- Linux-stable-mirror - lists.linaro.org

Re: [PATCH 6.9 000/197] 6.9.9-rc1 review

by Ronald Warsow

Hi Greg no regressions here on x86_64 (RKL, Intel 11th Gen. CPU) Thanks Tested-by: Ronald Warsow <rwarsow(a)gmx.de>

12 months

1
0
0 0

[PATCH v2] drm/amd/display: Add otg_master NULL check within init_pipe_slice_table_from_context

by Ma Ke

To avoid reports of NULL_RETURN warning, we should add otg_master NULL check. Cc: stable(a)vger.kernel.org Fixes: c51d87202d1f ("drm/amd/display: do not attempt ODM power optimization if minimal transition doesn't exist") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v2: - added the recipient's email address, due to the prolonged absence of a response from the recipient. - added Cc stable. --- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c index f6fe0a64beac..8972598ca77f 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c @@ -1177,6 +1177,9 @@ static void init_pipe_slice_table_from_context( stream = context->streams[i]; otg_master = resource_get_otg_master_for_stream( &context->res_ctx, stream); + if (!otg_master) + continue; + count = resource_get_odm_slice_count(otg_master); update_slice_table_for_stream(table, stream, count); -- 2.25.1

12 months

2
1
0 0

[PATCH] EDAC/altera: Fix possible null pointer dereference

by Ma Ke

In altr_s10_sdram_check_ecc_deps(), of_get_address() may return NULL which is later dereferenced. Fix this bug by adding NULL check. Cc: stable(a)vger.kernel.org Fixes: e1bca853dddc ("EDAC/altera: Add SDRAM ECC check for U-Boot") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/edac/altera_edac.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c index fe89f5c4837f..d6bf0eebeb41 100644 --- a/drivers/edac/altera_edac.c +++ b/drivers/edac/altera_edac.c @@ -1086,6 +1086,7 @@ static int altr_s10_sdram_check_ecc_deps(struct altr_edac_device_dev *device) struct arm_smccc_res result; struct device_node *np; phys_addr_t sdram_addr; + const __be32 *sdram_addrp; u32 read_reg; int ret; @@ -1093,8 +1094,14 @@ static int altr_s10_sdram_check_ecc_deps(struct altr_edac_device_dev *device) if (!np) goto sdram_err; - sdram_addr = of_translate_address(np, of_get_address(np, 0, - NULL, NULL)); + sdram_addrp = of_get_address(np, 0, NULL, NULL); + if (!sdram_addrp) + return -EINVAL; + + sdram_addr = of_translate_address(np, sdram_addrp); + if (!sdram_addr) + return -EINVAL; + of_node_put(np); sdram_ecc_addr = (unsigned long)sdram_addr + prv->ecc_en_ofst; arm_smccc_smc(INTEL_SIP_SMC_REG_READ, sdram_ecc_addr, -- 2.25.1

12 months

2
1
0 0

[PATCH] wifi: ath12k: fix soft lockup on suspend

by Johan Hovold

The ext interrupts are enabled when the firmware has been started, but this may never happen, for example, if the board configuration file is missing. When the system is later suspended, the driver unconditionally tries to disable interrupts, which results in an irq disable imbalance and causes the driver to spin indefinitely in napi_synchronize(). Make sure that the interrupts have been enabled before attempting to disable them. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable(a)vger.kernel.org # 6.3 Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> --- drivers/net/wireless/ath/ath12k/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c index 16af046c33d9..55fde0d33183 100644 --- a/drivers/net/wireless/ath/ath12k/pci.c +++ b/drivers/net/wireless/ath/ath12k/pci.c @@ -472,7 +472,8 @@ static void __ath12k_pci_ext_irq_disable(struct ath12k_base *ab) { int i; - clear_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags); + if (!test_and_clear_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags)) + return; for (i = 0; i < ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) { struct ath12k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i]; -- 2.44.1

12 months

2
1
0 0

[PATCH] cxl: Fix possible null pointer dereference in read_handle()

by Ma Ke

In read_handle() of_get_address() may return NULL which is later dereferenced. Fix this bug by adding NULL check. Cc: stable(a)vger.kernel.org Fixes: 14baf4d9c739 ("cxl: Add guest-specific code") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/misc/cxl/of.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/cxl/of.c b/drivers/misc/cxl/of.c index bcc005dff1c0..d8dbb3723951 100644 --- a/drivers/misc/cxl/of.c +++ b/drivers/misc/cxl/of.c @@ -58,7 +58,7 @@ static int read_handle(struct device_node *np, u64 *handle) /* Get address and size of the node */ prop = of_get_address(np, 0, &size, NULL); - if (size) + if (!prop || size) return -EINVAL; /* Helper to read a big number; size is in cells (not bytes) */ -- 2.25.1

12 months

3
2
0 0

[PATCH 2/3] perf/x86/intel: Add a distinct name for Granite Rapids

by kan.liang＠linux.intel.com

From: Kan Liang <kan.liang(a)linux.intel.com> Currently, the Sapphire Rapids and Granite Rapids share the same PMU name, sapphire_rapids. Because from the kernel’s perspective, GNR is similar to SPR. The only key difference is that they support different extra MSRs. The code path and the PMU name are shared. However, from end users' perspective, they are quite different. Besides the extra MSRs, GNR has a newer PEBS format, supports Retire Latency, supports new CPUID enumeration architecture, doesn't required the load-latency AUX event, has additional TMA Level 1 Architectural Events, etc. The differences can be enumerated by CPUID or the PERF_CAPABILITIES MSR. They weren't reflected in the model-specific kernel setup. But it is worth to have a distinct PMU name for GNR. Fixes: a6742cb90b56 ("perf/x86/intel: Fix the FRONTEND encoding on GNR and MTL") Suggested-by: Ahmad Yasin <ahmad.yasin(a)intel.com> Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Cc: stable(a)vger.kernel.org --- arch/x86/events/intel/core.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index b61367991a16..7a9f931a1f48 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -6943,12 +6943,17 @@ __init int intel_pmu_init(void) case INTEL_EMERALDRAPIDS_X: x86_pmu.flags |= PMU_FL_MEM_LOADS_AUX; x86_pmu.extra_regs = intel_glc_extra_regs; + pr_cont("Sapphire Rapids events, "); + name = "sapphire_rapids"; fallthrough; case INTEL_GRANITERAPIDS_X: case INTEL_GRANITERAPIDS_D: intel_pmu_init_glc(NULL); - if (!x86_pmu.extra_regs) + if (!x86_pmu.extra_regs) { x86_pmu.extra_regs = intel_rwc_extra_regs; + pr_cont("Granite Rapids events, "); + name = "granite_rapids"; + } x86_pmu.pebs_ept = 1; x86_pmu.hw_config = hsw_hw_config; x86_pmu.get_event_constraints = glc_get_event_constraints; @@ -6959,8 +6964,6 @@ __init int intel_pmu_init(void) td_attr = glc_td_events_attrs; tsx_attr = glc_tsx_events_attrs; intel_pmu_pebs_data_source_skl(true); - pr_cont("Sapphire Rapids events, "); - name = "sapphire_rapids"; break; case INTEL_ALDERLAKE: -- 2.38.1

12 months

4
3
0 0

WARNING&Oops in v6.6.37 on ppc64lea - Trying to vfree() bad address (00000000453be747)

by Vitaly Chikunov

Hi, There is new WARNING and Oops on ppc64le in v6.6.37 when running LTP tests: bpf_prog01, bpf_prog02, bpf_prog04, bpf_prog05, prctl04. Logs excerpt below. I see there is 1 commit in v6.6.36..v6.6.37 with call to bpf_jit_binary_pack_finalize, backported from 5 patch mainline patchset: f99feda5684a powerpc/bpf: use bpf_jit_binary_pack_[alloc|finalize|free] Log: [ 8.822079] LTP: starting bpf_prog01 [ 8.841853] ------------[ cut here ]------------ [ 8.841946] Trying to vfree() bad address (00000000453be747) [ 8.842024] WARNING: CPU: 6 PID: 689 at mm/vmalloc.c:2700 remove_vm_area+0xb4/0xf0 [ 8.842103] Modules linked in: virtio_rng rng_core virtio_net net_failover failover sd_mod ata_generic ata_piix libata scsi_mod scsi_common virtio_blk virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev 9pnet_virtio virtio_ring virtio 9p 9pnet netfs [ 8.842323] CPU: 6 PID: 689 Comm: bpf_prog01 Not tainted 6.6.37-un-def-alt1 #1 [ 8.842396] Hardware name: IBM pSeries (emulated by qemu) POWER8 (raw) 0x4d0200 0xf000004 of:SLOF,git-3a259d hv:linux,kvm pSeries [ 8.842519] NIP: c0000000004faf04 LR: c0000000004faf00 CTR: 0000000000000000 [ 8.842598] REGS: c000000009b6f250 TRAP: 0700 Not tainted (6.6.37-un-def-alt1) [ 8.842669] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28002822 XER: 00000000 [ 8.842748] CFAR: c00000000015df94 IRQMASK: 0 [ 8.842748] GPR00: 0000000000000000 c000000009b6f4f0 c000000001ac7f00 0000000000000000 [ 8.842748] GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.842748] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.842748] GPR12: 0000000000000000 c00000003fff7a00 0000000000000000 0000000000000000 [ 8.842748] GPR16: 0000000000000012 0000000000000000 000000000000008c 0000000000000000 [ 8.842748] GPR20: c008000000040a40 0000000000000002 c0000000022a7560 c008000000040a4c [ 8.842748] GPR24: c000000005716480 0000000000000000 c000000002155698 c0000000022a7680 [ 8.842748] GPR28: c000000002155688 c008000000040a40 c008000000040a40 c008000000040a40 [ 8.843347] NIP [c0000000004faf04] remove_vm_area+0xb4/0xf0 [ 8.843398] LR [c0000000004faf00] remove_vm_area+0xb0/0xf0 [ 8.843448] Call Trace: [ 8.843484] [c000000009b6f4f0] [c0000000004faf00] remove_vm_area+0xb0/0xf0 (unreliable) [ 8.843559] [c000000009b6f560] [c0000000004fb360] vfree+0x60/0x2a0 [ 8.843621] [c000000009b6f5e0] [c000000000269c6c] module_memfree+0x3c/0x60 [ 8.843685] [c000000009b6f600] [c00000000038cf60] bpf_jit_free_exec+0x20/0x40 [ 8.843759] [c000000009b6f620] [c00000000038f518] bpf_prog_pack_free+0x2f8/0x390 [ 8.843832] [c000000009b6f6b0] [c00000000038f878] bpf_jit_binary_pack_finalize+0x98/0xd0 [ 8.843906] [c000000009b6f6e0] [c000000000118240] bpf_int_jit_compile+0x2c0/0x710 [ 8.843979] [c000000009b6f830] [c00000000038ef64] bpf_prog_select_runtime+0x154/0x1b0 [ 8.844053] [c000000009b6f880] [c000000000398edc] bpf_prog_load+0x94c/0xe90 [ 8.844114] [c000000009b6f990] [c00000000039c878] __sys_bpf+0x418/0x2970 [ 8.844176] [c000000009b6fac0] [c00000000039f1a0] sys_bpf+0x30/0x50 [ 8.844237] [c000000009b6fae0] [c000000000030230] system_call_exception+0x190/0x390 [ 8.844312] [c000000009b6fe50] [c00000000000c7d4] system_call_common+0xf4/0x258 [ 8.844386] --- interrupt: c00 at 0x7fffb0839ad4 [ 8.844437] NIP: 00007fffb0839ad4 LR: 000000012a027fb4 CTR: 0000000000000000 [ 8.844524] REGS: c000000009b6fe80 TRAP: 0c00 Not tainted (6.6.37-un-def-alt1) [ 8.844596] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22002240 XER: 00000000 [ 8.844690] IRQMASK: 0 [ 8.844690] GPR00: 0000000000000169 00007fffd8534200 00007fffb0936d00 0000000000000005 [ 8.844690] GPR04: 00007fffb06aff90 0000000000000070 000000012a0538a0 0000000000000001 [ 8.844690] GPR08: 000000012a0801f4 0000000000000000 0000000000000000 0000000000000000 [ 8.844690] GPR12: 0000000000000000 00007fffb09ea540 0000000000000000 0000000000000000 [ 8.844690] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.844690] GPR20: 00007fffd85344b0 0000000000000000 0000000000000001 0000000000000000 [ 8.844690] GPR24: 000000012a0801f4 00007fffb06ce000 0000000000000000 00000000000f4240 [ 8.844690] GPR28: 00007fffb06aff90 00007fffb09e3550 0000000000000001 0000000000001118 [ 8.845267] NIP [00007fffb0839ad4] 0x7fffb0839ad4 [ 8.845315] LR [000000012a027fb4] 0x12a027fb4 [ 8.845363] --- interrupt: c00 [ 8.845399] Code: 38000000 38800000 39200000 4e800020 60000000 60000000 60420000 3c62ffa2 7fe4fb78 3863e698 4bc62f8d 60000000 <0fe00000> 38210070 3bc00000 e8010010 [ 8.845550] ---[ end trace 0000000000000000 ]--- [ 8.845603] ------------[ cut here ]------------ [ 8.845651] Trying to vfree() nonexistent vm area (00000000453be747) [ 8.845714] WARNING: CPU: 6 PID: 689 at mm/vmalloc.c:2835 vfree+0x1d8/0x2a0 [ 8.845776] Modules linked in: virtio_rng rng_core virtio_net net_failover failover sd_mod ata_generic ata_piix libata scsi_mod scsi_common virtio_blk virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev 9pnet_virtio virtio_ring virtio 9p 9pnet netfs [ 8.845989] CPU: 6 PID: 689 Comm: bpf_prog01 Tainted: G W 6.6.37-un-def-alt1 #1 [ 8.846072] Hardware name: IBM pSeries (emulated by qemu) POWER8 (raw) 0x4d0200 0xf000004 of:SLOF,git-3a259d hv:linux,kvm pSeries [ 8.846177] NIP: c0000000004fb4d8 LR: c0000000004fb4d4 CTR: 0000000000000000 [ 8.846248] REGS: c000000009b6f2c0 TRAP: 0700 Tainted: G W (6.6.37-un-def-alt1) [ 8.846330] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28002222 XER: 00000000 [ 8.846408] CFAR: c00000000015df94 IRQMASK: 0 [ 8.846408] GPR00: 0000000000000000 c000000009b6f560 c000000001ac7f00 0000000000000000 [ 8.846408] GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.846408] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.846408] GPR12: 0000000000000000 c00000003fff7a00 0000000000000000 0000000000000000 [ 8.846408] GPR16: 0000000000000012 0000000000000000 000000000000008c 0000000000000000 [ 8.846408] GPR20: c008000000040a40 0000000000000002 c0000000022a7560 c008000000040a4c [ 8.846408] GPR24: c000000005716480 0000000000000000 c000000002155698 c0000000022a7680 [ 8.846408] GPR28: c000000002155688 0000000000000000 c008000000040a40 0000000000000000 [ 8.851030] NIP [c0000000004fb4d8] vfree+0x1d8/0x2a0 [ 8.851085] LR [c0000000004fb4d4] vfree+0x1d4/0x2a0 [ 8.851135] Call Trace: [ 8.851160] [c000000009b6f560] [c0000000004fb4d4] vfree+0x1d4/0x2a0 (unreliable) [ 8.851234] [c000000009b6f5e0] [c000000000269c6c] module_memfree+0x3c/0x60 [ 8.851297] [c000000009b6f600] [c00000000038cf60] bpf_jit_free_exec+0x20/0x40 [ 8.851371] [c000000009b6f620] [c00000000038f518] bpf_prog_pack_free+0x2f8/0x390 [ 8.851445] [c000000009b6f6b0] [c00000000038f878] bpf_jit_binary_pack_finalize+0x98/0xd0 [ 8.851529] [c000000009b6f6e0] [c000000000118240] bpf_int_jit_compile+0x2c0/0x710 [ 8.851602] [c000000009b6f830] [c00000000038ef64] bpf_prog_select_runtime+0x154/0x1b0 [ 8.851675] [c000000009b6f880] [c000000000398edc] bpf_prog_load+0x94c/0xe90 [ 8.851737] [c000000009b6f990] [c00000000039c878] __sys_bpf+0x418/0x2970 [ 8.851798] [c000000009b6fac0] [c00000000039f1a0] sys_bpf+0x30/0x50 [ 8.851860] [c000000009b6fae0] [c000000000030230] system_call_exception+0x190/0x390 [ 8.851934] [c000000009b6fe50] [c00000000000c7d4] system_call_common+0xf4/0x258 [ 8.852007] --- interrupt: c00 at 0x7fffb0839ad4 [ 8.852057] NIP: 00007fffb0839ad4 LR: 000000012a027fb4 CTR: 0000000000000000 [ 8.852128] REGS: c000000009b6fe80 TRAP: 0c00 Tainted: G W (6.6.37-un-def-alt1) [ 8.852212] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22002240 XER: 00000000 [ 8.852307] IRQMASK: 0 [ 8.852307] GPR00: 0000000000000169 00007fffd8534200 00007fffb0936d00 0000000000000005 [ 8.852307] GPR04: 00007fffb06aff90 0000000000000070 000000012a0538a0 0000000000000001 [ 8.852307] GPR08: 000000012a0801f4 0000000000000000 0000000000000000 0000000000000000 [ 8.852307] GPR12: 0000000000000000 00007fffb09ea540 0000000000000000 0000000000000000 [ 8.852307] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.852307] GPR20: 00007fffd85344b0 0000000000000000 0000000000000001 0000000000000000 [ 8.852307] GPR24: 000000012a0801f4 00007fffb06ce000 0000000000000000 00000000000f4240 [ 8.852307] GPR28: 00007fffb06aff90 00007fffb09e3550 0000000000000001 0000000000001118 [ 8.852889] NIP [00007fffb0839ad4] 0x7fffb0839ad4 [ 8.852938] LR [000000012a027fb4] 0x12a027fb4 [ 8.852986] --- interrupt: c00 [ 8.853022] Code: 4e800020 60420000 3949ffff 4bffff0c 38210080 ebe1fff8 4bfffd68 3c62ffa2 7fc4f378 3863e6f0 4bc629b9 60000000 <0fe00000> eba10068 4bffff8c 2c080000 [ 8.853164] ---[ end trace 0000000000000000 ]--- [ 8.856619] kernel tried to execute exec-protected page (c008000000040a4c) - exploit attempt? (uid: 0) [ 8.856717] BUG: Unable to handle kernel instruction fetch [ 8.856763] Faulting instruction address: 0xc008000000040a4c [ 8.856825] Oops: Kernel access of bad area, sig: 11 [#1] [ 8.856875] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries [ 8.856937] Modules linked in: virtio_rng rng_core virtio_net net_failover failover sd_mod ata_generic ata_piix libata scsi_mod scsi_common virtio_blk virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev 9pnet_virtio virtio_ring virtio 9p 9pnet netfs [ 8.857154] CPU: 6 PID: 689 Comm: bpf_prog01 Tainted: G W 6.6.37-un-def-alt1 #1 [ 8.857236] Hardware name: IBM pSeries (emulated by qemu) POWER8 (raw) 0x4d0200 0xf000004 of:SLOF,git-3a259d hv:linux,kvm pSeries [ 8.857342] NIP: c008000000040a4c LR: c000000000ed25d0 CTR: c008000000040a4c [ 8.857413] REGS: c000000009b6f6f0 TRAP: 0400 Tainted: G W (6.6.37-un-def-alt1) [ 8.857510] MSR: 8000000010009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28008286 XER: 00000000 [ 8.857588] CFAR: c000000000ed25cc IRQMASK: 0 [ 8.857588] GPR00: c000000000ed25a8 c000000009b6f990 c000000001ac7f00 c000000006130400 [ 8.857588] GPR04: c008000000920048 0000000000000001 0000000000000000 0000000000000000 [ 8.857588] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.857588] GPR12: c008000000040a4c c00000003fff7a00 0000000000000000 0000000000000000 [ 8.857588] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.857588] GPR20: 7fffffffffffffff 0000000000000000 0000000000000001 0000000000000000 [ 8.857588] GPR24: c000000006130400 c000000006510a00 c000000006510f00 c0000000041a9000 [ 8.857588] GPR28: 0000000000000001 c000000006130400 0000000000000000 c008000000920000 [ 8.858184] NIP [c008000000040a4c] bpf_prog_2fb4fda3a3499517+0x0/0x8c [ 8.858245] LR [c000000000ed25d0] sk_filter_trim_cap+0xc0/0x370 [ 8.858308] Call Trace: [ 8.858333] [c000000009b6f990] [c000000000ed2574] sk_filter_trim_cap+0x64/0x370 (unreliable) [ 8.858421] [c000000009b6fa10] [c000000001068b64] unix_dgram_sendmsg+0x214/0xb10 [ 8.858511] [c000000009b6fad0] [c000000000e4c59c] sock_write_iter+0x19c/0x1e0 [ 8.858586] [c000000009b6fb80] [c0000000005b1b58] vfs_write+0x258/0x4e0 [ 8.858648] [c000000009b6fc40] [c0000000005b21d4] ksys_write+0x114/0x170 [ 8.858711] [c000000009b6fc90] [c000000000030230] system_call_exception+0x190/0x390 [ 8.858785] [c000000009b6fe50] [c00000000000c7d4] system_call_common+0xf4/0x258 [ 8.858859] --- interrupt: c00 at 0x7fffb082b884 [ 8.858908] NIP: 00007fffb082b884 LR: 000000012a02ab70 CTR: 0000000000000000 [ 8.858979] REGS: c000000009b6fe80 TRAP: 0c00 Tainted: G W (6.6.37-un-def-alt1) [ 8.859060] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 28002281 XER: 00000000 [ 8.859153] IRQMASK: 0 [ 8.859153] GPR00: 0000000000000004 00007fffd85341f0 00007fffb0936d00 0000000000000005 [ 8.859153] GPR04: 00007fffb068fffa 0000000000000006 0000000000000001 0000000000000005 [ 8.859153] GPR08: 00007fffb068fffa 0000000000000000 0000000000000000 0000000000000000 [ 8.859153] GPR12: 0000000000000000 00007fffb09ea540 0000000000000000 0000000000000000 [ 8.859153] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.859153] GPR20: 00007fffd85344b0 0000000000000000 0000000000000001 0000000000000000 [ 8.859153] GPR24: 000000012a053698 000000000000008b 0000000000000000 0000000000000001 [ 8.859153] GPR28: 00007fffb068fffa 0000000000000005 0000000000000006 000000012a053698 [ 8.859738] NIP [00007fffb082b884] 0x7fffb082b884 [ 8.859786] LR [000000012a02ab70] 0x12a02ab70 [ 8.859836] --- interrupt: c00 [ 8.859872] Code: 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 <7fe00008> 7fe00008 7fe00008 7fe00008 [ 8.860013] ---[ end trace 0000000000000000 ]--- [ 8.863088] pstore: backend (nvram) writing error (-1) [ 8.863141] [ 8.863166] note: bpf_prog01[689] exited with irqs disabled And so on. Temporary build/test log is at https://git.altlinux.org/tasks/352218/build/100/ppc64le/log Other stable/longterm branches or other architectures does not exhibit this. Thanks,

12 months

5
6
0 0

Re: Patch "igc: fix a log entry using uninitialized netdev" has been added to the 6.9-stable tree

by Corinna Vinschen

Hi Sasha, my patch should not go into the stable branches. Under certain circumstances it triggered kernel crashes. Consequentially this patch has been reverted in the main development branch: 8eef5c3cea65 Revert "igc: fix a log entry using uninitialized netdev" So I suggest to remove my patch 86167183a17e from the stable branches or apply 8eef5c3cea65 as well. Sorry and thanks, Corinna On Jul 5 15:29, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > igc: fix a log entry using uninitialized netdev > > to the 6.9-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > igc-fix-a-log-entry-using-uninitialized-netdev.patch > and it can be found in the queue-6.9 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > > > commit ee112b3c8929ec718b444134db87e1c585eb7d70 > Author: Corinna Vinschen <vinschen(a)redhat.com> > Date: Tue Apr 23 12:24:54 2024 +0200 > > igc: fix a log entry using uninitialized netdev > > [ Upstream commit 86167183a17e03ec77198897975e9fdfbd53cb0b ] > > During successful probe, igc logs this: > > [ 5.133667] igc 0000:01:00.0 (unnamed net_device) (uninitialized): PHC added > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > The reason is that igc_ptp_init() is called very early, even before > register_netdev() has been called. So the netdev_info() call works > on a partially uninitialized netdev. > > Fix this by calling igc_ptp_init() after register_netdev(), right > after the media autosense check, just as in igb. Add a comment, > just as in igb. > > Now the log message is fine: > > [ 5.200987] igc 0000:01:00.0 eth0: PHC added > > Signed-off-by: Corinna Vinschen <vinschen(a)redhat.com> > Reviewed-by: Hariprasad Kelam <hkelam(a)marvell.com> > Acked-by: Vinicius Costa Gomes <vinicius.gomes(a)intel.com> > Tested-by: Naama Meir <naamax.meir(a)linux.intel.com> > Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c > index 58bc96021bb4c..07feb951be749 100644 > --- a/drivers/net/ethernet/intel/igc/igc_main.c > +++ b/drivers/net/ethernet/intel/igc/igc_main.c > @@ -6932,8 +6932,6 @@ static int igc_probe(struct pci_dev *pdev, > device_set_wakeup_enable(&adapter->pdev->dev, > adapter->flags & IGC_FLAG_WOL_SUPPORTED); > > - igc_ptp_init(adapter); > - > igc_tsn_clear_schedule(adapter); > > /* reset the hardware with the new settings */ > @@ -6955,6 +6953,9 @@ static int igc_probe(struct pci_dev *pdev, > /* Check if Media Autosense is enabled */ > adapter->ei = *ei; > > + /* do hw tstamp init after resetting */ > + igc_ptp_init(adapter); > + > /* print pcie link status and MAC address */ > pcie_print_link_status(pdev); > netdev_info(netdev, "MAC: %pM\n", netdev->dev_addr);

12 months

2
2
0 0

[tip: perf/core] task_work: s/task_work_cancel()/task_work_cancel_func()/

by tip-bot2 for Frederic Weisbecker

The following commit has been merged into the perf/core branch of tip: Commit-ID: 68cbd415dd4b9c5b9df69f0f091879e56bf5907a Gitweb: https://git.kernel.org/tip/68cbd415dd4b9c5b9df69f0f091879e56bf5907a Author: Frederic Weisbecker <frederic(a)kernel.org> AuthorDate: Fri, 21 Jun 2024 11:15:58 +02:00 Committer: Peter Zijlstra <peterz(a)infradead.org> CommitterDate: Tue, 09 Jul 2024 13:26:31 +02:00 task_work: s/task_work_cancel()/task_work_cancel_func()/ A proper task_work_cancel() API that actually cancels a callback and not *any* callback pointing to a given function is going to be needed for perf events event freeing. Do the appropriate rename to prepare for that. Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240621091601.18227-2-frederic@kernel.org --- include/linux/task_work.h | 2 +- kernel/irq/manage.c | 2 +- kernel/task_work.c | 10 +++++----- security/keys/keyctl.c | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/include/linux/task_work.h b/include/linux/task_work.h index 795ef5a..23ab01a 100644 --- a/include/linux/task_work.h +++ b/include/linux/task_work.h @@ -30,7 +30,7 @@ int task_work_add(struct task_struct *task, struct callback_head *twork, struct callback_head *task_work_cancel_match(struct task_struct *task, bool (*match)(struct callback_head *, void *data), void *data); -struct callback_head *task_work_cancel(struct task_struct *, task_work_func_t); +struct callback_head *task_work_cancel_func(struct task_struct *, task_work_func_t); void task_work_run(void); static inline void exit_task_work(struct task_struct *task) diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c index 71b0fc2..dd53298 100644 --- a/kernel/irq/manage.c +++ b/kernel/irq/manage.c @@ -1337,7 +1337,7 @@ static int irq_thread(void *data) * synchronize_hardirq(). So neither IRQTF_RUNTHREAD nor the * oneshot mask bit can be set. */ - task_work_cancel(current, irq_thread_dtor); + task_work_cancel_func(current, irq_thread_dtor); return 0; } diff --git a/kernel/task_work.c b/kernel/task_work.c index 95a7e1b..54ac240 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c @@ -120,9 +120,9 @@ static bool task_work_func_match(struct callback_head *cb, void *data) } /** - * task_work_cancel - cancel a pending work added by task_work_add() - * @task: the task which should execute the work - * @func: identifies the work to remove + * task_work_cancel_func - cancel a pending work matching a function added by task_work_add() + * @task: the task which should execute the func's work + * @func: identifies the func to match with a work to remove * * Find the last queued pending work with ->func == @func and remove * it from queue. @@ -131,7 +131,7 @@ static bool task_work_func_match(struct callback_head *cb, void *data) * The found work or NULL if not found. */ struct callback_head * -task_work_cancel(struct task_struct *task, task_work_func_t func) +task_work_cancel_func(struct task_struct *task, task_work_func_t func) { return task_work_cancel_match(task, task_work_func_match, func); } @@ -168,7 +168,7 @@ void task_work_run(void) if (!work) break; /* - * Synchronize with task_work_cancel(). It can not remove + * Synchronize with task_work_cancel_match(). It can not remove * the first entry == work, cmpxchg(task_works) must fail. * But it can remove another entry from the ->next list. */ diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index 4bc3e93..ab927a1 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -1694,7 +1694,7 @@ long keyctl_session_to_parent(void) goto unlock; /* cancel an already pending keyring replacement */ - oldwork = task_work_cancel(parent, key_change_session_keyring); + oldwork = task_work_cancel_func(parent, key_change_session_keyring); /* the replacement session keyring is applied just prior to userspace * restarting */

12 months

1
0
0 0

[tip: perf/core] perf: Fix event leak upon exit

by tip-bot2 for Frederic Weisbecker

The following commit has been merged into the perf/core branch of tip: Commit-ID: 2fd5ad3f310de22836cdacae919dd99d758a1f1b Gitweb: https://git.kernel.org/tip/2fd5ad3f310de22836cdacae919dd99d758a1f1b Author: Frederic Weisbecker <frederic(a)kernel.org> AuthorDate: Fri, 21 Jun 2024 11:16:00 +02:00 Committer: Peter Zijlstra <peterz(a)infradead.org> CommitterDate: Tue, 09 Jul 2024 13:26:33 +02:00 perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); <IRQ> perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); </IRQ> =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] <IRQ WORK> perf_pending_irq() // early return: event->oncpu = -1 </IRQ WORK> [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling. Fixes: 517e6a301f34 ("perf: Fix perf_pending_task() UaF") Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240621091601.18227-4-frederic@kernel.org --- kernel/events/core.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 51ce436..576400d 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2284,18 +2284,15 @@ event_sched_out(struct perf_event *event, struct perf_event_context *ctx) } if (event->pending_sigtrap) { - bool dec = true; - event->pending_sigtrap = 0; if (state != PERF_EVENT_STATE_OFF && - !event->pending_work) { - event->pending_work = 1; - dec = false; + !event->pending_work && + !task_work_add(current, &event->pending_task, TWA_RESUME)) { WARN_ON_ONCE(!atomic_long_inc_not_zero(&event->refcount)); - task_work_add(current, &event->pending_task, TWA_RESUME); - } - if (dec) + event->pending_work = 1; + } else { local_dec(&event->ctx->nr_pending); + } } perf_event_set_state(event, state);

12 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror