Bisection revealed that the bitcrushing distortion with RME FireFace 800
was caused by 1d717123bb1a7555
("ALSA: firewire-lib: Avoid -Wflex-array-member-not-at-end warning").
Reverting this commit yields restoration of clear audio output.
I will send in a patch reverting this commit for now, soonTM.
#regzbot introduced: 1d717123bb1a7555
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x df39038cd89525d465c2c8827eb64116873f141a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024072535-synergy-struggle-8ecc@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
df39038cd895 ("s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()")
b20c8216c1e0 ("s390/mm,fault: move VM_FAULT_ERROR handling to do_exception()")
7c194d84a9ce ("s390/mm,fault: remove VM_FAULT_BADMAP and VM_FAULT_BADACCESS")
b61a0922b6dc ("s390/mm,fault: remove VM_FAULT_SIGNAL")
0f86ac4ba713 ("s390/mm,fault: remove VM_FAULT_BADCONTEXT")
0f1a14e0348e ("s390/mm,fault: simplify kfence fault handling")
64ea33fb09f8 ("s390/mm,fault: call do_fault_error() only from do_exception()")
5db06565cad6 ("s390/mm,fault: get rid of do_low_address()")
cca12b427d43 ("s390/mm,fault: remove VM_FAULT_PFAULT")
5be05c35e72f ("s390/mm,fault: improve readability by using teid union")
4416d2ed8166 ("s390/mm,fault: use static key for store indication")
9641613f48bb ("s390/mm,fault: use get_fault_address() everywhere")
5c845de331d9 ("s390/mm,fault: remove noinline attribute from all functions")
8dbc33dc8163 ("s390/mm,fault: have balanced braces, remove unnecessary blanks")
7c915a84e5e2 ("s390/mm,fault: reverse x-mas tree coding style")
3aad8c044297 ("s390/mm,fault: remove and improve comments, adjust whitespace")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From df39038cd89525d465c2c8827eb64116873f141a Mon Sep 17 00:00:00 2001
From: Gerald Schaefer <gerald.schaefer(a)linux.ibm.com>
Date: Mon, 15 Jul 2024 20:04:16 +0200
Subject: [PATCH] s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
There is no support for HWPOISON, MEMORY_FAILURE, or ARCH_HAS_COPY_MC on
s390. Therefore we do not expect to see VM_FAULT_HWPOISON in
do_exception().
However, since commit af19487f00f3 ("mm: make PTE_MARKER_SWAPIN_ERROR more
general"), it is possible to see VM_FAULT_HWPOISON in combination with
PTE_MARKER_POISONED, even on architectures that do not support HWPOISON
otherwise. In this case, we will end up on the BUG() in do_exception().
Fix this by treating VM_FAULT_HWPOISON the same as VM_FAULT_SIGBUS, similar
to x86 when MEMORY_FAILURE is not configured. Also print unexpected fault
flags, for easier debugging.
Note that VM_FAULT_HWPOISON_LARGE is not expected, because s390 cannot
support swap entries on other levels than PTE level.
Cc: stable(a)vger.kernel.org # 6.6+
Fixes: af19487f00f3 ("mm: make PTE_MARKER_SWAPIN_ERROR more general")
Reported-by: Yunseong Kim <yskelg(a)gmail.com>
Tested-by: Yunseong Kim <yskelg(a)gmail.com>
Acked-by: Alexander Gordeev <agordeev(a)linux.ibm.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer(a)linux.ibm.com>
Message-ID: <20240715180416.3632453-1-gerald.schaefer(a)linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor(a)linux.ibm.com>
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 6b19a33c49c2..8e149ef5e89b 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -433,12 +433,13 @@ static void do_exception(struct pt_regs *regs, int access)
handle_fault_error_nolock(regs, 0);
else
do_sigsegv(regs, SEGV_MAPERR);
- } else if (fault & VM_FAULT_SIGBUS) {
+ } else if (fault & (VM_FAULT_SIGBUS | VM_FAULT_HWPOISON)) {
if (!user_mode(regs))
handle_fault_error_nolock(regs, 0);
else
do_sigbus(regs);
} else {
+ pr_emerg("Unexpected fault flags: %08x\n", fault);
BUG();
}
}
From: Bailey Forrest <bcf(a)google.com>
The NIC requires each TSO segment to not span more than 10
descriptors. NIC further requires each descriptor to not exceed
16KB - 1 (GVE_TX_MAX_BUF_SIZE_DQO).
The descriptors for an skb are generated by
gve_tx_add_skb_no_copy_dqo() for DQO RDA queue format.
gve_tx_add_skb_no_copy_dqo() loops through each skb frag and
generates a descriptor for the entire frag if the frag size is
not greater than GVE_TX_MAX_BUF_SIZE_DQO. If the frag size is
greater than GVE_TX_MAX_BUF_SIZE_DQO, it is split into descriptor(s)
of size GVE_TX_MAX_BUF_SIZE_DQO and a descriptor is generated for
the remainder (frag size % GVE_TX_MAX_BUF_SIZE_DQO).
gve_can_send_tso() checks if the descriptors thus generated for an
skb would meet the requirement that each TSO-segment not span more
than 10 descriptors. However, the current code misses an edge case
when a TSO segment spans multiple descriptors within a large frag.
This change fixes the edge case.
gve_can_send_tso() relies on the assumption that max gso size (9728)
is less than GVE_TX_MAX_BUF_SIZE_DQO and therefore within an skb
fragment a TSO segment can never span more than 2 descriptors.
Fixes: a57e5de476be ("gve: DQO: Add TX path")
Signed-off-by: Praveen Kaligineedi <pkaligineedi(a)google.com>
Signed-off-by: Bailey Forrest <bcf(a)google.com>
Reviewed-by: Jeroen de Borst <jeroendb(a)google.com>
Cc: stable(a)vger.kernel.org
---
Changes from v1:
- Added 'stable tag'
- Added more explanation in the commit message
- Modified comments to clarify the changes made
- Changed variable names 'last_frag_size' to 'prev_frag_size' and
'last_frag_remain' to 'prev_frag_remain'
- Removed parentheses around single line statement
drivers/net/ethernet/google/gve/gve_tx_dqo.c | 22 +++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/google/gve/gve_tx_dqo.c b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
index 0b3cca3fc792..f879426cb552 100644
--- a/drivers/net/ethernet/google/gve/gve_tx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
@@ -866,22 +866,42 @@ static bool gve_can_send_tso(const struct sk_buff *skb)
const int header_len = skb_tcp_all_headers(skb);
const int gso_size = shinfo->gso_size;
int cur_seg_num_bufs;
+ int prev_frag_size;
int cur_seg_size;
int i;
cur_seg_size = skb_headlen(skb) - header_len;
+ prev_frag_size = skb_headlen(skb);
cur_seg_num_bufs = cur_seg_size > 0;
for (i = 0; i < shinfo->nr_frags; i++) {
if (cur_seg_size >= gso_size) {
cur_seg_size %= gso_size;
cur_seg_num_bufs = cur_seg_size > 0;
+
+ if (prev_frag_size > GVE_TX_MAX_BUF_SIZE_DQO) {
+ int prev_frag_remain = prev_frag_size %
+ GVE_TX_MAX_BUF_SIZE_DQO;
+
+ /* If the last descriptor of the previous frag
+ * is less than cur_seg_size, the segment will
+ * span two descriptors in the previous frag.
+ * Since max gso size (9728) is less than
+ * GVE_TX_MAX_BUF_SIZE_DQO, it is impossible
+ * for the segment to span more than two
+ * descriptors.
+ */
+ if (prev_frag_remain &&
+ cur_seg_size > prev_frag_remain)
+ cur_seg_num_bufs++;
+ }
}
if (unlikely(++cur_seg_num_bufs > max_bufs_per_seg))
return false;
- cur_seg_size += skb_frag_size(&shinfo->frags[i]);
+ prev_frag_size = skb_frag_size(&shinfo->frags[i]);
+ cur_seg_size += prev_frag_size;
}
return true;
--
2.45.2.1089.g2a221341d9-goog
From: Jiri Olsa <jolsa(a)kernel.org>
[ Upstream commit 4121d4481b72501aa4d22680be4ea1096d69d133 ]
Hao Sun reported crash in dispatcher image [1].
Currently we don't have any sync between bpf_dispatcher_update and
bpf_dispatcher_xdp_func, so following race is possible:
cpu 0: cpu 1:
bpf_prog_run_xdp
...
bpf_dispatcher_xdp_func
in image at offset 0x0
bpf_dispatcher_update
update image at offset 0x800
bpf_dispatcher_update
update image at offset 0x0
in image at offset 0x0 -> crash
Fixing this by synchronizing dispatcher image update (which is done
in bpf_dispatcher_update function) with bpf_dispatcher_xdp_func that
reads and execute the dispatcher image.
Calling synchronize_rcu after updating and installing new image ensures
that readers leave old image before it's changed in the next dispatcher
update. The update itself is locked with dispatcher's mutex.
The bpf_prog_run_xdp is called under local_bh_disable and synchronize_rcu
will wait for it to leave [2].
[1] https://lore.kernel.org/bpf/Y5SFho7ZYXr9ifRn@krava/T/#m00c29ece654bc9f332a1…
[2] https://lore.kernel.org/bpf/0B62D35A-E695-4B7A-A0D4-774767544C1A@gmail.com/…
Reported-by: Hao Sun <sunhao.th(a)gmail.com>
Signed-off-by: Jiri Olsa <jolsa(a)kernel.org>
Acked-by: Yonghong Song <yhs(a)fb.com>
Acked-by: Paul E. McKenney <paulmck(a)kernel.org>
Link: https://lore.kernel.org/r/20221214123542.1389719-1-jolsa@kernel.org
Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org>
(cherry picked from commit 4121d4481b72501aa4d22680be4ea1096d69d133)
Signed-off-by: Sergio González Collado <sergio.collado(a)gmail.com>
Reported-by: syzbot+08ba1e474d350b613604(a)syzkaller.appspotmail.com
---
kernel/bpf/dispatcher.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/bpf/dispatcher.c b/kernel/bpf/dispatcher.c
index c19719f48ce0..fa3e9225aedc 100644
--- a/kernel/bpf/dispatcher.c
+++ b/kernel/bpf/dispatcher.c
@@ -125,6 +125,11 @@ static void bpf_dispatcher_update(struct bpf_dispatcher *d, int prev_num_progs)
__BPF_DISPATCHER_UPDATE(d, new ?: (void *)&bpf_dispatcher_nop_func);
+ /* Make sure all the callers executing the previous/old half of the
+ * image leave it, so following update call can modify it safely.
+ */
+ synchronize_rcu();
+
if (new)
d->image_off = noff;
}
--
2.39.2
From: Filipe Manana <fdmanana(a)suse.com>
[ Upstream commit df9f278239046719c91aeb59ec0afb1a99ee8b2b ]
During the transaction commit path, at create_pending_snapshot(), there
is no need to BUG_ON() in case we fail to get a dir index for the snapshot
in the parent directory. This should fail very rarely because the parent
inode should be loaded in memory already, with the respective delayed
inode created and the parent inode's index_cnt field already initialized.
However if it fails, it may be -ENOMEM like the comment at
create_pending_snapshot() says or any error returned by
btrfs_search_slot() through btrfs_set_inode_index_count(), which can be
pretty much anything such as -EIO or -EUCLEAN for example. So the comment
is not correct when it says it can only be -ENOMEM.
However doing a BUG_ON() here is overkill, since we can instead abort
the transaction and return the error. Note that any error returned by
create_pending_snapshot() will eventually result in a transaction
abort at cleanup_transaction(), called from btrfs_commit_transaction(),
but we can explicitly abort the transaction at this point instead so that
we get a stack trace to tell us that the call to btrfs_set_inode_index()
failed.
So just abort the transaction and return in case btrfs_set_inode_index()
returned an error at create_pending_snapshot().
Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com>
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
(cherry picked from commit df9f278239046719c91aeb59ec0afb1a99ee8b2b)
Signed-off-by: Sergio González Collado <sergio.collado(a)gmail.com>
Reported-by: syzbot+c56033c8c15c08286062(a)syzkaller.appspotmail.com
---
fs/btrfs/transaction.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index a7853a3a5719..604241e6e2c1 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1701,7 +1701,10 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
* insert the directory item
*/
ret = btrfs_set_inode_index(BTRFS_I(parent_inode), &index);
- BUG_ON(ret); /* -ENOMEM */
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ goto fail;
+ }
/* check if there is a file/dir which has the same name. */
dir_item = btrfs_lookup_dir_item(NULL, parent_root, path,
--
2.39.2
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 074992a1163295d717faa21d1818c4c19ef6e676
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024072522-properly-jackpot-9fed@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
074992a11632 ("arm64: dts: qcom: sm6115: Disable SS instance in Parkmode for USB")
a06a2f12f9e2 ("arm64: dts: qcom: qrb4210-rb2: enable USB-C port handling")
7e3a1f6470f7 ("arm64: dts: qcom: sm6115: drop pipe clock selection")
b3eaa47395b9 ("arm64: dts: qcom: sm6115: Hook up interconnects")
f6874706e311 ("arm64: dts: qcom: sm6115: switch UFS QMP PHY to new style of bindings")
ff753723bf39 ("arm64: dts: qcom: qrb4210-rb2: Enable MPSS and Wi-Fi")
cab60b166575 ("arm64: dts: qcom: qrb4210-rb2: Enable bluetooth")
ba5f5610841f ("arm64: dts: qcom: sm6115: Add UART3")
27c2ca90e2f3 ("arm64: dts: qcom: qrb4210-rb2: don't force usb peripheral mode")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 074992a1163295d717faa21d1818c4c19ef6e676 Mon Sep 17 00:00:00 2001
From: Krishna Kurapati <quic_kriskura(a)quicinc.com>
Date: Thu, 4 Jul 2024 20:58:45 +0530
Subject: [PATCH] arm64: dts: qcom: sm6115: Disable SS instance in Parkmode for
USB
For Gen-1 targets like SM6115, it is seen that stressing out the
controller in host mode results in HC died error:
xhci-hcd.12.auto: xHCI host not responding to stop endpoint command
xhci-hcd.12.auto: xHCI host controller not responding, assume dead
xhci-hcd.12.auto: HC died; cleaning up
And at this instant only restarting the host mode fixes it. Disable
SuperSpeed instance in park mode for SM6115 to mitigate this issue.
Cc: stable(a)vger.kernel.org
Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi")
Signed-off-by: Krishna Kurapati <quic_kriskura(a)quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio(a)linaro.org>
Link: https://lore.kernel.org/r/20240704152848.3380602-6-quic_kriskura@quicinc.com
Signed-off-by: Bjorn Andersson <andersson(a)kernel.org>
diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi
index ac5f071a8db3..aec6ca5941c2 100644
--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
@@ -1659,6 +1659,7 @@ usb_dwc3: usb@4e00000 {
snps,has-lpm-erratum;
snps,hird-threshold = /bits/ 8 <0x10>;
snps,usb3_lpm_capable;
+ snps,parkmode-disable-ss-quirk;
usb-role-switch;