Hi Everyone,
Please find the KernelCI report for stable-rc/linux-5.4.y for this week.
## stable-rc HEAD for linux-5.4.y:
Date: 2023-12-18
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/…
## Build failures:
No build failures seen for the stable-rc/linux-5.4.y commit head \o/
## Boot failures:
No **new** boot failures seen for the stable-rc/linux-5.4.y commit head \o/
Tested-by: kernelci.org bot <bot(a)kernelci.org>
Thanks,
Shreeya Patel
Hi Everyone,
Please find the KernelCI report for stable-rc/linux-5.15.y for this week.
## stable-rc HEAD for linux-5.15.y:
Date: 2023-12-18
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/…
## Build failures:
No build failures seen for the stable-rc/linux-5.15.y commit head \o/
## Boot failures:
No **new** boot failures seen for the stable-rc/linux-5.15.y commit head \o/
Tested-by: kernelci.org bot <bot(a)kernelci.org>
Thanks,
Shreeya Patel
This is the start of the stable review cycle for the 4.19.303 release.
There are 36 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 20 Dec 2023 13:50:31 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.303-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.303-rc1
Naveen N Rao <naveen(a)kernel.org>
powerpc/ftrace: Fix stack teardown in ftrace_no_trace
Naveen N Rao <naveen(a)kernel.org>
powerpc/ftrace: Create a dummy stackframe to fix stack unwind
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Be sure to wait while busy in CQE error recovery
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ring-buffer: Fix memory leak of free page
Florent Revest <revest(a)chromium.org>
team: Fix use-after-free when an option instance allocation fails
James Houghton <jthoughton(a)google.com>
arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
Baokun Li <libaokun1(a)huawei.com>
ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
Mark Rutland <mark.rutland(a)arm.com>
perf: Fix perf_event_validate_size() lockdep splat
Denis Benato <benato.denis96(a)gmail.com>
HID: hid-asus: add const to read-only outgoing usb buffer
Lech Perczak <lech.perczak(a)gmail.com>
net: usb: qmi_wwan: claim interface 4 for ZTE MF290
Linus Torvalds <torvalds(a)linux-foundation.org>
asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
Aoba K <nexp_0x17(a)outlook.com>
HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
Denis Benato <benato.denis96(a)gmail.com>
HID: hid-asus: reset the backlight brightness level on resume
Oliver Neukum <oneukum(a)suse.com>
HID: add ALWAYS_POLL quirk for Apple kb
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
platform/x86: intel_telemetry: Fix kernel doc descriptions
Coly Li <colyli(a)suse.de>
bcache: avoid NULL checking to c->root in run_cache_set()
Coly Li <colyli(a)suse.de>
bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc()
Coly Li <colyli(a)suse.de>
bcache: avoid oversize memory allocation by small stripe_size
Ming Lei <ming.lei(a)redhat.com>
blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"
Jens Axboe <axboe(a)kernel.dk>
cred: switch to using atomic_long_t
Bjorn Helgaas <bhelgaas(a)google.com>
Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
Hyunwoo Kim <v4bel(a)theori.io>
appletalk: Fix Use-After-Free in atalk_ioctl
Andrew Halaney <ahalaney(a)redhat.com>
net: stmmac: Handle disabled MDIO busses from devicetree
Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
net: stmmac: use dev_err_probe() for reporting mdio bus registration failure
Eric Dumazet <edumazet(a)google.com>
net: prevent mss overflow in skb_segment()
Nikolay Kuratov <kniv(a)yandex-team.ru>
vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()
Yusong Gao <a869920004(a)gmail.com>
sign-file: Fix incorrect return values check
Dong Chenchen <dongchenchen2(a)huawei.com>
net: Remove acked SYN flag from packet in the transmit queue correctly
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
qed: Fix a potential use-after-free in qed_cxt_tables_alloc
Hyunwoo Kim <v4bel(a)theori.io>
net/rose: Fix Use-After-Free in rose_ioctl
Hyunwoo Kim <v4bel(a)theori.io>
atm: Fix Use-After-Free in do_vcc_ioctl
Chengfeng Ye <dg573847474(a)gmail.com>
atm: solos-pci: Fix potential deadlock on &tx_queue_lock
Chengfeng Ye <dg573847474(a)gmail.com>
atm: solos-pci: Fix potential deadlock on &cli_queue_lock
Stefan Wahren <wahrenst(a)gmx.net>
qca_spi: Fix reset behavior
Stefan Wahren <wahrenst(a)gmx.net>
qca_debug: Fix ethtool -G iface tx behavior
Stefan Wahren <wahrenst(a)gmx.net>
qca_debug: Prevent crash on TX ring changes
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/include/asm/pgtable.h | 6 +++
arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 17 ++++--
block/blk-throttle.c | 2 +
drivers/atm/solos-pci.c | 8 +--
drivers/hid/hid-asus.c | 25 +++++++--
drivers/hid/hid-multitouch.c | 5 ++
drivers/hid/hid-quirks.c | 1 +
drivers/md/bcache/bcache.h | 1 +
drivers/md/bcache/btree.c | 7 +++
drivers/md/bcache/super.c | 4 +-
drivers/mmc/core/core.c | 2 +
drivers/mmc/core/mmc_ops.c | 5 +-
drivers/mmc/core/mmc_ops.h | 2 +
drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 +
drivers/net/ethernet/qualcomm/qca_debug.c | 17 +++---
drivers/net/ethernet/qualcomm/qca_spi.c | 20 ++++++-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 ++-
drivers/net/team/team.c | 4 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/pci/hotplug/acpiphp_glue.c | 9 ++--
drivers/platform/x86/intel_telemetry_core.c | 4 +-
fs/ext4/mballoc.c | 4 ++
include/asm-generic/qspinlock.h | 2 +-
include/linux/cred.h | 6 +--
kernel/cred.c | 66 +++++++++++------------
kernel/events/core.c | 10 ++++
kernel/trace/ring_buffer.c | 2 +
net/appletalk/ddp.c | 9 ++--
net/atm/ioctl.c | 7 ++-
net/core/skbuff.c | 3 +-
net/ipv4/tcp_output.c | 6 +++
net/rose/af_rose.c | 4 +-
net/vmw_vsock/virtio_transport_common.c | 2 +-
scripts/sign-file.c | 12 ++---
36 files changed, 197 insertions(+), 89 deletions(-)
This is the start of the stable review cycle for the 4.14.334 release.
There are 26 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 20 Dec 2023 13:50:31 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.334-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.334-rc1
Naveen N Rao <naveen(a)kernel.org>
powerpc/ftrace: Fix stack teardown in ftrace_no_trace
Naveen N Rao <naveen(a)kernel.org>
powerpc/ftrace: Create a dummy stackframe to fix stack unwind
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ring-buffer: Fix memory leak of free page
Florent Revest <revest(a)chromium.org>
team: Fix use-after-free when an option instance allocation fails
Baokun Li <libaokun1(a)huawei.com>
ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
Denis Benato <benato.denis96(a)gmail.com>
HID: hid-asus: add const to read-only outgoing usb buffer
Lech Perczak <lech.perczak(a)gmail.com>
net: usb: qmi_wwan: claim interface 4 for ZTE MF290
Linus Torvalds <torvalds(a)linux-foundation.org>
asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
Aoba K <nexp_0x17(a)outlook.com>
HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
Denis Benato <benato.denis96(a)gmail.com>
HID: hid-asus: reset the backlight brightness level on resume
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
platform/x86: intel_telemetry: Fix kernel doc descriptions
Coly Li <colyli(a)suse.de>
bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc()
Ming Lei <ming.lei(a)redhat.com>
blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"
Jens Axboe <axboe(a)kernel.dk>
cred: switch to using atomic_long_t
Hyunwoo Kim <v4bel(a)theori.io>
appletalk: Fix Use-After-Free in atalk_ioctl
Nikolay Kuratov <kniv(a)yandex-team.ru>
vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()
Yusong Gao <a869920004(a)gmail.com>
sign-file: Fix incorrect return values check
Dong Chenchen <dongchenchen2(a)huawei.com>
net: Remove acked SYN flag from packet in the transmit queue correctly
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
qed: Fix a potential use-after-free in qed_cxt_tables_alloc
Hyunwoo Kim <v4bel(a)theori.io>
net/rose: Fix Use-After-Free in rose_ioctl
Hyunwoo Kim <v4bel(a)theori.io>
atm: Fix Use-After-Free in do_vcc_ioctl
Chengfeng Ye <dg573847474(a)gmail.com>
atm: solos-pci: Fix potential deadlock on &tx_queue_lock
Chengfeng Ye <dg573847474(a)gmail.com>
atm: solos-pci: Fix potential deadlock on &cli_queue_lock
Stefan Wahren <wahrenst(a)gmx.net>
qca_spi: Fix reset behavior
Stefan Wahren <wahrenst(a)gmx.net>
qca_debug: Fix ethtool -G iface tx behavior
Stefan Wahren <wahrenst(a)gmx.net>
qca_debug: Prevent crash on TX ring changes
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 9 +++-
block/blk-throttle.c | 2 +
drivers/atm/solos-pci.c | 8 ++--
drivers/hid/hid-asus.c | 25 ++++++++--
drivers/hid/hid-multitouch.c | 5 ++
drivers/md/bcache/btree.c | 7 +++
drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 +
drivers/net/ethernet/qualcomm/qca_debug.c | 17 +++----
drivers/net/ethernet/qualcomm/qca_spi.c | 20 +++++++-
drivers/net/team/team.c | 4 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/platform/x86/intel_telemetry_core.c | 4 +-
fs/ext4/mballoc.c | 4 ++
include/asm-generic/qspinlock.h | 2 +-
include/linux/cred.h | 6 +--
kernel/cred.c | 66 +++++++++++++-------------
kernel/trace/ring_buffer.c | 2 +
net/appletalk/ddp.c | 9 ++--
net/atm/ioctl.c | 7 ++-
net/ipv4/tcp_output.c | 6 +++
net/rose/af_rose.c | 4 +-
net/vmw_vsock/virtio_transport_common.c | 2 +-
scripts/sign-file.c | 12 ++---
24 files changed, 152 insertions(+), 75 deletions(-)
From: Ronald Wahl <ronald.wahl(a)raritan.com>
There is a bug in the ks8851 Ethernet driver that more data is written
to the hardware TX buffer than actually available. This is caused by
wrong accounting of the free TX buffer space.
The driver maintains a tx_space variable that represents the TX buffer
space that is deemed to be free. The ks8851_start_xmit_spi() function
adds an SKB to a queue if tx_space is large enough and reduces tx_space
by the amount of buffer space it will later need in the TX buffer and
then schedules a work item. If there is not enough space then the TX
queue is stopped.
The worker function ks8851_tx_work() dequeues all the SKBs and writes
the data into the hardware TX buffer. The last packet will trigger an
interrupt after it was send. Here it is assumed that all data fits into
the TX buffer.
In the interrupt routine (which runs asynchronously because it is a
threaded interrupt) tx_space is updated with the current value from the
hardware. Also the TX queue is woken up again.
Now it could happen that after data was sent to the hardware and before
handling the TX interrupt new data is queued in ks8851_start_xmit_spi()
when the TX buffer space had still some space left. When the interrupt
is actually handled tx_space is updated from the hardware but now we
already have new SKBs queued that have not been written to the hardware
TX buffer yet. Since tx_space has been overwritten by the value from the
hardware the space is not accounted for.
Now we have more data queued then buffer space available in the hardware
and ks8851_tx_work() will potentially overrun the hardware TX buffer. In
many cases it will still work because often the buffer is written out
fast enough so that no overrun occurs but for example if the peer
throttles us via flow control then an overrun may happen.
This can be fixed in different ways. The most simple way would be to set
tx_space to 0 before writing data to the hardware TX buffer preventing
the queuing of more SKBs until the TX interrupt has been handled. I have
chosen a slightly more efficient (and still rather simple) way and
track the amount of data that is already queued and not yet written to
the hardware. When new SKBs are to be queued the already queued amount
of data is honoured when checking free TX buffer space.
I tested this with a setup of two linked KS8851 running iperf3 between
the two in bidirectional mode. Before the fix I got a stall after some
minutes. With the fix I saw now issues anymore after hours.
Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver")
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: Eric Dumazet <edumazet(a)google.com>
Cc: Jakub Kicinski <kuba(a)kernel.org>
Cc: Paolo Abeni <pabeni(a)redhat.com>
Cc: Ben Dooks <ben.dooks(a)codethink.co.uk>
Cc: Tristram Ha <Tristram.Ha(a)microchip.com>
Cc: netdev(a)vger.kernel.org
Cc: stable(a)vger.kernel.org # 5.10+
Signed-off-by: Ronald Wahl <ronald.wahl(a)raritan.com>
---
V3: - Add missing kdoc of structure fields
- Avoid potential NULL pointer dereference
- Fix stack variable declaration order
V2: - Added Fixes: tag (issue actually present from the beginning)
- cosmetics reported by checkpatch
drivers/net/ethernet/micrel/ks8851.h | 3 ++
drivers/net/ethernet/micrel/ks8851_common.c | 20 +++++-----
drivers/net/ethernet/micrel/ks8851_spi.c | 42 +++++++++++++--------
3 files changed, 40 insertions(+), 25 deletions(-)
diff --git a/drivers/net/ethernet/micrel/ks8851.h b/drivers/net/ethernet/micrel/ks8851.h
index fecd43754cea..e5ec0a363aff 100644
--- a/drivers/net/ethernet/micrel/ks8851.h
+++ b/drivers/net/ethernet/micrel/ks8851.h
@@ -350,6 +350,8 @@ union ks8851_tx_hdr {
* @rxd: Space for receiving SPI data, in DMA-able space.
* @txd: Space for transmitting SPI data, in DMA-able space.
* @msg_enable: The message flags controlling driver output (see ethtool).
+ * @tx_space: Free space in the hardware TX buffer (cached copy of KS_TXMIR).
+ * @queued_len: Space required in hardware TX buffer for queued packets in txq.
* @fid: Incrementing frame id tag.
* @rc_ier: Cached copy of KS_IER.
* @rc_ccr: Cached copy of KS_CCR.
@@ -399,6 +401,7 @@ struct ks8851_net {
struct work_struct rxctrl_work;
struct sk_buff_head txq;
+ unsigned int queued_len;
struct eeprom_93cx6 eeprom;
struct regulator *vdd_reg;
diff --git a/drivers/net/ethernet/micrel/ks8851_common.c b/drivers/net/ethernet/micrel/ks8851_common.c
index cfbc900d4aeb..0bf13b38b8f5 100644
--- a/drivers/net/ethernet/micrel/ks8851_common.c
+++ b/drivers/net/ethernet/micrel/ks8851_common.c
@@ -362,16 +362,18 @@ static irqreturn_t ks8851_irq(int irq, void *_ks)
handled |= IRQ_RXPSI;
if (status & IRQ_TXI) {
- handled |= IRQ_TXI;
+ unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR);
- /* no lock here, tx queue should have been stopped */
+ netif_dbg(ks, intr, ks->netdev,
+ "%s: txspace %d\n", __func__, tx_space);
- /* update our idea of how much tx space is available to the
- * system */
- ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR);
+ spin_lock(&ks->statelock);
+ ks->tx_space = tx_space;
+ if (netif_queue_stopped(ks->netdev))
+ netif_wake_queue(ks->netdev);
+ spin_unlock(&ks->statelock);
- netif_dbg(ks, intr, ks->netdev,
- "%s: txspace %d\n", __func__, ks->tx_space);
+ handled |= IRQ_TXI;
}
if (status & IRQ_RXI)
@@ -414,9 +416,6 @@ static irqreturn_t ks8851_irq(int irq, void *_ks)
if (status & IRQ_LCI)
mii_check_link(&ks->mii);
- if (status & IRQ_TXI)
- netif_wake_queue(ks->netdev);
-
return IRQ_HANDLED;
}
@@ -500,6 +499,7 @@ static int ks8851_net_open(struct net_device *dev)
ks8851_wrreg16(ks, KS_ISR, ks->rc_ier);
ks8851_wrreg16(ks, KS_IER, ks->rc_ier);
+ ks->queued_len = 0;
netif_start_queue(ks->netdev);
netif_dbg(ks, ifup, ks->netdev, "network device up\n");
diff --git a/drivers/net/ethernet/micrel/ks8851_spi.c b/drivers/net/ethernet/micrel/ks8851_spi.c
index 70bc7253454f..88e26c120b48 100644
--- a/drivers/net/ethernet/micrel/ks8851_spi.c
+++ b/drivers/net/ethernet/micrel/ks8851_spi.c
@@ -286,6 +286,18 @@ static void ks8851_wrfifo_spi(struct ks8851_net *ks, struct sk_buff *txp,
netdev_err(ks->netdev, "%s: spi_sync() failed\n", __func__);
}
+/**
+ * calc_txlen - calculate size of message to send packet
+ * @len: Length of data
+ *
+ * Returns the size of the TXFIFO message needed to send
+ * this packet.
+ */
+static unsigned int calc_txlen(unsigned int len)
+{
+ return ALIGN(len + 4, 4);
+}
+
/**
* ks8851_rx_skb_spi - receive skbuff
* @ks: The device state
@@ -305,7 +317,9 @@ static void ks8851_rx_skb_spi(struct ks8851_net *ks, struct sk_buff *skb)
*/
static void ks8851_tx_work(struct work_struct *work)
{
+ unsigned int dequeued_len = 0;
struct ks8851_net_spi *kss;
+ unsigned short tx_space;
struct ks8851_net *ks;
unsigned long flags;
struct sk_buff *txb;
@@ -322,6 +336,8 @@ static void ks8851_tx_work(struct work_struct *work)
last = skb_queue_empty(&ks->txq);
if (txb) {
+ dequeued_len += calc_txlen(txb->len);
+
ks8851_wrreg16_spi(ks, KS_RXQCR,
ks->rc_rxqcr | RXQCR_SDA);
ks8851_wrfifo_spi(ks, txb, last);
@@ -332,6 +348,13 @@ static void ks8851_tx_work(struct work_struct *work)
}
}
+ tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR);
+
+ spin_lock(&ks->statelock);
+ ks->queued_len -= dequeued_len;
+ ks->tx_space = tx_space;
+ spin_unlock(&ks->statelock);
+
ks8851_unlock_spi(ks, &flags);
}
@@ -346,18 +369,6 @@ static void ks8851_flush_tx_work_spi(struct ks8851_net *ks)
flush_work(&kss->tx_work);
}
-/**
- * calc_txlen - calculate size of message to send packet
- * @len: Length of data
- *
- * Returns the size of the TXFIFO message needed to send
- * this packet.
- */
-static unsigned int calc_txlen(unsigned int len)
-{
- return ALIGN(len + 4, 4);
-}
-
/**
* ks8851_start_xmit_spi - transmit packet using SPI
* @skb: The buffer to transmit
@@ -386,16 +397,17 @@ static netdev_tx_t ks8851_start_xmit_spi(struct sk_buff *skb,
spin_lock(&ks->statelock);
- if (needed > ks->tx_space) {
+ if (ks->queued_len + needed > ks->tx_space) {
netif_stop_queue(dev);
ret = NETDEV_TX_BUSY;
} else {
- ks->tx_space -= needed;
+ ks->queued_len += needed;
skb_queue_tail(&ks->txq, skb);
}
spin_unlock(&ks->statelock);
- schedule_work(&kss->tx_work);
+ if (ret == NETDEV_TX_OK)
+ schedule_work(&kss->tx_work);
return ret;
}
--
2.43.0