From: Xiubo Li <xiubli(a)redhat.com>
Blindly expanding the readahead windows will cause unneccessary
pagecache thrashing and also will introduce the network workload.
We should disable expanding the windows if the readahead is disabled
and also shouldn't expand the windows too much.
Expanding forward firstly instead of expanding backward for possible
sequential reads.
Bound `rreq->len` to the actual file size to restore the previous page
cache usage.
The posix_fadvise may change the maximum size of a file readahead.
Cc: stable(a)vger.kernel.org
Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead")
URL: https://lore.kernel.org/ceph-devel/20230504082510.247-1-sehuww@mail.scut.ed…
URL: https://www.spinics.net/lists/ceph-users/msg76183.html
Cc: Hu Weiwen <sehuww(a)mail.scut.edu.cn>
Reviewed-by: Hu Weiwen <sehuww(a)mail.scut.edu.cn>
Tested-by: Hu Weiwen <sehuww(a)mail.scut.edu.cn>
Signed-off-by: Xiubo Li <xiubli(a)redhat.com>
---
fs/ceph/addr.c | 40 +++++++++++++++++++++++++++++++++-------
1 file changed, 33 insertions(+), 7 deletions(-)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 93fff1a7373f..0c4fb3d23078 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -188,16 +188,42 @@ static void ceph_netfs_expand_readahead(struct netfs_io_request *rreq)
struct inode *inode = rreq->inode;
struct ceph_inode_info *ci = ceph_inode(inode);
struct ceph_file_layout *lo = &ci->i_layout;
+ unsigned long max_pages = inode->i_sb->s_bdi->ra_pages;
+ loff_t end = rreq->start + rreq->len, new_end;
+ struct ceph_netfs_request_data *priv = rreq->netfs_priv;
+ unsigned long max_len;
u32 blockoff;
- u64 blockno;
- /* Expand the start downward */
- blockno = div_u64_rem(rreq->start, lo->stripe_unit, &blockoff);
- rreq->start = blockno * lo->stripe_unit;
- rreq->len += blockoff;
+ if (priv) {
+ /* Readahead is disabled by posix_fadvise POSIX_FADV_RANDOM */
+ if (priv->file_ra_disabled)
+ max_pages = 0;
+ else
+ max_pages = priv->file_ra_pages;
+
+ }
+
+ /* Readahead is disabled */
+ if (!max_pages)
+ return;
- /* Now, round up the length to the next block */
- rreq->len = roundup(rreq->len, lo->stripe_unit);
+ max_len = max_pages << PAGE_SHIFT;
+
+ /*
+ * Try to expand the length forward by rounding up it to the next
+ * block, but do not exceed the file size, unless the original
+ * request already exceeds it.
+ */
+ new_end = min(round_up(end, lo->stripe_unit), rreq->i_size);
+ if (new_end > end && new_end <= rreq->start + max_len)
+ rreq->len = new_end - rreq->start;
+
+ /* Try to expand the start downward */
+ div_u64_rem(rreq->start, lo->stripe_unit, &blockoff);
+ if (rreq->len + blockoff <= max_len) {
+ rreq->start -= blockoff;
+ rreq->len += blockoff;
+ }
}
static bool ceph_netfs_clamp_length(struct netfs_io_subrequest *subreq)
--
2.40.1
Touching privately mapped GPA that is not properly converted to private
with MapGPA and accepted leads to unrecoverable exit to VMM.
load_unaligned_zeropad() can touch memory that is not owned by the
caller, but just happened to next after the owned memory.
This load_unaligned_zeropad() behaviour makes it important when kernel
asks VMM to convert a GPA from shared to private or back. Kernel must
never have a page mapped into direct mapping (and aliases) as private
when the GPA is already converted to shared or when GPA is not yet
converted to private.
guest.enc_status_change_prepare() called before adjusting direct mapping
and therefore it is responsible for converting the memory to private.
guest.enc_status_change_finish() called after adjusting direct mapping
and it converts the memory to shared.
It is okay to have a shared mapping of memory that is not converted
properly. handle_mmio() knows how to deal with load_unaligned_zeropad()
stepping on it.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Fixes: 7dbde7631629 ("x86/mm/cpa: Add support for TDX shared memory")
Cc: stable(a)vger.kernel.org
---
arch/x86/coco/tdx/tdx.c | 56 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 53 insertions(+), 3 deletions(-)
diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index e146b599260f..59cc13e41aa6 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -840,6 +840,30 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc)
return true;
}
+static bool tdx_enc_status_change_prepare(unsigned long vaddr, int numpages,
+ bool enc)
+{
+ /*
+ * Only handle shared->private conversion here.
+ * See the comment in tdx_early_init().
+ */
+ if (enc)
+ return tdx_enc_status_changed(vaddr, numpages, enc);
+ return true;
+}
+
+static bool tdx_enc_status_change_finish(unsigned long vaddr, int numpages,
+ bool enc)
+{
+ /*
+ * Only handle private->shared conversion here.
+ * See the comment in tdx_early_init().
+ */
+ if (!enc)
+ return tdx_enc_status_changed(vaddr, numpages, enc);
+ return true;
+}
+
void __init tdx_early_init(void)
{
u64 cc_mask;
@@ -867,9 +891,35 @@ void __init tdx_early_init(void)
*/
physical_mask &= cc_mask - 1;
- x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required;
- x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required;
- x86_platform.guest.enc_status_change_finish = tdx_enc_status_changed;
+ /*
+ * Touching privately mapped GPA that is not properly converted to
+ * private with MapGPA and accepted leads to unrecoverable exit
+ * to VMM.
+ *
+ * load_unaligned_zeropad() can touch memory that is not owned by
+ * the caller, but just happened to next after the owned memory.
+ * This load_unaligned_zeropad() behaviour makes it important when
+ * kernel asks VMM to convert a GPA from shared to private or back.
+ * Kernel must never have a page mapped into direct mapping (and
+ * aliases) as private when the GPA is already converted to shared or
+ * when GPA is not yet converted to private.
+ *
+ * guest.enc_status_change_prepare() called before adjusting direct
+ * mapping and therefore it is responsible for converting the memory
+ * to private.
+ *
+ * guest.enc_status_change_finish() called after adjusting direct
+ * mapping and it converts the memory to shared.
+ *
+ * It is okay to have a shared mapping of memory that is not converted
+ * properly. handle_mmio() knows how to deal with load_unaligned_zeropad()
+ * stepping on it.
+ */
+ x86_platform.guest.enc_status_change_prepare = tdx_enc_status_change_prepare;
+ x86_platform.guest.enc_status_change_finish = tdx_enc_status_change_finish;
+
+ x86_platform.guest.enc_cache_flush_required = tdx_cache_flush_required;
+ x86_platform.guest.enc_tlb_flush_required = tdx_tlb_flush_required;
pr_info("Guest detected\n");
}
--
2.39.3
--
Beloved Greeting,
Please forgive me for stressing you with my predicaments and I sorry
to approach you through this media it is because it serves the
fastest means of communication. I came across your E-mail from my
personal search and I decided to contact you believing you will be
honest to fulfill my final wish before I die.
I am Helena , 63 years old, from Philippine, I have been dealing on
Gold exportation for the past fifteen years in West Africa. Am
childless and I am suffering from a pro-long critical cancer, my
doctors confirmed I may not live beyond two months from now as my ill
health has defiled all forms of medical treatment.
Since my days are numbered, I’ve decided willingly to fulfill my
long-time vowel to donate the sum ($5.000.000.00) million dollars. I
need a very honest person who can assist to release this money and use
the funds for charities work of God while you use 50% for yourself.
I want you to know there are no risk involved, it is 100% hitch free
& safe. If you will be interesting to assist in getting this fund been
released from the security company for charity project to fulfill my
promise before I die please let me know immediately. I will appreciate
your utmost confidentiality as I wait for your reply.
Yours Dying Sister
Madam Helena Philobrown
This is the start of the stable review cycle for the 5.15.115 release.
There are 35 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 05 Jun 2023 14:35:25 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.115-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.115-rc3
Paul Blakey <paulb(a)nvidia.com>
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
Carlos Llamas <cmllamas(a)google.com>
binder: fix UAF of alloc->vma in race with munmap()
Carlos Llamas <cmllamas(a)google.com>
binder: add lockless binder_alloc_(set|get)_vma()
Carlos Llamas <cmllamas(a)google.com>
Revert "android: binder: stop saving a pointer to the VMA"
Carlos Llamas <cmllamas(a)google.com>
Revert "binder_alloc: add missing mmap_lock calls when using the VMA"
Ruihan Li <lrh2000(a)pku.edu.cn>
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
Yunsheng Lin <linyunsheng(a)huawei.com>
page_pool: fix inconsistency for page_pool_ring_[un]lock()
Qingfang DENG <qingfang.deng(a)siflower.com.cn>
net: page_pool: use in_softirq() instead
Toke Høiland-Jørgensen <toke(a)redhat.com>
xdp: Allow registering memory model without rxq reference
Rahul Rameshbabu <rrameshbabu(a)nvidia.com>
net/mlx5e: Fix SQ wake logic in ptp napi_poll context
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
irqchip/mips-gic: Use raw spinlock for gic_lock
Marc Zyngier <maz(a)kernel.org>
irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
Carlos Llamas <cmllamas(a)google.com>
binder: fix UAF caused by faulty buffer cleanup
Hangbin Liu <liuhangbin(a)gmail.com>
bonding: fix send_peer_notif overflow
Hangbin Liu <liuhangbin(a)gmail.com>
Bonding: add arp_missed_max option
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: fix network connectivity with multiple CPU ports
Daniel Golle <daniel(a)makrotopia.org>
net: dsa: mt7530: split-off common parts from mt7531_setup
Frank Wunderlich <frank-w(a)public-files.de>
net: dsa: mt7530: rework mt753[01]_setup
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: introduce helpers for iterating through ports using dp
David Epping <david.epping(a)missinglinkelectronics.com>
net: phy: mscc: enable VSC8501/2 RGMII RX clock
Steve Wahl <steve.wahl(a)hpe.com>
platform/x86: ISST: Remove 8 socket limit
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering
Shay Drory <shayd(a)nvidia.com>
net/mlx5: Devcom, serialize devcom registration
Vlad Buslov <vladbu(a)nvidia.com>
net/mlx5e: Fix deadlock in tc route query code
Mark Bloch <mbloch(a)nvidia.com>
net/mlx5: devcom only supports 2 ports
Anton Protopopov <aspsk(a)isovalent.com>
bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq24190: Call power_supply_changed() after updating input current
Hans de Goede <hdegoede(a)redhat.com>
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: Move bq27xxx_battery_update() down
Sicelo A. Mhlongo <absicsz(a)gmail.com>
power: supply: bq27xxx: expose battery data when CI=1
-------------
Diffstat:
Documentation/networking/bonding.rst | 11 ++
Makefile | 4 +-
drivers/android/binder.c | 26 +++-
drivers/android/binder_alloc.c | 64 +++-----
drivers/android/binder_alloc.h | 2 +-
drivers/android/binder_alloc_selftest.c | 2 +-
drivers/irqchip/irq-mips-gic.c | 65 +++++---
drivers/net/bonding/bond_main.c | 17 +-
drivers/net/bonding/bond_netlink.c | 22 ++-
drivers/net/bonding/bond_options.c | 36 ++++-
drivers/net/bonding/bond_procfs.c | 2 +
drivers/net/bonding/bond_sysfs.c | 13 ++
drivers/net/dsa/mt7530.c | 124 +++++++++------
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +--
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 19 ++-
.../net/ethernet/mellanox/mlx5/core/lib/devcom.c | 81 +++++++---
.../net/ethernet/mellanox/mlx5/core/lib/devcom.h | 3 +
drivers/net/phy/mscc/mscc.h | 1 +
drivers/net/phy/mscc/mscc_main.c | 54 +++----
.../x86/intel/speed_select_if/isst_if_common.c | 49 ++++--
drivers/power/supply/bq24190_charger.c | 13 +-
drivers/power/supply/bq27xxx_battery.c | 171 +++++++++++----------
drivers/power/supply/power_supply_core.c | 57 +++----
include/linux/power/bq27xxx_battery.h | 3 +
include/linux/power_supply.h | 5 +-
include/net/bond_options.h | 1 +
include/net/bonding.h | 3 +-
include/net/dsa.h | 28 ++++
include/net/ip.h | 2 +
include/net/page_pool.h | 18 ---
include/net/xdp.h | 3 +
include/uapi/linux/if_link.h | 1 +
include/uapi/linux/in.h | 2 +
kernel/bpf/hashtab.c | 6 +-
net/bluetooth/hci_sock.c | 28 ++++
net/core/page_pool.c | 34 +++-
net/core/xdp.c | 93 +++++++----
net/ipv4/ip_sockglue.c | 12 +-
net/ipv4/raw.c | 5 +-
net/ipv6/raw.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 8 -
tools/include/uapi/linux/if_link.h | 1 +
44 files changed, 726 insertions(+), 389 deletions(-)
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x e42f110700ed7293700c26145e1ed07ea05ac3f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060527-unviable-vacancy-b389@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
e42f110700ed ("phy: qcom-qmp-pcie-msm8996: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e42f110700ed7293700c26145e1ed07ea05ac3f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:10 +0200
Subject: [PATCH] phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-3-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
index 09824be088c9..0c603bc06e09 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
@@ -379,7 +379,7 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -409,7 +409,8 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x e42f110700ed7293700c26145e1ed07ea05ac3f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060526-palpitate-viable-ab52@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
e42f110700ed ("phy: qcom-qmp-pcie-msm8996: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e42f110700ed7293700c26145e1ed07ea05ac3f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:10 +0200
Subject: [PATCH] phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-3-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
index 09824be088c9..0c603bc06e09 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
@@ -379,7 +379,7 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -409,7 +409,8 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x e42f110700ed7293700c26145e1ed07ea05ac3f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060525-enjoying-defiance-668a@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
e42f110700ed ("phy: qcom-qmp-pcie-msm8996: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e42f110700ed7293700c26145e1ed07ea05ac3f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:10 +0200
Subject: [PATCH] phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-3-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
index 09824be088c9..0c603bc06e09 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
@@ -379,7 +379,7 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -409,7 +409,8 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x e42f110700ed7293700c26145e1ed07ea05ac3f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060524-satin-contented-0ea3@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
e42f110700ed ("phy: qcom-qmp-pcie-msm8996: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e42f110700ed7293700c26145e1ed07ea05ac3f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:10 +0200
Subject: [PATCH] phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-3-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
index 09824be088c9..0c603bc06e09 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
@@ -379,7 +379,7 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -409,7 +409,8 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x e42f110700ed7293700c26145e1ed07ea05ac3f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060524-gong-backdrop-3a73@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
e42f110700ed ("phy: qcom-qmp-pcie-msm8996: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e42f110700ed7293700c26145e1ed07ea05ac3f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:10 +0200
Subject: [PATCH] phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-3-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
index 09824be088c9..0c603bc06e09 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
@@ -379,7 +379,7 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -409,7 +409,8 @@ static int qmp_pcie_msm8996_com_init(struct qmp_phy *qphy)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060513-salute-apostle-d249@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
9bf03a0cbd80 ("phy: qcom-qmp-combo: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:09 +0200
Subject: [PATCH] phy: qcom-qmp-combo: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation and can lead to the runtime suspend
callback attempting to disable resources that have never been enabled.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-2-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
index 6850e04c329b..87b17e5877ab 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
@@ -2472,7 +2472,7 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -2522,7 +2522,8 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060512-most-eastcoast-569c@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
9bf03a0cbd80 ("phy: qcom-qmp-combo: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:09 +0200
Subject: [PATCH] phy: qcom-qmp-combo: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation and can lead to the runtime suspend
callback attempting to disable resources that have never been enabled.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-2-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
index 6850e04c329b..87b17e5877ab 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
@@ -2472,7 +2472,7 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -2522,7 +2522,8 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060511-exemplary-skinning-fd83@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
9bf03a0cbd80 ("phy: qcom-qmp-combo: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:09 +0200
Subject: [PATCH] phy: qcom-qmp-combo: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation and can lead to the runtime suspend
callback attempting to disable resources that have never been enabled.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-2-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
index 6850e04c329b..87b17e5877ab 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
@@ -2472,7 +2472,7 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -2522,7 +2522,8 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060510-gains-hungry-0aed@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
9bf03a0cbd80 ("phy: qcom-qmp-combo: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:09 +0200
Subject: [PATCH] phy: qcom-qmp-combo: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation and can lead to the runtime suspend
callback attempting to disable resources that have never been enabled.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-2-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
index 6850e04c329b..87b17e5877ab 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
@@ -2472,7 +2472,7 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -2522,7 +2522,8 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060509-immerse-panoramic-d721@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
9bf03a0cbd80 ("phy: qcom-qmp-combo: fix init-count imbalance")
94a407cc17a4 ("phy: qcom-qmp: create copies of QMP PHY driver")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Tue, 2 May 2023 12:38:09 +0200
Subject: [PATCH] phy: qcom-qmp-combo: fix init-count imbalance
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation and can lead to the runtime suspend
callback attempting to disable resources that have never been enabled.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable(a)vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-2-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul(a)kernel.org>
diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
index 6850e04c329b..87b17e5877ab 100644
--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
@@ -2472,7 +2472,7 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -2522,7 +2522,8 @@ static int qmp_combo_com_init(struct qmp_combo *qmp)
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
The patch below does not apply to the 6.3-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.3.y
git checkout FETCH_HEAD
git cherry-pick -x 45c2f36871955b51b4ce083c447388d8c72d6b91
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060510-euphemism-budget-adac@gregkh' --subject-prefix 'PATCH 6.3.y' HEAD^..
Possible dependencies:
45c2f3687195 ("btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work")
4317ff0056be ("btrfs: introduce btrfs_bio::fs_info member")
2cef0c79bb81 ("btrfs: make btrfs_split_bio work on struct btrfs_bio")
b41bbd293e64 ("btrfs: return a btrfs_bio from btrfs_bio_alloc")
9dfde1b47b9d ("btrfs: store a pointer to a btrfs_bio in struct btrfs_bio_ctrl")
d733ea012db3 ("btrfs: simplify finding the inode in submit_one_bio")
690834e47cf7 ("btrfs: pass a btrfs_bio to btrfs_submit_compressed_read")
ae42a154ca89 ("btrfs: pass a btrfs_bio to btrfs_submit_bio")
34f888ce3a35 ("btrfs: cleanup main loop in btrfs_encoded_read_regular_fill_pages")
198bd49e5f0c ("btrfs: sink calc_bio_boundaries into its only caller")
24e6c8082208 ("btrfs: simplify main loop in submit_extent_page")
78a2ef1b7b33 ("btrfs: check for contiguity in submit_extent_page")
551733372fda ("btrfs: remove the submit_extent_page return value")
f8ed4852f3a9 ("btrfs: remove the compress_type argument to submit_extent_page")
a140453bf9fb ("btrfs: rename the this_bio_flag variable in btrfs_do_readpage")
c9bc621fb498 ("btrfs: move the compress_type check out of btrfs_bio_add_page")
72b505dc5757 ("btrfs: add a wbc pointer to struct btrfs_bio_ctrl")
794c26e214ab ("btrfs: remove the sync_io flag in struct btrfs_bio_ctrl")
c000bc04bad4 ("btrfs: store the bio opf in struct btrfs_bio_ctrl")
eb8d0c6d042f ("btrfs: remove the force_bio_submit to submit_extent_page")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 45c2f36871955b51b4ce083c447388d8c72d6b91 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch(a)lst.de>
Date: Mon, 15 May 2023 11:18:21 +0200
Subject: [PATCH] btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When I implemented the storage layer bio splitting, I was under the
assumption that we'll never split metadata bios. But Qu reminded me that
this can actually happen with very old file systems with unaligned
metadata chunks and RAID0.
I still haven't seen such a case in practice, but we better handled this
case, especially as it is fairly easily to do not calling the ->end_іo
method directly in btrfs_end_io_work, and using the proper
btrfs_orig_bbio_end_io helper instead.
In addition to the old file system with unaligned metadata chunks case
documented in the commit log, the combination of the new scrub code
with Johannes pending raid-stripe-tree also triggers this case. We
spent some time debugging it and found that this patch solves
the problem.
Fixes: 103c19723c80 ("btrfs: split the bio submission path into a separate file")
CC: stable(a)vger.kernel.org # 6.3+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com>
Tested-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com>
Signed-off-by: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c
index 5379c4714905..35d34c731d72 100644
--- a/fs/btrfs/bio.c
+++ b/fs/btrfs/bio.c
@@ -330,7 +330,7 @@ static void btrfs_end_bio_work(struct work_struct *work)
if (bbio->inode && !(bbio->bio.bi_opf & REQ_META))
btrfs_check_read_bio(bbio, bbio->bio.bi_private);
else
- bbio->end_io(bbio);
+ btrfs_orig_bbio_end_io(bbio);
}
static void btrfs_simple_end_io(struct bio *bio)
x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for
MTRR disabled case")
commit f9f57da2c2d119dbf109e3f6e1ceab7659294046 upstream
The requested patch fixes ioremap for certain devices when running as
a Xen Dom0. Without the patch, one example is TPM device probing
failing with:
tpm_tis IFX:00: ioremap failed for resource
The requested patch did not include a Fixes tag, but it was intended
as a fix to upstream 90b926e68f500844dff16b5bcea178dc55cf580a, which
was subsequently backported to 6.1 as
c1c59538337ab6d45700cb4a1c9725e67f59bc6e. The requested patch being a
fix can be seen in the thread here:
https://lore.kernel.org/lkml/167636735608.4906.4788207020350311572.tip-bot2…
I think it's only applicable to 6.1
Thanks,
Jason
The patch below does not apply to the 6.3-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.3.y
git checkout FETCH_HEAD
git cherry-pick -x a6e766dea0a22918735176e4af862d535962f11e
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060530-stammer-kitten-446d@gregkh' --subject-prefix 'PATCH 6.3.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a6e766dea0a22918735176e4af862d535962f11e Mon Sep 17 00:00:00 2001
From: Ekansh Gupta <quic_ekangupt(a)quicinc.com>
Date: Tue, 23 May 2023 16:25:47 +0100
Subject: [PATCH] misc: fastrpc: Pass proper scm arguments for secure map
request
If a map request is made with securemap attribute, the memory
ownership needs to be reassigned to new VMID to allow access
from protection domain. Currently only DSP VMID is passed to
the reassign call which is incorrect as only a combination of
HLOS and DSP VMID is allowed for memory ownership reassignment
and passing only DSP VMID will cause assign call failure.
Also pass proper restoring permissions to HLOS as the source
permission will now carry both HLOS and DSP VMID permission.
Change is also made to get valid physical address from
scatter/gather for this allocation request.
Fixes: e90d91190619 ("misc: fastrpc: Add support to secure memory map")
Cc: stable <stable(a)kernel.org>
Tested-by: Ekansh Gupta <quic_ekangupt(a)quicinc.com>
Signed-off-by: Ekansh Gupta <quic_ekangupt(a)quicinc.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Link: https://lore.kernel.org/r/20230523152550.438363-2-srinivas.kandagatla@linar…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f48466960f1b..32a5415624bf 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -316,12 +316,14 @@ static void fastrpc_free_map(struct kref *ref)
if (map->table) {
if (map->attr & FASTRPC_ATTR_SECUREMAP) {
struct qcom_scm_vmperm perm;
+ int vmid = map->fl->cctx->vmperms[0].vmid;
+ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS) | BIT(vmid);
int err = 0;
perm.vmid = QCOM_SCM_VMID_HLOS;
perm.perm = QCOM_SCM_PERM_RWX;
err = qcom_scm_assign_mem(map->phys, map->size,
- &map->fl->cctx->perms, &perm, 1);
+ &src_perms, &perm, 1);
if (err) {
dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d",
map->phys, map->size, err);
@@ -787,8 +789,12 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
goto map_err;
}
- map->phys = sg_dma_address(map->table->sgl);
- map->phys += ((u64)fl->sctx->sid << 32);
+ if (attr & FASTRPC_ATTR_SECUREMAP) {
+ map->phys = sg_phys(map->table->sgl);
+ } else {
+ map->phys = sg_dma_address(map->table->sgl);
+ map->phys += ((u64)fl->sctx->sid << 32);
+ }
map->size = len;
map->va = sg_virt(map->table->sgl);
map->len = len;
@@ -798,9 +804,15 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
* If subsystem VMIDs are defined in DTSI, then do
* hyp_assign from HLOS to those VM(s)
*/
+ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
+ struct qcom_scm_vmperm dst_perms[2] = {0};
+
+ dst_perms[0].vmid = QCOM_SCM_VMID_HLOS;
+ dst_perms[0].perm = QCOM_SCM_PERM_RW;
+ dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
+ dst_perms[1].perm = QCOM_SCM_PERM_RWX;
map->attr = attr;
- err = qcom_scm_assign_mem(map->phys, (u64)map->size, &fl->cctx->perms,
- fl->cctx->vmperms, fl->cctx->vmcount);
+ err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
if (err) {
dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d",
map->phys, map->size, err);
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x a6e766dea0a22918735176e4af862d535962f11e
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060537-gaining-slouchy-b6db@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a6e766dea0a22918735176e4af862d535962f11e Mon Sep 17 00:00:00 2001
From: Ekansh Gupta <quic_ekangupt(a)quicinc.com>
Date: Tue, 23 May 2023 16:25:47 +0100
Subject: [PATCH] misc: fastrpc: Pass proper scm arguments for secure map
request
If a map request is made with securemap attribute, the memory
ownership needs to be reassigned to new VMID to allow access
from protection domain. Currently only DSP VMID is passed to
the reassign call which is incorrect as only a combination of
HLOS and DSP VMID is allowed for memory ownership reassignment
and passing only DSP VMID will cause assign call failure.
Also pass proper restoring permissions to HLOS as the source
permission will now carry both HLOS and DSP VMID permission.
Change is also made to get valid physical address from
scatter/gather for this allocation request.
Fixes: e90d91190619 ("misc: fastrpc: Add support to secure memory map")
Cc: stable <stable(a)kernel.org>
Tested-by: Ekansh Gupta <quic_ekangupt(a)quicinc.com>
Signed-off-by: Ekansh Gupta <quic_ekangupt(a)quicinc.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Link: https://lore.kernel.org/r/20230523152550.438363-2-srinivas.kandagatla@linar…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f48466960f1b..32a5415624bf 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -316,12 +316,14 @@ static void fastrpc_free_map(struct kref *ref)
if (map->table) {
if (map->attr & FASTRPC_ATTR_SECUREMAP) {
struct qcom_scm_vmperm perm;
+ int vmid = map->fl->cctx->vmperms[0].vmid;
+ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS) | BIT(vmid);
int err = 0;
perm.vmid = QCOM_SCM_VMID_HLOS;
perm.perm = QCOM_SCM_PERM_RWX;
err = qcom_scm_assign_mem(map->phys, map->size,
- &map->fl->cctx->perms, &perm, 1);
+ &src_perms, &perm, 1);
if (err) {
dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d",
map->phys, map->size, err);
@@ -787,8 +789,12 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
goto map_err;
}
- map->phys = sg_dma_address(map->table->sgl);
- map->phys += ((u64)fl->sctx->sid << 32);
+ if (attr & FASTRPC_ATTR_SECUREMAP) {
+ map->phys = sg_phys(map->table->sgl);
+ } else {
+ map->phys = sg_dma_address(map->table->sgl);
+ map->phys += ((u64)fl->sctx->sid << 32);
+ }
map->size = len;
map->va = sg_virt(map->table->sgl);
map->len = len;
@@ -798,9 +804,15 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
* If subsystem VMIDs are defined in DTSI, then do
* hyp_assign from HLOS to those VM(s)
*/
+ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
+ struct qcom_scm_vmperm dst_perms[2] = {0};
+
+ dst_perms[0].vmid = QCOM_SCM_VMID_HLOS;
+ dst_perms[0].perm = QCOM_SCM_PERM_RW;
+ dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
+ dst_perms[1].perm = QCOM_SCM_PERM_RWX;
map->attr = attr;
- err = qcom_scm_assign_mem(map->phys, (u64)map->size, &fl->cctx->perms,
- fl->cctx->vmperms, fl->cctx->vmcount);
+ err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
if (err) {
dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d",
map->phys, map->size, err);
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x dbe678f6192f27879ac9ff6bc7a1036aad85aae9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060535-overrule-flypaper-4a03@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From dbe678f6192f27879ac9ff6bc7a1036aad85aae9 Mon Sep 17 00:00:00 2001
From: Frank Li <Frank.Li(a)nxp.com>
Date: Thu, 18 May 2023 11:49:45 -0400
Subject: [PATCH] usb: cdns3: fix NCM gadget RX speed 20x slow than expection
at iMX8QM
At iMX8QM platform, enable NCM gadget and run 'iperf3 -s'.
At host, run 'iperf3 -V -c fe80::6863:98ff:feef:3e0%enxc6e147509498'
[ 5] 0.00-1.00 sec 1.55 MBytes 13.0 Mbits/sec 90 4.18 KBytes
[ 5] 1.00-2.00 sec 1.44 MBytes 12.0 Mbits/sec 75 4.18 KBytes
[ 5] 2.00-3.00 sec 1.48 MBytes 12.4 Mbits/sec 75 4.18 KBytes
Expected speed should be bigger than 300Mbits/sec.
The root cause of this performance drop was found to be data corruption
happening at 4K borders in some Ethernet packets, leading to TCP
checksum errors. This corruption occurs from the position
(4K - (address & 0x7F)) to 4K. The u_ether function's allocation of
skb_buff reserves 64B, meaning all RX addresses resemble 0xXXXX0040.
Force trb_burst_size to 16 can fix this problem.
Cc: stable(a)vger.kernel.org
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li(a)nxp.com>
Link: https://lore.kernel.org/r/20230518154946.3666662-1-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index ccfaebca6faa..1dcadef933e3 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2097,6 +2097,19 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable)
else
priv_ep->trb_burst_size = 16;
+ /*
+ * In versions preceding DEV_VER_V2, for example, iMX8QM, there exit the bugs
+ * in the DMA. These bugs occur when the trb_burst_size exceeds 16 and the
+ * address is not aligned to 128 Bytes (which is a product of the 64-bit AXI
+ * and AXI maximum burst length of 16 or 0xF+1, dma_axi_ctrl0[3:0]). This
+ * results in data corruption when it crosses the 4K border. The corruption
+ * specifically occurs from the position (4K - (address & 0x7F)) to 4K.
+ *
+ * So force trb_burst_size to 16 at such platform.
+ */
+ if (priv_dev->dev_ver < DEV_VER_V2)
+ priv_ep->trb_burst_size = 16;
+
mult = min_t(u8, mult, EP_CFG_MULT_MAX);
buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX);
maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX);
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x dbe678f6192f27879ac9ff6bc7a1036aad85aae9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060534-finicky-backyard-49cc@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From dbe678f6192f27879ac9ff6bc7a1036aad85aae9 Mon Sep 17 00:00:00 2001
From: Frank Li <Frank.Li(a)nxp.com>
Date: Thu, 18 May 2023 11:49:45 -0400
Subject: [PATCH] usb: cdns3: fix NCM gadget RX speed 20x slow than expection
at iMX8QM
At iMX8QM platform, enable NCM gadget and run 'iperf3 -s'.
At host, run 'iperf3 -V -c fe80::6863:98ff:feef:3e0%enxc6e147509498'
[ 5] 0.00-1.00 sec 1.55 MBytes 13.0 Mbits/sec 90 4.18 KBytes
[ 5] 1.00-2.00 sec 1.44 MBytes 12.0 Mbits/sec 75 4.18 KBytes
[ 5] 2.00-3.00 sec 1.48 MBytes 12.4 Mbits/sec 75 4.18 KBytes
Expected speed should be bigger than 300Mbits/sec.
The root cause of this performance drop was found to be data corruption
happening at 4K borders in some Ethernet packets, leading to TCP
checksum errors. This corruption occurs from the position
(4K - (address & 0x7F)) to 4K. The u_ether function's allocation of
skb_buff reserves 64B, meaning all RX addresses resemble 0xXXXX0040.
Force trb_burst_size to 16 can fix this problem.
Cc: stable(a)vger.kernel.org
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li(a)nxp.com>
Link: https://lore.kernel.org/r/20230518154946.3666662-1-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index ccfaebca6faa..1dcadef933e3 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2097,6 +2097,19 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable)
else
priv_ep->trb_burst_size = 16;
+ /*
+ * In versions preceding DEV_VER_V2, for example, iMX8QM, there exit the bugs
+ * in the DMA. These bugs occur when the trb_burst_size exceeds 16 and the
+ * address is not aligned to 128 Bytes (which is a product of the 64-bit AXI
+ * and AXI maximum burst length of 16 or 0xF+1, dma_axi_ctrl0[3:0]). This
+ * results in data corruption when it crosses the 4K border. The corruption
+ * specifically occurs from the position (4K - (address & 0x7F)) to 4K.
+ *
+ * So force trb_burst_size to 16 at such platform.
+ */
+ if (priv_dev->dev_ver < DEV_VER_V2)
+ priv_ep->trb_burst_size = 16;
+
mult = min_t(u8, mult, EP_CFG_MULT_MAX);
buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX);
maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX);
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x dbe678f6192f27879ac9ff6bc7a1036aad85aae9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060528-encode-elk-1d80@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From dbe678f6192f27879ac9ff6bc7a1036aad85aae9 Mon Sep 17 00:00:00 2001
From: Frank Li <Frank.Li(a)nxp.com>
Date: Thu, 18 May 2023 11:49:45 -0400
Subject: [PATCH] usb: cdns3: fix NCM gadget RX speed 20x slow than expection
at iMX8QM
At iMX8QM platform, enable NCM gadget and run 'iperf3 -s'.
At host, run 'iperf3 -V -c fe80::6863:98ff:feef:3e0%enxc6e147509498'
[ 5] 0.00-1.00 sec 1.55 MBytes 13.0 Mbits/sec 90 4.18 KBytes
[ 5] 1.00-2.00 sec 1.44 MBytes 12.0 Mbits/sec 75 4.18 KBytes
[ 5] 2.00-3.00 sec 1.48 MBytes 12.4 Mbits/sec 75 4.18 KBytes
Expected speed should be bigger than 300Mbits/sec.
The root cause of this performance drop was found to be data corruption
happening at 4K borders in some Ethernet packets, leading to TCP
checksum errors. This corruption occurs from the position
(4K - (address & 0x7F)) to 4K. The u_ether function's allocation of
skb_buff reserves 64B, meaning all RX addresses resemble 0xXXXX0040.
Force trb_burst_size to 16 can fix this problem.
Cc: stable(a)vger.kernel.org
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li(a)nxp.com>
Link: https://lore.kernel.org/r/20230518154946.3666662-1-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index ccfaebca6faa..1dcadef933e3 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2097,6 +2097,19 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable)
else
priv_ep->trb_burst_size = 16;
+ /*
+ * In versions preceding DEV_VER_V2, for example, iMX8QM, there exit the bugs
+ * in the DMA. These bugs occur when the trb_burst_size exceeds 16 and the
+ * address is not aligned to 128 Bytes (which is a product of the 64-bit AXI
+ * and AXI maximum burst length of 16 or 0xF+1, dma_axi_ctrl0[3:0]). This
+ * results in data corruption when it crosses the 4K border. The corruption
+ * specifically occurs from the position (4K - (address & 0x7F)) to 4K.
+ *
+ * So force trb_burst_size to 16 at such platform.
+ */
+ if (priv_dev->dev_ver < DEV_VER_V2)
+ priv_ep->trb_burst_size = 16;
+
mult = min_t(u8, mult, EP_CFG_MULT_MAX);
buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX);
maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX);
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 626d312028bec44209d0ecd5beaa9b1aa8945f7d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023060543-disdain-plaza-27e7@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 626d312028bec44209d0ecd5beaa9b1aa8945f7d Mon Sep 17 00:00:00 2001
From: Masahiro Honda <honda(a)mechatrax.com>
Date: Thu, 18 May 2023 20:08:16 +0900
Subject: [PATCH] iio: adc: ad_sigma_delta: Fix IRQ issue by setting
IRQ_DISABLE_UNLAZY flag
The Sigma-Delta ADCs supported by this driver can use SDO as an interrupt
line to indicate the completion of a conversion. However, some devices
cannot properly detect the completion of a conversion by an interrupt.
This is for the reason mentioned in the following commit.
commit e9849777d0e2 ("genirq: Add flag to force mask in
disable_irq[_nosync]()")
A read operation is performed by an extra interrupt before the completion
of a conversion. At this time, the value read from the ADC data register
is the same as the previous conversion result. This patch fixes the issue
by setting IRQ_DISABLE_UNLAZY flag.
Fixes: 0c6ef985a1fd ("iio: adc: ad7791: fix IRQ flags")
Fixes: 1a913270e57a ("iio: adc: ad7793: Fix IRQ flag")
Fixes: e081102f3077 ("iio: adc: ad7780: Fix IRQ flag")
Fixes: 89a86da5cb8e ("iio: adc: ad7192: Add IRQ flag")
Fixes: 79ef91493f54 ("iio: adc: ad7124: Set IRQ type to falling")
Signed-off-by: Masahiro Honda <honda(a)mechatrax.com>
Link: https://lore.kernel.org/r/20230518110816.248-1-honda@mechatrax.com
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index d8570f620785..7e2192870743 100644
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -584,6 +584,10 @@ static int devm_ad_sd_probe_trigger(struct device *dev, struct iio_dev *indio_de
init_completion(&sigma_delta->completion);
sigma_delta->irq_dis = true;
+
+ /* the IRQ core clears IRQ_DISABLE_UNLAZY flag when freeing an IRQ */
+ irq_set_status_flags(sigma_delta->spi->irq, IRQ_DISABLE_UNLAZY);
+
ret = devm_request_irq(dev, sigma_delta->spi->irq,
ad_sd_data_rdy_trig_poll,
sigma_delta->info->irq_flags | IRQF_NO_AUTOEN,
On some USB speaker devices(Jabra/Logitech) we see above error
msg when connecting device to computer and kernel is probing the device.
Moving the snd_usb_init_sample_rate() to after usb_set_interface() makes
the error go away.
Signed-off-by: Joakim Tjernlund <joakim.tjernlund(a)infinera.com>
Cc: stable(a)vger.kernel.org
---
sound/usb/stream.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index f10f4e6d3fb8..d9ac8663a48b 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -1226,8 +1226,8 @@ static int __snd_usb_parse_audio_interface(struct snd_usb_audio *chip,
/* try to set the interface... */
usb_set_interface(chip->dev, iface_no, 0);
snd_usb_init_pitch(chip, fp);
- snd_usb_init_sample_rate(chip, fp, fp->rate_max);
usb_set_interface(chip->dev, iface_no, altno);
+ snd_usb_init_sample_rate(chip, fp, fp->rate_max);
}
return 0;
}
--
2.39.3
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x 7e01c7f7046efc2c7c192c3619db43292b98e997
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023052625-mutual-punch-5c0b@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
7e01c7f7046e ("net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize")
2be6d4d16a08 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")
0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block")
49c2c3f246e2 ("cdc_ncm: avoid padding beyond end of skb")
6314dab4b8fb ("net: cdc_ncm: GetNtbFormat endian fix")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 7e01c7f7046efc2c7c192c3619db43292b98e997 Mon Sep 17 00:00:00 2001
From: Tudor Ambarus <tudor.ambarus(a)linaro.org>
Date: Wed, 17 May 2023 13:38:08 +0000
Subject: [PATCH] net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than
the calculated "min" value, but greater than zero, the logic sets
tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in
cdc_ncm_fill_tx_frame() where all the data is handled.
For small values of dwNtbOutMaxSize the memory allocated during
alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to
how size is aligned at alloc time:
size = SKB_DATA_ALIGN(size);
size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
Thus we hit the same bug that we tried to squash with
commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")
Low values of dwNtbOutMaxSize do not cause an issue presently because at
alloc_skb() time more memory (512b) is allocated than required for the
SKB headers alone (320b), leaving some space (512b - 320b = 192b)
for CDC data (172b).
However, if more elements (for example 3 x u64 = [24b]) were added to
one of the SKB header structs, say 'struct skb_shared_info',
increasing its original size (320b [320b aligned]) to something larger
(344b [384b aligned]), then suddenly the CDC data (172b) no longer
fits in the spare SKB data area (512b - 384b = 128b).
Consequently the SKB bounds checking semantics fails and panics:
skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: mld mld_ifc_work
RIP: 0010:skb_panic net/core/skbuff.c:113 [inline]
RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118
[snip]
Call Trace:
<TASK>
skb_put+0x151/0x210 net/core/skbuff.c:2047
skb_put_zero include/linux/skbuff.h:2422 [inline]
cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]
cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308
cdc_ncm_tx_fixup+0xa3/0x100
Deal with too low values of dwNtbOutMaxSize, clamp it in the range
[USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure
enough data space is allocated to handle CDC data by making sure
dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.
Fixes: 289507d3364f ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning")
Cc: stable(a)vger.kernel.org
Reported-by: syzbot+9f575a1f15fc0c01ed69(a)syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=b982f1059506db48409d
Link: https://lore.kernel.org/all/20211202143437.1411410-1-lee.jones@linaro.org/
Signed-off-by: Tudor Ambarus <tudor.ambarus(a)linaro.org>
Reviewed-by: Simon Horman <simon.horman(a)corigine.com>
Link: https://lore.kernel.org/r/20230517133808.1873695-2-tudor.ambarus@linaro.org
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 6ce8f4f0c70e..db05622f1f70 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -181,9 +181,12 @@ static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx)
else
min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32);
- max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize));
- if (max == 0)
+ if (le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) == 0)
max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */
+ else
+ max = clamp_t(u32, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize),
+ USB_CDC_NCM_NTB_MIN_OUT_SIZE,
+ CDC_NCM_NTB_MAX_SIZE_TX);
/* some devices set dwNtbOutMaxSize too low for the above default */
min = min(min, max);
@@ -1244,6 +1247,9 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
* further.
*/
if (skb_out == NULL) {
+ /* If even the smallest allocation fails, abort. */
+ if (ctx->tx_curr_size == USB_CDC_NCM_NTB_MIN_OUT_SIZE)
+ goto alloc_failed;
ctx->tx_low_mem_max_cnt = min(ctx->tx_low_mem_max_cnt + 1,
(unsigned)CDC_NCM_LOW_MEM_MAX_CNT);
ctx->tx_low_mem_val = ctx->tx_low_mem_max_cnt;
@@ -1262,13 +1268,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
skb_out = alloc_skb(ctx->tx_curr_size, GFP_ATOMIC);
/* No allocation possible so we will abort */
- if (skb_out == NULL) {
- if (skb != NULL) {
- dev_kfree_skb_any(skb);
- dev->net->stats.tx_dropped++;
- }
- goto exit_no_skb;
- }
+ if (!skb_out)
+ goto alloc_failed;
ctx->tx_low_mem_val--;
}
if (ctx->is_ndp16) {
@@ -1461,6 +1462,11 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
return skb_out;
+alloc_failed:
+ if (skb) {
+ dev_kfree_skb_any(skb);
+ dev->net->stats.tx_dropped++;
+ }
exit_no_skb:
/* Start timer, if there is a remaining non-empty skb */
if (ctx->tx_curr_skb != NULL && n > 0)
commit 003fb0a51162d940f25fc35e70b0996a12c9e08a upstream.
Requests to the mmc layer usually come through a block device IO.
The exceptions are the ioctl interface, RPMB chardev ioctl
and debugfs, which issue their own blk_mq requests through
blk_execute_rq and do not query the BLK_STS error but the
mmcblk-internal drv_op_result. This patch ensures that drv_op_result
defaults to an error and has to be overwritten by the operation
to be considered successful.
The behavior leads to a bug where the request never propagates
the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if
mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then
can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged)
and thus may assume that their call executed successfully when it did not.
While always checking the blk_execute_rq return value would be
advised, let's eliminate the error by always setting
drv_op_result as -EIO to be overwritten on success (or other error)
Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests")
Signed-off-by: Christian Loehle <cloehle(a)hyperstone.com>
---
drivers/mmc/core/block.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index ed034b93cb25..0b72096f10e6 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -265,6 +265,7 @@ static ssize_t power_ro_lock_store(struct device *dev,
goto out_put;
}
req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
blk_execute_rq(NULL, req, 0);
ret = req_to_mmc_queue_req(req)->drv_op_result;
blk_put_request(req);
@@ -656,6 +657,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md,
idatas[0] = idata;
req_to_mmc_queue_req(req)->drv_op =
rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
req_to_mmc_queue_req(req)->drv_op_data = idatas;
req_to_mmc_queue_req(req)->ioc_count = 1;
blk_execute_rq(NULL, req, 0);
@@ -725,6 +727,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md,
}
req_to_mmc_queue_req(req)->drv_op =
rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
req_to_mmc_queue_req(req)->drv_op_data = idata;
req_to_mmc_queue_req(req)->ioc_count = num_of_cmds;
blk_execute_rq(NULL, req, 0);
@@ -2784,6 +2787,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val)
if (IS_ERR(req))
return PTR_ERR(req);
req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
blk_execute_rq(NULL, req, 0);
ret = req_to_mmc_queue_req(req)->drv_op_result;
if (ret >= 0) {
@@ -2822,6 +2826,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp)
goto out_free;
}
req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
blk_execute_rq(NULL, req, 0);
err = req_to_mmc_queue_req(req)->drv_op_result;
--
2.37.3
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x 7e01c7f7046efc2c7c192c3619db43292b98e997
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023052623-tricky-machinist-46c5@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
7e01c7f7046e ("net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize")
2be6d4d16a08 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")
0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 7e01c7f7046efc2c7c192c3619db43292b98e997 Mon Sep 17 00:00:00 2001
From: Tudor Ambarus <tudor.ambarus(a)linaro.org>
Date: Wed, 17 May 2023 13:38:08 +0000
Subject: [PATCH] net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than
the calculated "min" value, but greater than zero, the logic sets
tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in
cdc_ncm_fill_tx_frame() where all the data is handled.
For small values of dwNtbOutMaxSize the memory allocated during
alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to
how size is aligned at alloc time:
size = SKB_DATA_ALIGN(size);
size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
Thus we hit the same bug that we tried to squash with
commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")
Low values of dwNtbOutMaxSize do not cause an issue presently because at
alloc_skb() time more memory (512b) is allocated than required for the
SKB headers alone (320b), leaving some space (512b - 320b = 192b)
for CDC data (172b).
However, if more elements (for example 3 x u64 = [24b]) were added to
one of the SKB header structs, say 'struct skb_shared_info',
increasing its original size (320b [320b aligned]) to something larger
(344b [384b aligned]), then suddenly the CDC data (172b) no longer
fits in the spare SKB data area (512b - 384b = 128b).
Consequently the SKB bounds checking semantics fails and panics:
skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: mld mld_ifc_work
RIP: 0010:skb_panic net/core/skbuff.c:113 [inline]
RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118
[snip]
Call Trace:
<TASK>
skb_put+0x151/0x210 net/core/skbuff.c:2047
skb_put_zero include/linux/skbuff.h:2422 [inline]
cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]
cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308
cdc_ncm_tx_fixup+0xa3/0x100
Deal with too low values of dwNtbOutMaxSize, clamp it in the range
[USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure
enough data space is allocated to handle CDC data by making sure
dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.
Fixes: 289507d3364f ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning")
Cc: stable(a)vger.kernel.org
Reported-by: syzbot+9f575a1f15fc0c01ed69(a)syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=b982f1059506db48409d
Link: https://lore.kernel.org/all/20211202143437.1411410-1-lee.jones@linaro.org/
Signed-off-by: Tudor Ambarus <tudor.ambarus(a)linaro.org>
Reviewed-by: Simon Horman <simon.horman(a)corigine.com>
Link: https://lore.kernel.org/r/20230517133808.1873695-2-tudor.ambarus@linaro.org
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 6ce8f4f0c70e..db05622f1f70 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -181,9 +181,12 @@ static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx)
else
min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32);
- max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize));
- if (max == 0)
+ if (le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) == 0)
max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */
+ else
+ max = clamp_t(u32, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize),
+ USB_CDC_NCM_NTB_MIN_OUT_SIZE,
+ CDC_NCM_NTB_MAX_SIZE_TX);
/* some devices set dwNtbOutMaxSize too low for the above default */
min = min(min, max);
@@ -1244,6 +1247,9 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
* further.
*/
if (skb_out == NULL) {
+ /* If even the smallest allocation fails, abort. */
+ if (ctx->tx_curr_size == USB_CDC_NCM_NTB_MIN_OUT_SIZE)
+ goto alloc_failed;
ctx->tx_low_mem_max_cnt = min(ctx->tx_low_mem_max_cnt + 1,
(unsigned)CDC_NCM_LOW_MEM_MAX_CNT);
ctx->tx_low_mem_val = ctx->tx_low_mem_max_cnt;
@@ -1262,13 +1268,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
skb_out = alloc_skb(ctx->tx_curr_size, GFP_ATOMIC);
/* No allocation possible so we will abort */
- if (skb_out == NULL) {
- if (skb != NULL) {
- dev_kfree_skb_any(skb);
- dev->net->stats.tx_dropped++;
- }
- goto exit_no_skb;
- }
+ if (!skb_out)
+ goto alloc_failed;
ctx->tx_low_mem_val--;
}
if (ctx->is_ndp16) {
@@ -1461,6 +1462,11 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
return skb_out;
+alloc_failed:
+ if (skb) {
+ dev_kfree_skb_any(skb);
+ dev->net->stats.tx_dropped++;
+ }
exit_no_skb:
/* Start timer, if there is a remaining non-empty skb */
if (ctx->tx_curr_skb != NULL && n > 0)
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 8173cab3368a13cdc3cad0bd5cf14e9399b0f501
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023052257-kiwi-level-12a2@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
8173cab3368a ("drm/amdgpu/gfx10: Disable gfxoff before disabling powergating.")
fabe1753851c ("drm/amdgpu: enable gfx power gating for GC 10.3.7")
874bfdfa4735 ("drm/amdgpu: add gc 10.3.6 support")
a65dbf7cded7 ("drm/amdgpu/gfx10: Add GC 10.3.7 Support")
35c27d957835 ("drm/amdgpu: update vcn/jpeg PG flags for VCN 3.1.1")
b67f00e06f36 ("drm/amdgpu: set new revision id for 10.3.7 GC")
dfcc3e8c24cc ("drm/amdgpu: make cyan skillfish support code more consistent")
212021297eaf ("drm/amdgpu: set APU flag based on IP discovery table")
e8a423c589a0 ("drm/amdgpu: update RLC_PG_DELAY_3 Value to 200us for yellow carp")
a61794bd2f65 ("drm/amdgpu: remove grbm cam index/data operations for gfx v10")
b05b9c591f9e ("drm/amdgpu: clean up set IP function")
1d789535a036 ("drm/amdgpu: convert IP version array to include instances")
5c3720be7d46 ("drm/amdgpu: get VCN and SDMA instances from IP discovery table")
2cbc6f4259f6 ("drm/amd/display: fix error case handling")
75a07bcd1d30 ("drm/amdgpu/soc15: convert to IP version checking")
0b64a5a85229 ("drm/amdgpu/vcn2.5: convert to IP version checking")
96b8dd4423e7 ("drm/amdgpu/amdgpu_vcn: convert to IP version checking")
50638f7dbd0b ("drm/amdgpu/pm/amdgpu_smu: convert more IP version checking")
61b396b91196 ("drm/amdgpu/pm/smu_v13.0: convert IP version checking")
6b726a0a52cc ("drm/amdgpu/pm/smu_v11.0: update IP version checking")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 8173cab3368a13cdc3cad0bd5cf14e9399b0f501 Mon Sep 17 00:00:00 2001
From: Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl>
Date: Tue, 9 May 2023 18:49:46 +0200
Subject: [PATCH] drm/amdgpu/gfx10: Disable gfxoff before disabling
powergating.
Otherwise we get a full system lock (looks like a FW mess).
Copied the order from the GFX9 powergating code.
Fixes: 366468ff6c34 ("drm/amdgpu: Allow GfxOff on Vangogh as default")
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2545
Signed-off-by: Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl>
Tested-by: Guilherme G. Piccoli <gpiccoli(a)igalia.com>
Cc: Alex Deucher <alexander.deucher(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Cc: stable(a)vger.kernel.org
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index f5b5ce1051a2..1ec076517c96 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -8152,8 +8152,14 @@ static int gfx_v10_0_set_powergating_state(void *handle,
case IP_VERSION(10, 3, 3):
case IP_VERSION(10, 3, 6):
case IP_VERSION(10, 3, 7):
+ if (!enable)
+ amdgpu_gfx_off_ctrl(adev, false);
+
gfx_v10_cntl_pg(adev, enable);
- amdgpu_gfx_off_ctrl(adev, enable);
+
+ if (enable)
+ amdgpu_gfx_off_ctrl(adev, true);
+
break;
default:
break;
Hello all,
I have a HP Elite x360 1049 G9 2-in-1 notebook running fedora 38 with an Adler
Lake intel video card.
After upgrading to kernel 6.2.13 (as packaged by fedora), I started seeing
severe video glitches made of random pixels in a vertical band occupying about
20% of my screen, on the right. The glitches would happen both with X.org and
wayland.
I checked that vanilla 6.2.12 does not have the bug and that both vanilla
6.2.13 and vanilla 6.3.2 do have the bug.
I bisected the problem to commit e2b789bc3dc34edc87ffb85634967d24ed351acb (it
is a one-liner reproduced at the end of this message).
I checked that vanilla 6.3.2 with this commit reverted does not have the bug.
I am CC-ing every e-mail appearing in this commit , I hope this is ok, and I
apologize if it is not.
I have filled a fedora bug report about this, see https://bugzilla.redhat.com/
show_bug.cgi?id=2203549 . You will find there a small video (made with fedora
kernel 2.6.14) demonstrating the issue.
Some more details:
% sudo lspci -vk -s 00:02.0
00:02.0 VGA compatible controller: Intel Corporation Alder Lake-UP3 GT2 [Iris
Xe Graphics] (rev 0c) (prog-if 00 [VGA controller])
DeviceName: Onboard IGD
Subsystem: Hewlett-Packard Company Device 896d
Flags: bus master, fast devsel, latency 0, IRQ 143
Memory at 603c000000 (64-bit, non-prefetchable) [size=16M]
Memory at 4000000000 (64-bit, prefetchable) [size=256M]
I/O ports at 3000 [size=64]
Expansion ROM at 000c0000 [virtual] [disabled] [size=128K]
Capabilities: [40] Vendor Specific Information: Len=0c <?>
Capabilities: [70] Express Root Complex Integrated Endpoint, MSI 00
Capabilities: [ac] MSI: Enable+ Count=1/1 Maskable+ 64bit-
Capabilities: [d0] Power Management version 2
Capabilities: [100] Process Address Space ID (PASID)
Capabilities: [200] Address Translation Service (ATS)
Capabilities: [300] Page Request Interface (PRI)
Capabilities: [320] Single Root I/O Virtualization (SR-IOV)
Kernel driver in use: i915
Kernel modules: i915
Relevant kernel boot messages: (appart from timestamps, these lines are
identical for 6.2.12 and 6.2.14):
[ 2.790043] i915 0000:00:02.0: vgaarb: deactivate vga console
[ 2.790089] i915 0000:00:02.0: [drm] Using Transparent Hugepages
[ 2.790497] i915 0000:00:02.0: vgaarb: changed VGA decodes:
olddecodes=io+mem,decodes=io+mem:owns=io+mem
[ 2.793812] i915 0000:00:02.0: [drm] Finished loading DMC firmware i915/
adlp_dmc_ver2_16.bin (v2.16)
[ 2.825058] i915 0000:00:02.0: [drm] GuC firmware i915/adlp_guc_70.bin
version 70.5.1
[ 2.825061] i915 0000:00:02.0: [drm] HuC firmware i915/tgl_huc.bin version
7.9.3
[ 2.842906] i915 0000:00:02.0: [drm] HuC authenticated
[ 2.843778] i915 0000:00:02.0: [drm] GuC submission enabled
[ 2.843779] i915 0000:00:02.0: [drm] GuC SLPC enabled
[ 2.844200] i915 0000:00:02.0: [drm] GuC RC: enabled
[ 2.845010] i915 0000:00:02.0: [drm] Protected Xe Path (PXP) protected
content support initialized
[ 3.964766] [drm] Initialized i915 1.6.0 20201103 for 0000:00:02.0 on minor
1
[ 3.968403] ACPI: video: Video Device [GFX0] (multi-head: yes rom: no
post: no)
[ 3.968981] input: Video Bus as /devices/LNXSYSTM:00/LNXSYBUS:00/
PNP0A08:00/LNXVIDEO:00/input/input18
[ 3.977892] fbcon: i915drmfb (fb0) is primary device
[ 3.977899] fbcon: Deferring console take-over
[ 3.977904] i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device
[ 4.026120] i915 0000:00:02.0: [drm] Selective fetch area calculation
failed in pipe A
Is there anything else I should provide? I am willing to run some tests, of
course.
Thanks for your help,
Éric Brunet
=================================================
commit e2b789bc3dc34edc87ffb85634967d24ed351acb (HEAD)
Author: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Date: Wed Mar 29 20:24:33 2023 +0300
drm/i915: Fix fast wake AUX sync len
commit e1c71f8f918047ce822dc19b42ab1261ed259fd1 upstream.
Fast wake should use 8 SYNC pulses for the preamble
and 10-16 SYNC pulses for the precharge. Reduce our
fast wake SYNC count to match the maximum value.
We also use the maximum precharge length for normal
AUX transactions.
Cc: stable(a)vger.kernel.org
Cc: Jouni Högander <jouni.hogander(a)intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/
20230329172434.18744-1-ville.syrjala(a)linux.intel.com
Reviewed-by: Jouni Högander <jouni.hogander(a)intel.com>
(cherry picked from commit 605f7c73133341d4b762cbd9a22174cc22d4c38b)
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/gpu/drm/i915/display/intel_dp_aux.c b/drivers/gpu/drm/
i915/display/intel_dp_aux.c
index 664bebdecea7..d5fed2eb66d2 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_aux.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_aux.c
@@ -166,7 +166,7 @@ static u32 skl_get_aux_send_ctl(struct intel_dp *intel_dp,
DP_AUX_CH_CTL_TIME_OUT_MAX |
DP_AUX_CH_CTL_RECEIVE_ERROR |
(send_bytes << DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT) |
- DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL(32) |
+ DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL(24) |
DP_AUX_CH_CTL_SYNC_PULSE_SKL(32);
if (intel_tc_port_in_tbt_alt_mode(dig_port))
From: Oleksij Rempel <o.rempel(a)pengutronix.de>
This patch addresses an issue within the j1939_sk_send_loop_abort()
function in the j1939/socket.c file, specifically in the context of
Transport Protocol (TP) sessions.
Without this patch, when a TP session is initiated and a Clear To Send
(CTS) frame is received from the remote side requesting one data packet,
the kernel dispatches the first Data Transport (DT) frame and then waits
for the next CTS. If the remote side doesn't respond with another CTS,
the kernel aborts due to a timeout. This leads to the user-space
receiving an EPOLLERR on the socket, and the socket becomes active.
However, when trying to read the error queue from the socket with
sock.recvmsg(, , socket.MSG_ERRQUEUE), it returns -EAGAIN,
given that the socket is non-blocking. This situation results in an
infinite loop: the user-space repeatedly calls epoll(), epoll() returns
the socket file descriptor with EPOLLERR, but the socket then blocks on
the recv() of ERRQUEUE.
This patch introduces an additional check for the J1939_SOCK_ERRQUEUE
flag within the j1939_sk_send_loop_abort() function. If the flag is set,
it indicates that the application has subscribed to receive error queue
messages. In such cases, the kernel can communicate the current transfer
state via the error queue. This allows for the function to return early,
preventing the unnecessary setting of the socket into an error state,
and breaking the infinite loop. It is crucial to note that a socket
error is only needed if the application isn't using the error queue, as,
without it, the application wouldn't be aware of transfer issues.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Reported-by: David Jander <david(a)protonic.nl>
Tested-by: David Jander <david(a)protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de>
Link: https://lore.kernel.org/r/20230526081946.715190-1-o.rempel@pengutronix.de
Cc: stable(a)vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de>
---
net/can/j1939/socket.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 1790469b2580..35970c25496a 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -1088,6 +1088,11 @@ void j1939_sk_errqueue(struct j1939_session *session,
void j1939_sk_send_loop_abort(struct sock *sk, int err)
{
+ struct j1939_sock *jsk = j1939_sk(sk);
+
+ if (jsk->state & J1939_SOCK_ERRQUEUE)
+ return;
+
sk->sk_err = err;
sk_error_report(sk);
base-commit: 8cde87b007dad2e461015ff70352af56ceb02c75
--
2.39.2
This is the start of the stable review cycle for the 6.3.6 release.
There are 45 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 03 Jun 2023 13:19:19 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.6-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.3.6-rc1
Paul Blakey <paulb(a)nvidia.com>
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Gautham R. Shenoy <gautham.shenoy(a)amd.com>
cpufreq: amd-pstate: Add ->fast_switch() callback
Wyes Karny <wyes.karny(a)amd.com>
cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf()
Ruihan Li <lrh2000(a)pku.edu.cn>
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
David Epping <david.epping(a)missinglinkelectronics.com>
net: phy: mscc: enable VSC8501/2 RGMII RX clock
Wyes Karny <wyes.karny(a)amd.com>
cpufreq: amd-pstate: Remove fast_switch_possible flag from active driver
Yan Zhao <yan.y.zhao(a)intel.com>
vfio/type1: check pfn valid before converting to struct page
Tian Lan <tian.lan(a)twosigma.com>
blk-mq: fix race condition in active queue accounting
Yu Kuai <yukuai3(a)huawei.com>
blk-wbt: fix that wbt can't be disabled by default
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Incorrectly handling copied_seq
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Wake up polling after data copy
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: TCP data stall on recv before accept
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Handle fin correctly
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Improved check for empty queue
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Reschedule is now done through backlog
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Convert schedule_work into delayed_work
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Pass skb ownership through read_skb
Henning Schild <henning.schild(a)siemens.com>
gpio-f7188x: fix chip name and pin count on Nuvoton chip
Shay Drory <shayd(a)nvidia.com>
net/mlx5: E-switch, Devcom, sync devcom events and devcom comp register
Maher Sanalla <msanalla(a)nvidia.com>
Revert "net/mlx5: Expose vnic diagnostic counters for eswitch managed vports"
Maher Sanalla <msanalla(a)nvidia.com>
Revert "net/mlx5: Expose steering dropped packets counter"
Paul Blakey <paulb(a)nvidia.com>
net/mlx5e: TC, Fix using eswitch mapping in nic mode
Imre Deak <imre.deak(a)intel.com>
drm/i915: Fix PIPEDMC disabling for a bigjoiner configuration
Imre Deak <imre.deak(a)intel.com>
drm/i915: Disable DPLLs before disconnecting the TC PHY
Imre Deak <imre.deak(a)intel.com>
drm/i915: Move shared DPLL disabling into CRTC disable hook
Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com>
ASoC: Intel: avs: Fix module lookup
Robert Richter <rrichter(a)amd.com>
cxl/port: Fix NULL pointer access in devm_cxl_add_port()
Shenwei Wang <shenwei.wang(a)nxp.com>
net: fec: add dma_wmb to ensure correct descriptor values
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: don't use GFP_KERNEL in softirq context
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: preserve decryption status of skbs when needed
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: factor out copying skb data
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: force mixed decrypted records into copy mode
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: fix determining record length in copy mode
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: set the skb->len of detached / CoW'ed skbs
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: device: fix checking decryption status
Andreas Kemnade <andreas(a)kemnade.info>
gpiolib: fix allocation of mixed dynamic/static GPIOs
Jakub Kicinski <kuba(a)kernel.org>
bpf: netdev: init the offload table earlier
Mario Limonciello <mario.limonciello(a)amd.com>
platform/x86/amd/pmf: Fix CnQF and auto-mode after resume
ChiaEn Wu <chiaen_wu(a)richtek.com>
power: supply: rt9467: Fix passing zero to 'dev_err_probe'
Jeremy Sowden <jeremy(a)azazel.net>
selftests/bpf: Fix pkg-config call building sign-file
Christoph Niedermaier <cniedermaier(a)dh-electronics.com>
ARM: dts: imx6ull-dhcor: Set and limit the mode for PMIC buck 1, 2 and 3
Ruidong Tian <tianruidong(a)linux.alibaba.com>
coresight: perf: Release Coresight path when alloc trace id failed
Vijaya Krishna Nivarthi <quic_vnivarth(a)quicinc.com>
spi: spi-geni-qcom: Select FIFO mode for chip select
Sudeep Holla <sudeep.holla(a)arm.com>
firmware: arm_ffa: Fix usage of partition info get count flag
Tejun Heo <tj(a)kernel.org>
firmware: arm_scmi: Fix incorrect alloc_workqueue() invocation
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/imx6ull-dhcor-som.dtsi | 7 +
block/blk-mq-tag.c | 12 +-
block/blk-wbt.c | 12 +-
drivers/cpufreq/amd-pstate.c | 47 +++--
drivers/cxl/core/port.c | 7 +-
drivers/firmware/arm_ffa/driver.c | 3 +-
drivers/firmware/arm_scmi/raw_mode.c | 2 +-
drivers/gpio/Kconfig | 2 +-
drivers/gpio/gpio-f7188x.c | 28 +--
drivers/gpio/gpiolib.c | 2 +
drivers/gpu/drm/i915/display/intel_ddi.c | 15 +-
drivers/gpu/drm/i915/display/intel_display.c | 17 +-
drivers/gpu/drm/i915/display/intel_dp_mst.c | 15 ++
drivers/gpu/drm/i915/display/intel_modeset_setup.c | 1 -
drivers/hwtracing/coresight/coresight-etm-perf.c | 1 +
drivers/net/ethernet/freescale/fec_main.c | 17 +-
drivers/net/ethernet/mellanox/mlx5/core/Makefile | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 34 +++-
.../net/ethernet/mellanox/mlx5/core/esw/debugfs.c | 198 ---------------------
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 6 -
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 6 +-
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 12 +-
drivers/net/phy/mscc/mscc.h | 1 +
drivers/net/phy/mscc/mscc_main.c | 54 +++---
drivers/platform/x86/amd/pmf/core.c | 32 +++-
drivers/power/supply/rt9467-charger.c | 2 +-
drivers/spi/spi-geni-qcom.c | 2 +
drivers/vfio/vfio_iommu_type1.c | 5 +
include/linux/skbuff.h | 10 ++
include/linux/skmsg.h | 3 +-
include/net/tcp.h | 10 ++
include/net/tls.h | 1 +
kernel/bpf/offload.c | 2 +-
net/bluetooth/hci_sock.c | 28 +++
net/core/skmsg.c | 81 ++++-----
net/core/sock_map.c | 3 +-
net/ipv4/tcp.c | 11 +-
net/ipv4/tcp_bpf.c | 79 +++++++-
net/ipv4/udp.c | 7 +-
net/netfilter/nf_conntrack_netlink.c | 8 -
net/tls/tls.h | 5 +
net/tls/tls_device.c | 22 +--
net/tls/tls_strp.c | 185 +++++++++++++++----
net/tls/tls_sw.c | 4 +
net/unix/af_unix.c | 7 +-
sound/soc/intel/avs/control.c | 22 ++-
tools/testing/selftests/bpf/Makefile | 2 +-
48 files changed, 593 insertions(+), 443 deletions(-)
This is the start of the stable review cycle for the 6.1.32 release.
There are 39 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 03 Jun 2023 14:33:15 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.32-rc2…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.32-rc2
Yanteng Si <siyanteng(a)loongson.cn>
tools headers UAPI: Sync the linux/in.h with the kernel sources
Paul Blakey <paulb(a)nvidia.com>
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Gautham R. Shenoy <gautham.shenoy(a)amd.com>
cpufreq: amd-pstate: Add ->fast_switch() callback
Wyes Karny <wyes.karny(a)amd.com>
cpufreq: amd-pstate: Update policy->cur in amd_pstate_adjust_perf()
Anuj Gupta <anuj20.g(a)samsung.com>
block: fix bio-cache for passthru IO
Ido Schimmel <idosch(a)nvidia.com>
Revert "thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function"
Ruihan Li <lrh2000(a)pku.edu.cn>
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Don't allow s0ix on APUs older than Raven
Hariprasad Kelam <hkelam(a)marvell.com>
octeontx2-af: Add validation for lmac type
Zhu Yanjun <yanjun.zhu(a)linux.dev>
RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"
Johannes Berg <johannes.berg(a)intel.com>
wifi: iwlwifi: mvm: fix potential memory leak
Haim Dreyfuss <haim.dreyfuss(a)intel.com>
wifi: iwlwifi: mvm: support wowlan info notification version 2
Eric Huang <echuang(a)realtek.com>
wifi: rtw89: correct 5 MHz mask setting
David Epping <david.epping(a)missinglinkelectronics.com>
net: phy: mscc: enable VSC8501/2 RGMII RX clock
Yunsheng Lin <linyunsheng(a)huawei.com>
page_pool: fix inconsistency for page_pool_ring_[un]lock()
Qingfang DENG <qingfang.deng(a)siflower.com.cn>
net: page_pool: use in_softirq() instead
Yan Zhao <yan.y.zhao(a)intel.com>
vfio/type1: check pfn valid before converting to struct page
Tian Lan <tian.lan(a)twosigma.com>
blk-mq: fix race condition in active queue accounting
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Incorrectly handling copied_seq
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Wake up polling after data copy
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: TCP data stall on recv before accept
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Handle fin correctly
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Improved check for empty queue
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Reschedule is now done through backlog
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Convert schedule_work into delayed_work
John Fastabend <john.fastabend(a)gmail.com>
bpf, sockmap: Pass skb ownership through read_skb
Henning Schild <henning.schild(a)siemens.com>
gpio-f7188x: fix chip name and pin count on Nuvoton chip
Shay Drory <shayd(a)nvidia.com>
net/mlx5: E-switch, Devcom, sync devcom events and devcom comp register
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: preserve decryption status of skbs when needed
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: factor out copying skb data
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: force mixed decrypted records into copy mode
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: fix determining record length in copy mode
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: strp: set the skb->len of detached / CoW'ed skbs
Jakub Kicinski <kuba(a)kernel.org>
tls: rx: device: fix checking decryption status
Mario Limonciello <mario.limonciello(a)amd.com>
platform/x86/amd/pmf: Fix CnQF and auto-mode after resume
Jeremy Sowden <jeremy(a)azazel.net>
selftests/bpf: Fix pkg-config call building sign-file
Sudeep Holla <sudeep.holla(a)arm.com>
firmware: arm_ffa: Fix usage of partition info get count flag
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
Jakub Sitnicki <jakub(a)cloudflare.com>
inet: Add IP_LOCAL_PORT_RANGE socket option
-------------
Diffstat:
Makefile | 4 +-
block/blk-map.c | 2 +-
block/blk-mq-tag.c | 12 +-
drivers/cpufreq/amd-pstate.c | 45 ++++-
drivers/firmware/arm_ffa/driver.c | 3 +-
drivers/gpio/Kconfig | 2 +-
drivers/gpio/gpio-f7188x.c | 28 +--
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 7 +-
drivers/infiniband/sw/rxe/rxe_qp.c | 7 +-
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 8 +
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 1 +
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 9 +-
drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 209 ++++++++++++++++-----
drivers/net/phy/mscc/mscc.h | 1 +
drivers/net/phy/mscc/mscc_main.c | 54 +++---
drivers/net/wireless/intel/iwlwifi/fw/api/d3.h | 37 +++-
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 35 +++-
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 9 +-
drivers/platform/x86/amd/pmf/core.c | 32 +++-
drivers/vfio/vfio_iommu_type1.c | 5 +
include/linux/skbuff.h | 10 +
include/linux/skmsg.h | 3 +-
include/net/inet_sock.h | 4 +
include/net/ip.h | 5 +-
include/net/page_pool.h | 18 --
include/net/tcp.h | 10 +
include/net/tls.h | 1 +
include/uapi/linux/in.h | 2 +
net/bluetooth/hci_sock.c | 28 +++
net/core/page_pool.c | 34 +++-
net/core/skmsg.c | 81 ++++----
net/core/sock_map.c | 3 +-
net/ipv4/inet_connection_sock.c | 25 ++-
net/ipv4/inet_hashtables.c | 2 +-
net/ipv4/ip_sockglue.c | 30 ++-
net/ipv4/raw.c | 5 +-
net/ipv4/tcp.c | 11 +-
net/ipv4/tcp_bpf.c | 79 +++++++-
net/ipv4/udp.c | 9 +-
net/ipv6/raw.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 8 -
net/sctp/socket.c | 2 +-
net/tls/tls.h | 5 +
net/tls/tls_device.c | 22 +--
net/tls/tls_strp.c | 185 ++++++++++++++----
net/unix/af_unix.c | 7 +-
tools/include/uapi/linux/in.h | 1 +
tools/testing/selftests/bpf/Makefile | 2 +-
49 files changed, 827 insertions(+), 281 deletions(-)
This is the start of the stable review cycle for the 5.10.182 release.
There are 22 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 03 Jun 2023 13:19:19 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.182-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.182-rc1
Paul Blakey <paulb(a)nvidia.com>
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
Carlos Llamas <cmllamas(a)google.com>
binder: fix UAF caused by faulty buffer cleanup
Ruihan Li <lrh2000(a)pku.edu.cn>
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
David Epping <david.epping(a)missinglinkelectronics.com>
net: phy: mscc: enable VSC8501/2 RGMII RX clock
Shay Drory <shayd(a)nvidia.com>
net/mlx5: Devcom, serialize devcom registration
Mark Bloch <mbloch(a)nvidia.com>
net/mlx5: devcom only supports 2 ports
Alexander Stein <alexander.stein(a)ew.tq-group.com>
regulator: pca9450: Fix BUCK2 enable_mask
Axel Lin <axel.lin(a)ingics.com>
regulator: pca9450: Convert to use regulator_set_ramp_delay_regmap
Matti Vaittinen <matti.vaittinen(a)fi.rohmeurope.com>
regulator: Add regmap helper for ramp-delay setting
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq24190: Call power_supply_changed() after updating input current
Hans de Goede <hdegoede(a)redhat.com>
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: Move bq27xxx_battery_update() down
Sicelo A. Mhlongo <absicsz(a)gmail.com>
power: supply: bq27xxx: expose battery data when CI=1
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status()
Matthias Schiffer <matthias.schiffer(a)ew.tq-group.com>
power: supply: bq27xxx: make status more robust
Matthias Schiffer <matthias.schiffer(a)ew.tq-group.com>
power: supply: bq27xxx: fix sign of current_now for newer ICs
Andreas Kemnade <andreas(a)kemnade.info>
power: supply: bq27xxx: fix polarity of current_now
Tony Luck <tony.luck(a)intel.com>
x86/cpu: Drop spurious underscore from RAPTOR_LAKE #define
Tony Luck <tony.luck(a)intel.com>
x86/cpu: Add Raptor Lake to Intel family
-------------
Diffstat:
Makefile | 4 +-
arch/x86/include/asm/intel-family.h | 2 +
drivers/android/binder.c | 26 ++-
.../net/ethernet/mellanox/mlx5/core/lib/devcom.c | 35 ++--
.../net/ethernet/mellanox/mlx5/core/lib/devcom.h | 2 +
drivers/net/phy/mscc/mscc.h | 1 +
drivers/net/phy/mscc/mscc_main.c | 54 ++---
drivers/power/supply/bq24190_charger.c | 13 +-
drivers/power/supply/bq27xxx_battery.c | 224 +++++++++++----------
drivers/power/supply/power_supply_core.c | 57 +++---
drivers/regulator/helpers.c | 65 ++++++
drivers/regulator/pca9450-regulator.c | 55 +++--
include/linux/power/bq27xxx_battery.h | 3 +
include/linux/power_supply.h | 5 +-
include/linux/regulator/driver.h | 5 +
include/net/ip.h | 2 +
include/uapi/linux/in.h | 2 +
net/bluetooth/hci_sock.c | 28 +++
net/ipv4/ip_sockglue.c | 12 +-
net/ipv4/raw.c | 5 +-
net/ipv6/raw.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 8 -
22 files changed, 387 insertions(+), 224 deletions(-)
This is the start of the stable review cycle for the 5.4.245 release.
There are 16 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 03 Jun 2023 13:19:19 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.245-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.245-rc1
Paul Blakey <paulb(a)nvidia.com>
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
Carlos Llamas <cmllamas(a)google.com>
binder: fix UAF caused by faulty buffer cleanup
Ruihan Li <lrh2000(a)pku.edu.cn>
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Jens Axboe <axboe(a)kernel.dk>
io_uring: have io_kill_timeout() honor the request references
Jens Axboe <axboe(a)kernel.dk>
io_uring: don't drop completion lock before timer is fully initialized
Jens Axboe <axboe(a)kernel.dk>
io_uring: always grab lock in io_cancel_async_work()
Alexander Bersenev <bay(a)hackerdom.ru>
cdc_ncm: Fix the build warning
Shay Drory <shayd(a)nvidia.com>
net/mlx5: Devcom, serialize devcom registration
Mark Bloch <mbloch(a)nvidia.com>
net/mlx5: devcom only supports 2 ports
Hao Ge <gehao(a)kylinos.cn>
fs: fix undefined behavior in bit shift for SB_NOUSER
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq24190: Call power_supply_changed() after updating input current
Hans de Goede <hdegoede(a)redhat.com>
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
Tudor Ambarus <tudor.ambarus(a)linaro.org>
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
Alexander Bersenev <bay(a)hackerdom.ru>
cdc_ncm: Implement the 32-bit version of NCM Transfer Block
-------------
Diffstat:
Makefile | 4 +-
drivers/android/binder.c | 26 +-
.../net/ethernet/mellanox/mlx5/core/lib/devcom.c | 35 +-
.../net/ethernet/mellanox/mlx5/core/lib/devcom.h | 2 +
drivers/net/usb/cdc_ncm.c | 435 ++++++++++++++++-----
drivers/net/usb/huawei_cdc_ncm.c | 8 +-
drivers/power/supply/bq24190_charger.c | 13 +-
drivers/power/supply/bq27xxx_battery.c | 4 +-
drivers/power/supply/power_supply_core.c | 57 +--
fs/io_uring.c | 8 +-
include/linux/fs.h | 40 +-
include/linux/power_supply.h | 5 +-
include/linux/usb/cdc_ncm.h | 15 +-
include/net/ip.h | 2 +
include/uapi/linux/in.h | 2 +
net/bluetooth/hci_sock.c | 28 ++
net/ipv4/ip_sockglue.c | 12 +-
net/ipv4/raw.c | 5 +-
net/ipv6/raw.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 8 -
20 files changed, 521 insertions(+), 191 deletions(-)
I'm announcing the release of the 5.10.182 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/x86/include/asm/intel-family.h | 2
drivers/android/binder.c | 26 +-
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c | 35 +-
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h | 2
drivers/net/phy/mscc/mscc.h | 1
drivers/net/phy/mscc/mscc_main.c | 54 ++--
drivers/power/supply/bq24190_charger.c | 13 +
drivers/power/supply/bq27xxx_battery.c | 224 +++++++++----------
drivers/power/supply/power_supply_core.c | 57 ++--
drivers/regulator/helpers.c | 65 +++++
drivers/regulator/pca9450-regulator.c | 55 ++--
include/linux/power/bq27xxx_battery.h | 3
include/linux/power_supply.h | 5
include/linux/regulator/driver.h | 5
include/net/ip.h | 2
include/uapi/linux/in.h | 2
net/bluetooth/hci_sock.c | 28 ++
net/ipv4/ip_sockglue.c | 12 -
net/ipv4/raw.c | 5
net/ipv6/raw.c | 3
net/netfilter/nf_conntrack_netlink.c | 8
22 files changed, 386 insertions(+), 223 deletions(-)
Alexander Stein (1):
regulator: pca9450: Fix BUCK2 enable_mask
Andreas Kemnade (1):
power: supply: bq27xxx: fix polarity of current_now
Axel Lin (1):
regulator: pca9450: Convert to use regulator_set_ramp_delay_regmap
Carlos Llamas (1):
binder: fix UAF caused by faulty buffer cleanup
David Epping (1):
net: phy: mscc: enable VSC8501/2 RGMII RX clock
Greg Kroah-Hartman (1):
Linux 5.10.182
Hans de Goede (6):
power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status()
power: supply: bq27xxx: Move bq27xxx_battery_update() down
power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
power: supply: bq24190: Call power_supply_changed() after updating input current
Mark Bloch (1):
net/mlx5: devcom only supports 2 ports
Matthias Schiffer (2):
power: supply: bq27xxx: fix sign of current_now for newer ICs
power: supply: bq27xxx: make status more robust
Matti Vaittinen (1):
regulator: Add regmap helper for ramp-delay setting
Nicolas Dichtel (1):
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
Paul Blakey (1):
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Ruihan Li (1):
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Shay Drory (1):
net/mlx5: Devcom, serialize devcom registration
Sicelo A. Mhlongo (1):
power: supply: bq27xxx: expose battery data when CI=1
Tony Luck (2):
x86/cpu: Add Raptor Lake to Intel family
x86/cpu: Drop spurious underscore from RAPTOR_LAKE #define
I'm announcing the release of the 5.4.245 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
drivers/android/binder.c | 26 -
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c | 35 +
drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h | 2
drivers/net/usb/cdc_ncm.c | 435 ++++++++++++++-----
drivers/net/usb/huawei_cdc_ncm.c | 8
drivers/power/supply/bq24190_charger.c | 13
drivers/power/supply/bq27xxx_battery.c | 4
drivers/power/supply/power_supply_core.c | 57 +-
fs/io_uring.c | 8
include/linux/fs.h | 40 -
include/linux/power_supply.h | 5
include/linux/usb/cdc_ncm.h | 15
include/net/ip.h | 2
include/uapi/linux/in.h | 2
net/bluetooth/hci_sock.c | 28 +
net/ipv4/ip_sockglue.c | 12
net/ipv4/raw.c | 5
net/ipv6/raw.c | 3
net/netfilter/nf_conntrack_netlink.c | 8
20 files changed, 520 insertions(+), 190 deletions(-)
Alexander Bersenev (2):
cdc_ncm: Implement the 32-bit version of NCM Transfer Block
cdc_ncm: Fix the build warning
Carlos Llamas (1):
binder: fix UAF caused by faulty buffer cleanup
Greg Kroah-Hartman (1):
Linux 5.4.245
Hans de Goede (3):
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
power: supply: bq24190: Call power_supply_changed() after updating input current
Hao Ge (1):
fs: fix undefined behavior in bit shift for SB_NOUSER
Jens Axboe (3):
io_uring: always grab lock in io_cancel_async_work()
io_uring: don't drop completion lock before timer is fully initialized
io_uring: have io_kill_timeout() honor the request references
Mark Bloch (1):
net/mlx5: devcom only supports 2 ports
Nicolas Dichtel (1):
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
Paul Blakey (1):
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Ruihan Li (1):
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Shay Drory (1):
net/mlx5: Devcom, serialize devcom registration
Tudor Ambarus (1):
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
In I2C_FUNC_SMBUS_BLOCK_DATA case, the I2C Designware driver does not
handle correctly when it receives the length of SMBus block data
response from SMBus slave device, which is outside the range 1-32 bytes.
Consequently, the I2C Designware bus is stuck and cannot recover.
Because if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be detected
from the registers, the controller can be disabled if the STOP bit is set.
But it is only set after receiving block data response length.
Hence, to prevent the bus from stuck condition, after receiving the
invalid block data response length, the driver will read another byte
with STOP bit set.
Cc: stable(a)vger.kernel.org
Signed-off-by: Tam Nguyen <tamnguyenchi(a)os.amperecomputing.com>
---
drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index 55ea91a63382..94dadd785ed0 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -527,8 +527,19 @@ i2c_dw_read(struct dw_i2c_dev *dev)
regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
/* Ensure length byte is a valid value */
- if (flags & I2C_M_RECV_LEN &&
- (tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
+ if (flags & I2C_M_RECV_LEN) {
+ /*
+ * if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be
+ * detected from the registers, the controller can be
+ * disabled if the STOP bit is set. But it is only set
+ * after receiving block data response length in
+ * I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read
+ * another byte with STOP bit set when the block data
+ * response length is invalid to complete the transaction.
+ */
+ if ((tmp & DW_IC_DATA_CMD_DAT) > I2C_SMBUS_BLOCK_MAX || tmp == 0)
+ tmp = 1;
+
len = i2c_dw_recv_len(dev, tmp);
}
*buf++ = tmp;
--
2.25.1
From: Xiubo Li <xiubli(a)redhat.com>
Blindly expanding the readahead windows will cause unneccessary
pagecache thrashing and also will introdue the network workload.
We should disable expanding the windows if the readahead is disabled
and also shouldn't expand the windows too much.
Expanding forward firstly instead of expanding backward for possible
sequential reads.
Bound `rreq->len` to the actual file size to restore the previous page
cache usage.
The posix_fadvise may change the maximum size of a file readahead.
Cc: stable(a)vger.kernel.org
Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead")
URL: https://lore.kernel.org/ceph-devel/20230504082510.247-1-sehuww@mail.scut.ed…
URL: https://www.spinics.net/lists/ceph-users/msg76183.html
Cc: Hu Weiwen <sehuww(a)mail.scut.edu.cn>
Signed-off-by: Xiubo Li <xiubli(a)redhat.com>
---
fs/ceph/addr.c | 40 +++++++++++++++++++++++++++++++++-------
1 file changed, 33 insertions(+), 7 deletions(-)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 93fff1a7373f..4b29777c01d7 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -188,16 +188,42 @@ static void ceph_netfs_expand_readahead(struct netfs_io_request *rreq)
struct inode *inode = rreq->inode;
struct ceph_inode_info *ci = ceph_inode(inode);
struct ceph_file_layout *lo = &ci->i_layout;
+ unsigned long max_pages = inode->i_sb->s_bdi->ra_pages;
+ loff_t end = rreq->start + rreq->len, new_end;
+ struct ceph_netfs_request_data *priv = rreq->netfs_priv;
+ unsigned long max_len;
u32 blockoff;
- u64 blockno;
- /* Expand the start downward */
- blockno = div_u64_rem(rreq->start, lo->stripe_unit, &blockoff);
- rreq->start = blockno * lo->stripe_unit;
- rreq->len += blockoff;
+ if (priv) {
+ /* Readahead is disabled by posix_fadvise POSIX_FADV_RANDOM */
+ if (priv->file_ra_disabled)
+ max_pages = 0;
+ else
+ max_pages = priv->file_ra_pages;
+
+ }
+
+ /* Readahead is disabled */
+ if (!max_pages)
+ return;
- /* Now, round up the length to the next block */
- rreq->len = roundup(rreq->len, lo->stripe_unit);
+ max_len = max_pages << PAGE_SHIFT;
+
+ /*
+ * Try to expand the length forward by rounding up it to the next
+ * block, but do not exceed the file size, unless the original
+ * request already exceeds it.
+ */
+ new_end = min(round_up(end, lo->stripe_unit), rreq->i_size);
+ if (new_end > end && new_end <= rreq->start + max_len)
+ rreq->len = new_end - rreq->start;
+
+ /* Try to expand the start downward */
+ div_u64_rem(rreq->start, lo->stripe_unit, &blockoff);
+ if (rreq->len + blockoff <= max_len) {
+ rreq->start -= blockoff;
+ rreq->len += blockoff;
+ }
}
static bool ceph_netfs_clamp_length(struct netfs_io_subrequest *subreq)
--
2.40.1
Hi,
Sasha's auto-selection backported:
commit f3f8f16b10f8 ("drm/amd/display: enable DPG when disabling plane
for phantom pipe") from 6.4 into 6.3.y as
commit ef6c86d067b4 ("drm/amd/display: enable DPG when disabling plane
for phantom pipe")
This was bisected down to have caused a regression in both 6.3.4 and 6.3.5:
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2581
The problematic behavior doesn't occur in 6.4-rc4.
This is confirmed to fixed on 6.3.y by backporting an additional commit:
82a10aff9428 ("drm/amd/display: Only wait for blank completion if OTG
active")||
Can you please backport this to 6.3.y to fix this regression?
Thanks!
PEACE BE WITH YOU,
Receiving this message might sound as a surprise to you, please do
accept it as a blessing from God made possible through a woman (widow)
with a good and sincere heart towards the poor orphans. Through these
projects millions will be positively touched as with God nothing is
impossible. I have this strong desire to help the poor orphans
suffering each day, but this dream cannot be realised as a result of
my health, which does not improve, hence I do not know whether I will
survive having undergone different surgical operations, which has kept
me hospitalized. Right now, life gives me no choice, but to answer the
call (death); my prayers each day is to have a place in Heaven. I have
suffered a lot as a result of this incurable sickness (terminal
cancer)! Above all, I do not have a child as a result of my sterility.
The only help I need from you at this point is to be in constant
prayers with me as I believe you have an open heart towards the poor
orphans and do believe in GOD. I would be so much happy to see that my
funds (Eight million Five Hundred United State Dollars) 8.5 Million
USD are properly used to help the less privileged etc before leaving
this world as this will be a great relieve for me and my soul. This is
a huge responsibility, but I pray that God gives you the strength to
handle it. You will also be highly recompensated.
Therefore, I want you to receive the money and take 30% to take care
of yourself and family while 70% should be used basically on
humanitarian purposes mostly to orphanages, Motherless babies home,
less privileged and disable citizens and widows around the world.
Once I get your reply, I will put you in contact with the bank in
charge of the transaction in order to start all necessary procedures
so as to enable you to have possession of my funds as soon as possible
before my next surgical operations.
I looking forward to reading from you.( mirabelvicent01(a)gmail.com )
Mrs. Mirabel Vicent..
From: Tian Lan <tian.lan(a)twosigma.com>
The nr_active counter continues to increase over time which causes the
blk_mq_get_tag to hang until the thread is rescheduled to a different
core despite there are still tags available.
kernel-stack
INFO: task inboundIOReacto:3014879 blocked for more than 2 seconds
Not tainted 6.1.15-amd64 #1 Debian 6.1.15~debian11
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:inboundIORe state:D stack:0 pid:3014879 ppid:4557 flags:0x00000000
Call Trace:
<TASK>
__schedule+0x351/0xa20
scheduler+0x5d/0xe0
io_schedule+0x42/0x70
blk_mq_get_tag+0x11a/0x2a0
? dequeue_task_stop+0x70/0x70
__blk_mq_alloc_requests+0x191/0x2e0
kprobe output showing RQF_MQ_INFLIGHT bit is not cleared before
__blk_mq_free_request being called.
320 320 kworker/29:1H __blk_mq_free_request rq_flags 0x220c0
b'__blk_mq_free_request+0x1 [kernel]'
b'bt_iter+0x50 [kernel]'
b'blk_mq_queue_tag_busy_iter+0x318 [kernel]'
b'blk_mq_timeout_work+0x7c [kernel]'
b'process_one_work+0x1c4 [kernel]'
b'worker_thread+0x4d [kernel]'
b'kthread+0xe6 [kernel]'
b'ret_from_fork+0x1f [kernel]'
This issue arises when both bt_iter() and blk_mq_end_request_batch()
are iterating on the same request. The leak happens when
blk_mq_find_and_get_req() is executed(from bt_iter) before
req_ref_put_and_test() gets called by blk_mq_end_request_batch().
And because non-flush request freed by blk_mq_put_rq_ref() bypasses the
active request tracking, the counter would slowly leak overtime.
Fixes: f794f3351f26 ("block: add support for blk_mq_end_request_batch()")
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
Signed-off-by: Tian Lan <tian.lan(a)twosigma.com>
Reviewed-by: Ming Lei <ming.lei(a)redhat.com>
Reviewed-by: Hannes Reinecke <hare(a)suse.de>
Cc: stable(a)vger.kernel.org
---
block/blk-mq.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index f6dad0886a2f..850bfb844ed2 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -683,6 +683,10 @@ static void __blk_mq_free_request(struct request *rq)
blk_crypto_free_request(rq);
blk_pm_mark_last_busy(rq);
rq->mq_hctx = NULL;
+
+ if (rq->rq_flags & RQF_MQ_INFLIGHT)
+ __blk_mq_dec_active_requests(hctx);
+
if (rq->tag != BLK_MQ_NO_TAG)
blk_mq_put_tag(hctx->tags, ctx, rq->tag);
if (sched_tag != BLK_MQ_NO_TAG)
@@ -694,15 +698,11 @@ static void __blk_mq_free_request(struct request *rq)
void blk_mq_free_request(struct request *rq)
{
struct request_queue *q = rq->q;
- struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
if ((rq->rq_flags & RQF_ELVPRIV) &&
q->elevator->type->ops.finish_request)
q->elevator->type->ops.finish_request(rq);
- if (rq->rq_flags & RQF_MQ_INFLIGHT)
- __blk_mq_dec_active_requests(hctx);
-
if (unlikely(laptop_mode && !blk_rq_is_passthrough(rq)))
laptop_io_completion(q->disk->bdi);
--
2.25.1
The version is fetched once in check_version(), which then does some
validation and then overwrites the version in userspace with the API
version supported by the kernel. copy_params() then fetches the version
from userspace *again*, and this time no validation is done. The result
is that the kernel's version number is completely controllable by
userspace, provided that userspace can win a race condition.
Fix this flaw by not copying the version back to the kernel the second
time. This is not exploitable as the version is not further used in the
kernel. However, it could become a problem if future patches start
relying on the version field.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable(a)vger.kernel.org
Signed-off-by: Demi Marie Obenour <demi(a)invisiblethingslab.com>
---
drivers/md/dm-ioctl.c | 30 ++++++++++++++++++------------
1 file changed, 18 insertions(+), 12 deletions(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index da6ca26b51d0953df380582bb3a51c2ec22c27cb..7510afe237d979a5ee71afe87a20d49f631de1aa 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1873,30 +1873,33 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
* As well as checking the version compatibility this always
* copies the kernel interface version out.
*/
-static int check_version(unsigned int cmd, struct dm_ioctl __user *user)
+static int check_version(unsigned int cmd, struct dm_ioctl __user *user,
+ struct dm_ioctl *kernel_params)
{
- uint32_t version[3];
int r = 0;
- if (copy_from_user(version, user->version, sizeof(version)))
+ if (copy_from_user(kernel_params->version, user->version, sizeof(kernel_params->version)))
return -EFAULT;
- if ((version[0] != DM_VERSION_MAJOR) ||
- (version[1] > DM_VERSION_MINOR)) {
+ if ((kernel_params->version[0] != DM_VERSION_MAJOR) ||
+ (kernel_params->version[1] > DM_VERSION_MINOR)) {
DMERR("ioctl interface mismatch: kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",
DM_VERSION_MAJOR, DM_VERSION_MINOR,
DM_VERSION_PATCHLEVEL,
- version[0], version[1], version[2], cmd);
+ kernel_params->version[0],
+ kernel_params->version[1],
+ kernel_params->version[2],
+ cmd);
r = -EINVAL;
}
/*
* Fill in the kernel version.
*/
- version[0] = DM_VERSION_MAJOR;
- version[1] = DM_VERSION_MINOR;
- version[2] = DM_VERSION_PATCHLEVEL;
- if (copy_to_user(user->version, version, sizeof(version)))
+ kernel_params->version[0] = DM_VERSION_MAJOR;
+ kernel_params->version[1] = DM_VERSION_MINOR;
+ kernel_params->version[2] = DM_VERSION_PATCHLEVEL;
+ if (copy_to_user(user->version, kernel_params->version, sizeof(kernel_params->version)))
return -EFAULT;
return r;
@@ -1922,7 +1925,10 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
const size_t minimum_data_size = offsetof(struct dm_ioctl, data);
unsigned int noio_flag;
- if (copy_from_user(param_kernel, user, minimum_data_size))
+ /* Version has been copied from userspace already, avoid TOCTOU */
+ if (copy_from_user((char *)param_kernel + sizeof(param_kernel->version),
+ (char __user *)user + sizeof(param_kernel->version),
+ minimum_data_size - sizeof(param_kernel->version)))
return -EFAULT;
if (param_kernel->data_size < minimum_data_size) {
@@ -2034,7 +2040,7 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
* Check the interface version passed in. This also
* writes out the kernel's interface version.
*/
- r = check_version(cmd, user);
+ r = check_version(cmd, user, ¶m_kernel);
if (r)
return r;
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
This is the start of the stable review cycle for the 5.15.115 release.
There are 37 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 03 Jun 2023 14:33:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.115-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.115-rc2
Paul Blakey <paulb(a)nvidia.com>
netfilter: ctnetlink: Support offloaded conntrack entry deletion
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
Carlos Llamas <cmllamas(a)google.com>
binder: fix UAF of alloc->vma in race with munmap()
Carlos Llamas <cmllamas(a)google.com>
binder: add lockless binder_alloc_(set|get)_vma()
Carlos Llamas <cmllamas(a)google.com>
Revert "android: binder: stop saving a pointer to the VMA"
Carlos Llamas <cmllamas(a)google.com>
Revert "binder_alloc: add missing mmap_lock calls when using the VMA"
Ruihan Li <lrh2000(a)pku.edu.cn>
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
Yunsheng Lin <linyunsheng(a)huawei.com>
page_pool: fix inconsistency for page_pool_ring_[un]lock()
Qingfang DENG <qingfang.deng(a)siflower.com.cn>
net: page_pool: use in_softirq() instead
Toke Høiland-Jørgensen <toke(a)redhat.com>
xdp: Allow registering memory model without rxq reference
Rahul Rameshbabu <rrameshbabu(a)nvidia.com>
net/mlx5e: Fix SQ wake logic in ptp napi_poll context
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
irqchip/mips-gic: Use raw spinlock for gic_lock
Marc Zyngier <maz(a)kernel.org>
irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
Carlos Llamas <cmllamas(a)google.com>
binder: fix UAF caused by faulty buffer cleanup
Hangbin Liu <liuhangbin(a)gmail.com>
bonding: fix send_peer_notif overflow
Hangbin Liu <liuhangbin(a)gmail.com>
Bonding: add arp_missed_max option
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: fix network connectivity with multiple CPU ports
Daniel Golle <daniel(a)makrotopia.org>
net: dsa: mt7530: split-off common parts from mt7531_setup
Frank Wunderlich <frank-w(a)public-files.de>
net: dsa: mt7530: rework mt753[01]_setup
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: introduce helpers for iterating through ports using dp
Claudio Imbrenda <imbrenda(a)linux.ibm.com>
KVM: s390: fix race in gmap_make_secure()
Claudio Imbrenda <imbrenda(a)linux.ibm.com>
KVM: s390: pv: add export before import
David Epping <david.epping(a)missinglinkelectronics.com>
net: phy: mscc: enable VSC8501/2 RGMII RX clock
Steve Wahl <steve.wahl(a)hpe.com>
platform/x86: ISST: Remove 8 socket limit
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering
Shay Drory <shayd(a)nvidia.com>
net/mlx5: Devcom, serialize devcom registration
Vlad Buslov <vladbu(a)nvidia.com>
net/mlx5e: Fix deadlock in tc route query code
Mark Bloch <mbloch(a)nvidia.com>
net/mlx5: devcom only supports 2 ports
Anton Protopopov <aspsk(a)isovalent.com>
bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq24190: Call power_supply_changed() after updating input current
Hans de Goede <hdegoede(a)redhat.com>
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
Hans de Goede <hdegoede(a)redhat.com>
power: supply: bq27xxx: Move bq27xxx_battery_update() down
Sicelo A. Mhlongo <absicsz(a)gmail.com>
power: supply: bq27xxx: expose battery data when CI=1
-------------
Diffstat:
Documentation/networking/bonding.rst | 11 ++
Makefile | 4 +-
arch/s390/kernel/uv.c | 56 ++++---
drivers/android/binder.c | 26 +++-
drivers/android/binder_alloc.c | 64 +++-----
drivers/android/binder_alloc.h | 2 +-
drivers/android/binder_alloc_selftest.c | 2 +-
drivers/irqchip/irq-mips-gic.c | 65 +++++---
drivers/net/bonding/bond_main.c | 17 +-
drivers/net/bonding/bond_netlink.c | 22 ++-
drivers/net/bonding/bond_options.c | 36 ++++-
drivers/net/bonding/bond_procfs.c | 2 +
drivers/net/bonding/bond_sysfs.c | 13 ++
drivers/net/dsa/mt7530.c | 124 +++++++++------
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +--
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 19 ++-
.../net/ethernet/mellanox/mlx5/core/lib/devcom.c | 81 +++++++---
.../net/ethernet/mellanox/mlx5/core/lib/devcom.h | 3 +
drivers/net/phy/mscc/mscc.h | 1 +
drivers/net/phy/mscc/mscc_main.c | 54 +++----
.../x86/intel/speed_select_if/isst_if_common.c | 49 ++++--
drivers/power/supply/bq24190_charger.c | 13 +-
drivers/power/supply/bq27xxx_battery.c | 171 +++++++++++----------
drivers/power/supply/power_supply_core.c | 57 +++----
include/linux/power/bq27xxx_battery.h | 3 +
include/linux/power_supply.h | 5 +-
include/net/bond_options.h | 1 +
include/net/bonding.h | 3 +-
include/net/dsa.h | 28 ++++
include/net/ip.h | 2 +
include/net/page_pool.h | 18 ---
include/net/xdp.h | 3 +
include/uapi/linux/if_link.h | 1 +
include/uapi/linux/in.h | 2 +
kernel/bpf/hashtab.c | 6 +-
net/bluetooth/hci_sock.c | 28 ++++
net/core/page_pool.c | 34 +++-
net/core/xdp.c | 93 +++++++----
net/ipv4/ip_sockglue.c | 12 +-
net/ipv4/raw.c | 5 +-
net/ipv6/raw.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 8 -
tools/include/uapi/linux/if_link.h | 1 +
45 files changed, 763 insertions(+), 408 deletions(-)
The version is fetched once in check_version(), which then does some
validation and then overwrites the version in userspace with the API
version supported by the kernel. copy_params() then fetches the version
from userspace *again*, and this time no validation is done. The result
is that the kernel's version number is completely controllable by
userspace, provided that userspace can win a race condition.
Fix this flaw by not copying the version back to the kernel the second
time. This is not exploitable as the version is not further used in the
kernel. However, it could become a problem if future patches start
relying on the version field.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable(a)vger.kernel.org
Signed-off-by: Demi Marie Obenour <demi(a)invisiblethingslab.com>
---
drivers/md/dm-ioctl.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index da6ca26b51d0953df380582bb3a51c2ec22c27cb..fd46b249f6f856c49752063fc49d720e95df0525 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1873,12 +1873,13 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
* As well as checking the version compatibility this always
* copies the kernel interface version out.
*/
-static int check_version(unsigned int cmd, struct dm_ioctl __user *user)
+static int check_version(unsigned int cmd, struct dm_ioctl __user *user,
+ struct dm_ioctl *kernel_params)
{
- uint32_t version[3];
int r = 0;
+ uint32_t *version = kernel_params->version;
- if (copy_from_user(version, user->version, sizeof(version)))
+ if (copy_from_user(version, user->version, sizeof(user->version)))
return -EFAULT;
if ((version[0] != DM_VERSION_MAJOR) ||
@@ -1922,7 +1923,10 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
const size_t minimum_data_size = offsetof(struct dm_ioctl, data);
unsigned int noio_flag;
- if (copy_from_user(param_kernel, user, minimum_data_size))
+ /* Version has been copied from userspace already, avoid TOCTOU */
+ if (copy_from_user((char *)param_kernel + sizeof(param_kernel->version),
+ (char __user *)user + sizeof(param_kernel->version),
+ minimum_data_size - sizeof(param_kernel->version)))
return -EFAULT;
if (param_kernel->data_size < minimum_data_size) {
@@ -2034,7 +2038,7 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
* Check the interface version passed in. This also
* writes out the kernel's interface version.
*/
- r = check_version(cmd, user);
+ r = check_version(cmd, user, ¶m_kernel);
if (r)
return r;
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
This patch fixes a possible plock op collisions when using F_SETLKW lock
requests and fsid, number and owner are not enough to identify a result
for a pending request. The ltp testcases [0] and [1] are examples when
this is not enough in case of using classic posix locks with threads and
open filedescriptor posix locks.
The idea to fix the issue here is to place all lock request in order. In
case of non F_SETLKW lock request (indicated if wait is set or not) the
lock requests are ordered inside the recv_list. If a result comes back
the right plock op can be found by the first plock_op in recv_list which
has not info.wait set. This can be done only by non F_SETLKW plock ops as
dlm_controld always reads a specific plock op (list_move_tail() from
send_list to recv_mlist) and write the result immediately back.
This behaviour is for F_SETLKW not possible as multiple waiters can be
get a result back in an random order. To avoid a collisions in cases
like [0] or [1] this patch adds more fields to compare the plock
operations as the lock request is the same. This is also being made in
NFS to find an result for an asynchronous F_SETLKW lock request [2][3]. We
still can't find the exact lock request for a specific result if the
lock request is the same, but if this is the case we don't care the
order how the identical lock requests get their result back to grant the
lock.
[0] https://gitlab.com/netcoder/ltp/-/blob/dlm_fcntl_owner_testcase/testcases/k…
[1] https://gitlab.com/netcoder/ltp/-/blob/dlm_fcntl_owner_testcase/testcases/k…
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/inc…
[3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/…
Cc: stable(a)vger.kernel.org
Signed-off-by: Alexander Aring <aahringo(a)redhat.com>
---
change since v2:
- don't split recv_list into recv_setlkw_list
fs/dlm/plock.c | 43 ++++++++++++++++++++++++++++++-------------
1 file changed, 30 insertions(+), 13 deletions(-)
diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
index 31bc601ee3d8..53d17dbbb716 100644
--- a/fs/dlm/plock.c
+++ b/fs/dlm/plock.c
@@ -391,7 +391,7 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count,
if (op->info.flags & DLM_PLOCK_FL_CLOSE)
list_del(&op->list);
else
- list_move(&op->list, &recv_list);
+ list_move_tail(&op->list, &recv_list);
memcpy(&info, &op->info, sizeof(info));
}
spin_unlock(&ops_lock);
@@ -430,19 +430,36 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
return -EINVAL;
spin_lock(&ops_lock);
- list_for_each_entry(iter, &recv_list, list) {
- if (iter->info.fsid == info.fsid &&
- iter->info.number == info.number &&
- iter->info.owner == info.owner) {
- list_del_init(&iter->list);
- memcpy(&iter->info, &info, sizeof(info));
- if (iter->data)
- do_callback = 1;
- else
- iter->done = 1;
- op = iter;
- break;
+ if (info.wait) {
+ list_for_each_entry(iter, &recv_list, list) {
+ if (iter->info.fsid == info.fsid &&
+ iter->info.number == info.number &&
+ iter->info.owner == info.owner &&
+ iter->info.pid == info.pid &&
+ iter->info.start == info.start &&
+ iter->info.end == info.end &&
+ iter->info.ex == info.ex &&
+ iter->info.wait) {
+ op = iter;
+ break;
+ }
}
+ } else {
+ list_for_each_entry(iter, &recv_list, list) {
+ if (!iter->info.wait) {
+ op = iter;
+ break;
+ }
+ }
+ }
+
+ if (op) {
+ list_del_init(&op->list);
+ memcpy(&op->info, &info, sizeof(info));
+ if (op->data)
+ do_callback = 1;
+ else
+ op->done = 1;
}
spin_unlock(&ops_lock);
--
2.31.1
On Fri, 2 Jun 2023 15:57:46 -0700 Mike Kravetz <mike.kravetz(a)oracle.com> wrote:
> In commits d0ce0e47b323 and 91a2fb956ad99, hugetlb code was changed to
> use page_cache_next_miss to determine if a page was present in the page
> cache. However, the current implementation of page_cache_next_miss will
> always return the passed index if max_scan is 1 as in the hugetlb code.
> As a result, hugetlb code will always thing a page is present in the
> cache, even if that is not the case.
>
> The patch which follows addresses the issue by changing the implementation
> of page_cache_next_miss and for consistency page_cache_prev_miss. Since
> such a patch also impacts the readahead code, I would suggest using the
> patch by Sidhartha Kumar [1] to fix the issue in 6.3 and this patch moving
> forward.
Well this is tricky.
This patch applies cleanly to 6.3, so if we add cc:stable to this
patch, it will get backported, against your suggestion.
Sidhartha's patch [1] (which you recommend for -stable) is quite
different from this patch. And Sidhartha's patch has no route to being
tested in linux-next nor to being merged by Linus.
So problems. The preferable approach is to just backport this patch
into -stable in the usual fashion. What are the risks in doing this?
> If we would rather not modify page_cache_next/prev_miss, then a new
> interface as suggested by Ackerley Tng [2] could also be used.
>
> Comments on the best way to fix moving forward would be appreciated.
>
> [1] https://lore.kernel.org/linux-mm/20230505185301.534259-1-sidhartha.kumar@or…
> [2] https://lore.kernel.org/linux-mm/98624c2f481966492b4eb8272aef747790229b73.1…
>
> Mike Kravetz (1):
> page cache: fix page_cache_next/prev_miss off by one
>
> mm/filemap.c | 26 ++++++++++++++++----------
> 1 file changed, 16 insertions(+), 10 deletions(-)
>
Currently the offset into the device when looking for OTP
bits can go outside of the address of the MTD NOR devices,
and if that memory isn't readable, bad things happen
on the IXP4xx (added prints that illustrate the problem before
the crash):
cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100
ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78
cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000
ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78
8<--- cut here ---
Unable to handle kernel paging request at virtual address db000000
[db000000] *pgd=00000000
(...)
This happens in this case because the IXP4xx is big endian and
the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not
properly byteswapped. Compare to how the code in read_pri_intelext()
byteswaps the fields in struct cfi_pri_intelext.
Adding a small byte swapping loop for the OTP in read_pri_intelext()
and the crash goes away.
The problem went unnoticed for many years until I enabled
CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug.
Cc: Nicolas Pitre <npitre(a)baylibre.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org>
---
ChangeLog v2->v3:
- Move the byte swapping to a small loop in read_pri_intelext()
so all bytes are swapped as we reach cfi_intelext_otp_walk().
ChangeLog v1->v2:
- Drill deeper and discover a big endian compatibility issue.
---
drivers/mtd/chips/cfi_cmdset_0001.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 54f92d09d9cf..02aaf09d6f5c 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -421,9 +421,25 @@ read_pri_intelext(struct map_info *map, __u16 adr)
extra_size = 0;
/* Protection Register info */
- if (extp->NumProtectionFields)
+ if (extp->NumProtectionFields) {
+ struct cfi_intelext_otpinfo *otp =
+ (struct cfi_intelext_otpinfo *)&extp->extra[0];
+
extra_size += (extp->NumProtectionFields - 1) *
- sizeof(struct cfi_intelext_otpinfo);
+ sizeof(struct cfi_intelext_otpinfo);
+
+ if (extp_size >= sizeof(*extp) + extra_size) {
+ int i;
+
+ /* Do some byteswapping if necessary */
+ for (i = 0; i < extp->NumProtectionFields - 1; i++) {
+ otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr);
+ otp->FactGroups = le16_to_cpu(otp->FactGroups);
+ otp->UserGroups = le16_to_cpu(otp->UserGroups);
+ otp++;
+ }
+ }
+ }
}
if (extp->MinorVersion >= '1') {
--
2.40.1
The patch titled
Subject: mm/damon/ops-common: atomically test and clear young on ptes and pmds
has been added to the -mm mm-unstable branch. Its filename is
mm-damon-ops-common-atomically-test-and-clear-young-on-ptes-and-pmds.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Ryan Roberts <ryan.roberts(a)arm.com>
Subject: mm/damon/ops-common: atomically test and clear young on ptes and pmds
Date: Fri, 2 Jun 2023 10:29:47 +0100
It is racy to non-atomically read a pte, then clear the young bit, then
write it back as this could discard dirty information. Further, it is bad
practice to directly set a pte entry within a table. Instead clearing
young must go through the arch-provided helper,
ptep_test_and_clear_young() to ensure it is modified atomically and to
give the arch code visibility and allow it to check (and potentially
modify) the operation.
Link: https://lkml.kernel.org/r/20230602092949.545577-3-ryan.roberts@arm.com
Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces").
Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com>
Reviewed-by: Zi Yan <ziy(a)nvidia.com>
Reviewed-by: SeongJae Park <sj(a)kernel.org>
Reviewed-by: Mike Rapoport (IBM) <rppt(a)kernel.org>
Cc: Christoph Hellwig <hch(a)infradead.org>
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Lorenzo Stoakes <lstoakes(a)gmail.com>
Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: Uladzislau Rezki (Sony) <urezki(a)gmail.com>
Cc: Yu Zhao <yuzhao(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/damon/ops-common.c | 16 ++++++----------
mm/damon/ops-common.h | 4 ++--
mm/damon/paddr.c | 4 ++--
mm/damon/vaddr.c | 4 ++--
4 files changed, 12 insertions(+), 16 deletions(-)
--- a/mm/damon/ops-common.c~mm-damon-ops-common-atomically-test-and-clear-young-on-ptes-and-pmds
+++ a/mm/damon/ops-common.c
@@ -37,7 +37,7 @@ struct folio *damon_get_folio(unsigned l
return folio;
}
-void damon_ptep_mkold(pte_t *pte, struct mm_struct *mm, unsigned long addr)
+void damon_ptep_mkold(pte_t *pte, struct vm_area_struct *vma, unsigned long addr)
{
bool referenced = false;
struct folio *folio = damon_get_folio(pte_pfn(*pte));
@@ -45,13 +45,11 @@ void damon_ptep_mkold(pte_t *pte, struct
if (!folio)
return;
- if (pte_young(*pte)) {
+ if (ptep_test_and_clear_young(vma, addr, pte))
referenced = true;
- *pte = pte_mkold(*pte);
- }
#ifdef CONFIG_MMU_NOTIFIER
- if (mmu_notifier_clear_young(mm, addr, addr + PAGE_SIZE))
+ if (mmu_notifier_clear_young(vma->vm_mm, addr, addr + PAGE_SIZE))
referenced = true;
#endif /* CONFIG_MMU_NOTIFIER */
@@ -62,7 +60,7 @@ void damon_ptep_mkold(pte_t *pte, struct
folio_put(folio);
}
-void damon_pmdp_mkold(pmd_t *pmd, struct mm_struct *mm, unsigned long addr)
+void damon_pmdp_mkold(pmd_t *pmd, struct vm_area_struct *vma, unsigned long addr)
{
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
bool referenced = false;
@@ -71,13 +69,11 @@ void damon_pmdp_mkold(pmd_t *pmd, struct
if (!folio)
return;
- if (pmd_young(*pmd)) {
+ if (pmdp_test_and_clear_young(vma, addr, pmd))
referenced = true;
- *pmd = pmd_mkold(*pmd);
- }
#ifdef CONFIG_MMU_NOTIFIER
- if (mmu_notifier_clear_young(mm, addr, addr + HPAGE_PMD_SIZE))
+ if (mmu_notifier_clear_young(vma->vm_mm, addr, addr + HPAGE_PMD_SIZE))
referenced = true;
#endif /* CONFIG_MMU_NOTIFIER */
--- a/mm/damon/ops-common.h~mm-damon-ops-common-atomically-test-and-clear-young-on-ptes-and-pmds
+++ a/mm/damon/ops-common.h
@@ -9,8 +9,8 @@
struct folio *damon_get_folio(unsigned long pfn);
-void damon_ptep_mkold(pte_t *pte, struct mm_struct *mm, unsigned long addr);
-void damon_pmdp_mkold(pmd_t *pmd, struct mm_struct *mm, unsigned long addr);
+void damon_ptep_mkold(pte_t *pte, struct vm_area_struct *vma, unsigned long addr);
+void damon_pmdp_mkold(pmd_t *pmd, struct vm_area_struct *vma, unsigned long addr);
int damon_cold_score(struct damon_ctx *c, struct damon_region *r,
struct damos *s);
--- a/mm/damon/paddr.c~mm-damon-ops-common-atomically-test-and-clear-young-on-ptes-and-pmds
+++ a/mm/damon/paddr.c
@@ -24,9 +24,9 @@ static bool __damon_pa_mkold(struct foli
while (page_vma_mapped_walk(&pvmw)) {
addr = pvmw.address;
if (pvmw.pte)
- damon_ptep_mkold(pvmw.pte, vma->vm_mm, addr);
+ damon_ptep_mkold(pvmw.pte, vma, addr);
else
- damon_pmdp_mkold(pvmw.pmd, vma->vm_mm, addr);
+ damon_pmdp_mkold(pvmw.pmd, vma, addr);
}
return true;
}
--- a/mm/damon/vaddr.c~mm-damon-ops-common-atomically-test-and-clear-young-on-ptes-and-pmds
+++ a/mm/damon/vaddr.c
@@ -311,7 +311,7 @@ static int damon_mkold_pmd_entry(pmd_t *
}
if (pmd_trans_huge(*pmd)) {
- damon_pmdp_mkold(pmd, walk->mm, addr);
+ damon_pmdp_mkold(pmd, walk->vma, addr);
spin_unlock(ptl);
return 0;
}
@@ -323,7 +323,7 @@ static int damon_mkold_pmd_entry(pmd_t *
pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
if (!pte_present(*pte))
goto out;
- damon_ptep_mkold(pte, walk->mm, addr);
+ damon_ptep_mkold(pte, walk->vma, addr);
out:
pte_unmap_unlock(pte, ptl);
return 0;
_
Patches currently in -mm which might be from ryan.roberts(a)arm.com are
mm-vmalloc-must-set-pte-via-arch-code.patch
mm-damon-ops-common-atomically-test-and-clear-young-on-ptes-and-pmds.patch
mm-damon-ops-common-refactor-to-use-ptepmdp_clear_young_notify.patch
mm-fix-failure-to-unmap-pte-on-highmem-systems.patch
From: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
With commit 858e8b792d06 ("tpm, tpm_tis: Avoid cache incoherency in test
for interrupts") bit accessor functions are used to access flags in
tpm_tis_data->flags.
However these functions expect bit numbers, while the flags are defined as
bit masks in enum tpm_tis_flag.
Fix this inconsistency by using numbers instead of masks also for the flags
in the enum.
Reported-by: Pavel Machek <pavel(a)denx.de>
Fixes: 858e8b792d06 ("tpm, tpm_tis: Avoid cache incoherency in test for interrupts")
Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com>
Cc: stable(a)vger.kernel.org
---
drivers/char/tpm/tpm_tis_core.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
index e978f457fd4d..610bfadb6acf 100644
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -84,10 +84,10 @@ enum tis_defaults {
#define ILB_REMAP_SIZE 0x100
enum tpm_tis_flags {
- TPM_TIS_ITPM_WORKAROUND = BIT(0),
- TPM_TIS_INVALID_STATUS = BIT(1),
- TPM_TIS_DEFAULT_CANCELLATION = BIT(2),
- TPM_TIS_IRQ_TESTED = BIT(3),
+ TPM_TIS_ITPM_WORKAROUND = 0,
+ TPM_TIS_INVALID_STATUS = 1,
+ TPM_TIS_DEFAULT_CANCELLATION = 2,
+ TPM_TIS_IRQ_TESTED = 3,
};
struct tpm_tis_data {
base-commit: 7877cb91f1081754a1487c144d85dc0d2e2e7fc4
--
2.40.1
usb_udc_vbus_handler() can be invoked from interrupt context by irq
handlers of the gadget drivers, however, usb_udc_connect_control() has
to run in non-atomic context due to the following:
a. Some of the gadget driver implementations expect the ->pullup
callback to be invoked in non-atomic context.
b. usb_gadget_disconnect() acquires udc_lock which is a mutex.
Hence offload invocation of usb_udc_connect_control()
to workqueue.
Cc: stable(a)vger.kernel.org
Fixes: 1016fc0c096c ("USB: gadget: Fix obscure lockdep violation for udc_mutex")
Signed-off-by: Badhri Jagan Sridharan <badhri(a)google.com>
---
Changes since v1:
- Address Alan Stern's comment on usb_udc_vbus_handler invocation from
atomic context:
* vbus_events_lock is now a spinlock and allocations in
* usb_udc_vbus_handler are atomic now.
Changes since v2:
- Addressing Alan Stern's comments:
** connect_lock is now held by callers of
* usb_gadget_pullup_update_locked() and gadget_(un)bind_driver() does
* notdirectly hold the lock.
** Both usb_gadget_(dis)connect() and usb_udc_vbus_handler() would
* set/clear udc->vbus and invoke usb_gadget_pullup_update_locked.
** Add "unbinding" to prevent new connections after the gadget is being
* unbound.
Changes since v3:
** Made a minor cleanup which I missed to do in v3 in
* usb_udc_vbus_handler().
Changes since v4:
- Addressing Alan Stern's comments:
** usb_udc_vbus_handler() now offloads invocation of usb_udc_connect_control()
* from workqueue.
** Dropped vbus_events list as this was redundant. Updating to the
* latest value is suffice
---
drivers/usb/gadget/udc/core.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 52e6d2e84e35..44a9f32679b5 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -48,6 +48,7 @@ struct usb_udc {
struct list_head list;
bool vbus;
bool started;
+ struct work_struct vbus_work;
};
static struct class *udc_class;
@@ -1086,6 +1087,13 @@ static void usb_udc_connect_control(struct usb_udc *udc)
usb_gadget_disconnect(udc->gadget);
}
+static void vbus_event_work(struct work_struct *work)
+{
+ struct usb_udc *udc = container_of(work, struct usb_udc, vbus_work);
+
+ usb_udc_connect_control(udc);
+}
+
/**
* usb_udc_vbus_handler - updates the udc core vbus status, and try to
* connect or disconnect gadget
@@ -1094,6 +1102,13 @@ static void usb_udc_connect_control(struct usb_udc *udc)
*
* The udc driver calls it when it wants to connect or disconnect gadget
* according to vbus status.
+ *
+ * This function can be invoked from interrupt context by irq handlers of the gadget drivers,
+ * however, usb_udc_connect_control() has to run in non-atomic context due to the following:
+ * a. Some of the gadget driver implementations expect the ->pullup callback to be invoked in
+ * non-atomic context.
+ * b. usb_gadget_disconnect() acquires udc_lock which is a mutex.
+ * Hence offload invocation of usb_udc_connect_control() to workqueue.
*/
void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
{
@@ -1101,7 +1116,7 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
if (udc) {
udc->vbus = status;
- usb_udc_connect_control(udc);
+ schedule_work(&udc->vbus_work);
}
}
EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
@@ -1328,6 +1343,7 @@ int usb_add_gadget(struct usb_gadget *gadget)
mutex_lock(&udc_lock);
list_add_tail(&udc->list, &udc_list);
mutex_unlock(&udc_lock);
+ INIT_WORK(&udc->vbus_work, vbus_event_work);
ret = device_add(&udc->dev);
if (ret)
@@ -1558,6 +1574,7 @@ static void gadget_unbind_driver(struct device *dev)
kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
+ cancel_work_sync(&udc->vbus_work);
usb_gadget_disconnect(gadget);
usb_gadget_disable_async_callbacks(udc);
if (gadget->irq)
base-commit: 046895105d9666ab56e86ce8dd9786f8003125c6
--
2.41.0.rc0.172.g3f132b7071-goog
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
When configuring a pin as an output pin with a value of logic 0, we
end up as having a value of logic 1 on the output pin. Setting a
logic 0 a second time (or more) after that will correctly output a
logic 0 on the output pin.
By default, all GPIO pins are configured as inputs. When we enter
sc16is7xx_gpio_direction_output() for the first time, we first set the
desired value in IOSTATE, and then we configure the pin as an output.
The datasheet states that writing to IOSTATE register will trigger a
transfer of the value to the I/O pin configured as output, so if the
pin is configured as an input, nothing will be transferred.
Therefore, set the direction first in IODIR, and then set the desired
value in IOSTATE.
This is what is done in NXP application note AN10587.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Reviewed-by: Lech Perczak <lech.perczak(a)camlingroup.com>
Tested-by: Lech Perczak <lech.perczak(a)camlingroup.com>
---
drivers/tty/serial/sc16is7xx.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index edc83f5f6340..7a9b91f0c710 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1340,9 +1340,18 @@ static int sc16is7xx_gpio_direction_output(struct gpio_chip *chip,
state |= BIT(offset);
else
state &= ~BIT(offset);
- sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
+
+ /*
+ * If we write IOSTATE first, and then IODIR, the output value is not
+ * transferred to the corresponding I/O pin.
+ * The datasheet states that each register bit will be transferred to
+ * the corresponding I/O pin programmed as output when writing to
+ * IOSTATE. Therefore, configure direction first with IODIR, and then
+ * set value after with IOSTATE.
+ */
sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset),
BIT(offset));
+ sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
return 0;
}
--
2.30.2
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Some variants in this series of UART controllers have GPIO pins that
are shared between GPIO and modem control lines.
The pin mux mode (GPIO or modem control lines) can be set for each
ports (channels) supported by the variant.
This adds a property to the device tree to set the GPIO pin mux to
modem control lines on selected ports if needed.
Cc: <stable(a)vger.kernel.org> # 6.1.x
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Acked-by: Conor Dooley <conor.dooley(a)microchip.com>
Reviewed-by: Lech Perczak <lech.perczak(a)camlingroup.com>
---
.../bindings/serial/nxp,sc16is7xx.txt | 46 +++++++++++++++++++
1 file changed, 46 insertions(+)
diff --git a/Documentation/devicetree/bindings/serial/nxp,sc16is7xx.txt b/Documentation/devicetree/bindings/serial/nxp,sc16is7xx.txt
index 0fa8e3e43bf8..1a7e4bff0456 100644
--- a/Documentation/devicetree/bindings/serial/nxp,sc16is7xx.txt
+++ b/Documentation/devicetree/bindings/serial/nxp,sc16is7xx.txt
@@ -23,6 +23,9 @@ Optional properties:
1 = active low.
- irda-mode-ports: An array that lists the indices of the port that
should operate in IrDA mode.
+- nxp,modem-control-line-ports: An array that lists the indices of the port that
+ should have shared GPIO lines configured as
+ modem control lines.
Example:
sc16is750: sc16is750@51 {
@@ -35,6 +38,26 @@ Example:
#gpio-cells = <2>;
};
+ sc16is752: sc16is752@53 {
+ compatible = "nxp,sc16is752";
+ reg = <0x53>;
+ clocks = <&clk20m>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+ nxp,modem-control-line-ports = <1>; /* Port 1 as modem control lines */
+ gpio-controller; /* Port 0 as GPIOs */
+ #gpio-cells = <2>;
+ };
+
+ sc16is752: sc16is752@54 {
+ compatible = "nxp,sc16is752";
+ reg = <0x54>;
+ clocks = <&clk20m>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+ nxp,modem-control-line-ports = <0 1>; /* Ports 0 and 1 as modem control lines */
+ };
+
* spi as bus
Required properties:
@@ -59,6 +82,9 @@ Optional properties:
1 = active low.
- irda-mode-ports: An array that lists the indices of the port that
should operate in IrDA mode.
+- nxp,modem-control-line-ports: An array that lists the indices of the port that
+ should have shared GPIO lines configured as
+ modem control lines.
Example:
sc16is750: sc16is750@0 {
@@ -70,3 +96,23 @@ Example:
gpio-controller;
#gpio-cells = <2>;
};
+
+ sc16is752: sc16is752@1 {
+ compatible = "nxp,sc16is752";
+ reg = <1>;
+ clocks = <&clk20m>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+ nxp,modem-control-line-ports = <1>; /* Port 1 as modem control lines */
+ gpio-controller; /* Port 0 as GPIOs */
+ #gpio-cells = <2>;
+ };
+
+ sc16is752: sc16is752@2 {
+ compatible = "nxp,sc16is752";
+ reg = <2>;
+ clocks = <&clk20m>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+ nxp,modem-control-line-ports = <0 1>; /* Ports 0 and 1 as modem control lines */
+ };
--
2.30.2
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Bit SRESET (3) is cleared when a reset operation is completed. Having
the IOCONTROL register as non-volatile will always read SRESET as 1,
which is incorrect.
Also, if IOCONTROL register is not a volatile register, the upcoming
patch "serial: sc16is7xx: fix regression with GPIO configuration"
doesn't work when setting some shared GPIO lines as modem control
lines.
Therefore mark IOCONTROL register as a volatile register.
Cc: <stable(a)vger.kernel.org> # 6.1.x
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Reviewed-by: Lech Perczak <lech.perczak(a)camlingroup.com>
Tested-by: Lech Perczak <lech.perczak(a)camlingroup.com>
---
drivers/tty/serial/sc16is7xx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index faa51a58671f..0c903d44429c 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -488,6 +488,7 @@ static bool sc16is7xx_regmap_volatile(struct device *dev, unsigned int reg)
case SC16IS7XX_TXLVL_REG:
case SC16IS7XX_RXLVL_REG:
case SC16IS7XX_IOSTATE_REG:
+ case SC16IS7XX_IOCONTROL_REG:
return true;
default:
break;
--
2.30.2
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
The sc16is7xx_config_rs485() function is called only for the second
port (index 1, channel B), causing initialization problems for the
first port.
For the sc16is7xx driver, port->membase and port->mapbase are not set,
and their default values are 0. And we set port->iobase to the device
index. This means that when the first device is registered using the
uart_add_one_port() function, the following values will be in the port
structure:
port->membase = 0
port->mapbase = 0
port->iobase = 0
Therefore, the function uart_configure_port() in serial_core.c will
exit early because of the following check:
/*
* If there isn't a port here, don't do anything further.
*/
if (!port->iobase && !port->mapbase && !port->membase)
return;
Typically, I2C and SPI drivers do not set port->membase and
port->mapbase.
The max310x driver sets port->membase to ~0 (all ones). By
implementing the same change in this driver, uart_configure_port() is
now correctly executed for all ports.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: <stable(a)vger.kernel.org> # 6.1.x
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
Reviewed-by: Lech Perczak <lech.perczak(a)camlingroup.com>
Tested-by: Lech Perczak <lech.perczak(a)camlingroup.com>
---
drivers/tty/serial/sc16is7xx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index abad091baeea..faa51a58671f 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1436,6 +1436,7 @@ static int sc16is7xx_probe(struct device *dev,
s->p[i].port.fifosize = SC16IS7XX_FIFO_SIZE;
s->p[i].port.flags = UPF_FIXED_TYPE | UPF_LOW_LATENCY;
s->p[i].port.iobase = i;
+ s->p[i].port.membase = (void __iomem *)~0;
s->p[i].port.iotype = UPIO_PORT;
s->p[i].port.uartclk = freq;
s->p[i].port.rs485_config = sc16is7xx_config_rs485;
--
2.30.2
From: Roberto Sassu <roberto.sassu(a)huawei.com>
Changelog:
v4:
- Replace sg_init_table()/sg_set_buf() with sg_init_one() (suggested by
Eric)
v3:
v2:
- Add patch by Herbert to take only the needed bytes for a MPI from the
scatterlist
- Use only one scatterlist for signature and digest (suggested by Eric)
- Rename key variable to buf (suggested by Eric)
- Rename key_max_len variable to buf_len
- Use size_t for the buf_len variable instead of u32
v1:
- Unconditionally copy the signature and digest to the buffer to keep the
code simple (suggested by Eric)
Herbert Xu (1):
lib/mpi: Fix buffer overrun when SG is too long
Roberto Sassu (1):
KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
crypto/asymmetric_keys/public_key.c | 38 ++++++++++++++++-------------
lib/mpi/mpicoder.c | 3 ++-
2 files changed, 23 insertions(+), 18 deletions(-)
--
2.25.1
Currently the locking order of inode locks for directories that are not
in ancestor relationship is not defined because all operations that
needed to lock two directories like this were serialized by
sb->s_vfs_rename_mutex. However some filesystems need to lock two
subdirectories for RENAME_EXCHANGE operations and for this we need the
locking order established even for two tree-unrelated directories.
Provide a helper function lock_two_inodes() that establishes lock
ordering for any two inodes and use it in lock_two_directories().
CC: stable(a)vger.kernel.org
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
fs/inode.c | 42 ++++++++++++++++++++++++++++++++++++++++++
fs/internal.h | 2 ++
fs/namei.c | 4 ++--
3 files changed, 46 insertions(+), 2 deletions(-)
diff --git a/fs/inode.c b/fs/inode.c
index 577799b7855f..4000ab08bbc0 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1103,6 +1103,48 @@ void discard_new_inode(struct inode *inode)
}
EXPORT_SYMBOL(discard_new_inode);
+/**
+ * lock_two_inodes - lock two inodes (may be regular files but also dirs)
+ *
+ * Lock any non-NULL argument. The caller must make sure that if he is passing
+ * in two directories, one is not ancestor of the other. Zero, one or two
+ * objects may be locked by this function.
+ *
+ * @inode1: first inode to lock
+ * @inode2: second inode to lock
+ * @subclass1: inode lock subclass for the first lock obtained
+ * @subclass2: inode lock subclass for the second lock obtained
+ */
+void lock_two_inodes(struct inode *inode1, struct inode *inode2,
+ unsigned subclass1, unsigned subclass2)
+{
+ if (!inode1 || !inode2)
+ /*
+ * Make sure @subclass1 will be used for the acquired lock.
+ * This is not strictly necessary (no current caller cares) but
+ * let's keep things consistent.
+ */
+ if (!inode1)
+ swap(inode1, inode2);
+ goto lock;
+ }
+
+ /*
+ * If one object is directory and the other is not, we must make sure
+ * to lock directory first as the other object may be its child.
+ */
+ if (S_ISDIR(inode2->i_mode) == S_ISDIR(inode1->i_mode)) {
+ if (inode1 > inode2)
+ swap(inode1, inode2);
+ } else if (!S_ISDIR(inode1->i_mode))
+ swap(inode1, inode2);
+lock:
+ if (inode1)
+ inode_lock_nested(inode1, subclass1);
+ if (inode2 && inode2 != inode1)
+ inode_lock_nested(inode2, subclass2);
+}
+
/**
* lock_two_nondirectories - take two i_mutexes on non-directory objects
*
diff --git a/fs/internal.h b/fs/internal.h
index bd3b2810a36b..377030a50aca 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -152,6 +152,8 @@ extern long prune_icache_sb(struct super_block *sb, struct shrink_control *sc);
int dentry_needs_remove_privs(struct mnt_idmap *, struct dentry *dentry);
bool in_group_or_capable(struct mnt_idmap *idmap,
const struct inode *inode, vfsgid_t vfsgid);
+void lock_two_inodes(struct inode *inode1, struct inode *inode2,
+ unsigned subclass1, unsigned subclass2);
/*
* fs-writeback.c
diff --git a/fs/namei.c b/fs/namei.c
index e4fe0879ae55..148570aabe74 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3028,8 +3028,8 @@ static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2)
return p;
}
- inode_lock_nested(p1->d_inode, I_MUTEX_PARENT);
- inode_lock_nested(p2->d_inode, I_MUTEX_PARENT2);
+ lock_two_inodes(p1->d_inode, p2->d_inode,
+ I_MUTEX_PARENT, I_MUTEX_PARENT2);
return NULL;
}
--
2.35.3
Hi,
I notice a regression report on Bugzilla [1]. Quoting from it:
> Null pointer deref
>
> after reverting 326e1c208f3f24d14b93f910b8ae32c94923d22c the problem is gone and the kernel does not crash anymore
>
> See this discussion for details:
>
> https://bbs.archlinux.org/viewtopic.php?pid=2102715#p2102715
>
See Bugzilla for the full thread and attached journal log.
On the other hand, from linked Archlinux forum link:
> Hi,
>
> I am running arch successfully since a couple of years on my Acer ConceptD 7 laptop. Since a kernel update on 24th of May I am having strange issues (never seen this before):
>
> - sometimes I cannot even login (using gdm) - after entering password just a blank screen
> - if I can login I can start working - after a while commands I enter in the console are accepted but do nothing (i.e. grub-mkconfig -o ..... can enter the command but just no output - it does nothing - happens with most other command then as well....)
> - Reboot does not work - stuck somewhere - have to switch the machine off the hard way
> - this happens even when entering runlevel 3 (so no window manager)
> - same happens on the laptop of a friend (exact same model) - unfortunately I have no other piece of hardware which I could use for testing to potentially reproduce the problem
>
> Managed to trace this down to all kernels after 6.3.3.arch1-1 - so 6.3.3.arch1-1 it the last one which works without any problems
> Same applies for the LTS kernels - not 100% sure but think 6.1.29 ist the last one which works
>
> Currently I have marked linux linux-headers and nvidia to not upgrade. LTS kernels are upgraded but the latest two kernels (latest from today) up until 6.1.31-1 do NOT work
>
> Problem: Since most of the command fail when using one of the latest kernel - it is almost impossible to debug - at least I am not knowledgable enough to know where to look.
Anyway, I'm adding it to regzbot:
#regzbot introduced: 326e1c208f3f24 https://bugzilla.kernel.org/show_bug.cgi?id=217517
#regzbot title: USB typec quirk for Asus Zenbook UM325 triggers system freeze on Acer ConceptD 7
#regzbot link: https://bbs.archlinux.org/viewtopic.php?pid=2102715
Thanks.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=217517
--
An old man doll... just what I always wanted! - Clara