Hi,
Would you be interested in acquiring *Physicians Email & Mailing List* for
your upcoming campaigns?
*Physician Specialties*
Anesthesiologist
Ophthalmologist
Cardiologist
Optometrist
Dermatologist
Pathologist
Dentist
Pediatrician
Emergency Medicine
Psychiatrist
Family Practitioners
Psychologist
Gastroenterologist
Plastic Surgeon
General Practitioners
Podiatrist
Gynecologist
Pulmonologist
Hospitalist
Radiologist
Hematologist
Rheumatologist
Internal Medicine
Urologist
Nephrologists
Physician Assistants
Neurologist
Nurse Practitioners
Oncologist
Registered Nurses etc.
Let me know your *target audience* so that I will get back to you with more
information along with *pricing*.
If you think I should be talking to someone else, please forward this email
to the concerned person.
Looking forward to hearing from you.
Regards,
*Dyana Collins**| **Online Marketing Executive*
PWe have a responsibility to the environment
Before printing this e-mail or any other document, let's ask ourselves
whether we need a hard copy
To unsubscribe, reply with “leave out” in the subject line.
This is the start of the stable review cycle for the 6.1.71 release.
There are 100 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 05 Jan 2024 16:47:49 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.71-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.71-rc1
Andrii Nakryiko <andrii(a)kernel.org>
tracing/kprobes: Fix symbol counting logic by looking at modules as well
Jiri Olsa <jolsa(a)kernel.org>
kallsyms: Make module_kallsyms_on_each_symbol generally available
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
device property: Allow const parameter to dev_fwnode()
Geert Uytterhoeven <geert+renesas(a)glider.be>
spi: Constify spi parameters of chip select APIs
NeilBrown <neilb(a)suse.de>
NFSD: fix possible oops when nfsd/pool_stats is closed.
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ring-buffer: Fix slowpath of interrupted event
Pablo Neira Ayuso <pablo(a)netfilter.org>
netfilter: nf_tables: skip set commit for deleted/destroyed sets
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Fix blocked reader of snapshot buffer
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ring-buffer: Fix wake ups when buffer_percent is set to 100
Matthew Wilcox (Oracle) <willy(a)infradead.org>
mm/memory-failure: check the mapcount of the precise page
Matthew Wilcox (Oracle) <willy(a)infradead.org>
mm/memory-failure: cast index to loff_t before shifting it
Charan Teja Kalla <quic_charante(a)quicinc.com>
mm: migrate high-order folios in swap cache correctly
Baokun Li <libaokun1(a)huawei.com>
mm/filemap: avoid buffered read/write race to read inconsistent data
Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com>
platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
Christoph Hellwig <hch(a)lst.de>
block: renumber QUEUE_FLAG_HW_WC
Louis Chauvet <louis.chauvet(a)bootlin.com>
spi: atmel: Fix clock issue when using devices with different polarities
Amit Kumar Mahapatra <amit.kumar-mahapatra(a)amd.com>
spi: Add APIs in spi core to set/get spi->chip_select and spi->cs_gpiod
Tudor Ambarus <tudor.ambarus(a)microchip.com>
spi: Reintroduce spi_set_cs_timing()
Helge Deller <deller(a)gmx.de>
linux/export: Ensure natural alignment of kcrctab array
NeilBrown <neilb(a)suse.de>
nfsd: call nfsd_last_thread() before final nfsd_put()
NeilBrown <neilb(a)suse.de>
nfsd: separate nfsd_last_thread() from nfsd_put()
Nuno Sa <nuno.sa(a)analog.com>
iio: imu: adis16475: add spi_device_id table
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
spi: Introduce spi_get_device_match_data() helper
Dan Carpenter <dan.carpenter(a)linaro.org>
usb: fotg210-hcd: delete an incorrect bounds test
Tony Lindgren <tony(a)atomide.com>
ARM: dts: Fix occasional boot hang for am3 usb
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix wrong allocation size update in smb2_open()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: lazy v2 lease break on smb2_write()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: send v2 lease break notification for directory
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: downgrade RWH lease caching state to RH for directory
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: set v2 lease capability
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: set epoch in create context v2 lease
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: release interim response after sending status pending response
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: move oplock handling after unlock parent dir
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: separately allocate ci per dentry
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix possible deadlock in smb2_open
Zongmin Zhou <zhouzongmin(a)kylinos.cn>
ksmbd: prevent memory leak on error return
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: no need to wait for binded connection termination at logoff
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: add support for surrogate pair conversion
Kangjing Huang <huangkangjing(a)gmail.com>
ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()
Marios Makassikis <mmakassikis(a)freebox.fr>
ksmbd: fix recursive locking in vfs helpers
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: reorganize ksmbd_iov_pin_rsp()
Cheng-Han Wu <hank20010209(a)gmail.com>
ksmbd: Remove unused field in ksmbd_user struct
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix potential double free on smb2_read_pipe() error path
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix Null pointer dereferences in ksmbd_update_fstate()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix wrong error response status by using set_smb2_rsp_status()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix race condition between tree conn lookup and disconnect
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix race condition from parallel smb2 lock requests
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix race condition from parallel smb2 logoff requests
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix race condition with fp
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: check iov vector index in ksmbd_conn_write()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: return invalid parameter error response if smb2 request is invalid
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix passing freed memory 'aux_payload_buf'
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: remove unneeded mark_inode_dirty in set_info_sec()
Steve French <stfrench(a)microsoft.com>
ksmbd: remove experimental warning
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: add missing calling smb2_set_err_rsp() on error
Yang Li <yang.lee(a)linux.alibaba.com>
ksmbd: Fix one kernel-doc comment
Atte Heikkilä <atteh.mailbox(a)gmail.com>
ksmbd: fix `force create mode' and `force directory mode'
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix wrong interim response on compound
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: add support for read compound
Yang Yingliang <yangyingliang(a)huawei.com>
ksmbd: switch to use kmemdup_nul() helper
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: check if a mount point is crossed during path lookup
Wang Ming <machel(a)vivo.com>
ksmbd: Fix unsigned expression compared with zero
Gustavo A. R. Silva <gustavoars(a)kernel.org>
ksmbd: Replace one-element array with flexible-array member
Gustavo A. R. Silva <gustavoars(a)kernel.org>
ksmbd: Use struct_size() helper in ksmbd_negotiate_smb_dialect()
Lu Hongfei <luhongfei(a)vivo.com>
ksmbd: Replace the ternary conditional operator with min()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: use kvzalloc instead of kvmalloc
Lu Hongfei <luhongfei(a)vivo.com>
ksmbd: Change the return value of ksmbd_vfs_query_maximal_access to void
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: return a literal instead of 'err' in ksmbd_vfs_kern_path_locked()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: use kzalloc() instead of __GFP_ZERO
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: remove unused ksmbd_tree_conn_share function
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: add mnt_want_write to ksmbd vfs functions
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: call putname after using the last component
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix uninitialized pointer read in smb2_create_link()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename()
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix racy issue from using ->d_parent and ->d_name
Al Viro <viro(a)zeniv.linux.org.uk>
fs: introduce lock_rename_child() helper
David Disseldorp <ddiss(a)suse.de>
ksmbd: remove unused compression negotiate ctx packing
David Disseldorp <ddiss(a)suse.de>
ksmbd: avoid duplicate negotiate ctx offset increments
David Disseldorp <ddiss(a)suse.de>
ksmbd: set NegotiateContextCount once instead of every inc
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: delete asynchronous work from list
Tom Rix <trix(a)redhat.com>
ksmbd: remove unused is_char_allowed function
Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com>
ksmbd: Fix parameter name and comment mismatch
Colin Ian King <colin.i.king(a)gmail.com>
ksmbd: Fix spelling mistake "excceed" -> "exceeded"
Steve French <stfrench(a)microsoft.com>
ksmbd: update Kconfig to note Kerberos support and fix indentation
Dawei Li <set_pte_at(a)outlook.com>
ksmbd: Remove duplicated codes
Dawei Li <set_pte_at(a)outlook.com>
ksmbd: fix typo, syncronous->synchronous
Dawei Li <set_pte_at(a)outlook.com>
ksmbd: Implements sess->rpc_handle_list as xarray
ye xingchen <ye.xingchen(a)zte.com.cn>
ksmbd: Convert to use sysfs_emit()/sysfs_emit_at() APIs
Marios Makassikis <mmakassikis(a)freebox.fr>
ksmbd: Fix resource leak in smb2_lock()
Jeff Layton <jlayton(a)kernel.org>
ksmbd: use F_SETLK when unlocking a file
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: set SMB2_SESSION_FLAG_ENCRYPT_DATA when enforcing data encryption for this share
Gustavo A. R. Silva <gustavoars(a)kernel.org>
ksmbd: replace one-element arrays with flexible-array members
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/am33xx.dtsi | 1 +
drivers/base/property.c | 11 +-
drivers/iio/imu/adis16475.c | 129 +++--
drivers/platform/x86/p2sb.c | 178 +++++--
drivers/spi/spi-atmel.c | 82 ++-
drivers/spi/spi.c | 92 +++-
drivers/usb/host/fotg210-hcd.c | 3 -
fs/namei.c | 125 ++++-
fs/nfsd/nfsctl.c | 9 +-
fs/nfsd/nfsd.h | 8 +-
fs/nfsd/nfssvc.c | 57 +-
fs/smb/common/smb2pdu.h | 1 +
fs/smb/server/Kconfig | 10 +-
fs/smb/server/asn1.c | 33 +-
fs/smb/server/auth.c | 11 +-
fs/smb/server/connection.c | 74 +--
fs/smb/server/connection.h | 2 +-
fs/smb/server/ksmbd_netlink.h | 4 +-
fs/smb/server/ksmbd_work.c | 100 +++-
fs/smb/server/ksmbd_work.h | 36 +-
fs/smb/server/mgmt/share_config.h | 29 +-
fs/smb/server/mgmt/tree_connect.c | 53 +-
fs/smb/server/mgmt/tree_connect.h | 14 +-
fs/smb/server/mgmt/user_config.h | 1 -
fs/smb/server/mgmt/user_session.c | 38 +-
fs/smb/server/mgmt/user_session.h | 3 +-
fs/smb/server/oplock.c | 147 ++++--
fs/smb/server/oplock.h | 8 +-
fs/smb/server/server.c | 36 +-
fs/smb/server/smb2misc.c | 19 +-
fs/smb/server/smb2ops.c | 19 +-
fs/smb/server/smb2pdu.c | 1033 ++++++++++++++++---------------------
fs/smb/server/smb2pdu.h | 3 +-
fs/smb/server/smb_common.c | 19 +-
fs/smb/server/smb_common.h | 14 +-
fs/smb/server/smbacl.c | 20 +-
fs/smb/server/smbacl.h | 2 +-
fs/smb/server/transport_ipc.c | 4 +-
fs/smb/server/transport_rdma.c | 44 +-
fs/smb/server/unicode.c | 191 ++++---
fs/smb/server/vfs.c | 638 ++++++++++++-----------
fs/smb/server/vfs.h | 52 +-
fs/smb/server/vfs_cache.c | 63 ++-
fs/smb/server/vfs_cache.h | 18 +-
include/linux/blkdev.h | 2 +-
include/linux/export-internal.h | 1 +
include/linux/module.h | 9 +
include/linux/namei.h | 7 +
include/linux/property.h | 7 +-
include/linux/spi/spi.h | 23 +
kernel/module/kallsyms.c | 2 -
kernel/trace/ring_buffer.c | 140 ++---
kernel/trace/trace.c | 20 +-
kernel/trace/trace_kprobe.c | 25 +-
mm/filemap.c | 9 +
mm/memory-failure.c | 8 +-
mm/migrate.c | 9 +-
net/netfilter/nf_tables_api.c | 2 +-
59 files changed, 2139 insertions(+), 1563 deletions(-)
The OPP core finds the eventual frequency to set with the help of
clk_round_rate() and the same was earlier getting passed to _set_opp()
and that's what would get configured.
The commit 1efae8d2e777 ("OPP: Make dev_pm_opp_set_opp() independent of
frequency") mistakenly changed that. Fix it.
Fixes: 1efae8d2e777 ("OPP: Make dev_pm_opp_set_opp() independent of frequency")
Cc: v5.18+ <stable(a)vger.kernel.org> # v6.0+
Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org>
---
drivers/opp/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 29f8160c3e38..5e6cfcbd2e87 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -1352,12 +1352,12 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq)
* value of the frequency. In such a case, do not abort but
* configure the hardware to the desired frequency forcefully.
*/
- forced = opp_table->rate_clk_single != target_freq;
+ forced = opp_table->rate_clk_single != freq;
}
- ret = _set_opp(dev, opp_table, opp, &target_freq, forced);
+ ret = _set_opp(dev, opp_table, opp, &freq, forced);
- if (target_freq)
+ if (freq)
dev_pm_opp_put(opp);
put_opp_table:
--
2.31.1.272.g89b43f80a514
This is a note to let you know that I've just added the patch titled
usb: mon: Fix atomicity violation in mon_bin_vma_fault
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
From 2dd23cc4d0e6aa55cf9fb3b05f2f4165b01de81c Mon Sep 17 00:00:00 2001
From: Gui-Dong Han <2045gemini(a)gmail.com>
Date: Fri, 5 Jan 2024 13:24:12 +0800
Subject: usb: mon: Fix atomicity violation in mon_bin_vma_fault
In mon_bin_vma_fault():
offset = vmf->pgoff << PAGE_SHIFT;
if (offset >= rp->b_size)
return VM_FAULT_SIGBUS;
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;
The code is executed without holding any lock.
In mon_bin_vma_close():
spin_lock_irqsave(&rp->b_lock, flags);
rp->mmap_active--;
spin_unlock_irqrestore(&rp->b_lock, flags);
In mon_bin_ioctl():
spin_lock_irqsave(&rp->b_lock, flags);
if (rp->mmap_active) {
...
} else {
...
kfree(rp->b_vec);
rp->b_vec = vec;
rp->b_size = size;
...
}
spin_unlock_irqrestore(&rp->b_lock, flags);
Concurrent execution of mon_bin_vma_fault() with mon_bin_vma_close() and
mon_bin_ioctl() could lead to atomicity violations. mon_bin_vma_fault()
accesses rp->b_size and rp->b_vec without locking, risking array
out-of-bounds access or use-after-free bugs due to possible modifications
in mon_bin_ioctl().
This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.
To address this issue, it is proposed to add a spin lock pair in
mon_bin_vma_fault() to ensure atomicity. With this patch applied, our tool
never reports the possible bug, with the kernel configuration allyesconfig
for x86_64. Due to the lack of associated hardware, we cannot test the
patch in runtime testing, and just verify it according to the code logic.
[1] https://sites.google.com/view/basscheck/
Fixes: 19e6317d24c2 ("usb: mon: Fix a deadlock in usbmon between ...")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com>
Link: https://lore.kernel.org/r/20240105052412.9377-1-2045gemini@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/mon/mon_bin.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 9ca9305243fe..4e30de4db1c0 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1250,14 +1250,19 @@ static vm_fault_t mon_bin_vma_fault(struct vm_fault *vmf)
struct mon_reader_bin *rp = vmf->vma->vm_private_data;
unsigned long offset, chunk_idx;
struct page *pageptr;
+ unsigned long flags;
+ spin_lock_irqsave(&rp->b_lock, flags);
offset = vmf->pgoff << PAGE_SHIFT;
- if (offset >= rp->b_size)
+ if (offset >= rp->b_size) {
+ spin_unlock_irqrestore(&rp->b_lock, flags);
return VM_FAULT_SIGBUS;
+ }
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;
get_page(pageptr);
vmf->page = pageptr;
+ spin_unlock_irqrestore(&rp->b_lock, flags);
return 0;
}
--
2.43.0
This is a note to let you know that I've just added the patch titled
usb: mon: Fix atomicity violation in mon_bin_vma_fault
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
From 2dd23cc4d0e6aa55cf9fb3b05f2f4165b01de81c Mon Sep 17 00:00:00 2001
From: Gui-Dong Han <2045gemini(a)gmail.com>
Date: Fri, 5 Jan 2024 13:24:12 +0800
Subject: usb: mon: Fix atomicity violation in mon_bin_vma_fault
In mon_bin_vma_fault():
offset = vmf->pgoff << PAGE_SHIFT;
if (offset >= rp->b_size)
return VM_FAULT_SIGBUS;
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;
The code is executed without holding any lock.
In mon_bin_vma_close():
spin_lock_irqsave(&rp->b_lock, flags);
rp->mmap_active--;
spin_unlock_irqrestore(&rp->b_lock, flags);
In mon_bin_ioctl():
spin_lock_irqsave(&rp->b_lock, flags);
if (rp->mmap_active) {
...
} else {
...
kfree(rp->b_vec);
rp->b_vec = vec;
rp->b_size = size;
...
}
spin_unlock_irqrestore(&rp->b_lock, flags);
Concurrent execution of mon_bin_vma_fault() with mon_bin_vma_close() and
mon_bin_ioctl() could lead to atomicity violations. mon_bin_vma_fault()
accesses rp->b_size and rp->b_vec without locking, risking array
out-of-bounds access or use-after-free bugs due to possible modifications
in mon_bin_ioctl().
This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.
To address this issue, it is proposed to add a spin lock pair in
mon_bin_vma_fault() to ensure atomicity. With this patch applied, our tool
never reports the possible bug, with the kernel configuration allyesconfig
for x86_64. Due to the lack of associated hardware, we cannot test the
patch in runtime testing, and just verify it according to the code logic.
[1] https://sites.google.com/view/basscheck/
Fixes: 19e6317d24c2 ("usb: mon: Fix a deadlock in usbmon between ...")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com>
Link: https://lore.kernel.org/r/20240105052412.9377-1-2045gemini@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/mon/mon_bin.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 9ca9305243fe..4e30de4db1c0 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1250,14 +1250,19 @@ static vm_fault_t mon_bin_vma_fault(struct vm_fault *vmf)
struct mon_reader_bin *rp = vmf->vma->vm_private_data;
unsigned long offset, chunk_idx;
struct page *pageptr;
+ unsigned long flags;
+ spin_lock_irqsave(&rp->b_lock, flags);
offset = vmf->pgoff << PAGE_SHIFT;
- if (offset >= rp->b_size)
+ if (offset >= rp->b_size) {
+ spin_unlock_irqrestore(&rp->b_lock, flags);
return VM_FAULT_SIGBUS;
+ }
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;
get_page(pageptr);
vmf->page = pageptr;
+ spin_unlock_irqrestore(&rp->b_lock, flags);
return 0;
}
--
2.43.0
This is a note to let you know that I've just added the patch titled
usb: typec: class: fix typec_altmode_put_partner to put plugs
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
From 5962ded777d689cd8bf04454273e32228d7fb71f Mon Sep 17 00:00:00 2001
From: RD Babiera <rdbabiera(a)google.com>
Date: Wed, 3 Jan 2024 18:17:55 +0000
Subject: usb: typec: class: fix typec_altmode_put_partner to put plugs
When typec_altmode_put_partner is called by a plug altmode upon release,
the port altmode the plug belongs to will not remove its reference to the
plug. The check to see if the altmode being released is a plug evaluates
against the released altmode's partner instead of the calling altmode, so
change adev in typec_altmode_put_partner to properly refer to the altmode
being released.
Because typec_altmode_set_partner calls get_device() on the port altmode,
add partner_adev that points to the port altmode in typec_put_partner to
call put_device() on. typec_altmode_set_partner is not called for port
altmodes, so add a check in typec_altmode_release to prevent
typec_altmode_put_partner() calls on port altmode release.
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Cc: <stable(a)vger.kernel.org>
Co-developed-by: Christian A. Ehrhardt <lk(a)c--e.de>
Signed-off-by: Christian A. Ehrhardt <lk(a)c--e.de>
Signed-off-by: RD Babiera <rdbabiera(a)google.com>
Tested-by: Christian A. Ehrhardt <lk(a)c--e.de>
Acked-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
Link: https://lore.kernel.org/r/20240103181754.2492492-2-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/typec/class.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 4d11f2b536fa..015aa9253353 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -263,11 +263,13 @@ static void typec_altmode_put_partner(struct altmode *altmode)
{
struct altmode *partner = altmode->partner;
struct typec_altmode *adev;
+ struct typec_altmode *partner_adev;
if (!partner)
return;
- adev = &partner->adev;
+ adev = &altmode->adev;
+ partner_adev = &partner->adev;
if (is_typec_plug(adev->dev.parent)) {
struct typec_plug *plug = to_typec_plug(adev->dev.parent);
@@ -276,7 +278,7 @@ static void typec_altmode_put_partner(struct altmode *altmode)
} else {
partner->partner = NULL;
}
- put_device(&adev->dev);
+ put_device(&partner_adev->dev);
}
/**
@@ -497,7 +499,8 @@ static void typec_altmode_release(struct device *dev)
{
struct altmode *alt = to_altmode(to_typec_altmode(dev));
- typec_altmode_put_partner(alt);
+ if (!is_typec_port(dev->parent))
+ typec_altmode_put_partner(alt);
altmode_id_remove(alt->adev.dev.parent, alt->id);
kfree(alt);
--
2.43.0
This is a note to let you know that I've just added the patch titled
usb: dwc3: gadget: Queue PM runtime idle on disconnect event
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
From 3c7af52c7616c3aa6dacd2336ec748d4a65df8f4 Mon Sep 17 00:00:00 2001
From: Wesley Cheng <quic_wcheng(a)quicinc.com>
Date: Wed, 3 Jan 2024 13:49:46 -0800
Subject: usb: dwc3: gadget: Queue PM runtime idle on disconnect event
There is a scenario where DWC3 runtime suspend is blocked due to the
dwc->connected flag still being true while PM usage_count is zero after
DWC3 giveback is completed and the USB gadget session is being terminated.
This leads to a case where nothing schedules a PM runtime idle for the
device.
The exact condition is seen with the following sequence:
1. USB bus reset is issued by the host
2. Shortly after, or concurrently, a USB PD DR SWAP request is received
(sink->source)
3. USB bus reset event handler runs and issues
dwc3_stop_active_transfers(), and pending transfer are stopped
4. DWC3 usage_count decremented to 0, and runtime idle occurs while
dwc->connected == true, returns -EBUSY
5. DWC3 disconnect event seen, dwc->connected set to false due to DR
swap handling
6. No runtime idle after this point
Address this by issuing an asynchronous PM runtime idle call after the
disconnect event is completed, as it modifies the dwc->connected flag,
which is what blocks the initial runtime idle.
Fixes: fc8bb91bc83e ("usb: dwc3: implement runtime PM")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Wesley Cheng <quic_wcheng(a)quicinc.com>
Link: https://lore.kernel.org/r/20240103214946.2596-1-quic_wcheng@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index c15e965ea95a..019368f8e9c4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3989,6 +3989,13 @@ static void dwc3_gadget_disconnect_interrupt(struct dwc3 *dwc)
usb_gadget_set_state(dwc->gadget, USB_STATE_NOTATTACHED);
dwc3_ep0_reset_state(dwc);
+
+ /*
+ * Request PM idle to address condition where usage count is
+ * already decremented to zero, but waiting for the disconnect
+ * interrupt to set dwc->connected to FALSE.
+ */
+ pm_request_idle(dwc->dev);
}
static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
--
2.43.0