +
tools/perf/util/evlist.c | 5 +-
tools/testing/selftests/netfilter/nft_audit.sh | 46 ++++
59 files changed, 620 insertions(+), 144 deletions(-)
This is the start of the stable review cycle for the 5.4.260 release.
There are 74 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Nov 2023 13:02:46 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.260-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.260-rc1
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Intashield IS-100
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for Brainboxes UP cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Add support for additional Brainboxes UC cards
Cameron Williams <cang1(a)live.co.uk>
tty: 8250: Remove UC-257 and UC-431
LihaSika <lihasika(a)gmail.com>
usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
Vicki Pfau <vi(a)endrift.com>
PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
Matthias Schiffer <matthias.schiffer(a)ew.tq-group.com>
Revert "ARM: dts: Move am33xx and am43xx mmc nodes to sdhci-omap driver"
Sagi Grimberg <sagi(a)grimberg.me>
nvmet-tcp: Fix a possible UAF in queue intialization setup
Sagi Grimberg <sagi(a)grimberg.me>
nvmet-tcp: move send/recv error handling in the send/recv methods instead of call-sites
Christoph Hellwig <hch(a)lst.de>
remove the sx8 block driver
Arnd Bergmann <arnd(a)arndb.de>
ata: ahci: fix enum constants for gcc-13
Su Hui <suhui(a)nfschina.com>
net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
Liming Sun <limings(a)nvidia.com>
platform/mellanox: mlxbf-tmfifo: Fix a warning message
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
Tomas Henzl <thenzl(a)redhat.com>
scsi: mpt3sas: Fix in error path
Jorge Maidana <jorgem.linux(a)gmail.com>
fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
Shuming Fan <shumingf(a)realtek.com>
ASoC: rt5650: fix the wrong result of key button
Florian Westphal <fw(a)strlen.de>
netfilter: nfnetlink_log: silence bogus compiler warning
William A. Kennington III <william(a)wkennington.com>
spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
Arnd Bergmann <arnd(a)arndb.de>
fbdev: atyfb: only use ioremap_uc() on i386 and ia64
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
Zhang Shurong <zhang_shurong(a)foxmail.com>
dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
Ben Wolsieffer <ben.wolsieffer(a)hefring.com>
irqchip/stm32-exti: add missing DT IRQ flag translation
Szilard Fabian <szfabian(a)bluemarch.art>
Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
Juergen Gross <jgross(a)suse.com>
x86: Fix .brk attribute in linker script
Hangyu Hua <hbh25y(a)gmail.com>
rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
Bjorn Andersson <quic_bjorande(a)quicinc.com>
rpmsg: glink: Release driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix calling device_lock() on non-initialized device
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Fix kfree() of static memory on setting driver_override
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
rpmsg: Constify local variable in field store macro
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
driver: platform: Add helper for safer setting of driver_override
Baokun Li <libaokun1(a)huawei.com>
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: avoid overlapping preallocations due to overflow
Baokun Li <libaokun1(a)huawei.com>
ext4: add two helper functions extent_logical_end() and pa_logical_end()
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/mm: Fix RESERVE_BRK() for older binutils
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/mm: Simplify RESERVE_BRK()
Al Viro <viro(a)zeniv.linux.org.uk>
nfsd: lock_rename() needs both directories to live on the same fs
Chao Yu <chao(a)kernel.org>
f2fs: fix to do sanity check on inode type during garbage collection
Steve French <stfrench(a)microsoft.com>
smbdirect: missing rc checks while waiting for rdma events
Wang Hai <wanghai38(a)huawei.com>
kobject: Fix slab-out-of-bounds in fill_kobj_path()
Jinjie Ruan <ruanjinjie(a)huawei.com>
arm64: fix a concurrency issue in emulation_proc_handler()
Lukasz Majczak <lma(a)semihalf.com>
drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
Thomas Gleixner <tglx(a)linutronix.de>
x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
Alessandro Carminati <alessandro.carminati(a)gmail.com>
clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
Peter Zijlstra <peterz(a)infradead.org>
perf/core: Fix potential NULL deref
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6UL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6SLL
Peng Fan <peng.fan(a)nxp.com>
nvmem: imx: correct nregs for i.MX6ULL
Jian Zhang <zhangjian.3032(a)bytedance.com>
i2c: aspeed: Fix i2c bus hang in slave read
Alain Volmat <alain.volmat(a)foss.st.com>
i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
Herve Codina <herve.codina(a)bootlin.com>
i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
Marek Szyprowski <m.szyprowski(a)samsung.com>
iio: exynos-adc: request second interupt only when touchscreen mode is used
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: fix fragmentation needed check with gso
Pablo Neira Ayuso <pablo(a)netfilter.org>
gtp: uapi: fix GTPA_MAX
Fred Chen <fred.chenchen03(a)gmail.com>
tcp: fix wrong RTO timeout when received SACK reneging
Douglas Anderson <dianders(a)chromium.org>
r8152: Cancel hw_phy_work if we have an error in probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Run the unload routine if we have errors during probe
Douglas Anderson <dianders(a)chromium.org>
r8152: Increase USB control msg timeout to 5000ms as per spec
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
Sasha Neftin <sasha.neftin(a)intel.com>
igc: Fix ambiguity in the ethtool advertising
Eric Dumazet <edumazet(a)google.com>
neighbour: fix various data-races
Mateusz Palczewski <mateusz.palczewski(a)intel.com>
igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
Kunwu Chan <chentao(a)kylinos.cn>
treewide: Spelling fix in comment
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr>
r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
Maximilian Heyne <mheyne(a)amazon.de>
virtio-mmio: fix memory leak of vm_dev
Gavin Shan <gshan(a)redhat.com>
virtio_balloon: Fix endless deflation and inflation on arm64
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb-lpc: Reallocate memory region to avoid memory overlapping
Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez(a)duagon.com>
mcb: Return actual parsed size when reading chameleon table
Francis Laniel <flaniel(a)linux.microsoft.com>
selftests/ftrace: Add new test case which checks non unique symbol
Miquel Raynal <miquel.raynal(a)bootlin.com>
mtd: rawnand: marvell: Ensure program page operations are successful
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/am335x-baltos.dtsi | 2 +-
arch/arm/boot/dts/am335x-boneblack-common.dtsi | 1 -
arch/arm/boot/dts/am335x-boneblack-wireless.dts | 1 +
arch/arm/boot/dts/am335x-boneblue.dts | 1 +
arch/arm/boot/dts/am335x-bonegreen-wireless.dts | 1 +
arch/arm/boot/dts/am335x-evm.dts | 3 +-
arch/arm/boot/dts/am335x-evmsk.dts | 2 +-
arch/arm/boot/dts/am335x-lxm.dts | 2 +-
arch/arm/boot/dts/am335x-moxa-uc-2100-common.dtsi | 2 +-
arch/arm/boot/dts/am335x-moxa-uc-8100-me-t.dts | 2 +-
arch/arm/boot/dts/am335x-pepper.dts | 4 +-
arch/arm/boot/dts/am335x-phycore-som.dtsi | 2 +-
arch/arm/boot/dts/am33xx-l4.dtsi | 6 +-
arch/arm/boot/dts/am33xx.dtsi | 3 +-
arch/arm/boot/dts/am4372.dtsi | 3 +-
arch/arm/boot/dts/am437x-cm-t43.dts | 2 +-
arch/arm/boot/dts/am437x-gp-evm.dts | 4 +-
arch/arm/boot/dts/am437x-l4.dtsi | 5 +-
arch/arm/boot/dts/am437x-sk-evm.dts | 2 +-
arch/arm64/kernel/armv8_deprecated.c | 6 +-
arch/x86/include/asm/i8259.h | 2 +
arch/x86/include/asm/setup.h | 46 +-
arch/x86/kernel/acpi/boot.c | 3 +
arch/x86/kernel/i8259.c | 38 +-
arch/x86/kernel/vmlinux.lds.S | 2 +-
drivers/ata/ahci.h | 241 +--
drivers/base/driver.c | 69 +
drivers/base/platform.c | 28 +-
drivers/block/Kconfig | 9 -
drivers/block/Makefile | 2 -
drivers/block/sx8.c | 1586 --------------------
drivers/clk/clk.c | 21 +-
drivers/dma/ste_dma40.c | 1 +
drivers/gpu/drm/drm_dp_mst_topology.c | 6 +-
drivers/i2c/busses/i2c-aspeed.c | 3 +-
drivers/i2c/busses/i2c-stm32f7.c | 9 +-
drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
drivers/i2c/muxes/i2c-mux-gpmux.c | 2 +-
drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +-
drivers/iio/adc/exynos_adc.c | 24 +-
drivers/input/mouse/synaptics.c | 1 +
drivers/input/rmi4/rmi_smbus.c | 50 +-
drivers/input/serio/i8042-x86ia64io.h | 8 +
drivers/irqchip/irq-stm32-exti.c | 1 +
drivers/mcb/mcb-lpc.c | 35 +-
drivers/mcb/mcb-parse.c | 15 +-
drivers/mtd/nand/raw/marvell_nand.c | 23 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +-
drivers/net/ethernet/intel/igc/igc_ethtool.c | 35 +-
drivers/net/ethernet/realtek/r8169_main.c | 4 +-
drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +-
drivers/net/gtp.c | 5 +-
drivers/net/ieee802154/adf7242.c | 5 +-
drivers/net/usb/r8152.c | 10 +-
drivers/nvme/target/tcp.c | 50 +-
drivers/nvmem/imx-ocotp.c | 6 +-
drivers/pci/quirks.c | 8 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +-
drivers/platform/x86/asus-wmi.h | 2 +-
drivers/rpmsg/qcom_glink_native.c | 1 +
drivers/rpmsg/rpmsg_core.c | 37 +-
drivers/rpmsg/rpmsg_internal.h | 5 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +-
drivers/spi/spi-npcm-fiu.c | 5 +-
drivers/tty/serial/8250/8250_pci.c | 122 +-
drivers/usb/storage/unusual_cypress.h | 2 +-
drivers/video/fbdev/aty/atyfb_base.c | 4 +
drivers/video/fbdev/uvesafb.c | 2 +-
drivers/virtio/virtio_balloon.c | 6 +-
drivers/virtio/virtio_mmio.c | 19 +-
fs/cifs/smbdirect.c | 14 +-
fs/ext4/mballoc.c | 51 +-
fs/ext4/mballoc.h | 14 +
fs/f2fs/gc.c | 3 +-
fs/nfsd/vfs.c | 12 +-
include/linux/device.h | 2 +
include/linux/pci_ids.h | 1 +
include/linux/platform_device.h | 6 +-
include/linux/rpmsg.h | 14 +-
include/uapi/linux/gtp.h | 2 +-
kernel/events/core.c | 3 +-
lib/kobject.c | 12 +-
net/core/neighbour.c | 67 +-
net/ipv4/tcp_input.c | 9 +-
net/netfilter/nfnetlink_log.c | 2 +-
sound/soc/codecs/rt5645.c | 2 +
.../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13 +
90 files changed, 850 insertions(+), 2029 deletions(-)
The patch titled
Subject: mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
cgroups-warning-for-metadata-allocation-with-gfp_nofail-was-re-folio_alloc_buffers-doing-allocations-order-1-with-gfp_nofail.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Roman Gushchin <roman.gushchin(a)linux.dev>
Subject: mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
Date: Tue, 7 Nov 2023 09:18:02 -0800
Objcg vectors attached to slab pages to store slab object ownership
information are allocated using gfp flags for the original slab
allocation. Depending on slab page order and the size of slab objects,
objcg vector can take several pages.
If the original allocation was done with the __GFP_NOFAIL flag, it
triggered a warning in the page allocation code. Indeed, order > 1 pages
should not been allocated with the __GFP_NOFAIL flag.
Fix this by simply dropping the __GFP_NOFAIL flag when allocating the
objcg vector. It effectively allows to skip the accounting of a single
slab object under a heavy memory pressure.
An alternative would be to implement the mechanism to fallback to order-0
allocations for accounting metadata, which is also not perfect because it
will increase performance penalty and memory footprint of the kernel
memory accounting under memory pressure.
Link: https://lkml.kernel.org/r/ZUp8ZFGxwmCx4ZFr@P9FQF9L96D.corp.robot.car
Signed-off-by: Roman Gushchin <roman.gushchin(a)linux.dev>
Reported-by: Christoph Lameter <cl(a)linux.com>
Closes: https://lkml.kernel.org/r/6b42243e-f197-600a-5d22-56bd728a5ad8@gentwo.org
Acked-by: Shakeel Butt <shakeelb(a)google.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/memcontrol.c~cgroups-warning-for-metadata-allocation-with-gfp_nofail-was-re-folio_alloc_buffers-doing-allocations-order-1-with-gfp_nofail
+++ a/mm/memcontrol.c
@@ -2936,7 +2936,8 @@ void mem_cgroup_commit_charge(struct fol
* Moreover, it should not come from DMA buffer and is not readily
* reclaimable. So those GFP bits should be masked off.
*/
-#define OBJCGS_CLEAR_MASK (__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT)
+#define OBJCGS_CLEAR_MASK (__GFP_DMA | __GFP_RECLAIMABLE | \
+ __GFP_ACCOUNT | __GFP_NOFAIL)
/*
* mod_objcg_mlstate() may be called with irq enabled, so
_
Patches currently in -mm which might be from roman.gushchin(a)linux.dev are
cgroups-warning-for-metadata-allocation-with-gfp_nofail-was-re-folio_alloc_buffers-doing-allocations-order-1-with-gfp_nofail.patch
From: Lu Jialin <lujialin4(a)huawei.com>
[ Upstream commit 8f4f68e788c3a7a696546291258bfa5fdb215523 ]
We found a hungtask bug in test_aead_vec_cfg as follows:
INFO: task cryptomgr_test:391009 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Call trace:
__switch_to+0x98/0xe0
__schedule+0x6c4/0xf40
schedule+0xd8/0x1b4
schedule_timeout+0x474/0x560
wait_for_common+0x368/0x4e0
wait_for_completion+0x20/0x30
wait_for_completion+0x20/0x30
test_aead_vec_cfg+0xab4/0xd50
test_aead+0x144/0x1f0
alg_test_aead+0xd8/0x1e0
alg_test+0x634/0x890
cryptomgr_test+0x40/0x70
kthread+0x1e0/0x220
ret_from_fork+0x10/0x18
Kernel panic - not syncing: hung_task: blocked tasks
For padata_do_parallel, when the return err is 0 or -EBUSY, it will call
wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal
case, aead_request_complete() will be called in pcrypt_aead_serial and the
return err is 0 for padata_do_parallel. But, when pinst->flags is
PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it
won't call aead_request_complete(). Therefore, test_aead_vec_cfg will
hung at wait_for_completion(&wait->completion), which will cause
hungtask.
The problem comes as following:
(padata_do_parallel) |
rcu_read_lock_bh(); |
err = -EINVAL; | (padata_replace)
| pinst->flags |= PADATA_RESET;
err = -EBUSY |
if (pinst->flags & PADATA_RESET) |
rcu_read_unlock_bh() |
return err
In order to resolve the problem, we replace the return err -EBUSY with
-EAGAIN, which means parallel_data is changing, and the caller should call
it again.
v3:
remove retry and just change the return err.
v2:
introduce padata_try_do_parallel() in pcrypt_aead_encrypt and
pcrypt_aead_decrypt to solve the hungtask.
Signed-off-by: Lu Jialin <lujialin4(a)huawei.com>
Signed-off-by: Guo Zihua <guozihua(a)huawei.com>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
crypto/pcrypt.c | 4 ++++
kernel/padata.c | 2 +-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index 62e11835f220e..1e9de81ef84fa 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -174,6 +174,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req)
err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pencrypt);
if (!err)
return -EINPROGRESS;
+ if (err == -EBUSY)
+ return -EAGAIN;
return err;
}
@@ -218,6 +220,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req)
err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pdecrypt);
if (!err)
return -EINPROGRESS;
+ if (err == -EBUSY)
+ return -EAGAIN;
return err;
}
diff --git a/kernel/padata.c b/kernel/padata.c
index f56ec63f60ba8..82f6d5bf5cb45 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -120,7 +120,7 @@ int padata_do_parallel(struct padata_instance *pinst,
if (!cpumask_test_cpu(cb_cpu, pd->cpumask.cbcpu))
goto out;
- err = -EBUSY;
+ err = -EBUSY;
if ((pinst->flags & PADATA_RESET))
goto out;
--
2.42.0
From: Lu Jialin <lujialin4(a)huawei.com>
[ Upstream commit 8f4f68e788c3a7a696546291258bfa5fdb215523 ]
We found a hungtask bug in test_aead_vec_cfg as follows:
INFO: task cryptomgr_test:391009 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Call trace:
__switch_to+0x98/0xe0
__schedule+0x6c4/0xf40
schedule+0xd8/0x1b4
schedule_timeout+0x474/0x560
wait_for_common+0x368/0x4e0
wait_for_completion+0x20/0x30
wait_for_completion+0x20/0x30
test_aead_vec_cfg+0xab4/0xd50
test_aead+0x144/0x1f0
alg_test_aead+0xd8/0x1e0
alg_test+0x634/0x890
cryptomgr_test+0x40/0x70
kthread+0x1e0/0x220
ret_from_fork+0x10/0x18
Kernel panic - not syncing: hung_task: blocked tasks
For padata_do_parallel, when the return err is 0 or -EBUSY, it will call
wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal
case, aead_request_complete() will be called in pcrypt_aead_serial and the
return err is 0 for padata_do_parallel. But, when pinst->flags is
PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it
won't call aead_request_complete(). Therefore, test_aead_vec_cfg will
hung at wait_for_completion(&wait->completion), which will cause
hungtask.
The problem comes as following:
(padata_do_parallel) |
rcu_read_lock_bh(); |
err = -EINVAL; | (padata_replace)
| pinst->flags |= PADATA_RESET;
err = -EBUSY |
if (pinst->flags & PADATA_RESET) |
rcu_read_unlock_bh() |
return err
In order to resolve the problem, we replace the return err -EBUSY with
-EAGAIN, which means parallel_data is changing, and the caller should call
it again.
v3:
remove retry and just change the return err.
v2:
introduce padata_try_do_parallel() in pcrypt_aead_encrypt and
pcrypt_aead_decrypt to solve the hungtask.
Signed-off-by: Lu Jialin <lujialin4(a)huawei.com>
Signed-off-by: Guo Zihua <guozihua(a)huawei.com>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
crypto/pcrypt.c | 4 ++++
kernel/padata.c | 2 +-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index 62e11835f220e..1e9de81ef84fa 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -174,6 +174,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req)
err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pencrypt);
if (!err)
return -EINPROGRESS;
+ if (err == -EBUSY)
+ return -EAGAIN;
return err;
}
@@ -218,6 +220,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req)
err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pdecrypt);
if (!err)
return -EINPROGRESS;
+ if (err == -EBUSY)
+ return -EAGAIN;
return err;
}
diff --git a/kernel/padata.c b/kernel/padata.c
index 7f2b6d369fd47..a9e14183e1884 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -121,7 +121,7 @@ int padata_do_parallel(struct padata_instance *pinst,
if (!cpumask_test_cpu(cb_cpu, pd->cpumask.cbcpu))
goto out;
- err = -EBUSY;
+ err = -EBUSY;
if ((pinst->flags & PADATA_RESET))
goto out;
--
2.42.0
From: Lu Jialin <lujialin4(a)huawei.com>
[ Upstream commit 8f4f68e788c3a7a696546291258bfa5fdb215523 ]
We found a hungtask bug in test_aead_vec_cfg as follows:
INFO: task cryptomgr_test:391009 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Call trace:
__switch_to+0x98/0xe0
__schedule+0x6c4/0xf40
schedule+0xd8/0x1b4
schedule_timeout+0x474/0x560
wait_for_common+0x368/0x4e0
wait_for_completion+0x20/0x30
wait_for_completion+0x20/0x30
test_aead_vec_cfg+0xab4/0xd50
test_aead+0x144/0x1f0
alg_test_aead+0xd8/0x1e0
alg_test+0x634/0x890
cryptomgr_test+0x40/0x70
kthread+0x1e0/0x220
ret_from_fork+0x10/0x18
Kernel panic - not syncing: hung_task: blocked tasks
For padata_do_parallel, when the return err is 0 or -EBUSY, it will call
wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal
case, aead_request_complete() will be called in pcrypt_aead_serial and the
return err is 0 for padata_do_parallel. But, when pinst->flags is
PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it
won't call aead_request_complete(). Therefore, test_aead_vec_cfg will
hung at wait_for_completion(&wait->completion), which will cause
hungtask.
The problem comes as following:
(padata_do_parallel) |
rcu_read_lock_bh(); |
err = -EINVAL; | (padata_replace)
| pinst->flags |= PADATA_RESET;
err = -EBUSY |
if (pinst->flags & PADATA_RESET) |
rcu_read_unlock_bh() |
return err
In order to resolve the problem, we replace the return err -EBUSY with
-EAGAIN, which means parallel_data is changing, and the caller should call
it again.
v3:
remove retry and just change the return err.
v2:
introduce padata_try_do_parallel() in pcrypt_aead_encrypt and
pcrypt_aead_decrypt to solve the hungtask.
Signed-off-by: Lu Jialin <lujialin4(a)huawei.com>
Signed-off-by: Guo Zihua <guozihua(a)huawei.com>
Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
crypto/pcrypt.c | 4 ++++
kernel/padata.c | 2 +-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index 276d2fd9e911c..63e64164900e8 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -118,6 +118,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req)
err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu);
if (!err)
return -EINPROGRESS;
+ if (err == -EBUSY)
+ return -EAGAIN;
return err;
}
@@ -165,6 +167,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req)
err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu);
if (!err)
return -EINPROGRESS;
+ if (err == -EBUSY)
+ return -EAGAIN;
return err;
}
diff --git a/kernel/padata.c b/kernel/padata.c
index 92a4867e8adc7..a544da60014c0 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -130,7 +130,7 @@ int padata_do_parallel(struct padata_shell *ps,
*cb_cpu = cpu;
}
- err = -EBUSY;
+ err = -EBUSY;
if ((pinst->flags & PADATA_RESET))
goto out;
--
2.42.0
From: Richard Fitzgerald <rf(a)opensource.cirrus.com>
[ Upstream commit 47f56e38a199bd45514b8e0142399cba4feeaf1a ]
Add members to struct snd_soc_card to store the PCI subsystem ID (SSID)
of the soundcard.
The PCI specification provides two registers to store a vendor-specific
SSID that can be read by drivers to uniquely identify a particular
"soundcard". This is defined in the PCI specification to distinguish
products that use the same silicon (and therefore have the same silicon
ID) so that product-specific differences can be applied.
PCI only defines 0xFFFF as an invalid value. 0x0000 is not defined as
invalid. So the usual pattern of zero-filling the struct and then
assuming a zero value unset will not work. A flag is included to
indicate when the SSID information has been filled in.
Unlike DMI information, which has a free-format entirely up to the vendor,
the PCI SSID has a strictly defined format and a registry of vendor IDs.
It is usual in Windows drivers that the SSID is used as the sole identifier
of the specific end-product and the Windows driver contains tables mapping
that to information about the hardware setup, rather than using ACPI
properties.
This SSID is important information for ASoC components that need to apply
hardware-specific configuration on PCI-based systems.
As the SSID is a generic part of the PCI specification and is treated as
identifying the "soundcard", it is reasonable to include this information
in struct snd_soc_card, instead of components inventing their own custom
ways to pass this information around.
Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
Link: https://lore.kernel.org/r/20230912163207.3498161-2-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
include/sound/soc-card.h | 37 +++++++++++++++++++++++++++++++++++++
include/sound/soc.h | 11 +++++++++++
2 files changed, 48 insertions(+)
diff --git a/include/sound/soc-card.h b/include/sound/soc-card.h
index 4f2cc4fb56b7f..9a5429260ece5 100644
--- a/include/sound/soc-card.h
+++ b/include/sound/soc-card.h
@@ -40,6 +40,43 @@ int snd_soc_card_add_dai_link(struct snd_soc_card *card,
void snd_soc_card_remove_dai_link(struct snd_soc_card *card,
struct snd_soc_dai_link *dai_link);
+#ifdef CONFIG_PCI
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+ unsigned short vendor,
+ unsigned short device)
+{
+ card->pci_subsystem_vendor = vendor;
+ card->pci_subsystem_device = device;
+ card->pci_subsystem_set = true;
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+ unsigned short *vendor,
+ unsigned short *device)
+{
+ if (!card->pci_subsystem_set)
+ return -ENOENT;
+
+ *vendor = card->pci_subsystem_vendor;
+ *device = card->pci_subsystem_device;
+
+ return 0;
+}
+#else /* !CONFIG_PCI */
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+ unsigned short vendor,
+ unsigned short device)
+{
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+ unsigned short *vendor,
+ unsigned short *device)
+{
+ return -ENOENT;
+}
+#endif /* CONFIG_PCI */
+
/* device driver data */
static inline void snd_soc_card_set_drvdata(struct snd_soc_card *card,
void *data)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 3b038c563ae14..e973044143bc9 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -977,6 +977,17 @@ struct snd_soc_card {
#ifdef CONFIG_DMI
char dmi_longname[80];
#endif /* CONFIG_DMI */
+
+#ifdef CONFIG_PCI
+ /*
+ * PCI does not define 0 as invalid, so pci_subsystem_set indicates
+ * whether a value has been written to these fields.
+ */
+ unsigned short pci_subsystem_vendor;
+ unsigned short pci_subsystem_device;
+ bool pci_subsystem_set;
+#endif /* CONFIG_PCI */
+
char topology_shortname[32];
struct device *dev;
--
2.42.0
From: Richard Fitzgerald <rf(a)opensource.cirrus.com>
[ Upstream commit 47f56e38a199bd45514b8e0142399cba4feeaf1a ]
Add members to struct snd_soc_card to store the PCI subsystem ID (SSID)
of the soundcard.
The PCI specification provides two registers to store a vendor-specific
SSID that can be read by drivers to uniquely identify a particular
"soundcard". This is defined in the PCI specification to distinguish
products that use the same silicon (and therefore have the same silicon
ID) so that product-specific differences can be applied.
PCI only defines 0xFFFF as an invalid value. 0x0000 is not defined as
invalid. So the usual pattern of zero-filling the struct and then
assuming a zero value unset will not work. A flag is included to
indicate when the SSID information has been filled in.
Unlike DMI information, which has a free-format entirely up to the vendor,
the PCI SSID has a strictly defined format and a registry of vendor IDs.
It is usual in Windows drivers that the SSID is used as the sole identifier
of the specific end-product and the Windows driver contains tables mapping
that to information about the hardware setup, rather than using ACPI
properties.
This SSID is important information for ASoC components that need to apply
hardware-specific configuration on PCI-based systems.
As the SSID is a generic part of the PCI specification and is treated as
identifying the "soundcard", it is reasonable to include this information
in struct snd_soc_card, instead of components inventing their own custom
ways to pass this information around.
Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
Link: https://lore.kernel.org/r/20230912163207.3498161-2-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
include/sound/soc-card.h | 37 +++++++++++++++++++++++++++++++++++++
include/sound/soc.h | 11 +++++++++++
2 files changed, 48 insertions(+)
diff --git a/include/sound/soc-card.h b/include/sound/soc-card.h
index 4f2cc4fb56b7f..9a5429260ece5 100644
--- a/include/sound/soc-card.h
+++ b/include/sound/soc-card.h
@@ -40,6 +40,43 @@ int snd_soc_card_add_dai_link(struct snd_soc_card *card,
void snd_soc_card_remove_dai_link(struct snd_soc_card *card,
struct snd_soc_dai_link *dai_link);
+#ifdef CONFIG_PCI
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+ unsigned short vendor,
+ unsigned short device)
+{
+ card->pci_subsystem_vendor = vendor;
+ card->pci_subsystem_device = device;
+ card->pci_subsystem_set = true;
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+ unsigned short *vendor,
+ unsigned short *device)
+{
+ if (!card->pci_subsystem_set)
+ return -ENOENT;
+
+ *vendor = card->pci_subsystem_vendor;
+ *device = card->pci_subsystem_device;
+
+ return 0;
+}
+#else /* !CONFIG_PCI */
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+ unsigned short vendor,
+ unsigned short device)
+{
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+ unsigned short *vendor,
+ unsigned short *device)
+{
+ return -ENOENT;
+}
+#endif /* CONFIG_PCI */
+
/* device driver data */
static inline void snd_soc_card_set_drvdata(struct snd_soc_card *card,
void *data)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 5872a8864f3b6..3f0369aae2faf 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -880,6 +880,17 @@ struct snd_soc_card {
#ifdef CONFIG_DMI
char dmi_longname[80];
#endif /* CONFIG_DMI */
+
+#ifdef CONFIG_PCI
+ /*
+ * PCI does not define 0 as invalid, so pci_subsystem_set indicates
+ * whether a value has been written to these fields.
+ */
+ unsigned short pci_subsystem_vendor;
+ unsigned short pci_subsystem_device;
+ bool pci_subsystem_set;
+#endif /* CONFIG_PCI */
+
char topology_shortname[32];
struct device *dev;
--
2.42.0
From: Richard Fitzgerald <rf(a)opensource.cirrus.com>
[ Upstream commit 47f56e38a199bd45514b8e0142399cba4feeaf1a ]
Add members to struct snd_soc_card to store the PCI subsystem ID (SSID)
of the soundcard.
The PCI specification provides two registers to store a vendor-specific
SSID that can be read by drivers to uniquely identify a particular
"soundcard". This is defined in the PCI specification to distinguish
products that use the same silicon (and therefore have the same silicon
ID) so that product-specific differences can be applied.
PCI only defines 0xFFFF as an invalid value. 0x0000 is not defined as
invalid. So the usual pattern of zero-filling the struct and then
assuming a zero value unset will not work. A flag is included to
indicate when the SSID information has been filled in.
Unlike DMI information, which has a free-format entirely up to the vendor,
the PCI SSID has a strictly defined format and a registry of vendor IDs.
It is usual in Windows drivers that the SSID is used as the sole identifier
of the specific end-product and the Windows driver contains tables mapping
that to information about the hardware setup, rather than using ACPI
properties.
This SSID is important information for ASoC components that need to apply
hardware-specific configuration on PCI-based systems.
As the SSID is a generic part of the PCI specification and is treated as
identifying the "soundcard", it is reasonable to include this information
in struct snd_soc_card, instead of components inventing their own custom
ways to pass this information around.
Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
Link: https://lore.kernel.org/r/20230912163207.3498161-2-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
include/sound/soc-card.h | 37 +++++++++++++++++++++++++++++++++++++
include/sound/soc.h | 11 +++++++++++
2 files changed, 48 insertions(+)
diff --git a/include/sound/soc-card.h b/include/sound/soc-card.h
index 9d31a5c0db33c..40d3023cf0d16 100644
--- a/include/sound/soc-card.h
+++ b/include/sound/soc-card.h
@@ -44,6 +44,43 @@ int snd_soc_card_add_dai_link(struct snd_soc_card *card,
void snd_soc_card_remove_dai_link(struct snd_soc_card *card,
struct snd_soc_dai_link *dai_link);
+#ifdef CONFIG_PCI
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+ unsigned short vendor,
+ unsigned short device)
+{
+ card->pci_subsystem_vendor = vendor;
+ card->pci_subsystem_device = device;
+ card->pci_subsystem_set = true;
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+ unsigned short *vendor,
+ unsigned short *device)
+{
+ if (!card->pci_subsystem_set)
+ return -ENOENT;
+
+ *vendor = card->pci_subsystem_vendor;
+ *device = card->pci_subsystem_device;
+
+ return 0;
+}
+#else /* !CONFIG_PCI */
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+ unsigned short vendor,
+ unsigned short device)
+{
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+ unsigned short *vendor,
+ unsigned short *device)
+{
+ return -ENOENT;
+}
+#endif /* CONFIG_PCI */
+
/* device driver data */
static inline void snd_soc_card_set_drvdata(struct snd_soc_card *card,
void *data)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 37bbfc8b45cb2..108617cea9c67 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -911,6 +911,17 @@ struct snd_soc_card {
#ifdef CONFIG_DMI
char dmi_longname[80];
#endif /* CONFIG_DMI */
+
+#ifdef CONFIG_PCI
+ /*
+ * PCI does not define 0 as invalid, so pci_subsystem_set indicates
+ * whether a value has been written to these fields.
+ */
+ unsigned short pci_subsystem_vendor;
+ unsigned short pci_subsystem_device;
+ bool pci_subsystem_set;
+#endif /* CONFIG_PCI */
+
char topology_shortname[32];
struct device *dev;
--
2.42.0
The patch titled
Subject: mm/damon/sysfs-schemes: handle tried region directory allocation failure
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-damon-sysfs-schemes-handle-tried-region-directory-allocation-failure.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: SeongJae Park <sj(a)kernel.org>
Subject: mm/damon/sysfs-schemes: handle tried region directory allocation failure
Date: Mon, 6 Nov 2023 23:34:08 +0000
DAMON sysfs interface's before_damos_apply callback
(damon_sysfs_before_damos_apply()), which creates the DAMOS tried regions
for each DAMOS action applied region, is not handling the allocation
failure for the sysfs directory data. As a result, NULL pointer
derefeence is possible. Fix it by handling the case.
Link: https://lkml.kernel.org/r/20231106233408.51159-4-sj@kernel.org
Fixes: f1d13cacabe1 ("mm/damon/sysfs: implement DAMOS tried regions update command")
Signed-off-by: SeongJae Park <sj(a)kernel.org>
Cc: <stable(a)vger.kernel.org> [6.2+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/damon/sysfs-schemes.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/damon/sysfs-schemes.c~mm-damon-sysfs-schemes-handle-tried-region-directory-allocation-failure
+++ a/mm/damon/sysfs-schemes.c
@@ -1826,6 +1826,8 @@ static int damon_sysfs_before_damos_appl
return 0;
region = damon_sysfs_scheme_region_alloc(r);
+ if (!region)
+ return 0;
list_add_tail(®ion->list, &sysfs_regions->regions_list);
sysfs_regions->nr_regions++;
if (kobject_init_and_add(®ion->kobj,
_
Patches currently in -mm which might be from sj(a)kernel.org are
mm-damon-sysfs-check-error-from-damon_sysfs_update_target.patch
mm-damon-sysfs-schemes-handle-tried-regions-sysfs-directory-allocation-failure.patch
mm-damon-sysfs-schemes-handle-tried-region-directory-allocation-failure.patch
The patch titled
Subject: mm/damon/sysfs-schemes: handle tried regions sysfs directory allocation failure
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-damon-sysfs-schemes-handle-tried-regions-sysfs-directory-allocation-failure.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: SeongJae Park <sj(a)kernel.org>
Subject: mm/damon/sysfs-schemes: handle tried regions sysfs directory allocation failure
Date: Mon, 6 Nov 2023 23:34:07 +0000
DAMOS tried regions sysfs directory allocation function
(damon_sysfs_scheme_regions_alloc()) is not handling the memory allocation
failure. In the case, the code will dereference NULL pointer. Handle the
failure to avoid such invalid access.
Link: https://lkml.kernel.org/r/20231106233408.51159-3-sj@kernel.org
Fixes: 9277d0367ba1 ("mm/damon/sysfs-schemes: implement scheme region directory")
Signed-off-by: SeongJae Park <sj(a)kernel.org>
Cc: <stable(a)vger.kernel.org> [6.2+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/damon/sysfs-schemes.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/damon/sysfs-schemes.c~mm-damon-sysfs-schemes-handle-tried-regions-sysfs-directory-allocation-failure
+++ a/mm/damon/sysfs-schemes.c
@@ -162,6 +162,9 @@ damon_sysfs_scheme_regions_alloc(void)
struct damon_sysfs_scheme_regions *regions = kmalloc(sizeof(*regions),
GFP_KERNEL);
+ if (!regions)
+ return NULL;
+
regions->kobj = (struct kobject){};
INIT_LIST_HEAD(®ions->regions_list);
regions->nr_regions = 0;
_
Patches currently in -mm which might be from sj(a)kernel.org are
mm-damon-sysfs-check-error-from-damon_sysfs_update_target.patch
mm-damon-sysfs-schemes-handle-tried-regions-sysfs-directory-allocation-failure.patch
mm-damon-sysfs-schemes-handle-tried-region-directory-allocation-failure.patch
The patch titled
Subject: mm/damon/sysfs: check error from damon_sysfs_update_target()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-damon-sysfs-check-error-from-damon_sysfs_update_target.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: SeongJae Park <sj(a)kernel.org>
Subject: mm/damon/sysfs: check error from damon_sysfs_update_target()
Date: Mon, 6 Nov 2023 23:34:06 +0000
Patch series "mm/damon/sysfs: fix unhandled return values".
Some of DAMON sysfs interface code is not handling return values from some
functions. As a result, confusing user input handling or NULL-dereference
is possible. Check those properly.
This patch (of 3):
damon_sysfs_update_target() returns error code for failures, but its
caller, damon_sysfs_set_targets() is ignoring that. The update function
seems making no critical change in case of such failures, but the behavior
will look like DAMON sysfs is silently ignoring or only partially
accepting the user input. Fix it.
Link: https://lkml.kernel.org/r/20231106233408.51159-1-sj@kernel.org
Link: https://lkml.kernel.org/r/20231106233408.51159-2-sj@kernel.org
Fixes: 19467a950b49 ("mm/damon/sysfs: remove requested targets when online-commit inputs")
Signed-off-by: SeongJae Park <sj(a)kernel.org>
Cc: <stable(a)vger.kernel.org> [5.19+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/damon/sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/damon/sysfs.c~mm-damon-sysfs-check-error-from-damon_sysfs_update_target
+++ a/mm/damon/sysfs.c
@@ -1203,8 +1203,10 @@ static int damon_sysfs_set_targets(struc
damon_for_each_target_safe(t, next, ctx) {
if (i < sysfs_targets->nr) {
- damon_sysfs_update_target(t, ctx,
+ err = damon_sysfs_update_target(t, ctx,
sysfs_targets->targets_arr[i]);
+ if (err)
+ return err;
} else {
if (damon_target_has_pid(ctx))
put_pid(t->pid);
_
Patches currently in -mm which might be from sj(a)kernel.org are
mm-damon-sysfs-check-error-from-damon_sysfs_update_target.patch
mm-damon-sysfs-schemes-handle-tried-regions-sysfs-directory-allocation-failure.patch
mm-damon-sysfs-schemes-handle-tried-region-directory-allocation-failure.patch
From: Dmitry Antipov <dmantipov(a)yandex.ru>
[ Upstream commit cbaccdc42483c65016f1bae89128c08dc17cfb2a ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):
In file included from drivers/net/wireless/virtual/mac80211_hwsim.c:18:
In file included from ./include/linux/slab.h:16:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:56:
In file included from ./include/linux/preempt.h:79:
In file included from ./arch/x86/include/asm/preempt.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'mac80211_hwsim_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy the
whole 'mac80211_hwsim_gstrings_stats' array from its first member and so
issues an overread warning. This warning may be silenced by passing
an address of the whole array and not the first member to 'memcpy()'.
Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru>
Link: https://lore.kernel.org/r/20230829094140.234636-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/wireless/mac80211_hwsim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a21739b2f44e6..634e8c1e71cca 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2323,7 +2323,7 @@ static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
u32 sset, u8 *data)
{
if (sset == ETH_SS_STATS)
- memcpy(data, *mac80211_hwsim_gstrings_stats,
+ memcpy(data, mac80211_hwsim_gstrings_stats,
sizeof(mac80211_hwsim_gstrings_stats));
}
--
2.42.0
From: Dmitry Antipov <dmantipov(a)yandex.ru>
[ Upstream commit cbaccdc42483c65016f1bae89128c08dc17cfb2a ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):
In file included from drivers/net/wireless/virtual/mac80211_hwsim.c:18:
In file included from ./include/linux/slab.h:16:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:56:
In file included from ./include/linux/preempt.h:79:
In file included from ./arch/x86/include/asm/preempt.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'mac80211_hwsim_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy the
whole 'mac80211_hwsim_gstrings_stats' array from its first member and so
issues an overread warning. This warning may be silenced by passing
an address of the whole array and not the first member to 'memcpy()'.
Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru>
Link: https://lore.kernel.org/r/20230829094140.234636-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/wireless/mac80211_hwsim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 0d41f172a1dc2..037358606a51a 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2543,7 +2543,7 @@ static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
u32 sset, u8 *data)
{
if (sset == ETH_SS_STATS)
- memcpy(data, *mac80211_hwsim_gstrings_stats,
+ memcpy(data, mac80211_hwsim_gstrings_stats,
sizeof(mac80211_hwsim_gstrings_stats));
}
--
2.42.0
From: Dmitry Antipov <dmantipov(a)yandex.ru>
[ Upstream commit cbaccdc42483c65016f1bae89128c08dc17cfb2a ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):
In file included from drivers/net/wireless/virtual/mac80211_hwsim.c:18:
In file included from ./include/linux/slab.h:16:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:56:
In file included from ./include/linux/preempt.h:79:
In file included from ./arch/x86/include/asm/preempt.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'mac80211_hwsim_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy the
whole 'mac80211_hwsim_gstrings_stats' array from its first member and so
issues an overread warning. This warning may be silenced by passing
an address of the whole array and not the first member to 'memcpy()'.
Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru>
Link: https://lore.kernel.org/r/20230829094140.234636-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/wireless/mac80211_hwsim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 6eb3c845640bd..7d73502586839 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2615,7 +2615,7 @@ static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
u32 sset, u8 *data)
{
if (sset == ETH_SS_STATS)
- memcpy(data, *mac80211_hwsim_gstrings_stats,
+ memcpy(data, mac80211_hwsim_gstrings_stats,
sizeof(mac80211_hwsim_gstrings_stats));
}
--
2.42.0
From: Dmitry Antipov <dmantipov(a)yandex.ru>
[ Upstream commit a763e92c78615ea838f5b9a841398b1d4adb968e ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):
In file included from drivers/net/wireless/purelifi/plfxlc/mac.c:6:
In file included from ./include/linux/netdevice.h:24:
In file included from ./include/linux/timer.h:6:
In file included from ./include/linux/ktime.h:24:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'plfxlc_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy
the whole 'et_strings' array from its first member and so issues an
overread warning. This warning may be silenced by passing an address
of the whole array and not the first member to 'memcpy()'.
Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru>
Signed-off-by: Kalle Valo <kvalo(a)kernel.org>
Link: https://lore.kernel.org/r/20230829094541.234751-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/wireless/purelifi/plfxlc/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/purelifi/plfxlc/mac.c b/drivers/net/wireless/purelifi/plfxlc/mac.c
index d3cdffbded693..87a4ff888ddd4 100644
--- a/drivers/net/wireless/purelifi/plfxlc/mac.c
+++ b/drivers/net/wireless/purelifi/plfxlc/mac.c
@@ -666,7 +666,7 @@ static void plfxlc_get_et_strings(struct ieee80211_hw *hw,
u32 sset, u8 *data)
{
if (sset == ETH_SS_STATS)
- memcpy(data, *et_strings, sizeof(et_strings));
+ memcpy(data, et_strings, sizeof(et_strings));
}
static void plfxlc_get_et_stats(struct ieee80211_hw *hw,
--
2.42.0
From: Dmitry Antipov <dmantipov(a)yandex.ru>
[ Upstream commit a763e92c78615ea838f5b9a841398b1d4adb968e ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):
In file included from drivers/net/wireless/purelifi/plfxlc/mac.c:6:
In file included from ./include/linux/netdevice.h:24:
In file included from ./include/linux/timer.h:6:
In file included from ./include/linux/ktime.h:24:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'plfxlc_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy
the whole 'et_strings' array from its first member and so issues an
overread warning. This warning may be silenced by passing an address
of the whole array and not the first member to 'memcpy()'.
Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru>
Signed-off-by: Kalle Valo <kvalo(a)kernel.org>
Link: https://lore.kernel.org/r/20230829094541.234751-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/wireless/purelifi/plfxlc/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/purelifi/plfxlc/mac.c b/drivers/net/wireless/purelifi/plfxlc/mac.c
index 94ee831b5de35..506d2f31efb5a 100644
--- a/drivers/net/wireless/purelifi/plfxlc/mac.c
+++ b/drivers/net/wireless/purelifi/plfxlc/mac.c
@@ -666,7 +666,7 @@ static void plfxlc_get_et_strings(struct ieee80211_hw *hw,
u32 sset, u8 *data)
{
if (sset == ETH_SS_STATS)
- memcpy(data, *et_strings, sizeof(et_strings));
+ memcpy(data, et_strings, sizeof(et_strings));
}
static void plfxlc_get_et_stats(struct ieee80211_hw *hw,
--
2.42.0
From: Dmitry Antipov <dmantipov(a)yandex.ru>
[ Upstream commit a763e92c78615ea838f5b9a841398b1d4adb968e ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):
In file included from drivers/net/wireless/purelifi/plfxlc/mac.c:6:
In file included from ./include/linux/netdevice.h:24:
In file included from ./include/linux/timer.h:6:
In file included from ./include/linux/ktime.h:24:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'plfxlc_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy
the whole 'et_strings' array from its first member and so issues an
overread warning. This warning may be silenced by passing an address
of the whole array and not the first member to 'memcpy()'.
Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru>
Signed-off-by: Kalle Valo <kvalo(a)kernel.org>
Link: https://lore.kernel.org/r/20230829094541.234751-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/wireless/purelifi/plfxlc/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/purelifi/plfxlc/mac.c b/drivers/net/wireless/purelifi/plfxlc/mac.c
index 94ee831b5de35..506d2f31efb5a 100644
--- a/drivers/net/wireless/purelifi/plfxlc/mac.c
+++ b/drivers/net/wireless/purelifi/plfxlc/mac.c
@@ -666,7 +666,7 @@ static void plfxlc_get_et_strings(struct ieee80211_hw *hw,
u32 sset, u8 *data)
{
if (sset == ETH_SS_STATS)
- memcpy(data, *et_strings, sizeof(et_strings));
+ memcpy(data, et_strings, sizeof(et_strings));
}
static void plfxlc_get_et_stats(struct ieee80211_hw *hw,
--
2.42.0
Update the comments of binder_alloc_new_buf() to reflect that the return
value of the function is now ERR_PTR(-errno) on failure.
No functional changes in this patch.
Cc: stable(a)vger.kernel.org
Fixes: 57ada2fb2250 ("binder: add log information for binder transaction failures")
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
---
drivers/android/binder_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index cd720bb5c9ce..0e8312f4b771 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -558,7 +558,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
* is the sum of the three given sizes (each rounded up to
* pointer-sized boundary)
*
- * Return: The allocated buffer or %NULL if error
+ * Return: The allocated buffer or %ERR_PTR(-errno) if error
*/
struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
size_t data_size,
--
2.42.0.869.gea05f2083d-goog
The mmap read lock is used during the shrinker's callback, which means
that using alloc->vma pointer isn't safe as it can race with munmap().
As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in
munmap") the mmap lock is downgraded after the vma has been isolated.
I was able to reproduce this issue by manually adding some delays and
triggering page reclaiming through the shrinker's debug sysfs. The
following KASAN report confirms the UAF:
==================================================================
BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8
Read of size 8 at addr ffff356ed50e50f0 by task bash/478
CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70
Hardware name: linux,dummy-virt (DT)
Call trace:
zap_page_range_single+0x470/0x4b8
binder_alloc_free_page+0x608/0xadc
__list_lru_walk_one+0x130/0x3b0
list_lru_walk_node+0xc4/0x22c
binder_shrink_scan+0x108/0x1dc
shrinker_debugfs_scan_write+0x2b4/0x500
full_proxy_write+0xd4/0x140
vfs_write+0x1ac/0x758
ksys_write+0xf0/0x1dc
__arm64_sys_write+0x6c/0x9c
Allocated by task 492:
kmem_cache_alloc+0x130/0x368
vm_area_alloc+0x2c/0x190
mmap_region+0x258/0x18bc
do_mmap+0x694/0xa60
vm_mmap_pgoff+0x170/0x29c
ksys_mmap_pgoff+0x290/0x3a0
__arm64_sys_mmap+0xcc/0x144
Freed by task 491:
kmem_cache_free+0x17c/0x3c8
vm_area_free_rcu_cb+0x74/0x98
rcu_core+0xa38/0x26d4
rcu_core_si+0x10/0x1c
__do_softirq+0x2fc/0xd24
Last potentially related work creation:
__call_rcu_common.constprop.0+0x6c/0xba0
call_rcu+0x10/0x1c
vm_area_free+0x18/0x24
remove_vma+0xe4/0x118
do_vmi_align_munmap.isra.0+0x718/0xb5c
do_vmi_munmap+0xdc/0x1fc
__vm_munmap+0x10c/0x278
__arm64_sys_munmap+0x58/0x7c
Fix this issue by performing instead a vma_lookup() which will fail to
find the vma that was isolated before the mmap lock downgrade. Note that
this option has better performance than upgrading to a mmap write lock
which would increase contention. Plus, mmap_write_trylock() has been
recently removed anyway.
Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
Cc: stable(a)vger.kernel.org
Cc: Liam Howlett <liam.howlett(a)oracle.com>
Cc: Minchan Kim <minchan(a)kernel.org>
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
---
drivers/android/binder_alloc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index e3db8297095a..c4d60d81221b 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -1005,7 +1005,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
goto err_mmget;
if (!mmap_read_trylock(mm))
goto err_mmap_read_lock_failed;
- vma = binder_alloc_get_vma(alloc);
+ vma = vma_lookup(mm, page_addr);
+ if (vma && vma != binder_alloc_get_vma(alloc))
+ goto err_invalid_vma;
list_lru_isolate(lru, item);
spin_unlock(lock);
@@ -1031,6 +1033,8 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
mutex_unlock(&alloc->mutex);
return LRU_REMOVED_RETRY;
+err_invalid_vma:
+ mmap_read_unlock(mm);
err_mmap_read_lock_failed:
mmput_async(mm);
err_mmget:
--
2.42.0.869.gea05f2083d-goog
Commits 7b8ef22ea547 ("usb: xhci: plat: Add USB phy support") and
9134c1fd0503 ("usb: xhci: plat: Add USB 3.0 phy support") added support
for looking up legacy PHYs from the sysdev devicetree node and
initialising them.
This broke drivers such as dwc3 which manages PHYs themself as the PHYs
would now be initialised twice, something which specifically can lead to
resources being left enabled during suspend (e.g. with the
usb_phy_generic PHY driver).
As the dwc3 driver uses driver-name matching for the xhci platform
device, fix this by only looking up and initialising PHYs for devices
that have been matched using OF.
Note that checking that the platform device has a devicetree node would
currently be sufficient, but that could lead to subtle breakages in case
anyone ever tries to reuse an ancestor's node.
Fixes: 7b8ef22ea547 ("usb: xhci: plat: Add USB phy support")
Fixes: 9134c1fd0503 ("usb: xhci: plat: Add USB 3.0 phy support")
Cc: stable(a)vger.kernel.org # 4.1
Cc: Maxime Ripard <mripard(a)kernel.org>
Cc: Stanley Chang <stanley_chang(a)realtek.com>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/usb/host/xhci-plat.c | 50 +++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 20 deletions(-)
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 28218c8f1837..01d19d17153b 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -13,6 +13,7 @@
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/of.h>
+#include <linux/of_device.h>
#include <linux/platform_device.h>
#include <linux/usb/phy.h>
#include <linux/slab.h>
@@ -148,7 +149,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
int ret;
int irq;
struct xhci_plat_priv *priv = NULL;
-
+ bool of_match;
if (usb_disabled())
return -ENODEV;
@@ -253,16 +254,23 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
&xhci->imod_interval);
}
- hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, "usb-phy", 0);
- if (IS_ERR(hcd->usb_phy)) {
- ret = PTR_ERR(hcd->usb_phy);
- if (ret == -EPROBE_DEFER)
- goto disable_clk;
- hcd->usb_phy = NULL;
- } else {
- ret = usb_phy_init(hcd->usb_phy);
- if (ret)
- goto disable_clk;
+ /*
+ * Drivers such as dwc3 manages PHYs themself (and rely on driver name
+ * matching for the xhci platform device).
+ */
+ of_match = of_match_device(pdev->dev.driver->of_match_table, &pdev->dev);
+ if (of_match) {
+ hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, "usb-phy", 0);
+ if (IS_ERR(hcd->usb_phy)) {
+ ret = PTR_ERR(hcd->usb_phy);
+ if (ret == -EPROBE_DEFER)
+ goto disable_clk;
+ hcd->usb_phy = NULL;
+ } else {
+ ret = usb_phy_init(hcd->usb_phy);
+ if (ret)
+ goto disable_clk;
+ }
}
hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node);
@@ -285,15 +293,17 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
goto dealloc_usb2_hcd;
}
- xhci->shared_hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev,
- "usb-phy", 1);
- if (IS_ERR(xhci->shared_hcd->usb_phy)) {
- xhci->shared_hcd->usb_phy = NULL;
- } else {
- ret = usb_phy_init(xhci->shared_hcd->usb_phy);
- if (ret)
- dev_err(sysdev, "%s init usb3phy fail (ret=%d)\n",
- __func__, ret);
+ if (of_match) {
+ xhci->shared_hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev,
+ "usb-phy", 1);
+ if (IS_ERR(xhci->shared_hcd->usb_phy)) {
+ xhci->shared_hcd->usb_phy = NULL;
+ } else {
+ ret = usb_phy_init(xhci->shared_hcd->usb_phy);
+ if (ret)
+ dev_err(sysdev, "%s init usb3phy fail (ret=%d)\n",
+ __func__, ret);
+ }
}
xhci->shared_hcd->tpl_support = hcd->tpl_support;
--
2.41.0
From: Shuai Xue <xueshuai(a)linux.alibaba.com>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Signed-off-by: Shuai Xue <xueshuai(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/events/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index fb1e180b5f0af..e8d82c2f07d0e 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -700,6 +700,12 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
watermark = 0;
}
+ /*
+ * kcalloc_node() is unable to allocate buffer if the size is larger
+ * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+ */
+ if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+ return -ENOMEM;
rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
node);
if (!rb->aux_pages)
--
2.42.0
DAMON sysfs interface's before_damos_apply callback
(damon_sysfs_before_damos_apply()), which creates the DAMOS tried
regions for each DAMOS action applied region, is not handling the
allocation failure for the sysfs directory data. As a result, NULL
pointer derefeence is possible. Fix it by handling the case.
Fixes: f1d13cacabe1 ("mm/damon/sysfs: implement DAMOS tried regions update command")
Cc: <stable(a)vger.kernel.org> # 6.2.x
Signed-off-by: SeongJae Park <sj(a)kernel.org>
---
mm/damon/sysfs-schemes.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
index 7413cb35c5a9..be667236b8e6 100644
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -1826,6 +1826,8 @@ static int damon_sysfs_before_damos_apply(struct damon_ctx *ctx,
return 0;
region = damon_sysfs_scheme_region_alloc(r);
+ if (!region)
+ return 0;
list_add_tail(®ion->list, &sysfs_regions->regions_list);
sysfs_regions->nr_regions++;
if (kobject_init_and_add(®ion->kobj,
--
2.34.1
damon_sysfs_update_target() returns error code for failures, but its
caller, damon_sysfs_set_targets() is ignoring that. The update function
seems making no critical change in case of such failures, but the
behavior will look like DAMON sysfs is silently ignoring or only
partially accepting the user input. Fix it.
Fixes: 19467a950b49 ("mm/damon/sysfs: remove requested targets when online-commit inputs")
Cc: <stable(a)vger.kernel.org> # 5.19.x
Signed-off-by: SeongJae Park <sj(a)kernel.org>
---
Note that yet another fix[1] should be applied before this.
[1] https://lore.kernel.org/all/739e6aaf-a634-4e33-98a8-16546379ec9f@moroto.mou…
mm/damon/sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
index 1dfa96d4de99..7472404456aa 100644
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -1203,8 +1203,10 @@ static int damon_sysfs_set_targets(struct damon_ctx *ctx,
damon_for_each_target_safe(t, next, ctx) {
if (i < sysfs_targets->nr) {
- damon_sysfs_update_target(t, ctx,
+ err = damon_sysfs_update_target(t, ctx,
sysfs_targets->targets_arr[i]);
+ if (err)
+ return err;
} else {
if (damon_target_has_pid(ctx))
put_pid(t->pid);
--
2.34.1
From: Shuai Xue <xueshuai(a)linux.alibaba.com>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Signed-off-by: Shuai Xue <xueshuai(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/events/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 12f351b253bbb..2f6f77658eba2 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -639,6 +639,12 @@ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
}
}
+ /*
+ * kcalloc_node() is unable to allocate buffer if the size is larger
+ * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+ */
+ if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+ return -ENOMEM;
rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
node);
if (!rb->aux_pages)
--
2.42.0
From: Shuai Xue <xueshuai(a)linux.alibaba.com>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Signed-off-by: Shuai Xue <xueshuai(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/events/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index ffb59a4ef4ff3..fb3edb2f8ac93 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -653,6 +653,12 @@ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
max_order--;
}
+ /*
+ * kcalloc_node() is unable to allocate buffer if the size is larger
+ * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+ */
+ if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+ return -ENOMEM;
rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
node);
if (!rb->aux_pages)
--
2.42.0
From: Shuai Xue <xueshuai(a)linux.alibaba.com>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Signed-off-by: Shuai Xue <xueshuai(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/events/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 4032cd4750001..01351e7e25435 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -691,6 +691,12 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
max_order--;
}
+ /*
+ * kcalloc_node() is unable to allocate buffer if the size is larger
+ * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+ */
+ if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+ return -ENOMEM;
rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
node);
if (!rb->aux_pages)
--
2.42.0
From: Shuai Xue <xueshuai(a)linux.alibaba.com>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Signed-off-by: Shuai Xue <xueshuai(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/events/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index f40da32f5e753..6808873555f0d 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -696,6 +696,12 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
watermark = 0;
}
+ /*
+ * kcalloc_node() is unable to allocate buffer if the size is larger
+ * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+ */
+ if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+ return -ENOMEM;
rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
node);
if (!rb->aux_pages)
--
2.42.0
From: Shuai Xue <xueshuai(a)linux.alibaba.com>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Signed-off-by: Shuai Xue <xueshuai(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/events/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 273a0fe7910a5..45965f13757e4 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -699,6 +699,12 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
watermark = 0;
}
+ /*
+ * kcalloc_node() is unable to allocate buffer if the size is larger
+ * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+ */
+ if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+ return -ENOMEM;
rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
node);
if (!rb->aux_pages)
--
2.42.0
From: Shuai Xue <xueshuai(a)linux.alibaba.com>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Signed-off-by: Shuai Xue <xueshuai(a)linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/events/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index a0433f37b0243..4a260ceed9c73 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -699,6 +699,12 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
watermark = 0;
}
+ /*
+ * kcalloc_node() is unable to allocate buffer if the size is larger
+ * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+ */
+ if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+ return -ENOMEM;
rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
node);
if (!rb->aux_pages)
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 654977862b06b..8489a01f943e8 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -439,7 +439,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -504,7 +503,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -525,8 +523,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -537,15 +533,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -569,9 +574,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -586,6 +589,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 65a3b7e55b9fc..4fd05d9d5d6d1 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -439,7 +439,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -504,7 +503,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -525,8 +523,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -537,15 +533,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -569,9 +574,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -586,6 +589,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 3e82f449b4ff7..da36997d8742c 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -426,7 +426,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -491,7 +490,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -512,8 +510,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -524,15 +520,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -556,9 +561,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -573,6 +576,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 3e82f449b4ff7..da36997d8742c 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -426,7 +426,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -491,7 +490,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -512,8 +510,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -524,15 +520,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -556,9 +561,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -573,6 +576,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 3e82f449b4ff7..da36997d8742c 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -426,7 +426,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -491,7 +490,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -512,8 +510,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -524,15 +520,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -556,9 +561,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -573,6 +576,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 43efb2a041602..b1e25695185a4 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -466,7 +466,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -531,7 +530,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -552,8 +550,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -564,15 +560,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -596,9 +601,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -613,6 +616,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 93cca6e698600..7c5a8f05497f2 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -466,7 +466,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -531,7 +530,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -552,8 +550,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -564,15 +560,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -596,9 +601,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -613,6 +616,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
From: John Stultz <jstultz(a)google.com>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Signed-off-by: John Stultz <jstultz(a)google.com>
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 93cca6e698600..7c5a8f05497f2 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -466,7 +466,6 @@ static void stress_inorder_work(struct work_struct *work)
} while (!time_after(jiffies, stress->timeout));
kfree(order);
- kfree(stress);
}
struct reorder_lock {
@@ -531,7 +530,6 @@ static void stress_reorder_work(struct work_struct *work)
list_for_each_entry_safe(ll, ln, &locks, link)
kfree(ll);
kfree(order);
- kfree(stress);
}
static void stress_one_work(struct work_struct *work)
@@ -552,8 +550,6 @@ static void stress_one_work(struct work_struct *work)
break;
}
} while (!time_after(jiffies, stress->timeout));
-
- kfree(stress);
}
#define STRESS_INORDER BIT(0)
@@ -564,15 +560,24 @@ static void stress_one_work(struct work_struct *work)
static int stress(int nlocks, int nthreads, unsigned int flags)
{
struct ww_mutex *locks;
- int n;
+ struct stress *stress_array;
+ int n, count;
locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
if (!locks)
return -ENOMEM;
+ stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+ GFP_KERNEL);
+ if (!stress_array) {
+ kfree(locks);
+ return -ENOMEM;
+ }
+
for (n = 0; n < nlocks; n++)
ww_mutex_init(&locks[n], &ww_class);
+ count = 0;
for (n = 0; nthreads; n++) {
struct stress *stress;
void (*fn)(struct work_struct *work);
@@ -596,9 +601,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
if (!fn)
continue;
- stress = kmalloc(sizeof(*stress), GFP_KERNEL);
- if (!stress)
- break;
+ stress = &stress_array[count++];
INIT_WORK(&stress->work, fn);
stress->locks = locks;
@@ -613,6 +616,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
for (n = 0; n < nlocks; n++)
ww_mutex_destroy(&locks[n]);
+ kfree(stress_array);
kfree(locks);
return 0;
--
2.42.0
Recent changes to kernel_connect() and kernel_bind() ensure that
callers are insulated from changes to the address parameter made by BPF
SOCK_ADDR hooks. This patch wraps direct calls to ops->connect() and
ops->bind() with kernel_connect() and kernel_bind() to protect callers
in such cases.
Link: https://lore.kernel.org/netdev/9944248dba1bce861375fcce9de663934d933ba9.cam…
Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect")
Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jordan Rife <jrife(a)google.com>
---
fs/dlm/lowcomms.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 67f8dd8a05ef2..6296c62c10fa9 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -1817,8 +1817,8 @@ static int dlm_tcp_bind(struct socket *sock)
memcpy(&src_addr, &dlm_local_addr[0], sizeof(src_addr));
make_sockaddr(&src_addr, 0, &addr_len);
- result = sock->ops->bind(sock, (struct sockaddr *)&src_addr,
- addr_len);
+ result = kernel_bind(sock, (struct sockaddr *)&src_addr,
+ addr_len);
if (result < 0) {
/* This *may* not indicate a critical error */
log_print("could not bind for connect: %d", result);
@@ -1830,7 +1830,7 @@ static int dlm_tcp_bind(struct socket *sock)
static int dlm_tcp_connect(struct connection *con, struct socket *sock,
struct sockaddr *addr, int addr_len)
{
- return sock->ops->connect(sock, addr, addr_len, O_NONBLOCK);
+ return kernel_connect(sock, addr, addr_len, O_NONBLOCK);
}
static int dlm_tcp_listen_validate(void)
@@ -1862,8 +1862,8 @@ static int dlm_tcp_listen_bind(struct socket *sock)
/* Bind to our port */
make_sockaddr(&dlm_local_addr[0], dlm_config.ci_tcp_port, &addr_len);
- return sock->ops->bind(sock, (struct sockaddr *)&dlm_local_addr[0],
- addr_len);
+ return kernel_bind(sock, (struct sockaddr *)&dlm_local_addr[0],
+ addr_len);
}
static const struct dlm_proto_ops dlm_tcp_ops = {
@@ -1888,12 +1888,12 @@ static int dlm_sctp_connect(struct connection *con, struct socket *sock,
int ret;
/*
- * Make sock->ops->connect() function return in specified time,
+ * Make kernel_connect() function return in specified time,
* since O_NONBLOCK argument in connect() function does not work here,
* then, we should restore the default value of this attribute.
*/
sock_set_sndtimeo(sock->sk, 5);
- ret = sock->ops->connect(sock, addr, addr_len, 0);
+ ret = kernel_connect(sock, addr, addr_len, 0);
sock_set_sndtimeo(sock->sk, 0);
return ret;
}
--
2.42.0.869.gea05f2083d-goog
Greg,
Friday before the merge window opened, I received a bug report
for the eventfs code that was in linux-next. I spent the next
5 days debugging it and not only fixing it, but it led to finding
other bugs in the code. Several of these other bugs happen to
also affect the 6.6 kernel.
The eventfs code was written in two parts to lower the complexity.
The first part added just the dynamic creation of the eventfs
file system and that was added to 6.6.
The second part went further and removed the one-to-one mapping between
dentry/inode and meta data, as all events have the same files. It replaced
the meta data for each file with callbacks, which caused quite a bit of
code churn.
As the merge window was already open, when I finished all the fixes
I just sent those fixes on top of the linux-next changes along with
my pull request. That means, there are 5 commits that are marked
stable (or should be marked for stable) that need to be applied to
6.6 but require a bit of tweaking or even a new way of implementing the fix!
After sending the pull request, I then checked out 6.6 an took those
5 changes and fixed them up on top of it. I ran them through all my
tests that I use to send to Linus.
So these should be as good as the versions of the patches in Linus's tree.
I waited until Linus pulled in those changes to send this series out.
-- Steve
Steven Rostedt (Google) (5):
tracing: Have trace_event_file have ref counters
eventfs: Remove "is_freed" union with rcu head
eventfs: Save ownership and mode
eventfs: Delete eventfs_inode when the last dentry is freed
eventfs: Use simple_recursive_removal() to clean up dentries
----
fs/tracefs/event_inode.c | 288 +++++++++++++++++++++++--------------
include/linux/trace_events.h | 4 +
kernel/trace/trace.c | 15 ++
kernel/trace/trace.h | 3 +
kernel/trace/trace_events.c | 31 +++-
kernel/trace/trace_events_filter.c | 3 +
6 files changed, 231 insertions(+), 113 deletions(-)
The patch titled
Subject: mm: fix for negative counter: nr_file_hugepages
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-fix-for-negative-counter-nr_file_hugepages.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Stefan Roesch <shr(a)devkernel.io>
Subject: mm: fix for negative counter: nr_file_hugepages
Date: Mon, 6 Nov 2023 10:19:18 -0800
While qualifiying the 6.4 release, the following warning was detected in
messages:
vmstat_refresh: nr_file_hugepages -15664
The warning is caused by the incorrect updating of the NR_FILE_THPS
counter in the function split_huge_page_to_list. The if case is checking
for folio_test_swapbacked, but the else case is missing the check for
folio_test_pmd_mappable. The other functions that manipulate the counter
like __filemap_add_folio and filemap_unaccount_folio have the
corresponding check.
I have a test case, which reproduces the problem. It can be found here:
https://github.com/sroeschus/testcase/blob/main/vmstat_refresh/madv.c
The test case reproduces on an XFS filesystem. Running the same test
case on a BTRFS filesystem does not reproduce the problem.
AFAIK version 6.1 until 6.6 are affected by this problem.
Link: https://lkml.kernel.org/r/20231106181918.1091043-1-shr@devkernel.io
Signed-off-by: Stefan Roesch <shr(a)devkernel.io>
Co-debugged-by: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Rik van Riel <riel(a)surriel.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/huge_memory.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/huge_memory.c~mm-fix-for-negative-counter-nr_file_hugepages
+++ a/mm/huge_memory.c
@@ -2772,7 +2772,8 @@ int split_huge_page_to_list(struct page
if (folio_test_swapbacked(folio)) {
__lruvec_stat_mod_folio(folio, NR_SHMEM_THPS,
-nr);
- } else {
+ } else if (folio_test_pmd_mappable(folio)) {
+
__lruvec_stat_mod_folio(folio, NR_FILE_THPS,
-nr);
filemap_nr_thps_dec(mapping);
_
Patches currently in -mm which might be from shr(a)devkernel.io are
mm-fix-for-negative-counter-nr_file_hugepages.patch
The ttyname buffer for the ledtrig_tty_data struct is allocated in the
sysfs ttyname_store() function. This buffer must be released on trigger
deactivation. This was missing and is thus a memory leak.
While we are at it, the tty handler in the ledtrig_tty_data struct should
also be returned in case of the trigger deactivation call.
Cc: stable(a)vger.kernel.org
Fixes: fd4a641ac88f ("leds: trigger: implement a tty trigger")
Signed-off-by: Florian Eckert <fe(a)dev.tdt.de>
---
v1 -> v2:
Add Cc: tag
drivers/leds/trigger/ledtrig-tty.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/leds/trigger/ledtrig-tty.c b/drivers/leds/trigger/ledtrig-tty.c
index 8ae0d2d284af..3e69a7bde928 100644
--- a/drivers/leds/trigger/ledtrig-tty.c
+++ b/drivers/leds/trigger/ledtrig-tty.c
@@ -168,6 +168,10 @@ static void ledtrig_tty_deactivate(struct led_classdev *led_cdev)
cancel_delayed_work_sync(&trigger_data->dwork);
+ kfree(trigger_data->ttyname);
+ tty_kref_put(trigger_data->tty);
+ trigger_data->tty = NULL;
+
kfree(trigger_data);
}
--
2.30.2
On Mon, Nov 06, 2023 at 01:18:36PM +0100, gregkh(a)linuxfoundation.org wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> tty: 8250: Add support for Intashield IX cards
>
> to the 5.10-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> tty-8250-add-support-for-intashield-ix-cards.patch
> and it can be found in the queue-5.10 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
>
I don't think this patch should be in 5.10-stable. It's using the
pbn_oxsemi_x_15625000 configuration which isn't available in the version
of the driver (it's actually pbn_oxsemi_x_3906250 in this version).
The rest of the patches to be merged look OK for this branch (as they are
all using the generic configuration rather than Oxsemi).
>
Thanks,
Cameron
> From 62d2ec2ded278c7512d91ca7bf8eb9bac46baf90 Mon Sep 17 00:00:00 2001
> From: Cameron Williams <cang1(a)live.co.uk>
> Date: Fri, 20 Oct 2023 17:03:16 +0100
> Subject: tty: 8250: Add support for Intashield IX cards
>
> From: Cameron Williams <cang1(a)live.co.uk>
>
> commit 62d2ec2ded278c7512d91ca7bf8eb9bac46baf90 upstream.
>
> Add support for the IX-100, IX-200 and IX-400 serial cards.
>
> Cc: stable(a)vger.kernel.org
> Signed-off-by: Cameron Williams <cang1(a)live.co.uk>
> Link: https://lore.kernel.org/r/DU0PR02MB7899614E5837E82A03272A4BC4DBA@DU0PR02MB7…
> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
> ---
> drivers/tty/serial/8250/8250_pci.c | 21 +++++++++++++++++++++
> 1 file changed, 21 insertions(+)
>
> --- a/drivers/tty/serial/8250/8250_pci.c
> +++ b/drivers/tty/serial/8250/8250_pci.c
> @@ -5150,6 +5150,27 @@ static const struct pci_device_id serial
> { PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400,
> PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */
> pbn_b2_4_115200 },
> + /*
> + * IntaShield IX-100
> + */
> + { PCI_VENDOR_ID_INTASHIELD, 0x4027,
> + PCI_ANY_ID, PCI_ANY_ID,
> + 0, 0,
> + pbn_oxsemi_1_15625000 },
> + /*
> + * IntaShield IX-200
> + */
> + { PCI_VENDOR_ID_INTASHIELD, 0x4028,
> + PCI_ANY_ID, PCI_ANY_ID,
> + 0, 0,
> + pbn_oxsemi_2_15625000 },
> + /*
> + * IntaShield IX-400
> + */
> + { PCI_VENDOR_ID_INTASHIELD, 0x4029,
> + PCI_ANY_ID, PCI_ANY_ID,
> + 0, 0,
> + pbn_oxsemi_4_15625000 },
> /* Brainboxes Devices */
> /*
> * Brainboxes UC-101
>
>
> Patches currently in stable-queue which might be from cang1(a)live.co.uk are
>
> queue-5.10/tty-8250-add-support-for-additional-brainboxes-uc-cards.patch
> queue-5.10/tty-8250-add-support-for-intashield-ix-cards.patch
> queue-5.10/tty-8250-add-support-for-brainboxes-up-cards.patch
> queue-5.10/tty-8250-add-support-for-intashield-is-100.patch
> queue-5.10/tty-8250-remove-uc-257-and-uc-431.patch
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x b65235f6e102354ccafda601eaa1c5bef5284d21
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102017-human-marine-7125@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b65235f6e102354ccafda601eaa1c5bef5284d21 Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk(a)redhat.com>
Date: Thu, 28 Sep 2023 20:33:51 +0300
Subject: [PATCH] x86: KVM: SVM: always update the x2avic msr interception
The following problem exists since x2avic was enabled in the KVM:
svm_set_x2apic_msr_interception is called to enable the interception of
the x2apic msrs.
In particular it is called at the moment the guest resets its apic.
Assuming that the guest's apic was in x2apic mode, the reset will bring
it back to the xapic mode.
The svm_set_x2apic_msr_interception however has an erroneous check for
'!apic_x2apic_mode()' which prevents it from doing anything in this case.
As a result of this, all x2apic msrs are left unintercepted, and that
exposes the bare metal x2apic (if enabled) to the guest.
Oops.
Remove the erroneous '!apic_x2apic_mode()' check to fix that.
This fixes CVE-2023-5090
Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
Cc: stable(a)vger.kernel.org
Signed-off-by: Maxim Levitsky <mlevitsk(a)redhat.com>
Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com>
Tested-by: Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com>
Reviewed-by: Sean Christopherson <seanjc(a)google.com>
Message-Id: <20230928173354.217464-2-mlevitsk(a)redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 9507df93f410..acdd0b89e471 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -913,8 +913,7 @@ void svm_set_x2apic_msr_interception(struct vcpu_svm *svm, bool intercept)
if (intercept == svm->x2avic_msrs_intercepted)
return;
- if (!x2avic_enabled ||
- !apic_x2apic_mode(svm->vcpu.arch.apic))
+ if (!x2avic_enabled)
return;
for (i = 0; i < MAX_DIRECT_ACCESS_MSRS; i++) {
This helper is used for checking if the connected host supports
the feature, it can be moved into generic code to be used by other
smu implementations as well.
Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Evan Quan <evan.quan(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
(cherry picked from commit 188623076d0f1a500583d392b6187056bf7cc71a)
The original problematic dGPU is not supported in 5.15.
Just introduce new function for 5.15 as a dependency for fixing
unrelated dGPU that uses this symbol as well.
Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com>
---
v1->v2:
* Update commit to 6.5-rc2 commit.
It merged as both of these:
188623076d0f1a500583d392b6187056bf7cc71a
5d1eb4c4c872b55664f5754cc16827beff8630a7
It's already been backported into 6.1.y as well.
---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 19 +++++++++++++++++++
2 files changed, 20 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index d90da384d185..1f1e7966beb5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1285,6 +1285,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
void amdgpu_device_pci_config_reset(struct amdgpu_device *adev);
int amdgpu_device_pci_reset(struct amdgpu_device *adev);
bool amdgpu_device_need_post(struct amdgpu_device *adev);
+bool amdgpu_device_pcie_dynamic_switching_supported(void);
bool amdgpu_device_should_use_aspm(struct amdgpu_device *adev);
bool amdgpu_device_aspm_support_quirk(void);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 2cf49a32ac6c..f57334fff7fc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1319,6 +1319,25 @@ bool amdgpu_device_need_post(struct amdgpu_device *adev)
return true;
}
+/*
+ * Intel hosts such as Raptor Lake and Sapphire Rapids don't support dynamic
+ * speed switching. Until we have confirmation from Intel that a specific host
+ * supports it, it's safer that we keep it disabled for all.
+ *
+ * https://edc.intel.com/content/www/us/en/design/products/platforms/details/r…
+ * https://gitlab.freedesktop.org/drm/amd/-/issues/2663
+ */
+bool amdgpu_device_pcie_dynamic_switching_supported(void)
+{
+#if IS_ENABLED(CONFIG_X86)
+ struct cpuinfo_x86 *c = &cpu_data(0);
+
+ if (c->x86_vendor == X86_VENDOR_INTEL)
+ return false;
+#endif
+ return true;
+}
+
/**
* amdgpu_device_should_use_aspm - check if the device should program ASPM
*
--
2.34.1
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x d920abd1e7c4884f9ecd0749d1921b7ab19ddfbd
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102012-pleat-snippet-29cf@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From d920abd1e7c4884f9ecd0749d1921b7ab19ddfbd Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi(a)grimberg.me>
Date: Mon, 2 Oct 2023 13:54:28 +0300
Subject: [PATCH] nvmet-tcp: Fix a possible UAF in queue intialization setup
From Alon:
"Due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel,
a malicious user can cause a UAF and a double free, which may lead to
RCE (may also lead to an LPE in case the attacker already has local
privileges)."
Hence, when a queue initialization fails after the ahash requests are
allocated, it is guaranteed that the queue removal async work will be
called, hence leave the deallocation to the queue removal.
Also, be extra careful not to continue processing the socket, so set
queue rcv_state to NVMET_TCP_RECV_ERR upon a socket error.
Cc: stable(a)vger.kernel.org
Reported-by: Alon Zahavi <zahavi.alon(a)gmail.com>
Tested-by: Alon Zahavi <zahavi.alon(a)gmail.com>
Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com>
Signed-off-by: Keith Busch <kbusch(a)kernel.org>
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index cd92d7ddf5ed..197fc2ecb164 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -372,6 +372,7 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
{
+ queue->rcv_state = NVMET_TCP_RECV_ERR;
if (status == -EPIPE || status == -ECONNRESET)
kernel_sock_shutdown(queue->sock, SHUT_RDWR);
else
@@ -910,15 +911,11 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
iov.iov_len = sizeof(*icresp);
ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
if (ret < 0)
- goto free_crypto;
+ return ret; /* queue removal will cleanup */
queue->state = NVMET_TCP_Q_LIVE;
nvmet_prepare_receive_pdu(queue);
return 0;
-free_crypto:
- if (queue->hdr_digest || queue->data_digest)
- nvmet_tcp_free_crypto(queue);
- return ret;
}
static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,