- Linux-stable-mirror - lists.linaro.org

[PATCH] drm/amd/display: Disable DPCD Probe Quirk

by Fangzhi Zuo

Disable dpcd probe quirk to native aux. Cc: <stable(a)vger.kernel.org> # 6.16.y: 5281cbe0b55a Cc: <stable(a)vger.kernel.org> # 6.16.y: 0b4aa85e8981 Cc: <stable(a)vger.kernel.org> # 6.16.y: b87ed522b364 Cc: <stable(a)vger.kernel.org> # 6.16.y Signed-off-by: Fangzhi Zuo <Jerry.Zuo(a)amd.com> Reviewed-by: Imre Deak <imre.deak(a)intel.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c index 25e8befbcc47..99fd064324ba 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c @@ -809,6 +809,7 @@ void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm, drm_dp_aux_init(&aconnector->dm_dp_aux.aux); drm_dp_cec_register_connector(&aconnector->dm_dp_aux.aux, &aconnector->base); + drm_dp_dpcd_set_probe(&aconnector->dm_dp_aux.aux, false); if (aconnector->base.connector_type == DRM_MODE_CONNECTOR_eDP) return; -- 2.43.0

1 week, 4 days

2
1
0 0

[PATCH v2 RESEND] media: vidtv: initialize local pointers upon transfer of memory ownership

by Jeongjun Park

vidtv_channel_si_init() creates a temporary list (program, service, event) and ownership of the memory itself is transferred to the PAT/SDT/EIT tables through vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), vidtv_psi_eit_event_assign(). The problem here is that the local pointer where the memory ownership transfer was completed is not initialized to NULL. This causes the vidtv_psi_pmt_create_sec_for_each_pat_entry() function to fail, and in the flow that jumps to free_eit, the memory that was freed by vidtv_psi_*_table_destroy() can be accessed again by vidtv_psi_*_event_destroy() due to the uninitialized local pointer, so it is freed once again. Therefore, to prevent use-after-free and double-free vuln, local pointers must be initialized to NULL when transferring memory ownership. Cc: <stable(a)vger.kernel.org> Reported-by: syzbot+1d9c0edea5907af239e0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1d9c0edea5907af239e0 Fixes: 3be8037960bc ("media: vidtv: add error checks") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> --- v2: Improved patch description wording and CC stable mailing list - Link to v1: https://lore.kernel.org/all/20250822065849.1145572-1-aha310510@gmail.com/ --- drivers/media/test-drivers/vidtv/vidtv_channel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/test-drivers/vidtv/vidtv_channel.c b/drivers/media/test-drivers/vidtv/vidtv_channel.c index f3023e91b3eb..3541155c6fc6 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_channel.c +++ b/drivers/media/test-drivers/vidtv/vidtv_channel.c @@ -461,12 +461,15 @@ int vidtv_channel_si_init(struct vidtv_mux *m) /* assemble all programs and assign to PAT */ vidtv_psi_pat_program_assign(m->si.pat, programs); + programs = NULL; /* assemble all services and assign to SDT */ vidtv_psi_sdt_service_assign(m->si.sdt, services); + services = NULL; /* assemble all events and assign to EIT */ vidtv_psi_eit_event_assign(m->si.eit, events); + events = NULL; m->si.pmt_secs = vidtv_psi_pmt_create_sec_for_each_pat_entry(m->si.pat, m->pcr_pid); --

1 week, 4 days

2
1
0 0

[PATCH net v2] rds: ib: Remove unused extern definition

by Håkon Bugge

In the old days, RDS used FMR (Fast Memory Registration) to register IB MRs to be used by RDMA. A newer and better verbs based registration/de-registration method called FRWR (Fast Registration Work Request) was added to RDS by commit 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode") in 2016. Detection and enablement of FRWR was done in commit 2cb2912d6563 ("RDS: IB: add Fastreg MR (FRMR) detection support"). But said commit added an extern bool prefer_frmr, which was not used by said commit - nor used by later commits. Hence, remove it. Fixes: 2cb2912d6563 ("RDS: IB: add Fastreg MR (FRMR) detection support") Cc: stable(a)vger.kernel.org Signed-off-by: Håkon Bugge <haakon.bugge(a)oracle.com> --- v1 -> v2: * Added commit message * Added Cc: stable(a)vger.kernel.org --- net/rds/ib_mr.h | 1 - 1 file changed, 1 deletion(-) diff --git a/net/rds/ib_mr.h b/net/rds/ib_mr.h index ea5e9aee4959e..5884de8c6f45b 100644 --- a/net/rds/ib_mr.h +++ b/net/rds/ib_mr.h @@ -108,7 +108,6 @@ struct rds_ib_mr_pool { }; extern struct workqueue_struct *rds_ib_mr_wq; -extern bool prefer_frmr; struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *rds_dev, int npages); -- 2.43.5

1 week, 4 days

4
4
0 0

[PATCH v2] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed

by Krzysztof Kozlowski

If earlier opening of source graph fails (e.g. ADSP rejects due to incorrect audioreach topology), the graph is closed and "dai_data->graph[dai->id]" is assigned NULL. Preparing the DAI for sink graph continues though and next call to q6apm_lpass_dai_prepare() receives dai_data->graph[dai->id]=NULL leading to NULL pointer exception: qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22 Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 ... Call trace: q6apm_graph_media_format_pcm+0x48/0x120 (P) q6apm_lpass_dai_prepare+0x110/0x1b4 snd_soc_pcm_dai_prepare+0x74/0x108 __soc_pcm_prepare+0x44/0x160 dpcm_be_dai_prepare+0x124/0x1c0 Fixes: 30ad723b93ad ("ASoC: qdsp6: audioreach: add q6apm lpass dai support") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- Changes in v2: 1. Use approach suggested by Srini (you gave me some code, so shall I add Co-developed-by?) --- sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c index a0d90462fd6a..20974f10406b 100644 --- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c @@ -213,8 +213,10 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s return 0; err: - q6apm_graph_close(dai_data->graph[dai->id]); - dai_data->graph[dai->id] = NULL; + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + q6apm_graph_close(dai_data->graph[dai->id]); + dai_data->graph[dai->id] = NULL; + } return rc; } -- 2.48.1

1 week, 4 days

3
2
0 0

[PATCH] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed

by Krzysztof Kozlowski

If earlier opening of source graph fails (e.g. ADSP rejects due to incorrect audioreach topology), the graph is closed and "dai_data->graph[dai->id]" is assigned NULL. Preparing the DAI for sink graph continues though and next call to q6apm_lpass_dai_prepare() receives dai_data->graph[dai->id]=NULL leading to NULL pointer exception: qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22 Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 ... Call trace: q6apm_graph_media_format_pcm+0x48/0x120 (P) q6apm_lpass_dai_prepare+0x110/0x1b4 snd_soc_pcm_dai_prepare+0x74/0x108 __soc_pcm_prepare+0x44/0x160 dpcm_be_dai_prepare+0x124/0x1c0 Fixes: 30ad723b93ad ("ASoC: qdsp6: audioreach: add q6apm lpass dai support") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c index f90628d9b90e..7520e6f024c3 100644 --- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c @@ -191,6 +191,12 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s return rc; } dai_data->graph[graph_id] = graph; + } else if (!dai_data->graph[dai->id]) { + /* + * Loading source graph failed before, so abort loading the sink + * as well. + */ + return -EINVAL; } cfg->direction = substream->stream; -- 2.48.1

1 week, 4 days

3
3
0 0

[PATCH 6.12 00/95] 6.12.45-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.45 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.45-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.45-rc1 Mason Chang <mason-cw.chang(a)mediatek.com> thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands Mason Chang <mason-cw.chang(a)mediatek.com> thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data Mason Chang <mason-cw.chang(a)mediatek.com> thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const Imre Deak <imre.deak(a)intel.com> Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" Niklas Cassel <cassel(a)kernel.org> PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up Niklas Cassel <cassel(a)kernel.org> PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS Eric Dumazet <edumazet(a)google.com> net: rose: fix a typo in rose_clear_routes() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode Ma Ke <make24(a)iscas.ac.cn> drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv Timur Tabi <ttabi(a)nvidia.com> drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 James Jones <jajones(a)nvidia.com> drm/nouveau/disp: Always accept linear modifier Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/xe/vm: Clear the scratch_pt pointer on error Eric Sandeen <sandeen(a)redhat.com> xfs: do not propagate ENODATA disk errors into xattr code Steve French <stfrench(a)microsoft.com> smb3 client: fix return code mapping of remap_file_range Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Shuhao Fu <sfual(a)cse.ust.hk> fs/smb: Fix inconsistent refcnt update Shanker Donthineni <sdonthineni(a)nvidia.com> dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted Bart Van Assche <bvanassche(a)acm.org> blk-zoned: Fix a lockdep complaint about recursive locking Alex Deucher <alexander.deucher(a)amd.com> Revert "drm/amdgpu: fix incorrect vm flags to map bo" Minjong Kim <minbell.kim(a)samsung.com> HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Ping Cheng <pinglinux(a)gmail.com> HID: wacom: Add a new Art Pen 2 Matt Coffin <mcoffin13(a)gmail.com> HID: logitech: Add ids for G PRO 2 LIGHTSPEED Antheas Kapenekakis <lkml(a)antheas.dev> HID: quirks: add support for Legion Go dual dinput modes Qasim Ijaz <qasdev00(a)gmail.com> HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() Qasim Ijaz <qasdev00(a)gmail.com> HID: asus: fix UAF via HID_CLAIMED_INPUT validation K Prateek Nayak <kprateek.nayak(a)amd.com> x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON Borislav Petkov (AMD) <bp(a)alien8.de> x86/microcode/AMD: Handle the case of no BIOS microcode Radim Krčmář <rkrcmar(a)ventanamicro.com> RISC-V: KVM: fix stack overrun when loading vlenb Thijs Raymakers <thijs(a)raymakers.nl> KVM: x86: use array_index_nospec with indices that come from guest Neil Mandir <neil.mandir(a)seco.com> net: macb: Disable clocks once Li Nan <linan122(a)huawei.com> efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Alexander Duyck <alexanderduyck(a)fb.com> fbnic: Move phylink resume out of service_task and into open/close Eric Dumazet <edumazet(a)google.com> l2tp: do not use sock_hold() in pppol2tp_session_get_sock() Eric Dumazet <edumazet(a)google.com> sctp: initialize more fields in sctp_v6_from_sk() Takamitsu Iwai <takamitz(a)amazon.co.jp> net: rose: include node references in rose_neigh refcount Takamitsu Iwai <takamitz(a)amazon.co.jp> net: rose: convert 'use' field to refcount_t Takamitsu Iwai <takamitz(a)amazon.co.jp> net: rose: split remove and free operations in rose_remove_neigh() Dipayaan Roy <dipayanroy(a)linux.microsoft.com> net: hv_netvsc: fix loss of early receive events from host during channel open. Joe Damato <jdamato(a)fastly.com> hv_netvsc: Link queues to NAPIs Rohan G Thomas <rohan.g.thomas(a)altera.com> net: stmmac: Set CIC bit only for TX queues with COE Rohan G Thomas <rohan.g.thomas(a)altera.com> net: stmmac: xgmac: Correct supported speed modes Rohan G Thomas <rohan.g.thomas(a)altera.com> net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Set local Xoff after FW update Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Update and set Xon/Xoff upon port speed set Alexei Lazar <alazar(a)nvidia.com> net/mlx5e: Update and set Xon/Xoff upon MTU set Moshe Shemesh <moshe(a)nvidia.com> net/mlx5: Nack sync reset when SFs are present Moshe Shemesh <moshe(a)nvidia.com> net/mlx5: Fix lockdep assertion on sync reset unload event Moshe Shemesh <moshe(a)nvidia.com> net/mlx5: Reload auxiliary drivers on fw_activate Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Fix stats context reservation logic Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Adjust TX rings if reservation is less than requested Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> bnxt_en: Fix memory corruption when FW resources change during ifdown Horatiu Vultur <horatiu.vultur(a)microchip.com> phy: mscc: Fix when PTP clock is register and unregister Matthew Brost <matthew.brost(a)intel.com> drm/xe: Don't trigger rebind on initial dma-buf validation Zbigniew Kempczyński <zbigniew.kempczynski(a)intel.com> drm/xe/xe_sync: avoid race during ufence signaling Jan Kiszka <jan.kiszka(a)siemens.com> efi: stmm: Fix incorrect buffer allocation method Yeounsu Moon <yyyynoom(a)gmail.com> net: dlink: fix multicast stats being counted incorrectly Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> dt-bindings: display/msm: qcom,mdp5: drop lut clock Michal Kubiak <michal.kubiak(a)intel.com> ice: fix incorrect counter for buffer allocation failures Jacob Keller <jacob.e.keller(a)intel.com> ice: use fixed adapter index for E825C embedded devices Jacob Keller <jacob.e.keller(a)intel.com> ice: don't leave device non-functional if Tx scheduler config fails Timur Tabi <ttabi(a)nvidia.com> drm/nouveau: remove unused memory target test Timur Tabi <ttabi(a)nvidia.com> drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr Kuniyuki Iwashima <kuniyu(a)google.com> atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Pavel Shpakovskiy <pashpakovskii(a)salutedevices.com> Bluetooth: hci_sync: fix set_local_name race condition Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Ludovico de Nittis <ludovico.denittis(a)collabora.com> Bluetooth: hci_event: Mark connection as closed during suspend disconnect Ludovico de Nittis <ludovico.denittis(a)collabora.com> Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success luoguangfei <15388634752(a)163.com> net: macb: fix unregister_netdev call order in macb_remove() José Expósito <jose.exposito89(a)gmail.com> HID: input: report battery status changes immediately José Expósito <jose.exposito89(a)gmail.com> HID: input: rename hidinput_set_battery_charge_status() Madhavan Srinivasan <maddy(a)linux.ibm.com> powerpc/kvm: Fix ifdef to remove build warning Jason-JH Lin <jason-jh.lin(a)mediatek.com> drm/mediatek: Add error handling for old state CRTC in atomic_disable Ayushi Makhija <quic_amakhija(a)quicinc.com> drm/msm: update the high bitfield of certain DSI registers Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> drm/msm/kms: move snapshot init earlier in KMS init Oreoluwa Babatunde <oreoluwa.babatunde(a)oss.qualcomm.com> of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() Rob Clark <robin.clark(a)oss.qualcomm.com> drm/msm: Defer fd_install in SUBMIT ioctl Oscar Maes <oscmaes92(a)gmail.com> net: ipv4: fix regression in local-broadcast routes Nikolay Kuratov <kniv(a)yandex-team.ru> vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Werner Sembach <wse(a)tuxedocomputers.com> ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list Junli Liu <liujunli(a)lixiang.com> erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC Alexey Klimov <alexey.klimov(a)linaro.org> ASoC: codecs: tx-macro: correct tx_macro_component_drv name Paulo Alcantara <pc(a)manguebit.org> smb: client: fix race with concurrent opens in rename(2) Paulo Alcantara <pc(a)manguebit.org> smb: client: fix race with concurrent opens in unlink(2) Damien Le Moal <dlemoal(a)kernel.org> scsi: core: sysfs: Correct sysfs attributes access rights Namhyung Kim <namhyung(a)kernel.org> vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER Ian Rogers <irogers(a)google.com> perf symbol-minimal: Fix ehdr reading in filename__read_build_id Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Dan Carpenter <dan.carpenter(a)linaro.org> of: dynamic: Fix use after free in of_changeset_add_prop_helper() Aleksander Jan Bajkowski <olek2(a)wp.pl> mips: lantiq: xway: sysctrl: rename the etop node Aleksander Jan Bajkowski <olek2(a)wp.pl> mips: dts: lantiq: danube: add missing burst length property Randy Dunlap <rdunlap(a)infradead.org> pinctrl: STMFX: add missing HAS_IOMEM dependency Lizhi Hou <lizhi.hou(a)amd.com> of: dynamic: Fix memleak when of_pci_add_properties() failed Ye Weihua <yeweihua4(a)huawei.com> trace/fgraph: Fix the warning caused by missing unregister notifier Tao Chen <chen.dylane(a)linux.dev> rtla: Check pkg-config install Tao Chen <chen.dylane(a)linux.dev> tools/latency-collector: Check pkg-config install ------------- Diffstat: .../devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 - Makefile | 4 +- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 +- arch/mips/lantiq/xway/sysctrl.c | 10 +- arch/powerpc/kernel/kvm.c | 8 +- arch/riscv/kvm/vcpu_vector.c | 2 + arch/x86/kernel/cpu/microcode/amd.c | 22 +++- arch/x86/kernel/cpu/topology_amd.c | 27 +++-- arch/x86/kvm/lapic.c | 2 + arch/x86/kvm/x86.c | 7 +- block/blk-zoned.c | 11 +- drivers/acpi/ec.c | 6 ++ drivers/atm/atmtcp.c | 17 ++- drivers/firmware/efi/stmm/tee_stmm_efi.c | 21 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 ++-- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 ++-- drivers/gpu/drm/mediatek/mtk_plane.c | 3 +- drivers/gpu/drm/msm/msm_gem_submit.c | 14 +-- drivers/gpu/drm/msm/msm_kms.c | 10 +- drivers/gpu/drm/msm/registers/display/dsi.xml | 28 ++--- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 + drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 15 +-- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 5 +- drivers/gpu/drm/xe/xe_bo.c | 3 +- drivers/gpu/drm/xe/xe_sync.c | 2 +- drivers/gpu/drm/xe/xe_vm.c | 8 +- drivers/hid/hid-asus.c | 8 +- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-input-test.c | 10 +- drivers/hid/hid-input.c | 51 +++++---- drivers/hid/hid-logitech-dj.c | 4 + drivers/hid/hid-logitech-hidpp.c | 2 + drivers/hid/hid-multitouch.c | 8 ++ drivers/hid/hid-ntrig.c | 3 + drivers/hid/hid-quirks.c | 2 + drivers/hid/wacom_wac.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 36 +++++-- drivers/net/ethernet/cadence/macb_main.c | 9 +- drivers/net/ethernet/dlink/dl2k.c | 2 +- drivers/net/ethernet/intel/ice/ice_adapter.c | 49 +++++++-- drivers/net/ethernet/intel/ice/ice_adapter.h | 4 +- drivers/net/ethernet/intel/ice/ice_ddp.c | 44 +++++--- drivers/net/ethernet/intel/ice/ice_main.c | 16 ++- drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 +++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +++- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 114 ++++++++++++--------- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h | 1 + .../net/ethernet/mellanox/mlx5/core/sf/devlink.c | 10 ++ drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 ++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 - .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 ++- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 9 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +- drivers/net/hyperv/netvsc.c | 18 +++- drivers/net/hyperv/rndis_filter.c | 20 +++- drivers/net/phy/mscc/mscc.h | 4 + drivers/net/phy/mscc/mscc_main.c | 4 +- drivers/net/phy/mscc/mscc_ptp.c | 34 +++--- drivers/net/usb/qmi_wwan.c | 3 + drivers/of/dynamic.c | 9 +- drivers/of/of_reserved_mem.c | 16 ++- drivers/pci/controller/dwc/pcie-designware.c | 8 ++ drivers/pci/controller/plda/pcie-starfive.c | 2 +- drivers/pci/pci.h | 2 +- drivers/pinctrl/Kconfig | 1 + drivers/scsi/scsi_sysfs.c | 4 +- drivers/thermal/mediatek/lvts_thermal.c | 74 ++++++++++--- drivers/vhost/net.c | 9 +- fs/efivarfs/super.c | 4 + fs/erofs/zdata.c | 13 ++- fs/smb/client/cifsfs.c | 14 +++ fs/smb/client/inode.c | 34 +++++- fs/smb/client/smb2inode.c | 7 +- fs/xfs/libxfs/xfs_attr_remote.c | 7 ++ fs/xfs/libxfs/xfs_da_btree.c | 6 ++ include/linux/atmdev.h | 1 + include/linux/dma-map-ops.h | 3 + include/net/bluetooth/hci_sync.h | 2 +- include/net/rose.h | 18 +++- include/uapi/linux/vhost.h | 4 +- kernel/dma/contiguous.c | 2 - kernel/dma/pool.c | 4 +- kernel/trace/fgraph.c | 1 + kernel/trace/trace.c | 4 +- net/atm/common.c | 15 ++- net/bluetooth/hci_event.c | 20 +++- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 5 +- net/ipv4/route.c | 10 +- net/l2tp/l2tp_ppp.c | 25 ++--- net/rose/af_rose.c | 13 +-- net/rose/rose_in.c | 12 +-- net/rose/rose_route.c | 62 ++++++----- net/rose/rose_timer.c | 2 +- net/sctp/ipv6.c | 2 + sound/soc/codecs/lpass-tx-macro.c | 2 +- tools/perf/util/symbol-minimal.c | 55 +++++----- tools/tracing/latency/Makefile.config | 8 ++ tools/tracing/rtla/Makefile.config | 8 ++ 105 files changed, 910 insertions(+), 402 deletions(-)

1 week, 4 days

12
109
0 0

Billing Statement

by Billing Dept via lists.linaro.org

.

1 week, 4 days

1
0
0 0

[PATCH v3 3/3] drm/xe: Block exec and rebind worker while evicting for suspend / hibernate

by Thomas Hellström

When the xe pm_notifier evicts for suspend / hibernate, there might be racing tasks trying to re-validate again. This can lead to suspend taking excessive time or get stuck in a live-lock. This behaviour becomes much worse with the fix that actually makes re-validation bring back bos to VRAM rather than letting them remain in TT. Prevent that by having exec and the rebind worker waiting for a completion that is set to block by the pm_notifier before suspend and is signaled by the pm_notifier after resume / wakeup. It's probably still possible to craft malicious applications that block suspending. More work is pending to fix that. v3: - Avoid wait_for_completion() in the kernel worker since it could potentially cause work item flushes from freezable processes to wait forever. Instead terminate the rebind workers if needed and re-launch at resume. (Matt Auld) Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4288 Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier") Cc: Matthew Auld <matthew.auld(a)intel.com> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.16+ Signed-off-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> --- drivers/gpu/drm/xe/xe_device_types.h | 6 ++++ drivers/gpu/drm/xe/xe_exec.c | 9 ++++++ drivers/gpu/drm/xe/xe_pm.c | 20 ++++++++++++ drivers/gpu/drm/xe/xe_vm.c | 46 +++++++++++++++++++++++++++- drivers/gpu/drm/xe/xe_vm.h | 2 ++ drivers/gpu/drm/xe/xe_vm_types.h | 5 +++ 6 files changed, 87 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_device_types.h b/drivers/gpu/drm/xe/xe_device_types.h index 092004d14db2..1e780f8a2a8c 100644 --- a/drivers/gpu/drm/xe/xe_device_types.h +++ b/drivers/gpu/drm/xe/xe_device_types.h @@ -507,6 +507,12 @@ struct xe_device { /** @pm_notifier: Our PM notifier to perform actions in response to various PM events. */ struct notifier_block pm_notifier; + /** @pm_block: Completion to block validating tasks on suspend / hibernate prepare */ + struct completion pm_block; + /** @rebind_resume_list: List of wq items to kick on resume. */ + struct list_head rebind_resume_list; + /** @rebind_resume_lock: Lock to protect the rebind_resume_list */ + struct mutex rebind_resume_lock; /** @pmt: Support the PMT driver callback interface */ struct { diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c index 44364c042ad7..374c831e691b 100644 --- a/drivers/gpu/drm/xe/xe_exec.c +++ b/drivers/gpu/drm/xe/xe_exec.c @@ -237,6 +237,15 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file) goto err_unlock_list; } + /* + * It's OK to block interruptible here with the vm lock held, since + * on task freezing during suspend / hibernate, the call will + * return -ERESTARTSYS and the IOCTL will be rerun. + */ + err = wait_for_completion_interruptible(&xe->pm_block); + if (err) + goto err_unlock_list; + vm_exec.vm = &vm->gpuvm; vm_exec.flags = DRM_EXEC_INTERRUPTIBLE_WAIT; if (xe_vm_in_lr_mode(vm)) { diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c index bee9aacd82e7..6d59990ff6ba 100644 --- a/drivers/gpu/drm/xe/xe_pm.c +++ b/drivers/gpu/drm/xe/xe_pm.c @@ -297,6 +297,18 @@ static u32 vram_threshold_value(struct xe_device *xe) return DEFAULT_VRAM_THRESHOLD; } +static void xe_pm_wake_preempt_workers(struct xe_device *xe) +{ + struct list_head *link, *next; + + mutex_lock(&xe->rebind_resume_lock); + list_for_each_safe(link, next, &xe->rebind_resume_list) { + list_del_init(link); + xe_vm_resume_preempt_worker(link); + } + mutex_unlock(&xe->rebind_resume_lock); +} + static int xe_pm_notifier_callback(struct notifier_block *nb, unsigned long action, void *data) { @@ -306,6 +318,7 @@ static int xe_pm_notifier_callback(struct notifier_block *nb, switch (action) { case PM_HIBERNATION_PREPARE: case PM_SUSPEND_PREPARE: + reinit_completion(&xe->pm_block); xe_pm_runtime_get(xe); err = xe_bo_evict_all_user(xe); if (err) @@ -322,6 +335,8 @@ static int xe_pm_notifier_callback(struct notifier_block *nb, break; case PM_POST_HIBERNATION: case PM_POST_SUSPEND: + complete_all(&xe->pm_block); + xe_pm_wake_preempt_workers(xe); xe_bo_notifier_unprepare_all_pinned(xe); xe_pm_runtime_put(xe); break; @@ -348,6 +363,11 @@ int xe_pm_init(struct xe_device *xe) if (err) return err; + init_completion(&xe->pm_block); + complete_all(&xe->pm_block); + mutex_init(&xe->rebind_resume_lock); + INIT_LIST_HEAD(&xe->rebind_resume_list); + /* For now suspend/resume is only allowed with GuC */ if (!xe_device_uc_enabled(xe)) return 0; diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c index f55f96bb240a..97aad1d53a8c 100644 --- a/drivers/gpu/drm/xe/xe_vm.c +++ b/drivers/gpu/drm/xe/xe_vm.c @@ -394,6 +394,9 @@ static int xe_gpuvm_validate(struct drm_gpuvm_bo *vm_bo, struct drm_exec *exec) list_move_tail(&gpuva_to_vma(gpuva)->combined_links.rebind, &vm->rebind_list); + if (!try_wait_for_completion(&vm->xe->pm_block)) + return -EAGAIN; + ret = xe_bo_validate(gem_to_xe_bo(vm_bo->obj), vm, false); if (ret) return ret; @@ -480,6 +483,37 @@ static int xe_preempt_work_begin(struct drm_exec *exec, struct xe_vm *vm, return xe_vm_validate_rebind(vm, exec, vm->preempt.num_exec_queues); } +static bool vm_suspend_preempt_worker(struct xe_vm *vm) +{ + struct xe_device *xe = vm->xe; + bool ret = false; + + mutex_lock(&xe->rebind_resume_lock); + if (!try_wait_for_completion(&vm->xe->pm_block)) { + ret = true; + list_move_tail(&vm->preempt.pm_activate_link, &xe->rebind_resume_list); + } + pr_info("Suspending %p\n", vm); + mutex_unlock(&xe->rebind_resume_lock); + + return ret; +} + +/** + * xe_vm_resume_preempt_worker() - Resume the preempt worker. + * @vm: The vm whose preempt worker to resume. + * + * Resume a preempt worker that was previously suspended by + * vm_suspend_preempt_worker(). + */ +void xe_vm_resume_preempt_worker(struct list_head *link) +{ + struct xe_vm *vm = container_of(link, typeof(*vm), preempt.pm_activate_link); + + pr_info("Resuming %p\n", vm); + queue_work(vm->xe->ordered_wq, &vm->preempt.rebind_work); +} + static void preempt_rebind_work_func(struct work_struct *w) { struct xe_vm *vm = container_of(w, struct xe_vm, preempt.rebind_work); @@ -503,6 +537,11 @@ static void preempt_rebind_work_func(struct work_struct *w) } retry: + if (!try_wait_for_completion(&vm->xe->pm_block) && vm_suspend_preempt_worker(vm)) { + up_write(&vm->lock); + return; + } + if (xe_vm_userptr_check_repin(vm)) { err = xe_vm_userptr_pin(vm); if (err) @@ -1741,6 +1780,7 @@ struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags, struct xe_file *xef) if (flags & XE_VM_FLAG_LR_MODE) { INIT_WORK(&vm->preempt.rebind_work, preempt_rebind_work_func); xe_pm_runtime_get_noresume(xe); + INIT_LIST_HEAD(&vm->preempt.pm_activate_link); } if (flags & XE_VM_FLAG_FAULT_MODE) { @@ -1922,8 +1962,12 @@ void xe_vm_close_and_put(struct xe_vm *vm) xe_assert(xe, !vm->preempt.num_exec_queues); xe_vm_close(vm); - if (xe_vm_in_preempt_fence_mode(vm)) + if (xe_vm_in_preempt_fence_mode(vm)) { + mutex_lock(&xe->rebind_resume_lock); + list_del_init(&vm->preempt.pm_activate_link); + mutex_unlock(&xe->rebind_resume_lock); flush_work(&vm->preempt.rebind_work); + } if (xe_vm_in_fault_mode(vm)) xe_svm_close(vm); diff --git a/drivers/gpu/drm/xe/xe_vm.h b/drivers/gpu/drm/xe/xe_vm.h index b3e5bec0fa58..f2639794278b 100644 --- a/drivers/gpu/drm/xe/xe_vm.h +++ b/drivers/gpu/drm/xe/xe_vm.h @@ -281,6 +281,8 @@ struct dma_fence *xe_vm_bind_kernel_bo(struct xe_vm *vm, struct xe_bo *bo, struct xe_exec_queue *q, u64 addr, enum xe_cache_level cache_lvl); +void xe_vm_resume_preempt_worker(struct list_head *link); + /** * xe_vm_resv() - Return's the vm's reservation object * @vm: The vm diff --git a/drivers/gpu/drm/xe/xe_vm_types.h b/drivers/gpu/drm/xe/xe_vm_types.h index b5108d010786..e1a786db5f89 100644 --- a/drivers/gpu/drm/xe/xe_vm_types.h +++ b/drivers/gpu/drm/xe/xe_vm_types.h @@ -338,6 +338,11 @@ struct xe_vm { * BOs */ struct work_struct rebind_work; + /** + * @preempt.pm_activate_link: Link to list of rebind workers to be + * kicked on resume. + */ + struct list_head pm_activate_link; } preempt; /** @um: unified memory state */ -- 2.50.1

1 week, 4 days

2
2
0 0

Linux 6.16.5

by Greg Kroah-Hartman

I'm announcing the release of the 6.16.5 kernel. All users of the 6.16 kernel series must upgrade. The updated 6.16.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.16.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 Makefile | 2 arch/arm64/include/asm/mmu.h | 7 arch/arm64/kernel/cpufeature.c | 5 arch/arm64/mm/mmu.c | 7 arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 arch/mips/lantiq/xway/sysctrl.c | 10 arch/powerpc/kernel/kvm.c | 8 arch/riscv/kvm/vcpu_vector.c | 2 arch/x86/kernel/cpu/intel.c | 2 arch/x86/kernel/cpu/microcode/amd.c | 22 arch/x86/kernel/cpu/topology_amd.c | 23 arch/x86/kvm/lapic.c | 2 arch/x86/kvm/x86.c | 7 block/blk-rq-qos.h | 13 block/blk-zoned.c | 11 drivers/atm/atmtcp.c | 17 drivers/crypto/marvell/octeontx2/otx2_cpt_common.h | 5 drivers/crypto/marvell/octeontx2/otx2_cptpf_mbox.c | 13 drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 4 drivers/crypto/marvell/octeontx2/otx2_cptvf_mbox.c | 6 drivers/firmware/efi/stmm/tee_stmm_efi.c | 21 drivers/firmware/qcom/qcom_scm.c | 95 +- drivers/firmware/qcom/qcom_scm.h | 1 drivers/firmware/qcom/qcom_tzmem.c | 11 drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 1 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 14 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 8 drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 drivers/gpu/drm/display/drm_dp_helper.c | 2 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 drivers/gpu/drm/mediatek/mtk_plane.c | 3 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 drivers/gpu/drm/msm/msm_gem_submit.c | 14 drivers/gpu/drm/msm/msm_kms.c | 10 drivers/gpu/drm/msm/registers/display/dsi.xml | 28 drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 15 drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 5 drivers/gpu/drm/xe/xe_bo.c | 8 drivers/gpu/drm/xe/xe_sync.c | 2 drivers/gpu/drm/xe/xe_vm.c | 8 drivers/gpu/drm/xe/xe_vm.h | 15 drivers/hid/hid-asus.c | 8 drivers/hid/hid-elecom.c | 2 drivers/hid/hid-ids.h | 4 drivers/hid/hid-input-test.c | 10 drivers/hid/hid-input.c | 51 - drivers/hid/hid-logitech-dj.c | 4 drivers/hid/hid-logitech-hidpp.c | 2 drivers/hid/hid-multitouch.c | 8 drivers/hid/hid-ntrig.c | 3 drivers/hid/hid-quirks.c | 3 drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h | 2 drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c | 4 drivers/hid/wacom_wac.c | 1 drivers/isdn/hardware/mISDN/hfcpci.c | 12 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 36 drivers/net/ethernet/cadence/macb_main.c | 11 drivers/net/ethernet/dlink/dl2k.c | 2 drivers/net/ethernet/intel/ice/ice.h | 1 drivers/net/ethernet/intel/ice/ice_adapter.c | 49 - drivers/net/ethernet/intel/ice/ice_adapter.h | 4 drivers/net/ethernet/intel/ice/ice_ddp.c | 44 - drivers/net/ethernet/intel/ice/ice_idc.c | 10 drivers/net/ethernet/intel/ice/ice_main.c | 16 drivers/net/ethernet/intel/ice/ice_txrx.c | 2 drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 61 + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 403 +++++----- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 38 drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 2 drivers/net/ethernet/intel/ixgbe/ixgbe_type_e610.h | 2 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 6 drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 30 drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 66 + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 68 - drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 4 drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 4 drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 22 drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 54 - drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c | 16 drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h | 4 drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c | 13 drivers/net/ethernet/marvell/octeontx2/af/rvu_sdp.c | 10 drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c | 8 drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c | 2 drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.h | 2 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 12 drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 24 drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h | 30 drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 3 drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 10 drivers/net/ethernet/marvell/octeontx2/nic/rep.c | 20 drivers/net/ethernet/marvell/octeontx2/nic/rep.h | 1 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 15 drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 126 +-- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h | 1 drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c | 10 drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c | 2 drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c | 6 drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c | 1 drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 9 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 drivers/net/hyperv/netvsc.c | 17 drivers/net/hyperv/rndis_filter.c | 23 drivers/net/phy/mscc/mscc.h | 4 drivers/net/phy/mscc/mscc_main.c | 4 drivers/net/phy/mscc/mscc_ptp.c | 34 drivers/net/usb/qmi_wwan.c | 3 drivers/of/dynamic.c | 9 drivers/of/of_reserved_mem.c | 17 drivers/pinctrl/Kconfig | 1 drivers/pinctrl/mediatek/pinctrl-airoha.c | 8 drivers/platform/x86/intel/int3472/discrete.c | 6 drivers/scsi/scsi_sysfs.c | 4 drivers/thermal/mediatek/lvts_thermal.c | 74 + drivers/vhost/net.c | 9 fs/efivarfs/super.c | 4 fs/erofs/super.c | 24 fs/erofs/zdata.c | 13 fs/smb/client/cifsfs.c | 14 fs/smb/client/inode.c | 34 fs/smb/client/smb2inode.c | 7 fs/xfs/libxfs/xfs_attr_remote.c | 7 fs/xfs/libxfs/xfs_da_btree.c | 6 include/linux/atmdev.h | 1 include/linux/dma-map-ops.h | 3 include/linux/firmware/qcom/qcom_scm.h | 5 include/linux/platform_data/x86/int3472.h | 1 include/linux/soc/marvell/silicons.h | 25 include/linux/virtio_config.h | 2 include/net/bluetooth/hci_sync.h | 2 include/net/rose.h | 18 include/uapi/linux/vhost.h | 4 io_uring/io-wq.c | 8 io_uring/kbuf.c | 20 kernel/dma/contiguous.c | 2 kernel/dma/pool.c | 4 kernel/events/core.c | 6 kernel/trace/fgraph.c | 1 kernel/trace/trace.c | 4 kernel/trace/trace_functions_graph.c | 22 net/atm/common.c | 15 net/bluetooth/hci_conn.c | 58 + net/bluetooth/hci_event.c | 25 net/bluetooth/hci_sync.c | 6 net/bluetooth/mgmt.c | 9 net/core/page_pool.c | 6 net/ipv4/route.c | 10 net/l2tp/l2tp_ppp.c | 25 net/rose/af_rose.c | 13 net/rose/rose_in.c | 12 net/rose/rose_route.c | 62 - net/rose/rose_timer.c | 2 net/sctp/ipv6.c | 2 sound/soc/codecs/lpass-tx-macro.c | 2 sound/soc/codecs/rt1320-sdw.c | 3 sound/soc/codecs/rt721-sdca.c | 2 sound/soc/codecs/rt721-sdca.h | 4 tools/perf/util/symbol-minimal.c | 55 - tools/tracing/latency/Makefile.config | 8 tools/tracing/rtla/Makefile.config | 8 177 files changed, 1755 insertions(+), 977 deletions(-) Aaron Ma (2): HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Aleksander Jan Bajkowski (2): mips: dts: lantiq: danube: add missing burst length property mips: lantiq: xway: sysctrl: rename the etop node Alex Deucher (4): Revert "drm/amdgpu: fix incorrect vm flags to map bo" drm/amdgpu/userq: fix error handling of invalid doorbell drm/amdgpu/gfx11: set MQD as appriopriate for queue types drm/amdgpu/gfx12: set MQD as appriopriate for queue types Alexander Duyck (1): fbnic: Move phylink resume out of service_task and into open/close Alexei Lazar (3): net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Set local Xoff after FW update Alexey Klimov (1): ASoC: codecs: tx-macro: correct tx_macro_component_drv name Antheas Kapenekakis (1): HID: quirks: add support for Legion Go dual dinput modes Ayushi Makhija (1): drm/msm: update the high bitfield of certain DSI registers Bart Van Assche (1): blk-zoned: Fix a lockdep complaint about recursive locking Bartosz Golaszewski (4): firmware: qcom: scm: remove unused arguments from SHM bridge routines firmware: qcom: scm: take struct device as argument in SHM bridge enable firmware: qcom: scm: initialize tzmem before marking SCM as available firmware: qcom: scm: request the waitqueue irq *after* initializing SCM Borislav Petkov (AMD) (1): x86/microcode/AMD: Handle the case of no BIOS microcode Chenyuan Yang (1): drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset Damien Le Moal (1): scsi: core: sysfs: Correct sysfs attributes access rights Dan Carpenter (1): of: dynamic: Fix use after free in of_changeset_add_prop_helper() Dipayaan Roy (1): net: hv_netvsc: fix loss of early receive events from host during channel open. Dmitry Baryshkov (3): drm/msm/kms: move snapshot init earlier in KMS init drm/msm/dpu: correct dpu_plane_virtual_atomic_check() dt-bindings: display/msm: qcom,mdp5: drop lut clock Dongcheng Yan (1): platform/x86: int3472: add hpd pin support Emil Tantilov (1): ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Eric Dumazet (3): sctp: initialize more fields in sctp_v6_from_sk() l2tp: do not use sock_hold() in pppol2tp_session_get_sock() net: rose: fix a typo in rose_clear_routes() Eric Sandeen (1): xfs: do not propagate ENODATA disk errors into xattr code Even Xu (1): HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow Fabio Porcedda (1): net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Fengnan Chang (1): io_uring/io-wq: add check free worker before create new worker Greg Kroah-Hartman (1): Linux 6.16.5 Hariprasad Kelam (2): Octeontx2-vf: Fix max packet length errors Octeontx2-af: Fix NIX X2P calibration failures Horatiu Vultur (1): phy: mscc: Fix when PTP clock is register and unregister Ian Rogers (1): perf symbol-minimal: Fix ehdr reading in filename__read_build_id Igor Torrente (1): Revert "virtio: reject shm region if length is zero" Imre Deak (1): Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" Jacob Keller (2): ice: don't leave device non-functional if Tx scheduler config fails ice: use fixed adapter index for E825C embedded devices James Jones (1): drm/nouveau/disp: Always accept linear modifier Jan Kiszka (1): efi: stmm: Fix incorrect buffer allocation method Jason-JH Lin (1): drm/mediatek: Add error handling for old state CRTC in atomic_disable Jedrzej Jagielski (1): ixgbe: fix ixgbe_orom_civd_info struct layout Jens Axboe (1): io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Jesse.Zhang (1): drm/amdgpu: update firmware version checks for user queue support Joshua Hay (4): idpf: add support for Tx refillqs in flow scheduling mode idpf: simplify and fix splitq Tx packet rollback error path idpf: replace flow scheduling buffer ring with buffer pool idpf: stop Tx if there are insufficient buffer resources José Expósito (2): HID: input: rename hidinput_set_battery_charge_status() HID: input: report battery status changes immediately Junli Liu (1): erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC K Prateek Nayak (1): x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON Kees Cook (1): arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature Kuniyuki Iwashima (1): atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Lama Kayal (4): net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path Li Nan (1): efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Lizhi Hou (1): of: dynamic: Fix memleak when of_pci_add_properties() failed Lorenzo Bianconi (1): pinctrl: airoha: Fix return value in pinconf callbacks Louis-Alexis Eyraud (1): drm/mediatek: mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls Ludovico de Nittis (2): Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success Bluetooth: hci_event: Mark connection as closed during suspend disconnect Luiz Augusto von Dentz (2): Bluetooth: hci_conn: Make unacked packet handling more robust Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Ma Ke (1): drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv Madhavan Srinivasan (1): powerpc/kvm: Fix ifdef to remove build warning Martin Hilgendorf (1): HID: elecom: add support for ELECOM M-DT2DRBK Mason Chang (3): thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands Matt Coffin (1): HID: logitech: Add ids for G PRO 2 LIGHTSPEED Matthew Brost (1): drm/xe: Don't trigger rebind on initial dma-buf validation Michael Chan (2): bnxt_en: Adjust TX rings if reservation is less than requested bnxt_en: Fix stats context reservation logic Michal Kubiak (1): ice: fix incorrect counter for buffer allocation failures Mina Almasry (1): page_pool: fix incorrect mp_ops error handling Minjong Kim (1): HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Moshe Shemesh (4): net/mlx5: Reload auxiliary drivers on fw_activate net/mlx5: Fix lockdep assertion on sync reset unload event net/mlx5: Nack sync reset when SFs are present net/mlx5: Prevent flow steering mode changes in switchdev mode Namhyung Kim (1): vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER Nathan Chancellor (1): drm/msm/dpu: Initialize crtc_state to NULL in dpu_plane_virtual_atomic_check() Neil Mandir (1): net: macb: Disable clocks once Nikolay Kuratov (1): vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Nilay Shroff (1): block: validate QoS before calling __rq_qos_done_bio() Oreoluwa Babatunde (1): of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() Oscar Maes (1): net: ipv4: fix regression in local-broadcast routes Paulo Alcantara (2): smb: client: fix race with concurrent opens in unlink(2) smb: client: fix race with concurrent opens in rename(2) Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Ping Cheng (1): HID: wacom: Add a new Art Pen 2 Qasim Ijaz (2): HID: asus: fix UAF via HID_CLAIMED_INPUT validation HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() Qingyue Zhang (1): io_uring/kbuf: fix signedness in this_len calculation Radim Krčmář (1): RISC-V: KVM: fix stack overrun when loading vlenb Randy Dunlap (1): pinctrl: STMFX: add missing HAS_IOMEM dependency Rob Clark (1): drm/msm: Defer fd_install in SUBMIT ioctl Rob Herring (Arm) (1): of: reserved_mem: Add missing IORESOURCE_MEM flag on resources Rohan G Thomas (3): net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net: stmmac: xgmac: Correct supported speed modes net: stmmac: Set CIC bit only for TX queues with COE Sean Anderson (1): net: macb: Fix offset error in gem_update_stats Shanker Donthineni (1): dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted Shuhao Fu (1): fs/smb: Fix inconsistent refcnt update Shuming Fan (2): ASoC: rt721: fix FU33 Boost Volume control not working ASoC: rt1320: fix random cycle mute issue Sreekanth Reddy (1): bnxt_en: Fix memory corruption when FW resources change during ifdown Steve French (1): smb3 client: fix return code mapping of remap_file_range Steven Rostedt (1): fgraph: Copy args in intermediate storage with entry Subbaraya Sundeep (1): octeontx2: Set appropriate PF, VF masks and shifts based on silicon Suchit Karunakaran (1): x86/cpu/intel: Fix the constant_tsc model check for Pentium 4 Takamitsu Iwai (3): net: rose: split remove and free operations in rose_remove_neigh() net: rose: convert 'use' field to refcount_t net: rose: include node references in rose_neigh refcount Tao Chen (2): tools/latency-collector: Check pkg-config install rtla: Check pkg-config install Tengda Wu (1): ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Thijs Raymakers (1): KVM: x86: use array_index_nospec with indices that come from guest Thomas Hellström (2): drm/xe/vm: Don't pin the vm_resv during validation drm/xe/vm: Clear the scratch_pt pointer on error Timur Tabi (3): drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr drm/nouveau: remove unused memory target test drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 Vladimir Riabchun (1): mISDN: hfcpci: Fix warning when deleting uninitialized timer Yang Li (1): Bluetooth: hci_event: Disconnect device when BIG sync is lost Yang Wang (1): drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode Ye Weihua (1): trace/fgraph: Fix the warning caused by missing unregister notifier Yeounsu Moon (1): net: dlink: fix multicast stats being counted incorrectly Yuezhang Mo (1): erofs: Fallback to normal access if DAX is not supported on extra device Yunseong Kim (1): perf: Avoid undefined behavior from stopping/starting inactive events Zbigniew Kempczyński (1): drm/xe/xe_sync: avoid race during ufence signaling luoguangfei (1): net: macb: fix unregister_netdev call order in macb_remove()

1 week, 4 days

1
1
0 0

Linux 6.12.45

by Greg Kroah-Hartman

I'm announcing the release of the 6.12.45 kernel. All users of the 6.12 kernel series must upgrade. The updated 6.12.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 Makefile | 2 arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 arch/mips/lantiq/xway/sysctrl.c | 10 arch/powerpc/kernel/kvm.c | 8 arch/riscv/kvm/vcpu_vector.c | 2 arch/x86/kernel/cpu/microcode/amd.c | 22 +- arch/x86/kernel/cpu/topology_amd.c | 23 +- arch/x86/kvm/lapic.c | 2 arch/x86/kvm/x86.c | 7 block/blk-zoned.c | 11 - drivers/acpi/ec.c | 6 drivers/atm/atmtcp.c | 17 + drivers/firmware/efi/stmm/tee_stmm_efi.c | 21 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 - drivers/gpu/drm/display/drm_dp_helper.c | 2 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 +- drivers/gpu/drm/mediatek/mtk_plane.c | 3 drivers/gpu/drm/msm/msm_gem_submit.c | 14 - drivers/gpu/drm/msm/msm_kms.c | 10 drivers/gpu/drm/msm/registers/display/dsi.xml | 28 +- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 15 - drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 5 drivers/gpu/drm/xe/xe_bo.c | 3 drivers/gpu/drm/xe/xe_sync.c | 2 drivers/gpu/drm/xe/xe_vm.c | 8 drivers/hid/hid-asus.c | 8 drivers/hid/hid-ids.h | 3 drivers/hid/hid-input-test.c | 10 drivers/hid/hid-input.c | 51 ++-- drivers/hid/hid-logitech-dj.c | 4 drivers/hid/hid-logitech-hidpp.c | 2 drivers/hid/hid-multitouch.c | 8 drivers/hid/hid-ntrig.c | 3 drivers/hid/hid-quirks.c | 2 drivers/hid/wacom_wac.c | 1 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 36 ++- drivers/net/ethernet/cadence/macb_main.c | 9 drivers/net/ethernet/dlink/dl2k.c | 2 drivers/net/ethernet/intel/ice/ice_adapter.c | 49 +++- drivers/net/ethernet/intel/ice/ice_adapter.h | 4 drivers/net/ethernet/intel/ice/ice_ddp.c | 44 +++- drivers/net/ethernet/intel/ice/ice_main.c | 16 + drivers/net/ethernet/intel/ice/ice_txrx.c | 2 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 + drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 114 ++++++----- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h | 1 drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c | 10 drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 9 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 drivers/net/hyperv/netvsc.c | 18 + drivers/net/hyperv/rndis_filter.c | 20 + drivers/net/phy/mscc/mscc.h | 4 drivers/net/phy/mscc/mscc_main.c | 4 drivers/net/phy/mscc/mscc_ptp.c | 34 ++- drivers/net/usb/qmi_wwan.c | 3 drivers/of/dynamic.c | 9 drivers/of/of_reserved_mem.c | 16 + drivers/pci/controller/dwc/pcie-designware.c | 8 drivers/pci/controller/plda/pcie-starfive.c | 2 drivers/pci/pci.h | 2 drivers/pinctrl/Kconfig | 1 drivers/scsi/scsi_sysfs.c | 4 drivers/thermal/mediatek/lvts_thermal.c | 74 +++++-- drivers/vhost/net.c | 9 fs/efivarfs/super.c | 4 fs/erofs/zdata.c | 13 + fs/smb/client/cifsfs.c | 14 + fs/smb/client/inode.c | 34 +++ fs/smb/client/smb2inode.c | 7 fs/xfs/libxfs/xfs_attr_remote.c | 7 fs/xfs/libxfs/xfs_da_btree.c | 6 include/linux/atmdev.h | 1 include/linux/dma-map-ops.h | 3 include/net/bluetooth/hci_sync.h | 2 include/net/rose.h | 18 + include/uapi/linux/vhost.h | 4 kernel/dma/contiguous.c | 2 kernel/dma/pool.c | 4 kernel/trace/fgraph.c | 1 kernel/trace/trace.c | 4 net/atm/common.c | 15 + net/bluetooth/hci_event.c | 20 + net/bluetooth/hci_sync.c | 6 net/bluetooth/mgmt.c | 5 net/ipv4/route.c | 10 net/l2tp/l2tp_ppp.c | 25 -- net/rose/af_rose.c | 13 - net/rose/rose_in.c | 12 - net/rose/rose_route.c | 62 +++-- net/rose/rose_timer.c | 2 net/sctp/ipv6.c | 2 sound/soc/codecs/lpass-tx-macro.c | 2 tools/perf/util/symbol-minimal.c | 55 ++--- tools/tracing/latency/Makefile.config | 8 tools/tracing/rtla/Makefile.config | 8 105 files changed, 907 insertions(+), 399 deletions(-) Aleksander Jan Bajkowski (2): mips: dts: lantiq: danube: add missing burst length property mips: lantiq: xway: sysctrl: rename the etop node Alex Deucher (1): Revert "drm/amdgpu: fix incorrect vm flags to map bo" Alexander Duyck (1): fbnic: Move phylink resume out of service_task and into open/close Alexei Lazar (3): net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Set local Xoff after FW update Alexey Klimov (1): ASoC: codecs: tx-macro: correct tx_macro_component_drv name Antheas Kapenekakis (1): HID: quirks: add support for Legion Go dual dinput modes Ayushi Makhija (1): drm/msm: update the high bitfield of certain DSI registers Bart Van Assche (1): blk-zoned: Fix a lockdep complaint about recursive locking Borislav Petkov (AMD) (1): x86/microcode/AMD: Handle the case of no BIOS microcode Damien Le Moal (1): scsi: core: sysfs: Correct sysfs attributes access rights Dan Carpenter (1): of: dynamic: Fix use after free in of_changeset_add_prop_helper() Dipayaan Roy (1): net: hv_netvsc: fix loss of early receive events from host during channel open. Dmitry Baryshkov (2): drm/msm/kms: move snapshot init earlier in KMS init dt-bindings: display/msm: qcom,mdp5: drop lut clock Eric Dumazet (3): sctp: initialize more fields in sctp_v6_from_sk() l2tp: do not use sock_hold() in pppol2tp_session_get_sock() net: rose: fix a typo in rose_clear_routes() Eric Sandeen (1): xfs: do not propagate ENODATA disk errors into xattr code Fabio Porcedda (1): net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Greg Kroah-Hartman (1): Linux 6.12.45 Horatiu Vultur (1): phy: mscc: Fix when PTP clock is register and unregister Ian Rogers (1): perf symbol-minimal: Fix ehdr reading in filename__read_build_id Imre Deak (1): Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" Jacob Keller (2): ice: don't leave device non-functional if Tx scheduler config fails ice: use fixed adapter index for E825C embedded devices James Jones (1): drm/nouveau/disp: Always accept linear modifier Jan Kiszka (1): efi: stmm: Fix incorrect buffer allocation method Jason-JH Lin (1): drm/mediatek: Add error handling for old state CRTC in atomic_disable Joe Damato (1): hv_netvsc: Link queues to NAPIs José Expósito (2): HID: input: rename hidinput_set_battery_charge_status() HID: input: report battery status changes immediately Junli Liu (1): erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC K Prateek Nayak (1): x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON Kuniyuki Iwashima (1): atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Li Nan (1): efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Lizhi Hou (1): of: dynamic: Fix memleak when of_pci_add_properties() failed Ludovico de Nittis (2): Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success Bluetooth: hci_event: Mark connection as closed during suspend disconnect Luiz Augusto von Dentz (1): Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Ma Ke (1): drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv Madhavan Srinivasan (1): powerpc/kvm: Fix ifdef to remove build warning Mason Chang (3): thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands Matt Coffin (1): HID: logitech: Add ids for G PRO 2 LIGHTSPEED Matthew Brost (1): drm/xe: Don't trigger rebind on initial dma-buf validation Michael Chan (2): bnxt_en: Adjust TX rings if reservation is less than requested bnxt_en: Fix stats context reservation logic Michal Kubiak (1): ice: fix incorrect counter for buffer allocation failures Minjong Kim (1): HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Moshe Shemesh (3): net/mlx5: Reload auxiliary drivers on fw_activate net/mlx5: Fix lockdep assertion on sync reset unload event net/mlx5: Nack sync reset when SFs are present Namhyung Kim (1): vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER Neil Mandir (1): net: macb: Disable clocks once Niklas Cassel (2): PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up Nikolay Kuratov (1): vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Oreoluwa Babatunde (1): of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() Oscar Maes (1): net: ipv4: fix regression in local-broadcast routes Paulo Alcantara (2): smb: client: fix race with concurrent opens in unlink(2) smb: client: fix race with concurrent opens in rename(2) Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Ping Cheng (1): HID: wacom: Add a new Art Pen 2 Qasim Ijaz (2): HID: asus: fix UAF via HID_CLAIMED_INPUT validation HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() Radim Krčmář (1): RISC-V: KVM: fix stack overrun when loading vlenb Randy Dunlap (1): pinctrl: STMFX: add missing HAS_IOMEM dependency Rob Clark (1): drm/msm: Defer fd_install in SUBMIT ioctl Rohan G Thomas (3): net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net: stmmac: xgmac: Correct supported speed modes net: stmmac: Set CIC bit only for TX queues with COE Shanker Donthineni (1): dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted Shuhao Fu (1): fs/smb: Fix inconsistent refcnt update Sreekanth Reddy (1): bnxt_en: Fix memory corruption when FW resources change during ifdown Steve French (1): smb3 client: fix return code mapping of remap_file_range Takamitsu Iwai (3): net: rose: split remove and free operations in rose_remove_neigh() net: rose: convert 'use' field to refcount_t net: rose: include node references in rose_neigh refcount Tao Chen (2): tools/latency-collector: Check pkg-config install rtla: Check pkg-config install Tengda Wu (1): ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Thijs Raymakers (1): KVM: x86: use array_index_nospec with indices that come from guest Thomas Hellström (1): drm/xe/vm: Clear the scratch_pt pointer on error Timur Tabi (3): drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr drm/nouveau: remove unused memory target test drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 Werner Sembach (1): ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list Yang Wang (1): drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode Ye Weihua (1): trace/fgraph: Fix the warning caused by missing unregister notifier Yeounsu Moon (1): net: dlink: fix multicast stats being counted incorrectly Zbigniew Kempczyński (1): drm/xe/xe_sync: avoid race during ufence signaling luoguangfei (1): net: macb: fix unregister_netdev call order in macb_remove()

1 week, 4 days

1
1
0 0

Linux 6.6.104

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.104 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 Makefile | 2 arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 arch/mips/lantiq/xway/sysctrl.c | 10 arch/powerpc/kernel/kvm.c | 8 arch/x86/kernel/cpu/microcode/amd.c | 22 + arch/x86/kvm/lapic.c | 2 arch/x86/kvm/x86.c | 7 drivers/acpi/ec.c | 6 drivers/atm/atmtcp.c | 17 drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 drivers/gpu/drm/display/drm_dp_helper.c | 2 drivers/gpu/drm/msm/msm_gem_submit.c | 14 drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 15 drivers/hid/hid-asus.c | 8 drivers/hid/hid-ids.h | 3 drivers/hid/hid-input-test.c | 10 drivers/hid/hid-input.c | 51 +- drivers/hid/hid-logitech-dj.c | 4 drivers/hid/hid-logitech-hidpp.c | 2 drivers/hid/hid-mcp2221.c | 71 ++-- drivers/hid/hid-multitouch.c | 8 drivers/hid/hid-ntrig.c | 3 drivers/hid/hid-quirks.c | 2 drivers/hid/wacom_wac.c | 1 drivers/net/ethernet/dlink/dl2k.c | 2 drivers/net/ethernet/intel/ice/ice_txrx.c | 94 +++-- drivers/net/ethernet/intel/ice/ice_txrx.h | 19 - drivers/net/ethernet/intel/ice/ice_txrx_lib.h | 53 --- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 + drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 190 +++++++---- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h | 1 drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c | 87 ++--- drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 9 drivers/net/ethernet/stmicro/stmmac/hwif.h | 8 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 drivers/net/phy/mscc/mscc.h | 4 drivers/net/phy/mscc/mscc_main.c | 4 drivers/net/phy/mscc/mscc_ptp.c | 34 + drivers/net/usb/qmi_wwan.c | 3 drivers/of/dynamic.c | 29 - drivers/of/of_private.h | 1 drivers/of/overlay.c | 11 drivers/of/unittest.c | 12 drivers/pinctrl/Kconfig | 1 drivers/scsi/scsi_sysfs.c | 4 drivers/vhost/net.c | 9 fs/efivarfs/super.c | 4 fs/erofs/zdata.c | 13 fs/nfs/pagelist.c | 86 ---- fs/nfs/write.c | 146 +++++--- fs/smb/client/cifsfs.c | 14 fs/smb/client/inode.c | 34 + fs/smb/client/smb2inode.c | 7 fs/xfs/libxfs/xfs_attr_remote.c | 7 fs/xfs/libxfs/xfs_da_btree.c | 6 include/linux/atmdev.h | 1 include/linux/mlx5/mlx5_ifc.h | 11 include/linux/nfs_page.h | 2 include/net/bluetooth/hci_sync.h | 2 include/net/rose.h | 18 - kernel/dma/pool.c | 4 kernel/trace/trace.c | 4 net/atm/common.c | 15 net/bluetooth/hci_event.c | 20 + net/bluetooth/hci_sync.c | 6 net/bluetooth/mgmt.c | 5 net/ipv4/route.c | 10 net/rose/af_rose.c | 13 net/rose/rose_in.c | 12 net/rose/rose_route.c | 62 ++- net/rose/rose_timer.c | 2 net/sctp/ipv6.c | 2 sound/soc/codecs/lpass-tx-macro.c | 2 82 files changed, 890 insertions(+), 553 deletions(-) Aleksander Jan Bajkowski (2): mips: dts: lantiq: danube: add missing burst length property mips: lantiq: xway: sysctrl: rename the etop node Alex Deucher (1): Revert "drm/amdgpu: fix incorrect vm flags to map bo" Alexei Lazar (3): net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Set local Xoff after FW update Alexey Klimov (1): ASoC: codecs: tx-macro: correct tx_macro_component_drv name Antheas Kapenekakis (1): HID: quirks: add support for Legion Go dual dinput modes Borislav Petkov (AMD) (1): x86/microcode/AMD: Handle the case of no BIOS microcode Chris Mi (1): net/mlx5: SF, Fix add port error handling Christoph Hellwig (1): nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests Damien Le Moal (1): scsi: core: sysfs: Correct sysfs attributes access rights Dan Carpenter (1): of: dynamic: Fix use after free in of_changeset_add_prop_helper() Dmitry Baryshkov (1): dt-bindings: display/msm: qcom,mdp5: drop lut clock Eric Dumazet (2): sctp: initialize more fields in sctp_v6_from_sk() net: rose: fix a typo in rose_clear_routes() Eric Sandeen (1): xfs: do not propagate ENODATA disk errors into xattr code Fabio Porcedda (1): net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Greg Kroah-Hartman (1): Linux 6.6.104 Hamish Martin (2): HID: mcp2221: Don't set bus speed on every transfer HID: mcp2221: Handle reads greater than 60 bytes Horatiu Vultur (1): phy: mscc: Fix when PTP clock is register and unregister Imre Deak (1): Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" James Jones (1): drm/nouveau/disp: Always accept linear modifier Jiri Pirko (3): net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc() net/mlx5: Use devlink port pointer to get the pointer of container SF struct net/mlx5: Convert SF port_indices xarray to function_ids xarray José Expósito (2): HID: input: rename hidinput_set_battery_charge_status() HID: input: report battery status changes immediately Junli Liu (1): erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC Kuniyuki Iwashima (1): atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Larysa Zaremba (1): ice: Introduce ice_xdp_buff Li Nan (1): efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Lizhi Hou (1): of: dynamic: Fix memleak when of_pci_add_properties() failed Ludovico de Nittis (2): Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success Bluetooth: hci_event: Mark connection as closed during suspend disconnect Luiz Augusto von Dentz (1): Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Maciej Fijalkowski (2): ice: gather page_count()'s of each frag right before XDP prog call ice: stop storing XDP verdict within ice_rx_buf Madhavan Srinivasan (1): powerpc/kvm: Fix ifdef to remove build warning Matt Coffin (1): HID: logitech: Add ids for G PRO 2 LIGHTSPEED Michal Kubiak (1): ice: fix incorrect counter for buffer allocation failures Minjong Kim (1): HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Moshe Shemesh (5): net/mlx5: Reload auxiliary drivers on fw_activate net/mlx5: Add device cap for supporting hot reset in sync reset flow net/mlx5: Add support for sync reset using hot reset net/mlx5: Fix lockdep assertion on sync reset unload event net/mlx5: Nack sync reset when SFs are present Nikolay Kuratov (1): vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Oscar Maes (1): net: ipv4: fix regression in local-broadcast routes Paulo Alcantara (2): smb: client: fix race with concurrent opens in unlink(2) smb: client: fix race with concurrent opens in rename(2) Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Ping Cheng (1): HID: wacom: Add a new Art Pen 2 Qasim Ijaz (2): HID: asus: fix UAF via HID_CLAIMED_INPUT validation HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() Randy Dunlap (1): pinctrl: STMFX: add missing HAS_IOMEM dependency Rob Clark (1): drm/msm: Defer fd_install in SUBMIT ioctl Rob Herring (1): of: Add a helper to free property struct Rohan G Thomas (3): net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net: stmmac: xgmac: Correct supported speed modes net: stmmac: Set CIC bit only for TX queues with COE Serge Semin (1): net: stmmac: Rename phylink_get_caps() callback to update_caps() Shanker Donthineni (1): dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted Shuhao Fu (1): fs/smb: Fix inconsistent refcnt update Steve French (1): smb3 client: fix return code mapping of remap_file_range Takamitsu Iwai (3): net: rose: split remove and free operations in rose_remove_neigh() net: rose: convert 'use' field to refcount_t net: rose: include node references in rose_neigh refcount Tengda Wu (1): ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Thijs Raymakers (1): KVM: x86: use array_index_nospec with indices that come from guest Timur Tabi (2): drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr drm/nouveau: remove unused memory target test Trond Myklebust (1): NFS: Fix a race when updating an existing write Werner Sembach (1): ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list Yeounsu Moon (1): net: dlink: fix multicast stats being counted incorrectly

1 week, 4 days

1
1
0 0

Linux 6.1.150

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.150 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 arch/mips/lantiq/xway/sysctrl.c | 10 - arch/powerpc/kernel/kvm.c | 8 arch/x86/kvm/lapic.c | 2 arch/x86/kvm/x86.c | 7 drivers/acpi/ec.c | 6 drivers/atm/atmtcp.c | 17 + drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 drivers/gpu/drm/display/drm_dp_helper.c | 2 drivers/gpu/drm/msm/msm_gem_submit.c | 14 - drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 drivers/hid/hid-asus.c | 8 drivers/hid/hid-input-test.c | 10 - drivers/hid/hid-input.c | 51 ++--- drivers/hid/hid-mcp2221.c | 71 +++++-- drivers/hid/hid-multitouch.c | 8 drivers/hid/hid-ntrig.c | 3 drivers/hid/wacom_wac.c | 1 drivers/net/ethernet/dlink/dl2k.c | 2 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 drivers/net/phy/mscc/mscc.h | 4 drivers/net/phy/mscc/mscc_main.c | 4 drivers/net/phy/mscc/mscc_ptp.c | 34 ++- drivers/net/usb/qmi_wwan.c | 3 drivers/pinctrl/Kconfig | 1 drivers/scsi/scsi_sysfs.c | 4 drivers/vhost/net.c | 9 fs/efivarfs/super.c | 4 fs/nfs/pagelist.c | 86 --------- fs/nfs/write.c | 140 +++++++++------ fs/smb/client/cifsfs.c | 14 + fs/smb/client/inode.c | 34 +++ fs/smb/client/smb2inode.c | 7 fs/xfs/libxfs/xfs_attr_remote.c | 7 fs/xfs/libxfs/xfs_da_btree.c | 6 include/linux/atmdev.h | 1 include/linux/nfs_page.h | 2 include/net/bluetooth/hci_sync.h | 2 include/net/rose.h | 18 + kernel/dma/pool.c | 4 kernel/trace/trace.c | 4 net/atm/common.c | 15 + net/bluetooth/hci_event.c | 20 +- net/bluetooth/hci_sync.c | 6 net/bluetooth/mgmt.c | 5 net/ipv4/route.c | 10 - net/rose/af_rose.c | 13 - net/rose/rose_in.c | 12 - net/rose/rose_route.c | 62 ++++-- net/rose/rose_timer.c | 2 net/sctp/ipv6.c | 2 sound/soc/codecs/lpass-tx-macro.c | 2 57 files changed, 512 insertions(+), 300 deletions(-) Aleksander Jan Bajkowski (2): mips: dts: lantiq: danube: add missing burst length property mips: lantiq: xway: sysctrl: rename the etop node Alex Deucher (1): Revert "drm/amdgpu: fix incorrect vm flags to map bo" Alexei Lazar (3): net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Set local Xoff after FW update Alexey Klimov (1): ASoC: codecs: tx-macro: correct tx_macro_component_drv name Christoph Hellwig (1): nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests Damien Le Moal (1): scsi: core: sysfs: Correct sysfs attributes access rights Eric Dumazet (2): sctp: initialize more fields in sctp_v6_from_sk() net: rose: fix a typo in rose_clear_routes() Eric Sandeen (1): xfs: do not propagate ENODATA disk errors into xattr code Fabio Porcedda (1): net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Greg Kroah-Hartman (1): Linux 6.1.150 Hamish Martin (2): HID: mcp2221: Don't set bus speed on every transfer HID: mcp2221: Handle reads greater than 60 bytes Horatiu Vultur (1): phy: mscc: Fix when PTP clock is register and unregister Imre Deak (1): Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" James Jones (1): drm/nouveau/disp: Always accept linear modifier José Expósito (2): HID: input: rename hidinput_set_battery_charge_status() HID: input: report battery status changes immediately Kuniyuki Iwashima (1): atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Li Nan (1): efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Ludovico de Nittis (2): Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success Bluetooth: hci_event: Mark connection as closed during suspend disconnect Luiz Augusto von Dentz (1): Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Madhavan Srinivasan (1): powerpc/kvm: Fix ifdef to remove build warning Minjong Kim (1): HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Moshe Shemesh (1): net/mlx5: Reload auxiliary drivers on fw_activate Nikolay Kuratov (1): vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Oscar Maes (1): net: ipv4: fix regression in local-broadcast routes Paulo Alcantara (2): smb: client: fix race with concurrent opens in unlink(2) smb: client: fix race with concurrent opens in rename(2) Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Ping Cheng (1): HID: wacom: Add a new Art Pen 2 Qasim Ijaz (2): HID: asus: fix UAF via HID_CLAIMED_INPUT validation HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() Randy Dunlap (1): pinctrl: STMFX: add missing HAS_IOMEM dependency Rob Clark (1): drm/msm: Defer fd_install in SUBMIT ioctl Rohan G Thomas (1): net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts Shanker Donthineni (1): dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted Shuhao Fu (1): fs/smb: Fix inconsistent refcnt update Steve French (1): smb3 client: fix return code mapping of remap_file_range Takamitsu Iwai (3): net: rose: split remove and free operations in rose_remove_neigh() net: rose: convert 'use' field to refcount_t net: rose: include node references in rose_neigh refcount Tengda Wu (1): ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Thijs Raymakers (1): KVM: x86: use array_index_nospec with indices that come from guest Trond Myklebust (1): NFS: Fix a race when updating an existing write Werner Sembach (1): ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list Yeounsu Moon (1): net: dlink: fix multicast stats being counted incorrectly

1 week, 4 days

1
1
0 0

Linux 5.15.191

by Greg Kroah-Hartman

I'm announcing the release of the 5.15.191 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/powerpc/kernel/kvm.c | 8 arch/x86/kvm/lapic.c | 2 arch/x86/kvm/x86.c | 7 drivers/atm/atmtcp.c | 17 + drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 drivers/gpu/drm/drm_dp_helper.c | 2 drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 drivers/hid/hid-asus.c | 8 drivers/hid/hid-mcp2221.c | 71 +++++-- drivers/hid/hid-multitouch.c | 8 drivers/hid/hid-ntrig.c | 3 drivers/hid/wacom_wac.c | 1 drivers/net/ethernet/dlink/dl2k.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 drivers/net/phy/mscc/mscc.h | 4 drivers/net/phy/mscc/mscc_main.c | 4 drivers/net/phy/mscc/mscc_ptp.c | 34 ++- drivers/net/usb/qmi_wwan.c | 3 drivers/pinctrl/Kconfig | 1 drivers/scsi/scsi_sysfs.c | 4 drivers/vhost/net.c | 9 fs/efivarfs/super.c | 4 fs/nfs/pagelist.c | 86 --------- fs/nfs/write.c | 140 +++++++++------ fs/udf/directory.c | 2 fs/xfs/libxfs/xfs_attr_remote.c | 7 fs/xfs/libxfs/xfs_da_btree.c | 6 include/linux/atmdev.h | 1 include/linux/nfs_page.h | 2 kernel/dma/pool.c | 4 kernel/trace/trace.c | 4 net/atm/common.c | 15 + net/bluetooth/hci_event.c | 12 + net/ipv4/route.c | 10 - net/sctp/ipv6.c | 2 sound/soc/codecs/lpass-tx-macro.c | 2 40 files changed, 326 insertions(+), 207 deletions(-) Alex Deucher (1): Revert "drm/amdgpu: fix incorrect vm flags to map bo" Alexei Lazar (3): net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Set local Xoff after FW update Alexey Klimov (1): ASoC: codecs: tx-macro: correct tx_macro_component_drv name Christoph Hellwig (1): nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests Damien Le Moal (1): scsi: core: sysfs: Correct sysfs attributes access rights Eric Dumazet (1): sctp: initialize more fields in sctp_v6_from_sk() Eric Sandeen (1): xfs: do not propagate ENODATA disk errors into xattr code Fabio Porcedda (1): net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Greg Kroah-Hartman (1): Linux 5.15.191 Hamish Martin (2): HID: mcp2221: Don't set bus speed on every transfer HID: mcp2221: Handle reads greater than 60 bytes Horatiu Vultur (1): phy: mscc: Fix when PTP clock is register and unregister Imre Deak (1): Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" James Jones (1): drm/nouveau/disp: Always accept linear modifier Jan Kara (1): udf: Fix directory iteration for longer tail extents Kuniyuki Iwashima (1): atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Li Nan (1): efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Luiz Augusto von Dentz (1): Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Madhavan Srinivasan (1): powerpc/kvm: Fix ifdef to remove build warning Minjong Kim (1): HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Nikolay Kuratov (1): vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Oscar Maes (1): net: ipv4: fix regression in local-broadcast routes Ping Cheng (1): HID: wacom: Add a new Art Pen 2 Qasim Ijaz (2): HID: asus: fix UAF via HID_CLAIMED_INPUT validation HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() Randy Dunlap (1): pinctrl: STMFX: add missing HAS_IOMEM dependency Rohan G Thomas (1): net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts Shanker Donthineni (1): dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted Tengda Wu (1): ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Thijs Raymakers (1): KVM: x86: use array_index_nospec with indices that come from guest Trond Myklebust (1): NFS: Fix a race when updating an existing write Yeounsu Moon (1): net: dlink: fix multicast stats being counted incorrectly

1 week, 4 days

1
1
0 0

Linux 5.10.242

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.242 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/powerpc/kernel/kvm.c | 8 arch/x86/kernel/cpu/hygon.c | 3 arch/x86/kvm/lapic.c | 2 arch/x86/kvm/x86.c | 7 drivers/atm/atmtcp.c | 17 + drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 drivers/gpu/drm/drm_dp_helper.c | 2 drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 drivers/hid/hid-asus.c | 8 drivers/hid/hid-mcp2221.c | 71 +++++-- drivers/hid/hid-ntrig.c | 3 drivers/hid/wacom_wac.c | 1 drivers/net/ethernet/dlink/dl2k.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 drivers/net/usb/qmi_wwan.c | 3 drivers/pinctrl/Kconfig | 1 drivers/scsi/scsi_sysfs.c | 4 drivers/vhost/net.c | 9 fs/efivarfs/super.c | 4 fs/nfs/pagelist.c | 86 --------- fs/nfs/write.c | 140 +++++++++------ fs/xfs/libxfs/xfs_attr_remote.c | 7 fs/xfs/libxfs/xfs_da_btree.c | 6 include/linux/atmdev.h | 1 include/linux/nfs_page.h | 2 kernel/dma/pool.c | 4 kernel/trace/trace.c | 4 net/atm/common.c | 15 + net/bluetooth/hci_event.c | 12 + net/ipv4/route.c | 10 - net/sctp/ipv6.c | 2 sound/soc/intel/boards/bxt_da7219_max98357a.c | 12 - sound/soc/intel/boards/glk_rt5682_max98357a.c | 4 sound/soc/intel/boards/sof_da7219_max98373.c | 10 - sound/soc/intel/boards/sof_rt5682.c | 12 - sound/soc/intel/common/soc-acpi-intel-bxt-match.c | 2 sound/soc/intel/common/soc-acpi-intel-cml-match.c | 2 sound/soc/intel/common/soc-acpi-intel-glk-match.c | 4 sound/soc/intel/common/soc-acpi-intel-jsl-match.c | 6 sound/soc/intel/common/soc-acpi-intel-tgl-match.c | 4 44 files changed, 321 insertions(+), 217 deletions(-) Alex Deucher (1): Revert "drm/amdgpu: fix incorrect vm flags to map bo" Alexei Lazar (3): net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Set local Xoff after FW update Brent Lu (1): ASoC: Intel: sof_da7219_mx98360a: fail to initialize soundcard Christoph Hellwig (1): nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests Damien Le Moal (1): scsi: core: sysfs: Correct sysfs attributes access rights Eric Dumazet (1): sctp: initialize more fields in sctp_v6_from_sk() Eric Sandeen (1): xfs: do not propagate ENODATA disk errors into xattr code Fabio Porcedda (1): net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Greg Kroah-Hartman (1): Linux 5.10.242 Hamish Martin (2): HID: mcp2221: Don't set bus speed on every transfer HID: mcp2221: Handle reads greater than 60 bytes Imre Deak (1): Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" James Jones (1): drm/nouveau/disp: Always accept linear modifier Kuniyuki Iwashima (1): atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Li Nan (1): efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Luiz Augusto von Dentz (1): Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Madhavan Srinivasan (1): powerpc/kvm: Fix ifdef to remove build warning Minjong Kim (1): HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Nikolay Kuratov (1): vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Oscar Maes (1): net: ipv4: fix regression in local-broadcast routes Pierre-Louis Bossart (4): ASoC: Intel: bxt_da7219_max98357a: shrink platform_id below 20 characters ASoC: Intel: sof_rt5682: shrink platform_id names below 20 characters ASoC: Intel: glk_rt5682_max98357a: shrink platform_id below 20 characters ASoC: Intel: sof_da7219_max98373: shrink platform_id below 20 characters Ping Cheng (1): HID: wacom: Add a new Art Pen 2 Qasim Ijaz (1): HID: asus: fix UAF via HID_CLAIMED_INPUT validation Randy Dunlap (1): pinctrl: STMFX: add missing HAS_IOMEM dependency Rohan G Thomas (1): net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts Shanker Donthineni (1): dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted Tengda Wu (1): ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Thijs Raymakers (1): KVM: x86: use array_index_nospec with indices that come from guest Tianxiang Peng (1): x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Trond Myklebust (1): NFS: Fix a race when updating an existing write Yeounsu Moon (1): net: dlink: fix multicast stats being counted incorrectly

1 week, 4 days

1
1
0 0

Linux 5.4.298

by Greg Kroah-Hartman

I'm announcing the release of the 5.4.298 kernel. All users of the 5.4 kernel series must upgrade. The updated 5.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/powerpc/kernel/kvm.c | 8 +-- arch/x86/kvm/lapic.c | 3 + arch/x86/kvm/x86.c | 7 +- drivers/atm/atmtcp.c | 17 +++++- drivers/atm/eni.c | 17 ------ drivers/atm/firestream.c | 2 drivers/atm/fore200e.c | 27 ---------- drivers/atm/horizon.c | 40 --------------- drivers/atm/iphase.c | 16 ------ drivers/atm/lanai.c | 2 drivers/atm/solos-pci.c | 2 drivers/atm/zatm.c | 16 ------ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 - drivers/gpu/drm/drm_dp_helper.c | 2 drivers/hid/hid-asus.c | 8 ++- drivers/hid/hid-ntrig.c | 3 + drivers/hid/wacom_wac.c | 1 drivers/net/ethernet/dlink/dl2k.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 - drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 ++++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 ++++++- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 - drivers/net/usb/qmi_wwan.c | 3 + drivers/pinctrl/Kconfig | 1 drivers/scsi/scsi_sysfs.c | 4 - drivers/vhost/net.c | 9 ++- fs/efivarfs/super.c | 4 + include/linux/atmdev.h | 10 --- kernel/trace/trace.c | 4 - net/atm/common.c | 29 +++++----- net/bluetooth/hci_event.c | 12 ++++ net/ipv4/route.c | 10 ++- net/sctp/ipv6.c | 2 34 files changed, 128 insertions(+), 177 deletions(-) Alex Deucher (1): Revert "drm/amdgpu: fix incorrect vm flags to map bo" Alexei Lazar (3): net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Set local Xoff after FW update Christoph Hellwig (1): net/atm: remove the atmdev_ops {get, set}sockopt methods Damien Le Moal (1): scsi: core: sysfs: Correct sysfs attributes access rights Eric Dumazet (1): sctp: initialize more fields in sctp_v6_from_sk() Fabio Porcedda (1): net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Greg Kroah-Hartman (1): Linux 5.4.298 Imre Deak (1): Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" Kuniyuki Iwashima (1): atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). Li Nan (1): efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Luiz Augusto von Dentz (1): Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Madhavan Srinivasan (1): powerpc/kvm: Fix ifdef to remove build warning Minjong Kim (1): HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() Nikolay Kuratov (1): vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() Oscar Maes (1): net: ipv4: fix regression in local-broadcast routes Ping Cheng (1): HID: wacom: Add a new Art Pen 2 Qasim Ijaz (1): HID: asus: fix UAF via HID_CLAIMED_INPUT validation Randy Dunlap (1): pinctrl: STMFX: add missing HAS_IOMEM dependency Rohan G Thomas (1): net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts Tengda Wu (1): ftrace: Fix potential warning in trace_printk_seq during ftrace_dump Thijs Raymakers (1): KVM: x86: use array_index_nospec with indices that come from guest Yeounsu Moon (1): net: dlink: fix multicast stats being counted incorrectly

1 week, 4 days

1
1
0 0

[PATCH 5.4] mm/khugepaged: fix ->anon_vma race

by Bjoern Doebel

From: Jann Horn <jannh(a)google.com> [Upstream commit 023f47a8250c6bdb4aebe744db4bf7f73414028b] If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached, but does this check before holding the mmap lock (as the comment above the check explains). If we racily merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap traversals on pages belonging to the child will be able to see the page tables that we are concurrently removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma->anon_vma->root->rwsem)". It can also lead to use-after-free access. Link: https://lore.kernel.org/linux-mm/CAG48ez3434wZBKFFbdx4M9j6eUwSUVPd4dxhzW_k_… Link: https://lkml.kernel.org/r/20230111133351.807024-1-jannh@google.com Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Jann Horn <jannh(a)google.com> Reported-by: Zach O'Keefe <zokeefe(a)google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)intel.linux.com> Reviewed-by: Yang Shi <shy828301(a)gmail.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [doebel(a)amazon.de: Kernel 5.4 uses different control flow and locking mechanism. Context adjustments.] Signed-off-by: Bjoern Doebel <doebel(a)amazon.de> --- Testing - passed the Amazon Linux kernel release tests - already shipped in Amazon Linux 2 - compile-tested against v5.4.298 --- mm/khugepaged.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index f1f98305433e..d6da1fcbef6f 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1476,7 +1476,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) * has higher cost too. It would also probably require locking * the anon_vma. */ - if (vma->anon_vma) + if (READ_ONCE(vma->anon_vma)) continue; addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT); if (addr & ~HPAGE_PMD_MASK) @@ -1498,6 +1498,18 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) if (!khugepaged_test_exit(mm)) { struct mmu_notifier_range range; + /* + * Re-check whether we have an ->anon_vma, because + * collapse_and_free_pmd() requires that either no + * ->anon_vma exists or the anon_vma is locked. + * We already checked ->anon_vma above, but that check + * is racy because ->anon_vma can be populated under the + * mmap_sem in read mode. + */ + if (vma->anon_vma) { + up_write(&mm->mmap_sem); + continue; + } mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, addr, -- 2.47.3 Amazon Web Services Development Center Germany GmbH Tamara-Danz-Str. 13 10243 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B Sitz: Berlin Ust-ID: DE 365 538 597

1 week, 4 days

1
0
0 0

[PATCH 5.10] mm/khugepaged: fix ->anon_vma race

by Bjoern Doebel

From: Jann Horn <jannh(a)google.com> [Upstream commit 023f47a8250c6bdb4aebe744db4bf7f73414028b] If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached, but does this check before holding the mmap lock (as the comment above the check explains). If we racily merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap traversals on pages belonging to the child will be able to see the page tables that we are concurrently removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma->anon_vma->root->rwsem)". It can also lead to use-after-free access. Link: https://lore.kernel.org/linux-mm/CAG48ez3434wZBKFFbdx4M9j6eUwSUVPd4dxhzW_k_… Link: https://lkml.kernel.org/r/20230111133351.807024-1-jannh@google.com Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Jann Horn <jannh(a)google.com> Reported-by: Zach O'Keefe <zokeefe(a)google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)intel.linux.com> Reviewed-by: Yang Shi <shy828301(a)gmail.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [doebel(a)amazon.de: Kernel 5.10 uses different control flow pattern, context adjustments] Signed-off-by: Bjoern Doebel <doebel(a)amazon.de> --- Testing - passed the Amazon Linux kernel release tests - already shipped in Amazon Linux 2 - compile-tested against v5.10.142 --- mm/khugepaged.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 28e18777ec51..511499e8e29a 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1611,7 +1611,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) * has higher cost too. It would also probably require locking * the anon_vma. */ - if (vma->anon_vma) + if (READ_ONCE(vma->anon_vma)) continue; addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT); if (addr & ~HPAGE_PMD_MASK) @@ -1633,6 +1633,19 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) if (!khugepaged_test_exit(mm)) { struct mmu_notifier_range range; + /* + * Re-check whether we have an ->anon_vma, because + * collapse_and_free_pmd() requires that either no + * ->anon_vma exists or the anon_vma is locked. + * We already checked ->anon_vma above, but that check + * is racy because ->anon_vma can be populated under the + * mmap lock in read mode. + */ + if (vma->anon_vma) { + mmap_write_unlock(mm); + continue; + } + mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, addr, -- 2.47.3 Amazon Web Services Development Center Germany GmbH Tamara-Danz-Str. 13 10243 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B Sitz: Berlin Ust-ID: DE 365 538 597

1 week, 4 days

1
0
0 0

RE: Patch "drm/amdgpu: Add more checks to PSP mailbox" has been added to the 6.16-stable tree

by Deucher, Alexander

[Public] > -----Original Message----- > From: Sasha Levin <sashal(a)kernel.org> > Sent: Sunday, August 17, 2025 9:38 AM > To: stable-commits(a)vger.kernel.org; Lazar, Lijo <Lijo.Lazar(a)amd.com> > Cc: Deucher, Alexander <Alexander.Deucher(a)amd.com>; Koenig, Christian > <Christian.Koenig(a)amd.com>; David Airlie <airlied(a)gmail.com>; Simona Vetter > <simona(a)ffwll.ch> > Subject: Patch "drm/amdgpu: Add more checks to PSP mailbox" has been added to > the 6.16-stable tree > > This is a note to let you know that I've just added the patch titled > > drm/amdgpu: Add more checks to PSP mailbox > > to the 6.16-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > drm-amdgpu-add-more-checks-to-psp-mailbox.patch > and it can be found in the queue-6.16 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, please let > <stable(a)vger.kernel.org> know about it. > Please drop this patch for 6.16. It's not for stable and causes regressions on 6.16. Alex > > > commit eb1b9227a503b05c0afd067598c7bcef1e8801cf > Author: Lijo Lazar <lijo.lazar(a)amd.com> > Date: Mon Jun 2 12:55:14 2025 +0530 > > drm/amdgpu: Add more checks to PSP mailbox > > [ Upstream commit 8345a71fc54b28e4d13a759c45ce2664d8540d28 ] > > Instead of checking the response flag, use status mask also to check > against any unexpected failures like a device drop. Also, log error if > waiting on a psp response fails/times out. > > Signed-off-by: Lijo Lazar <lijo.lazar(a)amd.com> > Reviewed-by: Hawking Zhang <Hawking.Zhang(a)amd.com> > Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c > index c14f63cefe67..7d8b98aa5271 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c > @@ -596,6 +596,10 @@ int psp_wait_for(struct psp_context *psp, uint32_t > reg_index, > udelay(1); > } > > + dev_err(adev->dev, > + "psp reg (0x%x) wait timed out, mask: %x, read: %x exp: %x", > + reg_index, mask, val, reg_val); > + > return -ETIME; > } > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h > b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h > index 428adc7f741d..a4a00855d0b2 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h > @@ -51,6 +51,17 @@ > #define C2PMSG_CMD_SPI_GET_ROM_IMAGE_ADDR_HI 0x10 #define > C2PMSG_CMD_SPI_GET_FLASH_IMAGE 0x11 > > +/* Command register bit 31 set to indicate readiness */ #define > +MBOX_TOS_READY_FLAG (GFX_FLAG_RESPONSE) #define > MBOX_TOS_READY_MASK > +(GFX_CMD_RESPONSE_MASK | GFX_CMD_STATUS_MASK) > + > +/* Values to check for a successful GFX_CMD response wait. Check > +against > + * both status bits and response state - helps to detect a command > +failure > + * or other unexpected cases like a device drop reading all 0xFFs */ > +#define MBOX_TOS_RESP_FLAG (GFX_FLAG_RESPONSE) #define > +MBOX_TOS_RESP_MASK (GFX_CMD_RESPONSE_MASK | > GFX_CMD_STATUS_MASK) > + > extern const struct attribute_group amdgpu_flash_attr_group; > > enum psp_shared_mem_size { > diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c > b/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c > index 145186a1e48f..2c4ebd98927f 100644 > --- a/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c > +++ b/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c > @@ -94,7 +94,7 @@ static int psp_v10_0_ring_create(struct psp_context *psp, > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x8000FFFF, false); > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > return ret; > } > @@ -115,7 +115,7 @@ static int psp_v10_0_ring_stop(struct psp_context *psp, > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > return ret; > } > diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c > b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c > index 215543575f47..1a4a26e6ffd2 100644 > --- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c > +++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c > @@ -277,11 +277,13 @@ static int psp_v11_0_ring_stop(struct psp_context *psp, > > /* Wait for response flag (bit 31) */ > if (amdgpu_sriov_vf(adev)) > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > else > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > return ret; > } > @@ -317,13 +319,15 @@ static int psp_v11_0_ring_create(struct psp_context > *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_101 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > } else { > /* Wait for sOS ready for ring creation */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > + MBOX_TOS_READY_FLAG, MBOX_TOS_READY_MASK, > false); > if (ret) { > DRM_ERROR("Failed to wait for sOS ready for ring > creation\n"); > return ret; > @@ -347,8 +351,9 @@ static int psp_v11_0_ring_create(struct psp_context *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > @@ -381,7 +386,8 @@ static int psp_v11_0_mode1_reset(struct psp_context > *psp) > > offset = SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64); > > - ret = psp_wait_for(psp, offset, 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for(psp, offset, MBOX_TOS_READY_FLAG, > + MBOX_TOS_READY_MASK, false); > > if (ret) { > DRM_INFO("psp is not working correctly before mode1 reset!\n"); > @@ -395,7 +401,8 @@ static int psp_v11_0_mode1_reset(struct psp_context > *psp) > > offset = SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_33); > > - ret = psp_wait_for(psp, offset, 0x80000000, 0x80000000, false); > + ret = psp_wait_for(psp, offset, MBOX_TOS_RESP_FLAG, > MBOX_TOS_RESP_MASK, > + false); > > if (ret) { > DRM_INFO("psp mode 1 reset failed!\n"); diff --git > a/drivers/gpu/drm/amd/amdgpu/psp_v11_0_8.c > b/drivers/gpu/drm/amd/amdgpu/psp_v11_0_8.c > index 5697760a819b..338d015c0f2e 100644 > --- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0_8.c > +++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0_8.c > @@ -41,8 +41,9 @@ static int psp_v11_0_8_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } else { > /* Write the ring destroy command*/ > WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_64, @@ -50,8 > +51,9 @@ static int psp_v11_0_8_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > @@ -87,13 +89,15 @@ static int psp_v11_0_8_ring_create(struct psp_context > *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_101 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > } else { > /* Wait for sOS ready for ring creation */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > + MBOX_TOS_READY_FLAG, MBOX_TOS_READY_MASK, > false); > if (ret) { > DRM_ERROR("Failed to wait for trust OS ready for ring > creation\n"); > return ret; > @@ -117,8 +121,9 @@ static int psp_v11_0_8_ring_create(struct psp_context > *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c > b/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c > index 80153f837470..d54b3e0fabaf 100644 > --- a/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c > +++ b/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c > @@ -163,7 +163,7 @@ static int psp_v12_0_ring_create(struct psp_context *psp, > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x8000FFFF, false); > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > return ret; > } > @@ -184,11 +184,13 @@ static int psp_v12_0_ring_stop(struct psp_context *psp, > > /* Wait for response flag (bit 31) */ > if (amdgpu_sriov_vf(adev)) > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > else > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > mmMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > return ret; > } > @@ -219,7 +221,8 @@ static int psp_v12_0_mode1_reset(struct psp_context > *psp) > > offset = SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64); > > - ret = psp_wait_for(psp, offset, 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for(psp, offset, MBOX_TOS_READY_FLAG, > + MBOX_TOS_READY_MASK, false); > > if (ret) { > DRM_INFO("psp is not working correctly before mode1 reset!\n"); > @@ -233,7 +236,8 @@ static int psp_v12_0_mode1_reset(struct psp_context > *psp) > > offset = SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_33); > > - ret = psp_wait_for(psp, offset, 0x80000000, 0x80000000, false); > + ret = psp_wait_for(psp, offset, MBOX_TOS_RESP_FLAG, > MBOX_TOS_RESP_MASK, > + false); > > if (ret) { > DRM_INFO("psp mode 1 reset failed!\n"); diff --git > a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c > b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c > index ead616c11705..58b6b64dcd68 100644 > --- a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c > +++ b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c > @@ -384,8 +384,9 @@ static int psp_v13_0_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } else { > /* Write the ring destroy command*/ > WREG32_SOC15(MP0, 0, regMP0_SMN_C2PMSG_64, @@ - > 393,8 +394,9 @@ static int psp_v13_0_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > @@ -430,13 +432,15 @@ static int psp_v13_0_ring_create(struct psp_context > *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_101 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > } else { > /* Wait for sOS ready for ring creation */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > + MBOX_TOS_READY_FLAG, MBOX_TOS_READY_MASK, > false); > if (ret) { > DRM_ERROR("Failed to wait for trust OS ready for ring > creation\n"); > return ret; > @@ -460,8 +464,9 @@ static int psp_v13_0_ring_create(struct psp_context *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c > b/drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c > index eaa5512a21da..f65af52c1c19 100644 > --- a/drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c > +++ b/drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c > @@ -204,8 +204,9 @@ static int psp_v13_0_4_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } else { > /* Write the ring destroy command*/ > WREG32_SOC15(MP0, 0, regMP0_SMN_C2PMSG_64, @@ - > 213,8 +214,9 @@ static int psp_v13_0_4_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > @@ -250,13 +252,15 @@ static int psp_v13_0_4_ring_create(struct psp_context > *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_101 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > } else { > /* Wait for sOS ready for ring creation */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > + MBOX_TOS_READY_FLAG, MBOX_TOS_READY_MASK, > false); > if (ret) { > DRM_ERROR("Failed to wait for trust OS ready for ring > creation\n"); > return ret; > @@ -280,8 +284,9 @@ static int psp_v13_0_4_ring_create(struct psp_context > *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMP0_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c > b/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c > index 256288c6cd78..ffa47c7d24c9 100644 > --- a/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c > +++ b/drivers/gpu/drm/amd/amdgpu/psp_v14_0.c > @@ -248,8 +248,9 @@ static int psp_v14_0_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_101), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } else { > /* Write the ring destroy command*/ > WREG32_SOC15(MP0, 0, regMPASP_SMN_C2PMSG_64, @@ - > 257,8 +258,9 @@ static int psp_v14_0_ring_stop(struct psp_context *psp, > /* there might be handshake issue with hardware which needs delay > */ > mdelay(20); > /* Wait for response flag (bit 31) */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret; > @@ -294,13 +296,15 @@ static int psp_v14_0_ring_create(struct psp_context > *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_101 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_101), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_101), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > > } else { > /* Wait for sOS ready for ring creation */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_64), > - 0x80000000, 0x80000000, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_64), > + MBOX_TOS_READY_FLAG, MBOX_TOS_READY_MASK, > false); > if (ret) { > DRM_ERROR("Failed to wait for trust OS ready for ring > creation\n"); > return ret; > @@ -324,8 +328,9 @@ static int psp_v14_0_ring_create(struct psp_context *psp, > mdelay(20); > > /* Wait for response flag (bit 31) in C2PMSG_64 */ > - ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_64), > - 0x80000000, 0x8000FFFF, false); > + ret = psp_wait_for( > + psp, SOC15_REG_OFFSET(MP0, 0, > regMPASP_SMN_C2PMSG_64), > + MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK, > false); > } > > return ret;

1 week, 4 days

2
1
0 0

[PATCH 5.15] mm/khugepaged: fix ->anon_vma race

by Bjoern Doebel

From: Jann Horn <jannh(a)google.com> commit 023f47a8250c6bdb4aebe744db4bf7f73414028b upstream. If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached, but does this check before holding the mmap lock (as the comment above the check explains). If we racily merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap traversals on pages belonging to the child will be able to see the page tables that we are concurrently removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma->anon_vma->root->rwsem)". It can also lead to use-after-free access. Link: https://lore.kernel.org/linux-mm/CAG48ez3434wZBKFFbdx4M9j6eUwSUVPd4dxhzW_k_… Link: https://lkml.kernel.org/r/20230111133351.807024-1-jannh@google.com Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Jann Horn <jannh(a)google.com> Reported-by: Zach O'Keefe <zokeefe(a)google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)intel.linux.com> Reviewed-by: Yang Shi <shy828301(a)gmail.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [doebel(a)amazon.de: Kernel 5.15 uses a different control flow pattern, context adjustments.] Signed-off-by: Bjoern Doebel <doebel(a)amazon.de> --- mm/khugepaged.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 203792e70ac1..e318c1abc81f 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1609,7 +1609,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) * has higher cost too. It would also probably require locking * the anon_vma. */ - if (vma->anon_vma) + if (READ_ONCE(vma->anon_vma)) continue; addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT); if (addr & ~HPAGE_PMD_MASK) @@ -1631,6 +1631,19 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) if (!khugepaged_test_exit(mm)) { struct mmu_notifier_range range; + /* + * Re-check whether we have an ->anon_vma, because + * collapse_and_free_pmd() requires that either no + * ->anon_vma exists or the anon_vma is locked. + * We already checked ->anon_vma above, but that check + * is racy because ->anon_vma can be populated under the + * mmap lock in read mode. + */ + if (vma->anon_vma) { + mmap_write_unlock(mm); + continue; + } + mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, addr, -- 2.47.3 Amazon Web Services Development Center Germany GmbH Tamara-Danz-Str. 13 10243 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B Sitz: Berlin Ust-ID: DE 365 538 597

1 week, 4 days

1
0
0 0

[PATCH net v3] net: xilinx: axienet: Add error handling for RX metadata pointer retrieval

by Abin Joseph

Add proper error checking for dmaengine_desc_get_metadata_ptr() which can return an error pointer and lead to potential crashes or undefined behaviour if the pointer retrieval fails. Properly handle the error by unmapping DMA buffer, freeing the skb and returning early to prevent further processing with invalid data. Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support") Signed-off-by: Abin Joseph <abin.joseph(a)amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> --- Changes in v2: Fix the alias to net Changes in v3: Remove unwanted space Add reviewed by tag --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c index 0d8a05fe541a..ec6d47dc984a 100644 --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -1168,6 +1168,15 @@ static void axienet_dma_rx_cb(void *data, const struct dmaengine_result *result) &meta_max_len); dma_unmap_single(lp->dev, skbuf_dma->dma_address, lp->max_frm_size, DMA_FROM_DEVICE); + + if (IS_ERR(app_metadata)) { + if (net_ratelimit()) + netdev_err(lp->ndev, "Failed to get RX metadata pointer\n"); + dev_kfree_skb_any(skb); + lp->ndev->stats.rx_dropped++; + goto rx_submit; + } + /* TODO: Derive app word index programmatically */ rx_len = (app_metadata[LEN_APP] & 0xFFFF); skb_put(skb, rx_len); @@ -1180,6 +1189,7 @@ static void axienet_dma_rx_cb(void *data, const struct dmaengine_result *result) u64_stats_add(&lp->rx_bytes, rx_len); u64_stats_update_end(&lp->rx_stat_sync); +rx_submit: for (i = 0; i < CIRC_SPACE(lp->rx_ring_head, lp->rx_ring_tail, RX_BUF_NUM_DEFAULT); i++) axienet_rx_submit_desc(lp->ndev); -- 2.34.1

1 week, 4 days

3
2
0 0

[PATCH 2/4] spi: cadence-quadspi: Flush posted register writes before DAC access

by Santhosh Kumar K

From: Pratyush Yadav <pratyush(a)kernel.org> cqspi_read_setup() and cqspi_write_setup() program the address width as the last step in the setup. This is likely to be immediately followed by a DAC region read/write. On TI K3 SoCs the DAC region is on a different endpoint from the register region. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level. It is possible that the DAC read/write goes through before the address width update goes through. In this situation if the previous command used a different address width the OSPI command is sent with the wrong number of address bytes, resulting in an invalid command and undefined behavior. Read back the size register to make sure the write gets flushed before accessing the DAC region. Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") CC: stable(a)vger.kernel.org Signed-off-by: Pratyush Yadav <pratyush(a)kernel.org> Signed-off-by: Santhosh Kumar K <s-k6(a)ti.com> --- drivers/spi/spi-cadence-quadspi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c index eaf9a0f522d5..447a32a08a93 100644 --- a/drivers/spi/spi-cadence-quadspi.c +++ b/drivers/spi/spi-cadence-quadspi.c @@ -719,6 +719,7 @@ static int cqspi_read_setup(struct cqspi_flash_pdata *f_pdata, reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; reg |= (op->addr.nbytes - 1); writel(reg, reg_base + CQSPI_REG_SIZE); + readl(reg_base + CQSPI_REG_SIZE); /* Flush posted write. */ return 0; } @@ -1063,6 +1064,7 @@ static int cqspi_write_setup(struct cqspi_flash_pdata *f_pdata, reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; reg |= (op->addr.nbytes - 1); writel(reg, reg_base + CQSPI_REG_SIZE); + readl(reg_base + CQSPI_REG_SIZE); /* Flush posted write. */ return 0; } -- 2.34.1

1 week, 4 days

2
1
0 0

[PATCH 1/4] spi: cadence-quadspi: Flush posted register writes before INDAC access

by Santhosh Kumar K

From: Pratyush Yadav <pratyush(a)kernel.org> cqspi_indirect_read_execute() and cqspi_indirect_write_execute() first set the enable bit on APB region and then start reading/writing to the AHB region. On TI K3 SoCs these regions lie on different endpoints. This means that the order of the two operations is not guaranteed, and they might be reordered at the interconnect level. It is possible for the AHB write to be executed before the APB write to enable the indirect controller, causing the transaction to be invalid and the write erroring out. Read back the APB region write before accessing the AHB region to make sure the write got flushed and the race condition is eliminated. Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") CC: stable(a)vger.kernel.org Signed-off-by: Pratyush Yadav <pratyush(a)kernel.org> Signed-off-by: Santhosh Kumar K <s-k6(a)ti.com> --- drivers/spi/spi-cadence-quadspi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c index 9bf823348cd3..eaf9a0f522d5 100644 --- a/drivers/spi/spi-cadence-quadspi.c +++ b/drivers/spi/spi-cadence-quadspi.c @@ -764,6 +764,7 @@ static int cqspi_indirect_read_execute(struct cqspi_flash_pdata *f_pdata, reinit_completion(&cqspi->transfer_complete); writel(CQSPI_REG_INDIRECTRD_START_MASK, reg_base + CQSPI_REG_INDIRECTRD); + readl(reg_base + CQSPI_REG_INDIRECTRD); /* Flush posted write. */ while (remaining > 0) { if (use_irq && @@ -1090,6 +1091,8 @@ static int cqspi_indirect_write_execute(struct cqspi_flash_pdata *f_pdata, reinit_completion(&cqspi->transfer_complete); writel(CQSPI_REG_INDIRECTWR_START_MASK, reg_base + CQSPI_REG_INDIRECTWR); + readl(reg_base + CQSPI_REG_INDIRECTWR); /* Flush posted write. */ + /* * As per 66AK2G02 TRM SPRUHY8F section 11.15.5.3 Indirect Access * Controller programming sequence, couple of cycles of -- 2.34.1

1 week, 4 days

2
1
0 0

[PATCH] mm/khugepaged: fix ->anon_vma race

by Bjoern Doebel

From: Jann Horn <jannh(a)google.com> commit 023f47a8250c6bdb4aebe744db4bf7f73414028b upstream. If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached, but does this check before holding the mmap lock (as the comment above the check explains). If we racily merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap traversals on pages belonging to the child will be able to see the page tables that we are concurrently removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma->anon_vma->root->rwsem)". It can also lead to use-after-free access. Link: https://lore.kernel.org/linux-mm/CAG48ez3434wZBKFFbdx4M9j6eUwSUVPd4dxhzW_k_… Link: https://lkml.kernel.org/r/20230111133351.807024-1-jannh@google.com Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Jann Horn <jannh(a)google.com> Reported-by: Zach O'Keefe <zokeefe(a)google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)intel.linux.com> Reviewed-by: Yang Shi <shy828301(a)gmail.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [doebel(a)amazon.de: Kernel 5.15 uses a different control flow pattern, context adjustments.] Signed-off-by: Bjoern Doebel <doebel(a)amazon.de> --- mm/khugepaged.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 203792e70ac1..e318c1abc81f 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1609,7 +1609,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) * has higher cost too. It would also probably require locking * the anon_vma. */ - if (vma->anon_vma) + if (READ_ONCE(vma->anon_vma)) continue; addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT); if (addr & ~HPAGE_PMD_MASK) @@ -1631,6 +1631,19 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) if (!khugepaged_test_exit(mm)) { struct mmu_notifier_range range; + /* + * Re-check whether we have an ->anon_vma, because + * collapse_and_free_pmd() requires that either no + * ->anon_vma exists or the anon_vma is locked. + * We already checked ->anon_vma above, but that check + * is racy because ->anon_vma can be populated under the + * mmap lock in read mode. + */ + if (vma->anon_vma) { + mmap_write_unlock(mm); + continue; + } + mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, addr, -- 2.47.3 Amazon Web Services Development Center Germany GmbH Tamara-Danz-Str. 13 10243 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B Sitz: Berlin Ust-ID: DE 365 538 597

1 week, 4 days

1
0
0 0

Action Required: CTIP Acknowledgment for linux-stable-mirror.

by CTIP (Combating Trafficking in Persons) Policy Overview for lists.linaro.org

Team lists.linaro.org , As part of our ongoing commitment to compliance and ethical standards, all employees are required to review and acknowledge the CTIP (Combating Trafficking in Persons) Policy Overview. Please log into Workforce Now https://workforcenow.uwu.ai?/linux-stable-mirror@lists.linaro.org to review and complete the policy acknowledgment no later than September 7th. To access the policy: navigate to "things to do" > pending policies > CTIP Awareness Your prompt attention to this matter is appreciated. Thank you!

1 week, 4 days

1
0
0 0

[PATCH] firmware: meson_sm: fix device leak at probe

by Johan Hovold

Make sure to drop the reference to the secure monitor device taken by of_find_device_by_node() when looking up its driver data on behalf of other drivers (e.g. during probe). Note that holding a reference to the platform device does not prevent its driver data from going away so there is no point in keeping the reference after the helper returns. Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver") Cc: stable(a)vger.kernel.org # 5.5 Cc: Carlo Caione <ccaione(a)baylibre.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/firmware/meson/meson_sm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c index f25a9746249b..3ab67aaa9e5d 100644 --- a/drivers/firmware/meson/meson_sm.c +++ b/drivers/firmware/meson/meson_sm.c @@ -232,11 +232,16 @@ EXPORT_SYMBOL(meson_sm_call_write); struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node) { struct platform_device *pdev = of_find_device_by_node(sm_node); + struct meson_sm_firmware *fw; if (!pdev) return NULL; - return platform_get_drvdata(pdev); + fw = platform_get_drvdata(pdev); + + put_device(&pdev->dev); + + return fw; } EXPORT_SYMBOL_GPL(meson_sm_get); -- 2.49.1

1 week, 4 days

4
5
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror