March 2024 - Linux-stable-mirror

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I'm announcing the release of the 6.6.22 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary Thanks, Sasha - ------------ -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmX0maQACgkQ3qZv95d3 LNzbJxAAnP99q7lPOB0g0UMoAGOBqKYWI81DtW2Xey8i/Bf0yerJiIYIBqRRRHKU I4Sqq8C8iR7yrTkYcD7993J2Zey8rjMBIBws78vDeEKWdVxtGLuE1DivT2sBTk6N y6uQ7Nar7mDmQ0U2IB5KlA1MCy8/tFb2J2Ocvep0GfUMbxiloOcnRoa9SqZlUOzN BNeZoAqlAWIjgJ4rVo7En9cWdYjMtk4fPFDb53vfmSR2xu1Rak73w4LHA8MdtNzr AnKqQOqXLEutjb8tGnJ4mWe7ep/OMsrDGNXSkz04Sg/V7kSbjYzyTGiLeCxYmxip lavPNqBdgdiukexVkgWON8OA2AkvFBgKGHFrEaG4k+NAfLHzKAIC1AR8MQXjCbi8 5vinLTp+u8qmoAZNMsbTYgA347fgMexM3/rk65Z33w/GWP2hOWX7fJ9TRHycbomt tiveGtaSMgMAdhN+RKlDTtsxF4JVRDVADe5w6LBzaWgv1drdcJzwNn2fTItWZm9p Vq9gjzWdPChNqS9QXK58C14GUmnzgVEbZz3my0BU7ROroEKONje/jfwdHb9fj61V 8w/CYhAU9I/hlK/1ETxQkR3GdURZ/bzHNzmLsDXx2JBgxaelAXivQDuW2iR1PqtV YH4NtC6VlUN4tDPNrLse+wCUb5QUuSX4jb6qXDxUneaRegXfa9Q= =uPB5 -----END PGP SIGNATURE-----

9 months, 3 weeks

1
1
0 0

Linux 6.7.10

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I'm announcing the release of the 6.7.10 kernel. All users of the 6.7 kernel series must upgrade. The updated 6.7.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.7.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary Thanks, Sasha - ------------ -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmX0mQoACgkQ3qZv95d3 LNzimw/8CNyHdoZLtpqSUecdo2L57pR6Fd3oHmP87dqOnRylZpQpSujVqn/euZ3e XCEfwhyA52LaQDAcEqrgsoYa9aQQUBFHBY/P3QhPvvzud+wFkwyz73+UTYSH0ag7 GPpNwjdM6d/KdKZyNmv5FIX1zbaBx0ETYPVUBhL/UiCMwFTq4U/1ic4tiBueUSQa o87IlfZQKB9Gz6k7Dsi4bW0tZbeVCcg7rmVlL69b0xATuftOJe7P76OmjSJ6GO8c e2hTCTuc/RvuyAvfWjUSxmq38IMGb2yLsJP9/DWCjinlIna9mLKCsmQZ0oxg9q/T NHwur3VWuFoxX86/0CGFQ9XqNuZlvH0aqPpdUn4BvLOhFBBn1TM9KbVx3fLTjOfo BaF0tl8ZFsH5rZasUpoimrsmHoGSIVs7Vv/XY8hLZVq7BaWogwlz1yYN6tcDUcRn bp+RuC6FrPO8/G6QMX2TwmSmEM15L/RvWKEjAigqEeqOrAW1EurKMLa9oim4gJtH g3IRXdjzR6iYGW56XZ66MKmfXt3D2hPVOHYR2OvlMZMecSnuN0ncEAPzXa5hPNKN Ff2seiKL7DWKnUhDsqLQfJIXEtAqxavNK9SbCB54g7Vq6THPfcN49+dXxkqHUxpH IzGfYbfURrUEQw5KMsE1X7RueiX9eYTIWbthPw3A/OvWYC4HJ34= =HltL -----END PGP SIGNATURE-----

9 months, 3 weeks

1
1
0 0

Linux 6.8.1

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I'm announcing the release of the 6.8.1 kernel. All users of the 6.8 kernel series must upgrade. The updated 6.8.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.8.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary Thanks, Sasha - ------------ -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmX0mB0ACgkQ3qZv95d3 LNw+tBAAraZu6ZEFSO9/acuTsFQNQqPCVT6KPRWiX3FNWKnROFW10ExxgmjVTRUc xpZ8KFSuxXb9ipPEHI5r1Apqp+iu6LE8NmbMRPLVyWEWonnxdKKWztturhebOYZs Kj8HAwIyf0H3ubrIXT/pxtOzodiA3nsyc49+NNAK6fciEHe/g0KuSsC1a6nBAndG 8zqNTQg1jI02ymoiOPSf5z1MuIYmSA5Ae2+4pHthWcDPiaGw2MWqc632x2W+Yh1a gZIXYar6VLA2Bk2hcSL5tOVIDTXHEZV5iRndJ5wbxbg+LbE0z1tTvuZPLEPefRnk lMP+rObTHZLf9yTNMRbWJ0HwhrdFuVxLYUMeZfDyI5I5XF2pYv9qTQmjc+tYJICI qbDiO5u1j7Ffsxfl0HIWNLlSUMt3MBt1cn8riMxb9YSFWVFiflw66Axi4Rybhp7E Brrp/SNl1fHRoSgTxJC1RRz+/uIuwaQGOARKfcakXPLfQ54zUdNwSzEBdpXuLV3j 6QIS7d6hiw0IvtU5BF2JUMVt2hWW9SEAnhPRKrh+AJRX3aBjYmhe8UMo4OWfNINQ Hzl4b/AZwQ22r3z20yIlbwLSmd/P27H+HbWnSOiPdpMDttes+jcN/nso0coHHX5i chCuy4eGCj9K0WOSYSTn6XyobMMuQbyHVjXMM0wyXGLQbhqHycw= =Aljr -----END PGP SIGNATURE-----

9 months, 3 weeks

1
1
0 0

[PATCH 5.15 00/76] 5.15.152-rc1 review

by Sasha Levin

This is the start of the stable review cycle for the 5.15.152 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri Mar 15 04:42:22 PM UTC 2024. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. Thanks, Sasha ------------- Pseudo-Shortlog of commits: Ansuel Smith (1): regmap: allow to define reg_update_bits for no bus configuration Christophe Kerello (1): mmc: mmci: stm32: fix DMA API overlapping mappings warning Christos Skevis (1): ALSA: usb-audio: Fix microphone sound on Nexigo webcam. Cosmin Tanislav (3): serial: max310x: use regmap methods for SPI batch operations serial: max310x: use a separate regmap for each port serial: max310x: make accessing revision id interface-agnostic Edward Adam Davis (1): net/rds: fix WARNING in rds_conn_connect_if_down Eric Dumazet (2): geneve: make sure to pull inner header in geneve_rx() net/ipv6: avoid possible UAF in ip6_route_mpath_notify() Evan Quan (1): drm/amd/pm: do not expose the API used internally only in kv_dpm.c Florian Westphal (1): netfilter: nft_ct: fix l3num expectations with inet pseudo family Friedrich Vock (1): drm/amdgpu: Reset IH OVERFLOW_CLEAR bit Gao Xiang (1): erofs: apply proper VMA alignment for memory mapped files on THP Horatiu Vultur (1): net: sparx5: Fix use after free inside sparx5_del_mact_entry Hugo Villeneuve (1): serial: max310x: prevent infinite while() loop in port startup Hui Zhou (1): nfp: flower: add hardware offload check for post ct entry Ingo Molnar (1): exit: Fix typo in comment: s/sub-theads/sub-threads Isabella Basso (1): drm/amd/display: move calcs folder into DML Jan Kundrát (1): serial: max310x: fix IO data corruption in batched operations Jaroslav Kysela (2): ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format() Jason Xing (12): netrom: Fix a data-race around sysctl_netrom_default_path_quality netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser netrom: Fix a data-race around sysctl_netrom_transport_timeout netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay netrom: Fix a data-race around sysctl_netrom_transport_busy_delay netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout netrom: Fix a data-race around sysctl_netrom_routing_control netrom: Fix a data-race around sysctl_netrom_link_fails_count netrom: Fix data-races around sysctl_net_busy_read John Keeping (1): ALSA: usb-audio: Add quirk for Tascam Model 12 Juhee Kang (1): hv_netvsc: use netif_is_bond_master() instead of open code Kees Cook (1): proc: Use task_is_running() for wchan in /proc/$pid/stat Lena Wang (1): netfilter: nf_conntrack_h323: Add protection for bmp length out of range Maciej Fijalkowski (2): ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able i40e: disable NAPI right after disabling irqs when handling xsk_pool Magali Lemes (1): drm/amd/display: remove DML Makefile duplicate lines Marek Vasut (1): regmap: Add bulk read/write callbacks into regmap_config Mathias Nyman (1): xhci: process isoc TD properly when there was a transaction error mid TD. Matthieu Baerts (NGI0) (1): selftests: mptcp: decrease BW in simult flows Michal Pecio (1): xhci: handle isoc Babble and Buffer Overrun events properly Muhammad Usama Anjum (1): selftests/mm: switch to bash from sh Nathan Chancellor (3): modpost: Include '.text.*' in TEXT_SECTIONS modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS drm/amd/display: Increase frame-larger-than for all display_mode_vba files Nico Pache (1): selftests: mm: fix map_hugetlb failure on 64K page size systems Oleg Nesterov (6): getrusage: add the "signal_struct *sig" local variable getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand() getrusage: use __for_each_thread() getrusage: use sig->stats_lock rather than lock_task_sighand() fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() exit: wait_task_zombie: kill the no longer necessary spin_lock_irq(siglock) Oleksij Rempel (1): net: lan78xx: fix runtime PM count underflow on link stop Qingqing Zhuo (1): drm/amd/display: Re-arrange FPU code structure for dcn2x Rand Deeb (1): net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() Sasha Levin (1): Linux 5.15.152-rc1 Sean Young (1): ALSA: usb-audio: add quirk for RODE NT-USB+ Shradha Gupta (1): hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed Srinivasan Shanmugam (1): drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions Steven Rostedt (Google) (1): tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string Takashi Iwai (9): ALSA: usb-audio: Refcount multiple accesses on the single clock ALSA: usb-audio: Clear fixed clock rate at closing EP ALSA: usb-audio: Split endpoint setups for hw_params and prepare (take#2) ALSA: usb-audio: Properly refcounting clock rate ALSA: usb-audio: Apply mutex around snd_usb_endpoint_set_params() ALSA: usb-audio: Correct the return code from snd_usb_endpoint_set_params() ALSA: usb-audio: Avoid superfluous endpoint setup ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless ALSA: usb-audio: Sort quirk table entries Toke Høiland-Jørgensen (1): cpumap: Zero-initialise xdp_rxq_info struct before running XDP program Wan Jiabing (1): ALSA: usb-audio: Fix wrong kfree issue in snd_usb_endpoint_free_all Wentao Jia (1): nfp: flower: add goto_chain_index for ct entry Yann Gautier (1): mmc: mmci: stm32: use a buffer for unaligned DMA requests Makefile | 4 +- drivers/base/regmap/internal.h | 4 + drivers/base/regmap/regmap.c | 77 ++++---- drivers/gpu/drm/amd/amdgpu/cik_ih.c | 6 + drivers/gpu/drm/amd/amdgpu/cz_ih.c | 5 + drivers/gpu/drm/amd/amdgpu/iceland_ih.c | 5 + drivers/gpu/drm/amd/amdgpu/navi10_ih.c | 6 + drivers/gpu/drm/amd/amdgpu/si_ih.c | 6 + drivers/gpu/drm/amd/amdgpu/tonga_ih.c | 6 + drivers/gpu/drm/amd/amdgpu/vega10_ih.c | 6 + drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 6 + .../gpu/drm/amd/display/amdgpu_dm/dc_fpu.c | 2 +- drivers/gpu/drm/amd/display/dc/Makefile | 4 +- drivers/gpu/drm/amd/display/dc/calcs/Makefile | 68 ------- .../drm/amd/display/dc/core/dc_link_dpcd.c | 4 +- .../drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- .../drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- drivers/gpu/drm/amd/display/dc/dml/Makefile | 22 ++- .../amd/display/dc/{ => dml}/calcs/bw_fixed.c | 0 .../display/dc/{ => dml}/calcs/calcs_logger.h | 0 .../display/dc/{ => dml}/calcs/custom_float.c | 0 .../display/dc/{ => dml}/calcs/dce_calcs.c | 0 .../dc/{ => dml}/calcs/dcn_calc_auto.c | 0 .../dc/{ => dml}/calcs/dcn_calc_auto.h | 0 .../dc/{ => dml}/calcs/dcn_calc_math.c | 0 .../display/dc/{ => dml}/calcs/dcn_calcs.c | 0 .../dml/{dcn2x/dcn2x.c => dcn20/dcn20_fpu.c} | 2 +- .../dml/{dcn2x/dcn2x.h => dcn20/dcn20_fpu.h} | 6 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 23 --- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 2 - drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 25 ++- drivers/mmc/host/mmci_stm32_sdmmc.c | 112 +++++++++-- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 56 +++++- .../microchip/sparx5/sparx5_mactable.c | 4 +- .../ethernet/netronome/nfp/flower/conntrack.c | 28 ++- .../ethernet/netronome/nfp/flower/conntrack.h | 2 + drivers/net/geneve.c | 18 +- drivers/net/hyperv/netvsc_drv.c | 83 +++++--- drivers/net/usb/lan78xx.c | 3 +- drivers/tty/serial/max310x.c | 151 +++++++++------ drivers/usb/host/xhci-ring.c | 80 ++++++-- drivers/usb/host/xhci.h | 1 + fs/erofs/data.c | 1 + fs/proc/array.c | 17 +- include/linux/regmap.h | 19 ++ include/trace/events/qdisc.h | 20 +- kernel/bpf/cpumap.c | 2 +- kernel/exit.c | 12 +- kernel/sys.c | 91 +++++---- net/ipv6/route.c | 21 +-- net/netfilter/nf_conntrack_h323_asn1.c | 4 + net/netfilter/nft_ct.c | 11 +- net/netrom/af_netrom.c | 14 +- net/netrom/nr_dev.c | 2 +- net/netrom/nr_in.c | 6 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_route.c | 8 +- net/netrom/nr_subr.c | 5 +- net/rds/rdma.c | 3 + net/rds/send.c | 6 +- scripts/mod/modpost.c | 7 +- sound/usb/card.c | 1 + sound/usb/card.h | 7 +- sound/usb/endpoint.c | 177 +++++++++++++++--- sound/usb/endpoint.h | 9 +- sound/usb/implicit.c | 9 +- sound/usb/implicit.h | 2 +- sound/usb/mixer.c | 7 + sound/usb/pcm.c | 89 +++++---- sound/usb/pcm.h | 2 + sound/usb/quirks.c | 30 ++- sound/usb/usbaudio.h | 9 + .../selftests/net/mptcp/simult_flows.sh | 8 +- .../selftests/vm/charge_reserved_hugetlb.sh | 2 +- tools/testing/selftests/vm/map_hugetlb.c | 7 + .../selftests/vm/write_hugetlb_memory.sh | 2 +- 78 files changed, 966 insertions(+), 481 deletions(-) delete mode 100644 drivers/gpu/drm/amd/display/dc/calcs/Makefile rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/bw_fixed.c (100%) rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/calcs_logger.h (100%) rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/custom_float.c (100%) rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/dce_calcs.c (100%) rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/dcn_calc_auto.c (100%) rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/dcn_calc_auto.h (100%) rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/dcn_calc_math.c (100%) rename drivers/gpu/drm/amd/display/dc/{ => dml}/calcs/dcn_calcs.c (100%) rename drivers/gpu/drm/amd/display/dc/dml/{dcn2x/dcn2x.c => dcn20/dcn20_fpu.c} (99%) rename drivers/gpu/drm/amd/display/dc/dml/{dcn2x/dcn2x.h => dcn20/dcn20_fpu.h} (94%) -- 2.43.0

9 months, 3 weeks

9
90
0 0

[PATCH 6.8 0/5] 6.8.1-rc1 review

by Sasha Levin

This is the start of the stable review cycle for the 6.8.1 release. There are 5 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri Mar 15 04:28:11 PM UTC 2024. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.8.y and the diffstat can be found below. Thanks, Sasha ------------- Pseudo-Shortlog of commits: Pawan Gupta (4): x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set Documentation/hw-vuln: Add documentation for RFDS x86/rfds: Mitigate Register File Data Sampling (RFDS) KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests Sasha Levin (1): Linux 6.8.1-rc1 .../ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/reg-file-data-sampling.rst | 104 ++++++++++++++++++ .../admin-guide/kernel-parameters.txt | 21 ++++ Makefile | 4 +- arch/x86/Kconfig | 11 ++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 8 ++ arch/x86/kernel/cpu/bugs.c | 92 +++++++++++++++- arch/x86/kernel/cpu/common.c | 38 ++++++- arch/x86/kvm/x86.c | 5 +- drivers/base/cpu.c | 3 + include/linux/cpu.h | 2 + 13 files changed, 280 insertions(+), 11 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst -- 2.43.0

9 months, 3 weeks

7
14
0 0

[PATCH 6.6 00/60] 6.6.22-rc1 review

by Sasha Levin

This is the start of the stable review cycle for the 6.6.22 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri Mar 15 04:36:58 PM UTC 2024. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. Thanks, Sasha ------------- Pseudo-Shortlog of commits: Byungchul Park (1): mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index Christian Borntraeger (1): KVM: s390: vsie: fix race during shadow creation Daniel Borkmann (2): xdp, bonding: Fix feature flags when there are no slave devs anymore selftests/bpf: Fix up xdp bonding test wrt feature flags Eduard Zingerman (1): bpf: check bpf_func_state->callback_depth when pruning states Edward Adam Davis (1): net/rds: fix WARNING in rds_conn_connect_if_down Emeel Hakim (1): net/mlx5e: Fix MACsec state loss upon state update in offload path Eric Dumazet (2): geneve: make sure to pull inner header in geneve_rx() net/ipv6: avoid possible UAF in ip6_route_mpath_notify() Florian Kauer (1): igc: avoid returning frame twice in XDP_REDIRECT Florian Westphal (1): netfilter: nft_ct: fix l3num expectations with inet pseudo family Frank Li (3): dt-bindings: dma: fsl-edma: Add fsl-edma.h to prevent hardcoding in dts dmaengine: fsl-edma: utilize common dt-binding header file dmaengine: fsl-edma: correct max_segment_size setting Gao Xiang (1): erofs: apply proper VMA alignment for memory mapped files on THP Gavin Li (1): Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" Horatiu Vultur (1): net: sparx5: Fix use after free inside sparx5_del_mact_entry Jacob Keller (1): ice: virtchnl: stop pretending to support RSS over AQ or registers Jan Kara (1): readahead: avoid multiple marked readahead pages Jason Xing (12): netrom: Fix a data-race around sysctl_netrom_default_path_quality netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser netrom: Fix a data-race around sysctl_netrom_transport_timeout netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay netrom: Fix a data-race around sysctl_netrom_transport_busy_delay netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout netrom: Fix a data-race around sysctl_netrom_routing_control netrom: Fix a data-race around sysctl_netrom_link_fails_count netrom: Fix data-races around sysctl_net_busy_read Jianbo Liu (2): net/mlx5: E-switch, Change flow rule destination checking net/mlx5e: Change the warning when ignore_flow_level is not supported Kefeng Wang (3): mm: migrate: remove PageTransHuge check in numamigrate_isolate_page() mm: migrate: remove THP mapcount check in numamigrate_isolate_page() mm: migrate: convert numamigrate_isolate_page() to numamigrate_isolate_folio() Lena Wang (1): netfilter: nf_conntrack_h323: Add protection for bmp length out of range Leon Romanovsky (1): xfrm: Pass UDP encapsulation in TX packet offload Maciej Fijalkowski (3): ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able i40e: disable NAPI right after disabling irqs when handling xsk_pool ice: reorder disabling IRQ and NAPI in ice_qp_dis Matthieu Baerts (NGI0) (1): selftests: mptcp: decrease BW in simult flows Moshe Shemesh (1): net/mlx5: Check capability for fw_reset Nico Boehr (1): KVM: s390: add stat counter for shadow gmap events Oleg Nesterov (1): exit: wait_task_zombie: kill the no longer necessary spin_lock_irq(siglock) Oleksij Rempel (1): net: lan78xx: fix runtime PM count underflow on link stop Pawan Gupta (4): x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set Documentation/hw-vuln: Add documentation for RFDS x86/rfds: Mitigate Register File Data Sampling (RFDS) KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests Rahul Rameshbabu (2): net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context Rand Deeb (1): net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() Saeed Mahameed (1): Revert "net/mlx5e: Check the number of elements before walk TC rhashtable" Sasha Levin (1): Linux 6.6.22-rc1 Steven Rostedt (Google) (1): tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string Tobias Jakobi (Compleo) (1): net: dsa: microchip: fix register write order in ksz8_ind_write8() Toke Høiland-Jørgensen (1): cpumap: Zero-initialise xdp_rxq_info struct before running XDP program Xiubo Li (1): ceph: switch to corrected encoding of max_xattr_size in mdsmap Yongzhi Liu (1): net: pds_core: Fix possible double free in error handling path .../ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/reg-file-data-sampling.rst | 104 ++++++++++++++++++ .../admin-guide/kernel-parameters.txt | 21 ++++ Makefile | 4 +- arch/s390/include/asm/kvm_host.h | 7 ++ arch/s390/kvm/gaccess.c | 7 ++ arch/s390/kvm/kvm-s390.c | 9 +- arch/s390/kvm/vsie.c | 6 +- arch/s390/mm/gmap.c | 1 + arch/x86/Kconfig | 11 ++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 8 ++ arch/x86/kernel/cpu/bugs.c | 92 +++++++++++++++- arch/x86/kernel/cpu/common.c | 38 ++++++- arch/x86/kvm/x86.c | 5 +- drivers/base/cpu.c | 3 + drivers/dma/fsl-edma-common.h | 5 +- drivers/dma/fsl-edma-main.c | 21 ++-- drivers/net/bonding/bond_main.c | 2 +- drivers/net/dsa/microchip/ksz8795.c | 4 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 12 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 +- .../intel/ice/ice_virtchnl_allowlist.c | 2 - drivers/net/ethernet/intel/ice/ice_xsk.c | 9 +- drivers/net/ethernet/intel/igc/igc_main.c | 13 +-- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 56 ++++++++-- .../net/ethernet/mellanox/mlx5/core/devlink.c | 6 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 12 +- .../mellanox/mlx5/core/en/tc/post_act.c | 2 +- .../mellanox/mlx5/core/en_accel/macsec.c | 82 ++++++++------ .../net/ethernet/mellanox/mlx5/core/en_tx.c | 2 + .../mellanox/mlx5/core/esw/ipsec_fs.c | 2 +- .../mellanox/mlx5/core/eswitch_offloads.c | 46 +++----- .../ethernet/mellanox/mlx5/core/fw_reset.c | 22 +++- .../microchip/sparx5/sparx5_mactable.c | 4 +- drivers/net/geneve.c | 18 ++- drivers/net/usb/lan78xx.c | 3 +- fs/ceph/mdsmap.c | 7 +- fs/erofs/data.c | 1 + include/dt-bindings/dma/fsl-edma.h | 21 ++++ include/linux/ceph/mdsmap.h | 6 +- include/linux/cpu.h | 2 + include/linux/mlx5/mlx5_ifc.h | 4 +- include/trace/events/qdisc.h | 20 ++-- kernel/bpf/cpumap.c | 2 +- kernel/bpf/verifier.c | 3 + kernel/exit.c | 10 +- mm/migrate.c | 34 +++--- mm/readahead.c | 4 +- net/ipv6/route.c | 21 ++-- net/netfilter/nf_conntrack_h323_asn1.c | 4 + net/netfilter/nft_ct.c | 11 +- net/netrom/af_netrom.c | 14 +-- net/netrom/nr_dev.c | 2 +- net/netrom/nr_in.c | 6 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_route.c | 8 +- net/netrom/nr_subr.c | 5 +- net/rds/rdma.c | 3 + net/rds/send.c | 6 +- net/xfrm/xfrm_device.c | 2 +- .../selftests/bpf/prog_tests/xdp_bonding.c | 4 +- .../selftests/net/mptcp/simult_flows.sh | 8 +- 66 files changed, 628 insertions(+), 237 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst create mode 100644 include/dt-bindings/dma/fsl-edma.h -- 2.43.0

9 months, 4 weeks

9
71
0 0

[PATCH] bcache: fix variable length array abuse in btree_iter

by Matthew Mirvish

btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array. Cc: stable(a)vger.kernel.org Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368 Signed-off-by: Matthew Mirvish <matthew(a)mm12.xyz> --- drivers/md/bcache/bset.c | 44 +++++++++++++++++------------------ drivers/md/bcache/bset.h | 28 ++++++++++++++-------- drivers/md/bcache/btree.c | 40 ++++++++++++++++--------------- drivers/md/bcache/super.c | 5 ++-- drivers/md/bcache/sysfs.c | 2 +- drivers/md/bcache/writeback.c | 10 ++++---- 6 files changed, 70 insertions(+), 59 deletions(-) diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c index 2bba4d6aaaa2..463eb13bd0b2 100644 --- a/drivers/md/bcache/bset.c +++ b/drivers/md/bcache/bset.c @@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b) int __bch_count_data(struct btree_keys *b) { unsigned int ret = 0; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k; if (b->ops->is_extents) @@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...) { va_list args; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; const char *err; for_each_key(b, k, &iter) { @@ -879,7 +879,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, unsigned int status = BTREE_INSERT_STATUS_NO_INSERT; struct bset *i = bset_tree_last(b)->data; struct bkey *m, *prev = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey preceding_key_on_stack = ZERO_KEY; struct bkey *preceding_key_p = &preceding_key_on_stack; @@ -895,9 +895,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, else preceding_key(k, &preceding_key_p); - m = bch_btree_iter_init(b, &iter, preceding_key_p); + m = bch_btree_iter_stack_init(b, &iter, preceding_key_p); - if (b->ops->insert_fixup(b, k, &iter, replace_key)) + if (b->ops->insert_fixup(b, k, &iter.iter, replace_key)) return status; status = BTREE_INSERT_STATUS_INSERT; @@ -1100,33 +1100,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, btree_iter_cmp)); } -static struct bkey *__bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search, - struct bset_tree *start) +static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search, + struct bset_tree *start) { struct bkey *ret = NULL; - iter->size = ARRAY_SIZE(iter->data); - iter->used = 0; + iter->iter.size = ARRAY_SIZE(iter->stack_data); + iter->iter.used = 0; #ifdef CONFIG_BCACHE_DEBUG - iter->b = b; + iter->iter.b = b; #endif for (; start <= bset_tree_last(b); start++) { ret = bch_bset_search(b, start, search); - bch_btree_iter_push(iter, ret, bset_bkey_last(start->data)); + bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data)); } return ret; } -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, struct bkey *search) { - return __bch_btree_iter_init(b, iter, search, b->set); + return __bch_btree_iter_stack_init(b, iter, search, b->set); } static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter, @@ -1293,10 +1293,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, struct bset_sort_state *state) { size_t order = b->page_order, keys = 0; - struct btree_iter iter; + struct btree_iter_stack iter; int oldsize = bch_count_data(b); - __bch_btree_iter_init(b, &iter, NULL, &b->set[start]); + __bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]); if (start) { unsigned int i; @@ -1307,7 +1307,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, order = get_order(__set_bytes(b->set->data, keys)); } - __btree_sort(b, &iter, start, order, false, state); + __btree_sort(b, &iter.iter, start, order, false, state); EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize); } @@ -1323,11 +1323,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new, struct bset_sort_state *state) { uint64_t start_time = local_clock(); - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(b, &iter, NULL); + bch_btree_iter_stack_init(b, &iter, NULL); - btree_mergesort(b, new->set->data, &iter, false, true); + btree_mergesort(b, new->set->data, &iter.iter, false, true); bch_time_stats_update(&state->time, start_time); diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h index d795c84246b0..011f6062c4c0 100644 --- a/drivers/md/bcache/bset.h +++ b/drivers/md/bcache/bset.h @@ -321,7 +321,14 @@ struct btree_iter { #endif struct btree_iter_set { struct bkey *k, *end; - } data[MAX_BSETS]; + } data[]; +}; + +/* Fixed-size btree_iter that can be allocated on the stack */ + +struct btree_iter_stack { + struct btree_iter iter; + struct btree_iter_set stack_data[MAX_BSETS]; }; typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k); @@ -333,9 +340,9 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter, void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, struct bkey *end); -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search); +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search); struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t, const struct bkey *search); @@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b, return search ? __bch_bset_search(b, t, search) : t->data->start; } -#define for_each_key_filter(b, k, iter, filter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next_filter((iter), (b), filter));) +#define for_each_key_filter(b, k, stack_iter, filter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \ + filter));) -#define for_each_key(b, k, iter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next(iter));) +#define for_each_key(b, k, stack_iter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next(&((stack_iter)->iter)));) /* Sorting */ diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c index 196cdacce38f..d011a7154d33 100644 --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1309,7 +1309,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc) uint8_t stale = 0; unsigned int keys = 0, good_keys = 0; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct bset_tree *t; gc->nodes++; @@ -1570,7 +1570,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op, static unsigned int btree_gc_count_keys(struct btree *b) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; unsigned int ret = 0; for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) @@ -1611,17 +1611,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op, int ret = 0; bool should_rewrite; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct gc_merge_info r[GC_MERGE_NODES]; struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1; - bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done); + bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done); for (i = r; i < r + ARRAY_SIZE(r); i++) i->b = ERR_PTR(-EINTR); while (1) { - k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad); + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad); if (k) { r->b = bch_btree_node_get(b->c, op, k, b->level - 1, true, b); @@ -1911,7 +1912,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) { int ret = 0; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid) bch_initial_mark_key(b->c, b->level, k); @@ -1919,10 +1920,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) bch_initial_mark_key(b->c, b->level + 1, &b->key); if (b->level) { - bch_btree_iter_init(&b->keys, &iter, NULL); + bch_btree_iter_stack_init(&b->keys, &iter, NULL); do { - k = bch_btree_iter_next_filter(&iter, &b->keys, + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad); if (k) { btree_node_prefetch(b, k); @@ -1950,7 +1951,7 @@ static int bch_btree_check_thread(void *arg) struct btree_check_info *info = arg; struct btree_check_state *check_state = info->state; struct cache_set *c = check_state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; @@ -1959,8 +1960,8 @@ static int bch_btree_check_thread(void *arg) ret = 0; /* root node keys are checked before thread created */ - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -1978,7 +1979,7 @@ static int bch_btree_check_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -2051,7 +2052,7 @@ int bch_btree_check(struct cache_set *c) int ret = 0; int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct btree_check_state check_state; /* check and mark root node keys */ @@ -2547,11 +2548,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op, if (b->level) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad))) { ret = bcache_btree(map_nodes_recurse, k, b, op, from, fn, flags); @@ -2580,11 +2581,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op, { int ret = MAP_CONTINUE; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) { + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad))) { ret = !b->level ? fn(op, b, k) : bcache_btree(map_keys_recurse, k, diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index dc3f50f69714..0676f863355a 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1913,8 +1913,9 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) INIT_LIST_HEAD(&c->btree_cache_freed); INIT_LIST_HEAD(&c->data_buckets); - iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) * - sizeof(struct btree_iter_set); + iter_size = sizeof(struct btree_iter) + + ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) * + sizeof(struct btree_iter_set); c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL); if (!c->devices) diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c index a438efb66069..c4633425acc4 100644 --- a/drivers/md/bcache/sysfs.c +++ b/drivers/md/bcache/sysfs.c @@ -660,7 +660,7 @@ static unsigned int bch_root_usage(struct cache_set *c) unsigned int bytes = 0; struct bkey *k; struct btree *b; - struct btree_iter iter; + struct btree_iter_stack iter; goto lock_root; diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 8827a6f130ad..792e070ccf38 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -908,15 +908,15 @@ static int bch_dirty_init_thread(void *arg) struct dirty_init_thrd_info *info = arg; struct bch_dirty_init_state *state = info->state; struct cache_set *c = state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; k = p = NULL; prev_idx = 0; - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -930,7 +930,7 @@ static int bch_dirty_init_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -979,7 +979,7 @@ void bch_sectors_dirty_init(struct bcache_device *d) int i; struct btree *b = NULL; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct sectors_dirty_init op; struct cache_set *c = d->c; struct bch_dirty_init_state state; -- 2.40.1

9 months, 4 weeks

2
1
0 0

[PATCH v2 6/7] vfio/platform: Create persistent IRQ handlers

by Alex Williamson

The vfio-platform SET_IRQS ioctl currently allows loopback triggering of an interrupt before a signaling eventfd has been configured by the user, which thereby allows a NULL pointer dereference. Rather than register the IRQ relative to a valid trigger, register all IRQs in a disabled state in the device open path. This allows mask operations on the IRQ to nest within the overall enable state governed by a valid eventfd signal. This decouples @masked, protected by the @locked spinlock from @trigger, protected via the @igate mutex. In doing so, it's guaranteed that changes to @trigger cannot race the IRQ handlers because the IRQ handler is synchronously disabled before modifying the trigger, and loopback triggering of the IRQ via ioctl is safe due to serialization with trigger changes via igate. For compatibility, request_irq() failures are maintained to be local to the SET_IRQS ioctl rather than a fatal error in the open device path. This allows, for example, a userspace driver with polling mode support to continue to work regardless of moving the request_irq() call site. This necessarily blocks all SET_IRQS access to the failed index. Cc: Eric Auger <eric.auger(a)redhat.com> Cc: stable(a)vger.kernel.org Fixes: 57f972e2b341 ("vfio/platform: trigger an interrupt via eventfd") Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com> --- drivers/vfio/platform/vfio_platform_irq.c | 100 +++++++++++++++------- 1 file changed, 68 insertions(+), 32 deletions(-) diff --git a/drivers/vfio/platform/vfio_platform_irq.c b/drivers/vfio/platform/vfio_platform_irq.c index e5dcada9e86c..ef41ecef83af 100644 --- a/drivers/vfio/platform/vfio_platform_irq.c +++ b/drivers/vfio/platform/vfio_platform_irq.c @@ -136,6 +136,16 @@ static int vfio_platform_set_irq_unmask(struct vfio_platform_device *vdev, return 0; } +/* + * The trigger eventfd is guaranteed valid in the interrupt path + * and protected by the igate mutex when triggered via ioctl. + */ +static void vfio_send_eventfd(struct vfio_platform_irq *irq_ctx) +{ + if (likely(irq_ctx->trigger)) + eventfd_signal(irq_ctx->trigger); +} + static irqreturn_t vfio_automasked_irq_handler(int irq, void *dev_id) { struct vfio_platform_irq *irq_ctx = dev_id; @@ -155,7 +165,7 @@ static irqreturn_t vfio_automasked_irq_handler(int irq, void *dev_id) spin_unlock_irqrestore(&irq_ctx->lock, flags); if (ret == IRQ_HANDLED) - eventfd_signal(irq_ctx->trigger); + vfio_send_eventfd(irq_ctx); return ret; } @@ -164,52 +174,40 @@ static irqreturn_t vfio_irq_handler(int irq, void *dev_id) { struct vfio_platform_irq *irq_ctx = dev_id; - eventfd_signal(irq_ctx->trigger); + vfio_send_eventfd(irq_ctx); return IRQ_HANDLED; } static int vfio_set_trigger(struct vfio_platform_device *vdev, int index, - int fd, irq_handler_t handler) + int fd) { struct vfio_platform_irq *irq = &vdev->irqs[index]; struct eventfd_ctx *trigger; - int ret; if (irq->trigger) { - irq_clear_status_flags(irq->hwirq, IRQ_NOAUTOEN); - free_irq(irq->hwirq, irq); - kfree(irq->name); + disable_irq(irq->hwirq); eventfd_ctx_put(irq->trigger); irq->trigger = NULL; } if (fd < 0) /* Disable only */ return 0; - irq->name = kasprintf(GFP_KERNEL_ACCOUNT, "vfio-irq[%d](%s)", - irq->hwirq, vdev->name); - if (!irq->name) - return -ENOMEM; trigger = eventfd_ctx_fdget(fd); - if (IS_ERR(trigger)) { - kfree(irq->name); + if (IS_ERR(trigger)) return PTR_ERR(trigger); - } irq->trigger = trigger; - irq_set_status_flags(irq->hwirq, IRQ_NOAUTOEN); - ret = request_irq(irq->hwirq, handler, 0, irq->name, irq); - if (ret) { - kfree(irq->name); - eventfd_ctx_put(trigger); - irq->trigger = NULL; - return ret; - } - - if (!irq->masked) - enable_irq(irq->hwirq); + /* + * irq->masked effectively provides nested disables within the overall + * enable relative to trigger. Specifically request_irq() is called + * with NO_AUTOEN, therefore the IRQ is initially disabled. The user + * may only further disable the IRQ with a MASK operations because + * irq->masked is initially false. + */ + enable_irq(irq->hwirq); return 0; } @@ -228,7 +226,7 @@ static int vfio_platform_set_irq_trigger(struct vfio_platform_device *vdev, handler = vfio_irq_handler; if (!count && (flags & VFIO_IRQ_SET_DATA_NONE)) - return vfio_set_trigger(vdev, index, -1, handler); + return vfio_set_trigger(vdev, index, -1); if (start != 0 || count != 1) return -EINVAL; @@ -236,7 +234,7 @@ static int vfio_platform_set_irq_trigger(struct vfio_platform_device *vdev, if (flags & VFIO_IRQ_SET_DATA_EVENTFD) { int32_t fd = *(int32_t *)data; - return vfio_set_trigger(vdev, index, fd, handler); + return vfio_set_trigger(vdev, index, fd); } if (flags & VFIO_IRQ_SET_DATA_NONE) { @@ -260,6 +258,14 @@ int vfio_platform_set_irqs_ioctl(struct vfio_platform_device *vdev, unsigned start, unsigned count, uint32_t flags, void *data) = NULL; + /* + * For compatibility, errors from request_irq() are local to the + * SET_IRQS path and reflected in the name pointer. This allows, + * for example, polling mode fallback for an exclusive IRQ failure. + */ + if (IS_ERR(vdev->irqs[index].name)) + return PTR_ERR(vdev->irqs[index].name); + switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) { case VFIO_IRQ_SET_ACTION_MASK: func = vfio_platform_set_irq_mask; @@ -280,7 +286,7 @@ int vfio_platform_set_irqs_ioctl(struct vfio_platform_device *vdev, int vfio_platform_irq_init(struct vfio_platform_device *vdev) { - int cnt = 0, i; + int cnt = 0, i, ret = 0; while (vdev->get_irq(vdev, cnt) >= 0) cnt++; @@ -292,29 +298,54 @@ int vfio_platform_irq_init(struct vfio_platform_device *vdev) for (i = 0; i < cnt; i++) { int hwirq = vdev->get_irq(vdev, i); + irq_handler_t handler = vfio_irq_handler; - if (hwirq < 0) + if (hwirq < 0) { + ret = -EINVAL; goto err; + } spin_lock_init(&vdev->irqs[i].lock); vdev->irqs[i].flags = VFIO_IRQ_INFO_EVENTFD; - if (irq_get_trigger_type(hwirq) & IRQ_TYPE_LEVEL_MASK) + if (irq_get_trigger_type(hwirq) & IRQ_TYPE_LEVEL_MASK) { vdev->irqs[i].flags |= VFIO_IRQ_INFO_MASKABLE | VFIO_IRQ_INFO_AUTOMASKED; + handler = vfio_automasked_irq_handler; + } vdev->irqs[i].count = 1; vdev->irqs[i].hwirq = hwirq; vdev->irqs[i].masked = false; + vdev->irqs[i].name = kasprintf(GFP_KERNEL_ACCOUNT, + "vfio-irq[%d](%s)", hwirq, + vdev->name); + if (!vdev->irqs[i].name) { + ret = -ENOMEM; + goto err; + } + + ret = request_irq(hwirq, handler, IRQF_NO_AUTOEN, + vdev->irqs[i].name, &vdev->irqs[i]); + if (ret) { + kfree(vdev->irqs[i].name); + vdev->irqs[i].name = ERR_PTR(ret); + } } vdev->num_irqs = cnt; return 0; err: + for (--i; i >= 0; i--) { + if (!IS_ERR(vdev->irqs[i].name)) { + free_irq(vdev->irqs[i].hwirq, &vdev->irqs[i]); + kfree(vdev->irqs[i].name); + } + } kfree(vdev->irqs); - return -EINVAL; + return ret; } void vfio_platform_irq_cleanup(struct vfio_platform_device *vdev) @@ -324,7 +355,12 @@ void vfio_platform_irq_cleanup(struct vfio_platform_device *vdev) for (i = 0; i < vdev->num_irqs; i++) { vfio_virqfd_disable(&vdev->irqs[i].mask); vfio_virqfd_disable(&vdev->irqs[i].unmask); - vfio_set_trigger(vdev, i, -1, NULL); + if (!IS_ERR(vdev->irqs[i].name)) { + free_irq(vdev->irqs[i].hwirq, &vdev->irqs[i]); + if (vdev->irqs[i].trigger) + eventfd_ctx_put(vdev->irqs[i].trigger); + kfree(vdev->irqs[i].name); + } } vdev->num_irqs = 0; -- 2.44.0

9 months, 4 weeks

3
3
0 0

[PATCH 6.7 00/61] 6.7.10-rc1 review

by Sasha Levin

This is the start of the stable review cycle for the 6.7.10 release. There are 61 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri Mar 15 04:32:27 PM UTC 2024. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.7.y and the diffstat can be found below. Thanks, Sasha ------------- Pseudo-Shortlog of commits: Aya Levin (1): net/mlx5: Fix fw reporter diagnose output Daniel Borkmann (2): xdp, bonding: Fix feature flags when there are no slave devs anymore selftests/bpf: Fix up xdp bonding test wrt feature flags Eduard Zingerman (1): bpf: check bpf_func_state->callback_depth when pruning states Edward Adam Davis (1): net/rds: fix WARNING in rds_conn_connect_if_down Emeel Hakim (1): net/mlx5e: Fix MACsec state loss upon state update in offload path Emil Tantilov (1): idpf: disable local BH when scheduling napi for marker packets Eric Dumazet (2): geneve: make sure to pull inner header in geneve_rx() net/ipv6: avoid possible UAF in ip6_route_mpath_notify() Florian Kauer (1): igc: avoid returning frame twice in XDP_REDIRECT Florian Westphal (1): netfilter: nft_ct: fix l3num expectations with inet pseudo family Frank Li (3): dt-bindings: dma: fsl-edma: Add fsl-edma.h to prevent hardcoding in dts dmaengine: fsl-edma: utilize common dt-binding header file dmaengine: fsl-edma: correct max_segment_size setting Gao Xiang (1): erofs: apply proper VMA alignment for memory mapped files on THP Gavin Li (1): Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" Guillaume Nault (1): xfrm: Clear low order bits of ->flowi4_tos in decode_session4(). Horatiu Vultur (1): net: sparx5: Fix use after free inside sparx5_del_mact_entry Jacob Keller (2): ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi() ice: virtchnl: stop pretending to support RSS over AQ or registers Jan Kara (1): readahead: avoid multiple marked readahead pages Jason Xing (12): netrom: Fix a data-race around sysctl_netrom_default_path_quality netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser netrom: Fix a data-race around sysctl_netrom_transport_timeout netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay netrom: Fix a data-race around sysctl_netrom_transport_busy_delay netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout netrom: Fix a data-race around sysctl_netrom_routing_control netrom: Fix a data-race around sysctl_netrom_link_fails_count netrom: Fix data-races around sysctl_net_busy_read Jianbo Liu (2): net/mlx5: E-switch, Change flow rule destination checking net/mlx5e: Change the warning when ignore_flow_level is not supported Lena Wang (1): netfilter: nf_conntrack_h323: Add protection for bmp length out of range Leon Romanovsky (1): xfrm: Pass UDP encapsulation in TX packet offload Maciej Fijalkowski (3): ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able i40e: disable NAPI right after disabling irqs when handling xsk_pool ice: reorder disabling IRQ and NAPI in ice_qp_dis Matthieu Baerts (NGI0) (1): selftests: mptcp: decrease BW in simult flows Michal Schmidt (1): ice: fix uninitialized dplls mutex usage Michal Swiatkowski (1): ice: reconfig host after changing MSI-X on VF Moshe Shemesh (1): net/mlx5: Check capability for fw_reset Oleg Nesterov (1): exit: wait_task_zombie: kill the no longer necessary spin_lock_irq(siglock) Oleksij Rempel (1): net: lan78xx: fix runtime PM count underflow on link stop Pawan Gupta (4): x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set Documentation/hw-vuln: Add documentation for RFDS x86/rfds: Mitigate Register File Data Sampling (RFDS) KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests Rahul Rameshbabu (2): net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context Rand Deeb (1): net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() Saeed Mahameed (1): Revert "net/mlx5e: Check the number of elements before walk TC rhashtable" Sasha Levin (1): Linux 6.7.10-rc1 Steven Rostedt (Google) (1): tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string Suren Baghdasaryan (1): arch/arm/mm: fix major fault accounting when retrying under per-VMA lock Tobias Jakobi (Compleo) (1): net: dsa: microchip: fix register write order in ksz8_ind_write8() Toke Høiland-Jørgensen (1): cpumap: Zero-initialise xdp_rxq_info struct before running XDP program Wang Kefeng (1): ARM: 9328/1: mm: try VMA lock-based page fault handling first Yongzhi Liu (1): net: pds_core: Fix possible double free in error handling path .../ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/reg-file-data-sampling.rst | 104 ++++++++++++++++++ .../admin-guide/kernel-parameters.txt | 21 ++++ Makefile | 4 +- arch/arm/Kconfig | 1 + arch/arm/mm/fault.c | 32 ++++++ arch/x86/Kconfig | 11 ++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 8 ++ arch/x86/kernel/cpu/bugs.c | 92 +++++++++++++++- arch/x86/kernel/cpu/common.c | 38 ++++++- arch/x86/kvm/x86.c | 5 +- drivers/base/cpu.c | 3 + drivers/dma/fsl-edma-common.h | 5 +- drivers/dma/fsl-edma-main.c | 21 ++-- drivers/net/bonding/bond_main.c | 2 +- drivers/net/dsa/microchip/ksz8795.c | 4 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 12 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 + drivers/net/ethernet/intel/ice/ice_sriov.c | 33 ++---- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 35 ++++-- drivers/net/ethernet/intel/ice/ice_vf_lib.h | 1 - .../ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 +- .../intel/ice/ice_virtchnl_allowlist.c | 2 - drivers/net/ethernet/intel/ice/ice_xsk.c | 9 +- .../net/ethernet/intel/idpf/idpf_virtchnl.c | 2 + drivers/net/ethernet/intel/igc/igc_main.c | 13 +-- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 56 ++++++++-- .../net/ethernet/mellanox/mlx5/core/devlink.c | 6 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 12 +- .../mellanox/mlx5/core/en/tc/post_act.c | 2 +- .../mellanox/mlx5/core/en_accel/macsec.c | 82 ++++++++------ .../net/ethernet/mellanox/mlx5/core/en_tx.c | 2 + .../mellanox/mlx5/core/esw/ipsec_fs.c | 2 +- .../mellanox/mlx5/core/eswitch_offloads.c | 46 +++----- .../ethernet/mellanox/mlx5/core/fw_reset.c | 22 +++- .../net/ethernet/mellanox/mlx5/core/health.c | 2 +- .../microchip/sparx5/sparx5_mactable.c | 4 +- drivers/net/geneve.c | 18 ++- drivers/net/usb/lan78xx.c | 3 +- fs/erofs/data.c | 1 + include/dt-bindings/dma/fsl-edma.h | 21 ++++ include/linux/cpu.h | 2 + include/linux/mlx5/mlx5_ifc.h | 4 +- include/trace/events/qdisc.h | 20 ++-- kernel/bpf/cpumap.c | 2 +- kernel/bpf/verifier.c | 3 + kernel/exit.c | 10 +- mm/readahead.c | 4 +- net/ipv6/route.c | 21 ++-- net/netfilter/nf_conntrack_h323_asn1.c | 4 + net/netfilter/nft_ct.c | 11 +- net/netrom/af_netrom.c | 14 +-- net/netrom/nr_dev.c | 2 +- net/netrom/nr_in.c | 6 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_route.c | 8 +- net/netrom/nr_subr.c | 5 +- net/rds/rdma.c | 3 + net/rds/send.c | 6 +- net/xfrm/xfrm_device.c | 2 +- net/xfrm/xfrm_policy.c | 2 +- .../selftests/bpf/prog_tests/xdp_bonding.c | 4 +- .../selftests/net/mptcp/simult_flows.sh | 8 +- 68 files changed, 648 insertions(+), 251 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/reg-file-data-sampling.rst create mode 100644 include/dt-bindings/dma/fsl-edma.h -- 2.43.0

9 months, 4 weeks

7
68
0 0

[PATCH v4] usb: udc: remove warning when queue disabled ep

by yuan linyu

It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mass storage function try to queue request from main thread, but other thread may already disable ep when function disable. As there is no function failure in the driver, in order to avoid effort to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug(). Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Cc: <stable(a)vger.kernel.org> Signed-off-by: yuan linyu <yuanlinyu(a)hihonor.com> --- v4: add version info in subject v3: add more debug info, remove two line commit description https://lore.kernel.org/linux-usb/20240315015854.2715357-1-yuanlinyu@hihono… v2: change WARN_ON_ONCE() in usb_ep_queue() to pr_debug() https://lore.kernel.org/linux-usb/20240315013019.2711135-1-yuanlinyu@hihono… v1: https://lore.kernel.org/linux-usb/20240314065949.2627778-1-yuanlinyu@hihono… drivers/usb/gadget/udc/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 9d4150124fdb..b3a9d18a8dcd 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -292,7 +292,9 @@ int usb_ep_queue(struct usb_ep *ep, { int ret = 0; - if (WARN_ON_ONCE(!ep->enabled && ep->address)) { + if (!ep->enabled && ep->address) { + pr_debug("USB gadget: queue request to disabled ep 0x%x (%s)\n", + ep->address, ep->name); ret = -ESHUTDOWN; goto out; } -- 2.25.1

9 months, 4 weeks

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2024