February 2024 - Linux-stable-mirror

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.17 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/process/changes.rst | 2 MAINTAINERS | 1 Makefile | 2 arch/arc/include/asm/cacheflush.h | 1 arch/arm/include/asm/cacheflush.h | 2 arch/csky/abiv1/inc/abi/cacheflush.h | 1 arch/csky/abiv2/inc/abi/cacheflush.h | 1 arch/m68k/include/asm/cacheflush_mm.h | 1 arch/mips/include/asm/cacheflush.h | 2 arch/nios2/include/asm/cacheflush.h | 1 arch/parisc/include/asm/cacheflush.h | 1 arch/riscv/include/asm/cacheflush.h | 3 arch/riscv/include/asm/hugetlb.h | 3 arch/riscv/include/asm/sbi.h | 3 arch/riscv/include/asm/stacktrace.h | 5 arch/riscv/include/asm/tlb.h | 8 arch/riscv/include/asm/tlbflush.h | 17 - arch/riscv/kernel/sbi.c | 32 - arch/riscv/mm/hugetlbpage.c | 78 ++++ arch/riscv/mm/init.c | 4 arch/riscv/mm/tlbflush.c | 158 +++++---- arch/sh/include/asm/cacheflush.h | 1 arch/sparc/include/asm/cacheflush_32.h | 1 arch/sparc/include/asm/cacheflush_64.h | 1 arch/x86/lib/getuser.S | 24 - arch/x86/lib/putuser.S | 20 - arch/xtensa/include/asm/cacheflush.h | 6 block/blk-iocost.c | 7 drivers/atm/idt77252.c | 2 drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 10 drivers/dma/fsl-qdma.c | 27 - drivers/dma/ti/k3-udma.c | 10 drivers/firmware/efi/libstub/efistub.h | 3 drivers/firmware/efi/libstub/kaslr.c | 2 drivers/firmware/efi/libstub/randomalloc.c | 12 drivers/firmware/efi/libstub/x86-stub.c | 25 - drivers/firmware/efi/libstub/x86-stub.h | 4 drivers/firmware/efi/libstub/zboot.c | 2 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 63 ++- drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c | 2 drivers/gpu/drm/i915/gvt/handlers.c | 3 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 drivers/gpu/drm/msm/dp/dp_ctrl.c | 5 drivers/gpu/drm/msm/dp/dp_link.c | 22 - drivers/gpu/drm/msm/dp/dp_reg.h | 3 drivers/hwmon/aspeed-pwm-tacho.c | 7 drivers/hwmon/coretemp.c | 40 +- drivers/input/keyboard/atkbd.c | 13 drivers/input/serio/i8042-acpipnpio.h | 6 drivers/media/pci/solo6x10/solo6x10-offsets.h | 10 drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 4 drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 13 drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 drivers/net/ethernet/engleder/tsnep_main.c | 16 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 14 drivers/net/ethernet/stmicro/stmmac/common.h | 1 drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 3 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 58 +++ drivers/net/netdevsim/dev.c | 8 drivers/net/ppp/ppp_async.c | 4 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 6 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 4 drivers/phy/ti/phy-omap-usb2.c | 4 drivers/scsi/scsi_error.c | 3 drivers/scsi/scsi_lib.c | 4 drivers/usb/dwc3/dwc3-pci.c | 4 drivers/usb/dwc3/host.c | 4 drivers/usb/host/xhci-plat.c | 3 drivers/usb/host/xhci-ring.c | 80 +++- drivers/usb/host/xhci.h | 1 drivers/usb/serial/cp210x.c | 1 drivers/usb/serial/option.c | 1 drivers/usb/serial/qcserial.c | 2 drivers/usb/typec/tcpm/tcpm.c | 3 fs/ext4/mballoc.c | 20 + fs/ntfs3/ntfs_fs.h | 2 fs/smb/client/sess.c | 2 fs/smb/client/smb2pdu.c | 2 fs/xfs/Kconfig | 2 fs/xfs/libxfs/xfs_alloc.c | 27 + fs/xfs/libxfs/xfs_bmap.c | 21 - fs/xfs/libxfs/xfs_defer.c | 28 + fs/xfs/libxfs/xfs_defer.h | 2 fs/xfs/libxfs/xfs_inode_buf.c | 3 fs/xfs/libxfs/xfs_rtbitmap.c | 33 + fs/xfs/libxfs/xfs_sb.h | 2 fs/xfs/xfs_bmap_util.c | 24 - fs/xfs/xfs_dquot.c | 5 fs/xfs/xfs_dquot_item_recover.c | 21 + fs/xfs/xfs_file.c | 63 +++ fs/xfs/xfs_inode.c | 24 + fs/xfs/xfs_inode.h | 17 + fs/xfs/xfs_inode_item_recover.c | 14 fs/xfs/xfs_ioctl.c | 30 + fs/xfs/xfs_iops.c | 7 fs/xfs/xfs_log.c | 23 - fs/xfs/xfs_log_recover.c | 2 fs/xfs/xfs_reflink.c | 5 fs/xfs/xfs_rtalloc.c | 33 + fs/xfs/xfs_rtalloc.h | 27 - include/asm-generic/cacheflush.h | 6 include/linux/ceph/messenger.h | 2 include/linux/dmaengine.h | 3 include/linux/hrtimer.h | 4 include/trace/events/rxrpc.h | 8 include/uapi/linux/netfilter/nf_tables.h | 2 io_uring/io_uring.h | 7 io_uring/net.c | 50 ++- io_uring/poll.c | 39 +- kernel/time/hrtimer.c | 3 mm/percpu.c | 8 net/ceph/messenger_v1.c | 33 + net/ceph/messenger_v2.c | 4 net/ceph/osd_client.c | 9 net/ipv4/af_inet.c | 6 net/ipv4/ip_tunnel_core.c | 2 net/mac80211/mlme.c | 3 net/mac80211/tx.c | 7 net/netfilter/nft_compat.c | 17 - net/netfilter/nft_ct.c | 3 net/netfilter/nft_set_pipapo.c | 108 +++--- net/netfilter/nft_set_pipapo.h | 18 - net/netfilter/nft_set_pipapo_avx2.c | 17 - net/netfilter/nft_set_rbtree.c | 6 net/rxrpc/ar-internal.h | 37 +- net/rxrpc/call_event.c | 12 net/rxrpc/call_object.c | 1 net/rxrpc/conn_event.c | 10 net/rxrpc/input.c | 115 +++++- net/rxrpc/output.c | 8 net/rxrpc/proc.c | 2 net/rxrpc/rxkad.c | 4 net/tipc/bearer.c | 6 net/unix/garbage.c | 11 rust/alloc/alloc.rs | 21 - rust/alloc/boxed.rs | 56 ++- rust/alloc/lib.rs | 13 rust/alloc/raw_vec.rs | 30 + rust/alloc/vec/drain_filter.rs | 199 ------------ rust/alloc/vec/extract_if.rs | 115 ++++++ rust/alloc/vec/mod.rs | 110 +++--- rust/alloc/vec/spec_extend.rs | 8 rust/compiler_builtins.rs | 1 rust/kernel/print.rs | 1 rust/kernel/sync/arc.rs | 2 rust/kernel/task.rs | 2 scripts/min-tool-version.sh | 2 sound/soc/amd/acp-config.c | 15 sound/usb/quirks.c | 38 +- tools/perf/util/evlist.c | 9 tools/testing/selftests/net/big_tcp.sh | 4 tools/testing/selftests/net/cmsg_ipv6.sh | 4 tools/testing/selftests/net/pmtu.sh | 52 +-- tools/testing/selftests/net/udpgro_fwd.sh | 14 tools/testing/selftests/net/udpgso_bench_rx.c | 2 tools/testing/selftests/net/unicast_extensions.sh | 101 ++---- 157 files changed, 1701 insertions(+), 1017 deletions(-) Abhinav Kumar (1): drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup Alexander Tsoy (1): ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision Alexandre Ghiti (8): riscv: Improve tlb_flush() riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb riscv: Improve flush_tlb_kernel_range() mm: Introduce flush_cache_vmap_early() riscv: Fix set_huge_pte_at() for NAPOT mapping riscv: Fix hugetlb_mask_last_page() when NAPOT is enabled riscv: Flush the tlb when a page directory is freed riscv: Fix arch_hugetlb_migration_supported() for NAPOT Anthony Iliopoulos (1): xfs: fix again select in kconfig XFS_ONLINE_SCRUB_STATS Antoine Tenart (1): tunnels: fix out of bounds access when building IPv6 PMTU error Ard Biesheuvel (2): x86/efistub: Give up if memory attribute protocol returns an error x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR Aurelien Jarno (1): media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) Badhri Jagan Sridharan (1): Revert "usb: typec: tcpm: fix cc role at port reset" Baokun Li (1): ext4: regenerate buddy after block freeing failed if under fc replay Ben Dooks (1): riscv: declare overflow_stack as exported from traps.c Catherine Hoang (2): MAINTAINERS: add Catherine as xfs maintainer for 6.6.y xfs: allow read IO and FICLONE to run concurrently Cheng Lin (1): xfs: introduce protection for drop nlink Christoph Hellwig (4): xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space xfs: only remap the written blocks in xfs_reflink_end_cow_extent xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags xfs: respect the stable writes flag on the RT device Christophe JAILLET (2): dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA Dan Carpenter (2): drm/i915/gvt: Fix uninitialized variable in handle_mmio() fs/ntfs3: Fix an NULL dereference bug Darrick J. Wong (8): xfs: bump max fsgeom struct version xfs: hoist freeing of rt data fork extent mappings xfs: prevent rt growfs when quota is enabled xfs: rt stubs should return negative errnos when rt disabled xfs: fix units conversion error in xfs_bmap_del_extent_delay xfs: make sure maxlen is still congruent with prod when rounding down xfs: clean up dqblk extraction xfs: dquot recovery does not validate the recovered dquot Dave Chinner (1): xfs: inode recovery does not validate the recovered inode David Howells (4): rxrpc: Fix generation of serial numbers to skip zero rxrpc: Fix delayed ACKs to not set the reference serial number rxrpc: Fix response to PING RESPONSE ACKs to a dead call rxrpc: Fix counting of new acks and nacks Eric Dumazet (3): netdevsim: avoid potential loop in nsim_dev_trap_report_work() inet: read sk->sk_family once in inet_recv_error() ppp_async: limit MRU to 64K Florian Westphal (3): netfilter: nft_set_pipapo: store index in scratch maps netfilter: nft_set_pipapo: add helper to release pcpu scratch area netfilter: nft_set_pipapo: remove scratch_aligned pointer Frank Li (1): dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV Frederic Weisbecker (1): hrtimer: Report offline hrtimer enqueue Furong Xu (2): net: stmmac: xgmac: fix handling of DPP safety error for DMA channels net: stmmac: xgmac: fix a typo of register name in DPP safety handling Gerhard Engleder (1): tsnep: Fix mapping for zero copy XDP_TX action Greg Kroah-Hartman (2): Revert "ASoC: amd: Add new dmi entries for acp5x platform" Linux 6.6.17 Guanhua Gao (1): dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools Hangbin Liu (2): selftests/net: convert unicast_extensions.sh to run it in unique namespace selftests/net: convert pmtu.sh to run it in unique namespace Hans de Goede (1): Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID Heikki Krogerus (1): usb: dwc3: pci: add support for the Intel Arrow Lake-H Ivan Vecera (1): net: atlantic: Fix DMA mapping for PTP hwts ring JackBB Wu (1): USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e Jai Luthra (1): dmaengine: ti: k3-udma: Report short packet errors Jakub Kicinski (1): selftests: cmsg_ipv6: repeat the exact packet James Clark (1): perf evlist: Fix evlist__new_default() for > 1 core PMU Jens Axboe (5): io_uring/net: fix sr->len for IORING_OP_RECV with MSG_WAITALL and buffers io_uring/poll: move poll execution helpers higher up io_uring/net: un-indent mshot retry path in io_recv_finish() io_uring/poll: add requeue return code from poll multishot handling io_uring/net: limit inline multishot retries Johannes Berg (2): wifi: mac80211: fix RCU use in TDLS fast-xmit wifi: mac80211: fix waiting for beacons logic Julian Sikorski (1): ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter Kees Cook (1): wifi: brcmfmac: Adjust n_channels usage for __counted_by Kuniyuki Iwashima (1): af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. Kuogee Hsieh (2): drm/msms/dp: fixed link clock divider bits be over written in BPC unknown case drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case Leah Rumancik (1): xfs: up(ic_sema) if flushing data device fails Leonard Dallmayr (1): USB: serial: cp210x: add ID for IMST iM871A-USB Loic Prylli (1): hwmon: (aspeed-pwm-tacho) mutex for tach reading Long Li (2): xfs: factor out xfs_defer_pending_abort xfs: abort intent items when recovery intents fail Mathias Nyman (1): xhci: process isoc TD properly when there was a transaction error mid TD. Michal Pecio (1): xhci: handle isoc Babble and Buffer Overrun events properly Miguel Ojeda (5): rust: arc: add explicit `drop()` around `Box::from_raw()` rust: upgrade to Rust 1.72.1 rust: task: remove redundant explicit link rust: print: use explicit link in documentation rust: upgrade to Rust 1.73.0 Ming Lei (1): scsi: core: Move scsi_host_busy() out of host lock if it is for per-command Miri Korenblit (1): wifi: iwlwifi: exit eSR only after the FW does Omar Sandoval (1): xfs: fix internal error from AGFL exhaustion Pablo Neira Ayuso (5): netfilter: nft_compat: narrow down revision to unsigned 8-bits netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_ct: reject direction for ct id netfilter: nft_set_rbtree: skip end interval element from gc Paolo Abeni (4): selftests: net: cut more slack for gro fwd tests. selftests: net: fix tcp listener handling in pmtu.sh selftests: net: avoid just another constant wait selftests: net: let big_tcp test cope with slow env Prashanth K (2): usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK Puliang Lu (1): USB: serial: option: add Fibocom FM101-GL variant Qiuxu Zhuo (1): x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups Sean Young (1): ALSA: usb-audio: add quirk for RODE NT-USB+ Shigeru Yoshida (1): tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() Shyam Prasad N (2): cifs: avoid redundant calls to disable multichannel cifs: failure to add channel on iface should bump up weight Simon Horman (1): net: stmmac: xgmac: use #define for string constants Srinivasan Shanmugam (3): drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()' drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' drm/amd/display: Implement bounds check for stream encoder creation in DCN301 Takashi Iwai (1): ALSA: usb-audio: Sort quirk table entries Tejun Heo (1): blk-iocost: Fix an UBSAN shift-out-of-bounds warning Tony Lindgren (1): phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP Vincent Chen (1): riscv: mm: execute local TLB flush after populating vmemmap Werner Sembach (1): Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU Xiubo Li (2): libceph: rename read_sparse_msg_*() to read_partial_sparse_msg_*() libceph: just wait for more data to be available on the socket Yoshihiro Shimoda (1): phy: renesas: rcar-gen3-usb2: Fix returning wrong error code Yujie Liu (1): selftests/net: change shebang to bash to support "source" Zhang Rui (2): hwmon: (coretemp) Fix out-of-bounds memory access hwmon: (coretemp) Fix bogus core_id to attr name mapping Zhipeng Lu (2): atm: idt77252: fix a memleak in open_card_ubr0 octeontx2-pf: Fix a memleak otx2_sq_init

1 year, 2 months

1
1
0 0

Linux 6.1.78

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.78 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 block/blk-core.c | 11 + block/blk-iocost.c | 7 drivers/atm/idt77252.c | 2 drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 10 - drivers/dma/fsl-qdma.c | 27 +-- drivers/dma/ti/k3-udma.c | 10 + drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c | 2 drivers/gpu/drm/i915/gvt/handlers.c | 3 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 drivers/gpu/drm/msm/dp/dp_ctrl.c | 5 drivers/gpu/drm/msm/dp/dp_link.c | 22 +-- drivers/gpu/drm/msm/dp/dp_reg.h | 3 drivers/hwmon/aspeed-pwm-tacho.c | 7 drivers/hwmon/coretemp.c | 40 ++--- drivers/infiniband/hw/irdma/verbs.c | 2 drivers/input/keyboard/atkbd.c | 13 + drivers/input/serio/i8042-acpipnpio.h | 6 drivers/mtd/parsers/ofpart_core.c | 19 ++ drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 4 drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 13 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 14 + drivers/net/ethernet/stmicro/stmmac/common.h | 1 drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 3 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 58 +++++++- drivers/net/netdevsim/dev.c | 8 - drivers/net/ppp/ppp_async.c | 4 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 4 drivers/phy/ti/phy-omap-usb2.c | 4 drivers/scsi/scsi_error.c | 3 drivers/scsi/scsi_lib.c | 4 drivers/usb/dwc3/host.c | 4 drivers/usb/host/xhci-plat.c | 3 drivers/usb/serial/cp210x.c | 1 drivers/usb/serial/option.c | 1 drivers/usb/serial/qcserial.c | 2 drivers/vhost/vhost.c | 5 fs/dlm/lowcomms.c | 38 +---- fs/ext4/mballoc.c | 20 ++ fs/f2fs/compress.c | 27 +++ fs/f2fs/f2fs.h | 2 fs/f2fs/super.c | 4 fs/ntfs3/ntfs_fs.h | 2 fs/smb/client/sess.c | 2 include/linux/dmaengine.h | 3 include/linux/hrtimer.h | 4 include/uapi/linux/netfilter/nf_tables.h | 2 io_uring/net.c | 1 kernel/time/clocksource.c | 25 +++ kernel/time/hrtimer.c | 3 net/ipv4/af_inet.c | 6 net/ipv4/ip_tunnel_core.c | 2 net/mac80211/mlme.c | 3 net/netfilter/nft_compat.c | 17 +- net/netfilter/nft_ct.c | 3 net/netfilter/nft_set_pipapo.c | 108 +++++++-------- net/netfilter/nft_set_pipapo.h | 18 +- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/netfilter/nft_set_rbtree.c | 6 net/rxrpc/conn_event.c | 8 + net/tipc/bearer.c | 6 net/unix/garbage.c | 11 + sound/soc/amd/acp-config.c | 15 -- sound/usb/quirks.c | 38 +++-- tools/testing/selftests/net/cmsg_ipv6.sh | 4 tools/testing/selftests/net/pmtu.sh | 18 +- tools/testing/selftests/net/udpgro_fwd.sh | 14 + tools/testing/selftests/net/udpgso_bench_rx.c | 2 69 files changed, 519 insertions(+), 242 deletions(-) Abhinav Kumar (1): drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup Alexander Aring (1): fs: dlm: don't put dlm_local_addrs on heap Alexander Tsoy (1): ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision Antoine Tenart (1): tunnels: fix out of bounds access when building IPv6 PMTU error Baokun Li (1): ext4: regenerate buddy after block freeing failed if under fc replay Christophe JAILLET (2): dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA Dan Carpenter (2): drm/i915/gvt: Fix uninitialized variable in handle_mmio() fs/ntfs3: Fix an NULL dereference bug David Howells (1): rxrpc: Fix response to PING RESPONSE ACKs to a dead call Eric Dumazet (3): netdevsim: avoid potential loop in nsim_dev_trap_report_work() inet: read sk->sk_family once in inet_recv_error() ppp_async: limit MRU to 64K Florian Westphal (3): netfilter: nft_set_pipapo: store index in scratch maps netfilter: nft_set_pipapo: add helper to release pcpu scratch area netfilter: nft_set_pipapo: remove scratch_aligned pointer Francesco Dolcini (1): mtd: parsers: ofpart: add workaround for #size-cells 0 Frank Li (1): dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV Frederic Weisbecker (1): hrtimer: Report offline hrtimer enqueue Furong Xu (2): net: stmmac: xgmac: fix handling of DPP safety error for DMA channels net: stmmac: xgmac: fix a typo of register name in DPP safety handling Greg Kroah-Hartman (2): Revert "ASoC: amd: Add new dmi entries for acp5x platform" Linux 6.1.78 Guanhua Gao (1): dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools Hans de Goede (1): Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID Ivan Vecera (1): net: atlantic: Fix DMA mapping for PTP hwts ring JackBB Wu (1): USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e Jai Luthra (1): dmaengine: ti: k3-udma: Report short packet errors Jakub Kicinski (1): selftests: cmsg_ipv6: repeat the exact packet Jens Axboe (2): io_uring/net: fix sr->len for IORING_OP_RECV with MSG_WAITALL and buffers block: treat poll queue enter similarly to timeouts Jiri Wiesner (1): clocksource: Skip watchdog check for large watchdog intervals Johannes Berg (1): wifi: mac80211: fix waiting for beacons logic Julian Sikorski (1): ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter Kuniyuki Iwashima (1): af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. Kuogee Hsieh (2): drm/msms/dp: fixed link clock divider bits be over written in BPC unknown case drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case Leonard Dallmayr (1): USB: serial: cp210x: add ID for IMST iM871A-USB Loic Prylli (1): hwmon: (aspeed-pwm-tacho) mutex for tach reading Mike Marciniszyn (1): RDMA/irdma: Fix support for 64k pages Ming Lei (1): scsi: core: Move scsi_host_busy() out of host lock if it is for per-command Pablo Neira Ayuso (5): netfilter: nft_compat: narrow down revision to unsigned 8-bits netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_ct: reject direction for ct id netfilter: nft_set_rbtree: skip end interval element from gc Paolo Abeni (2): selftests: net: cut more slack for gro fwd tests. selftests: net: avoid just another constant wait Prashanth K (2): usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK Prathu Baronia (1): vhost: use kzalloc() instead of kmalloc() followed by memset() Puliang Lu (1): USB: serial: option: add Fibocom FM101-GL variant Sean Young (1): ALSA: usb-audio: add quirk for RODE NT-USB+ Sheng Yong (1): f2fs: add helper to check compression level Shigeru Yoshida (1): tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() Shyam Prasad N (1): cifs: failure to add channel on iface should bump up weight Simon Horman (1): net: stmmac: xgmac: use #define for string constants Srinivasan Shanmugam (1): drm/amd/display: Implement bounds check for stream encoder creation in DCN301 Takashi Iwai (1): ALSA: usb-audio: Sort quirk table entries Tejun Heo (1): blk-iocost: Fix an UBSAN shift-out-of-bounds warning Tony Lindgren (1): phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP Werner Sembach (1): Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU Yoshihiro Shimoda (1): phy: renesas: rcar-gen3-usb2: Fix returning wrong error code Zhang Rui (2): hwmon: (coretemp) Fix out-of-bounds memory access hwmon: (coretemp) Fix bogus core_id to attr name mapping Zhipeng Lu (2): atm: idt77252: fix a memleak in open_card_ubr0 octeontx2-pf: Fix a memleak otx2_sq_init

1 year, 2 months

1
1
0 0

[PATCH v5] sparc: vDSO: fix return value of __setup handler

by Randy Dunlap

__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled. A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings. Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from vdso_setup(). Fixes: 9a08862a5d2e ("vDSO for sparc") Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Reported-by: Igor Zhbanov <izh1979(a)gmail.com> Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: "David S. Miller" <davem(a)davemloft.net> Cc: sparclinux(a)vger.kernel.org Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Cc: Nick Alcock <nick.alcock(a)oracle.com> Cc: Sam Ravnborg <sam(a)ravnborg.org> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: stable(a)vger.kernel.org Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: Andreas Larsson <andreas(a)gaisler.com> --- v2: correct the Fixes: tag (Dan Carpenter) v3: add more Cc's; correct Igor's email address; change From: Igor to Reported-by: Igor; v4: add Arnd to Cc: list v5: add Andreas to Cc: list arch/sparc/vdso/vma.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff -- a/arch/sparc/vdso/vma.c b/arch/sparc/vdso/vma.c --- a/arch/sparc/vdso/vma.c +++ b/arch/sparc/vdso/vma.c @@ -449,9 +449,8 @@ static __init int vdso_setup(char *s) unsigned long val; err = kstrtoul(s, 10, &val); - if (err) - return err; - vdso_enabled = val; - return 0; + if (!err) + vdso_enabled = val; + return 1; } __setup("vdso=", vdso_setup);

1 year, 2 months

2
1
0 0

[PATCH v5] sparc64: NMI watchdog: fix return value of __setup handler

by Randy Dunlap

__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled. A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings. Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from setup_nmi_watchdog(). Fixes: e5553a6d0442 ("sparc64: Implement NMI watchdog on capable cpus.") Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Reported-by: Igor Zhbanov <izh1979(a)gmail.com> Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: "David S. Miller" <davem(a)davemloft.net> Cc: sparclinux(a)vger.kernel.org Cc: Sam Ravnborg <sam(a)ravnborg.org> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: stable(a)vger.kernel.org Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: Andreas Larsson <andreas(a)gaisler.com> --- v2: change From: Igor to Reported-by: add more Cc's v3: use Igor's current email address v4: add Arnd to Cc: list v5: add Andreas to Cc: list arch/sparc/kernel/nmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -- a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c --- a/arch/sparc/kernel/nmi.c +++ b/arch/sparc/kernel/nmi.c @@ -279,7 +279,7 @@ static int __init setup_nmi_watchdog(cha if (!strncmp(str, "panic", 5)) panic_on_timeout = 1; - return 0; + return 1; } __setup("nmi_watchdog=", setup_nmi_watchdog);

1 year, 2 months

2
1
0 0

[PATCH v2] scsi: core: Consult supported VPD page list prior to fetching page

by Martin K. Petersen

Commit c92a6b5d6335 ("scsi: core: Query VPD size before getting full page") removed the logic which checks whether a VPD page is present on the supported pages list before asking for the page itself. That was done because SPC helpfully states "The Supported VPD Pages VPD page list may or may not include all the VPD pages that are able to be returned by the device server". Testing had revealed a few devices that supported some of the 0xBn pages but didn't actually list them in page 0. Julian Sikorski bisected a problem with his drive resetting during discovery to the commit above. As it turns out, this particular drive firmware will crash if we attempt to fetch page 0xB9. Various approaches were attempted to work around this. In the end, reinstating the logic that consults VPD page 0 before fetching any other page was the path of least resistance. A firmware update for the devices which originally compelled us to remove the check has since been released. Cc: stable(a)vger.kernel.org Cc: Bart Van Assche <bvanassche(a)acm.org> Fixes: c92a6b5d6335 ("scsi: core: Query VPD size before getting full page") Reported-by: Julian Sikorski <belegdol(a)gmail.com> Tested-by: Julian Sikorski <belegdol(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> --- v2: Address Bart's comments. --- drivers/scsi/scsi.c | 22 ++++++++++++++++++++-- include/scsi/scsi_device.h | 4 ---- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c index 76d369343c7a..8cad9792a562 100644 --- a/drivers/scsi/scsi.c +++ b/drivers/scsi/scsi.c @@ -328,21 +328,39 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer, return result + 4; } +enum scsi_vpd_parameters { + SCSI_VPD_HEADER_SIZE = 4, + SCSI_VPD_LIST_SIZE = 36, +}; + static int scsi_get_vpd_size(struct scsi_device *sdev, u8 page) { - unsigned char vpd_header[SCSI_VPD_HEADER_SIZE] __aligned(4); + unsigned char vpd[SCSI_VPD_LIST_SIZE] __aligned(4); int result; if (sdev->no_vpd_size) return SCSI_DEFAULT_VPD_LEN; + /* + * Fetch the supported pages VPD and validate that the requested page + * number is present. + */ + if (page != 0) { + result = scsi_vpd_inquiry(sdev, vpd, 0, sizeof(vpd)); + if (result < SCSI_VPD_HEADER_SIZE) + return 0; + + result -= SCSI_VPD_HEADER_SIZE; + if (!memchr(&vpd[SCSI_VPD_HEADER_SIZE], page, result)) + return 0; + } /* * Fetch the VPD page header to find out how big the page * is. This is done to prevent problems on legacy devices * which can not handle allocation lengths as large as * potentially requested by the caller. */ - result = scsi_vpd_inquiry(sdev, vpd_header, page, sizeof(vpd_header)); + result = scsi_vpd_inquiry(sdev, vpd, page, SCSI_VPD_HEADER_SIZE); if (result < 0) return 0; diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h index cb019c80763b..72a6b3923fc7 100644 --- a/include/scsi/scsi_device.h +++ b/include/scsi/scsi_device.h @@ -100,10 +100,6 @@ struct scsi_vpd { unsigned char data[]; }; -enum scsi_vpd_parameters { - SCSI_VPD_HEADER_SIZE = 4, -}; - struct scsi_device { struct Scsi_Host *host; struct request_queue *request_queue; -- 2.42.1

1 year, 2 months

4
4
0 0

[PATCH v2] fs, USB gadget: Rework kiocb cancellation

by Bart Van Assche

Calling kiocb_set_cancel_fn() without knowing whether the caller submitted a struct kiocb or a struct aio_kiocb is unsafe. Fix this by introducing the cancel_kiocb() method in struct file_operations. The following call trace illustrates that without this patch an out-of-bounds write happens if I/O is submitted by io_uring (from a phone with an ARM CPU and kernel 6.1): WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8 Call trace: kiocb_set_cancel_fn+0x9c/0xa8 ffs_epfile_read_iter+0x144/0x1d0 io_read+0x19c/0x498 io_issue_sqe+0x118/0x27c io_submit_sqes+0x25c/0x5fc __arm64_sys_io_uring_enter+0x104/0xab0 invoke_syscall+0x58/0x11c el0_svc_common+0xb4/0xf4 do_el0_svc+0x2c/0xb0 el0_svc+0x2c/0xa4 el0t_64_sync_handler+0x68/0xb4 el0t_64_sync+0x1a4/0x1a8 Several ideas in this patch come from the following patch: Christoph Hellwig, "[PATCH 08/32] aio: replace kiocb_set_cancel_fn with a cancel_kiocb file operation", May 2018 (https://lore.kernel.org/all/20180515194833.6906-9-hch@lst.de/). Cc: Christoph Hellwig <hch(a)lst.de> Cc: Avi Kivity <avi(a)scylladb.com> Cc: Sandeep Dhavale <dhavale(a)google.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/usb/gadget/function/f_fs.c | 19 +---- drivers/usb/gadget/legacy/inode.c | 12 +-- fs/aio.c | 129 +++++++++++++++++++---------- include/linux/aio.h | 7 -- include/linux/fs.h | 1 + 5 files changed, 90 insertions(+), 78 deletions(-) Changes compared to v1: - Fixed a race between request completion and addition to the list of active requests. - Changed the return type of .cancel_kiocb() from int into void. - Simplified the .cancel_kiocb() implementations. - Introduced the ki_opcode member in struct aio_kiocb. - aio_cancel_and_del() checks .ki_opcode before accessing union members. - Left out the include/include/mm changes. diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 6bff6cb93789..4837e3071263 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -31,7 +31,6 @@ #include <linux/usb/composite.h> #include <linux/usb/functionfs.h> -#include <linux/aio.h> #include <linux/kthread.h> #include <linux/poll.h> #include <linux/eventfd.h> @@ -1157,23 +1156,16 @@ ffs_epfile_open(struct inode *inode, struct file *file) return stream_open(inode, file); } -static int ffs_aio_cancel(struct kiocb *kiocb) +static void ffs_epfile_cancel_kiocb(struct kiocb *kiocb) { struct ffs_io_data *io_data = kiocb->private; struct ffs_epfile *epfile = kiocb->ki_filp->private_data; unsigned long flags; - int value; spin_lock_irqsave(&epfile->ffs->eps_lock, flags); - if (io_data && io_data->ep && io_data->req) - value = usb_ep_dequeue(io_data->ep, io_data->req); - else - value = -EINVAL; - + usb_ep_dequeue(io_data->ep, io_data->req); spin_unlock_irqrestore(&epfile->ffs->eps_lock, flags); - - return value; } static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) @@ -1198,9 +1190,6 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) kiocb->private = p; - if (p->aio) - kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); - res = ffs_epfile_io(kiocb->ki_filp, p); if (res == -EIOCBQUEUED) return res; @@ -1242,9 +1231,6 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to) kiocb->private = p; - if (p->aio) - kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); - res = ffs_epfile_io(kiocb->ki_filp, p); if (res == -EIOCBQUEUED) return res; @@ -1356,6 +1342,7 @@ static const struct file_operations ffs_epfile_operations = { .release = ffs_epfile_release, .unlocked_ioctl = ffs_epfile_ioctl, .compat_ioctl = compat_ptr_ioctl, + .cancel_kiocb = ffs_epfile_cancel_kiocb, }; diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index 03179b1880fd..c2cf7fca6937 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -22,7 +22,6 @@ #include <linux/slab.h> #include <linux/poll.h> #include <linux/kthread.h> -#include <linux/aio.h> #include <linux/uio.h> #include <linux/refcount.h> #include <linux/delay.h> @@ -446,23 +445,18 @@ struct kiocb_priv { unsigned actual; }; -static int ep_aio_cancel(struct kiocb *iocb) +static void ep_cancel_kiocb(struct kiocb *iocb) { struct kiocb_priv *priv = iocb->private; struct ep_data *epdata; - int value; local_irq_disable(); epdata = priv->epdata; // spin_lock(&epdata->dev->lock); if (likely(epdata && epdata->ep && priv->req)) - value = usb_ep_dequeue (epdata->ep, priv->req); - else - value = -EINVAL; + usb_ep_dequeue(epdata->ep, priv->req); // spin_unlock(&epdata->dev->lock); local_irq_enable(); - - return value; } static void ep_user_copy_worker(struct work_struct *work) @@ -537,7 +531,6 @@ static ssize_t ep_aio(struct kiocb *iocb, iocb->private = priv; priv->iocb = iocb; - kiocb_set_cancel_fn(iocb, ep_aio_cancel); get_ep(epdata); priv->epdata = epdata; priv->actual = 0; @@ -709,6 +702,7 @@ static const struct file_operations ep_io_operations = { .unlocked_ioctl = ep_ioctl, .read_iter = ep_read_iter, .write_iter = ep_write_iter, + .cancel_kiocb = ep_cancel_kiocb, }; /* ENDPOINT INITIALIZATION diff --git a/fs/aio.c b/fs/aio.c index bb2ff48991f3..9dc0be703aa6 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -203,7 +203,6 @@ struct aio_kiocb { }; struct kioctx *ki_ctx; - kiocb_cancel_fn *ki_cancel; struct io_event ki_res; @@ -211,6 +210,8 @@ struct aio_kiocb { * for cancellation */ refcount_t ki_refcnt; + u16 ki_opcode; /* IOCB_CMD_* */ + /* * If the aio_resfd field of the userspace iocb is not zero, * this is the underlying eventfd context to deliver events to. @@ -587,22 +588,6 @@ static int aio_setup_ring(struct kioctx *ctx, unsigned int nr_events) #define AIO_EVENTS_FIRST_PAGE ((PAGE_SIZE - sizeof(struct aio_ring)) / sizeof(struct io_event)) #define AIO_EVENTS_OFFSET (AIO_EVENTS_PER_PAGE - AIO_EVENTS_FIRST_PAGE) -void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel) -{ - struct aio_kiocb *req = container_of(iocb, struct aio_kiocb, rw); - struct kioctx *ctx = req->ki_ctx; - unsigned long flags; - - if (WARN_ON_ONCE(!list_empty(&req->ki_list))) - return; - - spin_lock_irqsave(&ctx->ctx_lock, flags); - list_add_tail(&req->ki_list, &ctx->active_reqs); - req->ki_cancel = cancel; - spin_unlock_irqrestore(&ctx->ctx_lock, flags); -} -EXPORT_SYMBOL(kiocb_set_cancel_fn); - /* * free_ioctx() should be RCU delayed to synchronize against the RCU * protected lookup_ioctx() and also needs process context to call @@ -634,6 +619,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref) queue_rcu_work(system_wq, &ctx->free_rwork); } +static void aio_cancel_and_del(struct aio_kiocb *req); + /* * When this function runs, the kioctx has been removed from the "hash table" * and ctx->users has dropped to 0, so we know no more kiocbs can be submitted - @@ -649,8 +636,7 @@ static void free_ioctx_users(struct percpu_ref *ref) while (!list_empty(&ctx->active_reqs)) { req = list_first_entry(&ctx->active_reqs, struct aio_kiocb, ki_list); - req->ki_cancel(&req->rw); - list_del_init(&req->ki_list); + aio_cancel_and_del(req); } spin_unlock_irq(&ctx->ctx_lock); @@ -1552,6 +1538,24 @@ static ssize_t aio_setup_rw(int rw, const struct iocb *iocb, return __import_iovec(rw, buf, len, UIO_FASTIOV, iovec, iter, compat); } +static void aio_add_rw_to_active_reqs(struct kiocb *req) +{ + struct aio_kiocb *aio = container_of(req, struct aio_kiocb, rw); + struct kioctx *ctx = aio->ki_ctx; + unsigned long flags; + + /* + * If the .cancel_kiocb() callback has been set, add the request + * to the list of active requests. + */ + if (!req->ki_filp->f_op->cancel_kiocb) + return; + + spin_lock_irqsave(&ctx->ctx_lock, flags); + list_add_tail(&aio->ki_list, &ctx->active_reqs); + spin_unlock_irqrestore(&ctx->ctx_lock, flags); +} + static inline void aio_rw_done(struct kiocb *req, ssize_t ret) { switch (ret) { @@ -1593,8 +1597,10 @@ static int aio_read(struct kiocb *req, const struct iocb *iocb, if (ret < 0) return ret; ret = rw_verify_area(READ, file, &req->ki_pos, iov_iter_count(&iter)); - if (!ret) + if (!ret) { + aio_add_rw_to_active_reqs(req); aio_rw_done(req, call_read_iter(file, req, &iter)); + } kfree(iovec); return ret; } @@ -1622,6 +1628,7 @@ static int aio_write(struct kiocb *req, const struct iocb *iocb, return ret; ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter)); if (!ret) { + aio_add_rw_to_active_reqs(req); if (S_ISREG(file_inode(file)->i_mode)) kiocb_start_write(req); req->ki_flags |= IOCB_WRITE; @@ -1715,6 +1722,54 @@ static void poll_iocb_unlock_wq(struct poll_iocb *req) rcu_read_unlock(); } +/* Must be called only for IOCB_CMD_POLL requests. */ +static void aio_poll_cancel(struct aio_kiocb *aiocb) +{ + struct poll_iocb *req = &aiocb->poll; + struct kioctx *ctx = aiocb->ki_ctx; + + lockdep_assert_held(&ctx->ctx_lock); + + if (!poll_iocb_lock_wq(req)) + return; + + WRITE_ONCE(req->cancelled, true); + if (!req->work_scheduled) { + schedule_work(&aiocb->poll.work); + req->work_scheduled = true; + } + poll_iocb_unlock_wq(req); +} + +static void aio_cancel_and_del(struct aio_kiocb *req) +{ + void (*cancel_kiocb)(struct kiocb *) = + req->rw.ki_filp->f_op->cancel_kiocb; + struct kioctx *ctx = req->ki_ctx; + + lockdep_assert_held(&ctx->ctx_lock); + + switch (req->ki_opcode) { + case IOCB_CMD_PREAD: + case IOCB_CMD_PWRITE: + case IOCB_CMD_PREADV: + case IOCB_CMD_PWRITEV: + if (cancel_kiocb) + cancel_kiocb(&req->rw); + break; + case IOCB_CMD_FSYNC: + case IOCB_CMD_FDSYNC: + break; + case IOCB_CMD_POLL: + aio_poll_cancel(req); + break; + default: + WARN_ONCE(true, "invalid aio operation %d\n", req->ki_opcode); + } + + list_del_init(&req->ki_list); +} + static void aio_poll_complete_work(struct work_struct *work) { struct poll_iocb *req = container_of(work, struct poll_iocb, work); @@ -1727,11 +1782,11 @@ static void aio_poll_complete_work(struct work_struct *work) mask = vfs_poll(req->file, &pt) & req->events; /* - * Note that ->ki_cancel callers also delete iocb from active_reqs after - * calling ->ki_cancel. We need the ctx_lock roundtrip here to - * synchronize with them. In the cancellation case the list_del_init - * itself is not actually needed, but harmless so we keep it in to - * avoid further branches in the fast path. + * aio_cancel_and_del() deletes the iocb from the active_reqs list. We + * need the ctx_lock here to synchronize with aio_cancel_and_del(). In + * the cancellation case the list_del_init itself is not actually + * needed, but harmless so we keep it in to avoid further branches in + * the fast path. */ spin_lock_irq(&ctx->ctx_lock); if (poll_iocb_lock_wq(req)) { @@ -1760,24 +1815,6 @@ static void aio_poll_complete_work(struct work_struct *work) iocb_put(iocb); } -/* assumes we are called with irqs disabled */ -static int aio_poll_cancel(struct kiocb *iocb) -{ - struct aio_kiocb *aiocb = container_of(iocb, struct aio_kiocb, rw); - struct poll_iocb *req = &aiocb->poll; - - if (poll_iocb_lock_wq(req)) { - WRITE_ONCE(req->cancelled, true); - if (!req->work_scheduled) { - schedule_work(&aiocb->poll.work); - req->work_scheduled = true; - } - poll_iocb_unlock_wq(req); - } /* else, the request was force-cancelled by POLLFREE already */ - - return 0; -} - static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, void *key) { @@ -1945,7 +1982,6 @@ static int aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb) * active_reqs so that it can be cancelled if needed. */ list_add_tail(&aiocb->ki_list, &ctx->active_reqs); - aiocb->ki_cancel = aio_poll_cancel; } if (on_queue) poll_iocb_unlock_wq(req); @@ -1993,6 +2029,8 @@ static int __io_submit_one(struct kioctx *ctx, const struct iocb *iocb, req->ki_res.res = 0; req->ki_res.res2 = 0; + req->ki_opcode = iocb->aio_lio_opcode; + switch (iocb->aio_lio_opcode) { case IOCB_CMD_PREAD: return aio_read(&req->rw, iocb, false, compat); @@ -2189,8 +2227,7 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, /* TODO: use a hash or array, this sucks. */ list_for_each_entry(kiocb, &ctx->active_reqs, ki_list) { if (kiocb->ki_res.obj == obj) { - ret = kiocb->ki_cancel(&kiocb->rw); - list_del_init(&kiocb->ki_list); + aio_cancel_and_del(kiocb); break; } } diff --git a/include/linux/aio.h b/include/linux/aio.h index 86892a4fe7c8..2aa6d0be3171 100644 --- a/include/linux/aio.h +++ b/include/linux/aio.h @@ -4,20 +4,13 @@ #include <linux/aio_abi.h> -struct kioctx; -struct kiocb; struct mm_struct; -typedef int (kiocb_cancel_fn)(struct kiocb *); - /* prototypes */ #ifdef CONFIG_AIO extern void exit_aio(struct mm_struct *mm); -void kiocb_set_cancel_fn(struct kiocb *req, kiocb_cancel_fn *cancel); #else static inline void exit_aio(struct mm_struct *mm) { } -static inline void kiocb_set_cancel_fn(struct kiocb *req, - kiocb_cancel_fn *cancel) { } #endif /* CONFIG_AIO */ #endif /* __LINUX__AIO_H */ diff --git a/include/linux/fs.h b/include/linux/fs.h index ed5966a70495..7ec714878637 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2021,6 +2021,7 @@ struct file_operations { int (*uring_cmd)(struct io_uring_cmd *ioucmd, unsigned int issue_flags); int (*uring_cmd_iopoll)(struct io_uring_cmd *, struct io_comp_batch *, unsigned int poll_flags); + void (*cancel_kiocb)(struct kiocb *); } __randomize_layout; /* Wrap a directory iterator that needs exclusive inode access */

1 year, 2 months

3
9
0 0

6.8-rc: system freezes after resuming from suspend

by Trolli Schmittlauch

I've found a regression somewhere between 6.7.4 and 6.8.0-rc0 that causes my Framework 7840 AMD laptop to freeze after waking it from a suspend. I can reliably trigger the issue, but unfortunately cannot provide useful logs for now and hope to get some help with doing so. How to reproduce ---------------- The last working kernel release was 6.7.4, the issue appeared in all 6.8 release candidates from 1-4. 1. normally boot the system with a 6.8 kernel 2. suspend and resume the system 2 to 4 times. Usually, the freeze already occurs at the 2nd resume. 2.1 graphical approach: I've reproduced this directly from the "Suspend" button in my SDDM display manager (X11) 2.2 TTY approach: You can also directly swith to a tty after boot, log in, and then issue `systemctl suspend` 2 to 4 times 3. After resume number 2 or later, the system freezes while resuming and cannot be used anymore. The screen is switched on and displays something, but no inputs are processed and the image is static. 3.1 graphical approach: When suspending and resuming by closing and opening the laptop lid, the screen is black with the cursor displayed. When doing so while keeping the lid open, the display manager's background image and a cursor are displayed, but only statically frozen. No keyboard or touchpad input is processed. 3.2 on a TTY: When suspending and resuming from a tty, a few kernel messages still manage to be printed, but after that no new information is displayed. E.g. when keeping a `journalctl -f` session open in another tmux pane, that journal output does not update anymore. Keyboard inputs are not processed anymore. Nonetheless, the cursor continues to blink regulary. I've attached two screenshots showing the situation with kernels 6.7.4 (working) and 6.8 (broken). Detailed Description -------------------- In most cases, the freeze already occurs after the 2nd suspend-resume-cycle. Unfortunately, this freeze also appears to block IO, as after a forced hard reboot I cannot retrieve relevant information from `journalctl -b "-1"`. The last retrievable log messages are from the successful suspend action. I welcome any recommendation on how to retrieve valuable information. I have not yet played around with cmdline parameters relevant for debug. System Details -------------- Distro: NixOS 23.11, kernel 6.8 rc1-4 compiled manually kernel: Linux version 6.8.0-rc4 (nixbld@localhost) (gcc (GCC) 12.3.0, GNU ld (GNU Binutils) 2.40) #1-NixOS SMP PREEMPT_DYNAMIC Sun Feb 11 20:18:13 UTC 2024 hardware: Framework 13 laptop, 7840 AMD series, CPU AMD Ryzen 7 7840U x86_64 In the attachments you find: - the used kernel config - my cmdline params - 2 screenshots from the bug occuring when triggered from a tty Next Steps ---------- I intend to bisect the issue, but this can take a while due to the need for manual testing and a kernel compile cycle requiring >30min for now. I am mostly reporting this now already to still raise awareness in the RC phase and to have something where I can point other Framework laptop users towards for reproduction of the bug. All the best schmittlauch Disclaimer: I read the kernel docs on reporting issues, IMHO these were a bit unclear on whether RC kernels are in the scope of the stable and regressions lists. If they aren't please point me to where to do this. So far I had only reported bugs via the bugzilla.

1 year, 2 months

1
0
0 0

[PATCH] usb: dwc3: gadget: Don't disconnect if not started

by Thinh Nguyen

Don't go through soft-disconnection sequence if the controller hasn't started. Otherwise, there will be timeout and warning reports from the soft-disconnection flow. Cc: stable(a)vger.kernel.org Fixes: 61a348857e86 ("usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") Reported-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Closes: https://lore.kernel.org/linux-usb/20240215233536.7yejlj3zzkl23vjd@synopsys.… Tested-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> --- drivers/usb/dwc3/gadget.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 4c8dd6724678..28f49400f3e8 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2650,6 +2650,11 @@ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc) int ret; spin_lock_irqsave(&dwc->lock, flags); + if (!dwc->pullups_connected) { + spin_unlock_irqrestore(&dwc->lock, flags); + return 0; + } + dwc->connected = false; /* base-commit: 7d708c145b2631941b8b0b4a740dc2990818c39c -- 2.28.0

1 year, 2 months

1
0
0 0

[PATCH v3] usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend

by Uttkarsh Aggarwal

In current scenario if Plug-out and Plug-In performed continuously there could be a chance while checking for dwc->gadget_driver in dwc3_gadget_suspend, a NULL pointer dereference may occur. Call Stack: CPU1: CPU2: gadget_unbind_driver dwc3_suspend_common dwc3_gadget_stop dwc3_gadget_suspend dwc3_disconnect_gadget CPU1 basically clears the variable and CPU2 checks the variable. Consider CPU1 is running and right before gadget_driver is cleared and in parallel CPU2 executes dwc3_gadget_suspend where it finds dwc->gadget_driver which is not NULL and resumes execution and then CPU1 completes execution. CPU2 executes dwc3_disconnect_gadget where it checks dwc->gadget_driver is already NULL because of which the NULL pointer deference occur. Cc: <stable(a)vger.kernel.org> Fixes: 9772b47a4c29 ("usb: dwc3: gadget: Fix suspend/resume during device mode") Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Signed-off-by: Uttkarsh Aggarwal <quic_uaggarwa(a)quicinc.com> --- changes in v3: Corrected fixes tag and typo mistake in commit message dw3_gadget_stop -> dwc3_gadget_stop. Link to v2: https://lore.kernel.org/linux-usb/CAKzKK0r8RUqgXy1o5dndU21KuTKtyZ5rn5Fb9sZq… Changes in v2: Added cc and fixes tag missing in v1. Link to v1: https://lore.kernel.org/linux-usb/20240110095532.4776-1-quic_uaggarwa@quici… drivers/usb/dwc3/gadget.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 019368f8e9c4..564976b3e2b9 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -4709,15 +4709,13 @@ int dwc3_gadget_suspend(struct dwc3 *dwc) unsigned long flags; int ret; - if (!dwc->gadget_driver) - return 0; - ret = dwc3_gadget_soft_disconnect(dwc); if (ret) goto err; spin_lock_irqsave(&dwc->lock, flags); - dwc3_disconnect_gadget(dwc); + if (dwc->gadget_driver) + dwc3_disconnect_gadget(dwc); spin_unlock_irqrestore(&dwc->lock, flags); return 0; -- 2.17.1

1 year, 2 months

3
4
0 0

[PATCH] arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata

by Easwar Hariharan

Add the MIDR value of Microsoft Azure Cobalt 100, which is a Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and therefore suffers from all the same errata. CC: Mark Rutland <mark.rutland(a)arm.com> CC: Marc Zyngier <maz(a)kernel.org> CC: Anshuman Khandual <anshuman.khandual(a)arm.com> CC: stable(a)vger.kernel.org # 5.15+ Signed-off-by: Easwar Hariharan <eahariha(a)linux.microsoft.com> --- Documentation/arch/arm64/silicon-errata.rst | 7 +++++++ arch/arm64/include/asm/cputype.h | 4 ++++ arch/arm64/kernel/cpu_errata.c | 3 +++ 3 files changed, 14 insertions(+) diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst index e8c2ce1f9df6..45a7f4932fe0 100644 --- a/Documentation/arch/arm64/silicon-errata.rst +++ b/Documentation/arch/arm64/silicon-errata.rst @@ -243,3 +243,10 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ASR | ASR8601 | #8601001 | N/A | +----------------+-----------------+-----------------+-----------------------------+ ++----------------+-----------------+-----------------+-----------------------------+ +| Microsoft | Azure Cobalt 100| #2139208 | ARM64_ERRATUM_2139208 | ++----------------+-----------------+-----------------+-----------------------------+ +| Microsoft | Azure Cobalt 100| #2067961 | ARM64_ERRATUM_2067961 | ++----------------+-----------------+-----------------+-----------------------------+ +| Microsoft | Azure Cobalt 100| #2253138 | ARM64_ERRATUM_2253138 | ++----------------+-----------------+-----------------+-----------------------------+ diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 7c7493cb571f..a632a7514e55 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -61,6 +61,7 @@ #define ARM_CPU_IMP_HISI 0x48 #define ARM_CPU_IMP_APPLE 0x61 #define ARM_CPU_IMP_AMPERE 0xC0 +#define ARM_CPU_IMP_MICROSOFT 0x6D #define ARM_CPU_PART_AEM_V8 0xD0F #define ARM_CPU_PART_FOUNDATION 0xD00 @@ -135,6 +136,8 @@ #define AMPERE_CPU_PART_AMPERE1 0xAC3 +#define MSFT_CPU_PART_AZURE_COBALT_100 0xD49 /* Based on r0p0 of ARM Neoverse N2 */ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) @@ -193,6 +196,7 @@ #define MIDR_APPLE_M2_BLIZZARD_MAX MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX) #define MIDR_APPLE_M2_AVALANCHE_MAX MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX) #define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) +#define MIDR_MICROSOFT_AZURE_COBALT_100 MIDR_CPU_MODEL(ARM_CPU_IMP_MICROSOFT, MSFT_CPU_PART_AZURE_COBALT_100) /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */ #define MIDR_FUJITSU_ERRATUM_010001 MIDR_FUJITSU_A64FX diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 967c7c7a4e7d..76b8dd37092a 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -374,6 +374,7 @@ static const struct midr_range erratum_1463225[] = { static const struct midr_range trbe_overwrite_fill_mode_cpus[] = { #ifdef CONFIG_ARM64_ERRATUM_2139208 MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), #endif #ifdef CONFIG_ARM64_ERRATUM_2119858 MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), @@ -387,6 +388,7 @@ static const struct midr_range trbe_overwrite_fill_mode_cpus[] = { static const struct midr_range tsb_flush_fail_cpus[] = { #ifdef CONFIG_ARM64_ERRATUM_2067961 MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), #endif #ifdef CONFIG_ARM64_ERRATUM_2054223 MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), @@ -399,6 +401,7 @@ static const struct midr_range tsb_flush_fail_cpus[] = { static struct midr_range trbe_write_out_of_range_cpus[] = { #ifdef CONFIG_ARM64_ERRATUM_2253138 MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), #endif #ifdef CONFIG_ARM64_ERRATUM_2224489 MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), -- 2.34.1

1 year, 2 months

3
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2024