December 2024 - Linux-stable-mirror

[PATCH] rust: enable arbitrary_self_types and remove `Receiver`

by Miguel Ojeda

From: Gary Guo <gary(a)garyguo.net> [ Upstream commit c95bbb59a9b22f9b838b15d28319185c1c884329 ] The term "receiver" means that a type can be used as the type of `self`, and thus enables method call syntax `foo.bar()` instead of `Foo::bar(foo)`. Stable Rust as of today (1.81) enables a limited selection of types (primitives and types in std, e.g. `Box` and `Arc`) to be used as receivers, while custom types cannot. We want the kernel `Arc` type to have the same functionality as the Rust std `Arc`, so we use the `Receiver` trait (gated behind `receiver_trait` unstable feature) to gain the functionality. The `arbitrary_self_types` RFC [1] (tracking issue [2]) is accepted and it will allow all types that implement a new `Receiver` trait (different from today's unstable trait) to be used as receivers. This trait will be automatically implemented for all `Deref` types, which include our `Arc` type, so we no longer have to opt-in to be used as receiver. To prepare us for the change, remove the `Receiver` implementation and the associated feature. To still allow `Arc` and others to be used as method receivers, turn on `arbitrary_self_types` feature instead. This feature gate is introduced in 1.23.0. It used to enable both `Deref` types and raw pointer types to be used as receivers, but the latter is now split into a different feature gate in Rust 1.83 nightly. We do not need receivers on raw pointers so this change would not affect us and usage of `arbitrary_self_types` feature would work for all Rust versions that we support (>=1.78). Cc: Adrian Taylor <ade(a)hohum.me.uk> Link: https://github.com/rust-lang/rfcs/pull/3519 [1] Link: https://github.com/rust-lang/rust/issues/44874 [2] Signed-off-by: Gary Guo <gary(a)garyguo.net> Reviewed-by: Benno Lossin <benno.lossin(a)proton.me> Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Link: https://lore.kernel.org/r/20240915132734.1653004-1-gary@garyguo.net Signed-off-by: Miguel Ojeda <ojeda(a)kernel.org> --- Please consider applying to 6.12.y. It is meant to support the upcoming Rust 1.84.0 compiler (to be released in a month), since 6.12 LTS is the first stable kernel that supports a minimum Rust version, thus users may use newer compilers. Older LTSs do not need it, for that reason. rust/kernel/lib.rs | 2 +- rust/kernel/list/arc.rs | 3 --- rust/kernel/sync/arc.rs | 6 ------ scripts/Makefile.build | 2 +- 4 files changed, 2 insertions(+), 11 deletions(-) diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs index 032c9089e686..e936254531fd 100644 --- a/rust/kernel/lib.rs +++ b/rust/kernel/lib.rs @@ -12,10 +12,10 @@ //! do so first instead of bypassing this crate. #![no_std] +#![feature(arbitrary_self_types)] #![feature(coerce_unsized)] #![feature(dispatch_from_dyn)] #![feature(new_uninit)] -#![feature(receiver_trait)] #![feature(unsize)] // Ensure conditional compilation based on the kernel configuration works; diff --git a/rust/kernel/list/arc.rs b/rust/kernel/list/arc.rs index d801b9dc6291..3483d8c232c4 100644 --- a/rust/kernel/list/arc.rs +++ b/rust/kernel/list/arc.rs @@ -441,9 +441,6 @@ fn as_ref(&self) -> &Arc<T> { } } -// This is to allow [`ListArc`] (and variants) to be used as the type of `self`. -impl<T, const ID: u64> core::ops::Receiver for ListArc<T, ID> where T: ListArcSafe<ID> + ?Sized {} - // This is to allow coercion from `ListArc<T>` to `ListArc` if `T` can be converted to the // dynamically-sized type (DST) `U`. impl<T, U, const ID: u64> core::ops::CoerceUnsized<ListArc<U, ID>> for ListArc<T, ID> diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs index 3021f30fd822..28743a7c74a8 100644 --- a/rust/kernel/sync/arc.rs +++ b/rust/kernel/sync/arc.rs @@ -171,9 +171,6 @@ unsafe fn container_of(ptr: *const T) -> NonNull<ArcInner<T>> { } } -// This is to allow [`Arc`] (and variants) to be used as the type of `self`. -impl<T: ?Sized> core::ops::Receiver for Arc<T> {} - // This is to allow coercion from `Arc<T>` to `Arc` if `T` can be converted to the // dynamically-sized type (DST) `U`. impl<T: ?Sized + Unsize, U: ?Sized> core::ops::CoerceUnsized<Arc> for Arc<T> {} @@ -480,9 +477,6 @@ pub struct ArcBorrow<'a, T: ?Sized + 'a> { _p: PhantomData<&'a ()>, } -// This is to allow [`ArcBorrow`] (and variants) to be used as the type of `self`. -impl<T: ?Sized> core::ops::Receiver for ArcBorrow<'_, T> {} - // This is to allow `ArcBorrow` to be dispatched on when `ArcBorrow<T>` can be coerced into // `ArcBorrow`. impl<T: ?Sized + Unsize, U: ?Sized> core::ops::DispatchFromDyn<ArcBorrow<'_, U>> diff --git a/scripts/Makefile.build b/scripts/Makefile.build index 8f423a1faf50..880785b52c04 100644 --- a/scripts/Makefile.build +++ b/scripts/Makefile.build @@ -248,7 +248,7 @@ $(obj)/%.lst: $(obj)/%.c FORCE # Compile Rust sources (.rs) # --------------------------------------------------------------------------- -rust_allowed_features := new_uninit +rust_allowed_features := arbitrary_self_types,new_uninit # `--out-dir` is required to avoid temporaries being created by `rustc` in the # current working directory, which may be not accessible in the out-of-tree base-commit: 61baee2dc5341c936e7fa7b1ca33c5607868de69 -- 2.47.1

7 months

2
1
0 0

[PATCH 6.6.y] iommu/arm-smmu: Defer probe of clients after smmu device bound

by Robin Murphy

From: Pratyush Brahma <quic_pbrahma(a)quicinc.com> [ Upstream commit 229e6ee43d2a160a1592b83aad620d6027084aad ] Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called. Following is how the race occurs: T1:Smmu device probe T2: Client device probe really_probe() arm_smmu_device_probe() iommu_device_register() really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu->streamid_mask */ driver_bound() klist_add_tail() When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes. Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver. Fixes: 021bb8420d44 ("iommu/arm-smmu: Wire up generic configuration support") Cc: stable(a)vger.kernel.org # 6.6 Co-developed-by: Prakash Gupta <quic_guptap(a)quicinc.com> Signed-off-by: Prakash Gupta <quic_guptap(a)quicinc.com> Signed-off-by: Pratyush Brahma <quic_pbrahma(a)quicinc.com> Link: https://lore.kernel.org/r/20241004090428.2035-1-quic_pbrahma@quicinc.com [will: Add comment] Signed-off-by: Will Deacon <will(a)kernel.org> [rm: backport for context conflict prior to 6.8] Signed-off-by: Robin Murphy <robin.murphy(a)arm.com> --- drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c index d6d1a2a55cc0..42c5012ba8aa 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c @@ -1359,6 +1359,17 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) goto out_free; } else if (fwspec && fwspec->ops == &arm_smmu_ops) { smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode); + + /* + * Defer probe if the relevant SMMU instance hasn't finished + * probing yet. This is a fragile hack and we'd ideally + * avoid this race in the core code. Until that's ironed + * out, however, this is the most pragmatic option on the + * table. + */ + if (!smmu) + return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER, + "smmu dev has not bound yet\n")); } else { return ERR_PTR(-ENODEV); } -- 2.39.2.101.g768bb238c484.dirty

7 months

3
2
0 0

[PATCH] drm/amdgpu: rework resume handling for display (v2)

by Alex Deucher

Split resume into a 3rd step to handle displays when DCC is enabled on DCN 4.0.1. Move display after the buffer funcs have been re-enabled so that the GPU will do the move and properly set the DCC metadata for DCN. v2: fix fence irq resume ordering Backport to 6.12 and older kernels Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org # 6.11.x (cherry picked from commit 73dae652dcac776296890da215ee7dec357a1032) --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 45 +++++++++++++++++++++- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index 1f08cb88d51b..66890f8a7670 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -3666,7 +3666,7 @@ static int amdgpu_device_ip_resume_phase1(struct amdgpu_device *adev) * * @adev: amdgpu_device pointer * - * First resume function for hardware IPs. The list of all the hardware + * Second resume function for hardware IPs. The list of all the hardware * IPs that make up the asic is walked and the resume callbacks are run for * all blocks except COMMON, GMC, and IH. resume puts the hardware into a * functional state after a suspend and updates the software state as @@ -3684,6 +3684,7 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev) if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_COMMON || adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC || adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_IH || + adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE || adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_PSP) continue; r = adev->ip_blocks[i].version->funcs->resume(adev); @@ -3698,6 +3699,36 @@ static int amdgpu_device_ip_resume_phase2(struct amdgpu_device *adev) return 0; } +/** + * amdgpu_device_ip_resume_phase3 - run resume for hardware IPs + * + * @adev: amdgpu_device pointer + * + * Third resume function for hardware IPs. The list of all the hardware + * IPs that make up the asic is walked and the resume callbacks are run for + * all DCE. resume puts the hardware into a functional state after a suspend + * and updates the software state as necessary. This function is also used + * for restoring the GPU after a GPU reset. + * + * Returns 0 on success, negative error code on failure. + */ +static int amdgpu_device_ip_resume_phase3(struct amdgpu_device *adev) +{ + int i, r; + + for (i = 0; i < adev->num_ip_blocks; i++) { + if (!adev->ip_blocks[i].status.valid || adev->ip_blocks[i].status.hw) + continue; + if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_DCE) { + r = adev->ip_blocks[i].version->funcs->resume(adev); + if (r) + return r; + } + } + + return 0; +} + /** * amdgpu_device_ip_resume - run resume for hardware IPs * @@ -3727,6 +3758,13 @@ static int amdgpu_device_ip_resume(struct amdgpu_device *adev) if (adev->mman.buffer_funcs_ring->sched.ready) amdgpu_ttm_set_buffer_funcs_status(adev, true); + if (r) + return r; + + amdgpu_fence_driver_hw_init(adev); + + r = amdgpu_device_ip_resume_phase3(adev); + return r; } @@ -4809,7 +4847,6 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon) dev_err(adev->dev, "amdgpu_device_ip_resume failed (%d).\n", r); goto exit; } - amdgpu_fence_driver_hw_init(adev); if (!adev->in_s0ix) { r = amdgpu_amdkfd_resume(adev, adev->in_runpm); @@ -5431,6 +5468,10 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, if (tmp_adev->mman.buffer_funcs_ring->sched.ready) amdgpu_ttm_set_buffer_funcs_status(tmp_adev, true); + r = amdgpu_device_ip_resume_phase3(tmp_adev); + if (r) + goto out; + if (vram_lost) amdgpu_device_fill_reset_magic(tmp_adev); -- 2.47.1

7 months

2
1
0 0

FAILED: patch "[PATCH] modpost: Add .irqentry.text to OTHER_SECTIONS" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 7912405643a14b527cd4a4f33c1d4392da900888 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024121044-elbow-varmint-5f14@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7912405643a14b527cd4a4f33c1d4392da900888 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner <tglx(a)linutronix.de> Date: Sun, 1 Dec 2024 12:17:30 +0100 Subject: [PATCH] modpost: Add .irqentry.text to OTHER_SECTIONS The compiler can fully inline the actual handler function of an interrupt entry into the .irqentry.text entry point. If such a function contains an access which has an exception table entry, modpost complains about a section mismatch: WARNING: vmlinux.o(__ex_table+0x447c): Section mismatch in reference ... The relocation at __ex_table+0x447c references section ".irqentry.text" which is not in the list of authorized sections. Add .irqentry.text to OTHER_SECTIONS to cure the issue. Reported-by: Sergey Senozhatsky <senozhatsky(a)chromium.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org # needed for linux-5.4-y Link: https://lore.kernel.org/all/20241128111844.GE10431@google.com/ Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index 0584cbcdbd2d..fb787a5715f5 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -772,7 +772,7 @@ static void check_section(const char *modname, struct elf_info *elf, ".ltext", ".ltext.*" #define OTHER_TEXT_SECTIONS ".ref.text", ".head.text", ".spinlock.text", \ ".fixup", ".entry.text", ".exception.text", \ - ".coldtext", ".softirqentry.text" + ".coldtext", ".softirqentry.text", ".irqentry.text" #define ALL_TEXT_SECTIONS ".init.text", ".exit.text", \ TEXT_SECTIONS, OTHER_TEXT_SECTIONS

7 months

3
2
0 0

[PATCH 6.1.y] i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition

by jianqi.ren.cn＠windriver.com

From: Kaixin Wang <kxwang23(a)m.fudan.edu.cn> [ Upstream commit 609366e7a06d035990df78f1562291c3bf0d4a12 ] In the cdns_i3c_master_probe function, &master->hj_work is bound with cdns_i3c_master_hj. And cdns_i3c_master_interrupt can call cnds_i3c_master_demux_ibis function to start the work. If we remove the module which will call cdns_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | cdns_i3c_master_hj cdns_i3c_master_remove | i3c_master_unregister(&master->base) | device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in cdns_i3c_master_remove. Signed-off-by: Kaixin Wang <kxwang23(a)m.fudan.edu.cn> Link: https://lore.kernel.org/r/20240911153544.848398-1-kxwang23@m.fudan.edu.cn Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- drivers/i3c/master/i3c-master-cdns.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c index b9cfda6ae9ae..4473c0b1ae2e 100644 --- a/drivers/i3c/master/i3c-master-cdns.c +++ b/drivers/i3c/master/i3c-master-cdns.c @@ -1668,6 +1668,7 @@ static int cdns_i3c_master_remove(struct platform_device *pdev) struct cdns_i3c_master *master = platform_get_drvdata(pdev); int ret; + cancel_work_sync(&master->hj_work); ret = i3c_master_unregister(&master->base); if (ret) return ret; -- 2.25.1

7 months

2
1
0 0

[PATCH] drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX

by guocai.he.cn＠windriver.com

From: Wayne Lin <wayne.lin(a)amd.com> [ Upstream commit ad28d7c3d989fc5689581664653879d664da76f0 ] [Why & How] It actually exposes '6' types in enum dmub_notification_type. Not 5. Using smaller number to create array dmub_callback & dmub_thread_offload has potential to access item out of array bound. Fix it. Reviewed-by: Jerry Zuo <jerry.zuo(a)amd.com> Acked-by: Zaeem Mohamed <zaeem.mohamed(a)amd.com> Signed-off-by: Wayne Lin <wayne.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Cherry-pick from 9f404b0bc2df3880758fb3c3bc7496f596f347d7 CVE-2024-46871 Signed-off-by: Guocai He <guocai.he.cn(a)windriver.com> --- This commit is backporting 9f404b0bc2df3880758fb3c3bc7496f596f347d7 to the branch linux-5.15.y to solve the CVE-2024-46871. Please merge this commit to linux-5.15.y. drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h index f9c3e5a41713..3102ade85b55 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h @@ -48,7 +48,7 @@ #define AMDGPU_DM_MAX_NUM_EDP 2 -#define AMDGPU_DMUB_NOTIFICATION_MAX 5 +#define AMDGPU_DMUB_NOTIFICATION_MAX 6 /* #include "include/amdgpu_dal_power_if.h" #include "amdgpu_dm_irq.h" -- 2.34.1

7 months

2
1
0 0

[PATCH] bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors

by Jann Horn

Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF program to a uprobe, and non-sleepable BPF programs are freed via normal RCU (see __bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal RCU grace period does not imply a tasks-trace-RCU grace period. Fix it by explicitly waiting for a tasks-trace-RCU grace period after removing the attachment of a bpf_prog to a perf_event. Cc: stable(a)vger.kernel.org Fixes: 8c7dcb84e3b7 ("bpf: implement sleepable uprobes by chaining gps") Suggested-by: Andrii Nakryiko <andrii(a)kernel.org> Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Jann Horn <jannh(a)google.com> --- kernel/trace/bpf_trace.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 949a3870946c381820e8fa7194851b84593d17d9..a403b05a7091384fb08e8c47ed02fad79c1a4874 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -2258,6 +2258,13 @@ void perf_event_detach_bpf_prog(struct perf_event *event) bpf_prog_array_free_sleepable(old_array); } + /* + * It could be that the bpf_prog is not sleepable (and will be freed + * via normal RCU), but is called from a point that supports sleepable + * programs and uses tasks-trace-RCU. + */ + synchronize_rcu_tasks_trace(); + bpf_prog_put(event->prog); event->prog = NULL; --- base-commit: 509df676c2d79c985ec2eaa3e3a3bbe557645861 change-id: 20241210-bpf-fix-actual-uprobe-uaf-0aa234c0e005 -- Jann Horn <jannh(a)google.com>

7 months, 1 week

2
1
0 0

[PATCH v2 1/1] tty: serial: 8250: Fix another runtime PM usage counter underflow

by Ilpo Järvinen

The commit f9b11229b79c ("serial: 8250: Fix PM usage_count for console handover") fixed one runtime PM usage counter balance problem that occurs because .dev is not set during univ8250 setup preventing call to pm_runtime_get_sync(). Later, univ8250_console_exit() will trigger the runtime PM usage counter underflow as .dev is already set at that time. Call pm_runtime_get_sync() to balance the RPM usage counter also in serial8250_register_8250_port() before trying to add the port. Reported-by: Borislav Petkov (AMD) <bp(a)alien8.de> Fixes: bedb404e91bb ("serial: 8250_port: Don't use power management for kernel console") Cc: <stable(a)vger.kernel.org> Tested-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> --- v2: - Added tags drivers/tty/serial/8250/8250_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c index 5f9f06911795..68baf75bdadc 100644 --- a/drivers/tty/serial/8250/8250_core.c +++ b/drivers/tty/serial/8250/8250_core.c @@ -812,6 +812,9 @@ int serial8250_register_8250_port(const struct uart_8250_port *up) uart->dl_write = up->dl_write; if (uart->port.type != PORT_8250_CIR) { + if (uart_console_registered(&uart->port)) + pm_runtime_get_sync(uart->port.dev); + if (serial8250_isa_config != NULL) serial8250_isa_config(0, &uart->port, &uart->capabilities); -- 2.39.5

7 months, 1 week

1
0
0 0

Linux 6.12.4

by Greg Kroah-Hartman

I'm announcing the release of the 6.12.4 kernel. All users of the 6.12 kernel series must upgrade. The updated 6.12.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 Makefile | 2 arch/arm/kernel/entry-armv.S | 8 arch/arm/mm/ioremap.c | 35 ++- arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 6 arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 arch/powerpc/Kconfig | 4 arch/powerpc/Makefile | 13 - arch/powerpc/kernel/vdso/Makefile | 8 arch/s390/kernel/entry.S | 4 arch/s390/kernel/kprobes.c | 6 arch/s390/kernel/stacktrace.c | 2 drivers/android/binder.c | 64 ++++-- drivers/base/core.c | 55 ++--- drivers/block/zram/zram_drv.c | 7 drivers/clk/qcom/gcc-qcs404.c | 1 drivers/cpufreq/scmi-cpufreq.c | 4 drivers/firmware/efi/libstub/efi-stub.c | 2 drivers/gpu/drm/Kconfig | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c | 9 drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 drivers/gpu/drm/amd/display/dc/core/dc.c | 3 drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 15 - drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 23 ++ drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h | 2 drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h | 13 + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 2 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 6 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 33 ++- drivers/gpu/drm/bridge/ite-it6505.c | 8 drivers/gpu/drm/drm_atomic_helper.c | 2 drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 1 drivers/gpu/drm/radeon/radeon_connectors.c | 10 drivers/gpu/drm/sti/sti_cursor.c | 3 drivers/gpu/drm/sti/sti_gdp.c | 3 drivers/gpu/drm/sti/sti_hqvdp.c | 3 drivers/gpu/drm/xe/xe_guc_submit.c | 17 + drivers/gpu/drm/xe/xe_migrate.c | 6 drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 drivers/i3c/master.c | 2 drivers/i3c/master/svc-i3c-master.c | 39 ++- drivers/iio/accel/kionix-kx022a.c | 2 drivers/iio/adc/ad7780.c | 2 drivers/iio/adc/ad7923.c | 4 drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 4 drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 3 drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 1 drivers/iio/industrialio-gts-helper.c | 2 drivers/iio/inkern.c | 2 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 2 drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 + drivers/iommu/io-pgtable-arm.c | 18 + drivers/leds/flash/leds-mt6360.c | 3 drivers/leds/leds-lp55xx-common.c | 3 drivers/md/dm-thin.c | 1 drivers/md/md-bitmap.c | 1 drivers/md/persistent-data/dm-space-map-common.c | 2 drivers/md/raid5.c | 4 drivers/media/dvb-frontends/ts2020.c | 8 drivers/media/i2c/dw9768.c | 10 drivers/media/i2c/ov08x40.c | 33 ++- drivers/media/i2c/tc358743.c | 4 drivers/media/platform/allegro-dvt/allegro-core.c | 4 drivers/media/platform/amphion/vpu_drv.c | 2 drivers/media/platform/amphion/vpu_v4l2.c | 2 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 - drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 drivers/media/platform/qcom/camss/camss.c | 19 - drivers/media/platform/qcom/venus/core.c | 2 drivers/media/platform/rockchip/rga/rga.c | 2 drivers/media/platform/samsung/exynos4-is/media-dev.h | 5 drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c | 3 drivers/media/usb/gspca/ov534.c | 2 drivers/media/usb/uvc/uvc_driver.c | 102 +++++++--- drivers/mtd/nand/spi/winbond.c | 16 - drivers/net/ethernet/freescale/fec_ptp.c | 11 - drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 drivers/net/netkit.c | 68 +++++- drivers/net/phy/dp83869.c | 20 + drivers/nvmem/core.c | 2 drivers/pci/controller/dwc/pci-imx6.c | 57 ++++- drivers/pci/controller/dwc/pci-keystone.c | 12 + drivers/pci/controller/dwc/pcie-designware-ep.c | 2 drivers/pci/controller/dwc/pcie-qcom.c | 2 drivers/pci/controller/pcie-rockchip-ep.c | 16 + drivers/pci/controller/pcie-rockchip.h | 4 drivers/pci/endpoint/pci-epc-core.c | 11 - drivers/pci/of_property.c | 2 drivers/remoteproc/qcom_q6v5_pas.c | 2 drivers/spmi/spmi-pmic-arb.c | 3 drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 drivers/ufs/host/ufs-exynos.c | 23 +- drivers/vfio/pci/qat/main.c | 2 fs/btrfs/btrfs_inode.h | 12 - fs/btrfs/ctree.c | 6 fs/btrfs/extent-tree.c | 2 fs/btrfs/inode.c | 94 ++++----- fs/btrfs/ioctl.c | 32 +++ fs/btrfs/ref-verify.c | 1 fs/btrfs/send.c | 2 fs/ceph/mds_client.c | 7 fs/ceph/super.c | 10 fs/f2fs/segment.c | 16 - fs/f2fs/super.c | 12 + fs/nfsd/export.c | 5 fs/nfsd/nfs4state.c | 19 + fs/overlayfs/inode.c | 7 fs/overlayfs/util.c | 3 fs/proc/kcore.c | 1 fs/quota/dquot.c | 2 fs/xfs/libxfs/xfs_sb.c | 7 include/drm/drm_panic.h | 14 + include/linux/kasan.h | 12 - include/linux/util_macros.h | 56 +++-- include/uapi/linux/if_link.h | 15 + kernel/signal.c | 9 kernel/trace/ftrace.c | 7 lib/kunit/debugfs.c | 5 lib/kunit/kunit-test.c | 2 lib/maple_tree.c | 13 + mm/damon/tests/vaddr-kunit.h | 1 mm/damon/vaddr.c | 4 mm/kasan/shadow.c | 14 - mm/slab.h | 5 mm/slab_common.c | 2 mm/slub.c | 9 mm/vmalloc.c | 34 ++- mm/vmstat.c | 1 tools/perf/pmu-events/empty-pmu-events.c | 12 - tools/perf/pmu-events/jevents.py | 12 - 142 files changed, 1054 insertions(+), 431 deletions(-) Adrian Huang (1): mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation Alex Deucher (1): Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable" Alexander Shiyan (1): media: i2c: tc358743: Fix crash in the probe error path when using polling Alexandru Ardelean (1): util_macros.h: fix/rework find_closest() macros Andrea della Porta (1): PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes Ard Biesheuvel (1): efi/libstub: Free correct pointer on failure Ashutosh Dixit (1): Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs" Balaji Pothunoori (1): remoteproc: qcom_q6v5_pas: disable auto boot for wpss Benjamin Gaignard (1): media: verisilicon: av1: Fix reference video buffer pointer assignment Bryan O'Donoghue (1): media: ov08x40: Fix burst write sequence Carlos Llamas (8): binder: fix node UAF in binder_add_freeze_work() binder: fix OOB in binder_add_freeze_work() binder: fix freeze UAF in binder_release_work() binder: fix BINDER_WORK_FROZEN_BINDER debug logs binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs binder: allow freeze notification for dead nodes binder: fix memleak of proc->delivered_freeze binder: add delivered_freeze to debugfs output Chao Yu (1): f2fs: fix to drop all discards after creating snapshot on lvm device Chen-Yu Tsai (3): arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity drm/bridge: it6505: Fix inverted reset polarity Choong Yong Liang (1): net: stmmac: set initial EEE policy configuration Damien Le Moal (1): PCI: rockchip-ep: Fix address translation unit programming Daniel Borkmann (1): netkit: Add option for scrubbing skb meta data David Sterba (1): btrfs: drop unused parameter file_offset from btrfs_encoded_read_regular_fill_pages() Dragan Simic (1): arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer Filipe Manana (2): btrfs: don't loop for nowait writes when checking for cross references btrfs: ref-verify: fix use-after-free after invalid ref action Francesco Dolcini (6): arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay dt-bindings: net: fec: add pps channel property net: fec: refactor PPS channel configuration net: fec: make PPS channel configurable Frank Li (3): i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() i3c: master: svc: fix possible assignment of the same address to two devices i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter Frederic Weisbecker (1): posix-timers: Target group sigqueue to current task only if not exiting Gabor Juhos (1): clk: qcom: gcc-qcs404: fix initial rate of GPLL3 Gaosheng Cui (1): media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() Geert Uytterhoeven (1): slab: Fix too strict alignment check in create_cache() Giovanni Cabiddu (1): vfio/qat: fix overflow check in qat_vf_resume_write() Greg Kroah-Hartman (1): Linux 6.12.4 Guoqing Jiang (1): media: mtk-jpeg: Fix null-ptr-deref during unload module Heiko Carstens (1): s390/stacktrace: Use break instead of return statement Hugo Villeneuve (1): drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member Javier Carrasco (3): spmi: pmic-arb: fix return path in for_each_available_child_of_node() leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths drm/mediatek: Fix child node refcount handling in early exit Jean-Baptiste Maneyrol (1): iio: invensense: fix multiple odr switch when FIFO is off Jinjie Ruan (6): media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() kunit: string-stream: Fix a UAF bug in kunit_init_suite() i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled Jiri Olsa (1): fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero Joe Hattori (1): media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available Johannes Thumshirn (1): btrfs: fix use-after-free in btrfs_encoded_read_endio() John Keeping (1): media: platform: rga: fix 32-bit DMA limitation Jonathan Cavitt (1): drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs Joshua Aberback (1): drm/amd/display: Fix handling of plane refcount Kenneth Feng (3): drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3 drm/amd/pm: skip setting the power source on smu v14.0.2/3 drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3 Kishon Vijay Abraham I (2): PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible PCI: keystone: Add link up check to ks_pcie_other_map_bus() Li Zetao (1): media: ts2020: fix null-ptr-deref in ts2020_probe() Lijo Lazar (2): drm/amdkfd: Use the correct wptr size drm/amd/pm: Remove arcturus min power limit Linus Walleij (3): ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow ARM: 9430/1: entry: Do a dummy read from VMAP shadow ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire() Lizhi Xu (1): btrfs: add a sanity check for btrfs root in btrfs_search_slot() Long Li (1): xfs: remove unknown compat feature check in superblock write validation Lucas Stach (1): drm/etnaviv: flush shader L1 cache after user commandstream Lyude Paul (1): drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n Ma Ke (3): drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check drm/sti: avoid potential dereference of error pointers Marek Vasut (1): nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write() Mario Limonciello (2): drm/amd: Add some missing straps from NBIO 7.11.0 drm/amd: Fix initialization mistake for NBIO 7.11 devices Mark Harmstone (2): btrfs: change btrfs_encoded_read() so that reading of extent is done by caller btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages() Masami Hiramatsu (Google) (1): tracing: Fix function timing profiler to initialize hashtable Matthew Auld (3): drm/xe/migrate: fix pat index usage drm/xe/migrate: use XE_BO_FLAG_PAGETABLE drm/xe/guc_submit: fix race around suspend_pending Matti Vaittinen (1): iio: accel: kx022a: Fix raw read format Max Kellermann (2): ceph: pass cred pointer to ceph_mds_auth_match() ceph: fix cred leak in ceph_mds_check_access() MengEn Sun (1): vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event Michal Vokáč (1): leds: lp55xx: Remove redundant test for invalid channel number Ming Qian (3): media: amphion: Set video drvdata before register video device media: imx-jpeg: Set video drvdata before register video device media: imx-jpeg: Ensure power suppliers be suspended before detach them Miquel Raynal (2): mtd: spinand: winbond: Fix 512GW and 02JW OOB layout mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information Mostafa Saleh (1): iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables Nathan Chancellor (3): powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang powerpc: Fix stack protector Kconfig test for clang powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang Niklas Cassel (1): PCI: dwc: ep: Fix advertised resizable BAR size regression Nuno Sa (1): iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer Ojaswin Mujoo (1): quota: flush quota_release_work upon quota writeback Oleksandr Tymoshenko (1): ovl: properly handle large files in ovl_security_fileattr Ovidiu Bunea (1): drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto Patrick Donnelly (1): ceph: extract entity name from device id Peter Griffin (2): scsi: ufs: exynos: Add check inside exynos_ufs_config_smu() scsi: ufs: exynos: Fix hibern8 notify callbacks Pratyush Brahma (1): iommu/arm-smmu: Defer probe of clients after smmu device bound Qiang Yu (1): PCI: qcom: Disable ASPM L0s for X1E80100 Ricardo Ribalda (1): media: uvcvideo: Stop stream during unregister Romain Gantois (1): net: phy: dp83869: fix status reporting for 1000base-x autonegotiation Saravana Kannan (1): driver core: fw_devlink: Stop trying to optimize cycle detection logic Sergey Senozhatsky (1): zram: clear IDLE flag after recompression Sibi Sankar (1): cpufreq: scmi: Fix cleanup path when boost enablement fails Srinivas Pandruvada (1): thermal: int3400: Fix reading of current_uuid for active policy Ssuhung Yeh (1): dm: Fix typo in error message Stefan Eichenberger (1): PCI: imx6: Fix suspend/resume support on i.MX6QDL Steffen Dirkwinkel (1): drm: xlnx: zynqmp_dpsub: fix hotplug detection Thadeu Lima de Souza Cascardo (1): media: uvcvideo: Require entities to have a non-zero unique ID Thomas Zimmermann (1): drm/fbdev-dma: Select FB_DEFERRED_IO Umio Yasuno (1): drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 Vasiliy Kovalev (1): ovl: Filter invalid inodes with missing lookup function Vasily Gorbik (1): s390/entry: Mark IRQ entries to fix stack depot warnings Vitaly Prosyak (1): drm/amdgpu: fix usage slab after free Vladimir Zapolskiy (1): media: qcom: camss: fix error path on configuration of power domains Wei Yang (1): maple_tree: refine mas_store_root() on storing NULL Will Deacon (1): iommu/tegra241-cmdqv: Fix unused variable warning Xiao Ni (1): md/raid5: Wait sync io to finish before changing group cnt Xu Yang (1): perf jevents: fix breakage when do perf stat on system metric Yang Erkun (2): nfsd: make sure exp active before svc_export_show nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur Yihan Zhu (1): drm/amd/display: update pipe selection policy to check head pipe Yuan Can (2): md/md-bitmap: Add missing destroy_work_on_stack() dm thin: Add missing destroy_work_on_stack() Zheng Yejian (1): mm/damon/vaddr: fix issue in damon_va_evenly_split_region() Zichen Xie (1): kunit: Fix potential null dereference in kunit_device_driver_test() Zicheng Qu (3): ad7780: fix division by zero in ad7780_write_raw() iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() iio: gts: fix infinite loop for gain_to_scaletables() Zijun Hu (2): PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy() PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf() guoweikang (1): ftrace: Fix regression with module command in stack_trace_filter yuan.gao (1): mm/slub: Avoid list corruption when removing a slab from the full list

7 months, 1 week

5
16
0 0

[PATCH v2 1/2] drm/xe: Use non-interruptible wait when moving BO to system

by Nirmoy Das

Ensure a non-interruptible wait is used when moving a bo to XE_PL_SYSTEM. This prevents dma_mappings from being removed prematurely while a GPU job is still in progress, even if the CPU receives a signal during the operation. Fixes: 75521e8b56e8 ("drm/xe: Perform dma_map when moving system buffer objects to TT") Cc: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Lucas De Marchi <lucas.demarchi(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.11+ Suggested-by: Matthew Auld <matthew.auld(a)intel.com> Signed-off-by: Nirmoy Das <nirmoy.das(a)intel.com> --- drivers/gpu/drm/xe/xe_bo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c index 73689dd7d672..b2aa368a23f8 100644 --- a/drivers/gpu/drm/xe/xe_bo.c +++ b/drivers/gpu/drm/xe/xe_bo.c @@ -733,7 +733,7 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict, new_mem->mem_type == XE_PL_SYSTEM) { long timeout = dma_resv_wait_timeout(ttm_bo->base.resv, DMA_RESV_USAGE_BOOKKEEP, - true, + false, MAX_SCHEDULE_TIMEOUT); if (timeout < 0) { ret = timeout; -- 2.46.0

7 months, 1 week

5
7
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2024