The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x ccbfcac05866ebe6eb3bc6d07b51d4ed4fcde436
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024081927-ungodly-gumminess-adf9@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
ccbfcac05866 ("ALSA: timer: Relax start tick time check for slave timer elements")
4a63bd179fa8 ("ALSA: timer: Set lower bound of start tick time")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ccbfcac05866ebe6eb3bc6d07b51d4ed4fcde436 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai(a)suse.de>
Date: Sat, 10 Aug 2024 10:48:32 +0200
Subject: [PATCH] ALSA: timer: Relax start tick time check for slave timer
elements
The recent addition of a sanity check for a too low start tick time
seems breaking some applications that uses aloop with a certain slave
timer setup. They may have the initial resolution 0, hence it's
treated as if it were a too low value.
Relax and skip the check for the slave timer instance for addressing
the regression.
Fixes: 4a63bd179fa8 ("ALSA: timer: Set lower bound of start tick time")
Cc: <stable(a)vger.kernel.org>
Link: https://github.com/raspberrypi/linux/issues/6294
Link: https://patch.msgid.link/20240810084833.10939-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
diff --git a/sound/core/timer.c b/sound/core/timer.c
index d104adc75a8b..71a07c1662f5 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -547,7 +547,7 @@ static int snd_timer_start1(struct snd_timer_instance *timeri,
/* check the actual time for the start tick;
* bail out as error if it's way too low (< 100us)
*/
- if (start) {
+ if (start && !(timer->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
if ((u64)snd_timer_hw_resolution(timer) * ticks < 100000)
return -EINVAL;
}
Several cs track offsets (such as 'track->db_s_read_offset')
either are initialized with or plainly take big enough values that,
once shifted 8 bits left, may be hit with integer overflow if the
resulting values end up going over u32 limit.
Some debug prints take this into account (see according dev_warn() in
evergreen_cs_track_validate_stencil()), even if the actual
calculated value assigned to local 'offset' variable is missing
similar proper expansion.
Mitigate the problem by casting the type of right operands to the
wider type of corresponding left ones in all such cases.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 285484e2d55e ("drm/radeon: add support for evergreen/ni tiling informations v11")
Cc: stable(a)vger.kernel.org
Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
---
P.S. While I am not certain that track->cb_color_bo_offset[id]
actually ends up taking values high enough to cause an overflow,
nonetheless I thought it prudent to cast it to ulong as well.
drivers/gpu/drm/radeon/evergreen_cs.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 1fe6e0d883c7..d734d221e2da 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -433,7 +433,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
return r;
}
- offset = track->cb_color_bo_offset[id] << 8;
+ offset = (unsigned long)track->cb_color_bo_offset[id] << 8;
if (offset & (surf.base_align - 1)) {
dev_warn(p->dev, "%s:%d cb[%d] bo base %ld not aligned with %ld\n",
__func__, __LINE__, id, offset, surf.base_align);
@@ -455,7 +455,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
min = surf.nby - 8;
}
bsize = radeon_bo_size(track->cb_color_bo[id]);
- tmp = track->cb_color_bo_offset[id] << 8;
+ tmp = (unsigned long)track->cb_color_bo_offset[id] << 8;
for (nby = surf.nby; nby > min; nby--) {
size = nby * surf.nbx * surf.bpe * surf.nsamples;
if ((tmp + size * mslice) <= bsize) {
@@ -476,10 +476,10 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
}
}
dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
- "offset %d, max layer %d, bo size %ld, slice %d)\n",
+ "offset %ld, max layer %d, bo size %ld, slice %d)\n",
__func__, __LINE__, id, surf.layer_size,
- track->cb_color_bo_offset[id] << 8, mslice,
- radeon_bo_size(track->cb_color_bo[id]), slice);
+ (unsigned long)track->cb_color_bo_offset[id] << 8,
+ mslice, radeon_bo_size(track->cb_color_bo[id]), slice);
dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
__func__, __LINE__, surf.nbx, surf.nby,
surf.mode, surf.bpe, surf.nsamples,
@@ -608,7 +608,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
return r;
}
- offset = track->db_s_read_offset << 8;
+ offset = (unsigned long)track->db_s_read_offset << 8;
if (offset & (surf.base_align - 1)) {
dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
__func__, __LINE__, offset, surf.base_align);
@@ -627,7 +627,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
return -EINVAL;
}
- offset = track->db_s_write_offset << 8;
+ offset = (unsigned long)track->db_s_write_offset << 8;
if (offset & (surf.base_align - 1)) {
dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
__func__, __LINE__, offset, surf.base_align);
@@ -706,7 +706,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
return r;
}
- offset = track->db_z_read_offset << 8;
+ offset = (unsigned long)track->db_z_read_offset << 8;
if (offset & (surf.base_align - 1)) {
dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
__func__, __LINE__, offset, surf.base_align);
@@ -722,7 +722,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
return -EINVAL;
}
- offset = track->db_z_write_offset << 8;
+ offset = (unsigned long)track->db_z_write_offset << 8;
if (offset & (surf.base_align - 1)) {
dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
__func__, __LINE__, offset, surf.base_align);
If formatting a suspended disk (such as formatting with different DIF
type), the disk will be resuming first, and then the format command will
submit to the disk through SG_IO ioctl.
When the disk is processing the format command, the system does not submit
other commands to the disk. Therefore, the system attempts to suspend the
disk again and sends the SYNC CACHE command. However, the SYNC CACHE
command will fail because the disk is in the formatting process, which
will cause the runtime_status of the disk to error and it is difficult
for user to recover it. Error info like:
[ 669.925325] sd 6:0:6:0: [sdg] Synchronizing SCSI cache
[ 670.202371] sd 6:0:6:0: [sdg] Synchronize Cache(10) failed: Result: hostbyte=0x00 driverbyte=DRIVER_OK
[ 670.216300] sd 6:0:6:0: [sdg] Sense Key : 0x2 [current]
[ 670.221860] sd 6:0:6:0: [sdg] ASC=0x4 ASCQ=0x4
To solve the issue, retry the command until format command is finished.
Cc: stable(a)vger.kernel.org
Signed-off-by: Yihang Li <liyihang9(a)huawei.com>
Reviewed-by: Bart Van Assche <bvanassche(a)acm.org>
---
Changes since v3:
- Add Cc tag for kernel stable.
Changes since v2:
- Add Reviewed-by for Bart.
Changes since v1:
- Updated and added error information to the patch description.
---
drivers/scsi/sd.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index adeaa8ab9951..5cd88a8eea73 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1823,6 +1823,11 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
(sshdr.asc == 0x74 && sshdr.ascq == 0x71)) /* drive is password locked */
/* this is no error here */
return 0;
+
+ /* retry if format in progress */
+ if (sshdr.asc == 0x4 && sshdr.ascq == 0x4)
+ return -EBUSY;
+
/*
* This drive doesn't support sync and there's not much
* we can do because this is called during shutdown
--
2.33.0
When operating in High-Speed, it is observed that DSTS[USBLNKST] doesn't
update link state immediately after receiving the wakeup interrupt. Since
wakeup event handler calls the resume callbacks, there is a chance that
function drivers can perform an ep queue, which in turn tries to perform
remote wakeup from send_gadget_ep_cmd(STARTXFER). This happens because
DSTS[[21:18] wasn't updated to U0 yet, it's observed that the latency of
DSTS can be in order of milli-seconds. Hence avoid calling gadget_wakeup
during startxfer to prevent unnecessarily issuing remote wakeup to host.
Fixes: c36d8e947a56 ("usb: dwc3: gadget: put link to U0 before Start Transfer")
Cc: <stable(a)vger.kernel.org>
Suggested-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
Signed-off-by: Prashanth K <quic_prashk(a)quicinc.com>
---
v2: Refactored the patch as suggested in v1 discussion.
drivers/usb/dwc3/gadget.c | 24 ------------------------
1 file changed, 24 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 89fc690fdf34..3f634209c5b8 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -327,30 +327,6 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
}
- if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
- int link_state;
-
- /*
- * Initiate remote wakeup if the link state is in U3 when
- * operating in SS/SSP or L1/L2 when operating in HS/FS. If the
- * link state is in U1/U2, no remote wakeup is needed. The Start
- * Transfer command will initiate the link recovery.
- */
- link_state = dwc3_gadget_get_link_state(dwc);
- switch (link_state) {
- case DWC3_LINK_STATE_U2:
- if (dwc->gadget->speed >= USB_SPEED_SUPER)
- break;
-
- fallthrough;
- case DWC3_LINK_STATE_U3:
- ret = __dwc3_gadget_wakeup(dwc, false);
- dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n",
- ret);
- break;
- }
- }
-
/*
* For some commands such as Update Transfer command, DEPCMDPARn
* registers are reserved. Since the driver often sends Update Transfer
--
2.25.1
I'm announcing the release of the 6.10.6 kernel.
All users of the 6.10 kernel series must upgrade.
The updated 6.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/loongarch/include/uapi/asm/unistd.h | 1
drivers/ata/libata-scsi.c | 15
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 232 ++++--------
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 6
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 90 +++-
drivers/gpu/drm/amd/display/dc/dc_stream.h | 8
drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 2
drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 -
drivers/nvme/host/pci.c | 7
drivers/platform/x86/Kconfig | 1
drivers/platform/x86/amd/pmf/spc.c | 32 -
drivers/platform/x86/ideapad-laptop.c | 148 ++++++-
drivers/platform/x86/ideapad-laptop.h | 9
drivers/platform/x86/lenovo-ymc.c | 60 ---
fs/binfmt_flat.c | 4
fs/exec.c | 8
fs/f2fs/extent_cache.c | 48 --
fs/f2fs/f2fs.h | 2
fs/f2fs/gc.c | 10
fs/f2fs/inode.c | 10
fs/jfs/jfs_dmap.c | 2
fs/jfs/jfs_dtree.c | 2
fs/ntfs3/frecord.c | 75 +++
net/core/filter.c | 8
net/ipv4/fou_core.c | 2
sound/soc/codecs/cs35l56-shared.c | 1
sound/usb/mixer.c | 7
29 files changed, 486 insertions(+), 355 deletions(-)
Chao Yu (2):
f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
f2fs: fix to cover read extent cache access with lock
Edward Adam Davis (1):
jfs: fix null ptr deref in dtInsertEntry
Fangzhi Zuo (1):
drm/amd/display: Prevent IPX From Link Detect and Set Mode
Gergo Koteles (3):
platform/x86: ideapad-laptop: introduce a generic notification chain
platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands
Greg Kroah-Hartman (2):
Revert "drm/amd/display: Refactor function dm_dp_mst_is_port_support_mode()"
Linux 6.10.6
Harry Wentland (1):
drm/amd/display: Separate setting and programming of cursor
Huacai Chen (1):
LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
Kees Cook (2):
exec: Fix ToCToU between perm check and set-uid/gid usage
binfmt_flat: Fix corruption when not offsetting data start
Konstantin Komarov (1):
fs/ntfs3: Do copy_to_user out of run_lock
Niklas Cassel (1):
Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error"
Pei Li (1):
jfs: Fix shift-out-of-bounds in dbDiscardAG
Sean Young (1):
media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
Shyam Sundar S K (1):
platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled
Simon Trimmer (1):
ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
Srinivasan Shanmugam (1):
drm/amdgpu/display: Fix null pointer dereference in dc_stream_program_cursor_position
Takashi Iwai (1):
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
WangYuli (1):
nvme/pci: Add APST quirk for Lenovo N60z laptop
Wayne Lin (2):
drm/amd/display: Defer handling mst up request in resume
drm/amd/display: Solve mst monitors blank out problem after resume
Willem de Bruijn (1):
fou: remove warn in gue_gro_receive on unsupported protocol
yunshui (1):
bpf, net: Use DEV_STAT_INC()
I'm announcing the release of the 6.1.106 kernel.
All users of the 6.1 kernel series must upgrade.
The updated 6.1.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm64/kvm/hyp/pgtable.c | 10 -
arch/loongarch/include/uapi/asm/unistd.h | 1
drivers/ata/libata-scsi.c | 15 +
drivers/gpu/drm/i915/gem/i915_gem_mman.c | 192 ++++++++++++++++------
drivers/gpu/drm/i915/gem/i915_gem_mman.h | 2
drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 ----
drivers/nvme/host/pci.c | 7
fs/binfmt_flat.c | 4
fs/exec.c | 8
fs/lockd/svc.c | 3
fs/nfs/callback.c | 3
fs/nfsd/export.c | 32 ++-
fs/nfsd/export.h | 4
fs/nfsd/netns.h | 25 ++
fs/nfsd/nfs4proc.c | 6
fs/nfsd/nfscache.c | 201 ++++++++++++++----------
fs/nfsd/nfsctl.c | 24 +-
fs/nfsd/nfsd.h | 1
fs/nfsd/nfsfh.c | 3
fs/nfsd/nfssvc.c | 24 +-
fs/nfsd/stats.c | 52 ++----
fs/nfsd/stats.h | 85 +++-------
fs/nfsd/trace.h | 22 ++
fs/nfsd/vfs.c | 6
include/linux/cgroup-defs.h | 7
include/linux/sunrpc/svc.h | 5
kernel/cgroup/cgroup-internal.h | 3
kernel/cgroup/cgroup.c | 23 +-
net/mptcp/options.c | 3
net/mptcp/pm_netlink.c | 49 +++--
net/mptcp/pm_userspace.c | 2
net/mptcp/protocol.h | 2
net/sunrpc/stats.c | 2
net/sunrpc/svc.c | 36 ++--
net/wireless/nl80211.c | 6
sound/soc/soc-topology.c | 32 ---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 +
38 files changed, 572 insertions(+), 379 deletions(-)
Amadeusz Sławiński (2):
ASoC: topology: Clean up route loading
ASoC: topology: Fix route memory corruption
Andi Shyti (2):
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
drm/i915/gem: Adjust vma offset for framebuffer mmap offset
Chuck Lever (6):
NFSD: Refactor nfsd_reply_cache_free_locked()
NFSD: Rename nfsd_reply_cache_alloc()
NFSD: Replace nfsd_prune_bucket()
NFSD: Refactor the duplicate reply cache shrinker
NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
NFSD: Fix frame size warning in svc_export_parse()
Dan Carpenter (1):
drm/i915: Fix a NULL vs IS_ERR() bug
Eric Dumazet (1):
wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
Geliang Tang (1):
mptcp: pass addr to mptcp_pm_alloc_anno_list
Greg Kroah-Hartman (1):
Linux 6.1.106
Huacai Chen (1):
LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
Jeff Layton (2):
nfsd: move reply cache initialization into nfsd startup
nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
Josef Bacik (10):
sunrpc: don't change ->sv_stats if it doesn't exist
nfsd: stop setting ->pg_stats for unused stats
sunrpc: pass in the sv_stats struct through svc_create_pooled
sunrpc: remove ->pg_stats from svc_program
sunrpc: use the struct net as the svc proc private
nfsd: rename NFSD_NET_* to NFSD_STATS_*
nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
nfsd: make all of the nfsd stats per-network namespace
nfsd: remove nfsd_stats, make th_cnt a global counter
nfsd: make svc_stat per-network namespace instead of global
Kees Cook (2):
exec: Fix ToCToU between perm check and set-uid/gid usage
binfmt_flat: Fix corruption when not offsetting data start
Matthieu Baerts (NGI0) (5):
mptcp: pm: reduce indentation blocks
mptcp: pm: don't try to create sf if alloc failed
mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set
selftests: mptcp: join: test both signal & subflow
mptcp: fully established after ADD_ADDR echo on MPJ
Niklas Cassel (1):
Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error"
Nirmoy Das (1):
drm/i915: Add a function to mmap framebuffer obj
Sean Young (1):
media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
Waiman Long (1):
cgroup: Move rcu_head up near the top of cgroup_root
WangYuli (1):
nvme/pci: Add APST quirk for Lenovo N60z laptop
Will Deacon (1):
KVM: arm64: Don't pass a TLBI level hint when zapping table entries
Yafang Shao (1):
cgroup: Make operations on the cgroup root_list RCU safe