November 2021 - Linux-stable-mirror

FAILED: patch "[PATCH] PCI/MSI: Destroy sysfs before freeing entries" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 3735459037114d31e5acd9894fad9aed104231a0 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner <tglx(a)linutronix.de> Date: Tue, 9 Nov 2021 14:53:57 +0100 Subject: [PATCH] PCI/MSI: Destroy sysfs before freeing entries free_msi_irqs() frees the MSI entries before destroying the sysfs entries which are exposing them. Nothing prevents a concurrent free while a sysfs file is read and accesses the possibly freed entry. Move the sysfs release ahead of freeing the entries. Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Bjorn Helgaas <helgaas(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/87sfw5305m.ffs@tglx diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index 70433013897b..48e3f4e47b29 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -368,6 +368,11 @@ static void free_msi_irqs(struct pci_dev *dev) for (i = 0; i < entry->nvec_used; i++) BUG_ON(irq_has_action(entry->irq + i)); + if (dev->msi_irq_groups) { + msi_destroy_sysfs(&dev->dev, dev->msi_irq_groups); + dev->msi_irq_groups = NULL; + } + pci_msi_teardown_msi_irqs(dev); list_for_each_entry_safe(entry, tmp, msi_list, list) { @@ -379,11 +384,6 @@ static void free_msi_irqs(struct pci_dev *dev) list_del(&entry->list); free_msi_entry(entry); } - - if (dev->msi_irq_groups) { - msi_destroy_sysfs(&dev->dev, dev->msi_irq_groups); - dev->msi_irq_groups = NULL; - } } static void pci_intx_for_msi(struct pci_dev *dev, int enable)

3 years, 1 month

1
0
0 0

FAILED: patch "[PATCH] MIPS: Fix assembly error from MIPSr2 code used within" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From a923a2676e60683aee46aa4b93c30aff240ac20d Mon Sep 17 00:00:00 2001 From: "Maciej W. Rozycki" <macro(a)orcam.me.uk> Date: Fri, 22 Oct 2021 00:58:23 +0200 Subject: [PATCH] MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL Fix assembly errors like: {standard input}: Assembler messages: {standard input}:287: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32' {standard input}:680: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32' {standard input}:1274: Error: opcode not supported on this processor: mips3 (mips3) `dins $12,$9,32,32' {standard input}:2175: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32' make[1]: *** [scripts/Makefile.build:277: mm/highmem.o] Error 1 with code produced from `__cmpxchg64' for MIPS64r2 CPU configurations using CONFIG_32BIT and CONFIG_PHYS_ADDR_T_64BIT. This is due to MIPS_ISA_ARCH_LEVEL downgrading the assembly architecture to `r4000' i.e. MIPS III for MIPS64r2 configurations, while there is a block of code containing a DINS MIPS64r2 instruction conditionalized on MIPS_ISA_REV >= 2 within the scope of the downgrade. The assembly architecture override code pattern has been put there for LL/SC instructions, so that code compiles for configurations that select a processor to build for that does not support these instructions while still providing run-time support for processors that do, dynamically switched by non-constant `cpu_has_llsc'. It went in with linux-mips.org commit aac8aa7717a2 ("Enable a suitable ISA for the assembler around ll/sc so that code builds even for processors that don't support the instructions. Plus minor formatting fixes.") back in 2005. Fix the problem by wrapping these instructions along with the adjacent SYNC instructions only, following the practice established with commit cfd54de3b0e4 ("MIPS: Avoid move psuedo-instruction whilst using MIPS_ISA_LEVEL") and commit 378ed6f0e3c5 ("MIPS: Avoid using .set mips0 to restore ISA"). Strictly speaking the SYNC instructions do not have to be wrapped as they are only used as a Loongson3 erratum workaround, so they will be enabled in the assembler by default, but do this so as to keep code consistent with other places. Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Maciej W. Rozycki <macro(a)orcam.me.uk> Fixes: c7e2d71dda7a ("MIPS: Fix set_pte() for Netlogic XLR using cmpxchg64()") Cc: stable(a)vger.kernel.org # v5.1+ Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h index 0b983800f48b..66a8b293fd80 100644 --- a/arch/mips/include/asm/cmpxchg.h +++ b/arch/mips/include/asm/cmpxchg.h @@ -249,6 +249,7 @@ static inline unsigned long __cmpxchg64(volatile void *ptr, /* Load 64 bits from ptr */ " " __SYNC(full, loongson3_war) " \n" "1: lld %L0, %3 # __cmpxchg64 \n" + " .set pop \n" /* * Split the 64 bit value we loaded into the 2 registers that hold the * ret variable. @@ -276,12 +277,14 @@ static inline unsigned long __cmpxchg64(volatile void *ptr, " or %L1, %L1, $at \n" " .set at \n" # endif + " .set push \n" + " .set " MIPS_ISA_ARCH_LEVEL " \n" /* Attempt to store new at ptr */ " scd %L1, %2 \n" /* If we failed, loop! */ "\t" __SC_BEQZ "%L1, 1b \n" - " .set pop \n" "2: " __SYNC(full, loongson3_war) " \n" + " .set pop \n" : "=&r"(ret), "=&r"(tmp), "=" GCC_OFF_SMALL_ASM() (*(unsigned long long *)ptr)

3 years, 1 month

1
0
0 0

[PATCH] parisc: Fix set_fixmap() on PA1.x CPUs

by Helge Deller

Upstream commit 6e866a462867b60841202e900f10936a0478608c failed to apply to kernel v5.2 up to v5.4. Below is the fixed backport patch. Please apply to v5.2 up to v5.4. Thanks, Helge -------------------- From: Helge Deller <deller(a)gmx.de> Date: Sun, 31 Oct 2021 21:58:12 +0100 Subject: [PATCH] parisc: Fix set_fixmap() on PA1.x CPUs Upstream commit: 6e866a462867b60841202e900f10936a0478608c Fix a kernel crash which happens on PA1.x CPUs while initializing the FTRACE/KPROBE breakpoints. The PTE table entries for the fixmap area were not created correctly. Signed-off-by: Helge Deller <deller(a)gmx.de> Fixes: ccfbc68d41c2 ("parisc: add set_fixmap()/clear_fixmap()") Cc: stable(a)vger.kernel.org # v5.2+ diff --git a/arch/parisc/mm/fixmap.c b/arch/parisc/mm/fixmap.c index 474cd241c150..02e19a32e6c5 100644 --- a/arch/parisc/mm/fixmap.c +++ b/arch/parisc/mm/fixmap.c @@ -18,12 +18,9 @@ void notrace set_fixmap(enum fixed_addresses idx, phys_addr_t phys) pte_t *pte; if (pmd_none(*pmd)) - pmd = pmd_alloc(NULL, pgd, vaddr); - - pte = pte_offset_kernel(pmd, vaddr); - if (pte_none(*pte)) pte = pte_alloc_kernel(pmd, vaddr); + pte = pte_offset_kernel(pmd, vaddr); set_pte_at(&init_mm, vaddr, pte, __mk_pte(phys, PAGE_KERNEL_RWX)); flush_tlb_kernel_range(vaddr, vaddr + PAGE_SIZE); }

3 years, 1 month

2
1
0 0

smb3: do not error on fsync when readonly

by Steve French

Please include "smb3: do not error on fsync when readonly" Commit id: 71e6864eacbef0b2645ca043cdfbac272cb6cea3 It fixes an fsync problem over SMB3 mounts, reported by Julian, when the file is not opened for write. -- Thanks, Steve

3 years, 1 month

2
1
0 0

[stable-rc queue/5/15 ]: rk3568-evb1-v10.dts:10:10: fatal error: rk3568.dtsi: No such file or directory

by Naresh Kamboju

Following build warnings/ errors noticed on Linux stable-rc queue/5.15 branch. with gcc-11 for arm64 architecture. arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi:464.3-52: Warning (pci_device_reg): /pcie@f8000000/pcie@0,0:reg: PCI reg address is not configuration space arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi:464.3-52: Warning (pci_device_reg): /pcie@f8000000/pcie@0,0:reg: PCI reg address is not configuration space arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi:464.3-52: Warning (pci_device_reg): /pcie@f8000000/pcie@0,0:reg: PCI reg address is not configuration space arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi:464.3-52: Warning (pci_device_reg): /pcie@f8000000/pcie@0,0:reg: PCI reg address is not configuration space arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts:10:10: fatal error: rk3568.dtsi: No such file or directory 10 | #include rk3568.dtsi | ^~~~~~~~~~~~~ compilation terminated. make[3]: *** [scripts/Makefile.lib:358: arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dtb] Error 1 The first bad commit: -------- arm64: dts: rockchip: move rk3568 dtsi to rk356x dtsi [ Upstream commit 4e50d2173b67115a5574f4f4ce64ec9c5d9c136e ] In preparation for separating the rk3568 and rk3566 device trees, move the base rk3568 dtsi to rk356x dtsi. This will allow us to strip out the rk3568 specific nodes. Signed-off-by: Peter Geis <pgwipeout(a)gmail.com> Link: https://lore.kernel.org/r/20210710151034.32857-2-pgwipeout@gmail.com Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org Build config: https://builds.tuxbuild.com/20wHY13986hVAE9j4Kwxq4C8JUX/config Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> meta data: ----------- git_describe: v5.15.2-851-g750602323c68 git_ref: git_repo: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc-queues git_sha: 750602323c68ab51f3b65c59efc4289a7e7c60f9 git_short_log: 750602323c68 (\thermal: int340x: fix build on 32-bit targets\) kernel_version: 5.15.2 target_arch: arm64 toolchain: gcc-11 kconfig: [ defconfig, https://raw.githubusercontent.com/Linaro/meta-lkft/sumo/recipes-kernel/linu…, https://raw.githubusercontent.com/Linaro/meta-lkft/sumo/recipes-kernel/linu…, https://raw.githubusercontent.com/Linaro/meta-lkft/sumo/recipes-kernel/linu…, https://raw.githubusercontent.com/Linaro/meta-lkft/sumo/recipes-kernel/linu…, https://raw.githubusercontent.com/Linaro/meta-lkft/sumo/recipes-kernel/linu…, CONFIG_ARM64_MODULE_PLTS=y, CONFIG_SYN_COOKIES=y ], steps to reproduce: tuxmake --runtime podman --target-arch arm64 --toolchain gcc-11 --kconfig defconfig \ --kconfig-add https://builds.tuxbuild.com/20wHY13986hVAE9j4Kwxq4C8JUX/config https://builds.tuxbuild.com/20wHY13986hVAE9j4Kwxq4C8JUX/tuxmake_reproducer.… -- Linaro LKFT https://lkft.linaro.org

3 years, 1 month

2
1
0 0

[PATCH stable-4.9] USB: chipidea: fix interrupt deadlock

by Johan Hovold

commit 9aaa81c3366e8393a62374e3a1c67c69edc07b8a upstream. Chipidea core was calling the interrupt handler from non-IRQ context with interrupts enabled, something which can lead to a deadlock if there's an actual interrupt trying to take a lock that's already held (e.g. the controller lock in udc_irq()). Add a wrapper that can be used to fake interrupts instead of calling the handler directly. Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect") Fixes: 876d4e1e8298 ("usb: chipidea: core: add wakeup support for extcon") Cc: Peter Chen <peter.chen(a)kernel.org> Cc: stable(a)vger.kernel.org # 4.4 Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://lore.kernel.org/r/20211021083447.20078-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ johan: backport to 4.9; adjust context ] Signed-off-by: Johan Hovold <johan(a)kernel.org> --- This one should apply to 4.4 as well. Johan drivers/usb/chipidea/core.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c index 6062a5d816a6..f4b13f0637ea 100644 --- a/drivers/usb/chipidea/core.c +++ b/drivers/usb/chipidea/core.c @@ -516,7 +516,7 @@ int hw_device_reset(struct ci_hdrc *ci) return 0; } -static irqreturn_t ci_irq(int irq, void *data) +static irqreturn_t ci_irq_handler(int irq, void *data) { struct ci_hdrc *ci = data; irqreturn_t ret = IRQ_NONE; @@ -569,6 +569,15 @@ static irqreturn_t ci_irq(int irq, void *data) return ret; } +static void ci_irq(struct ci_hdrc *ci) +{ + unsigned long flags; + + local_irq_save(flags); + ci_irq_handler(ci->irq, ci); + local_irq_restore(flags); +} + static int ci_vbus_notifier(struct notifier_block *nb, unsigned long event, void *ptr) { @@ -582,7 +591,7 @@ static int ci_vbus_notifier(struct notifier_block *nb, unsigned long event, vbus->changed = true; - ci_irq(ci->irq, ci); + ci_irq(ci); return NOTIFY_DONE; } @@ -599,7 +608,7 @@ static int ci_id_notifier(struct notifier_block *nb, unsigned long event, id->changed = true; - ci_irq(ci->irq, ci); + ci_irq(ci); return NOTIFY_DONE; } @@ -1011,7 +1020,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) } platform_set_drvdata(pdev, ci); - ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED, + ret = devm_request_irq(dev, ci->irq, ci_irq_handler, IRQF_SHARED, ci->platdata->name, ci); if (ret) goto stop; @@ -1126,11 +1135,11 @@ static void ci_extcon_wakeup_int(struct ci_hdrc *ci) if (!IS_ERR(cable_id->edev) && ci->is_otg && (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) - ci_irq(ci->irq, ci); + ci_irq(ci); if (!IS_ERR(cable_vbus->edev) && ci->is_otg && (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) - ci_irq(ci->irq, ci); + ci_irq(ci); } static int ci_controller_resume(struct device *dev) -- 2.32.0

3 years, 1 month

2
1
0 0

FAILED: patch "[PATCH] fuse: fix page stealing" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 712a951025c0667ff00b25afc360f74e639dfabe Mon Sep 17 00:00:00 2001 From: Miklos Szeredi <mszeredi(a)redhat.com> Date: Tue, 2 Nov 2021 11:10:37 +0100 Subject: [PATCH] fuse: fix page stealing It is possible to trigger a crash by splicing anon pipe bufs to the fuse device. The reason for this is that anon_pipe_buf_release() will reuse buf->page if the refcount is 1, but that page might have already been stolen and its flags modified (e.g. PG_lru added). This happens in the unlikely case of fuse_dev_splice_write() getting around to calling pipe_buf_release() after a page has been stolen, added to the page cache and removed from the page cache. Fix by calling pipe_buf_release() right after the page was inserted into the page cache. In this case the page has an elevated refcount so any release function will know that the page isn't reusable. Reported-by: Frank Dinoff <fdinoff(a)google.com> Link: https://lore.kernel.org/r/CAAmZXrsGg2xsP1CK+cbuEMumtrqdvD-NKnWzhNcvn71RV3c1… Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device") Cc: <stable(a)vger.kernel.org> # v2.6.35 Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 337fa6f5a7c6..79f7eda49e06 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -847,6 +847,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) replace_page_cache_page(oldpage, newpage); + /* + * Release while we have extra ref on stolen page. Otherwise + * anon_pipe_buf_release() might think the page can be reused. + */ + pipe_buf_release(cs->pipe, buf); + get_page(newpage); if (!(buf->flags & PIPE_BUF_FLAG_LRU)) @@ -2031,8 +2037,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, pipe_lock(pipe); out_free: - for (idx = 0; idx < nbuf; idx++) - pipe_buf_release(pipe, &bufs[idx]); + for (idx = 0; idx < nbuf; idx++) { + struct pipe_buffer *buf = &bufs[idx]; + + if (buf->ops) + pipe_buf_release(pipe, buf); + } pipe_unlock(pipe); kvfree(bufs);

3 years, 1 month

3
2
0 0

[PATCH 5.4 0/5] powerpc/bpf: Various fixes

by Naveen N. Rao

This is a backport of the remaining patches from the below series: https://lore.kernel.org/all/cover.1633464148.git.naveen.n.rao@linux.vnet.ib… Kindly apply to the longterm tree for v5.4 Thanks, Naveen Naveen N. Rao (5): powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/bpf: Validate branch ranges powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 powerpc/security: Add a helper to query stf_barrier type powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC arch/powerpc/include/asm/code-patching.h | 1 + arch/powerpc/include/asm/security_features.h | 5 ++ arch/powerpc/kernel/security.c | 5 ++ arch/powerpc/lib/code-patching.c | 7 +- arch/powerpc/net/bpf_jit.h | 33 ++++--- arch/powerpc/net/bpf_jit64.h | 8 +- arch/powerpc/net/bpf_jit_comp64.c | 91 ++++++++++++++++---- 7 files changed, 117 insertions(+), 33 deletions(-) base-commit: c65356f0f7268b1260dd64415c2145e73640872e -- 2.33.1

3 years, 1 month

1
5
0 0

[PATCH 4.19 0/5] powerpc/bpf: Various fixes

by Naveen N. Rao

This is a backport of the remaining patches from the below series: https://lore.kernel.org/all/cover.1633464148.git.naveen.n.rao@linux.vnet.ib… Kindly apply to the longterm tree for v4.19 Thanks, Naveen Naveen N. Rao (5): powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/bpf: Validate branch ranges powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 powerpc/security: Add a helper to query stf_barrier type powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC arch/powerpc/include/asm/code-patching.h | 1 + arch/powerpc/include/asm/security_features.h | 5 ++ arch/powerpc/kernel/security.c | 5 ++ arch/powerpc/lib/code-patching.c | 7 +- arch/powerpc/net/bpf_jit.h | 33 ++++--- arch/powerpc/net/bpf_jit64.h | 8 +- arch/powerpc/net/bpf_jit_comp64.c | 93 ++++++++++++++++---- 7 files changed, 118 insertions(+), 34 deletions(-) base-commit: 3033e5726834e4c9c8c48cdb2273f33bd105f938 -- 2.33.1

3 years, 1 month

1
5
0 0

[PATCH 4.14 0/3] powerpc/bpf: Various fixes

by Naveen N. Rao

This is a backport of the remaining patches from the below series: https://lore.kernel.org/all/cover.1633464148.git.naveen.n.rao@linux.vnet.ib… Kindly apply to the longterm tree for v4.14 Thanks, Naveen Naveen N. Rao (3): powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/bpf: Validate branch ranges powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 arch/powerpc/include/asm/code-patching.h | 1 + arch/powerpc/lib/code-patching.c | 7 ++++- arch/powerpc/net/bpf_jit.h | 33 +++++++++++++-------- arch/powerpc/net/bpf_jit_comp64.c | 37 +++++++++++++++--------- 4 files changed, 52 insertions(+), 26 deletions(-) base-commit: 0447aa205abe1c0c016b4f7fa9d7c08d920b5c8e -- 2.33.1

3 years, 1 month

1
3
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2021