The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x 2e07e8348ea454615e268222ae3fc240421be768
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122844-kilowatt-prorate-bba2@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg")
f4b41f062c42 ("net: remove noblock parameter from skb_recv_datagram()")
42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket")
30ffd5332e06 ("can: isotp: return -EADDRNOTAVAIL when reading from unbound socket")
c5755214623d ("mctp: tests: Add key state tests")
62a2b005c6d6 ("mctp: tests: Rename FL_T macro to FL_TO")
1e5e9250d422 ("mctp: Add input reassembly tests")
8892c0490779 ("mctp: Add route input to socket tests")
b504db408c34 ("mctp: Add packet rx tests")
161eba50e183 ("mctp: Add initial test structure and fragmentation test")
833ef3b91de6 ("mctp: Populate socket implementation")
4d8b9319282a ("mctp: Add neighbour implementation")
889b7da23abf ("mctp: Add initial routing framework")
583be982d934 ("mctp: Add device handling and netlink interface")
60fc63981693 ("mctp: Add sockaddr_mctp to uapi")
2c8e2e9aec79 ("mctp: Add base packet definitions")
8f601a1e4f8c ("mctp: Add base socket/protocol definitions")
bc49d8169aa7 ("mctp: Add MCTP base")
29df44fa52b7 ("af_unix: Implement ->read_sock() for sockmap")
fe0bdbde0756 ("net: add pf_family_names[] for protocol family")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2e07e8348ea454615e268222ae3fc240421be768 Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel(a)theori.io>
Date: Sat, 9 Dec 2023 05:55:18 -0500
Subject: [PATCH] Bluetooth: af_bluetooth: Fix Use-After-Free in
bt_sock_recvmsg
This can cause a race with bt_sock_ioctl() because
bt_sock_recvmsg() gets the skb from sk->sk_receive_queue
and then frees it without holding lock_sock.
A use-after-free for a skb occurs with the following flow.
```
bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
bt_sock_ioctl() -> skb_peek()
```
Add lock_sock to bt_sock_recvmsg() to fix this issue.
Cc: stable(a)vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 336a76165454..b93464ac3517 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -309,11 +309,14 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
if (flags & MSG_OOB)
return -EOPNOTSUPP;
+ lock_sock(sk);
+
skb = skb_recv_datagram(sk, flags, &err);
if (!skb) {
if (sk->sk_shutdown & RCV_SHUTDOWN)
- return 0;
+ err = 0;
+ release_sock(sk);
return err;
}
@@ -343,6 +346,8 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
skb_free_datagram(sk, skb);
+ release_sock(sk);
+
if (flags & MSG_TRUNC)
copied = skblen;
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 2e07e8348ea454615e268222ae3fc240421be768
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122844-parmesan-autism-1891@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg")
f4b41f062c42 ("net: remove noblock parameter from skb_recv_datagram()")
42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket")
30ffd5332e06 ("can: isotp: return -EADDRNOTAVAIL when reading from unbound socket")
c5755214623d ("mctp: tests: Add key state tests")
62a2b005c6d6 ("mctp: tests: Rename FL_T macro to FL_TO")
1e5e9250d422 ("mctp: Add input reassembly tests")
8892c0490779 ("mctp: Add route input to socket tests")
b504db408c34 ("mctp: Add packet rx tests")
161eba50e183 ("mctp: Add initial test structure and fragmentation test")
833ef3b91de6 ("mctp: Populate socket implementation")
4d8b9319282a ("mctp: Add neighbour implementation")
889b7da23abf ("mctp: Add initial routing framework")
583be982d934 ("mctp: Add device handling and netlink interface")
60fc63981693 ("mctp: Add sockaddr_mctp to uapi")
2c8e2e9aec79 ("mctp: Add base packet definitions")
8f601a1e4f8c ("mctp: Add base socket/protocol definitions")
bc49d8169aa7 ("mctp: Add MCTP base")
29df44fa52b7 ("af_unix: Implement ->read_sock() for sockmap")
fe0bdbde0756 ("net: add pf_family_names[] for protocol family")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2e07e8348ea454615e268222ae3fc240421be768 Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel(a)theori.io>
Date: Sat, 9 Dec 2023 05:55:18 -0500
Subject: [PATCH] Bluetooth: af_bluetooth: Fix Use-After-Free in
bt_sock_recvmsg
This can cause a race with bt_sock_ioctl() because
bt_sock_recvmsg() gets the skb from sk->sk_receive_queue
and then frees it without holding lock_sock.
A use-after-free for a skb occurs with the following flow.
```
bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
bt_sock_ioctl() -> skb_peek()
```
Add lock_sock to bt_sock_recvmsg() to fix this issue.
Cc: stable(a)vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 336a76165454..b93464ac3517 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -309,11 +309,14 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
if (flags & MSG_OOB)
return -EOPNOTSUPP;
+ lock_sock(sk);
+
skb = skb_recv_datagram(sk, flags, &err);
if (!skb) {
if (sk->sk_shutdown & RCV_SHUTDOWN)
- return 0;
+ err = 0;
+ release_sock(sk);
return err;
}
@@ -343,6 +346,8 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
skb_free_datagram(sk, skb);
+ release_sock(sk);
+
if (flags & MSG_TRUNC)
copied = skblen;
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 2e07e8348ea454615e268222ae3fc240421be768
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122843-hula-defender-404e@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg")
f4b41f062c42 ("net: remove noblock parameter from skb_recv_datagram()")
42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket")
30ffd5332e06 ("can: isotp: return -EADDRNOTAVAIL when reading from unbound socket")
c5755214623d ("mctp: tests: Add key state tests")
62a2b005c6d6 ("mctp: tests: Rename FL_T macro to FL_TO")
1e5e9250d422 ("mctp: Add input reassembly tests")
8892c0490779 ("mctp: Add route input to socket tests")
b504db408c34 ("mctp: Add packet rx tests")
161eba50e183 ("mctp: Add initial test structure and fragmentation test")
833ef3b91de6 ("mctp: Populate socket implementation")
4d8b9319282a ("mctp: Add neighbour implementation")
889b7da23abf ("mctp: Add initial routing framework")
583be982d934 ("mctp: Add device handling and netlink interface")
60fc63981693 ("mctp: Add sockaddr_mctp to uapi")
2c8e2e9aec79 ("mctp: Add base packet definitions")
8f601a1e4f8c ("mctp: Add base socket/protocol definitions")
bc49d8169aa7 ("mctp: Add MCTP base")
29df44fa52b7 ("af_unix: Implement ->read_sock() for sockmap")
fe0bdbde0756 ("net: add pf_family_names[] for protocol family")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2e07e8348ea454615e268222ae3fc240421be768 Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel(a)theori.io>
Date: Sat, 9 Dec 2023 05:55:18 -0500
Subject: [PATCH] Bluetooth: af_bluetooth: Fix Use-After-Free in
bt_sock_recvmsg
This can cause a race with bt_sock_ioctl() because
bt_sock_recvmsg() gets the skb from sk->sk_receive_queue
and then frees it without holding lock_sock.
A use-after-free for a skb occurs with the following flow.
```
bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
bt_sock_ioctl() -> skb_peek()
```
Add lock_sock to bt_sock_recvmsg() to fix this issue.
Cc: stable(a)vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 336a76165454..b93464ac3517 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -309,11 +309,14 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
if (flags & MSG_OOB)
return -EOPNOTSUPP;
+ lock_sock(sk);
+
skb = skb_recv_datagram(sk, flags, &err);
if (!skb) {
if (sk->sk_shutdown & RCV_SHUTDOWN)
- return 0;
+ err = 0;
+ release_sock(sk);
return err;
}
@@ -343,6 +346,8 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
skb_free_datagram(sk, skb);
+ release_sock(sk);
+
if (flags & MSG_TRUNC)
copied = skblen;
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 2e07e8348ea454615e268222ae3fc240421be768
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122842-probation-retiree-3f3d@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg")
f4b41f062c42 ("net: remove noblock parameter from skb_recv_datagram()")
42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket")
30ffd5332e06 ("can: isotp: return -EADDRNOTAVAIL when reading from unbound socket")
c5755214623d ("mctp: tests: Add key state tests")
62a2b005c6d6 ("mctp: tests: Rename FL_T macro to FL_TO")
1e5e9250d422 ("mctp: Add input reassembly tests")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2e07e8348ea454615e268222ae3fc240421be768 Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel(a)theori.io>
Date: Sat, 9 Dec 2023 05:55:18 -0500
Subject: [PATCH] Bluetooth: af_bluetooth: Fix Use-After-Free in
bt_sock_recvmsg
This can cause a race with bt_sock_ioctl() because
bt_sock_recvmsg() gets the skb from sk->sk_receive_queue
and then frees it without holding lock_sock.
A use-after-free for a skb occurs with the following flow.
```
bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
bt_sock_ioctl() -> skb_peek()
```
Add lock_sock to bt_sock_recvmsg() to fix this issue.
Cc: stable(a)vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 336a76165454..b93464ac3517 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -309,11 +309,14 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
if (flags & MSG_OOB)
return -EOPNOTSUPP;
+ lock_sock(sk);
+
skb = skb_recv_datagram(sk, flags, &err);
if (!skb) {
if (sk->sk_shutdown & RCV_SHUTDOWN)
- return 0;
+ err = 0;
+ release_sock(sk);
return err;
}
@@ -343,6 +346,8 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
skb_free_datagram(sk, skb);
+ release_sock(sk);
+
if (flags & MSG_TRUNC)
copied = skblen;
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 0dfc852b6fe3cbecbea67332a0dce2bebeba540d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122844-pellet-sharpie-7d33@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
0dfc852b6fe3 ("eventfs: Have event files and directories default to parent uid and gid")
28e12c09f5aa ("eventfs: Save ownership and mode")
db3a397209b0 ("eventfs: Have a free_ei() that just frees the eventfs_inode")
5790b1fb3d67 ("eventfs: Remove eventfs_file and just use eventfs_inode")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 0dfc852b6fe3cbecbea67332a0dce2bebeba540d Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
Date: Wed, 20 Dec 2023 10:50:17 -0500
Subject: [PATCH] eventfs: Have event files and directories default to parent
uid and gid
Dongliang reported:
I found that in the latest version, the nodes of tracefs have been
changed to dynamically created.
This has caused me to encounter a problem where the gid I specified in
the mounting parameters cannot apply to all files, as in the following
situation:
/data/tmp/events # mount | grep tracefs
tracefs on /data/tmp type tracefs (rw,seclabel,relatime,gid=3012)
gid 3012 = readtracefs
/data/tmp # ls -lh
total 0
-r--r----- 1 root readtracefs 0 1970-01-01 08:00 README
-r--r----- 1 root readtracefs 0 1970-01-01 08:00 available_events
ums9621_1h10:/data/tmp/events # ls -lh
total 0
drwxr-xr-x 2 root root 0 2023-12-19 00:56 alarmtimer
drwxr-xr-x 2 root root 0 2023-12-19 00:56 asoc
It will prevent certain applications from accessing tracefs properly, I
try to avoid this issue by making the following modifications.
To fix this, have the files created default to taking the ownership of
the parent dentry unless the ownership was previously set by the user.
Link: https://lore.kernel.org/linux-trace-kernel/1703063706-30539-1-git-send-emai…
Link: https://lore.kernel.org/linux-trace-kernel/20231220105017.1489d790@gandalf.…
Cc: stable(a)vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Cc: Hongyu Jin <hongyu.jin(a)unisoc.com>
Fixes: 28e12c09f5aa0 ("eventfs: Save ownership and mode")
Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
Reported-by: Dongliang Cui <cuidongliang390(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 43e237864a42..2ccc849a5bda 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -148,7 +148,8 @@ static const struct file_operations eventfs_file_operations = {
.release = eventfs_release,
};
-static void update_inode_attr(struct inode *inode, struct eventfs_attr *attr, umode_t mode)
+static void update_inode_attr(struct dentry *dentry, struct inode *inode,
+ struct eventfs_attr *attr, umode_t mode)
{
if (!attr) {
inode->i_mode = mode;
@@ -162,9 +163,13 @@ static void update_inode_attr(struct inode *inode, struct eventfs_attr *attr, um
if (attr->mode & EVENTFS_SAVE_UID)
inode->i_uid = attr->uid;
+ else
+ inode->i_uid = d_inode(dentry->d_parent)->i_uid;
if (attr->mode & EVENTFS_SAVE_GID)
inode->i_gid = attr->gid;
+ else
+ inode->i_gid = d_inode(dentry->d_parent)->i_gid;
}
/**
@@ -206,7 +211,7 @@ static struct dentry *create_file(const char *name, umode_t mode,
return eventfs_failed_creating(dentry);
/* If the user updated the directory's attributes, use them */
- update_inode_attr(inode, attr, mode);
+ update_inode_attr(dentry, inode, attr, mode);
inode->i_op = &eventfs_file_inode_operations;
inode->i_fop = fop;
@@ -242,7 +247,8 @@ static struct dentry *create_dir(struct eventfs_inode *ei, struct dentry *parent
return eventfs_failed_creating(dentry);
/* If the user updated the directory's attributes, use them */
- update_inode_attr(inode, &ei->attr, S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO);
+ update_inode_attr(dentry, inode, &ei->attr,
+ S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO);
inode->i_op = &eventfs_root_dir_inode_operations;
inode->i_fop = &eventfs_file_operations;
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122846-barricade-obtain-7302@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
9b6a51aab5f5 ("ARM: dts: Fix occasional boot hang for am3 usb")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony(a)atomide.com>
Date: Tue, 12 Dec 2023 15:50:35 +0200
Subject: [PATCH] ARM: dts: Fix occasional boot hang for am3 usb
With subtle timings changes, we can now sometimes get an external abort on
non-linefetch error booting am3 devices at sysc_reset(). This is because
of a missing reset delay needed for the usb target module.
Looks like we never enabled the delay earlier for am3, although a similar
issue was seen earlier with a similar usb setup for dm814x as described in
commit ebf244148092 ("ARM: OMAP2+: Use srst_udelay for USB on dm814x").
Cc: stable(a)vger.kernel.org
Fixes: 0782e8572ce4 ("ARM: dts: Probe am335x musb with ti-sysc")
Signed-off-by: Tony Lindgren <tony(a)atomide.com>
diff --git a/arch/arm/boot/dts/ti/omap/am33xx.dtsi b/arch/arm/boot/dts/ti/omap/am33xx.dtsi
index 1a2cd5baf402..5b9e01a8aa5d 100644
--- a/arch/arm/boot/dts/ti/omap/am33xx.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am33xx.dtsi
@@ -359,6 +359,7 @@ usb: target-module@47400000 {
<SYSC_IDLE_NO>,
<SYSC_IDLE_SMART>,
<SYSC_IDLE_SMART_WKUP>;
+ ti,sysc-delay-us = <2>;
clocks = <&l3s_clkctrl AM3_L3S_USB_OTG_HS_CLKCTRL 0>;
clock-names = "fck";
#address-cells = <1>;
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122845-curling-strainer-cd1a@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
9b6a51aab5f5 ("ARM: dts: Fix occasional boot hang for am3 usb")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony(a)atomide.com>
Date: Tue, 12 Dec 2023 15:50:35 +0200
Subject: [PATCH] ARM: dts: Fix occasional boot hang for am3 usb
With subtle timings changes, we can now sometimes get an external abort on
non-linefetch error booting am3 devices at sysc_reset(). This is because
of a missing reset delay needed for the usb target module.
Looks like we never enabled the delay earlier for am3, although a similar
issue was seen earlier with a similar usb setup for dm814x as described in
commit ebf244148092 ("ARM: OMAP2+: Use srst_udelay for USB on dm814x").
Cc: stable(a)vger.kernel.org
Fixes: 0782e8572ce4 ("ARM: dts: Probe am335x musb with ti-sysc")
Signed-off-by: Tony Lindgren <tony(a)atomide.com>
diff --git a/arch/arm/boot/dts/ti/omap/am33xx.dtsi b/arch/arm/boot/dts/ti/omap/am33xx.dtsi
index 1a2cd5baf402..5b9e01a8aa5d 100644
--- a/arch/arm/boot/dts/ti/omap/am33xx.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am33xx.dtsi
@@ -359,6 +359,7 @@ usb: target-module@47400000 {
<SYSC_IDLE_NO>,
<SYSC_IDLE_SMART>,
<SYSC_IDLE_SMART_WKUP>;
+ ti,sysc-delay-us = <2>;
clocks = <&l3s_clkctrl AM3_L3S_USB_OTG_HS_CLKCTRL 0>;
clock-names = "fck";
#address-cells = <1>;
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023122844-impending-deceiving-5f9d@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
9b6a51aab5f5 ("ARM: dts: Fix occasional boot hang for am3 usb")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony(a)atomide.com>
Date: Tue, 12 Dec 2023 15:50:35 +0200
Subject: [PATCH] ARM: dts: Fix occasional boot hang for am3 usb
With subtle timings changes, we can now sometimes get an external abort on
non-linefetch error booting am3 devices at sysc_reset(). This is because
of a missing reset delay needed for the usb target module.
Looks like we never enabled the delay earlier for am3, although a similar
issue was seen earlier with a similar usb setup for dm814x as described in
commit ebf244148092 ("ARM: OMAP2+: Use srst_udelay for USB on dm814x").
Cc: stable(a)vger.kernel.org
Fixes: 0782e8572ce4 ("ARM: dts: Probe am335x musb with ti-sysc")
Signed-off-by: Tony Lindgren <tony(a)atomide.com>
diff --git a/arch/arm/boot/dts/ti/omap/am33xx.dtsi b/arch/arm/boot/dts/ti/omap/am33xx.dtsi
index 1a2cd5baf402..5b9e01a8aa5d 100644
--- a/arch/arm/boot/dts/ti/omap/am33xx.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am33xx.dtsi
@@ -359,6 +359,7 @@ usb: target-module@47400000 {
<SYSC_IDLE_NO>,
<SYSC_IDLE_SMART>,
<SYSC_IDLE_SMART_WKUP>;
+ ti,sysc-delay-us = <2>;
clocks = <&l3s_clkctrl AM3_L3S_USB_OTG_HS_CLKCTRL 0>;
clock-names = "fck";
#address-cells = <1>;
Starting v6.5, Bluetooth does not work at all on my T2
MacBookAir9,1 with the BCM4377 chip. When I boot up the computer,
go into bluetoothctl, and then try to run commands like scan on,
show, list, it returns "No default controller available." I have
tried reloading the kernel module, in which the log outputs
"{Added,Removed} hci0 (unconfigured)." With this patch, I
am able to use Bluetooth as normal without any errors regarding
hci0 being unconfigured. However, an issue is still present
where sometimes hci_bcm4377 will have to be reloaded in order to
get bluetooth to work. I believe this was still present before
the previously mentioned commit.
I would also like to thank Kerem Karabay <kekrby(a)gmail.com> for
assisting me with this patch.
Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Felix Zhang <mrman(a)mrman314.tech>
---
v4:
* Adjust the format to pass the CI (again).
* Shorten description
---
drivers/bluetooth/hci_bcm4377.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_bcm4377.c
b/drivers/bluetooth/hci_bcm4377.c
index a61757835695..5c6fef1aa0f6 100644
--- a/drivers/bluetooth/hci_bcm4377.c
+++ b/drivers/bluetooth/hci_bcm4377.c
@@ -513,6 +513,7 @@ struct bcm4377_hw {
unsigned long broken_ext_scan : 1;
unsigned long broken_mws_transport_config : 1;
unsigned long broken_le_coded : 1;
+ unsigned long use_bdaddr_property : 1;
int (*send_calibration)(struct bcm4377_data *bcm4377);
int (*send_ptb)(struct bcm4377_data *bcm4377,
@@ -2368,5 +2369,6 @@ static int bcm4377_probe(struct pci_dev *pdev,
const struct pci_device_id *id)
hdev->set_bdaddr = bcm4377_hci_set_bdaddr;
hdev->setup = bcm4377_hci_setup;
- set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+ if (bcm4377->hw->use_bdaddr_property)
+ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
if (bcm4377->hw->broken_mws_transport_config)
@@ -2465,6 +2467,7 @@ static const struct bcm4377_hw
bcm4377_hw_variants[] = {
.has_bar0_core2_window2 = true,
.broken_mws_transport_config = true,
.broken_le_coded = true,
+ .use_bdaddr_property = true,
.send_calibration = bcm4378_send_calibration,
.send_ptb = bcm4378_send_ptb,
},
@@ -2479,6 +2482,7 @@ static const struct bcm4377_hw
bcm4377_hw_variants[] = {
.clear_pciecfg_subsystem_ctrl_bit19 = true,
.broken_mws_transport_config = true,
.broken_le_coded = true,
+ .use_bdaddr_property = true,
.send_calibration = bcm4387_send_calibration,
.send_ptb = bcm4378_send_ptb,
},
--
2.43.0
Starting v6.5, Bluetooth does not work at all on my T2 MacBookAir9,1
with the BCM4377 chip. When I boot up the computer, go into
bluetoothctl, and then try to run commands like scan on, show, list,
it returns "No default controller available." I have tried reloading
the
kernel module, in which the log outputs "{Added,Removed} hci0
(unconfigured)." With this patch, I am able to use Bluetooth as
normal
without any errors regarding hci0 being unconfigured. However, an
issue is still present where sometimes hci_bcm4377 will have to be
reloaded in order to get bluetooth to work. I believe this was still
present before the previously mentioned commit.
Due to the bit HCI_QUIRK_USE_BDADDR_PROPERTY being always set in
drivers/bluetooth/hci_bcm4377.c (line 2371), the chip would be left
unconfigured on kernels compiled after commit 6945795bc81a
("Bluetooth:
fix use-bdaddr-property quirk") due to a change in its logic. On the
M1 Macs, the device would be configured in the devicetree. However,
that is not the case on T2 Macs. Because the bluetooth adapter is
left
unconfigured, it is not usable in the operating system. In order to
circumvent this issue, a flag is added to prevent the bit from being
set on the BCM4377, while setting it on the other devices.
Because I do not have an M1 device to test this patch on, I am not sure
whether the patch breaks anything for said devices. I would be very
grateful if anyone is willing to test this patch on their M1 device.
I would also like to thank Kerem Karabay <kekrby(a)gmail.com> for
assisting me with this patch.
Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk")
Signed-off-by: Felix Zhang <mrman(a)mrman314.tech>
---
v3:
* Adjust the format to pass the CI (again).
---
drivers/bluetooth/hci_bcm4377.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_bcm4377.c
b/drivers/bluetooth/hci_bcm4377.c
index a61757835695..5c6fef1aa0f6 100644
--- a/drivers/bluetooth/hci_bcm4377.c
+++ b/drivers/bluetooth/hci_bcm4377.c
@@ -513,6 +513,7 @@ struct bcm4377_hw {
unsigned long broken_ext_scan : 1;
unsigned long broken_mws_transport_config : 1;
unsigned long broken_le_coded : 1;
+ unsigned long use_bdaddr_property : 1;
int (*send_calibration)(struct bcm4377_data *bcm4377);
int (*send_ptb)(struct bcm4377_data *bcm4377,
@@ -2368,7 +2369,8 @@ static int bcm4377_probe(struct pci_dev *pdev,
const struct pci_device_id *id)
hdev->set_bdaddr = bcm4377_hci_set_bdaddr;
hdev->setup = bcm4377_hci_setup;
- set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+ if (bcm4377->hw->use_bdaddr_property)
+ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
if (bcm4377->hw->broken_mws_transport_config)
set_bit(HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG, &hdev-
>quirks);
if (bcm4377->hw->broken_ext_scan)
@@ -2465,6 +2467,7 @@ static const struct bcm4377_hw
bcm4377_hw_variants[] = {
.has_bar0_core2_window2 = true,
.broken_mws_transport_config = true,
.broken_le_coded = true,
+ .use_bdaddr_property = true,
.send_calibration = bcm4378_send_calibration,
.send_ptb = bcm4378_send_ptb,
},
@@ -2479,6 +2482,7 @@ static const struct bcm4377_hw
bcm4377_hw_variants[] = {
.clear_pciecfg_subsystem_ctrl_bit19 = true,
.broken_mws_transport_config = true,
.broken_le_coded = true,
+ .use_bdaddr_property = true,
.send_calibration = bcm4387_send_calibration,
.send_ptb = bcm4378_send_ptb,
},
--
2.43.0
Some ioctl commands do not require ioctl permission, but are routed to
other permissions such as FILE_GETATTR or FILE_SETATTR. This routing is
done by comparing the ioctl cmd to a set of 64-bit flags (FS_IOC_*).
However, if a 32-bit process is running on a 64-bit kernel, it emmits
32-bit flags (FS_IOC32_*) for certain ioctl operations. These flags are
being checked erroneoulsy, which leads to these ioctl operations being
routed to the ioctl permission, rather than the correct file permissions.
Two possible solutions exist:
- Trim parameter "cmd" to a u16 so that only the last two bytes are
checked in the case statement.
- Explicitily add the FS_IOC32_* codes to the case statement.
Solution 2 was chosen because it is a minimal explicit change. Solution
1 is a more elegant change, but is less explicit, as the switch
statement appears to only check the FS_IOC_* codes upon first reading.
Fixes: 0b24dcb7f2f7 ("Revert "selinux: simplify ioctl checking"")
Signed-off-by: Alfred Piccioni <alpic(a)google.com>
---
security/selinux/hooks.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d06e350fedee..bba83f437a1d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3644,11 +3644,15 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
case FIGETBSZ:
case FS_IOC_GETFLAGS:
case FS_IOC_GETVERSION:
+ case FS_IOC32_GETFLAGS:
+ case FS_IOC32_GETVERSION:
error = file_has_perm(cred, file, FILE__GETATTR);
break;
case FS_IOC_SETFLAGS:
case FS_IOC_SETVERSION:
+ case FS_IOC32_SETFLAGS:
+ case FS_IOC32_SETVERSION:
error = file_has_perm(cred, file, FILE__SETATTR);
break;
base-commit: 50a510a78287c15cee644f345ef8bac8977986a7
--
2.42.0.283.g2d96d420d3-goog
From: José Pekkarinen <jose.pekkarinen(a)foxhound.fi>
[ Upstream commit c1f342f35f820b33390571293498c3e2e9bc77ec ]
Observed on dmesg of my laptop I see the following
output:
[ 19.898700] psmouse serio1: synaptics: queried max coordinates: x [..5678], y [..4694]
[ 19.936057] psmouse serio1: synaptics: queried min coordinates: x [1266..], y [1162..]
[ 19.936076] psmouse serio1: synaptics: Your touchpad (PNP: LEN0411 PNP0f13) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input(a)vger.kernel.org.
[ 20.008901] psmouse serio1: synaptics: Touchpad model: 1, fw: 10.32, id: 0x1e2a1, caps: 0xf014a3/0x940300/0x12e800/0x500000, board id: 3471, fw id: 2909640
[ 20.008925] psmouse serio1: synaptics: serio: Synaptics pass-through port at isa0060/serio1/input0
[ 20.053344] input: SynPS/2 Synaptics TouchPad as /devices/platform/i8042/serio1/input/input7
[ 20.397608] mousedev: PS/2 mouse device common for all mice
This patch will add its pnp id to the smbus list to
produce the setup of intertouch for the device.
Signed-off-by: José Pekkarinen <jose.pekkarinen(a)foxhound.fi>
Link: https://lore.kernel.org/r/20231114063607.71772-1-jose.pekkarinen@foxhound.fi
Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/input/mouse/synaptics.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 22d16d80efb93..7a303a9d6bf72 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -183,6 +183,7 @@ static const char * const smbus_pnp_ids[] = {
"LEN009b", /* T580 */
"LEN0402", /* X1 Extreme Gen 2 / P1 Gen 2 */
"LEN040f", /* P1 Gen 3 */
+ "LEN0411", /* L14 Gen 1 */
"LEN200f", /* T450s */
"LEN2044", /* L470 */
"LEN2054", /* E480 */
--
2.43.0
The drivers RS485 support is deactivated if there is no RTS GPIO available.
This is done by nullifying the ports rs485_supported struct. After that
however the settings in serial_omap_rs485_supported are assigned to the
same structure unconditionally, which results in an unintended reactivation
of RS485 support.
Fix this by moving the assignment to the beginning of
serial_omap_probe_rs485() and thus before uart_get_rs485_mode() gets
called.
Also replace the assignment of rs485_config() to have the complete RS485
setup in one function.
Fixes: e2752ae3cfc9 ("serial: omap: Disallow RS-485 if rts-gpio is not specified")
Cc: stable(a)vger.kernel.org
Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
---
drivers/tty/serial/omap-serial.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index ad4c1c5d0a7f..b563c109caa9 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -1497,6 +1497,9 @@ static int serial_omap_probe_rs485(struct uart_omap_port *up,
if (!np)
return 0;
+ up->port.rs485_config = serial_omap_config_rs485;
+ up->port.rs485_supported = serial_omap_rs485_supported;
+
ret = uart_get_rs485_mode(&up->port);
if (ret)
return ret;
@@ -1604,17 +1607,11 @@ static int serial_omap_probe(struct platform_device *pdev)
dev_info(up->port.dev, "no wakeirq for uart%d\n",
up->port.line);
- ret = serial_omap_probe_rs485(up, &pdev->dev);
- if (ret < 0)
- goto err_rs485;
-
sprintf(up->name, "OMAP UART%d", up->port.line);
up->port.mapbase = mem->start;
up->port.membase = base;
up->port.flags = omap_up_info->flags;
up->port.uartclk = omap_up_info->uartclk;
- up->port.rs485_config = serial_omap_config_rs485;
- up->port.rs485_supported = serial_omap_rs485_supported;
if (!up->port.uartclk) {
up->port.uartclk = DEFAULT_CLK_SPEED;
dev_warn(&pdev->dev,
@@ -1622,6 +1619,10 @@ static int serial_omap_probe(struct platform_device *pdev)
DEFAULT_CLK_SPEED);
}
+ ret = serial_omap_probe_rs485(up, &pdev->dev);
+ if (ret < 0)
+ goto err_rs485;
+
up->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
up->calc_latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
cpu_latency_qos_add_request(&up->pm_qos_request, up->latency);
--
2.43.0
Accesses to ctx->s_frame.width and ctx->s_frame.height should be protected
by the lock fimc->lock to guarantee that width and height are consistent.
Here is an example in fimc_subdev_get_fmt():
struct fimc_frame *ff = &ctx->s_frame; // Alias
mutex_lock(&fimc->lock);
mf->width = ff->width;
mf->height = ff->height;
However, ctx->s_frame.width and ctx->s_frame.height are accessed without
holding the lock fimc->lock in fimc_subdev_set_fmt():
mf->width = ctx->s_frame.width;
mf->height = ctx->s_frame.height;
And thus a harmful data race can occur, which can make ctx->s_frame.width
inconsistent with ctx->s_frame.height, if ctx->s_frame.height is updated
right after ctx->s_frame.width is accessed by another thread.
This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.
To fix this possible data race, the lock operation mutex_lock(&fimc->lock)
is moved to the front of the accesses to these two variables. With this
patch applied, our tool no longer reports the bug, with the kernel
configuration allyesconfig for x86_64. Due to the lack of associated
hardware, we cannot test the patch in runtime testing, and just verify it
according to the code logic.
[1] https://sites.google.com/view/basscheck/
Fixes: 88fa8311ee36 ("[media] s5p-fimc: Add support for ISP Writeback ...")
Signed-off-by: Tuo Li <islituo(a)gmail.com>
Cc: stable(a)vger.kernel.org
Reported-by: BassCheck <bass(a)buaa.edu.cn>
---
drivers/media/platform/samsung/exynos4-is/fimc-capture.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-capture.c b/drivers/media/platform/samsung/exynos4-is/fimc-capture.c
index a0d43bf892e6..5c8b67f92c65 100644
--- a/drivers/media/platform/samsung/exynos4-is/fimc-capture.c
+++ b/drivers/media/platform/samsung/exynos4-is/fimc-capture.c
@@ -1546,6 +1546,7 @@ static int fimc_subdev_set_fmt(struct v4l2_subdev *sd,
fimc_alpha_ctrl_update(ctx);
fimc_capture_mark_jpeg_xfer(ctx, ffmt->color);
+ mutex_lock(&fimc->lock);
if (fmt->pad == FIMC_SD_PAD_SOURCE) {
ff = &ctx->d_frame;
/* Sink pads crop rectangle size */
@@ -1555,7 +1556,6 @@ static int fimc_subdev_set_fmt(struct v4l2_subdev *sd,
ff = &ctx->s_frame;
}
- mutex_lock(&fimc->lock);
set_frame_bounds(ff, mf->width, mf->height);
if (fmt->pad == FIMC_SD_PAD_SINK_FIFO)
--
2.34.1
The UART supports an auto-RTS mode in which the RTS pin is automatically
activated during transmission. So mark this mode as being supported even
if RTS is not controlled by the driver but the UART.
Also the serial core expects now at least one of both modes rts-on-send or
rts-after-send to be supported. This is since during sanitization
unsupported flags are deleted from a RS485 configuration set by userspace.
However if the configuration ends up with both flags unset, the core prints
a warning since it considers such a configuration invalid (see
uart_sanitize_serial_rs485()).
Cc: stable(a)vger.kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
---
drivers/tty/serial/8250/8250_exar.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
index 6085d356ad86..23366f868ae3 100644
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -480,7 +480,7 @@ static int sealevel_rs485_config(struct uart_port *port, struct ktermios *termio
}
static const struct serial_rs485 generic_rs485_supported = {
- .flags = SER_RS485_ENABLED,
+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND,
};
static const struct exar8250_platform exar8250_default_platform = {
@@ -524,7 +524,8 @@ static int iot2040_rs485_config(struct uart_port *port, struct ktermios *termios
}
static const struct serial_rs485 iot2040_rs485_supported = {
- .flags = SER_RS485_ENABLED | SER_RS485_RX_DURING_TX | SER_RS485_TERMINATE_BUS,
+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND |
+ SER_RS485_RX_DURING_TX | SER_RS485_TERMINATE_BUS,
};
static const struct property_entry iot2040_gpio_properties[] = {
--
2.43.0
If the imx driver cannot support RS485 it nullifies the ports
rs485_supported structure. But it still calls uart_get_rs485_mode() which
may set the RS485_ENABLED flag nevertheless.
This may lead to an attempt to configure RS485 even if it is not supported
when the flag is evaluated in uart_configure_port() at port startup.
Avoid this by bailing out of uart_get_rs485_mode() if the RS485_ENABLED
flag is not supported by the caller.
With this fix a check for RTS availability is now obsolete in the imx
driver, since it can not evaluate to true any more. So remove this check.
Furthermore the explicit nullifcation of rs485_supported is not needed,
since the memory has already been set to zeros at allocation. So remove
this, too.
Fixes: 00d7a00e2a6f ("serial: imx: Fill in rs485_supported")
Cc: Shawn Guo <shawnguo(a)kernel.org>
Cc: Sascha Hauer <s.hauer(a)pengutronix.de>
Cc: stable(a)vger.kernel.org
Suggested-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
---
drivers/tty/serial/imx.c | 7 -------
drivers/tty/serial/serial_core.c | 3 +++
2 files changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 9cffeb23112b..198ce7e7bc8b 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2206,7 +2206,6 @@ static enum hrtimer_restart imx_trigger_stop_tx(struct hrtimer *t)
return HRTIMER_NORESTART;
}
-static const struct serial_rs485 imx_no_rs485 = {}; /* No RS485 if no RTS */
static const struct serial_rs485 imx_rs485_supported = {
.flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND |
SER_RS485_RX_DURING_TX,
@@ -2290,8 +2289,6 @@ static int imx_uart_probe(struct platform_device *pdev)
/* RTS is required to control the RS485 transmitter */
if (sport->have_rtscts || sport->have_rtsgpio)
sport->port.rs485_supported = imx_rs485_supported;
- else
- sport->port.rs485_supported = imx_no_rs485;
sport->port.flags = UPF_BOOT_AUTOCONF;
timer_setup(&sport->timer, imx_uart_timeout, 0);
@@ -2328,10 +2325,6 @@ static int imx_uart_probe(struct platform_device *pdev)
return ret;
}
- if (sport->port.rs485.flags & SER_RS485_ENABLED &&
- (!sport->have_rtscts && !sport->have_rtsgpio))
- dev_err(&pdev->dev, "no RTS control, disabling rs485\n");
-
/*
* If using the i.MX UART RTS/CTS control then the RTS (CTS_B)
* signal cannot be set low during transmission in case the
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 28bcbc686c67..93e4e1693601 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -3600,6 +3600,9 @@ int uart_get_rs485_mode(struct uart_port *port)
u32 rs485_delay[2];
int ret;
+ if (!(port->rs485_supported.flags & SER_RS485_ENABLED))
+ return 0;
+
ret = device_property_read_u32_array(dev, "rs485-rts-delay",
rs485_delay, 2);
if (!ret) {
--
2.43.0
Some uart drivers specify a rs485_config() function and then decide later
to disable RS485 support for some reason (e.g. imx and ar933).
In these cases userspace may be able to activate RS485 via TIOCSRS485
nevertheless, since in uart_set_rs485_config() an existing rs485_config()
function indicates that RS485 is supported.
Make sure that this is not longer possible by checking the uarts
rs485_supported.flags instead and bailing out if SER_RS485_ENABLED is not
set.
Furthermore instead of returning an empty structure return -ENOTTY if the
RS485 configuration is requested via TIOCGRS485 but RS485 is not supported.
This has a small impact on userspace visibility but it is consistent with
the -ENOTTY error for TIOCGRS485.
Fixes: e849145e1fdd ("serial: ar933x: Fill in rs485_supported")
Fixes: 55e18c6b6d42 ("serial: imx: Remove serial_rs485 sanitization")
Cc: Shawn Guo <shawnguo(a)kernel.org>
Cc: Sascha Hauer <s.hauer(a)pengutronix.de>
Cc: stable(a)vger.kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
---
drivers/tty/serial/serial_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index f67fb6a04983..28bcbc686c67 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1469,7 +1469,7 @@ static int uart_set_rs485_config(struct tty_struct *tty, struct uart_port *port,
int ret;
unsigned long flags;
- if (!port->rs485_config)
+ if (!(port->rs485_supported.flags & SER_RS485_ENABLED))
return -ENOTTY;
if (copy_from_user(&rs485, rs485_user, sizeof(*rs485_user)))
--
2.43.0
Among other things uart_sanitize_serial_rs485() tests the sanity of the RTS
settings in a RS485 configuration that has been passed by userspace.
If RTS-on-send and RTS-after-send are both set or unset the configuration
is adjusted and RTS-after-send is disabled and RTS-on-send enabled.
This however makes only sense if both RTS modes are actually supported by
the driver.
With commit be2e2cb1d281 ("serial: Sanitize rs485_struct") the code does
take the driver support into account but only checks if one of both RTS
modes are supported. This may lead to the errorneous result of RTS-on-send
being set even if only RTS-after-send is supported.
Fix this by changing the implemented logic: First clear all unsupported
flags in the RS485 configuration, then adjust an invalid RTS setting by
taking into account which RTS mode is supported.
Cc: stable(a)vger.kernel.org
Fixes: be2e2cb1d281 ("serial: Sanitize rs485_struct")
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
---
drivers/tty/serial/serial_core.c | 28 ++++++++++++++++++----------
1 file changed, 18 insertions(+), 10 deletions(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 1204102d7162..f67fb6a04983 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1371,19 +1371,27 @@ static void uart_sanitize_serial_rs485(struct uart_port *port, struct serial_rs4
return;
}
+ rs485->flags &= supported_flags;
+
/* Pick sane settings if the user hasn't */
- if ((supported_flags & (SER_RS485_RTS_ON_SEND|SER_RS485_RTS_AFTER_SEND)) &&
- !(rs485->flags & SER_RS485_RTS_ON_SEND) ==
+ if (!(rs485->flags & SER_RS485_RTS_ON_SEND) ==
!(rs485->flags & SER_RS485_RTS_AFTER_SEND)) {
- dev_warn_ratelimited(port->dev,
- "%s (%d): invalid RTS setting, using RTS_ON_SEND instead\n",
- port->name, port->line);
- rs485->flags |= SER_RS485_RTS_ON_SEND;
- rs485->flags &= ~SER_RS485_RTS_AFTER_SEND;
- supported_flags |= SER_RS485_RTS_ON_SEND|SER_RS485_RTS_AFTER_SEND;
- }
+ if (supported_flags & SER_RS485_RTS_ON_SEND) {
+ rs485->flags |= SER_RS485_RTS_ON_SEND;
+ rs485->flags &= ~SER_RS485_RTS_AFTER_SEND;
- rs485->flags &= supported_flags;
+ dev_warn_ratelimited(port->dev,
+ "%s (%d): invalid RTS setting, using RTS_ON_SEND instead\n",
+ port->name, port->line);
+ } else {
+ rs485->flags |= SER_RS485_RTS_AFTER_SEND;
+ rs485->flags &= ~SER_RS485_RTS_ON_SEND;
+
+ dev_warn_ratelimited(port->dev,
+ "%s (%d): invalid RTS setting, using RTS_AFTER_SEND instead\n",
+ port->name, port->line);
+ }
+ }
uart_sanitize_serial_rs485_delays(port, rs485);
--
2.43.0
If the RS485 feature RX-during-TX is supported by means of a GPIO set the
according supported flag. Otherwise setting this feature from userspace may
not be possible, since in uart_sanitize_serial_rs485() the passed RS485
configuration is matched against the supported features and unsupported
settings are thereby removed and thus take no effect.
Cc: stable(a)vger.kernel.org
Fixes: 163f080eb717 ("serial: core: Add option to output RS485 RX_DURING_TX state via GPIO")
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
---
drivers/tty/serial/serial_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index d155131f221d..1204102d7162 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -3642,6 +3642,8 @@ int uart_get_rs485_mode(struct uart_port *port)
if (IS_ERR(desc))
return dev_err_probe(dev, PTR_ERR(desc), "Cannot get rs485-rx-during-tx-gpios\n");
port->rs485_rx_during_tx_gpio = desc;
+ if (port->rs485_rx_during_tx_gpio)
+ port->rs485_supported.flags |= SER_RS485_RX_DURING_TX;
return 0;
}
--
2.43.0
Starting v6.5, Bluetooth does not work at all on my T2 MacBookAir9,1
with
the BCM4377 chip. When I boot up the computer, go into bluetoothctl,
and
then try to run commands like scan on, show, list, it returns "No
default
controller available." I have tried reloading the kernel module, in
which
the log outputs "{Added,Removed} hci0 (unconfigured)." With this patch,
I
am able to use Bluetooth as normal without any errors regarding hci0
being
unconfigured. However, an issue is still present where sometimes
hci_bcm4377 will have to be reloaded in order to get bluetooth to work.
I
believe this was still present before the previously mentioned commit.
Due to the bit HCI_QUIRK_USE_BDADDR_PROPERTY being always set in
drivers/bluetooth/hci_bcm4377.c(line 2371), the chip would be left
unconfigured on kernels compiled after commit 6945795bc81a ("Bluetooth:
fix use-bdaddr-property quirk") due to a change in its logic. On the M1
Macs, the device would be configured in the devicetree. However, that
is
not the case on T2 Macs. Because the bluetooth adapter is left
unconfigured, it is not usable in the operating system. In order to
circumvent this issue, a flag is added to prevent the bit from being set
on
the BCM4377, while setting it on the other devices.
Because I do not have an M1 device to test this patch on, I am not sure
whether the patch breaks anything for said devices. I would be very
grateful if anyone is willing to test this patch on their M1 device.
I would also like to thank Kerem Karabay <kekrby(a)gmail.com> for
assisting
me with this patch.
Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk")
Signed-off-by: Felix Zhang <mrman(a)mrman314.tech>
---
drivers/bluetooth/hci_bcm4377.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_bcm4377.c
b/drivers/bluetooth/hci_bcm4377.c
index a61757835695..5c6fef1aa0f6 100644
--- a/drivers/bluetooth/hci_bcm4377.c
+++ b/drivers/bluetooth/hci_bcm4377.c
@@ -513,6 +513,7 @@ struct bcm4377_hw {
unsigned long broken_ext_scan : 1;
unsigned long broken_mws_transport_config : 1;
unsigned long broken_le_coded : 1;
+ unsigned long use_bdaddr_property : 1;
int (*send_calibration)(struct bcm4377_data *bcm4377);
int (*send_ptb)(struct bcm4377_data *bcm4377,
@@ -2368,7 +2369,8 @@ static int bcm4377_probe(struct pci_dev *pdev,
const struct pci_device_id *id)
hdev->set_bdaddr = bcm4377_hci_set_bdaddr;
hdev->setup = bcm4377_hci_setup;
- set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+ if (bcm4377->hw->use_bdaddr_property)
+ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
if (bcm4377->hw->broken_mws_transport_config)
set_bit(HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG, &hdev->quirks);
if (bcm4377->hw->broken_ext_scan)
@@ -2465,6 +2467,7 @@ static const struct bcm4377_hw
bcm4377_hw_variants[] = {
.has_bar0_core2_window2 = true,
.broken_mws_transport_config = true,
.broken_le_coded = true,
+ .use_bdaddr_property = true,
.send_calibration = bcm4378_send_calibration,
.send_ptb = bcm4378_send_ptb,
},
@@ -2479,6 +2482,7 @@ static const struct bcm4377_hw
bcm4377_hw_variants[] = {
.clear_pciecfg_subsystem_ctrl_bit19 = true,
.broken_mws_transport_config = true,
.broken_le_coded = true,
+ .use_bdaddr_property = true,
.send_calibration = bcm4387_send_calibration,
.send_ptb = bcm4378_send_ptb,
},
--
2.43.0
The patch titled
Subject: mm/mglru: skip special VMAs in lru_gen_look_around()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-mglru-skip-special-vmas-in-lru_gen_look_around.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Yu Zhao <yuzhao(a)google.com>
Subject: mm/mglru: skip special VMAs in lru_gen_look_around()
Date: Fri, 22 Dec 2023 21:56:47 -0700
Special VMAs like VM_PFNMAP can contain anon pages from COW. There isn't
much profit in doing lookaround on them. Besides, they can trigger the
pte_special() warning in get_pte_pfn().
Skip them in lru_gen_look_around().
Link: https://lkml.kernel.org/r/20231223045647.1566043-1-yuzhao@google.com
Fixes: 018ee47f1489 ("mm: multi-gen LRU: exploit locality in rmap")
Signed-off-by: Yu Zhao <yuzhao(a)google.com>
Reported-by: syzbot+03fd9b3f71641f0ebf2d(a)syzkaller.appspotmail.com
Closes: https://lore.kernel.org/000000000000f9ff00060d14c256@google.com/
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/vmscan.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/mm/vmscan.c~mm-mglru-skip-special-vmas-in-lru_gen_look_around
+++ a/mm/vmscan.c
@@ -3955,6 +3955,7 @@ void lru_gen_look_around(struct page_vma
int young = 0;
pte_t *pte = pvmw->pte;
unsigned long addr = pvmw->address;
+ struct vm_area_struct *vma = pvmw->vma;
struct folio *folio = pfn_folio(pvmw->pfn);
bool can_swap = !folio_is_file_lru(folio);
struct mem_cgroup *memcg = folio_memcg(folio);
@@ -3969,11 +3970,15 @@ void lru_gen_look_around(struct page_vma
if (spin_is_contended(pvmw->ptl))
return;
+ /* exclude special VMAs containing anon pages from COW */
+ if (vma->vm_flags & VM_SPECIAL)
+ return;
+
/* avoid taking the LRU lock under the PTL when possible */
walk = current->reclaim_state ? current->reclaim_state->mm_walk : NULL;
- start = max(addr & PMD_MASK, pvmw->vma->vm_start);
- end = min(addr | ~PMD_MASK, pvmw->vma->vm_end - 1) + 1;
+ start = max(addr & PMD_MASK, vma->vm_start);
+ end = min(addr | ~PMD_MASK, vma->vm_end - 1) + 1;
if (end - start > MIN_LRU_BATCH * PAGE_SIZE) {
if (addr - start < MIN_LRU_BATCH * PAGE_SIZE / 2)
@@ -3998,7 +4003,7 @@ void lru_gen_look_around(struct page_vma
unsigned long pfn;
pte_t ptent = ptep_get(pte + i);
- pfn = get_pte_pfn(ptent, pvmw->vma, addr);
+ pfn = get_pte_pfn(ptent, vma, addr);
if (pfn == -1)
continue;
@@ -4009,7 +4014,7 @@ void lru_gen_look_around(struct page_vma
if (!folio)
continue;
- if (!ptep_test_and_clear_young(pvmw->vma, addr, pte + i))
+ if (!ptep_test_and_clear_young(vma, addr, pte + i))
VM_WARN_ON_ONCE(true);
young++;
_
Patches currently in -mm which might be from yuzhao(a)google.com are
mm-mglru-skip-special-vmas-in-lru_gen_look_around.patch
There were multiple issues with direct_io_allow_mmap:
- fuse_link_write_file() was missing, resulting in warnings in
fuse_write_file_get() and EIO from msync()
- "vma->vm_ops = &fuse_file_vm_ops" was not set, but especially
fuse_page_mkwrite is needed.
The semantics of invalidate_inode_pages2() is so far not clearly defined
in fuse_file_mmap. It dates back to
commit 3121bfe76311 ("fuse: fix "direct_io" private mmap")
Though, as direct_io_allow_mmap is a new feature, that was for MAP_PRIVATE
only. As invalidate_inode_pages2() is calling into fuse_launder_folio()
and writes out dirty pages, it should be safe to call
invalidate_inode_pages2 for MAP_PRIVATE and MAP_SHARED as well.
Cc: Hao Xu <howeyxu(a)tencent.com>
Cc: stable(a)vger.kernel.org
Fixes: e78662e818f9 ("fuse: add a new fuse init flag to relax restrictions in no cache mode")
Signed-off-by: Bernd Schubert <bschubert(a)ddn.com>
Reviewed-by: Amir Goldstein <amir73il(a)gmail.com>
---
fs/fuse/file.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a660f1f21540a..174aa16407c4b 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2475,7 +2475,10 @@ static int fuse_file_mmap(struct file *file, struct vm_area_struct *vma)
invalidate_inode_pages2(file->f_mapping);
- return generic_file_mmap(file, vma);
+ if (!(vma->vm_flags & VM_MAYSHARE)) {
+ /* MAP_PRIVATE */
+ return generic_file_mmap(file, vma);
+ }
}
if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE))
--
2.40.1
I'm announcing the release of the 5.15.145 kernel.
All users of the 5.15 kernel series must upgrade.
The updated 5.15.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 75 -
fs/ksmbd/Kconfig | 11
fs/ksmbd/asn1.c | 169 --
fs/ksmbd/auth.c | 72 -
fs/ksmbd/auth.h | 3
fs/ksmbd/connection.c | 169 +-
fs/ksmbd/connection.h | 92 -
fs/ksmbd/ksmbd_netlink.h | 7
fs/ksmbd/ksmbd_work.c | 101 +
fs/ksmbd/ksmbd_work.h | 40
fs/ksmbd/mgmt/share_config.c | 56
fs/ksmbd/mgmt/share_config.h | 36
fs/ksmbd/mgmt/tree_connect.c | 80 -
fs/ksmbd/mgmt/tree_connect.h | 15
fs/ksmbd/mgmt/user_config.h | 1
fs/ksmbd/mgmt/user_session.c | 180 +-
fs/ksmbd/mgmt/user_session.h | 8
fs/ksmbd/misc.c | 94 +
fs/ksmbd/misc.h | 6
fs/ksmbd/oplock.c | 258 +--
fs/ksmbd/oplock.h | 4
fs/ksmbd/server.c | 54
fs/ksmbd/smb2misc.c | 4
fs/ksmbd/smb2ops.c | 10
fs/ksmbd/smb2pdu.c | 2041 ++++++++++++++---------------
fs/ksmbd/smb2pdu.h | 83 -
fs/ksmbd/smb_common.c | 176 +-
fs/ksmbd/smb_common.h | 20
fs/ksmbd/smbacl.c | 26
fs/ksmbd/smbacl.h | 8
fs/ksmbd/transport_ipc.c | 4
fs/ksmbd/transport_rdma.c | 644 ++++++---
fs/ksmbd/transport_rdma.h | 6
fs/ksmbd/transport_tcp.c | 9
fs/ksmbd/unicode.c | 193 +-
fs/ksmbd/unicode.h | 3
fs/ksmbd/vfs.c | 647 ++++-----
fs/ksmbd/vfs.h | 56
fs/ksmbd/vfs_cache.c | 72 -
fs/ksmbd/vfs_cache.h | 26
fs/namei.c | 125 +
include/linux/kasan.h | 6
include/linux/namei.h | 7
kernel/trace/trace_kprobe.c | 74 +
kernel/trace/trace_probe.h | 1
mm/kasan/report.c | 4
47 files changed, 3259 insertions(+), 2519 deletions(-)
Al Viro (4):
ksmbd: don't open-code file_path()
ksmbd: don't open-code %pD
ksmbd: constify struct path
fs: introduce lock_rename_child() helper
Amit Pundir (3):
Revert "drm/bridge: lt9611uxc: fix the race in the error path"
Revert "drm/bridge: lt9611uxc: Register and attach our DSI device at probe"
Revert "drm/bridge: lt9611uxc: Switch to devm MIPI-DSI helpers"
Arnd Bergmann (1):
kasan: disable kasan_non_canonical_hook() for HW tags
Atte Heikkilä (5):
ksmbd: request update to stale share config
ksmbd: casefold utf-8 share names and fix ascii lowercase conversion
ksmbd: make utf-8 file name comparison work in __caseless_lookup()
ksmbd: validate share name from share config response
ksmbd: fix `force create mode' and `force directory mode'
Cheng-Han Wu (1):
ksmbd: Remove unused field in ksmbd_user struct
Christophe JAILLET (3):
ksmbd: Remove redundant 'flush_workqueue()' calls
ksmbd: Remove a redundant zeroing of memory
ksmbd: smbd: Remove useless license text when SPDX-License-Identifier is already used
Colin Ian King (1):
ksmbd: Fix spelling mistake "excceed" -> "exceeded"
David Disseldorp (4):
ksmbd: avoid out of bounds access in decode_preauth_ctxt()
ksmbd: set NegotiateContextCount once instead of every inc
ksmbd: avoid duplicate negotiate ctx offset increments
ksmbd: remove unused compression negotiate ctx packing
Dawei Li (4):
ksmbd: Implements sess->ksmbd_chann_list as xarray
ksmbd: Implements sess->rpc_handle_list as xarray
ksmbd: fix typo, syncronous->synchronous
ksmbd: Remove duplicated codes
Francis Laniel (1):
tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
Greg Kroah-Hartman (1):
Linux 5.15.145
Gustavo A. R. Silva (3):
ksmbd: replace one-element arrays with flexible-array members
ksmbd: Use struct_size() helper in ksmbd_negotiate_smb_dialect()
ksmbd: Replace one-element array with flexible-array member
Hangyu Hua (1):
ksmbd: fix possible memory leak in smb2_lock()
Hyunchul Lee (16):
ksmbd: use oid registry functions to decode OIDs
ksmbd: register ksmbd ib client with ib_register_client()
ksmbd: smbd: call rdma_accept() under CM handler
ksmbd: smbd: create MR pool
ksmbd: smbd: change the default maximum read/write, receive size
ksmbd: smbd: fix missing client's memory region invalidation
ksmbd: smbd: validate buffer descriptor structures
ksmbd: smbd: change prototypes of RDMA read/write related functions
ksmbd: smbd: introduce read/write credits for RDMA read/write
ksmbd: smbd: simplify tracking pending packets
ksmbd: smbd: change the return value of get_sg_list
ksmbd: smbd: handle multiple Buffer descriptors
ksmbd: smbd: fix connection dropped issue
ksmbd: smbd: relax the count of sges required
ksmbd: remove duplicate flag set in smb2_write
ksmbd: remove unnecessary generic_fillattr in smb2_open
Jakob Koschel (1):
ksmbd: replace usage of found with dedicated list iterator variable
Jeff Layton (1):
ksmbd: use F_SETLK when unlocking a file
Jiapeng Chong (1):
ksmbd: Fix parameter name and comment mismatch
Kangjing Huang (1):
ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()
Kuan-Ting Chen (1):
ksmbd: fix multiple out-of-bounds read during context decoding
Lu Hongfei (2):
ksmbd: Change the return value of ksmbd_vfs_query_maximal_access to void
ksmbd: Replace the ternary conditional operator with min()
Marios Makassikis (5):
ksmbd: Remove unused parameter from smb2_get_name()
ksmbd: Remove unused fields from ksmbd_file struct definition
ksmbd: Fix resource leak in smb2_lock()
ksmbd: send proper error response in smb2_tree_connect()
ksmbd: fix recursive locking in vfs helpers
Namjae Jeon (79):
ksmbd: remove md4 leftovers
ksmbd: remove smb2_buf_length in smb2_hdr
ksmbd: remove smb2_buf_length in smb2_transform_hdr
ksmbd: change LeaseKey data type to u8 array
ksmbd: set both ipv4 and ipv6 in FSCTL_QUERY_NETWORK_INTERFACE_INFO
ksmbd: set 445 port to smbdirect port by default
ksmbd: add smb-direct shutdown
ksmbd: add support for key exchange
ksmbd: remove filename in ksmbd_file
ksmbd: validate length in smb2_write()
ksmbd: fix wrong smbd max read/write size check
ksmbd: remove unused ksmbd_share_configs_cleanup function
ksmbd: use wait_event instead of schedule_timeout()
ksmbd: remove generic_fillattr use in smb2_open()
ksmbd: change security id to the one samba used for posix extension
ksmbd: set file permission mode to match Samba server posix extension behavior
ksmbd: fill sids in SMB_FIND_FILE_POSIX_INFO response
ksmbd: fix encryption failure issue for session logoff response
ksmbd: set NTLMSSP_NEGOTIATE_SEAL flag to challenge blob
ksmbd: hide socket error message when ipv6 config is disable
ksmbd: call ib_drain_qp when disconnected
ksmbd: set SMB2_SESSION_FLAG_ENCRYPT_DATA when enforcing data encryption for this share
ksmbd: fix wrong signingkey creation when encryption is AES256
ksmbd: delete asynchronous work from list
ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
ksmbd: fix racy issue from using ->d_parent and ->d_name
ksmbd: fix racy issue from session setup and logoff
ksmbd: destroy expired sessions
ksmbd: block asynchronous requests when making a delay on session setup
ksmbd: fix racy issue from smb2 close and logoff with multichannel
ksmbd: fix racy issue under cocurrent smb2 tree disconnect
ksmbd: fix uninitialized pointer read in ksmbd_vfs_rename()
ksmbd: fix uninitialized pointer read in smb2_create_link()
ksmbd: fix UAF issue from opinfo->conn
ksmbd: call putname after using the last component
ksmbd: fix out-of-bound read in deassemble_neg_contexts()
ksmbd: fix out-of-bound read in parse_lease_state()
ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()
ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop
ksmbd: validate smb request protocol id
ksmbd: add mnt_want_write to ksmbd vfs functions
ksmbd: remove unused ksmbd_tree_conn_share function
ksmbd: use kzalloc() instead of __GFP_ZERO
ksmbd: return a literal instead of 'err' in ksmbd_vfs_kern_path_locked()
ksmbd: use kvzalloc instead of kvmalloc
ksmbd: fix out of bounds read in smb2_sess_setup
ksmbd: add missing compound request handing in some commands
ksmbd: check if a mount point is crossed during path lookup
ksmbd: validate session id and tree id in compound request
ksmbd: fix out of bounds in init_smb2_rsp_hdr()
ksmbd: add support for read compound
ksmbd: fix wrong interim response on compound
ksmbd: reduce descriptor size if remaining bytes is less than request size
ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
ksmbd: add missing calling smb2_set_err_rsp() on error
ksmbd: remove unneeded mark_inode_dirty in set_info_sec()
ksmbd: fix passing freed memory 'aux_payload_buf'
ksmbd: return invalid parameter error response if smb2 request is invalid
ksmbd: check iov vector index in ksmbd_conn_write()
ksmbd: fix race condition between session lookup and expire
ksmbd: fix race condition with fp
ksmbd: fix race condition from parallel smb2 logoff requests
ksmbd: fix race condition from parallel smb2 lock requests
ksmbd: fix race condition between tree conn lookup and disconnect
ksmbd: fix wrong error response status by using set_smb2_rsp_status()
ksmbd: fix Null pointer dereferences in ksmbd_update_fstate()
ksmbd: fix potential double free on smb2_read_pipe() error path
ksmbd: reorganize ksmbd_iov_pin_rsp()
ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr()
ksmbd: add support for surrogate pair conversion
ksmbd: no need to wait for binded connection termination at logoff
ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked()
ksmbd: handle malformed smb1 message
ksmbd: fix possible deadlock in smb2_open
ksmbd: separately allocate ci per dentry
ksmbd: move oplock handling after unlock parent dir
ksmbd: release interim response after sending status pending response
ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId
ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error
Paulo Alcantara (SUSE) (1):
ksmbd: store fids as opaque u64 integers
Ralph Boehme (2):
ksmbd: use ksmbd_req_buf_next() in ksmbd_verify_smb_message()
ksmdb: use cmd helper variable in smb2_get_ksmbd_tcon()
Steve French (4):
ksmbd: shorten experimental warning on loading the module
smb3: fix ksmbd bigendian bug in oplock break, and move its struct to smbfs_common
ksmbd: update Kconfig to note Kerberos support and fix indentation
ksmbd: remove experimental warning
Tobias Klauser (1):
ksmbd: use netif_is_bridge_port
Tom Rix (1):
ksmbd: remove unused is_char_allowed function
Tom Talpey (2):
ksmbd: decrease the number of SMB3 smbdirect server SGEs
ksmbd: reduce server smbdirect max send/receive segment sizes
Wang Ming (1):
ksmbd: Fix unsigned expression compared with zero
Yang Li (6):
ksmbd: Fix buffer_check_err() kernel-doc comment
ksmbd: Fix smb2_set_info_file() kernel-doc comment
ksmbd: Delete an invalid argument description in smb2_populate_readdir_entry()
ksmbd: Fix smb2_get_name() kernel-doc comment
ksmbd: Fix some kernel-doc comments
ksmbd: Fix one kernel-doc comment
Yang Yingliang (1):
ksmbd: switch to use kmemdup_nul() helper
Zongmin Zhou (1):
ksmbd: prevent memory leak on error return
ye xingchen (1):
ksmbd: Convert to use sysfs_emit()/sysfs_emit_at() APIs
From: Guo Ren <guoren(a)linux.alibaba.com>
In COMPAT mode, the STACK_TOP is DEFAULT_MAP_WINDOW (0x80000000), but
the TASK_SIZE is 0x7fff000. When the user stack is upon 0x7fff000, it
will cause a user segment fault. Sometimes, it would cause boot
failure when the whole rootfs is rv32.
Freeing unused kernel image (initmem) memory: 2236K
Run /sbin/init as init process
Starting init: /sbin/init exists but couldn't execute it (error -14)
Run /etc/init as init process
...
Increase the TASK_SIZE to cover STACK_TOP.
Cc: stable(a)vger.kernel.org
Fixes: add2cc6b6515 ("RISC-V: mm: Restrict address space for sv39,sv48,sv57")
Signed-off-by: Guo Ren <guoren(a)linux.alibaba.com>
Signed-off-by: Guo Ren <guoren(a)kernel.org>
---
arch/riscv/include/asm/pgtable.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index ab00235b018f..74ffb2178f54 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -881,7 +881,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte)
#define TASK_SIZE_MIN (PGDIR_SIZE_L3 * PTRS_PER_PGD / 2)
#ifdef CONFIG_COMPAT
-#define TASK_SIZE_32 (_AC(0x80000000, UL) - PAGE_SIZE)
+#define TASK_SIZE_32 (_AC(0x80000000, UL))
#define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \
TASK_SIZE_32 : TASK_SIZE_64)
#else
--
2.40.1