June 2022 - Linux-stable-mirror

Bug report: ntfs_read_block may crash system

by xu xin

From Zeal Robot <zealci(a)zte.com.cn> Hi! Zeal Robot found a potential risky bug about NTFS under the help of syzkaller. This will cause OS crash when CONFIG_NTFS_FS is set and panic_on_oops is on. We have a reproducer below and Debug log. ============================================================================= Debugging log: ============================================================================= [ 101.384038] kernel BUG at fs/ntfs/aops.c:186! [ 101.386267] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 101.387099] PKRU: 55555554 [ 101.387099] Call Trace: [ 101.387099] <TASK> [ 101.387099] ? ntfs_end_buffer_async_read+0xb20/0xb20 [ 101.387099] ? filemap_add_folio+0x115/0x180 [ 101.387099] ? add_to_page_cache_locked+0x90/0x90 [ 101.387099] do_read_cache_folio+0x4d4/0x950 [ 101.387099] ? generic_file_read_iter+0x4f0/0x4f0 [ 101.387099] ? _extract_crng.constprop.0+0xc1/0xf0 [ 101.387099] ? ntfs_attr_find+0x649/0xa90 [ 101.387099] ? __kasan_check_write+0x15/0x20 [ 101.387099] read_cache_page+0x6c/0x150 [ 101.387099] map_mft_record+0x1a5/0x960 [ 101.387099] ntfs_read_locked_inode+0x1a7/0x58b0 [ 101.387099] ? ntfs_mapping_pairs_decompress+0x79e/0x1030 [ 101.387099] ? ntfs_attr_reinit_search_ctx+0x14e/0x430 [ 101.387099] ntfs_read_inode_mount+0xb72/0x2170 [ 101.387099] ntfs_fill_super+0x10f2/0x4420 [ 101.387099] ? snprintf+0xa9/0xd0 [ 101.387099] mount_bdev+0x305/0x3d0 [ 101.387099] ? ntfs_remount+0xc0/0xc0 [ 101.387099] ntfs_mount+0x3b/0x50 [ 101.387099] entry_SYSCALL_64_after_hwframe+0x44/0xae =============================================================================== The C reproducer of this bug is as follows: =============================================================================== #define _GNU_SOURCE #include <endian.h> #include <errno.h> #include <fcntl.h> #include <stddef.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/ioctl.h> #include <sys/mount.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <unistd.h> #include <linux/loop.h> #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; struct fs_image_segment { void* data; uintptr_t size; uintptr_t offset; }; #define IMAGE_MAX_SEGMENTS 4096 #define IMAGE_MAX_SIZE (129 << 20) static unsigned long fs_image_segment_check(unsigned long size, unsigned long nsegs, struct fs_image_segment* segs) { if (nsegs > IMAGE_MAX_SEGMENTS) nsegs = IMAGE_MAX_SEGMENTS; for (size_t i = 0; i < nsegs; i++) { if (segs[i].size > IMAGE_MAX_SIZE) segs[i].size = IMAGE_MAX_SIZE; segs[i].offset %= IMAGE_MAX_SIZE; if (segs[i].offset > IMAGE_MAX_SIZE - segs[i].size) segs[i].offset = IMAGE_MAX_SIZE - segs[i].size; if (size < segs[i].offset + segs[i].offset) size = segs[i].offset + segs[i].offset; } if (size > IMAGE_MAX_SIZE) size = IMAGE_MAX_SIZE; return size; } static int setup_loop_device(long unsigned size, long unsigned nsegs, struct fs_image_segment* segs, const char* loopname, int* memfd_p, int* loopfd_p) { int err = 0, loopfd = -1; size = fs_image_segment_check(size, nsegs, segs); int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (ftruncate(memfd, size)) { err = errno; goto error_close_memfd; } for (size_t i = 0; i < nsegs; i++) { if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) { } } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } *memfd_p = memfd; *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile unsigned long size, volatile unsigned long nsegs, volatile long segments, volatile long flags, volatile long optsarg) { struct fs_image_segment* segs = (struct fs_image_segment*)segments; int res = -1, err = 0, loopfd = -1, memfd = -1, need_loop_device = !!segs; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(size, nsegs, segs, loopname, &memfd, &loopfd) == -1) { printf("setup_loop_device failed\n"); return -1; } source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { if (strstr(opts, "errors=panic") || strstr(opts, "errors=remount-ro") == 0) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } printf("Start to mount...\n"); res = mount(source, target, fs, flags, opts); if (res == -1) { printf("mount failed: %s\n", strerror(errno)); err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; } error_clear_loop: if (need_loop_device) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); close(memfd); } errno = err; return res; } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); memcpy((void*)0x20000000, "ntfs\000", 5); memcpy((void*)0x20000100, "./file0\000", 8); *(uint64_t*)0x20000200 = 0x20010000; memcpy( (void*)0x20010000, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x02\x08\x00\x00\x00\x00" "\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x80\x00\x80\x00\xff\x0f\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00" "\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xf6\x00\x00\x00\x01\x00\x00\x00" "\x3d\xaa\xf5\x5a\xf9\x83\x09\x09\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac" "\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00\xcd\x10\x5e\xeb\xf0\x32\xe4\xcd" "\x16\xcd\x19\xeb\xfe\x54\x68\x69\x73\x20\x69\x73\x20\x6e\x6f\x74\x20\x61" "\x20\x62\x6f\x6f\x74\x61\x62\x6c\x65\x20\x64\x69\x73\x6b\x2e\x20\x50\x6c" "\x65\x61\x73\x65\x20\x69\x6e\x73\x65\x72\x74\x20\x61\x20\x62\x6f\x6f\x74" "\x61\x62\x6c\x65\x20\x66\x6c\x6f\x70\x70\x79\x20\x61\x6e\x64\x0d\x0a\x70" "\x72\x65\x73\x73\x20\x61\x6e\x79\x20\x6b\x65\x79\x20\x74\x6f\x20\x74\x72" "\x79\x20\x61\x67\x61\x69\x6e\x20\x2e\x2e\x2e\x20\x0d\x0a\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 224); *(uint64_t*)0x20000208 = 0xe0; *(uint64_t*)0x20000210 = 0; *(uint64_t*)0x20000218 = 0x20010100; memcpy((void*)0x20010100, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x55\xaa", 32); *(uint64_t*)0x20000220 = 0x20; *(uint64_t*)0x20000228 = 0x1e0; *(uint64_t*)0x20000230 = 0x20010200; memcpy((void*)0x20010200, "\xff\xff\x00\x07\x00\x00\x00\x00\x3f\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint64_t*)0x20000238 = 0x20; *(uint64_t*)0x20000240 = 0x2000; *(uint64_t*)0x20000248 = 0x20010300; memcpy( (void*)0x20010300, "\x46\x49\x4c\x45\x30\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00" "\x01\x00\x38\x00\x01\x00\x98\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00" "\x00\x00\x10\x00\x00\x00\x60\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00" "\x48\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x30\x00\x00\x00\x68\x00\x00\x00\x00\x00" "\x18\x00\x00\x00\x02\x00\x4a\x00\x00\x00\x18\x00\x01\x00\x05\x00\x00\x00" "\x00\x00\x05\x00\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x00\x70\x00\x00\x00\x00\x00\x00\x00\x6c\x00\x00\x00\x00\x00\x00\x06\x00" "\x00\x00\x00\x00\x00\x00\x04\x03\x24\x00\x4d\x00\x46\x00\x54\x00\x00\x00" "\x00\x00\x00\x00\x80\x00\x00\x00\x48\x00\x00\x00\x01\x00\x40\x00\x00\x00" "\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00" "\x40\x00\x00\x00\x00\x00\x00\x00\x00\x30\x01\x00\x00\x00\x00\x00\x00\x18" "\x01\x00\x00\x00\x00\x00", 312); *(uint64_t*)0x20000250 = 0x138; *(uint64_t*)0x20000258 = 0x4000; *(uint64_t*)0x20000260 = 0x20010500; memcpy((void*)0x20010500, "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\b", 31); *(uint64_t*)0x20000268 = 0x1f; *(uint64_t*)0x20000270 = 0x41e0; *(uint64_t*)0x20000278 = 0x20010600; memcpy((void*)0x20010600, "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\b", 31); *(uint64_t*)0x20000280 = 0x1f; *(uint64_t*)0x20000288 = 0x43e0; *(uint64_t*)0x20000290 = 0x20010c00; memcpy( (void*)0x20010c00, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x46\x49\x4c\x45" "\x30\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x01\x00\x38\x00" "\x01\x00\xe0\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x06\x00\x00\x00\x03\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x10\x00" "\x00\x00\x48\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x30\x00\x00\x00" "\x18\x00\x00\x00\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x00" "\x00\x00\x68\x00\x00\x00\x00\x00\x18\x00\x00\x00\x01\x00\x50\x00\x00\x00" "\x18\x00\x01\x00\x05\x00\x00\x00\x00\x00\x05\x00\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x07\x03\x24\x00" "\x56\x00\x6f\x00\x6c\x00\x75\x00\x6d\x00\x65\x00\x50\x00\x00\x00\x80\x00" "\x00\x00\x00\x00\x18\x00\x00\x00\x02\x00\x64\x00\x00\x00\x18\x00\x00\x00" "\x01\x00\x04\x80\x48\x00\x00\x00\x54\x00\x00\x00\x00\x00\x00\x00\x14\x00" "\x00\x00\x02\x00\x34\x00\x02\x00\x00\x00\x00\x00\x14\x00\x9f\x01\x12\x00" "\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x00\x00\x18\x00\x9f\x01" "\x12\x00\x01\x02\x00\x00\x00\x00\x00\x05\x20\x00\x00\x00\x20\x02\x00\x00" "\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x01\x02\x00\x00\x00\x00" "\x00\x05\x20\x00\x00\x00\x20\x02\x00\x00\x00\x00\x00\x00\x60\x00\x00\x00" "\x30\x00\x00\x00\x00\x00\x18\x00\x00\x00\x04\x00\x12\x00\x00\x00\x18\x00" "\x00\x00\x73\x00\x79\x00\x7a\x00\x6b\x00\x61\x00\x6c\x00\x6c\x00\x65\x00" "\x72\x00\x00\x00\x00\x00\x00\x00\x70\x00\x00\x00\x28\x00\x00\x00\x00\x00" "\x18\x00\x00\x00\x05\x00\x0c\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x03\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x18\x00" "\x00\x00\x00\x00\x18\x00\x00\x00\x03\x00\x00\x00\x00\x00\x18\x00\x00\x00" "\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x02", 543); *(uint64_t*)0x20000298 = 0x21f; *(uint64_t*)0x200002a0 = 0x4be0; *(uint64_t*)0x200002a8 = 0x20010f00; memcpy((void*)0x20010f00, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02", 31); *(uint64_t*)0x200002b0 = 0x1f; *(uint64_t*)0x200002b8 = 0x4fe0; *(uint64_t*)0x200002c0 = 0x20011200; memcpy( (void*)0x20011200, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x46\x49\x4c\x45" "\x30\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x01\x00\x38\x00" "\x03\x00\x00\x02\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x06\x00\x00\x00\x05\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x10\x00" "\x00\x00\x48\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x30\x00\x00\x00" "\x18\x00\x00\x00\x00\x6f\x95\xff\xc7\x8d\xd6\x01\xbb\xc8\x07\x00\xc8\x8d" "\xd6\x01\xbb\xc8\x07\x00\xc8\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x26\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x00" "\x00\x00\x60\x00\x00\x00\x00\x00\x18\x00\x00\x00\x01\x00\x44\x00\x00\x00" "\x18\x00\x01\x00\x05\x00\x00\x00\x00\x00\x05\x00\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x06\x00\x00\x10\x00\x00\x00\x00\x01\x03\x2e\x00" "\x00\x00\x00\x00\x50\x00\x00\x00\x48\x00\x00\x00\x01\x00\x40\x00\x00\x00" "\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" "\x40\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x2c\x10" "\x00\x00\x00\x00\x00\x00\x2c\x10\x00\x00\x00\x00\x00\x00\x11\x02\x43\x00" "\x00\x00\x00\x00\x90\x00\x00\x00\x58\x00\x00\x00\x00\x04\x18\x00\x00\x00" "\x03\x00\x38\x00\x00\x00\x20\x00\x00\x00\x24\x00\x49\x00\x33\x00\x30\x00" "\x30\x00\x00\x00\x01\x00\x00\x00\x00\x10\x00\x00\x01\x00\x00\x00\x10\x00" "\x00\x00\x28\x00\x00\x00\x28\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x18\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\xa0\x00\x00\x00\x50\x00\x00\x00\x01\x04\x40\x00\x00\x00\x05\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x48\x00" "\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00" "\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x24\x00\x49\x00\x33\x00" "\x30\x00\x11\x01\x45\x00\x00\x00\x00\x00\xb0\x00\x00\x00\x28\x00\x00\x00" "\x00\x04\x18\x00\x00\x00\x04\x00\x08\x00\x00\x00\x20\x00\x00\x00\x24\x00" "\x49\x00\x33\x00\x30\x00\x01\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff" "\x00\x00\x07", 543); *(uint64_t*)0x200002c8 = 0x21f; *(uint64_t*)0x200002d0 = 0x53e0; *(uint64_t*)0x200002d8 = 0x20011500; memcpy( (void*)0x20011500, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x46\x49\x4c\x45" "\x30\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x01\x00\x38\x00" "\x01\x00\x50\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x03\x00\x00\x00\x06\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x10\x00" "\x00\x00\x60\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x48\x00\x00\x00" "\x18\x00\x00\x00\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x30\x00\x00\x00\x68\x00\x00\x00\x00\x00\x18\x00\x00\x00" "\x02\x00\x50\x00\x00\x00\x18\x00\x01\x00\x05\x00\x00\x00\x00\x00\x05\x00" "\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f" "\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x10\x00\x00" "\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00" "\x00\x00\x07\x03\x24\x00\x42\x00\x69\x00\x74\x00\x6d\x00\x61\x00\x70\x00" "\x80\x00\x00\x00\x48\x00\x00\x00\x01\x00\x40\x00\x00\x00\x01\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00" "\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x40", 337); *(uint64_t*)0x200002e0 = 0x151; *(uint64_t*)0x200002e8 = 0x57e0; *(uint64_t*)0x200002f0 = 0x20011700; memcpy((void*)0x20011700, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02", 31); *(uint64_t*)0x200002f8 = 0x1f; *(uint64_t*)0x20000300 = 0x59e0; *(uint64_t*)0x20000308 = 0x20011800; memcpy((void*)0x20011800, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02", 31); *(uint64_t*)0x20000310 = 0x1f; *(uint64_t*)0x20000318 = 0x5be0; *(uint64_t*)0x20000320 = 0x20011e00; memcpy( (void*)0x20011e00, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x46\x49\x4c\x45" "\x30\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\x38\x00" "\x09\x00\xa8\x02\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x05\x00\x00\x00\x09\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x10\x00" "\x00\x00\x60\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x48\x00\x00\x00" "\x18\x00\x00\x00\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x06\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x30\x00\x00\x00\x68\x00\x00\x00\x00\x00\x18\x00\x00\x00" "\x01\x00\x50\x00\x00\x00\x18\x00\x01\x00\x05\x00\x00\x00\x00\x00\x05\x00" "\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f" "\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x20\x00\x00" "\x00\x00\x07\x03\x24\x00\x53\x00\x65\x00\x63\x00\x75\x00\x72\x00\x65\x00" "\x80\x00\x00\x00\x50\x00\x00\x00\x01\x04\x40\x00\x00\x00\x02\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x48\x00\x00\x00" "\x00\x00\x00\x00\x00\x10\x04\x00\x00\x00\x00\x00\xfc\x00\x04\x00\x00\x00" "\x00\x00\xfc\x00\x04\x00\x00\x00\x00\x00\x24\x00\x53\x00\x44\x00\x53\x00" "\x11\x41\x48\x00\x00\x00\x00\x00\x90\x00\x00\x00\xb0\x00\x00\x00\x00\x04" "\x18\x00\x00\x00\x03\x00\x90\x00\x00\x00\x20\x00\x00\x00\x24\x00\x53\x00" "\x44\x00\x48\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x10\x00\x00\x01\x00" "\x00\x00\x10\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00" "\x18\x00\x14\x00\x00\x00\x00\x00\x30\x00\x08\x00\x00\x00\x00\x00\x51\x24" "\xb3\x00\x01\x01\x00\x00\x51\x24\xb3\x00\x01\x01\x00\x00\x80\x00\x00\x00" "\x00\x00\x00\x00\x7c\x00\x00\x00\x49\x00\x49\x00\x18\x00\x14\x00\x00\x00" "\x00\x00\x30\x00\x08\x00\x00\x00\x00\x00\xf0\x12\x03\xf8\x00\x01\x00\x00" "\xf0\x12\x03\xf8\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7c\x00" "\x00\x00\x49\x00\x49\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" "\x02\x00\x02", 543); *(uint64_t*)0x20000328 = 0x21f; *(uint64_t*)0x20000330 = 0x63e0; *(uint64_t*)0x20000338 = 0x20012100; memcpy((void*)0x20012100, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02", 31); *(uint64_t*)0x20000340 = 0x1f; *(uint64_t*)0x20000348 = 0x67e0; *(uint64_t*)0x20000350 = 0x20012400; memcpy( (void*)0x20012400, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x46\x49\x4c\x45" "\x30\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x01\x00\x38\x00" "\x03\x00\x80\x02\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x03\x00\x00\x00\x0b\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x10\x00" "\x00\x00\x60\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x48\x00\x00\x00" "\x18\x00\x00\x00\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x30\x00\x00\x00\x68\x00\x00\x00\x00\x00\x18\x00\x00\x00" "\x01\x00\x50\x00\x00\x00\x18\x00\x01\x00\x05\x00\x00\x00\x00\x00\x05\x00" "\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f" "\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x10\x00\x00" "\x00\x00\x07\x03\x24\x00\x45\x00\x78\x00\x74\x00\x65\x00\x6e\x00\x64\x00" "\x90\x00\x00\x00\x78\x01\x00\x00\x00\x04\x18\x00\x00\x00\x02\x00\x58\x01" "\x00\x00\x20\x00\x00\x00\x24\x00\x49\x00\x33\x00\x30\x00\x30\x00\x00\x00" "\x01\x00\x00\x00\x00\x10\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x48\x01" "\x00\x00\x48\x01\x00\x00\x00\x00\x00\x00\x19\x00\x00\x00\x00\x00\x01\x00" "\x60\x00\x4e\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x0b\x00\x00\x6f" "\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff" "\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x26\x00\x00\x20\x00\x00\x00\x00" "\x06\x03\x24\x00\x4f\x00\x62\x00\x6a\x00\x49\x00\x64\x00\x00\x00\x18\x00" "\x00\x00\x00\x00\x01\x00\x60\x00\x4e\x00\x00\x00\x00\x00\x0b\x00\x00\x00" "\x00\x00\x0b\x00\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d" "\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01\x00\x6f\x95\xff\xc7\x8d\xd6\x01" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x26\x00" "\x00\x20\x00\x00\x00\x00\x06\x03\x24\x00\x51\x00\x75\x00\x6f\x00\x74\x00" "\x61\x00\x02", 543); *(uint64_t*)0x20000358 = 0x21f; *(uint64_t*)0x20000360 = 0x6be0; *(uint64_t*)0x20000368 = 0x20012700; memcpy((void*)0x20012700, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02", 31); *(uint64_t*)0x20000370 = 0x1f; *(uint64_t*)0x20000378 = 0x6fe0; *(uint8_t*)0x2007dc00 = 0; syz_mount_image(0x20000000, 0x20000100, 0, 0x10, 0x20000200, 0, 0x2007dc00); return 0; }

3 years

6
10
0 0

[PATCH] cpufreq: amd-pstate: Add resume and suspend callback for amd-pstate

by Jinzhou Su

When system resumes from S3, the CPPC enable register will be cleared and reset to 0. So sets this bit to enable CPPC interface by writing 1 to this register. Signed-off-by: Jinzhou Su <Jinzhou.Su(a)amd.com> --- drivers/cpufreq/amd-pstate.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c index 7be38bc6a673..9ac75c1cde9c 100644 --- a/drivers/cpufreq/amd-pstate.c +++ b/drivers/cpufreq/amd-pstate.c @@ -566,6 +566,28 @@ static int amd_pstate_cpu_exit(struct cpufreq_policy *policy) return 0; } +static int amd_pstate_cpu_resume(struct cpufreq_policy *policy) +{ + int ret; + + ret = amd_pstate_enable(true); + if (ret) + pr_err("failed to enable amd-pstate during resume, return %d\n", ret); + + return ret; +} + +static int amd_pstate_cpu_suspend(struct cpufreq_policy *policy) +{ + int ret; + + ret = amd_pstate_enable(false); + if (ret) + pr_err("failed to disable amd-pstate during suspend, return %d\n", ret); + + return ret; +} + /* Sysfs attributes */ /* @@ -636,6 +658,8 @@ static struct cpufreq_driver amd_pstate_driver = { .target = amd_pstate_target, .init = amd_pstate_cpu_init, .exit = amd_pstate_cpu_exit, + .suspend = amd_pstate_cpu_suspend, + .resume = amd_pstate_cpu_resume, .set_boost = amd_pstate_set_boost, .name = "amd-pstate", .attr = amd_pstate_attr, -- 2.32.0

3 years

4
3
0 0

Re: [PATCH 5.18 00/11] 5.18.7-rc1 review

by Ronald Warsow

hallo Greg 5.18.7-rc1 compiles, boots and runs here on x86_64 (Intel i5-11400, Fedora 36) Tested-by: Ronald Warsow <rwarsow(a)gmx.de Thanks Ronald

3 years

1
0
0 0

stable-rc/queue/4.19 baseline: 89 runs, 10 regressions (v4.19.248-225-gee5f4486fd9e0)

by kernelci.org bot

stable-rc/queue/4.19 baseline: 89 runs, 10 regressions (v4.19.248-225-gee5f4486fd9e0) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ jetson-tk1 | arm | lab-baylibre | gcc-10 | tegra_defconfig | 1 meson-gxl-s905x-libretech-cc | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2 | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3 | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.19/kernel/v4.19.24… Test: baseline Tree: stable-rc Branch: queue/4.19 Describe: v4.19.248-225-gee5f4486fd9e0 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: ee5f4486fd9e012cb983bff05d2e0a3aca1d92c8 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ jetson-tk1 | arm | lab-baylibre | gcc-10 | tegra_defconfig | 1 Details: https://kernelci.org/test/plan/id/62b379698f798ba321a39bd4 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: tegra_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b379698f798ba321a39bd5 failing since 6 days (last pass: v4.19.246-288-g495edb43ebcc4, first fail: v4.19.247-16-g570bbfee860d2) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ meson-gxl-s905x-libretech-cc | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335d705e6d367c3a39bd0 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335d705e6d367c3a39bd1 failing since 64 days (last pass: v4.19.238-22-gb215381f8cf05, first fail: v4.19.238-32-g4d86c9395c31a) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335811c770a38b7a39bdc Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335811c770a38b7a39bdd failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335adfb85478d4da39be8 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335adfb85478d4da39be9 failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b3357ffb85478d4da39bd7 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b3357ffb85478d4da39bd8 failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335711c770a38b7a39bcd Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335711c770a38b7a39bce failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335821c770a38b7a39bdf Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335821c770a38b7a39be0 failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335ae16c051deaca39be8 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335ae16c051deaca39be9 failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335801c770a38b7a39bd9 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335801c770a38b7a39bda failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+--------------+----------+-----------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/62b335851c770a38b7a39be2 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.248-225-gee5f4486f… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/62b335851c770a38b7a39be3 failing since 43 days (last pass: v4.19.241-58-g5e77acf6dbb6, first fail: v4.19.241-83-g0ec5709aa1da)

3 years

1
0
0 0

[stable] Improved TCP source port randomisation

by Ben Hutchings

Please pick the following commits for 5.4 and 5.10 stable branches: 90564f36f1c3071d1e0c617cde342f9706e250be tcp: add some entropy in __inet_hash_connect() 506884b616e95714af173c47b89e7d1f5157c190 tcp: use different parts of the port_offset for index and offset dabeb1baad260b2308477991f3006f4a1ac80d6d tcp: add small random increments to the source port 735ad25586cd381a3fdc8283e2d1cd4d65f0e9e7 tcp: dynamically allocate the perturb table used by source ports ada9e93075c7d54a7fd28bae5429ed30ddd89bfa tcp: increase source port perturb table to 2^16 82f233b30b728249d1c374b77d722b2e4f55a631 tcp: drop the hash_32() part from the index calculation I will send backports for older branches after this. (All stable branches have the other 2 commits from this series; I'm not sure why the whole series wasn't applied.) Ben. -- Ben Hutchings Man invented language to satisfy his deep need to complain. - Lily Tomlin

3 years

2
3
0 0

[PATCH stable-5.15] arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

by Catalin Marinas

From: Will Deacon <will(a)kernel.org> commit c50f11c6196f45c92ca48b16a5071615d4ae0572 upstream. Invalidating the buffer memory in arch_sync_dma_for_device() for FROM_DEVICE transfers When using the streaming DMA API to map a buffer prior to inbound non-coherent DMA (i.e. DMA_FROM_DEVICE), we invalidate any dirty CPU cachelines so that they will not be written back during the transfer and corrupt the buffer contents written by the DMA. This, however, poses two potential problems: (1) If the DMA transfer does not write to every byte in the buffer, then the unwritten bytes will contain stale data once the transfer has completed. (2) If the buffer has a virtual alias in userspace, then stale data may be visible via this alias during the period between performing the cache invalidation and the DMA writes landing in memory. Address both of these issues by cleaning (aka writing-back) the dirty lines in arch_sync_dma_for_device(DMA_FROM_DEVICE) instead of discarding them using invalidation. Cc: Ard Biesheuvel <ardb(a)kernel.org> Cc: Christoph Hellwig <hch(a)lst.de> Cc: Robin Murphy <robin.murphy(a)arm.com> Cc: Russell King <linux(a)armlinux.org.uk> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220606152150.GA31568@willie-the-truck Signed-off-by: Will Deacon <will(a)kernel.org> Reviewed-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20220610151228.4562-2-will@kernel.org Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> --- arch/arm64/mm/cache.S | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S index 5051b3c1a4f1..79164e439036 100644 --- a/arch/arm64/mm/cache.S +++ b/arch/arm64/mm/cache.S @@ -231,8 +231,6 @@ SYM_FUNC_END_PI(__dma_flush_area) */ SYM_FUNC_START_PI(__dma_map_area) add x1, x0, x1 - cmp w2, #DMA_FROM_DEVICE - b.eq __dma_inv_area b __dma_clean_area SYM_FUNC_END_PI(__dma_map_area)

3 years

2
1
0 0

[PATCH v5.10] serial: core: Initialize rs485 RTS polarity already on probe

by Dominique Martinet

From: Lukas Wunner <lukas(a)wunner.de> Core part of commit 2dd8a74fddd21b95dcc60a2d3c9eaec993419d69 upstream: the PL011 driver does not support RS485 in the 5.10 tree yet so drop that bit. RTS polarity of rs485-enabled ports is currently initialized on uart open via: tty_port_open() tty_port_block_til_ready() tty_port_raise_dtr_rts() # if (C_BAUD(tty)) uart_dtr_rts() uart_port_dtr_rts() There's at least three problems here: First, if no baud rate is set, RTS polarity is not initialized. That's the right thing to do for rs232, but not for rs485, which requires that RTS is deasserted unconditionally. Second, if the DeviceTree property "linux,rs485-enabled-at-boot-time" is present, RTS should be deasserted as early as possible, i.e. on probe. Otherwise it may remain asserted until first open. Third, even though RTS is deasserted on open and close, it may subsequently be asserted by uart_throttle(), uart_unthrottle() or uart_set_termios() because those functions aren't rs485-aware. (Only uart_tiocmset() is.) To address these issues, move RTS initialization from uart_port_dtr_rts() to uart_configure_port(). Prevent subsequent modification of RTS polarity by moving the existing rs485 check from uart_tiocmget() to uart_update_mctrl(). That way, RTS is initialized on probe and then remains unmodified unless the uart transmits data. If rs485 is enabled at runtime (instead of at boot) through a TIOCSRS485 ioctl(), RTS is initialized by the uart driver's ->rs485_config() callback and then likewise remains unmodified. The PL011 driver initializes RTS on uart open and prevents subsequent modification in its ->set_mctrl() callback. That code is obsoleted by the present commit, so drop it. Cc: Jan Kiszka <jan.kiszka(a)siemens.com> Cc: Su Bao Cheng <baocheng.su(a)siemens.com> Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Link: https://lore.kernel.org/r/2d2acaf3a69e89b7bf687c912022b11fd29dfa1e.16429092… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: stable(a)vger.kernel.org # 5.10 Reported-by: Daisuke Mizobuchi <mizo(a)atmark-techno.com> Tested-by: Daisuke Mizobuchi <mizo(a)atmark-techno.com> Signed-off-by: Dominique Martinet <dominique.martinet(a)atmark-techno.com> --- Notes: - as said in commit message, I've dropped the PL011 part of the original patch as it is orthogonal to this change. We need this serial core fix for the imx serial tty driver. - I wasn't really sure what to do with tags in the commit message, everything below the 'Cc: stable' tag apply to the backport: Mizobuchi-san tested the backport on the 5.10 branch with the imx driver. - I'm not quite sure how far back it is relevant, for imx I assume rs485 is broken since 58362d5be352 ("serial: imx: implement handshaking using gpios with the mctrl_gpio helper") (4.5), and we did have that problem all the way back in our older 4.9 product tree... but core support back then wasn't as extensive for RS485 so we have a different imx specific workaround there. - I do not use 5.15 but either version of this patch apply cleanly there; I'd assume it'd be more appropriate to get the original 2dd8a74fddd21b cherry-picked in this case for 5.15. Thanks! drivers/tty/serial/serial_core.c | 34 +++++++++++--------------------- 1 file changed, 12 insertions(+), 22 deletions(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 19f0c5db11e3..32d09d024f6c 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -144,6 +144,11 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear) unsigned long flags; unsigned int old; + if (port->rs485.flags & SER_RS485_ENABLED) { + set &= ~TIOCM_RTS; + clear &= ~TIOCM_RTS; + } + spin_lock_irqsave(&port->lock, flags); old = port->mctrl; port->mctrl = (old & ~clear) | set; @@ -157,23 +162,10 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear) static void uart_port_dtr_rts(struct uart_port *uport, int raise) { - int rs485_on = uport->rs485_config && - (uport->rs485.flags & SER_RS485_ENABLED); - int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND); - - if (raise) { - if (rs485_on && RTS_after_send) { - uart_set_mctrl(uport, TIOCM_DTR); - uart_clear_mctrl(uport, TIOCM_RTS); - } else { - uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); - } - } else { - unsigned int clear = TIOCM_DTR; - - clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0; - uart_clear_mctrl(uport, clear); - } + if (raise) + uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); + else + uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS); } /* @@ -1116,11 +1108,6 @@ uart_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear) goto out; if (!tty_io_error(tty)) { - if (uport->rs485.flags & SER_RS485_ENABLED) { - set &= ~TIOCM_RTS; - clear &= ~TIOCM_RTS; - } - uart_update_mctrl(uport, set, clear); ret = 0; } @@ -2429,6 +2416,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, */ spin_lock_irqsave(&port->lock, flags); port->mctrl &= TIOCM_DTR; + if (port->rs485.flags & SER_RS485_ENABLED && + !(port->rs485.flags & SER_RS485_RTS_AFTER_SEND)) + port->mctrl |= TIOCM_RTS; port->ops->set_mctrl(port, port->mctrl); spin_unlock_irqrestore(&port->lock, flags); -- 2.35.1

3 years

2
1
0 0

backport of 8cb0cd68bef7 (dt-bindings: nvmem: sfp: Add clock properties)

by Michael Walle

Hi Greg, This patch should have been picked for the 5.18 branch where the device tree binding was introcuded first, but instead it landed in -next without a Fixes: tag [1]. Now there is a backwards incompatible change between 5.18 and the upcoming 5.19. Thus, can this be picked up for the 5.18 tree? More background can be found in [2]. -michael [1] https://lore.kernel.org/r/3b8fc56f64508f7604f3b9e14b048568@walle.cc [2] https://lore.kernel.org/r/4a45db184fbadc278624571dfbeb5004@walle.cc

3 years

2
1
0 0

[PATCH 5.15 1/2] bpf: Fix calling global functions from BPF_PROG_TYPE_EXT programs

by Toke Høiland-Jørgensen

commit f858c2b2ca04fc7ead291821a793638ae120c11d upstream The verifier allows programs to call global functions as long as their argument types match, using BTF to check the function arguments. One of the allowed argument types to such global functions is PTR_TO_CTX; however the check for this fails on BPF_PROG_TYPE_EXT functions because the verifier uses the wrong type to fetch the vmlinux BTF ID for the program context type. This failure is seen when an XDP program is loaded using libxdp (which loads it as BPF_PROG_TYPE_EXT and attaches it to a global XDP type program). Fix the issue by passing in the target program type instead of the BPF_PROG_TYPE_EXT type to bpf_prog_get_ctx() when checking function argument compatibility. The first Fixes tag refers to the latest commit that touched the code in question, while the second one points to the code that first introduced the global function call verification. v2: - Use resolve_prog_type() Fixes: 3363bd0cfbb8 ("bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support") Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification") Reported-by: Simon Sundberg <simon.sundberg(a)kau.se> Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Link: https://lore.kernel.org/r/20220606075253.28422-1-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> [ backport: open-code missing resolve_prog_type() helper, resolve context diff ] Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> --- kernel/bpf/btf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 40df35088cdb..3cfba41a0829 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5441,6 +5441,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, struct bpf_reg_state *regs, bool ptr_to_mem_ok) { + enum bpf_prog_type prog_type = env->prog->type == BPF_PROG_TYPE_EXT ? + env->prog->aux->dst_prog->type : env->prog->type; struct bpf_verifier_log *log = &env->log; const char *func_name, *ref_tname; const struct btf_type *t, *ref_t; @@ -5533,8 +5535,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, reg_ref_tname); return -EINVAL; } - } else if (btf_get_prog_ctx_type(log, btf, t, - env->prog->type, i)) { + } else if (btf_get_prog_ctx_type(log, btf, t, prog_type, i)) { /* If function expects ctx type in BTF check that caller * is passing PTR_TO_CTX. */ -- 2.36.1

3 years

2
2
0 0

patch request for 5.18-stable to fix gcc-12 build (hopefully last)

by Sudip Mukherjee

Hi Greg, The following will be needed for the gcc-12 builds: ee3db469dd31 ("wifi: rtlwifi: remove always-true condition pointed out by GCC 12") 32329216ca1d ("eth: sun: cassini: remove dead code") dbbc7d04c549 ("net: wwan: iosm: remove pointless null check") With this 3 applied on top of v5.18.6-rc1 allmodconfig for x86_64, riscv and mips passes. (not checked other arch yet) Will request you to add these to 5.18-stable queue please. -- Regards Sudip

3 years

3
5
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror June 2022