From: Jos Wang <joswang(a)lenovo.com>
As PD2.0 spec ("8.3.3.2.3 PE_SRC_Send_Capabilities state"), after the
Source receives the GoodCRC Message from the Sink in response to the
Source_Capabilities message, it should start the SenderResponseTimer,
after the timer times out, the state machine transitions to the
HARD_RESET state.
Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jos Wang <joswang(a)lenovo.com>
---
drivers/usb/typec/tcpm/tcpm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 460dbde9fe22..57fae1118ac9 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -4821,7 +4821,7 @@ static void run_state_machine(struct tcpm_port *port)
port->caps_count = 0;
port->pd_capable = true;
tcpm_set_state_cond(port, SRC_SEND_CAPABILITIES_TIMEOUT,
- PD_T_SEND_SOURCE_CAP);
+ PD_T_SENDER_RESPONSE);
}
break;
case SRC_SEND_CAPABILITIES_TIMEOUT:
--
2.17.1
When using the in-kernel pd-mapper on x1e80100, client drivers often
fail to communicate with the firmware during boot, which specifically
breaks battery and USB-C altmode notifications. This has been observed
to happen on almost every second boot (41%) but likely depends on probe
order:
pmic_glink_altmode.pmic_glink_altmode pmic_glink.altmode.0: failed to send altmode request: 0x10 (-125)
pmic_glink_altmode.pmic_glink_altmode pmic_glink.altmode.0: failed to request altmode notifications: -125
ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI read request: -125
qcom_battmgr.pmic_glink_power_supply pmic_glink.power-supply.0: failed to request power notifications
In the same setup audio also fails to probe albeit much more rarely:
PDR: avs/audio get domain list txn wait failed: -110
PDR: service lookup for avs/audio failed: -110
Chris Lew has provided an analysis and is working on a fix for the
ECANCELED (125) errors, but it is not yet clear whether this will also
address the audio regression.
Even if this was first observed on x1e80100 there is currently no reason
to believe that these issues are specific to that platform.
Disable the in-kernel pd-mapper for now, and make sure to backport this
to stable to prevent users and distros from migrating away from the
user-space service.
Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation")
Cc: stable(a)vger.kernel.org # 6.11
Link: https://lore.kernel.org/lkml/Zqet8iInnDhnxkT9@hovoldconsulting.com/
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
It's now been over two months since I reported this regression, and even
if we seem to be making some progress on at least some of these issues I
think we need disable the pd-mapper temporarily until the fixes are in
place (e.g. to prevent distros from dropping the user-space service).
Johan
#regzbot introduced: 1ebcde047c54
drivers/soc/qcom/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig
index 74b9121240f8..35ddab9338d4 100644
--- a/drivers/soc/qcom/Kconfig
+++ b/drivers/soc/qcom/Kconfig
@@ -78,6 +78,7 @@ config QCOM_PD_MAPPER
select QCOM_PDR_MSG
select AUXILIARY_BUS
depends on NET && QRTR && (ARCH_QCOM || COMPILE_TEST)
+ depends on BROKEN
default QCOM_RPROC_COMMON
help
The Protection Domain Mapper maps registered services to the domains
--
2.45.2
Including m86k's <asm/raw_io.h> in vga.h on nommu platforms results
in conflicting defines with io_no.h for various I/O macros from the
__raw_read and __raw_write families. An example error is
In file included from arch/m68k/include/asm/vga.h:12,
from include/video/vga.h:22,
from include/linux/vgaarb.h:34,
from drivers/video/aperture.c:12:
>> arch/m68k/include/asm/raw_io.h:39: warning: "__raw_readb" redefined
39 | #define __raw_readb in_8
|
In file included from arch/m68k/include/asm/io.h:6,
from include/linux/io.h:13,
from include/linux/irq.h:20,
from include/asm-generic/hardirq.h:17,
from ./arch/m68k/include/generated/asm/hardirq.h:1,
from include/linux/hardirq.h:11,
from include/linux/interrupt.h:11,
from include/linux/trace_recursion.h:5,
from include/linux/ftrace.h:10,
from include/linux/kprobes.h:28,
from include/linux/kgdb.h:19,
from include/linux/fb.h:6,
from drivers/video/aperture.c:5:
arch/m68k/include/asm/io_no.h:16: note: this is the location of the previous definition
16 | #define __raw_readb(addr) \
|
Include <asm/io.h>, which avoid raw_io.h on nommu platforms. Also change
the defined values of some of the read/write symbols in vga.h to
__raw_read/__raw_write as the raw_in/raw_out symbols are not generally
available.
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Reported-by: kernel test robot <lkp(a)intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202501071629.DNEswlm8-lkp@intel.com/
Fixes: 5c3f968712ce ("m68k/video: Create <asm/vga.h>")
Cc: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: linux-fbdev(a)vger.kernel.org
Cc: dri-devel(a)lists.freedesktop.org
Cc: Helge Deller <deller(a)gmx.de>
Cc: <stable(a)vger.kernel.org> # v3.5+
---
arch/m68k/include/asm/vga.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/m68k/include/asm/vga.h b/arch/m68k/include/asm/vga.h
index 4742e6bc3ab8..cdd414fa8710 100644
--- a/arch/m68k/include/asm/vga.h
+++ b/arch/m68k/include/asm/vga.h
@@ -9,7 +9,7 @@
*/
#ifndef CONFIG_PCI
-#include <asm/raw_io.h>
+#include <asm/io.h>
#include <asm/kmap.h>
/*
@@ -29,9 +29,9 @@
#define inw_p(port) 0
#define outb_p(port, val) do { } while (0)
#define outw(port, val) do { } while (0)
-#define readb raw_inb
-#define writeb raw_outb
-#define writew raw_outw
+#define readb __raw_readb
+#define writeb __raw_writeb
+#define writew __raw_writew
#endif /* CONFIG_PCI */
#endif /* _ASM_M68K_VGA_H */
--
2.47.1
The reference count of the device incremented in device_initialize() is
not decremented when device_add() fails. Add a put_device() and delete
kfree() before returning from the function to decrement reference
count for cleanup. Or it could cause memory leak.
As comment of device_add() says, if device_add() succeeds, you should
call device_del() when you want to get rid of it. If device_add() has
not succeeded, use only put_device() to drop the reference count.
Found by code review.
Cc: stable(a)vger.kernel.org
Fixes: ed542bed126c ("[SCSI] raid class: handle component-add errors")
Signed-off-by: Ma Ke <make24(a)iscas.ac.cn>
---
drivers/scsi/raid_class.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/raid_class.c b/drivers/scsi/raid_class.c
index 898a0bdf8df6..77c91dbf3b77 100644
--- a/drivers/scsi/raid_class.c
+++ b/drivers/scsi/raid_class.c
@@ -251,7 +251,7 @@ int raid_component_add(struct raid_template *r,struct device *raid_dev,
list_del(&rc->node);
rd->component_count--;
put_device(component_dev);
- kfree(rc);
+ put_device(&rc->dev);
return err;
}
EXPORT_SYMBOL(raid_component_add);
--
2.25.1
This is the start of the stable review cycle for the 5.4.286 release.
There are 66 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 17 Nov 2024 06:37:07 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.286-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.286-rc1
Linus Torvalds <torvalds(a)linux-foundation.org>
9p: fix slab cache name creation for real
Christoph Hellwig <hch(a)lst.de>
mm: add remap_pfn_range_notrack
Alex Zhang <zhangalex(a)google.com>
mm/memory.c: make remap_pfn_range() reject unaligned addr
chenqiwu <chenqiwu(a)xiaomi.com>
mm: fix ambiguous comments for better code readability
WANG Wenhu <wenhu.wang(a)vivo.com>
mm: clarify a confusing comment for remap_pfn_range()
Li Nan <linan122(a)huawei.com>
md/raid10: improve code of mrdev in raid10_sync_request
Reinhard Speyerer <rspmn(a)arcor.de>
net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
Alessandro Zanni <alessandro.zanni87(a)gmail.com>
fs: Fix uninitialized value issue in from_kuid and from_kgid
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/powernv: Free name on error in opal_event_init()
Julian Vetter <jvetter(a)kalrayinc.com>
sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
Rik van Riel <riel(a)surriel.com>
bpf: use kvzmalloc to allocate BPF verifier environment
WangYuli <wangyuli(a)uniontech.com>
HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
Pedro Falcato <pedro.falcato(a)gmail.com>
9p: Avoid creating multiple slab caches with the same name
Jan Schär <jan(a)jschaer.ch>
ALSA: usb-audio: Add endianness annotations
Hyunwoo Kim <v4bel(a)theori.io>
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
Hyunwoo Kim <v4bel(a)theori.io>
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
Zheng Yejian <zhengyejian1(a)huawei.com>
ftrace: Fix possible use-after-free issue in ftrace_location()
Chuck Lever <chuck.lever(a)oracle.com>
NFSD: Fix NFSv4's PUTPUBFH operation
Jan Schär <jan(a)jschaer.ch>
ALSA: usb-audio: Add quirks for Dell WD19 dock
Jan Schär <jan(a)jschaer.ch>
ALSA: usb-audio: Support jack detection on Dell dock
Andrew Kanner <andrew.kanner(a)gmail.com>
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
Marc Zyngier <maz(a)kernel.org>
irqchip/gic-v3: Force propagation of the active state with a read-back
Benoît Monin <benoit.monin(a)gmx.fr>
USB: serial: option: add Quectel RG650V
Reinhard Speyerer <rspmn(a)arcor.de>
USB: serial: option: add Fibocom FG132 0x0112 composition
Jack Wu <wojackbb(a)gmail.com>
USB: serial: qcserial: add support for Sierra Wireless EM86xx
Dan Carpenter <dan.carpenter(a)linaro.org>
USB: serial: io_edgeport: fix use after free in debug printk
Zijun Hu <quic_zijuhu(a)quicinc.com>
usb: musb: sunxi: Fix accessing an released usb phy
Qi Xi <xiqi2(a)huawei.com>
fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
Benoit Sevens <bsevens(a)google.com>
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
Nikolay Aleksandrov <razor(a)blackwall.org>
net: bridge: xmit: make sure we have at least eth header len bytes
Michael Walle <michael(a)walle.cc>
spi: fix use-after-free of the add_lock mutex
Mark Brown <broonie(a)kernel.org>
spi: Fix deadlock when adding SPI controllers on SPI buses
Sean Nyekjaer <sean(a)geanix.com>
mtd: rawnand: protect access to rawnand devices while in suspend
Filipe Manana <fdmanana(a)suse.com>
btrfs: reinitialize delayed ref list after deleting it from the list
Roberto Sassu <roberto.sassu(a)huawei.com>
nfs: Fix KMSAN warning in decode_getfattr_attrs()
Zichen Xie <zichenxie0106(a)gmail.com>
dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
Ming-Hung Tsai <mtsai(a)redhat.com>
dm cache: fix potential out-of-bounds access on the first resume
Ming-Hung Tsai <mtsai(a)redhat.com>
dm cache: optimize dirty bit checking with find_next_bit when resizing
Ming-Hung Tsai <mtsai(a)redhat.com>
dm cache: fix out-of-bounds access to the dirty bitset when resizing
Ming-Hung Tsai <mtsai(a)redhat.com>
dm cache: correct the number of origin blocks to match the target length
Antonio Quartulli <antonio(a)mandelbit.com>
drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
Erik Schumacher <erik.schumacher(a)iris-sensing.com>
pwm: imx-tpm: Use correct MODULO value for EPWM mode
Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
media: v4l2-tpg: prevent the risk of a division by zero
Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
media: cx24116: prevent overflows on SNR calculus
Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
media: s5p-jpeg: prevent buffer overflows
Murad Masimov <m.masimov(a)maxima.ru>
ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
media: adv7604: prevent underflow condition when reporting colorspace
Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
media: dvb_frontend: don't play tricks with underflow values
Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
media: dvbdev: prevent the risk of out of memory access
Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
media: stb0899_algo: initialize cfr before using it
Peiyang Wang <wangpeiyang1(a)huawei.com>
net: hns3: fix kernel crash when uninstalling driver
Dario Binacchi <dario.binacchi(a)amarulasolutions.com>
can: c_can: fix {rx,tx}_errors statistics
Xin Long <lucien.xin(a)gmail.com>
sctp: properly validate chunk size in sctp_sf_ootb()
Wei Fang <wei.fang(a)nxp.com>
net: enetc: set MAC address to the VF net_device
Qinglang Miao <miaoqinglang(a)huawei.com>
enetc: simplify the return expression of enetc_vf_set_mac_addr()
Chen Ridong <chenridong(a)huawei.com>
security/keys: fix slab-out-of-bounds in key_task_permission
Jiri Kosina <jkosina(a)suse.com>
HID: core: zero-initialize the report buffer
Heiko Stuebner <heiko(a)sntech.de>
ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
Heiko Stuebner <heiko(a)sntech.de>
ARM: dts: rockchip: Fix the spi controller on rk3036
Heiko Stuebner <heiko(a)sntech.de>
ARM: dts: rockchip: drop grf reference from rk3036 hdmi
Heiko Stuebner <heiko(a)sntech.de>
ARM: dts: rockchip: fix rk3036 acodec node
Heiko Stuebner <heiko(a)sntech.de>
arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
Heiko Stuebner <heiko(a)sntech.de>
arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
Diederik de Haas <didi.debian(a)cknow.org>
arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
Geert Uytterhoeven <geert+renesas(a)glider.be>
arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/rk3036-kylin.dts | 4 +-
arch/arm/boot/dts/rk3036.dtsi | 14 +-
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +-
arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 -
arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 +-
.../dts/rockchip/rk3399-sapphire-excavator.dts | 2 +-
arch/powerpc/platforms/powernv/opal-irqchip.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
drivers/hid/hid-core.c | 2 +-
drivers/hid/hid-multitouch.c | 5 +
drivers/irqchip/irq-gic-v3.c | 7 +
drivers/md/dm-cache-target.c | 35 ++---
drivers/md/dm-unstripe.c | 4 +-
drivers/md/raid10.c | 23 +--
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 +
drivers/media/dvb-core/dvb_frontend.c | 4 +-
drivers/media/dvb-core/dvbdev.c | 17 ++-
drivers/media/dvb-frontends/cx24116.c | 7 +-
drivers/media/dvb-frontends/stb0899_algo.c | 2 +-
drivers/media/i2c/adv7604.c | 26 ++--
drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 ++-
drivers/media/usb/uvc/uvc_driver.c | 2 +-
drivers/mtd/nand/raw/nand_base.c | 44 +++---
drivers/net/can/c_can/c_can.c | 7 +-
drivers/net/ethernet/freescale/enetc/enetc_vf.c | 2 +
drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/pwm/pwm-imx-tpm.c | 4 +-
drivers/spi/spi.c | 27 ++--
drivers/usb/musb/sunxi.c | 2 -
drivers/usb/serial/io_edgeport.c | 8 +-
drivers/usb/serial/option.c | 6 +
drivers/usb/serial/qcserial.c | 2 +
fs/btrfs/delayed-ref.c | 2 +-
fs/nfs/inode.c | 1 +
fs/nfsd/nfs4xdr.c | 10 +-
fs/ocfs2/file.c | 9 +-
fs/ocfs2/xattr.c | 3 +-
fs/proc/vmcore.c | 9 +-
include/linux/mm.h | 2 +
include/linux/mm_types.h | 4 +-
include/linux/mtd/rawnand.h | 2 +
include/linux/spi/spi.h | 3 +
kernel/bpf/verifier.c | 4 +-
kernel/trace/ftrace.c | 30 ++--
mm/memory.c | 56 ++++---
net/9p/client.c | 12 +-
net/bridge/br_device.c | 5 +
net/sctp/sm_statefuns.c | 2 +-
net/vmw_vsock/hyperv_transport.c | 1 +
net/vmw_vsock/virtio_transport_common.c | 1 +
security/keys/keyring.c | 7 +-
sound/Kconfig | 2 +-
sound/firewire/tascam/amdtp-tascam.c | 2 +-
sound/usb/mixer_quirks.c | 170 +++++++++++++++++++++
57 files changed, 453 insertions(+), 183 deletions(-)
The reference count of the device incremented in device_initialize()
is not decremented properly when device_add() fails. Change
device_unregister() to a put_device() call before returning from the
function to decrement reference count for cleanup. Or it could cause
memory leak.
As comment of device_add() says, 'if device_add() succeeds, you should
call device_del() when you want to get rid of it. If device_add() has
not succeeded, use only put_device() to drop the reference count'.
Found by code review.
Cc: stable(a)vger.kernel.org
Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support")
Signed-off-by: Ma Ke <make24(a)iscas.ac.cn>
---
drivers/phy/tegra/xusb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
index 79d4814d758d..c89df95aa6ca 100644
--- a/drivers/phy/tegra/xusb.c
+++ b/drivers/phy/tegra/xusb.c
@@ -548,16 +548,16 @@ static int tegra_xusb_port_init(struct tegra_xusb_port *port,
err = dev_set_name(&port->dev, "%s-%u", name, index);
if (err < 0)
- goto unregister;
+ goto put_device;
err = device_add(&port->dev);
if (err < 0)
- goto unregister;
+ goto put_device;
return 0;
-unregister:
- device_unregister(&port->dev);
+put_device:
+ put_device(&port->dev);
return err;
}
--
2.25.1
In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the
current CPU at the beginning of the operation is retrieved and used
throughout. However, since neither preemption nor migration are disabled,
it is possible that the operation continues on a different CPU.
If the original CPU is hotunplugged while the acomp_ctx is still in use,
we run into a UAF bug as the resources attached to the acomp_ctx are freed
during hotunplug in zswap_cpu_comp_dead().
The problem was introduced in commit 1ec3b5fe6eec ("mm/zswap: move to use
crypto_acomp API for hardware acceleration") when the switch to the
crypto_acomp API was made. Prior to that, the per-CPU crypto_comp was
retrieved using get_cpu_ptr() which disables preemption and makes sure the
CPU cannot go away from under us. Preemption cannot be disabled with the
crypto_acomp API as a sleepable context is needed.
Commit 8ba2f844f050 ("mm/zswap: change per-cpu mutex and buffer to
per-acomp_ctx") increased the UAF surface area by making the per-CPU
buffers dynamic, adding yet another resource that can be freed from under
zswap compression/decompression by CPU hotunplug.
There are a few ways to fix this:
(a) Add a refcount for acomp_ctx.
(b) Disable migration while using the per-CPU acomp_ctx.
(c) Use SRCU to wait for other CPUs using the acomp_ctx of the CPU being
hotunplugged. Normal RCU cannot be used as a sleepable context is
required.
Implement (c) since it's simpler than (a), and (b) involves using
migrate_disable() which is apparently undesired (see huge comment in
include/linux/preempt.h).
Fixes: 1ec3b5fe6eec ("mm/zswap: move to use crypto_acomp API for hardware acceleration")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Yosry Ahmed <yosryahmed(a)google.com>
Reported-by: Johannes Weiner <hannes(a)cmpxchg.org>
Closes: https://lore.kernel.org/lkml/20241113213007.GB1564047@cmpxchg.org/
Reported-by: Sam Sun <samsun1006219(a)gmail.com>
Closes: https://lore.kernel.org/lkml/CAEkJfYMtSdM5HceNsXUDf5haghD5+o2e7Qv4OcuruL4tP…
---
mm/zswap.c | 31 ++++++++++++++++++++++++++++---
1 file changed, 28 insertions(+), 3 deletions(-)
diff --git a/mm/zswap.c b/mm/zswap.c
index f6316b66fb236..add1406d693b8 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -864,12 +864,22 @@ static int zswap_cpu_comp_prepare(unsigned int cpu, struct hlist_node *node)
return ret;
}
+DEFINE_STATIC_SRCU(acomp_srcu);
+
static int zswap_cpu_comp_dead(unsigned int cpu, struct hlist_node *node)
{
struct zswap_pool *pool = hlist_entry(node, struct zswap_pool, node);
struct crypto_acomp_ctx *acomp_ctx = per_cpu_ptr(pool->acomp_ctx, cpu);
if (!IS_ERR_OR_NULL(acomp_ctx)) {
+ /*
+ * Even though the acomp_ctx should not be currently in use on
+ * @cpu, it may still be used by compress/decompress operations
+ * that started on @cpu and migrated to a different CPU. Wait
+ * for such usages to complete, any news usages would be a bug.
+ */
+ synchronize_srcu(&acomp_srcu);
+
if (!IS_ERR_OR_NULL(acomp_ctx->req))
acomp_request_free(acomp_ctx->req);
if (!IS_ERR_OR_NULL(acomp_ctx->acomp))
@@ -880,6 +890,18 @@ static int zswap_cpu_comp_dead(unsigned int cpu, struct hlist_node *node)
return 0;
}
+static struct crypto_acomp_ctx *acomp_ctx_get_cpu(struct crypto_acomp_ctx __percpu *acomp_ctx,
+ int *srcu_idx)
+{
+ *srcu_idx = srcu_read_lock(&acomp_srcu);
+ return raw_cpu_ptr(acomp_ctx);
+}
+
+static void acomp_ctx_put_cpu(int srcu_idx)
+{
+ srcu_read_unlock(&acomp_srcu, srcu_idx);
+}
+
static bool zswap_compress(struct page *page, struct zswap_entry *entry,
struct zswap_pool *pool)
{
@@ -889,12 +911,12 @@ static bool zswap_compress(struct page *page, struct zswap_entry *entry,
unsigned int dlen = PAGE_SIZE;
unsigned long handle;
struct zpool *zpool;
+ int srcu_idx;
char *buf;
gfp_t gfp;
u8 *dst;
- acomp_ctx = raw_cpu_ptr(pool->acomp_ctx);
-
+ acomp_ctx = acomp_ctx_get_cpu(pool->acomp_ctx, &srcu_idx);
mutex_lock(&acomp_ctx->mutex);
dst = acomp_ctx->buffer;
@@ -950,6 +972,7 @@ static bool zswap_compress(struct page *page, struct zswap_entry *entry,
zswap_reject_alloc_fail++;
mutex_unlock(&acomp_ctx->mutex);
+ acomp_ctx_put_cpu(srcu_idx);
return comp_ret == 0 && alloc_ret == 0;
}
@@ -958,9 +981,10 @@ static void zswap_decompress(struct zswap_entry *entry, struct folio *folio)
struct zpool *zpool = entry->pool->zpool;
struct scatterlist input, output;
struct crypto_acomp_ctx *acomp_ctx;
+ int srcu_idx;
u8 *src;
- acomp_ctx = raw_cpu_ptr(entry->pool->acomp_ctx);
+ acomp_ctx = acomp_ctx_get_cpu(entry->pool->acomp_ctx, &srcu_idx);
mutex_lock(&acomp_ctx->mutex);
src = zpool_map_handle(zpool, entry->handle, ZPOOL_MM_RO);
@@ -990,6 +1014,7 @@ static void zswap_decompress(struct zswap_entry *entry, struct folio *folio)
if (src != acomp_ctx->buffer)
zpool_unmap_handle(zpool, entry->handle);
+ acomp_ctx_put_cpu(srcu_idx);
}
/*********************************
--
2.47.1.613.gc27f4b7a9f-goog