December 2022 - Linux-stable-mirror

by Max Filippov

xtensa gcc-13 has changed multiplication handling and may now use __umulsidi3 helper where it used to use __muldi3. As a result building the kernel with the new gcc may fail with the following error: linux/init/main.c:1287: undefined reference to `__umulsidi3' Fix the build by providing __umulsidi3 implementation for xtensa. Cc: stable(a)vger.kernel.org # 5.18+ Signed-off-by: Max Filippov <jcmvbkbc(a)gmail.com> --- arch/xtensa/kernel/xtensa_ksyms.c | 2 + arch/xtensa/lib/Makefile | 2 +- arch/xtensa/lib/umulsidi3.S | 230 ++++++++++++++++++++++++++++++ 3 files changed, 233 insertions(+), 1 deletion(-) create mode 100644 arch/xtensa/lib/umulsidi3.S diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c index b0bc8897c924..2a31b1ab0c9f 100644 --- a/arch/xtensa/kernel/xtensa_ksyms.c +++ b/arch/xtensa/kernel/xtensa_ksyms.c @@ -62,6 +62,7 @@ extern int __modsi3(int, int); extern int __mulsi3(int, int); extern unsigned int __udivsi3(unsigned int, unsigned int); extern unsigned int __umodsi3(unsigned int, unsigned int); +extern unsigned long long __umulsidi3(unsigned int, unsigned int); EXPORT_SYMBOL(__ashldi3); EXPORT_SYMBOL(__ashrdi3); @@ -71,6 +72,7 @@ EXPORT_SYMBOL(__modsi3); EXPORT_SYMBOL(__mulsi3); EXPORT_SYMBOL(__udivsi3); EXPORT_SYMBOL(__umodsi3); +EXPORT_SYMBOL(__umulsidi3); unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v) { diff --git a/arch/xtensa/lib/Makefile b/arch/xtensa/lib/Makefile index d4e9c397e3fd..7ecef0519a27 100644 --- a/arch/xtensa/lib/Makefile +++ b/arch/xtensa/lib/Makefile @@ -5,7 +5,7 @@ lib-y += memcopy.o memset.o checksum.o \ ashldi3.o ashrdi3.o lshrdi3.o \ - divsi3.o udivsi3.o modsi3.o umodsi3.o mulsi3.o \ + divsi3.o udivsi3.o modsi3.o umodsi3.o mulsi3.o umulsidi3.o \ usercopy.o strncpy_user.o strnlen_user.o lib-$(CONFIG_PCI) += pci-auto.o lib-$(CONFIG_KCSAN) += kcsan-stubs.o diff --git a/arch/xtensa/lib/umulsidi3.S b/arch/xtensa/lib/umulsidi3.S new file mode 100644 index 000000000000..136081647942 --- /dev/null +++ b/arch/xtensa/lib/umulsidi3.S @@ -0,0 +1,230 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later WITH GCC-exception-2.0 */ +#include <linux/linkage.h> +#include <asm/asmmacro.h> +#include <asm/core.h> + +#if !XCHAL_HAVE_MUL16 && !XCHAL_HAVE_MUL32 && !XCHAL_HAVE_MAC16 +#define XCHAL_NO_MUL 1 +#endif + +ENTRY(__umulsidi3) + +#ifdef __XTENSA_CALL0_ABI__ + abi_entry(32) + s32i a12, sp, 16 + s32i a13, sp, 20 + s32i a14, sp, 24 + s32i a15, sp, 28 +#elif XCHAL_NO_MUL + /* This is not really a leaf function; allocate enough stack space + to allow CALL12s to a helper function. */ + abi_entry(32) +#else + abi_entry_default +#endif + +#ifdef __XTENSA_EB__ +#define wh a2 +#define wl a3 +#else +#define wh a3 +#define wl a2 +#endif /* __XTENSA_EB__ */ + + /* This code is taken from the mulsf3 routine in ieee754-sf.S. + See more comments there. */ + +#if XCHAL_HAVE_MUL32_HIGH + mull a6, a2, a3 + muluh wh, a2, a3 + mov wl, a6 + +#else /* ! MUL32_HIGH */ + +#if defined(__XTENSA_CALL0_ABI__) && XCHAL_NO_MUL + /* a0 and a8 will be clobbered by calling the multiply function + but a8 is not used here and need not be saved. */ + s32i a0, sp, 0 +#endif + +#if XCHAL_HAVE_MUL16 || XCHAL_HAVE_MUL32 + +#define a2h a4 +#define a3h a5 + + /* Get the high halves of the inputs into registers. */ + srli a2h, a2, 16 + srli a3h, a3, 16 + +#define a2l a2 +#define a3l a3 + +#if XCHAL_HAVE_MUL32 && !XCHAL_HAVE_MUL16 + /* Clear the high halves of the inputs. This does not matter + for MUL16 because the high bits are ignored. */ + extui a2, a2, 0, 16 + extui a3, a3, 0, 16 +#endif +#endif /* MUL16 || MUL32 */ + + +#if XCHAL_HAVE_MUL16 + +#define do_mul(dst, xreg, xhalf, yreg, yhalf) \ + mul16u dst, xreg ## xhalf, yreg ## yhalf + +#elif XCHAL_HAVE_MUL32 + +#define do_mul(dst, xreg, xhalf, yreg, yhalf) \ + mull dst, xreg ## xhalf, yreg ## yhalf + +#elif XCHAL_HAVE_MAC16 + +/* The preprocessor insists on inserting a space when concatenating after + a period in the definition of do_mul below. These macros are a workaround + using underscores instead of periods when doing the concatenation. */ +#define umul_aa_ll umul.aa.ll +#define umul_aa_lh umul.aa.lh +#define umul_aa_hl umul.aa.hl +#define umul_aa_hh umul.aa.hh + +#define do_mul(dst, xreg, xhalf, yreg, yhalf) \ + umul_aa_ ## xhalf ## yhalf xreg, yreg; \ + rsr dst, ACCLO + +#else /* no multiply hardware */ + +#define set_arg_l(dst, src) \ + extui dst, src, 0, 16 +#define set_arg_h(dst, src) \ + srli dst, src, 16 + +#ifdef __XTENSA_CALL0_ABI__ +#define do_mul(dst, xreg, xhalf, yreg, yhalf) \ + set_arg_ ## xhalf (a13, xreg); \ + set_arg_ ## yhalf (a14, yreg); \ + call0 .Lmul_mulsi3; \ + mov dst, a12 +#else +#define do_mul(dst, xreg, xhalf, yreg, yhalf) \ + set_arg_ ## xhalf (a14, xreg); \ + set_arg_ ## yhalf (a15, yreg); \ + call12 .Lmul_mulsi3; \ + mov dst, a14 +#endif /* __XTENSA_CALL0_ABI__ */ + +#endif /* no multiply hardware */ + + /* Add pp1 and pp2 into a6 with carry-out in a9. */ + do_mul(a6, a2, l, a3, h) /* pp 1 */ + do_mul(a11, a2, h, a3, l) /* pp 2 */ + movi a9, 0 + add a6, a6, a11 + bgeu a6, a11, 1f + addi a9, a9, 1 +1: + /* Shift the high half of a9/a6 into position in a9. Note that + this value can be safely incremented without any carry-outs. */ + ssai 16 + src a9, a9, a6 + + /* Compute the low word into a6. */ + do_mul(a11, a2, l, a3, l) /* pp 0 */ + sll a6, a6 + add a6, a6, a11 + bgeu a6, a11, 1f + addi a9, a9, 1 +1: + /* Compute the high word into wh. */ + do_mul(wh, a2, h, a3, h) /* pp 3 */ + add wh, wh, a9 + mov wl, a6 + +#endif /* !MUL32_HIGH */ + +#if defined(__XTENSA_CALL0_ABI__) && XCHAL_NO_MUL + /* Restore the original return address. */ + l32i a0, sp, 0 +#endif +#ifdef __XTENSA_CALL0_ABI__ + l32i a12, sp, 16 + l32i a13, sp, 20 + l32i a14, sp, 24 + l32i a15, sp, 28 + abi_ret(32) +#else + abi_ret_default +#endif + +#if XCHAL_NO_MUL + + .macro do_addx2 dst, as, at, tmp +#if XCHAL_HAVE_ADDX + addx2 \dst, \as, \at +#else + slli \tmp, \as, 1 + add \dst, \tmp, \at +#endif + .endm + + .macro do_addx4 dst, as, at, tmp +#if XCHAL_HAVE_ADDX + addx4 \dst, \as, \at +#else + slli \tmp, \as, 2 + add \dst, \tmp, \at +#endif + .endm + + .macro do_addx8 dst, as, at, tmp +#if XCHAL_HAVE_ADDX + addx8 \dst, \as, \at +#else + slli \tmp, \as, 3 + add \dst, \tmp, \at +#endif + .endm + + /* For Xtensa processors with no multiply hardware, this simplified + version of _mulsi3 is used for multiplying 16-bit chunks of + the floating-point mantissas. When using CALL0, this function + uses a custom ABI: the inputs are passed in a13 and a14, the + result is returned in a12, and a8 and a15 are clobbered. */ + .align 4 +.Lmul_mulsi3: + abi_entry_default + + .macro mul_mulsi3_body dst, src1, src2, tmp1, tmp2 + movi \dst, 0 +1: add \tmp1, \src2, \dst + extui \tmp2, \src1, 0, 1 + movnez \dst, \tmp1, \tmp2 + + do_addx2 \tmp1, \src2, \dst, \tmp1 + extui \tmp2, \src1, 1, 1 + movnez \dst, \tmp1, \tmp2 + + do_addx4 \tmp1, \src2, \dst, \tmp1 + extui \tmp2, \src1, 2, 1 + movnez \dst, \tmp1, \tmp2 + + do_addx8 \tmp1, \src2, \dst, \tmp1 + extui \tmp2, \src1, 3, 1 + movnez \dst, \tmp1, \tmp2 + + srli \src1, \src1, 4 + slli \src2, \src2, 4 + bnez \src1, 1b + .endm + +#ifdef __XTENSA_CALL0_ABI__ + mul_mulsi3_body a12, a13, a14, a15, a8 +#else + /* The result will be written into a2, so save that argument in a4. */ + mov a4, a2 + mul_mulsi3_body a2, a4, a3, a5, a6 +#endif + abi_ret_default +#endif /* XCHAL_NO_MUL */ + +ENDPROC(__umulsidi3) -- 2.30.2

2 years, 1 month

1
0
0 0

[PATCH 4.9 00/62] 4.9.335-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.335 release. There are 62 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 07 Dec 2022 19:07:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.335-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.335-rc1 Adrian Hunter <adrian.hunter(a)intel.com> mmc: sdhci: Fix voltage switch delay Masahiro Yamada <yamada.masahiro(a)socionext.com> mmc: sdhci: use FIELD_GET for preset value bit masks Michael Kelley <mikelley(a)microsoft.com> x86/ioremap: Fix page aligned size calculation in __ioremap_caller() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/pm: Add enumeration check before spec MSRs save/restore setup Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/tsx: Add a feature bit for TSX control MSR support Ulrich Hecht <uli+cip(a)fpond.eu> Revert "fbdev: fb_pm2fb: Avoid potential divide by zero error" Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp/udp: Fix memory leak in ipv6_renew_options(). Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: Fix potential division by zero Mark Brown <broonie(a)kernel.org> ASoC: ops: Fix bounds check for _sx controls James Morse <james.morse(a)arm.com> arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 James Morse <james.morse(a)arm.com> arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors ZhangPeng <zhangpeng362(a)huawei.com> nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Tiezhu Yang <yangtiezhu(a)loongson.cn> tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" ChenXiaoSong <chenxiaosong2(a)huawei.com> btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() Phil Auld <pauld(a)redhat.com> hwmon: (coretemp) Check for null before removing sysfs attrs Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed Willem de Bruijn <willemb(a)google.com> packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE YueHaibing <yuehaibing(a)huawei.com> net: hsr: Fix potential use-after-free Wang Hai <wanghai38(a)huawei.com> net/9p: Fix a potential socket leak in p9_socket_open Yuan Can <yuancan(a)huawei.com> net: net_netdev: Fix error handling in ntb_netdev_init_module() Yang Yingliang <yangyingliang(a)huawei.com> net: phy: fix null-ptr-deref while probe() failed Duoming Zhou <duoming(a)zju.edu.cn> qlcnic: fix sleep-in-atomic-context bugs caused by msleep Zhang Changzhong <zhangchangzhong(a)huawei.com> can: cc770: cc770_isa_probe(): add missing free_cc770dev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() YueHaibing <yuehaibing(a)huawei.com> net/mlx5: Fix uninitialized variable bug in outlen_write() Gaosheng Cui <cuigaosheng1(a)huawei.com> hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (i5500_temp) fix missing pci_disable_device() Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4403: Fix oob read in afe4403_read_raw Christian König <christian.koenig(a)amd.com> drm/amdgpu: always register an MMU notifier for userptr Enrico Sau <enrico.sau(a)gmail.com> net: usb: qmi_wwan: add Telit 0x103a composition Gleb Mazovetskiy <glex.spb(a)gmail.com> tcp: configurable source port perturb table size Xiongfeng Wang <wangxiongfeng2(a)huawei.com> platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() ruanjinjie <ruanjinjie(a)huawei.com> xen/platform-pci: add missing free_irq() in error path Lukas Wunner <lukas(a)wunner.de> serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() Chen Zhongjin <chenzhongjin(a)huawei.com> nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty Randy Dunlap <rdunlap(a)infradead.org> nios2: add FORCE for vmlinuz.gz Masahiro Yamada <yamada.masahiro(a)socionext.com> kconfig: display recursive dependency resolution hint just once Chen Zhongjin <chenzhongjin(a)huawei.com> iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails Alejandro Concepción Rodríguez <asconcepcion(a)acoro.eu> iio: light: apds9960: fix wrong register for gesture gain Heiko Carstens <hca(a)linux.ibm.com> s390/crashdump: fix TOD programmable field size Yu Liao <liaoyu15(a)huawei.com> net: thunderx: Fix the ACPI memory leak Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix memory leaks in EVT_TRANSACTION Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION Liu Shixin <liushixin2(a)huawei.com> NFC: nci: fix memory leak in nci_rx_data_packet() Chen Zhongjin <chenzhongjin(a)huawei.com> xfrm: Fix ignored return value in xfrm6_init() Zhang Changzhong <zhangchangzhong(a)huawei.com> net/qla3xxx: fix potential memleak in ql3xxx_send() Peter Kosyh <pkosyh(a)yandex.ru> net/mlx4: Check retval of mlx4_bitmap_init Zheng Yongjun <zhengyongjun3(a)huawei.com> ARM: mxs: fix memory leak in mxs_machine_init() Zhengchao Shao <shaozhengchao(a)huawei.com> 9p/fd: fix issue of list_del corruption in p9_fd_cancel() Wang Hai <wanghai38(a)huawei.com> net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() Lin Ma <linma(a)zju.edu.cn> nfc/nci: fix race with opening and closing Michael Grzeschik <m.grzeschik(a)pengutronix.de> ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl Samuel Holland <samuel(a)sholland.org> bus: sunxi-rsb: Support atomic transfers Herbert Xu <herbert(a)gondor.apana.org.au> af_key: Fix send_acquire race with pfkey_register Jason A. Donenfeld <Jason(a)zx2c4.com> MIPS: pic32: treat port as signed integer Nicolas Cavallari <nicolas.cavallari(a)green-communications.fr> wifi: mac80211: Fix ack frame idr leak when mesh has no route Gaosheng Cui <cuigaosheng1(a)huawei.com> audit: fix undefined behavior in bit shift for AUDIT_BIT Jonas Jelonek <jelonek.jonas(a)gmail.com> wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 9 +++ arch/arm/mach-mxs/mach-mxs.c | 4 +- arch/arm64/kernel/cpu_errata.c | 25 +++++--- arch/mips/include/asm/fw/fw.h | 2 +- arch/mips/pic32/pic32mzda/early_console.c | 13 ++-- arch/mips/pic32/pic32mzda/init.c | 2 +- arch/nios2/boot/Makefile | 2 +- arch/s390/kernel/crash_dump.c | 2 +- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/kernel/cpu/tsx.c | 33 +++++----- arch/x86/mm/ioremap.c | 8 ++- arch/x86/power/cpu.c | 23 ++++--- drivers/bus/sunxi-rsb.c | 29 ++++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 8 +-- drivers/hwmon/coretemp.c | 9 ++- drivers/hwmon/i5500_temp.c | 2 +- drivers/hwmon/ibmpex.c | 1 + drivers/iio/health/afe4403.c | 5 +- drivers/iio/health/afe4404.c | 12 ++-- drivers/iio/industrialio-sw-trigger.c | 6 +- drivers/iio/light/apds9960.c | 12 ++-- drivers/iommu/dmar.c | 1 + drivers/mmc/host/sdhci.c | 71 ++++++++++++++++++---- drivers/mmc/host/sdhci.h | 12 ++-- drivers/net/can/cc770/cc770_isa.c | 10 +-- drivers/net/can/sja1000/sja1000_isa.c | 10 +-- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +- drivers/net/ethernet/mellanox/mlx4/qp.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +- .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 1 + drivers/net/ethernet/qlogic/qla3xxx.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +- drivers/net/ethernet/renesas/ravb_main.c | 1 + drivers/net/ntb_netdev.c | 9 ++- drivers/net/phy/phy_device.c | 1 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/mac80211_hwsim.c | 5 ++ drivers/nfc/st-nci/se.c | 6 +- drivers/pinctrl/pinctrl-single.c | 2 +- drivers/platform/x86/asus-wmi.c | 2 + drivers/tty/serial/8250/8250_omap.c | 7 ++- drivers/video/fbdev/pm2fb.c | 5 -- drivers/xen/platform-pci.c | 7 ++- fs/btrfs/qgroup.c | 9 +-- fs/nilfs2/dat.c | 7 +++ fs/nilfs2/sufile.c | 8 +++ include/uapi/linux/audit.h | 2 +- net/9p/trans_fd.c | 6 +- net/bluetooth/l2cap_core.c | 13 ++++ net/hsr/hsr_forward.c | 5 +- net/ipv4/Kconfig | 10 +++ net/ipv4/inet_hashtables.c | 10 +-- net/ipv6/ipv6_sockglue.c | 7 +++ net/ipv6/xfrm6_policy.c | 6 +- net/key/af_key.c | 32 +++++++--- net/mac80211/mesh_pathtbl.c | 2 +- net/nfc/nci/core.c | 2 +- net/nfc/nci/data.c | 4 +- net/packet/af_packet.c | 6 +- scripts/kconfig/symbol.c | 8 ++- sound/soc/soc-ops.c | 2 +- tools/vm/slabinfo-gnuplot.sh | 4 +- 63 files changed, 358 insertions(+), 164 deletions(-)

2 years, 1 month

6
69
0 0

[PATCH v2 1/2] drm/i915/migrate: Account for the reserved_space

by Matthew Auld

From: Chris Wilson <chris.p.wilson(a)intel.com> If the ring is nearly full when calling into emit_pte(), we might incorrectly trample the reserved_space when constructing the packet to emit the PTEs. This then triggers the GEM_BUG_ON(rq->reserved_space > ring->space) when later submitting the request, since the request itself doesn't have enough space left in the ring to emit things like workarounds, breadcrumbs etc. Testcase: igt@i915_selftests@live_emit_pte_full_ring Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7535 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6889 Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration") Signed-off-by: Chris Wilson <chris.p.wilson(a)intel.com> Signed-off-by: Matthew Auld <matthew.auld(a)intel.com> Cc: Andrzej Hajda <andrzej.hajda(a)intel.com> Cc: Nirmoy Das <nirmoy.das(a)intel.com> Cc: <stable(a)vger.kernel.org> # v5.15+ --- drivers/gpu/drm/i915/gt/intel_migrate.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c index b405a04135ca..48c3b5168558 100644 --- a/drivers/gpu/drm/i915/gt/intel_migrate.c +++ b/drivers/gpu/drm/i915/gt/intel_migrate.c @@ -342,6 +342,16 @@ static int emit_no_arbitration(struct i915_request *rq) return 0; } +static int max_pte_pkt_size(struct i915_request *rq, int pkt) +{ + struct intel_ring *ring = rq->ring; + + pkt = min_t(int, pkt, (ring->space - rq->reserved_space) / sizeof(u32) + 5); + pkt = min_t(int, pkt, (ring->size - ring->emit) / sizeof(u32) + 5); + + return pkt; +} + static int emit_pte(struct i915_request *rq, struct sgt_dma *it, enum i915_cache_level cache_level, @@ -388,8 +398,7 @@ static int emit_pte(struct i915_request *rq, return PTR_ERR(cs); /* Pack as many PTE updates as possible into a single MI command */ - pkt = min_t(int, dword_length, ring->space / sizeof(u32) + 5); - pkt = min_t(int, pkt, (ring->size - ring->emit) / sizeof(u32) + 5); + pkt = max_pte_pkt_size(rq, dword_length); hdr = cs; *cs++ = MI_STORE_DATA_IMM | REG_BIT(21); /* as qword elements */ @@ -422,8 +431,7 @@ static int emit_pte(struct i915_request *rq, } } - pkt = min_t(int, dword_rem, ring->space / sizeof(u32) + 5); - pkt = min_t(int, pkt, (ring->size - ring->emit) / sizeof(u32) + 5); + pkt = max_pte_pkt_size(rq, dword_rem); hdr = cs; *cs++ = MI_STORE_DATA_IMM | REG_BIT(21); -- 2.38.1

2 years, 1 month

2
1
0 0

[PATCH v5.10 1/1] Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled

by Lee Jones

commit 152fe65f300e1819d59b80477d3e0999b4d5d7d2 upstream. When enabled, KASAN enlarges function's stack-frames. Pushing quite a few over the current threshold. This can mainly be seen on 32-bit architectures where the present limit (when !GCC) is a lowly 1024-Bytes. Link: https://lkml.kernel.org/r/20221125120750.3537134-3-lee@kernel.org Signed-off-by: Lee Jones <lee(a)kernel.org> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: "Christian König" <christian.koenig(a)amd.com> Cc: Daniel Vetter <daniel(a)ffwll.ch> Cc: David Airlie <airlied(a)gmail.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Leo Li <sunpeng.li(a)amd.com> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Nathan Chancellor <nathan(a)kernel.org> Cc: Nick Desaulniers <ndesaulniers(a)google.com> Cc: "Pan, Xinhui" <Xinhui.Pan(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: Tom Rix <trix(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [Lee: Back-ported to linux-5.10.y] Signed-off-by: Lee Jones <lee(a)kernel.org> --- lib/Kconfig.debug | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug index ce796ca869c22..ea0628a0116d0 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug @@ -298,6 +298,7 @@ config FRAME_WARN int "Warn for stack frames larger than" range 0 8192 default 2048 if GCC_PLUGIN_LATENT_ENTROPY + default 1280 if KASAN && !64BIT default 1280 if (!64BIT && PARISC) default 1024 if (!64BIT && !PARISC) default 2048 if 64BIT -- 2.39.0.rc0.267.gcb52ba06e7-goog

2 years, 1 month

1
0
0 0

[PATCH 6.0 000/127] 6.0.12-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.0.12 release. There are 127 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 08 Dec 2022 12:40:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.12-rc2… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.0.12-rc2 Linus Torvalds <torvalds(a)linux-foundation.org> proc: proc_skip_spaces() shouldn't think it is working on C strings Linus Torvalds <torvalds(a)linux-foundation.org> proc: avoid integer type confusion in get_proc_long Jann Horn <jannh(a)google.com> ipc/sem: Fix dangling sem_array access in semtimedop race Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/bpf/32: Fix Oops on tail call tests Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() Jan Dabros <jsd(a)semihalf.com> char: tpm: Protect tpm_pm_suspend with locks Conor Dooley <conor.dooley(a)microchip.com> Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" Vishal Verma <vishal.l.verma(a)intel.com> ACPI: HMAT: Fix initiator registration for single-initiator systems Vishal Verma <vishal.l.verma(a)intel.com> ACPI: HMAT: remove unnecessary variable initialization Andrew Lunn <andrew(a)lunn.ch> i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set Wang Yufen <wangyufen(a)huawei.com> i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer Yuan Can <yuancan(a)huawei.com> i2c: npcm7xx: Fix error handling in npcm_i2c_init() Ricardo Ribalda <ribalda(a)chromium.org> i2c: Restore initial power state if probe fails SeongJae Park <sj(a)kernel.org> mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes() Yajun Deng <yajun.deng(a)linux.dev> mm/damon: introduce struct damos_access_pattern Ido Schimmel <idosch(a)nvidia.com> ipv4: Fix route deletion when nexthop info is not specified David Ahern <dsahern(a)kernel.org> ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in has_external_pci() Caleb Sander <csander(a)purestorage.com> nvme: fix SRCU protection of nvme_ns_head list Guo Ren <guoren(a)kernel.org> riscv: kexec: Fixup crash_smp_send_stop without multi cores Guo Ren <guoren(a)kernel.org> riscv: kexec: Fixup irq controller broken in kexec crash path Jisheng Zhang <jszhang(a)kernel.org> riscv: fix race when vmap stack overflow Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Sync efi page table's kernel mappings before switching Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: Fix potential division by zero Hui Tang <tanghui20(a)huawei.com> ASoC: tlv320adc3xxx: Fix build error for implicit function declaration Mark Brown <broonie(a)kernel.org> ASoC: ops: Fix bounds check for _sx controls Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Free buffers when a used dynamic event is removed Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Fix race where histograms can be called before the event Daniel Bristot de Oliveira <bristot(a)kernel.org> tracing/osnoise: Fix duration type Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Never return 0 if not all requests retired Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix negative value passed as remaining time Leo Liu <leo.liu(a)amd.com> drm/amdgpu: enable Vangogh VCN indirect sram mode Lee Jones <lee(a)kernel.org> drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame Lee Jones <lee(a)kernel.org> Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled Adrian Hunter <adrian.hunter(a)intel.com> mmc: sdhci: Fix voltage switch delay Wenchao Chen <wenchao.chen(a)unisoc.com> mmc: sdhci-sprd: Fix no reset data and command after voltage switch Sebastian Falbesoner <sebastian.falbesoner(a)gmail.com> mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check Christian Löhle <CLoehle(a)hyperstone.com> mmc: core: Fix ambiguous TRIM and DISCARD arg Gaosheng Cui <cuigaosheng1(a)huawei.com> mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse() Ye Bin <yebin10(a)huawei.com> mmc: mmc_test: Fix removal of debugfs file Goh, Wei Sheng <wei.sheng.goh(a)intel.com> net: stmmac: Set MAC's flow control register to reflect current settings Gavin Shan <gshan(a)redhat.com> mm: migrate: fix THP's mapcount on isolation Linus Torvalds <torvalds(a)linux-foundation.org> v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Save and restore pins in "direct IRQ" mode Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 ZhangPeng <zhangpeng362(a)huawei.com> nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Tiezhu Yang <yangtiezhu(a)loongson.cn> tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" Steven Rostedt (Google) <rostedt(a)goodmis.org> error-injection: Add prompt for function error injection Ziyang Xuan <william.xuanziyang(a)huawei.com> can: can327: can327_feed_frame_to_netdev(): fix potential skb leak when netdev is down Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: dice: fix regression for Lexicon I-ONIX FW810S Björn Töpel <bjorn(a)rivosinc.com> riscv: mm: Proper page permissions after initmem free Jisheng Zhang <jszhang(a)kernel.org> riscv: vdso: fix section overlapping under some conditions Yuan Can <yuancan(a)huawei.com> hwmon: (asus-ec-sensors) Add checks for devm_kcalloc Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() Phil Auld <pauld(a)redhat.com> hwmon: (coretemp) Check for null before removing sysfs attrs Marc Dionne <marc.dionne(a)auristor.com> afs: Fix server->active leak in afs_put_server Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed Zhengchao Shao <shaozhengchao(a)huawei.com> sctp: fix memory leak in sctp_stream_outq_migrate() Willem de Bruijn <willemb(a)google.com> packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE Chris Mi <cmi(a)nvidia.com> net/mlx5: Lag, Fix for loop when checking lag Shigeru Yoshida <syoshida(a)redhat.com> net: tun: Fix use-after-free in tun_detach() David Howells <dhowells(a)redhat.com> afs: Fix fileserver probe RTT handling Yang Yingliang <yangyingliang(a)huawei.com> net: mdiobus: fix unbalanced node reference count YueHaibing <yuehaibing(a)huawei.com> net: hsr: Fix potential use-after-free Xin Long <lucien.xin(a)gmail.com> tipc: re-fetch skb cb after tipc_msg_validate Paolo Abeni <pabeni(a)redhat.com> mptcp: fix sleep in atomic at close time Menglong Dong <imagedong(a)tencent.com> mptcp: don't orphan ssk in mptcp_close() Jerry Ray <jerry.ray(a)microchip.com> dsa: lan9303: Correct stat name M Chetan Kumar <m.chetan.kumar(a)linux.intel.com> net: wwan: iosm: fix incorrect skb length M Chetan Kumar <m.chetan.kumar(a)linux.intel.com> net: wwan: iosm: fix crash in peek throughput test M Chetan Kumar <m.chetan.kumar(a)linux.intel.com> net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type M Chetan Kumar <m.chetan.kumar(a)linux.intel.com> net: wwan: iosm: fix kernel test robot reported error Yuri Karpov <YKarpov(a)ispras.ru> net: ethernet: nixge: fix NULL dereference Wang Hai <wanghai38(a)huawei.com> net/9p: Fix a potential socket leak in p9_socket_open Yuan Can <yuancan(a)huawei.com> net: net_netdev: Fix error handling in ntb_netdev_init_module() Zhang Changzhong <zhangchangzhong(a)huawei.com> net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() Yang Yingliang <yangyingliang(a)huawei.com> net: phy: fix null-ptr-deref while probe() failed Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: don't allow multi-BSSID in S1G Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: fix buffer overflow in elem comparison Izabela Bakollari <ibakolla(a)redhat.com> aquantia: Do not purge addresses when setting the number of rings Duoming Zhou <duoming(a)zju.edu.cn> qlcnic: fix sleep-in-atomic-context bugs caused by msleep Amir Goldstein <amir73il(a)gmail.com> vfs: fix copy_file_range() averts filesystem freeze protection Jiasheng Jiang <jiasheng(a)iscas.ac.cn> can: m_can: Add check for devm_clk_get Zhang Changzhong <zhangchangzhong(a)huawei.com> can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods Zhang Changzhong <zhangchangzhong(a)huawei.com> can: etas_es58x: es58x_init_netdev(): free netdev when register_candev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: cc770: cc770_isa_probe(): add missing free_cc770dev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() Roi Dayan <roid(a)nvidia.com> net/mlx5e: Fix use-after-free when reverting termination table YueHaibing <yuehaibing(a)huawei.com> net/mlx5: Fix uninitialized variable bug in outlen_write() Chris Mi <cmi(a)nvidia.com> net/mlx5: E-switch, Fix duplicate lag creation Chris Mi <cmi(a)nvidia.com> net/mlx5: E-switch, Destroy legacy fdb table when needed YueHaibing <yuehaibing(a)huawei.com> net/mlx5: DR, Fix uninitialized var warning Wang Hai <wanghai38(a)huawei.com> e100: Fix possible use after free in e100_xmit_prepare Yuan Can <yuancan(a)huawei.com> iavf: Fix error handling in iavf_init_module() Yuan Can <yuancan(a)huawei.com> fm10k: Fix error handling in fm10k_init_module() Shang XiaoJing <shangxiaojing(a)huawei.com> i40e: Fix error handling in i40e_init_module() Shang XiaoJing <shangxiaojing(a)huawei.com> ixgbevf: Fix resource leak in ixgbevf_init_module() Shazad Hussain <quic_shazhuss(a)quicinc.com> clk: qcom: gcc-sc8280xp: add cxo as parent for three ufs ref clks Yang Yingliang <yangyingliang(a)huawei.com> of: property: decrement node refcount in of_fwnode_get_reference_args() Wei Yongjun <weiyongjun1(a)huawei.com> nvmem: rmem: Fix return value check in rmem_read() Xu Kuohai <xukuohai(a)huawei.com> bpf: Do not copy spin lock field from user in bpf_selem_alloc Joe Korty <joe.korty(a)concurrent-rt.com> clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL register math error Gaosheng Cui <cuigaosheng1(a)huawei.com> hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (i5500_temp) fix missing pci_disable_device() Ninad Malwade <nmalwade(a)nvidia.com> hwmon: (ina3221) Fix shunt sum critical calculation Derek Nguyen <derek.nguyen(a)collins.com> hwmon: (ltc2947) fix temperature scaling Hou Tao <houtao1(a)huawei.com> libbpf: Handle size overflow for ringbuf mmap Michael Grzeschik <m.grzeschik(a)pengutronix.de> ARM: at91: rm9200: fix usb device clock id Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> scripts/faddr2line: Fix regression in name resolution on ppc64le Hou Tao <houtao1(a)huawei.com> bpf, perf: Use subprog name when reporting subprog ksymbol Jiri Olsa <jolsa(a)kernel.org> libbpf: Use correct return pointer in attach_raw_tp Paul Gazzillo <paul(a)pgazz.com> iio: light: rpr0521: add missing Kconfig dependencies Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4403: Fix oob read in afe4403_read_raw Stephen Boyd <swboyd(a)chromium.org> clk: qcom: gdsc: Remove direct runtime PM calls Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: gdsc: add missing error handling David Virag <virag.david003(a)gmail.com> clk: samsung: exynos7885: Correct "div4" clock parents lyndonli <Lyndon.Li(a)amd.com> drm/amd/pm: update driver if header for smu_13_0_7 Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/pm: update driver-if header for smu_v13_0_10 Yang Wang <KevinYang.Wang(a)amd.com> drm/amd/pm: add smu_v13_0_10 driver if version Sam James <sam(a)gentoo.org> kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix userptr HMM range handling v2 Christian König <christian.koenig(a)amd.com> drm/amdgpu: cleanup error handling in amdgpu_cs_parser_bos Christian König <christian.koenig(a)amd.com> drm/amdgpu: move setting the job resources ChenXiaoSong <chenxiaosong2(a)huawei.com> btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/at91rm9200.dtsi | 2 +- arch/powerpc/net/bpf_jit_comp32.c | 52 ++++----- arch/riscv/include/asm/asm.h | 1 + arch/riscv/include/asm/efi.h | 6 +- arch/riscv/include/asm/pgalloc.h | 11 +- arch/riscv/include/asm/smp.h | 3 + arch/riscv/kernel/entry.S | 13 +++ arch/riscv/kernel/machine_kexec.c | 46 ++++++-- arch/riscv/kernel/setup.c | 9 +- arch/riscv/kernel/smp.c | 97 ++++++++++++++++- arch/riscv/kernel/traps.c | 18 ++++ arch/riscv/kernel/vdso/Makefile | 1 + arch/x86/include/asm/nospec-branch.h | 2 +- arch/x86/kernel/cpu/bugs.c | 21 ++-- arch/x86/kernel/process.c | 2 +- drivers/acpi/numa/hmat.c | 27 +++-- drivers/char/tpm/tpm-interface.c | 5 +- drivers/clk/at91/at91rm9200.c | 2 +- drivers/clk/qcom/gcc-sc8280xp.c | 6 ++ drivers/clk/qcom/gdsc.c | 70 +++--------- drivers/clk/qcom/gdsc.h | 2 - drivers/clk/samsung/clk-exynos7885.c | 4 +- drivers/clocksource/arm_arch_timer.c | 7 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 12 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 60 ++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 17 +++ drivers/gpu/drm/amd/amdgpu/amdgpu_job.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 53 +++------- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 14 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 3 + drivers/gpu/drm/amd/display/Kconfig | 7 ++ .../pm/swsmu/inc/pmfw_if/smu13_driver_if_v13_0_0.h | 111 +++++++++++++------ .../pm/swsmu/inc/pmfw_if/smu13_driver_if_v13_0_7.h | 117 ++++++++++++++------- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 3 +- drivers/gpu/drm/i915/gt/intel_gt.c | 9 +- drivers/gpu/drm/i915/gt/intel_gt_requests.c | 2 +- drivers/hwmon/asus-ec-sensors.c | 2 + drivers/hwmon/coretemp.c | 9 +- drivers/hwmon/i5500_temp.c | 2 +- drivers/hwmon/ibmpex.c | 1 + drivers/hwmon/ina3221.c | 4 +- drivers/hwmon/ltc2947-core.c | 2 +- drivers/i2c/busses/i2c-imx.c | 6 +- drivers/i2c/busses/i2c-npcm7xx.c | 11 +- drivers/i2c/busses/i2c-qcom-geni.c | 1 - drivers/i2c/i2c-core-base.c | 9 +- drivers/iio/health/afe4403.c | 5 +- drivers/iio/health/afe4404.c | 12 ++- drivers/iio/light/Kconfig | 2 + drivers/input/touchscreen/raydium_i2c_ts.c | 4 +- drivers/iommu/intel/dmar.c | 1 + drivers/iommu/intel/iommu.c | 4 +- drivers/media/common/videobuf2/frame_vector.c | 68 +++--------- drivers/mmc/core/core.c | 9 +- drivers/mmc/core/mmc_test.c | 3 +- drivers/mmc/host/mtk-sd.c | 6 +- drivers/mmc/host/sdhci-esdhc-imx.c | 2 +- drivers/mmc/host/sdhci-sprd.c | 4 +- drivers/mmc/host/sdhci.c | 61 +++++++++-- drivers/mmc/host/sdhci.h | 2 + drivers/net/can/can327.c | 4 +- drivers/net/can/cc770/cc770_isa.c | 10 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/can/m_can/m_can_pci.c | 9 +- drivers/net/can/sja1000/sja1000_isa.c | 10 +- drivers/net/can/usb/etas_es58x/es58x_core.c | 5 +- drivers/net/dsa/lan9303-core.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 5 +- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 4 +- drivers/net/ethernet/aquantia/atlantic/aq_main.h | 2 + drivers/net/ethernet/intel/e100.c | 5 +- drivers/net/ethernet/intel/fm10k/fm10k_main.c | 10 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 11 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 9 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 8 ++ .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 7 ++ .../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 9 +- .../mellanox/mlx5/core/steering/dr_table.c | 5 +- drivers/net/ethernet/ni/nixge.c | 29 ++--- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +- drivers/net/ethernet/renesas/ravb_main.c | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 ++- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- drivers/net/mdio/fwnode_mdio.c | 2 +- drivers/net/ntb_netdev.c | 9 +- drivers/net/phy/phy_device.c | 2 + drivers/net/tun.c | 4 +- drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 26 ++--- drivers/net/wwan/iosm/iosm_ipc_protocol.h | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/multipath.c | 3 + drivers/nvmem/rmem.c | 4 +- drivers/of/property.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 27 ++++- drivers/pinctrl/pinctrl-single.c | 2 +- fs/afs/fs_probe.c | 4 +- fs/afs/server.c | 2 +- fs/btrfs/qgroup.c | 9 +- fs/ksmbd/vfs.c | 6 +- fs/nfsd/vfs.c | 4 +- fs/nilfs2/dat.c | 7 ++ fs/read_write.c | 19 +++- include/linux/damon.h | 37 ++++--- include/linux/fs.h | 8 ++ include/linux/license.h | 2 + include/linux/mmc/mmc.h | 2 +- include/net/sctp/stream_sched.h | 2 + ipc/sem.c | 3 +- kernel/bpf/bpf_local_storage.c | 2 +- kernel/events/core.c | 2 +- kernel/sysctl.c | 30 +++--- kernel/trace/trace_dynevent.c | 2 + kernel/trace/trace_events.c | 11 +- kernel/trace/trace_events_hist.c | 3 + kernel/trace/trace_osnoise.c | 6 +- lib/Kconfig.debug | 9 +- mm/compaction.c | 22 ++-- mm/damon/core.c | 31 +++--- mm/damon/dbgfs.c | 27 +++-- mm/damon/lru_sort.c | 46 ++++---- mm/damon/reclaim.c | 23 ++-- mm/damon/sysfs.c | 63 +++++++++-- net/9p/trans_fd.c | 4 +- net/hsr/hsr_forward.c | 5 +- net/ipv4/fib_semantics.c | 10 +- net/mac80211/airtime.c | 3 + net/mptcp/protocol.c | 13 ++- net/mptcp/subflow.c | 6 +- net/packet/af_packet.c | 6 +- net/sctp/stream.c | 25 +++-- net/sctp/stream_sched.c | 5 + net/sctp/stream_sched_prio.c | 19 ++++ net/sctp/stream_sched_rr.c | 5 + net/tipc/crypto.c | 3 + net/wireless/scan.c | 10 +- scripts/faddr2line | 7 +- sound/firewire/dice/dice-stream.c | 12 ++- sound/soc/codecs/tlv320adc3xxx.c | 3 + sound/soc/soc-ops.c | 2 +- tools/lib/bpf/libbpf.c | 2 +- tools/lib/bpf/ringbuf.c | 12 ++- tools/testing/selftests/net/fib_nexthops.sh | 16 +++ tools/vm/slabinfo-gnuplot.sh | 4 +- 154 files changed, 1253 insertions(+), 642 deletions(-)

2 years, 1 month

1
0
0 0

[PATCH 4.14 0/2] x86/speculation: Regression fixes

by Ben Hutchings

Fix two regressions introudced by recent speculation mitigations on the 4.14 branch: - Crash on older 32-bit processors - Build warning from objtool Ben. Ben Hutchings (1): Revert "x86/speculation: Change FILL_RETURN_BUFFER to work with objtool" Peter Zijlstra (1): x86/nospec: Fix i386 RSB stuffing arch/x86/include/asm/nospec-branch.h | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)

2 years, 1 month

3
3
0 0

[PATCH 4.19] Revert "x86/speculation: Change FILL_RETURN_BUFFER to work with objtool"

by Ben Hutchings

This reverts commit 9f3330d4930e034d84ee6561fbfb098433ff0ab9, which was commit 089dd8e53126ebaf506e2dc0bf89d652c36bfc12 upstream. The necessary changes to objtool have not been backported to 4.19. Backporting this commit alone only added build warnings. Signed-off-by: Ben Hutchings <ben(a)decadent.org.uk> --- arch/x86/include/asm/nospec-branch.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 64b086c47b4a..0f99dda233a5 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -4,13 +4,11 @@ #define _ASM_X86_NOSPEC_BRANCH_H_ #include <linux/static_key.h> -#include <linux/frame.h> #include <asm/alternative.h> #include <asm/alternative-asm.h> #include <asm/cpufeatures.h> #include <asm/msr-index.h> -#include <asm/unwind_hints.h> #include <asm/percpu.h> /* @@ -54,9 +52,9 @@ lfence; \ jmp 775b; \ 774: \ - add $(BITS_PER_LONG/8) * 2, sp; \ dec reg; \ jnz 771b; \ + add $(BITS_PER_LONG/8) * nr, sp; \ /* barrier for jnz misprediction */ \ lfence; #else @@ -167,8 +165,10 @@ * monstrosity above, manually. */ .macro FILL_RETURN_BUFFER reg:req nr:req ftr:req - ALTERNATIVE "jmp .Lskip_rsb_\@", "", \ftr - __FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP) + ANNOTATE_NOSPEC_ALTERNATIVE + ALTERNATIVE "jmp .Lskip_rsb_\@", \ + __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)) \ + \ftr .Lskip_rsb_\@: .endm

2 years, 1 month

2
1
0 0

[PATCH v2 net 0/2] vmxnet3: couple of fixes

by Ronak Doshi

This series fixes following issues: Patch 1: This patch provides a fix to correctly report encapsulated LRO'ed packet. Patch 2: This patch provides a fix to use correct intrConf reference. Changes in v2: - declare generic descriptor to be used - remove white spaces - remove single quote around commit reference in patch 2 - remove if check for encap_lro Ronak Doshi (2): vmxnet3: correctly report encapsulated LRO packet vmxnet3: use correct intrConf reference when using extended queues drivers/net/vmxnet3/vmxnet3_drv.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) -- 2.11.0

2 years, 1 month

3
4
0 0

FAILED: patch "[PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b52be557e24c47286738276121177a41f54e3b83 Mon Sep 17 00:00:00 2001 From: Jann Horn <jannh(a)google.com> Date: Mon, 5 Dec 2022 17:59:27 +0100 Subject: [PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race When __do_semtimedop() goes to sleep because it has to wait for a semaphore value becoming zero or becoming bigger than some threshold, it links the on-stack sem_queue to the sem_array, then goes to sleep without holding a reference on the sem_array. When __do_semtimedop() comes back out of sleep, one of two things must happen: a) We prove that the on-stack sem_queue has been disconnected from the (possibly freed) sem_array, making it safe to return from the stack frame that the sem_queue exists in. b) We stabilize our reference to the sem_array, lock the sem_array, and detach the sem_queue from the sem_array ourselves. sem_array has RCU lifetime, so for case (b), the reference can be stabilized inside an RCU read-side critical section by locklessly checking whether the sem_queue is still connected to the sem_array. However, the current code does the lockless check on sem_queue before starting an RCU read-side critical section, so the result of the lockless check immediately becomes useless. Fix it by doing rcu_read_lock() before the lockless check. Now RCU ensures that if we observe the object being on our queue, the object can't be freed until rcu_read_unlock(). This bug is only hittable on kernel builds with full preemption support (either CONFIG_PREEMPT or PREEMPT_DYNAMIC with preempt=full). Fixes: 370b262c896e ("ipc/sem: avoid idr tree lookup for interrupted semop") Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/ipc/sem.c b/ipc/sem.c index c8496f98b139..00f88aa01ac5 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -2179,14 +2179,15 @@ long __do_semtimedop(int semid, struct sembuf *sops, * scenarios where we were awakened externally, during the * window between wake_q_add() and wake_up_q(). */ + rcu_read_lock(); error = READ_ONCE(queue.status); if (error != -EINTR) { /* see SEM_BARRIER_2 for purpose/pairing */ smp_acquire__after_ctrl_dep(); + rcu_read_unlock(); goto out; } - rcu_read_lock(); locknum = sem_lock(sma, sops, nsops); if (!ipc_valid_object(&sma->sem_perm))

2 years, 1 month

2
1
0 0

FAILED: patch "[PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b52be557e24c47286738276121177a41f54e3b83 Mon Sep 17 00:00:00 2001 From: Jann Horn <jannh(a)google.com> Date: Mon, 5 Dec 2022 17:59:27 +0100 Subject: [PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race When __do_semtimedop() goes to sleep because it has to wait for a semaphore value becoming zero or becoming bigger than some threshold, it links the on-stack sem_queue to the sem_array, then goes to sleep without holding a reference on the sem_array. When __do_semtimedop() comes back out of sleep, one of two things must happen: a) We prove that the on-stack sem_queue has been disconnected from the (possibly freed) sem_array, making it safe to return from the stack frame that the sem_queue exists in. b) We stabilize our reference to the sem_array, lock the sem_array, and detach the sem_queue from the sem_array ourselves. sem_array has RCU lifetime, so for case (b), the reference can be stabilized inside an RCU read-side critical section by locklessly checking whether the sem_queue is still connected to the sem_array. However, the current code does the lockless check on sem_queue before starting an RCU read-side critical section, so the result of the lockless check immediately becomes useless. Fix it by doing rcu_read_lock() before the lockless check. Now RCU ensures that if we observe the object being on our queue, the object can't be freed until rcu_read_unlock(). This bug is only hittable on kernel builds with full preemption support (either CONFIG_PREEMPT or PREEMPT_DYNAMIC with preempt=full). Fixes: 370b262c896e ("ipc/sem: avoid idr tree lookup for interrupted semop") Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/ipc/sem.c b/ipc/sem.c index c8496f98b139..00f88aa01ac5 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -2179,14 +2179,15 @@ long __do_semtimedop(int semid, struct sembuf *sops, * scenarios where we were awakened externally, during the * window between wake_q_add() and wake_up_q(). */ + rcu_read_lock(); error = READ_ONCE(queue.status); if (error != -EINTR) { /* see SEM_BARRIER_2 for purpose/pairing */ smp_acquire__after_ctrl_dep(); + rcu_read_unlock(); goto out; } - rcu_read_lock(); locknum = sem_lock(sma, sops, nsops); if (!ipc_valid_object(&sma->sem_perm))

2 years, 1 month

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2022