April 2024 - Linux-stable-mirror

[PATCH 1/3] drm/xe/vm: prevent UAF with asid based lookup

by Matthew Auld

The asid is only erased from the xarray when the vm refcount reaches zero, however this leads to potential UAF since the xe_vm_get() only works on a vm with refcount != 0. Since the asid is allocated in the vm create ioctl, rather erase it when closing the vm, prior to dropping the potential last ref. This should also work when user closes driver fd without explicit vm destroy. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1594 Signed-off-by: Matthew Auld <matthew.auld(a)intel.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.8+ --- drivers/gpu/drm/xe/xe_vm.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c index a196dbe65252..c5c26b3d1b76 100644 --- a/drivers/gpu/drm/xe/xe_vm.c +++ b/drivers/gpu/drm/xe/xe_vm.c @@ -1581,6 +1581,16 @@ void xe_vm_close_and_put(struct xe_vm *vm) xe->usm.num_vm_in_fault_mode--; else if (!(vm->flags & XE_VM_FLAG_MIGRATION)) xe->usm.num_vm_in_non_fault_mode--; + + if (vm->usm.asid) { + void *lookup; + + xe_assert(xe, xe->info.has_asid); + xe_assert(xe, !(vm->flags & XE_VM_FLAG_MIGRATION)); + + lookup = xa_erase(&xe->usm.asid_to_vm, vm->usm.asid); + xe_assert(xe, lookup == vm); + } mutex_unlock(&xe->usm.lock); for_each_tile(tile, xe, id) @@ -1596,24 +1606,15 @@ static void vm_destroy_work_func(struct work_struct *w) struct xe_device *xe = vm->xe; struct xe_tile *tile; u8 id; - void *lookup; /* xe_vm_close_and_put was not called? */ xe_assert(xe, !vm->size); mutex_destroy(&vm->snap_mutex); - if (!(vm->flags & XE_VM_FLAG_MIGRATION)) { + if (!(vm->flags & XE_VM_FLAG_MIGRATION)) xe_device_mem_access_put(xe); - if (xe->info.has_asid && vm->usm.asid) { - mutex_lock(&xe->usm.lock); - lookup = xa_erase(&xe->usm.asid_to_vm, vm->usm.asid); - xe_assert(xe, lookup == vm); - mutex_unlock(&xe->usm.lock); - } - } - for_each_tile(tile, xe, id) XE_WARN_ON(vm->pt_root[id]); -- 2.44.0

1 year, 2 months

3
3
0 0

[PATCH 6.6 000/114] 6.6.27-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.27 release. There are 114 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.27-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.27-rc1 Ma Jun <Jun.Ma2(a)amd.com> Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()" Vasiliy Kovalev <kovalev(a)altlinux.org> VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() Florian Westphal <fw(a)strlen.de> net: mpls: error out if inner headers are not set Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: btintel: Fixe build regression Gwendal Grignou <gwendal(a)chromium.org> platform/x86: intel-vbtn: Update tablet mode switch at end of probe Kees Cook <keescook(a)chromium.org> randomize_kstack: Improve entropy diffusion Yunfei Dong <yunfei.dong(a)mediatek.com> media: mediatek: vcodec: adding lock to protect encoder context list Yunfei Dong <yunfei.dong(a)mediatek.com> media: mediatek: vcodec: adding lock to protect decoder context list Nicolas Dufresne <nicolas.dufresne(a)collabora.com> media: mediatek: vcodec: Fix oops when HEVC init fails Geliang Tang <geliang.tang(a)suse.com> selftests: mptcp: display simult in extra_msg Ard Biesheuvel <ardb(a)kernel.org> gcc-plugins/stackleak: Avoid .head.text section Tim Crawford <tcrawford(a)system76.com> ALSA: hda/realtek: Add quirks for some Clevo laptops Roman Smirnov <r.smirnov(a)omp.ru> fbmon: prevent division by zero in fb_videomode_from_videomode() Jiawei Fu (iBug) <i(a)ibugone.com> drivers/nvme: Add quirks for device 126f:2262 Max Kellermann <max.kellermann(a)ionos.com> modpost: fix null pointer dereference Jens Axboe <axboe(a)kernel.dk> io_uring: clear opcode specific data for an early failure Aleksandr Burakov <a.burakov(a)rosalinux.ru> fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 Roger Pau Monne <roger.pau(a)citrix.com> x86/xen: attempt to inflate the memory balloon on PVH Chancel Liu <chancel.liu(a)nxp.com> ASoC: soc-core.c: Skip dummy codec when adding platforms Konrad Dybcio <konrad.dybcio(a)linaro.org> thermal/of: Assume polling-delay(-passive) 0 when absent M Cooley <m.cooley.198(a)gmail.com> ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE Colin Ian King <colin.i.king(a)gmail.com> usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined Marco Felsch <m.felsch(a)pengutronix.de> usb: typec: tcpci: add generic tcpci fallback compatible Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep the domain powered when USB4 port is in redrive mode Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> usb: typec: ucsi: Limit read size on v1.2 Michael Grzeschik <m.grzeschik(a)pengutronix.de> usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR Tejun Heo <tj(a)kernel.org> kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id() Jeffrey Hugo <quic_jhugo(a)quicinc.com> bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state Petre Rodan <petre.rodan(a)subdimension.ro> tools: iio: replace seekdir() in iio_generic_buffer linke li <lilinke99(a)qq.com> ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment Matt Scialabba <matt.git(a)fastmail.fm> Input: xpad - add support for Snakebyte GAMEPADs Ricardo B. Marliere <ricardo(a)marliere.net> ktest: force $buildonly = 1 for 'make_warnings_file' test type Jichi Zhang <i(a)jichi.ca> ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9 Sandipan Das <sandipan.das(a)amd.com> perf/x86/amd/lbr: Discard erroneous branch entries Alban Boyé <alban.boye(a)protonmail.com> platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet Gergo Koteles <soyer(a)irl.hu> Input: allocate keycode for Display refresh rate toggle Duje Mihanović <duje.mihanovic(a)skole.hr> Input: imagis - use FIELD_GET where applicable Manjunath Patil <manjunath.b.patil(a)oracle.com> RDMA/cm: add timeout to cm_destroy_id wait Roman Smirnov <r.smirnov(a)omp.ru> block: prevent division by zero in blk_rq_stat_sum() Junhao He <hejunhao3(a)huawei.com> drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09 Markuss Broks <markuss.broks(a)gmail.com> input/touchscreen: imagis: Correct the maximum touch area value Ian Rogers <irogers(a)google.com> libperf evlist: Avoid out-of-bounds access Daniel Drake <drake(a)endlessos.org> Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" Daniel Drake <drake(a)endlessos.org> PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge Dai Ngo <dai.ngo(a)oracle.com> SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int Shradha Gupta <shradhagupta(a)linux.microsoft.com> drm: Check output polling initialized before disabling Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> HID: input: avoid polling stylus battery on Chromebook Pompom Jarkko Nikula <jarkko.nikula(a)linux.intel.com> i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC Koby Elbaz <kelbaz(a)habana.ai> accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings Aric Cyr <aric.cyr(a)amd.com> drm/amd/display: Fix nanosec stat overflow Ye Bin <yebin10(a)huawei.com> ext4: forbid commit inconsistent quota data when errors=remount-ro Zhang Yi <yi.zhang(a)huawei.com> ext4: add a hint for block bitmap corrupt state in mb_groups Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: avs: Populate board selection with new I2S entries Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter Arnd Bergmann <arnd(a)arndb.de> media: sta2x11: fix irq handler cast Mike Marshall <hubcap(a)omnibond.com> Julia Lawall reported this null pointer dereference, this should fix it. Paul E. McKenney <paulmck(a)kernel.org> rcu-tasks: Repair RCU Tasks Trace quiescence check Zqiang <qiang.zhang1211(a)gmail.com> rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock() mosomate <mosomate(a)gmail.com> ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops Alex Henrie <alexhenrie24(a)gmail.com> isofs: handle CDs with bad root inode but good Joliet root directory Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> sysv: don't call sb_bread() with pointers_lock held Geert Uytterhoeven <geert+renesas(a)glider.be> pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs Christian König <christian.koenig(a)amd.com> drm/ttm: return ENOSPC from ttm_bo_mem_space v3 Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: SOF: amd: Optimize quirk for Valve Galileo Samuel Dionne-Riel <samuel(a)dionne-riel.com> drm: panel-orientation-quirks: Add quirk for GPD Win Mini Kunwu Chan <chentao(a)kylinos.cn> Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails Maíra Canal <mcanal(a)igalia.com> drm/vc4: don't check if plane->state->fb == state->fb Vinicius Peixoto <nukelet64(a)gmail.com> Bluetooth: Add new quirk for broken read key length on ATS2851 Takashi Iwai <tiwai(a)suse.de> Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922 Edward Adam Davis <eadavis(a)qq.com> Bluetooth: btintel: Fix null ptr deref in btintel_read_version Eric Dumazet <edumazet(a)google.com> net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() Jacob Keller <jacob.e.keller(a)intel.com> ice: use relative VSI index for VFs instead of PF VSI number David Sterba <dsterba(a)suse.com> btrfs: send: handle path ref underflow in header iterate_inode_ref() David Sterba <dsterba(a)suse.com> btrfs: export: handle invalid inode or root reference in btrfs_get_parent() David Sterba <dsterba(a)suse.com> btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: check A-MSDU format more carefully Takashi Iwai <tiwai(a)suse.de> wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm Kees Cook <keescook(a)chromium.org> overflow: Allow non-type arg to type_max() and type_min() Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: Don't unregister cpufreq cooling on CPU hotplug Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath11k: decrease MHI channel buffer length to 8KB Rick Edgecombe <rick.p.edgecombe(a)intel.com> dma-direct: Leak pages on dma_set_decrypted() failure Serge Semin <fancer.lancer(a)gmail.com> net: pcs: xpcs: Return EINVAL in the internal methods Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() Kunwu Chan <chentao(a)kylinos.cn> pstore/zone: Add a null pointer check to the psz_kmsg_read Hans de Goede <hdegoede(a)redhat.com> ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: add locking for accessing mapped registers Peter Chiu <chui-hao.chiu(a)mediatek.com> wifi: mt76: mt7996: disable AMSDU for non-data frames Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7915: add locking for accessing mapped registers Hans de Goede <hdegoede(a)redhat.com> wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro Markus Elfring <elfring(a)users.sourceforge.net> firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() Florian Westphal <fw(a)strlen.de> net: skbuff: add overflow debug check to pull/push helpers Shannon Nelson <shannon.nelson(a)amd.com> ionic: set adminq irq affinity Adam Ford <aford173(a)gmail.com> pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain Kunwu Chan <chentao(a)kylinos.cn> pmdomain: ti: Add a null pointer check to the omap_prm_domain_init Eric Dumazet <edumazet(a)google.com> net: add netdev_lockdep_set_classes() to virtual drivers Johan Jonker <jbx6244(a)gmail.com> arm64: dts: rockchip: fix rk3399 hdmi ports node Johan Jonker <jbx6244(a)gmail.com> arm64: dts: rockchip: fix rk3328 hdmi ports node Johan Jonker <jbx6244(a)gmail.com> ARM: dts: rockchip: fix rk322x hdmi ports node Johan Jonker <jbx6244(a)gmail.com> ARM: dts: rockchip: fix rk3288 hdmi ports node C Cheng <C.Cheng(a)mediatek.com> cpuidle: Avoid potential overflow in integer multiplication John Ogness <john.ogness(a)linutronix.de> panic: Flush kernel log buffer at the end John Ogness <john.ogness(a)linutronix.de> printk: For @suppress_panic_printk check for other CPU in panic Mukesh Sisodiya <mukesh.sisodiya(a)intel.com> wifi: iwlwifi: pcie: Add the PCI device id for new hardware Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Ping-Ke Shih <pkshih(a)realtek.com> wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor Andre Werner <andre.werner(a)systec-electronic.com> net: phy: phy_device: Prevent nullptr exceptions on ISR Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> net: stmmac: dwmac-starfive: Add support for JH7100 SoC Markus Elfring <elfring(a)users.sourceforge.net> batman-adv: Improve exception handling in batadv_throw_uevent() Markus Elfring <elfring(a)users.sourceforge.net> batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data() Kees Cook <keescook(a)chromium.org> bnx2x: Fix firmware version string character counts Po-Hao Huang <phhuang(a)realtek.com> wifi: rtw89: fix null pointer access when abort scan Dmitry Antipov <dmantipov(a)yandex.ru> wifi: ath9k: fix LNA selection in ath_ant_try_scan() ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/rockchip/rk322x.dtsi | 16 ++-- arch/arm/boot/dts/rockchip/rk3288.dtsi | 16 +++- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 11 ++- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 12 ++- arch/x86/events/amd/lbr.c | 6 +- arch/x86/include/asm/xen/hypervisor.h | 5 ++ arch/x86/pci/fixup.c | 48 ++++++++++++ arch/x86/platform/pvh/enlighten.c | 3 + arch/x86/xen/enlighten.c | 32 ++++++++ arch/x86/xen/enlighten_pvh.c | 68 +++++++++++++++++ arch/x86/xen/setup.c | 44 ----------- arch/x86/xen/xen-ops.h | 14 ++++ block/blk-stat.c | 2 +- drivers/accel/habanalabs/common/habanalabs.h | 2 +- drivers/acpi/sleep.c | 12 --- drivers/acpi/x86/utils.c | 18 ++++- drivers/bluetooth/btintel.c | 2 +- drivers/bluetooth/btmtk.c | 1 + drivers/bluetooth/btmtk.h | 1 + drivers/bluetooth/btusb.c | 1 + drivers/bus/mhi/host/init.c | 1 + drivers/bus/mhi/host/internal.h | 9 ++- drivers/bus/mhi/host/pm.c | 20 ++++- drivers/cpufreq/cpufreq.c | 17 +++-- drivers/cpuidle/driver.c | 3 +- drivers/firmware/tegra/bpmp-debugfs.c | 2 +- .../gpu/drm/amd/display/modules/inc/mod_stats.h | 4 +- drivers/gpu/drm/drm_modeset_helper.c | 19 ++++- drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 +++ drivers/gpu/drm/drm_probe_helper.c | 13 +++- drivers/gpu/drm/ttm/ttm_bo.c | 7 +- drivers/gpu/drm/vc4/vc4_plane.c | 5 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 + drivers/i2c/busses/i2c-designware-core.h | 2 +- drivers/infiniband/core/cm.c | 20 ++++- drivers/input/joystick/xpad.c | 3 + drivers/input/rmi4/rmi_driver.c | 6 +- drivers/input/touchscreen/imagis.c | 20 ++--- drivers/media/pci/sta2x11/sta2x11_vip.c | 9 +-- .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 8 +- .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 5 ++ .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 + .../vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- .../platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 5 ++ .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 + .../platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 + drivers/misc/vmw_vmci/vmci_datagram.c | 6 +- drivers/net/dummy.c | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 9 ++- .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 14 ++-- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 +-- drivers/net/ethernet/intel/ice/ice_virtchnl.h | 9 +++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 +- drivers/net/ethernet/stmicro/stmmac/Kconfig | 6 +- .../net/ethernet/stmicro/stmmac/dwmac-starfive.c | 32 +++++++- drivers/net/geneve.c | 1 + drivers/net/loopback.c | 1 + drivers/net/pcs/pcs-xpcs.c | 4 +- drivers/net/phy/phy_device.c | 13 ++-- drivers/net/veth.c | 1 + drivers/net/vxlan/vxlan_core.c | 1 + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- drivers/net/wireless/ath/ath9k/antenna.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 9 +++ drivers/net/wireless/intel/iwlwifi/cfg/ax210.c | 6 ++ drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 2 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 45 ++++++++++-- drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 1 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 64 ++++++++++------ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 +- drivers/net/wireless/realtek/rtw89/pci.h | 2 +- drivers/nvme/host/pci.c | 3 + drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 42 ++++++++++- drivers/pinctrl/renesas/core.c | 4 +- drivers/platform/x86/intel/vbtn.c | 5 +- drivers/platform/x86/touchscreen_dmi.c | 9 +++ drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 10 +-- drivers/pmdomain/ti/omap_prm.c | 2 + drivers/scsi/lpfc/lpfc_nportdisc.c | 6 +- drivers/soundwire/dmi-quirks.c | 8 ++ drivers/thermal/thermal_of.c | 12 ++- drivers/thunderbolt/quirks.c | 14 ++++ drivers/thunderbolt/tb.c | 49 ++++++++++++- drivers/thunderbolt/tb.h | 4 + drivers/usb/gadget/function/uvc_video.c | 3 + drivers/usb/host/sl811-hcd.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 1 + drivers/usb/typec/ucsi/ucsi.c | 26 ++++++- drivers/usb/typec/ucsi/ucsi.h | 11 +++ drivers/video/fbdev/core/fbmon.c | 7 +- drivers/video/fbdev/via/accel.c | 4 +- drivers/xen/balloon.c | 2 - fs/btrfs/export.c | 9 ++- fs/btrfs/send.c | 10 ++- fs/btrfs/volumes.c | 12 ++- fs/ext4/mballoc.c | 5 +- fs/ext4/super.c | 12 +++ fs/isofs/inode.c | 18 ++++- fs/kernfs/dir.c | 31 +++++--- fs/kernfs/kernfs-internal.h | 2 + fs/orangefs/super.c | 2 +- fs/pstore/zone.c | 2 + fs/sysv/itree.c | 10 +-- include/acpi/acpi_bus.h | 22 +++--- include/linux/kernfs.h | 2 + include/linux/overflow.h | 12 +-- include/linux/randomize_kstack.h | 2 +- include/linux/rcupdate.h | 4 +- include/linux/skbuff.h | 11 +++ include/linux/sunrpc/sched.h | 2 +- include/net/bluetooth/hci.h | 8 ++ include/uapi/linux/input-event-codes.h | 1 + io_uring/io_uring.c | 25 ++++--- kernel/dma/direct.c | 9 ++- kernel/panic.c | 8 ++ kernel/printk/printk.c | 3 +- kernel/rcu/tree_nocb.h | 2 +- kernel/trace/ring_buffer.c | 2 +- net/batman-adv/distributed-arp-table.c | 3 +- net/batman-adv/main.c | 14 ++-- net/bluetooth/hci_event.c | 3 +- net/ipv4/ip_tunnel.c | 1 + net/ipv6/ip6_gre.c | 2 + net/ipv6/ip6_tunnel.c | 1 + net/ipv6/ip6_vti.c | 1 + net/ipv6/sit.c | 1 + net/mpls/mpls_gso.c | 3 + net/smc/smc_pnet.c | 10 +++ net/wireless/util.c | 14 +++- scripts/gcc-plugins/stackleak_plugin.c | 2 + scripts/mod/modpost.c | 4 +- sound/firewire/amdtp-stream.c | 12 ++- sound/firewire/amdtp-stream.h | 4 + sound/pci/hda/patch_realtek.c | 12 +++ sound/soc/amd/yc/acp6x-mach.c | 7 ++ sound/soc/intel/avs/board_selection.c | 85 ++++++++++++++++++++++ sound/soc/intel/boards/sof_sdw.c | 11 +++ sound/soc/soc-core.c | 3 + sound/soc/sof/amd/acp.c | 3 +- tools/iio/iio_utils.c | 2 +- tools/lib/perf/evlist.c | 18 +++-- tools/lib/perf/include/internal/evlist.h | 4 +- .../x86_energy_perf_policy.c | 1 + tools/testing/ktest/ktest.pl | 1 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 +- 152 files changed, 1140 insertions(+), 318 deletions(-)

1 year, 2 months

11
125
0 0

[PATCH 6.1 00/83] 6.1.86-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.86 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.86-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.86-rc1 Ma Jun <Jun.Ma2(a)amd.com> Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()" Vasiliy Kovalev <kovalev(a)altlinux.org> VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() Florian Westphal <fw(a)strlen.de> net: mpls: error out if inner headers are not set Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: btintel: Fixe build regression Gwendal Grignou <gwendal(a)chromium.org> platform/x86: intel-vbtn: Update tablet mode switch at end of probe Kees Cook <keescook(a)chromium.org> randomize_kstack: Improve entropy diffusion David Hildenbrand <david(a)redhat.com> virtio: reenable config if freezing device failed Martin K. Petersen <martin.petersen(a)oracle.com> scsi: sd: usb_storage: uas: Access media prior to querying device properties Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "scsi: core: Add struct for args to execution functions" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "scsi: sd: usb_storage: uas: Access media prior to querying device properties" Ard Biesheuvel <ardb(a)kernel.org> gcc-plugins/stackleak: Avoid .head.text section Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: discard table flag update with pending basechain deletion Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: release batch on table validation from abort path Roman Smirnov <r.smirnov(a)omp.ru> fbmon: prevent division by zero in fb_videomode_from_videomode() Jiawei Fu (iBug) <i(a)ibugone.com> drivers/nvme: Add quirks for device 126f:2262 Jens Axboe <axboe(a)kernel.dk> io_uring: clear opcode specific data for an early failure Aleksandr Burakov <a.burakov(a)rosalinux.ru> fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 Chancel Liu <chancel.liu(a)nxp.com> ASoC: soc-core.c: Skip dummy codec when adding platforms Konrad Dybcio <konrad.dybcio(a)linaro.org> thermal/of: Assume polling-delay(-passive) 0 when absent Colin Ian King <colin.i.king(a)gmail.com> usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined Marco Felsch <m.felsch(a)pengutronix.de> usb: typec: tcpci: add generic tcpci fallback compatible Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep the domain powered when USB4 port is in redrive mode Michael Grzeschik <m.grzeschik(a)pengutronix.de> usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR Jeffrey Hugo <quic_jhugo(a)quicinc.com> bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state Petre Rodan <petre.rodan(a)subdimension.ro> tools: iio: replace seekdir() in iio_generic_buffer linke li <lilinke99(a)qq.com> ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment Ricardo B. Marliere <ricardo(a)marliere.net> ktest: force $buildonly = 1 for 'make_warnings_file' test type Sandipan Das <sandipan.das(a)amd.com> perf/x86/amd/lbr: Discard erroneous branch entries Alban Boyé <alban.boye(a)protonmail.com> platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet Gergo Koteles <soyer(a)irl.hu> Input: allocate keycode for Display refresh rate toggle Duje Mihanović <duje.mihanovic(a)skole.hr> Input: imagis - use FIELD_GET where applicable Manjunath Patil <manjunath.b.patil(a)oracle.com> RDMA/cm: add timeout to cm_destroy_id wait Roman Smirnov <r.smirnov(a)omp.ru> block: prevent division by zero in blk_rq_stat_sum() Markuss Broks <markuss.broks(a)gmail.com> input/touchscreen: imagis: Correct the maximum touch area value Ian Rogers <irogers(a)google.com> libperf evlist: Avoid out-of-bounds access Daniel Drake <drake(a)endlessos.org> Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" Dai Ngo <dai.ngo(a)oracle.com> SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() Aric Cyr <aric.cyr(a)amd.com> drm/amd/display: Fix nanosec stat overflow Ye Bin <yebin10(a)huawei.com> ext4: forbid commit inconsistent quota data when errors=remount-ro Zhang Yi <yi.zhang(a)huawei.com> ext4: add a hint for block bitmap corrupt state in mb_groups Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter Arnd Bergmann <arnd(a)arndb.de> media: sta2x11: fix irq handler cast Mike Marshall <hubcap(a)omnibond.com> Julia Lawall reported this null pointer dereference, this should fix it. Paul E. McKenney <paulmck(a)kernel.org> rcu-tasks: Repair RCU Tasks Trace quiescence check mosomate <mosomate(a)gmail.com> ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops Alex Henrie <alexhenrie24(a)gmail.com> isofs: handle CDs with bad root inode but good Joliet root directory Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> sysv: don't call sb_bread() with pointers_lock held Geert Uytterhoeven <geert+renesas(a)glider.be> pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs Samuel Dionne-Riel <samuel(a)dionne-riel.com> drm: panel-orientation-quirks: Add quirk for GPD Win Mini Kunwu Chan <chentao(a)kylinos.cn> Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails Maíra Canal <mcanal(a)igalia.com> drm/vc4: don't check if plane->state->fb == state->fb Takashi Iwai <tiwai(a)suse.de> Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922 Edward Adam Davis <eadavis(a)qq.com> Bluetooth: btintel: Fix null ptr deref in btintel_read_version Eric Dumazet <edumazet(a)google.com> net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() Jacob Keller <jacob.e.keller(a)intel.com> ice: use relative VSI index for VFs instead of PF VSI number David Sterba <dsterba(a)suse.com> btrfs: send: handle path ref underflow in header iterate_inode_ref() David Sterba <dsterba(a)suse.com> btrfs: export: handle invalid inode or root reference in btrfs_get_parent() David Sterba <dsterba(a)suse.com> btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: Don't unregister cpufreq cooling on CPU hotplug Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath11k: decrease MHI channel buffer length to 8KB Rick Edgecombe <rick.p.edgecombe(a)intel.com> dma-direct: Leak pages on dma_set_decrypted() failure Serge Semin <fancer.lancer(a)gmail.com> net: pcs: xpcs: Return EINVAL in the internal methods Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() Kunwu Chan <chentao(a)kylinos.cn> pstore/zone: Add a null pointer check to the psz_kmsg_read Hans de Goede <hdegoede(a)redhat.com> wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro Markus Elfring <elfring(a)users.sourceforge.net> firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() Florian Westphal <fw(a)strlen.de> net: skbuff: add overflow debug check to pull/push helpers Shannon Nelson <shannon.nelson(a)amd.com> ionic: set adminq irq affinity Johan Jonker <jbx6244(a)gmail.com> arm64: dts: rockchip: fix rk3399 hdmi ports node Johan Jonker <jbx6244(a)gmail.com> arm64: dts: rockchip: fix rk3328 hdmi ports node C Cheng <C.Cheng(a)mediatek.com> cpuidle: Avoid potential overflow in integer multiplication John Ogness <john.ogness(a)linutronix.de> panic: Flush kernel log buffer at the end Mukesh Sisodiya <mukesh.sisodiya(a)intel.com> wifi: iwlwifi: pcie: Add the PCI device id for new hardware Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Ping-Ke Shih <pkshih(a)realtek.com> wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor Markus Elfring <elfring(a)users.sourceforge.net> batman-adv: Improve exception handling in batadv_throw_uevent() Markus Elfring <elfring(a)users.sourceforge.net> batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data() Kees Cook <keescook(a)chromium.org> bnx2x: Fix firmware version string character counts Dmitry Antipov <dmantipov(a)yandex.ru> wifi: ath9k: fix LNA selection in ath_ant_try_scan() ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 11 ++++- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 12 ++++- arch/x86/events/amd/lbr.c | 6 ++- block/blk-stat.c | 2 +- drivers/acpi/sleep.c | 12 ----- drivers/bluetooth/btintel.c | 2 +- drivers/bluetooth/btmtk.c | 1 + drivers/bluetooth/btmtk.h | 1 + drivers/bus/mhi/host/init.c | 1 + drivers/bus/mhi/host/internal.h | 9 ++-- drivers/bus/mhi/host/pm.c | 20 +++++++-- drivers/cpufreq/cpufreq.c | 17 ++++--- drivers/cpuidle/driver.c | 3 +- drivers/firmware/tegra/bpmp-debugfs.c | 2 +- .../gpu/drm/amd/display/modules/inc/mod_stats.h | 4 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 +++++ drivers/gpu/drm/vc4/vc4_plane.c | 5 +-- drivers/infiniband/core/cm.c | 20 ++++++++- drivers/input/rmi4/rmi_driver.c | 6 ++- drivers/input/touchscreen/imagis.c | 20 ++++----- drivers/media/pci/sta2x11/sta2x11_vip.c | 9 ++-- drivers/misc/vmw_vmci/vmci_datagram.c | 6 ++- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 9 ++-- .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 14 +++--- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 +--- drivers/net/ethernet/intel/ice/ice_virtchnl.h | 9 ++++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 ++- drivers/net/pcs/pcs-xpcs.c | 4 +- drivers/net/wireless/ath/ath11k/mhi.c | 2 +- drivers/net/wireless/ath/ath9k/antenna.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 9 ++++ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + drivers/net/wireless/realtek/rtw89/pci.h | 2 +- drivers/nvme/host/pci.c | 3 ++ drivers/pinctrl/renesas/core.c | 4 +- drivers/platform/x86/intel/vbtn.c | 5 ++- drivers/platform/x86/touchscreen_dmi.c | 9 ++++ drivers/scsi/lpfc/lpfc_nportdisc.c | 6 ++- drivers/scsi/scsi_lib.c | 52 +++++++++++----------- drivers/scsi/sd.c | 4 +- drivers/soundwire/dmi-quirks.c | 8 ++++ drivers/thermal/thermal_of.c | 12 +++-- drivers/thunderbolt/quirks.c | 14 ++++++ drivers/thunderbolt/tb.c | 49 +++++++++++++++++++- drivers/thunderbolt/tb.h | 4 ++ drivers/tty/n_gsm.c | 3 ++ drivers/usb/gadget/function/uvc_video.c | 3 ++ drivers/usb/host/sl811-hcd.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 1 + drivers/video/fbdev/core/fbmon.c | 7 +-- drivers/video/fbdev/via/accel.c | 4 +- drivers/virtio/virtio.c | 10 ++++- fs/btrfs/export.c | 9 +++- fs/btrfs/send.c | 10 ++++- fs/btrfs/volumes.c | 12 ++++- fs/ext4/mballoc.c | 5 ++- fs/ext4/super.c | 12 +++++ fs/isofs/inode.c | 18 +++++++- fs/orangefs/super.c | 2 +- fs/pstore/zone.c | 2 + fs/sysv/itree.c | 10 ++--- include/linux/randomize_kstack.h | 2 +- include/linux/rcupdate.h | 4 +- include/linux/skbuff.h | 11 +++++ include/linux/sunrpc/sched.h | 2 +- include/scsi/scsi_device.h | 51 ++++++--------------- include/uapi/linux/input-event-codes.h | 1 + io_uring/io_uring.c | 25 +++++++---- kernel/dma/direct.c | 9 ++-- kernel/panic.c | 8 ++++ kernel/trace/ring_buffer.c | 2 +- net/batman-adv/distributed-arp-table.c | 3 +- net/batman-adv/main.c | 14 +++--- net/mpls/mpls_gso.c | 3 ++ net/netfilter/nf_tables_api.c | 47 ++++++++++++++----- net/smc/smc_pnet.c | 10 +++++ scripts/gcc-plugins/stackleak_plugin.c | 2 + sound/firewire/amdtp-stream.c | 12 +++-- sound/firewire/amdtp-stream.h | 4 ++ sound/soc/intel/boards/sof_sdw.c | 11 +++++ sound/soc/soc-core.c | 3 ++ tools/iio/iio_utils.c | 2 +- tools/lib/perf/evlist.c | 18 +++++--- tools/lib/perf/include/internal/evlist.h | 4 +- .../x86_energy_perf_policy.c | 1 + tools/testing/ktest/ktest.pl | 1 + 88 files changed, 552 insertions(+), 231 deletions(-)

1 year, 2 months

12
97
0 0

[to-be-updated] bootconfig-use-memblock_free_late-to-free-xbc-memory-to-buddy.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: bootconfig: use memblock_free_late to free xbc memory to buddy has been removed from the -mm tree. Its filename was bootconfig-use-memblock_free_late-to-free-xbc-memory-to-buddy.patch This patch was dropped because an updated version will be merged ------------------------------------------------------ From: Qiang Zhang <qiang4.zhang(a)intel.com> Subject: bootconfig: use memblock_free_late to free xbc memory to buddy Date: Fri, 12 Apr 2024 10:41:04 +0800 At the time to free xbc memory, memblock has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86. Following KASAN logs shows this case. [ 9.410890] ================================================================== [ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260 [ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1 [ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023 [ 9.460789] Call Trace: [ 9.463518] <TASK> [ 9.465859] dump_stack_lvl+0x53/0x70 [ 9.469949] print_report+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [ 9.478619] ? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [ 9.493125] memblock_isolate_range+0x12d/0x260 [ 9.498187] memblock_phys_free+0xb4/0x160 [ 9.502762] ? __pfx_memblock_phys_free+0x10/0x10 [ 9.508021] ? mutex_unlock+0x7e/0xd0 [ 9.512111] ? __pfx_mutex_unlock+0x10/0x10 [ 9.516786] ? kernel_init_freeable+0x2d4/0x430 [ 9.521850] ? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [ 9.538601] ret_from_fork+0x2c/0x50 [ 9.542596] ? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552] </TASK> [ 9.555649] The buggy address belongs to the physical page: [ 9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30 [ 9.570821] flags: 0x200000000000000(node=0|zone=2) [ 9.576271] page_type: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000 [ 9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 9.597476] page dumped because: kasan: bad access detected [ 9.605362] Memory state around the buggy address: [ 9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ================================================================== Link: https://lkml.kernel.org/r/20240412024103.3078378-1-qiang4.zhang@linux.intel… Signed-off-by: Qiang Zhang <qiang4.zhang(a)intel.com> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/bootconfig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/lib/bootconfig.c~bootconfig-use-memblock_free_late-to-free-xbc-memory-to-buddy +++ a/lib/bootconfig.c @@ -63,7 +63,7 @@ static inline void * __init xbc_alloc_me static inline void __init xbc_free_mem(void *addr, size_t size) { - memblock_free(addr, size); + memblock_free_late(__pa(addr), size); } #else /* !__KERNEL__ */ _ Patches currently in -mm which might be from qiang4.zhang(a)intel.com are

1 year, 2 months

1
0
0 0

+ bootconfig-use-memblock_free_late-to-free-xbc-memory-to-buddy.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: bootconfig: use memblock_free_late to free xbc memory to buddy has been added to the -mm mm-hotfixes-unstable branch. Its filename is bootconfig-use-memblock_free_late-to-free-xbc-memory-to-buddy.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Qiang Zhang <qiang4.zhang(a)intel.com> Subject: bootconfig: use memblock_free_late to free xbc memory to buddy Date: Fri, 12 Apr 2024 10:41:04 +0800 At the time to free xbc memory, memblock has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86. Following KASAN logs shows this case. [ 9.410890] ================================================================== [ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260 [ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1 [ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023 [ 9.460789] Call Trace: [ 9.463518] <TASK> [ 9.465859] dump_stack_lvl+0x53/0x70 [ 9.469949] print_report+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [ 9.478619] ? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [ 9.493125] memblock_isolate_range+0x12d/0x260 [ 9.498187] memblock_phys_free+0xb4/0x160 [ 9.502762] ? __pfx_memblock_phys_free+0x10/0x10 [ 9.508021] ? mutex_unlock+0x7e/0xd0 [ 9.512111] ? __pfx_mutex_unlock+0x10/0x10 [ 9.516786] ? kernel_init_freeable+0x2d4/0x430 [ 9.521850] ? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [ 9.538601] ret_from_fork+0x2c/0x50 [ 9.542596] ? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552] </TASK> [ 9.555649] The buggy address belongs to the physical page: [ 9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30 [ 9.570821] flags: 0x200000000000000(node=0|zone=2) [ 9.576271] page_type: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000 [ 9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 9.597476] page dumped because: kasan: bad access detected [ 9.605362] Memory state around the buggy address: [ 9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ================================================================== Link: https://lkml.kernel.org/r/20240412024103.3078378-1-qiang4.zhang@linux.intel… Signed-off-by: Qiang Zhang <qiang4.zhang(a)intel.com> Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mike Rapoport <rppt(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/bootconfig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/lib/bootconfig.c~bootconfig-use-memblock_free_late-to-free-xbc-memory-to-buddy +++ a/lib/bootconfig.c @@ -63,7 +63,7 @@ static inline void * __init xbc_alloc_me static inline void __init xbc_free_mem(void *addr, size_t size) { - memblock_free(addr, size); + memblock_free_late(__pa(addr), size); } #else /* !__KERNEL__ */ _ Patches currently in -mm which might be from qiang4.zhang(a)intel.com are bootconfig-use-memblock_free_late-to-free-xbc-memory-to-buddy.patch

1 year, 2 months

1
0
0 0

[PATCH 6.8 000/143] 6.8.6-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.8.6 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.8.6-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.8.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.8.6-rc1 Ma Jun <Jun.Ma2(a)amd.com> Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()" Borislav Petkov (AMD) <bp(a)alien8.de> x86/vdso: Fix rethunk patching for vdso-image-x32.o too Vasiliy Kovalev <kovalev(a)altlinux.org> VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() Florian Westphal <fw(a)strlen.de> net: mpls: error out if inner headers are not set Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: btintel: Fixe build regression Dave Airlie <airlied(a)gmail.com> nouveau: fix devinit paths to only handle display on GSP. Gwendal Grignou <gwendal(a)chromium.org> platform/x86: intel-vbtn: Update tablet mode switch at end of probe David McFarland <corngood(a)gmail.com> platform/x86/intel/hid: Don't wake on 5-button releases Kees Cook <keescook(a)chromium.org> randomize_kstack: Improve entropy diffusion Yunfei Dong <yunfei.dong(a)mediatek.com> media: mediatek: vcodec: adding lock to protect encoder context list Yunfei Dong <yunfei.dong(a)mediatek.com> media: mediatek: vcodec: adding lock to protect decoder context list Nicolas Dufresne <nicolas.dufresne(a)collabora.com> media: mediatek: vcodec: Fix oops when HEVC init fails Ard Biesheuvel <ardb(a)kernel.org> gcc-plugins/stackleak: Avoid .head.text section Ahmad Rehman <Ahmad.Rehman(a)amd.com> drm/amdgpu: Init zone device and drm client after mode-1 reset on reload Tim Crawford <tcrawford(a)system76.com> ALSA: hda/realtek: Add quirks for some Clevo laptops Roman Smirnov <r.smirnov(a)omp.ru> fbmon: prevent division by zero in fb_videomode_from_videomode() Jiawei Fu (iBug) <i(a)ibugone.com> drivers/nvme: Add quirks for device 126f:2262 Max Kellermann <max.kellermann(a)ionos.com> modpost: fix null pointer dereference Jens Axboe <axboe(a)kernel.dk> io_uring: clear opcode specific data for an early failure Aleksandr Burakov <a.burakov(a)rosalinux.ru> fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 Roger Pau Monne <roger.pau(a)citrix.com> x86/xen: attempt to inflate the memory balloon on PVH Chancel Liu <chancel.liu(a)nxp.com> ASoC: soc-core.c: Skip dummy codec when adding platforms Konrad Dybcio <konrad.dybcio(a)linaro.org> thermal/of: Assume polling-delay(-passive) 0 when absent M Cooley <m.cooley.198(a)gmail.com> ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE Colin Ian King <colin.i.king(a)gmail.com> usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined Marco Felsch <m.felsch(a)pengutronix.de> usb: typec: tcpci: add generic tcpci fallback compatible Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep the domain powered when USB4 port is in redrive mode Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_of: Drop quirk fot NPCM from 8250_port Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> usb: typec: ucsi: Limit read size on v1.2 Michael Grzeschik <m.grzeschik(a)pengutronix.de> usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR Michael Grzeschik <m.grzeschik(a)pengutronix.de> usb: gadget: uvc: refactor the check for a valid buffer in the pump worker Gil Fine <gil.fine(a)linux.intel.com> thunderbolt: Calculate DisplayPort tunnel bandwidth after DPRX capabilities read Luca Weiss <luca.weiss(a)fairphone.com> usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk Tejun Heo <tj(a)kernel.org> kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id() Jeffrey Hugo <quic_jhugo(a)quicinc.com> bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state Petre Rodan <petre.rodan(a)subdimension.ro> tools: iio: replace seekdir() in iio_generic_buffer linke li <lilinke99(a)qq.com> ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment Matt Scialabba <matt.git(a)fastmail.fm> Input: xpad - add support for Snakebyte GAMEPADs Ricardo B. Marliere <ricardo(a)marliere.net> ktest: force $buildonly = 1 for 'make_warnings_file' test type Jichi Zhang <i(a)jichi.ca> ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9 Sandipan Das <sandipan.das(a)amd.com> perf/x86/amd/lbr: Discard erroneous branch entries Alban Boyé <alban.boye(a)protonmail.com> platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet SungHwan Jung <onenowy(a)gmail.com> platform/x86: acer-wmi: Add predator_v4 module parameter SungHwan Jung <onenowy(a)gmail.com> platform/x86: acer-wmi: Add support for Acer PH16-71 Gergo Koteles <soyer(a)irl.hu> Input: allocate keycode for Display refresh rate toggle Duje Mihanović <duje.mihanovic(a)skole.hr> Input: imagis - use FIELD_GET where applicable Manjunath Patil <manjunath.b.patil(a)oracle.com> RDMA/cm: add timeout to cm_destroy_id wait Roman Smirnov <r.smirnov(a)omp.ru> block: prevent division by zero in blk_rq_stat_sum() Junhao He <hejunhao3(a)huawei.com> drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09 Markuss Broks <markuss.broks(a)gmail.com> input/touchscreen: imagis: Correct the maximum touch area value Tom Zanussi <tom.zanussi(a)linux.intel.com> crypto: iaa - Fix async_disable descriptor leak Ian Rogers <irogers(a)google.com> libperf evlist: Avoid out-of-bounds access Daniel Drake <drake(a)endlessos.org> Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" Daniel Drake <drake(a)endlessos.org> PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge Dai Ngo <dai.ngo(a)oracle.com> SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int Shradha Gupta <shradhagupta(a)linux.microsoft.com> drm: Check output polling initialized before disabling Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> HID: input: avoid polling stylus battery on Chromebook Pompom Jarkko Nikula <jarkko.nikula(a)linux.intel.com> i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC Koby Elbaz <kelbaz(a)habana.ai> accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings Aric Cyr <aric.cyr(a)amd.com> drm/amd/display: Fix nanosec stat overflow Ye Bin <yebin10(a)huawei.com> ext4: forbid commit inconsistent quota data when errors=remount-ro Zhang Yi <yi.zhang(a)huawei.com> ext4: add a hint for block bitmap corrupt state in mb_groups Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: avs: Populate board selection with new I2S entries Josh Poimboeuf <jpoimboe(a)kernel.org> x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o Tony Lindgren <tony(a)atomide.com> drm/panel: simple: Add BOE BP082WX1-100 8.2" panel Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter Arnd Bergmann <arnd(a)arndb.de> media: sta2x11: fix irq handler cast Mike Marshall <hubcap(a)omnibond.com> Julia Lawall reported this null pointer dereference, this should fix it. Paul E. McKenney <paulmck(a)kernel.org> rcu-tasks: Repair RCU Tasks Trace quiescence check Zqiang <qiang.zhang1211(a)gmail.com> rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock() mosomate <mosomate(a)gmail.com> ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops Brent Lu <brent.lu(a)intel.com> ASoC: Intel: sof_rt5682: dmi quirk cleanup for mtl boards Alex Henrie <alexhenrie24(a)gmail.com> isofs: handle CDs with bad root inode but good Joliet root directory Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Disable idle reallow as part of command/gpint execution Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> sysv: don't call sb_bread() with pointers_lock held Geert Uytterhoeven <geert+renesas(a)glider.be> pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs Sohaib Nadeem <sohaib.nadeem(a)amd.com> drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz Eric Chanudet <echanude(a)redhat.com> scsi: ufs: qcom: Avoid re-init quirk when gears match Christian König <christian.koenig(a)amd.com> drm/ttm: return ENOSPC from ttm_bo_mem_space v3 Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: SOF: amd: Optimize quirk for Valve Galileo Samuel Dionne-Riel <samuel(a)dionne-riel.com> drm: panel-orientation-quirks: Add quirk for GPD Win Mini Kunwu Chan <chentao(a)kylinos.cn> Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails Stanley.Yang <Stanley.Yang(a)amd.com> drm/amdgpu: Skip do PCI error slot reset during RAS recovery Vignesh Raman <vignesh.raman(a)collabora.com> drm/ci: uprev mesa version: fix kdl commit fetch Maíra Canal <mcanal(a)igalia.com> drm/vc4: don't check if plane->state->fb == state->fb Vinicius Peixoto <nukelet64(a)gmail.com> Bluetooth: Add new quirk for broken read key length on ATS2851 Takashi Iwai <tiwai(a)suse.de> Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922 Edward Adam Davis <eadavis(a)qq.com> Bluetooth: btintel: Fix null ptr deref in btintel_read_version Jakub Kicinski <kuba(a)kernel.org> netdev: let netlink core handle -EMSGSIZE errors Eric Dumazet <edumazet(a)google.com> net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() Jacob Keller <jacob.e.keller(a)intel.com> ice: use relative VSI index for VFs instead of PF VSI number David Sterba <dsterba(a)suse.com> btrfs: send: handle path ref underflow in header iterate_inode_ref() David Sterba <dsterba(a)suse.com> btrfs: export: handle invalid inode or root reference in btrfs_get_parent() David Sterba <dsterba(a)suse.com> btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: check A-MSDU format more carefully Takashi Iwai <tiwai(a)suse.de> wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm Kees Cook <keescook(a)chromium.org> overflow: Allow non-type arg to type_max() and type_min() Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: Don't unregister cpufreq cooling on CPU hotplug Jason Gunthorpe <jgg(a)ziepe.ca> iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath11k: decrease MHI channel buffer length to 8KB Rick Edgecombe <rick.p.edgecombe(a)intel.com> dma-direct: Leak pages on dma_set_decrypted() failure Serge Semin <fancer.lancer(a)gmail.com> net: pcs: xpcs: Return EINVAL in the internal methods Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() Kunwu Chan <chentao(a)kylinos.cn> pstore/zone: Add a null pointer check to the psz_kmsg_read Hans de Goede <hdegoede(a)redhat.com> ACPI: x86: Add DELL0501 handling to acpi_quirk_skip_serdev_enumeration() Hans de Goede <hdegoede(a)redhat.com> ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7996: add locking for accessing mapped registers Peter Chiu <chui-hao.chiu(a)mediatek.com> wifi: mt76: mt7996: disable AMSDU for non-data frames Shayne Chen <shayne.chen(a)mediatek.com> wifi: mt76: mt7915: add locking for accessing mapped registers Hans de Goede <hdegoede(a)redhat.com> wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro Markus Elfring <elfring(a)users.sourceforge.net> firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() Florian Westphal <fw(a)strlen.de> net: skbuff: add overflow debug check to pull/push helpers Shannon Nelson <shannon.nelson(a)amd.com> ionic: set adminq irq affinity Sviatoslav Harasymchuk <sviatoslav.harasymchuk(a)gmail.com> ACPI: resource: Add IRQ override quirk for ASUS ExpertBook B2502FBA Adam Ford <aford173(a)gmail.com> pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain Kunwu Chan <chentao(a)kylinos.cn> pmdomain: ti: Add a null pointer check to the omap_prm_domain_init Bjorn Andersson <quic_bjorande(a)quicinc.com> arm64: dts: qcom: qcs6490-rb3gen2: Declare GCC clocks protected Eric Dumazet <edumazet(a)google.com> net: add netdev_lockdep_set_classes() to virtual drivers Johan Jonker <jbx6244(a)gmail.com> arm64: dts: rockchip: fix rk3399 hdmi ports node Johan Jonker <jbx6244(a)gmail.com> arm64: dts: rockchip: fix rk3328 hdmi ports node Johan Jonker <jbx6244(a)gmail.com> ARM: dts: rockchip: fix rk322x hdmi ports node Johan Jonker <jbx6244(a)gmail.com> ARM: dts: rockchip: fix rk3288 hdmi ports node C Cheng <C.Cheng(a)mediatek.com> cpuidle: Avoid potential overflow in integer multiplication Mukesh Sisodiya <mukesh.sisodiya(a)intel.com> wifi: iwlwifi: pcie: Add new PCI device id and CNVI John Ogness <john.ogness(a)linutronix.de> dump_stack: Do not get cpu_sync for panic CPU John Ogness <john.ogness(a)linutronix.de> panic: Flush kernel log buffer at the end John Ogness <john.ogness(a)linutronix.de> printk: For @suppress_panic_printk check for other CPU in panic Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: qrb2210-rb1: disable cluster power domains Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: qca8k: put MDIO controller OF node if unavailable Hui Liu <quic_huliu(a)quicinc.com> arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs Mukesh Sisodiya <mukesh.sisodiya(a)intel.com> wifi: iwlwifi: pcie: Add the PCI device id for new hardware Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Ping-Ke Shih <pkshih(a)realtek.com> wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor Ping-Ke Shih <pkshih(a)realtek.com> wifi: rtw89: pci: validate RX tag for RXQ and RPQ Andre Werner <andre.werner(a)systec-electronic.com> net: phy: phy_device: Prevent nullptr exceptions on ISR Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> net: stmmac: dwmac-starfive: Add support for JH7100 SoC Markus Elfring <elfring(a)users.sourceforge.net> batman-adv: Improve exception handling in batadv_throw_uevent() Markus Elfring <elfring(a)users.sourceforge.net> batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data() Kees Cook <keescook(a)chromium.org> bnx2x: Fix firmware version string character counts Po-Hao Huang <phhuang(a)realtek.com> wifi: rtw89: fix null pointer access when abort scan Dmitry Antipov <dmantipov(a)yandex.ru> wifi: ath9k: fix LNA selection in ath_ant_try_scan() ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/rockchip/rk322x.dtsi | 16 ++-- arch/arm/boot/dts/rockchip/rk3288.dtsi | 16 +++- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 28 +++++++ arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 17 +++++ arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 18 +++++ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 11 ++- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 12 ++- arch/x86/entry/vdso/Makefile | 10 ++- arch/x86/events/amd/lbr.c | 6 +- arch/x86/include/asm/xen/hypervisor.h | 5 ++ arch/x86/pci/fixup.c | 48 ++++++++++++ arch/x86/platform/pvh/enlighten.c | 3 + arch/x86/xen/enlighten.c | 32 ++++++++ arch/x86/xen/enlighten_pvh.c | 68 +++++++++++++++++ arch/x86/xen/setup.c | 44 ----------- arch/x86/xen/xen-ops.h | 14 ++++ block/blk-stat.c | 2 +- drivers/accel/habanalabs/common/habanalabs.h | 2 +- drivers/acpi/resource.c | 7 ++ drivers/acpi/sleep.c | 12 --- drivers/acpi/x86/utils.c | 38 +++++++++- drivers/bluetooth/btintel.c | 2 +- drivers/bluetooth/btmtk.c | 1 + drivers/bluetooth/btmtk.h | 1 + drivers/bluetooth/btusb.c | 1 + drivers/bus/mhi/host/init.c | 1 + drivers/bus/mhi/host/internal.h | 9 ++- drivers/bus/mhi/host/pm.c | 20 ++++- drivers/cpufreq/cpufreq.c | 17 +++-- drivers/cpuidle/driver.c | 3 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 +- drivers/firmware/tegra/bpmp-debugfs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +- drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 4 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- .../amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + .../gpu/drm/amd/display/modules/inc/mod_stats.h | 4 +- drivers/gpu/drm/ci/gitlab-ci.yml | 14 +++- drivers/gpu/drm/ci/test.yml | 1 + drivers/gpu/drm/drm_modeset_helper.c | 19 ++++- drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 +++ drivers/gpu/drm/drm_probe_helper.c | 13 +++- .../gpu/drm/nouveau/nvkm/subdev/devinit/gm107.c | 12 ++- drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c | 1 + drivers/gpu/drm/panel/panel-simple.c | 20 +++++ drivers/gpu/drm/ttm/ttm_bo.c | 7 +- drivers/gpu/drm/vc4/vc4_plane.c | 5 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 + drivers/i2c/busses/i2c-designware-core.h | 2 +- drivers/infiniband/core/cm.c | 20 ++++- drivers/input/joystick/xpad.c | 3 + drivers/input/rmi4/rmi_driver.c | 6 +- drivers/input/touchscreen/imagis.c | 20 ++--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 22 +++--- drivers/media/pci/sta2x11/sta2x11_vip.c | 9 +-- .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 8 +- .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 5 ++ .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 + .../vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- .../platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 5 ++ .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 + .../platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 + drivers/misc/vmw_vmci/vmci_datagram.c | 6 +- drivers/net/dsa/qca/qca8k-8xxx.c | 3 +- drivers/net/dummy.c | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 9 ++- .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 14 ++-- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 +-- drivers/net/ethernet/intel/ice/ice_virtchnl.h | 9 +++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 +- drivers/net/ethernet/stmicro/stmmac/Kconfig | 6 +- .../net/ethernet/stmicro/stmmac/dwmac-starfive.c | 32 +++++++- drivers/net/geneve.c | 1 + drivers/net/loopback.c | 1 + drivers/net/pcs/pcs-xpcs.c | 4 +- drivers/net/phy/phy_device.c | 13 ++-- drivers/net/veth.c | 1 + drivers/net/vxlan/vxlan_core.c | 1 + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- drivers/net/wireless/ath/ath9k/antenna.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 9 +++ drivers/net/wireless/intel/iwlwifi/cfg/ax210.c | 6 ++ drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 2 + drivers/net/wireless/intel/iwlwifi/cfg/sc.c | 38 +++++++++- drivers/net/wireless/intel/iwlwifi/iwl-config.h | 8 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 16 +++- drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 45 ++++++++++-- drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 1 + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 64 ++++++++++------ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 +- drivers/net/wireless/realtek/rtw89/pci.c | 60 +++++++++++++-- drivers/net/wireless/realtek/rtw89/pci.h | 6 +- drivers/net/wireless/realtek/rtw89/rtw8851be.c | 2 + drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 + drivers/nvme/host/pci.c | 3 + drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 42 ++++++++++- drivers/pinctrl/renesas/core.c | 4 +- drivers/platform/x86/acer-wmi.c | 17 ++++- drivers/platform/x86/intel/hid.c | 7 +- drivers/platform/x86/intel/vbtn.c | 5 +- drivers/platform/x86/touchscreen_dmi.c | 9 +++ drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 10 +-- drivers/pmdomain/ti/omap_prm.c | 2 + drivers/scsi/lpfc/lpfc_nportdisc.c | 6 +- drivers/soundwire/dmi-quirks.c | 8 ++ drivers/thermal/thermal_of.c | 12 ++- drivers/thunderbolt/quirks.c | 14 ++++ drivers/thunderbolt/tb.c | 49 ++++++++++++- drivers/thunderbolt/tb.h | 4 + drivers/thunderbolt/tunnel.c | 16 ++-- drivers/tty/serial/8250/8250_of.c | 44 ++++++++++- drivers/tty/serial/8250/8250_port.c | 24 ------ drivers/ufs/host/ufs-qcom.c | 13 +++- drivers/usb/gadget/function/uvc_video.c | 10 ++- drivers/usb/host/sl811-hcd.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 1 + drivers/usb/typec/ucsi/ucsi.c | 26 ++++++- drivers/usb/typec/ucsi/ucsi.h | 11 +++ drivers/usb/typec/ucsi/ucsi_glink.c | 1 + drivers/video/fbdev/core/fbmon.c | 7 +- drivers/video/fbdev/via/accel.c | 4 +- drivers/xen/balloon.c | 2 - fs/btrfs/export.c | 9 ++- fs/btrfs/send.c | 10 ++- fs/btrfs/volumes.c | 12 ++- fs/ext4/mballoc.c | 5 +- fs/ext4/super.c | 12 +++ fs/isofs/inode.c | 18 ++++- fs/kernfs/dir.c | 31 +++++--- fs/kernfs/kernfs-internal.h | 2 + fs/orangefs/super.c | 2 +- fs/pstore/zone.c | 2 + fs/sysv/itree.c | 10 +-- include/acpi/acpi_bus.h | 22 +++--- include/linux/kernfs.h | 2 + include/linux/overflow.h | 12 +-- include/linux/printk.h | 2 + include/linux/randomize_kstack.h | 2 +- include/linux/rcupdate.h | 4 +- include/linux/skbuff.h | 11 +++ include/linux/sunrpc/sched.h | 2 +- include/net/bluetooth/hci.h | 8 ++ include/uapi/linux/input-event-codes.h | 1 + io_uring/io_uring.c | 25 ++++--- kernel/dma/direct.c | 9 ++- kernel/panic.c | 8 ++ kernel/printk/internal.h | 1 - kernel/printk/printk.c | 3 +- kernel/rcu/tree_nocb.h | 2 +- kernel/trace/ring_buffer.c | 2 +- lib/dump_stack.c | 16 +++- net/batman-adv/distributed-arp-table.c | 3 +- net/batman-adv/main.c | 14 ++-- net/bluetooth/hci_event.c | 3 +- net/core/netdev-genl.c | 15 +--- net/core/page_pool_user.c | 2 - net/ipv4/ip_tunnel.c | 1 + net/ipv6/ip6_gre.c | 2 + net/ipv6/ip6_tunnel.c | 1 + net/ipv6/ip6_vti.c | 1 + net/ipv6/sit.c | 1 + net/mpls/mpls_gso.c | 3 + net/smc/smc_pnet.c | 10 +++ net/wireless/util.c | 14 +++- scripts/gcc-plugins/stackleak_plugin.c | 2 + scripts/mod/modpost.c | 4 +- sound/firewire/amdtp-stream.c | 12 ++- sound/firewire/amdtp-stream.h | 4 + sound/pci/hda/patch_realtek.c | 12 +++ sound/soc/amd/yc/acp6x-mach.c | 7 ++ sound/soc/intel/avs/board_selection.c | 85 ++++++++++++++++++++++ sound/soc/intel/boards/sof_rt5682.c | 40 ---------- sound/soc/intel/boards/sof_sdw.c | 11 +++ sound/soc/soc-core.c | 3 + sound/soc/sof/amd/acp.c | 3 +- tools/iio/iio_utils.c | 2 +- tools/lib/perf/evlist.c | 18 +++-- tools/lib/perf/include/internal/evlist.h | 4 +- .../x86_energy_perf_policy.c | 1 + tools/testing/ktest/ktest.pl | 1 + 192 files changed, 1536 insertions(+), 459 deletions(-)

1 year, 2 months

11
154
0 0

[PATCH v2] arm64: dts: qcom: sa8155p-adp: fix SDHC2 configuration

by Volodymyr Babchuk

There are multiple issues with SDHC2 configuration for SA8155P-ADP, which prevent use of SDHC2 and causes issues with ethernet: - Card Detect pin for SHDC2 on SA8155P-ADP is connected to gpio4 of PMM8155AU_1, not to SoC itself. SoC's gpio4 is used for DWMAC TX. If sdhc driver probes after dwmac driver, it reconfigures gpio4 and this breaks Ethernet MAC. - pinctrl configuration mentions gpio96 as CD pin. It seems it was copied from some SM8150 example, because as mentioned above, correct CD pin is gpio4 on PMM8155AU_1. - L13C voltage regulator limits minimal voltage to 2.504V, which prevents use 1.8V to power SD card, which in turns does not allow card to work in UHS mode. This patch fixes all the mentioned issues. Fixes: 0deb2624e2d0 ("arm64: dts: qcom: sa8155p-adp: Add support for uSD card") Cc: stable(a)vger.kernel.org Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk(a)epam.com> --- In v2: - Added "Fixes:" tag - CCed stable ML - Fixed pinctrl configuration - Extended voltage range for L13C voltage regulator --- arch/arm64/boot/dts/qcom/sa8155p-adp.dts | 32 +++++++++++------------- 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts index 5e4287f8c8cd1..b9d56bda96759 100644 --- a/arch/arm64/boot/dts/qcom/sa8155p-adp.dts +++ b/arch/arm64/boot/dts/qcom/sa8155p-adp.dts @@ -283,7 +283,7 @@ vreg_l12c_1p808: ldo12 { vreg_l13c_2p96: ldo13 { regulator-name = "vreg_l13c_2p96"; - regulator-min-microvolt = <2504000>; + regulator-min-microvolt = <1800000>; regulator-max-microvolt = <2960000>; regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>; }; @@ -384,10 +384,10 @@ &remoteproc_cdsp { &sdhc_2 { status = "okay"; - cd-gpios = <&tlmm 4 GPIO_ACTIVE_LOW>; + cd-gpios = <&pmm8155au_1_gpios 4 GPIO_ACTIVE_LOW>; pinctrl-names = "default", "sleep"; - pinctrl-0 = <&sdc2_on>; - pinctrl-1 = <&sdc2_off>; + pinctrl-0 = <&sdc2_on &pmm8155au_1_sdc2_cd>; + pinctrl-1 = <&sdc2_off &pmm8155au_1_sdc2_cd>; vqmmc-supply = <&vreg_l13c_2p96>; /* IO line power */ vmmc-supply = <&vreg_l17a_2p96>; /* Card power line */ bus-width = <4>; @@ -505,13 +505,6 @@ data-pins { bias-pull-up; /* pull up */ drive-strength = <16>; /* 16 MA */ }; - - sd-cd-pins { - pins = "gpio96"; - function = "gpio"; - bias-pull-up; /* pull up */ - drive-strength = <2>; /* 2 MA */ - }; }; sdc2_off: sdc2-off-state { @@ -532,13 +525,6 @@ data-pins { bias-pull-up; /* pull up */ drive-strength = <2>; /* 2 MA */ }; - - sd-cd-pins { - pins = "gpio96"; - function = "gpio"; - bias-pull-up; /* pull up */ - drive-strength = <2>; /* 2 MA */ - }; }; usb2phy_ac_en1_default: usb2phy-ac-en1-default-state { @@ -604,3 +590,13 @@ phy-reset-pins { }; }; }; + +&pmm8155au_1_gpios { + pmm8155au_1_sdc2_cd: pmm8155au_1-sdc2-cd { + pins = "gpio4"; + function = "normal"; + input-enable; + bias-pull-up; + power-source = <0>; + }; +}; -- 2.44.0

1 year, 2 months

3
4
0 0

[PATCH] sched: Add missing memory barrier in switch_mm_cid

by Mathieu Desnoyers

Many architectures' switch_mm() (e.g. arm64) do not have an smp_mb() which the core scheduler code has depended upon since commit: commit 223baf9d17f25 ("sched: Fix performance regression introduced by mm_cid") If switch_mm() doesn't call smp_mb(), sched_mm_cid_remote_clear() can unset the actively used cid when it fails to observe active task after it sets lazy_put. There *is* a memory barrier between storing to rq->curr and _return to userspace_ (as required by membarrier), but the rseq mm_cid has stricter requirements: the barrier needs to be issued between store to rq->curr and switch_mm_cid(), which happens earlier than: - spin_unlock(), - switch_to(). So it's fine when the architecture switch_mm() happens to have that barrier already, but less so when the architecture only provides the full barrier in switch_to() or spin_unlock(). It is a bug in the rseq switch_mm_cid() implementation. All architectures that don't have memory barriers in switch_mm(), but rather have the full barrier either in finish_lock_switch() or switch_to() have them too late for the needs of switch_mm_cid(). Introduce a new smp_mb__after_switch_mm(), defined as smp_mb() in the generic barrier.h header, and use it in switch_mm_cid() for scheduler transitions where switch_mm() is expected to provide a memory barrier. Architectures can override smp_mb__after_switch_mm() if their switch_mm() implementation provides an implicit memory barrier. Override it with a no-op on x86 which implicitly provide this memory barrier by writing to CR3. Link: https://lore.kernel.org/lkml/20240305145335.2696125-1-yeoreum.yun@arm.com/ Reported-by: levi.yun <yeoreum.yun(a)arm.com> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> # for arm64 Acked-by: Dave Hansen <dave.hansen(a)linux.intel.com> # for x86 Fixes: 223baf9d17f2 ("sched: Fix performance regression introduced by mm_cid") Cc: <stable(a)vger.kernel.org> # 6.4.x Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Vincent Guittot <vincent.guittot(a)linaro.org> Cc: Juri Lelli <juri.lelli(a)redhat.com> Cc: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Cc: Ben Segall <bsegall(a)google.com> Cc: Mel Gorman <mgorman(a)suse.de> Cc: Daniel Bristot de Oliveira <bristot(a)redhat.com> Cc: Valentin Schneider <vschneid(a)redhat.com> Cc: levi.yun <yeoreum.yun(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Cc: Aaron Lu <aaron.lu(a)intel.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Borislav Petkov <bp(a)alien8.de> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: linux-arch(a)vger.kernel.org Cc: linux-mm(a)kvack.org Cc: x86(a)kernel.org --- arch/x86/include/asm/barrier.h | 3 +++ include/asm-generic/barrier.h | 8 ++++++++ kernel/sched/sched.h | 20 ++++++++++++++------ 3 files changed, 25 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h index 0216f63a366b..d0795b5fab46 100644 --- a/arch/x86/include/asm/barrier.h +++ b/arch/x86/include/asm/barrier.h @@ -79,6 +79,9 @@ do { \ #define __smp_mb__before_atomic() do { } while (0) #define __smp_mb__after_atomic() do { } while (0) +/* Writing to CR3 provides a full memory barrier in switch_mm(). */ +#define smp_mb__after_switch_mm() do { } while (0) + #include <asm-generic/barrier.h> #endif /* _ASM_X86_BARRIER_H */ diff --git a/include/asm-generic/barrier.h b/include/asm-generic/barrier.h index 961f4d88f9ef..5a6c94d7a598 100644 --- a/include/asm-generic/barrier.h +++ b/include/asm-generic/barrier.h @@ -296,5 +296,13 @@ do { \ #define io_stop_wc() do { } while (0) #endif +/* + * Architectures that guarantee an implicit smp_mb() in switch_mm() + * can override smp_mb__after_switch_mm. + */ +#ifndef smp_mb__after_switch_mm +#define smp_mb__after_switch_mm() smp_mb() +#endif + #endif /* !__ASSEMBLY__ */ #endif /* __ASM_GENERIC_BARRIER_H */ diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 001fe047bd5d..35717359d3ca 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -79,6 +79,8 @@ # include <asm/paravirt_api_clock.h> #endif +#include <asm/barrier.h> + #include "cpupri.h" #include "cpudeadline.h" @@ -3445,13 +3447,19 @@ static inline void switch_mm_cid(struct rq *rq, * between rq->curr store and load of {prev,next}->mm->pcpu_cid[cpu]. * Provide it here. */ - if (!prev->mm) // from kernel + if (!prev->mm) { // from kernel smp_mb(); - /* - * user -> user transition guarantees a memory barrier through - * switch_mm() when current->mm changes. If current->mm is - * unchanged, no barrier is needed. - */ + } else { // from user + /* + * user -> user transition relies on an implicit + * memory barrier in switch_mm() when + * current->mm changes. If the architecture + * switch_mm() does not have an implicit memory + * barrier, it is emitted here. If current->mm + * is unchanged, no barrier is needed. + */ + smp_mb__after_switch_mm(); + } } if (prev->mm_cid_active) { mm_cid_snapshot_time(rq, prev->mm); -- 2.25.1

1 year, 2 months

2
2
0 0

[PATCH 1/3] tracing/kprobes: Fix symbol counting logic by looking at modules as well

by Maxime MERE

From: Andrii Nakryiko <andrii(a)kernel.org> Recent changes to count number of matching symbols when creating a kprobe event failed to take into account kernel modules. As such, it breaks kprobes on kernel module symbols, by assuming there is no match. Fix this my calling module_kallsyms_on_each_symbol() in addition to kallsyms_on_each_match_symbol() to perform a proper counting. Link: https://lore.kernel.org/all/20231027233126.2073148-1-andrii@kernel.org/ Cc: Francis Laniel <flaniel(a)linux.microsoft.com> Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Steven Rostedt <rostedt(a)goodmis.org> Fixes: b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols") Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Song Liu <song(a)kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> --- kernel/trace/trace_kprobe.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 95c5b0668cb7..e834f149695b 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -714,14 +714,30 @@ static int count_symbols(void *data, unsigned long unused) return 0; } +struct sym_count_ctx { + unsigned int count; + const char *name; +}; + +static int count_mod_symbols(void *data, const char *name, unsigned long unused) +{ + struct sym_count_ctx *ctx = data; + + if (strcmp(name, ctx->name) == 0) + ctx->count++; + + return 0; +} + static unsigned int number_of_same_symbols(char *func_name) { - unsigned int count; + struct sym_count_ctx ctx = { .count = 0, .name = func_name }; + + kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count); - count = 0; - kallsyms_on_each_match_symbol(count_symbols, func_name, &count); + module_kallsyms_on_each_symbol(NULL, count_mod_symbols, &ctx); - return count; + return ctx.count; } static int __trace_kprobe_create(int argc, const char *argv[]) -- 2.25.1

1 year, 2 months

2
2
0 0

[for-linus][PATCH 4/4] ring-buffer: Only update pages_touched when a new page is touched

by Steven Rostedt

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> The "buffer_percent" logic that is used by the ring buffer splice code to only wake up the tasks when there's no data after the buffer is filled to the percentage of the "buffer_percent" file is dependent on three variables that determine the amount of data that is in the ring buffer: 1) pages_read - incremented whenever a new sub-buffer is consumed 2) pages_lost - incremented every time a writer overwrites a sub-buffer 3) pages_touched - incremented when a write goes to a new sub-buffer The percentage is the calculation of: (pages_touched - (pages_lost + pages_read)) / nr_pages Basically, the amount of data is the total number of sub-bufs that have been touched, minus the number of sub-bufs lost and sub-bufs consumed. This is divided by the total count to give the buffer percentage. When the percentage is greater than the value in the "buffer_percent" file, it wakes up splice readers waiting for that amount. It was observed that over time, the amount read from the splice was constantly decreasing the longer the trace was running. That is, if one asked for 60%, it would read over 60% when it first starts tracing, but then it would be woken up at under 60% and would slowly decrease the amount of data read after being woken up, where the amount becomes much less than the buffer percent. This was due to an accounting of the pages_touched incrementation. This value is incremented whenever a writer transfers to a new sub-buffer. But the place where it was incremented was incorrect. If a writer overflowed the current sub-buffer it would go to the next one. If it gets preempted by an interrupt at that time, and the interrupt performs a trace, it too will end up going to the next sub-buffer. But only one should increment the counter. Unfortunately, that was not the case. Change the cmpxchg() that does the real switch of the tail-page into a try_cmpxchg(), and on success, perform the increment of pages_touched. This will only increment the counter once for when the writer moves to a new sub-buffer, and not when there's a race and is incremented for when a writer and its preempting writer both move to the same new sub-buffer. Link: https://lore.kernel.org/linux-trace-kernel/20240409151309.0d0e5056@gandalf.… Cc: stable(a)vger.kernel.org Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Fixes: 2c2b0a78b3739 ("ring-buffer: Add percentage of ring buffer full to wake up reader") Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> --- kernel/trace/ring_buffer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 25476ead681b..6511dc3a00da 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1393,7 +1393,6 @@ static void rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer, old_write = local_add_return(RB_WRITE_INTCNT, &next_page->write); old_entries = local_add_return(RB_WRITE_INTCNT, &next_page->entries); - local_inc(&cpu_buffer->pages_touched); /* * Just make sure we have seen our old_write and synchronize * with any interrupts that come in. @@ -1430,8 +1429,9 @@ static void rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer, */ local_set(&next_page->page->commit, 0); - /* Again, either we update tail_page or an interrupt does */ - (void)cmpxchg(&cpu_buffer->tail_page, tail_page, next_page); + /* Either we update tail_page or an interrupt does */ + if (try_cmpxchg(&cpu_buffer->tail_page, &tail_page, next_page)) + local_inc(&cpu_buffer->pages_touched); } } -- 2.43.0

1 year, 2 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2024