Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral
if extcon is present") Dual Role support on Intel Merrifield platform
broke due to rearranging the call to dwc3_get_extcon().
It appears to be caused by ulpi_read_id() on the first test write failing
with -ETIMEDOUT. Currently ulpi_read_id() expects to discover the phy via
DT when the test write fails and returns 0 in that case, even if DT does not
provide the phy. As a result usb probe completes without phy.
Make ulpi_read_id() return -ETIMEDOUT to its user if the first test write
fails. The user should then handle it appropriately. A follow up patch
will make dwc3_core_init() set -EPROBE_DEFER in this case and bail out.
Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT")
Cc: stable(a)vger.kernel.org
Signed-off-by: Ferry Toth <ftoth(a)exalondelft.nl>
---
drivers/usb/common/ulpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
index d7c8461976ce..60e8174686a1 100644
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -207,7 +207,7 @@ static int ulpi_read_id(struct ulpi *ulpi)
/* Test the interface */
ret = ulpi_write(ulpi, ULPI_SCRATCH, 0xaa);
if (ret < 0)
- goto err;
+ return ret;
ret = ulpi_read(ulpi, ULPI_SCRATCH);
if (ret < 0)
--
2.37.2
From: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
This is the fix proposed by Chuansheng Liu <chuansheng.liu(a)intel.com> to
close a memory leak caused by refactoring done in 786555987207
("drm/i915/gem: Store mmap_offsets in an rbtree rather than a plain list").
Original commit text from Liu was this:
>
> The below memory leak information is caught:
>
> unreferenced object 0xffff997dd4e3b240 (size 64):
> comm "gem_tiled_fence", pid 10332, jiffies 4294959326 (age 220778.420s)
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 be f2 d4 7d 99 ff ff ............}...
> backtrace:
> [<ffffffffa0f04365>] kmem_cache_alloc_trace+0x2e5/0x450
> [<ffffffffc062f3ac>] drm_vma_node_allow+0x2c/0xe0 [drm]
> [<ffffffffc13149ea>] __assign_mmap_offset_handle+0x1da/0x4a0 [i915]
> [<ffffffffc1315235>] i915_gem_mmap_offset_ioctl+0x55/0xb0 [i915]
> [<ffffffffc06207e4>] drm_ioctl_kernel+0xb4/0x140 [drm]
> [<ffffffffc0620ac7>] drm_ioctl+0x257/0x410 [drm]
> [<ffffffffa0f553ae>] __x64_sys_ioctl+0x8e/0xc0
> [<ffffffffa1821128>] do_syscall_64+0x38/0xc0
> [<ffffffffa1a0007c>] entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> The issue is always reproduced with the test:
> gem_tiled_fence_blits --run-subtest basic
>
> It tries to mmap_gtt the same object several times, it is like:
> create BO
> mmap_gtt BO
> unmap BO
> mmap_gtt BO <== second time mmap_gtt
> unmap
> close BO
>
> The leak happens at the second time mmap_gtt in function
> mmap_offset_attach(),it will simply increase the reference
> count to 2 by calling drm_vma_node_allow() directly since
> the mmo has been created at the first time.
>
> However the driver just revokes the vma_node only one time
> when closing the object, it leads to memory leak easily.
>
> This patch is to fix the memory leak by calling drm_vma_node_allow() one
> time also.
Issue was later also reported by Mirsad:
>
> The problem is a kernel memory leak that is repeatedly occurring
> triggered during the execution of Chrome browser under the latest
> 6.1.0+ kernel of this morning and Almalinux 8.6 on a Lenovo
> desktop box with Intel(R) Core(TM) i5-8400 CPU @ 2.80GHz CPU.
>
> The build is with KMEMLEAK, KASAN and MGLRU turned on during the
> build, on a vanilla mainline kernel from Mr. Torvalds' tree.
>
> The leaks look like this one:
>
> unreferenced object 0xffff888131754880 (size 64):
> comm "chrome", pid 13058, jiffies 4298568878 (age 3708.084s)
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 80 1e 3e 83 88 ff ff ...........>....
> backtrace:
> [<ffffffff9e9b5542>] slab_post_alloc_hook+0xb2/0x340
> [<ffffffff9e9bbf5f>] __kmem_cache_alloc_node+0x1bf/0x2c0
> [<ffffffff9e8f767a>] kmalloc_trace+0x2a/0xb0
> [<ffffffffc08dfde5>] drm_vma_node_allow+0x45/0x150 [drm]
> [<ffffffffc0b33315>] __assign_mmap_offset_handle+0x615/0x820 [i915]
> [<ffffffffc0b34057>] i915_gem_mmap_offset_ioctl+0x77/0x110 [i915]
> [<ffffffffc08bc5e1>] drm_ioctl_kernel+0x181/0x280 [drm]
> [<ffffffffc08bc9cd>] drm_ioctl+0x2dd/0x6a0 [drm]
> [<ffffffff9ea54744>] __x64_sys_ioctl+0xc4/0x100
> [<ffffffff9fbc0178>] do_syscall_64+0x58/0x80
> [<ffffffff9fc000aa>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
>
Root cause is that 786555987207 started caching (and sharing) the
i915_mmap_offset objects per object and same mmap type. This means that
reference count incremented by drm_vma_node_allow could grow beyond one,
while the object closure path calls drm_vma_node_revoke only once and
so the structure leaks.
Secondary effect from this, which is also different than what we had
before 786555987207 is that it is now possible to mmap an offset belonging
to a closed object.
Fix here is to partially revert to behaviour before 786555987207 - that is
to disallow mmap of closed objects and to only increment the mmap offset
ref count once per object-type.
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
Co-developed-by: Chuansheng Liu <chuansheng.liu(a)intel.com>
Fixes: 786555987207 ("drm/i915/gem: Store mmap_offsets in an rbtree rather than a plain list")
Reported-by: Mirsad Todorovac <mirsad.todorovac(a)alu.unizg.hr>
Tested-by: Mirsad Todorovac <mirsad.todorovac(a)alu.unizg.hr>
Testcase: igt@gem_mmap_gtt@mmap-closed-bo
Cc: Matthew Auld <matthew.auld(a)intel.com>
Cc: "Thomas Hellström" <thomas.hellstrom(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> # v5.7+
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
---
Test-with: 20221222100403.256775-1-tvrtko.ursulin(a)linux.intel.com
---
drivers/gpu/drm/i915/gem/i915_gem_mman.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
index d73ba0f5c4c5..1ceff19a0ac0 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
@@ -695,9 +695,10 @@ mmap_offset_attach(struct drm_i915_gem_object *obj,
insert:
mmo = insert_mmo(obj, mmo);
GEM_BUG_ON(lookup_mmo(obj, mmap_type) != mmo);
-out:
+
if (file)
drm_vma_node_allow(&mmo->vma_node, file);
+out:
return mmo;
err:
--
2.34.1
--
Hello,
I tried e-mailing you more than twice but my email bounced back
failure, Note this, soonest you receive this email revert to me before
I deliver the message it's importunate, pressing, crucial. Await your
response.
Best regards
Dr. Michelle Daniel
Good morning, my name is Aisha Al-Gaddafi.
Please, I have an investment Project transaction of US$27.500.000.00.
that involves transfer and I would like to have your advice on which
Investment / Industry that you think that can bring us profit.
If you're interested, kindly reply for more specific information on
this project.
Thanks,
Mr. Aisha Al-Gaddafi.
This is the start of the stable review cycle for the 6.1.1 release.
There are 25 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 21 Dec 2022 18:29:31 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.1-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.1-rc1
Ferry Toth <ftoth(a)exalondelft.nl>
usb: ulpi: defer ulpi_register on ulpi_read_id timeout
Nikolaus Voss <nikolaus.voss(a)haag-streit.com>
KEYS: encrypted: fix key instantiation with user-provided data
Paulo Alcantara <pc(a)cjr.nz>
cifs: fix oops during encryption
Shruthi Sanil <shruthi.sanil(a)intel.com>
usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system for Raptor Lake
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
usb: typec: ucsi: Resume in separate work
Tony Nguyen <anthony.l.nguyen(a)intel.com>
igb: Initialize mailbox message for VF reset
Martin Kaiser <martin(a)kaiser.cx>
staging: r8188eu: fix led register settings
Reka Norman <rekanorman(a)chromium.org>
xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
Andy Chi <andy.chi(a)canonical.com>
ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
Johan Hovold <johan(a)kernel.org>
USB: serial: f81534: fix division by zero on line-speed change
Johan Hovold <johan(a)kernel.org>
USB: serial: f81232: fix division by zero on line-speed change
Bruno Thomsen <bruno.thomsen(a)gmail.com>
USB: serial: cp210x: add Kamstrup RF sniffer PIDs
Duke Xin <duke_xinanwen(a)163.com>
USB: serial: option: add Quectel EM05-G modem
Szymon Heidrich <szymon.heidrich(a)gmail.com>
usb: gadget: uvc: Prevent buffer overflow in setup handler
Jan Kara <jack(a)suse.cz>
udf: Fix extending file within last block
Jan Kara <jack(a)suse.cz>
udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size
Jan Kara <jack(a)suse.cz>
udf: Fix preallocation discarding at indirect extent boundary
Jan Kara <jack(a)suse.cz>
udf: Discard preallocation before extending file with a hole
Sean Anderson <sean.anderson(a)seco.com>
irqchip/ls-extirq: Fix endianness detection
John Thomson <git(a)johnthomson.fastmail.com.au>
mips: ralink: mt7621: do not use kzalloc too early
John Thomson <git(a)johnthomson.fastmail.com.au>
mips: ralink: mt7621: soc queries and tests as functions
John Thomson <git(a)johnthomson.fastmail.com.au>
mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem
John Thomson <git(a)johnthomson.fastmail.com.au>
PCI: mt7621: Add sentinel to quirks table
David Michael <fedora.dm0(a)gmail.com>
libbpf: Fix uninitialized warning in btf_dump_dump_type_data
Nathan Chancellor <nathan(a)kernel.org>
x86/vdso: Conditionally export __vdso_sgx_enter_enclave()
-------------
Diffstat:
Documentation/security/keys/trusted-encrypted.rst | 3 +-
Makefile | 4 +-
arch/mips/include/asm/mach-ralink/mt7621.h | 4 +-
arch/mips/ralink/mt7621.c | 97 ++++++++++-----
arch/x86/entry/vdso/vdso.lds.S | 2 +
drivers/irqchip/irq-ls-extirq.c | 2 +-
drivers/net/ethernet/intel/igb/igb_main.c | 2 +-
drivers/pci/controller/pcie-mt7621.c | 3 +-
drivers/staging/r8188eu/core/rtw_led.c | 25 +---
drivers/usb/common/ulpi.c | 2 +-
drivers/usb/dwc3/dwc3-pci.c | 2 +-
drivers/usb/gadget/function/f_uvc.c | 5 +-
drivers/usb/host/xhci-pci.c | 4 +-
drivers/usb/serial/cp210x.c | 2 +
drivers/usb/serial/f81232.c | 12 +-
drivers/usb/serial/f81534.c | 12 +-
drivers/usb/serial/option.c | 3 +
drivers/usb/typec/ucsi/ucsi.c | 17 ++-
drivers/usb/typec/ucsi/ucsi.h | 1 +
fs/cifs/cifsglob.h | 68 ++++++++++
fs/cifs/cifsproto.h | 4 +-
fs/cifs/misc.c | 4 +-
fs/cifs/smb2ops.c | 143 ++++++++++------------
fs/udf/inode.c | 76 +++++-------
fs/udf/truncate.c | 48 +++-----
security/keys/encrypted-keys/encrypted.c | 6 +-
sound/pci/hda/patch_realtek.c | 2 +
tools/lib/bpf/btf_dump.c | 2 +-
28 files changed, 319 insertions(+), 236 deletions(-)