A recent commit moved enabling of runtime PM from adreno_gpu_init() to
adreno_load_gpu() (called on first open()), which means that unbind()
may now be called with runtime PM disabled in case the device was never
opened in between.
Make sure to only forcibly suspend and disable runtime PM at unbind() in
case runtime PM has been enabled to prevent a disable count imbalance.
This specifically avoids leaving runtime PM disabled when the device
is later opened after a successful bind:
msm_dpu ae01000.display-controller: [drm:adreno_load_gpu [msm]] *ERROR* Couldn't power up the GPU: -13
Fixes: 4b18299b3365 ("drm/msm/adreno: Defer enabling runpm until hw_init()")
Reported-by: Bjorn Andersson <quic_bjorande(a)quicinc.com>
Link: https://lore.kernel.org/lkml/20230203181245.3523937-1-quic_bjorande@quicinc…
Cc: stable(a)vger.kernel.org # 6.0
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/gpu/drm/msm/adreno/adreno_device.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
index 36f062c7582f..c5c4c93b3689 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
@@ -558,7 +558,8 @@ static void adreno_unbind(struct device *dev, struct device *master,
struct msm_drm_private *priv = dev_get_drvdata(master);
struct msm_gpu *gpu = dev_to_gpu(dev);
- WARN_ON_ONCE(adreno_system_suspend(dev));
+ if (pm_runtime_enabled(dev))
+ WARN_ON_ONCE(adreno_system_suspend(dev));
gpu->funcs->destroy(gpu);
priv->gpu_pdev = NULL;
--
2.39.2
On Wed, 1 Mar 2023 at 22:31, Daniel Díaz <daniel.diaz(a)linaro.org> wrote:
> Hello!
>
> Would the stable maintainers please consider backporting the following
> commit to the 5.15, 6.1, and 6.2 stable branches? It's been
> build-tested and verified it fixes the problem described therein.
>
> commit d78c8e32890ef7eca79ffd67c96022c7f9d8cce4
> Author: Anders Roxell <anders.roxell(a)linaro.org>
> Date: Wed Aug 10 13:43:18 2022 +0200
>
> powerpc/mm: Rearrange if-else block to avoid clang warning
>
> Clang (13, 14, 15, 16, nightly) warns as follows:
> -----8<----------8<----------8<-----
> arch/powerpc/mm/book3s64/radix_tlb.c:1191:23: error: variable 'hstart'
> is uninitialized when used here
> __tlbiel_va_range(hstart, hend, pid,
> ^~~~~~
> arch/powerpc/mm/book3s64/radix_tlb.c:1191:31: error: variable 'hend'
> is uninitialized when used here
> __tlbiel_va_range(hstart, hend, pid,
> ^~~~
> ----->8---------->8---------->8-----
>
> Those warnings make the builds fail.
>
> The same patch applies to 5.10 with fuzz 2 (offset -243 lines).
> Attached is that updated patch.
>
> The code for 5.4 (and below) is different, so this patch would not apply there.
>
> Thanks and greetings!
>
> Daniel Díaz
> daniel.diaz(a)linaro.org
+ stable mailing list
--
ddiaz
[Public]
Hi,
There was a regression in 6.2-rc1 that caused amdgpu to not be able to load when IOMMU domain isn't set up properly
It was fixed by these four patches in 6.3.
080920e52148 ("iommu/amd: Fix error handling for pdev_pri_ats_enable()")
f451c7a5a3b8 ("iommu/amd: Skip attach device domain is same as new domain")
996d120b4de2 ("iommu/amd: Improve page fault error reporting")
2cc73c5712f9 ("iommu: Attach device group to old domain in error path")
Can you please bring them to 6.2.y?
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216865
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2319
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2156691
Thanks,
This is the start of the stable review cycle for the 6.1.15 release.
There are 42 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Mar 2023 18:06:43 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.15-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.15-rc1
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Carlos Llamas <cmllamas(a)google.com>
scripts/tags.sh: fix incompatibility with PCRE2
Christian Brauner <brauner(a)kernel.org>
fs: use consistent setgid checks in is_sxid()
Christian Brauner <brauner(a)kernel.org>
attr: use consistent sgid stripping checks
Christian Brauner <brauner(a)kernel.org>
attr: add setattr_should_drop_sgid()
Christian Brauner <brauner(a)kernel.org>
fs: move should_remove_suid()
Christian Brauner <brauner(a)kernel.org>
attr: add in_group_or_capable()
Stylon Wang <stylon.wang(a)amd.com>
drm/amd/display: Properly reuse completion structure
Saranya Gopal <saranya.gopal(a)intel.com>
usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com>
arm64: dts: uniphier: Fix property name in PXs3 USB node
Prashanth K <quic_prashk(a)quicinc.com>
usb: gadget: u_serial: Add null pointer check in gserial_resume
Florian Zumbiehl <florz(a)florz.de>
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
usb: dwc3: pci: add support for the Intel Meteor Lake-M
Stylon Wang <stylon.wang(a)amd.com>
drm/amd/display: Fix race condition in DPIA AUX transfer
Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
Thomas Weißschuh <linux(a)weissschuh.net>
vc_screen: don't clobber return value in vcs_read
Kuniyuki Iwashima <kuniyu(a)amazon.com>
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Martin KaFai Lau <martin.lau(a)kernel.org>
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
PM: sleep: Avoid using pr_cont() in the tasks freezing code
Kan Liang <kan.liang(a)linux.intel.com>
x86/cpu: Add Lunar Lake M
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: ocelot: tc_flower_chains: make test_vlan_ingress_modify() more comprehensive
Luka Guzenko <l.guzenko(a)web.de>
HID: Ignore battery for ELAN touchscreen 29DF on HP
Alexey Firago <a.firago(a)yadro.com>
ASoC: codecs: es8326: Fix DTS properties reading
Xin Zhao <xnzhao(a)google.com>
HID: core: Fix deadloop in hid_apply_multiplier.
Julian Anastasov <ja(a)ssi.bg>
neigh: make sure used and confirmed times are valid
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
ARM: dts: stihxxx-b2120: fix polarity of reset line of tsin0 port
V sujith kumar Reddy <Vsujithkumar.Reddy(a)amd.com>
ASoC: SOF: amd: Fix for handling spurious interrupts from DSP
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc: Don't select ARCH_WANTS_NO_INSTR
Dean Luick <dean.luick(a)cornelisnetworks.com>
IB/hfi1: Assign npages earlier
Jack Yu <jack.yu(a)realtek.com>
ASoC: rt715-sdca: fix clock stop prepare timeout issue
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
arm64: dts: rockchip: align rk3399 DMC OPP table with bindings
David Sterba <dsterba(a)suse.com>
btrfs: send: limit number of clones and allocated memory size
Mario Limonciello <mario.limonciello(a)amd.com>
pinctrl: amd: Fix debug output for debounce time
Vishal Verma <vishal.l.verma(a)intel.com>
ACPI: NFIT: fix a potential deadlock during NFIT teardown
marco.rodolfi(a)tuta.io <marco.rodolfi(a)tuta.io>
HID: Ignore battery for Elan touchscreen on Asus TP420IA
Takahiro Fujii <fujii(a)xaxxi.net>
HID: elecom: add support for TrackBall 056E:011C
Jonas Karlman <jonas(a)kwiboo.se>
arm64: dts: rockchip: fix probe of analog sound card on rock-3a
Jensen Huang <jensenhuang(a)friendlyarm.com>
arm64: dts: rockchip: add missing #interrupt-cells to rk356x pcie2x1
Johan Jonker <jbx6244(a)gmail.com>
ARM: dts: rockchip: add power-domains property to dp node on rk3288
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
Jarrah Gosbell <kernel(a)undef.tools>
arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro
Benedict Wong <benedictwong(a)google.com>
Fix XFRM-I support for nested ESP tunnels
-------------
Diffstat:
Documentation/trace/ftrace.rst | 2 +-
Makefile | 4 +-
arch/arm/boot/dts/rk3288.dtsi | 1 +
arch/arm/boot/dts/stihxxx-b2120.dtsi | 2 +-
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 -
arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi | 2 +-
.../boot/dts/rockchip/rk3399-pinephone-pro.dts | 7 +
arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts | 2 +
arch/arm64/boot/dts/rockchip/rk356x.dtsi | 1 +
.../dts/socionext/uniphier-pxs3-ref-gadget0.dts | 2 +-
.../dts/socionext/uniphier-pxs3-ref-gadget1.dts | 2 +-
arch/powerpc/Kconfig | 1 -
arch/x86/include/asm/intel-family.h | 2 +
drivers/acpi/nfit/core.c | 2 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 150 ++++++++++-----------
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 17 ++-
.../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 10 +-
.../gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c | 24 ++++
.../gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.h | 2 +
.../gpu/drm/amd/display/dc/dcn314/dcn314_init.c | 2 +-
drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 25 ++++
drivers/hid/hid-core.c | 3 +
drivers/hid/hid-elecom.c | 16 ++-
drivers/hid/hid-ids.h | 5 +-
drivers/hid/hid-input.c | 4 +
drivers/hid/hid-quirks.c | 3 +-
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 +-
drivers/pinctrl/pinctrl-amd.c | 1 +
drivers/tty/vt/vc_screen.c | 7 +-
drivers/usb/core/hub.c | 5 +-
drivers/usb/core/sysfs.c | 5 -
drivers/usb/dwc3/dwc3-pci.c | 4 +
drivers/usb/gadget/function/u_serial.c | 23 +++-
drivers/usb/serial/option.c | 4 +
drivers/usb/typec/pd.c | 1 -
fs/attr.c | 74 +++++++++-
fs/btrfs/send.c | 6 +-
fs/fuse/file.c | 2 +-
fs/inode.c | 64 ++++-----
fs/internal.h | 10 +-
fs/ocfs2/file.c | 4 +-
fs/open.c | 8 +-
include/linux/fs.h | 4 +-
kernel/power/process.c | 21 ++-
net/caif/caif_socket.c | 1 +
net/core/filter.c | 4 +-
net/core/neighbour.c | 18 ++-
net/core/stream.c | 1 -
net/xfrm/xfrm_interface.c | 54 +++++++-
net/xfrm/xfrm_policy.c | 3 +
scripts/tags.sh | 2 +-
sound/soc/codecs/es8326.c | 6 +-
sound/soc/codecs/rt715-sdca-sdw.c | 2 +-
sound/soc/sof/amd/acp.c | 36 +++--
.../drivers/net/ocelot/tc_flower_chains.sh | 2 +-
55 files changed, 446 insertions(+), 228 deletions(-)
I'm announcing the release of the 6.2.2 kernel.
All users of the 6.2 kernel series must upgrade.
The updated 6.2.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.2.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget0.dts | 2
arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget1.dts | 2
arch/arm64/crypto/sm4-ce-gcm-glue.c | 51 +++++-------
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c | 24 +++++
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.h | 2
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_init.c | 2
drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 25 +++++
drivers/net/wireless/realtek/rtw88/usb.c | 18 ----
drivers/tty/vt/vc_screen.c | 7 -
drivers/usb/core/hub.c | 5 -
drivers/usb/core/sysfs.c | 5 -
drivers/usb/dwc3/dwc3-pci.c | 4
drivers/usb/gadget/function/u_serial.c | 23 ++++-
drivers/usb/serial/option.c | 4
drivers/usb/typec/pd.c | 1
net/core/filter.c | 4
scripts/tags.sh | 2
sound/pci/hda/hda_cs_dsp_ctl.c | 4
20 files changed, 124 insertions(+), 66 deletions(-)
Alan Stern (1):
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Carlos Llamas (1):
scripts/tags.sh: fix incompatibility with PCRE2
Florian Zumbiehl (1):
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Greg Kroah-Hartman (1):
Linux 6.2.2
Heikki Krogerus (1):
usb: dwc3: pci: add support for the Intel Meteor Lake-M
Herbert Xu (1):
crypto: arm64/sm4-gcm - Fix possible crash in GCM cryption
Kunihiko Hayashi (1):
arm64: dts: uniphier: Fix property name in PXs3 USB node
Martin KaFai Lau (1):
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Nicholas Kazlauskas (1):
drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
Prashanth K (1):
usb: gadget: u_serial: Add null pointer check in gserial_resume
Saranya Gopal (1):
usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
Sascha Hauer (3):
wifi: rtw88: usb: Set qsel correctly
wifi: rtw88: usb: send Zero length packets if necessary
wifi: rtw88: usb: drop now unnecessary URB size check
Stylon Wang (1):
drm/amd/display: Properly reuse completion structure
Thomas Weißschuh (1):
vc_screen: don't clobber return value in vcs_read
Vitaly Rodionov (1):
ALSA: hda: cs35l41: Correct error condition handling
I'm announcing the release of the 5.10.171 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/rk3288.dtsi | 1
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2
drivers/acpi/nfit/core.c | 2
drivers/gpu/drm/virtio/virtgpu_object.c | 5 +-
drivers/hid/hid-core.c | 3 +
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ----
drivers/md/md.c | 1
drivers/tty/vt/vc_screen.c | 7 +--
drivers/usb/core/hub.c | 5 --
drivers/usb/core/sysfs.c | 5 --
drivers/usb/gadget/function/u_serial.c | 23 ++++++++--
drivers/usb/serial/option.c | 4 +
fs/btrfs/send.c | 6 +-
io_uring/io_uring.c | 25 +++++++----
net/caif/caif_socket.c | 1
net/core/filter.c | 4 -
net/core/neighbour.c | 18 ++++++--
net/core/stream.c | 1
net/xfrm/xfrm_interface.c | 54 +++++++++++++++++++++++--
net/xfrm/xfrm_policy.c | 3 +
scripts/tags.sh | 11 +++--
22 files changed, 138 insertions(+), 54 deletions(-)
Alan Stern (1):
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Benedict Wong (1):
Fix XFRM-I support for nested ESP tunnels
Bing-Jhong Billy Jheng (1):
io_uring: add missing lock in io_get_file_fixed
Carlos Llamas (1):
scripts/tags.sh: fix incompatibility with PCRE2
Cristian Ciocaltea (1):
scripts/tags.sh: Invoke 'realpath' via 'xargs'
David Sloan (1):
md: Flush workqueue md_rdev_misc_wq in md_alloc()
David Sterba (1):
btrfs: send: limit number of clones and allocated memory size
Dean Luick (1):
IB/hfi1: Assign npages earlier
Dmitry Osipenko (1):
drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
Florian Zumbiehl (1):
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Greg Kroah-Hartman (1):
Linux 5.10.171
Johan Jonker (1):
ARM: dts: rockchip: add power-domains property to dp node on rk3288
Julian Anastasov (1):
neigh: make sure used and confirmed times are valid
Krzysztof Kozlowski (1):
arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
Kuniyuki Iwashima (1):
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Martin KaFai Lau (1):
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Miaoqian Lin (1):
drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
Prashanth K (1):
usb: gadget: u_serial: Add null pointer check in gserial_resume
Thomas Weißschuh (1):
vc_screen: don't clobber return value in vcs_read
Vishal Verma (1):
ACPI: NFIT: fix a potential deadlock during NFIT teardown
Xin Zhao (1):
HID: core: Fix deadloop in hid_apply_multiplier.
I'm announcing the release of the 5.4.234 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/arm/boot/dts/rk3288.dtsi | 1 +
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 --
drivers/acpi/nfit/core.c | 2 +-
drivers/dma/sh/rcar-dmac.c | 5 ++++-
drivers/hid/hid-core.c | 3 +++
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++-------
drivers/tty/vt/vc_screen.c | 7 ++++---
drivers/usb/core/hub.c | 5 ++---
drivers/usb/core/sysfs.c | 5 -----
drivers/usb/serial/option.c | 4 ++++
fs/btrfs/send.c | 6 +++---
net/caif/caif_socket.c | 1 +
net/core/filter.c | 4 ++--
net/core/neighbour.c | 18 +++++++++++++++---
net/core/stream.c | 1 -
16 files changed, 43 insertions(+), 32 deletions(-)
Alan Stern (1):
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
David Sterba (1):
btrfs: send: limit number of clones and allocated memory size
Dean Luick (1):
IB/hfi1: Assign npages earlier
Florian Zumbiehl (1):
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Greg Kroah-Hartman (1):
Linux 5.4.234
Jiasheng Jiang (1):
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
Johan Jonker (1):
ARM: dts: rockchip: add power-domains property to dp node on rk3288
Julian Anastasov (1):
neigh: make sure used and confirmed times are valid
Krzysztof Kozlowski (1):
arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
Kuniyuki Iwashima (1):
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Martin KaFai Lau (1):
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Thomas Weißschuh (1):
vc_screen: don't clobber return value in vcs_read
Vishal Verma (1):
ACPI: NFIT: fix a potential deadlock during NFIT teardown
Xin Zhao (1):
HID: core: Fix deadloop in hid_apply_multiplier.
I'm announcing the release of the 4.19.275 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/arm/boot/dts/rk3288.dtsi | 1 +
drivers/acpi/nfit/core.c | 2 +-
drivers/dma/sh/rcar-dmac.c | 5 ++++-
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++-------
drivers/tty/vt/vc_screen.c | 7 ++++---
drivers/usb/core/hub.c | 5 ++---
drivers/usb/core/sysfs.c | 5 -----
drivers/usb/serial/option.c | 4 ++++
fs/btrfs/send.c | 6 +++---
net/caif/caif_socket.c | 1 +
net/core/stream.c | 1 -
12 files changed, 23 insertions(+), 25 deletions(-)
Alan Stern (1):
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
David Sterba (1):
btrfs: send: limit number of clones and allocated memory size
Dean Luick (1):
IB/hfi1: Assign npages earlier
Florian Zumbiehl (1):
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Greg Kroah-Hartman (1):
Linux 4.19.275
Jiasheng Jiang (1):
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
Johan Jonker (1):
ARM: dts: rockchip: add power-domains property to dp node on rk3288
Kuniyuki Iwashima (1):
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Thomas Weißschuh (1):
vc_screen: don't clobber return value in vcs_read
Vishal Verma (1):
ACPI: NFIT: fix a potential deadlock during NFIT teardown
This is the start of the stable review cycle for the 5.15.97 release.
There are 22 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Mar 2023 18:06:43 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.97-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.97-rc1
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Prashanth K <quic_prashk(a)quicinc.com>
usb: gadget: u_serial: Add null pointer check in gserial_resume
Florian Zumbiehl <florz(a)florz.de>
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
usb: dwc3: pci: add support for the Intel Meteor Lake-M
Carlos Llamas <cmllamas(a)google.com>
scripts/tags.sh: fix incompatibility with PCRE2
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
scripts/tags.sh: Invoke 'realpath' via 'xargs'
Thomas Weißschuh <linux(a)weissschuh.net>
vc_screen: don't clobber return value in vcs_read
Kuniyuki Iwashima <kuniyu(a)amazon.com>
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Martin KaFai Lau <martin.lau(a)kernel.org>
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Sergio Paracuellos <sergio.paracuellos(a)gmail.com>
staging: mt7621-dts: change palmbus address to lower case
Kan Liang <kan.liang(a)linux.intel.com>
x86/cpu: Add Lunar Lake M
Xin Zhao <xnzhao(a)google.com>
HID: core: Fix deadloop in hid_apply_multiplier.
Julian Anastasov <ja(a)ssi.bg>
neigh: make sure used and confirmed times are valid
Dean Luick <dean.luick(a)cornelisnetworks.com>
IB/hfi1: Assign npages earlier
Jack Yu <jack.yu(a)realtek.com>
ASoC: rt715-sdca: fix clock stop prepare timeout issue
David Sterba <dsterba(a)suse.com>
btrfs: send: limit number of clones and allocated memory size
Vishal Verma <vishal.l.verma(a)intel.com>
ACPI: NFIT: fix a potential deadlock during NFIT teardown
Takahiro Fujii <fujii(a)xaxxi.net>
HID: elecom: add support for TrackBall 056E:011C
Johan Jonker <jbx6244(a)gmail.com>
ARM: dts: rockchip: add power-domains property to dp node on rk3288
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
Benedict Wong <benedictwong(a)google.com>
Fix XFRM-I support for nested ESP tunnels
Neel Patel <neel(a)pensando.io>
ionic: refactor use of ionic_rx_fill()
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/rk3288.dtsi | 1 +
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 -
arch/x86/include/asm/intel-family.h | 2 +
drivers/acpi/nfit/core.c | 2 +-
drivers/hid/hid-core.c | 3 ++
drivers/hid/hid-elecom.c | 16 ++++++-
drivers/hid/hid-ids.h | 3 +-
drivers/hid/hid-quirks.c | 3 +-
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 +---
drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 23 +++++-----
drivers/staging/mt7621-dts/gbpc1.dts | 2 +-
drivers/tty/vt/vc_screen.c | 7 +--
drivers/usb/core/hub.c | 5 +--
drivers/usb/core/sysfs.c | 5 ---
drivers/usb/dwc3/dwc3-pci.c | 4 ++
drivers/usb/gadget/function/u_serial.c | 23 ++++++++--
drivers/usb/serial/option.c | 4 ++
fs/btrfs/send.c | 6 +--
net/caif/caif_socket.c | 1 +
net/core/filter.c | 4 +-
net/core/neighbour.c | 18 ++++++--
net/core/stream.c | 1 -
net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++--
net/xfrm/xfrm_policy.c | 3 ++
scripts/tags.sh | 11 +++--
sound/soc/codecs/rt715-sdca-sdw.c | 2 +-
27 files changed, 157 insertions(+), 61 deletions(-)
The quilt patch titled
Subject: fs/cramfs/inode.c: initialize file_ra_state
has been removed from the -mm tree. Its filename was
fs-cramfs-inodec-initialize-file_ra_state.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Andrew Morton <akpm(a)linux-foundation.org>
Subject: fs/cramfs/inode.c: initialize file_ra_state
Date: Sun Feb 26 12:31:11 PM PST 2023
file_ra_state_init() assumes that the file_ra_state has been zeroed out.
Fixes a KMSAN used-unintialized issue (at least).
Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous")
Reported-by: syzbot <syzbot+8ce7f8308d91e6b8bbe2(a)syzkaller.appspotmail.com>
Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@google.com
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Nicolas Pitre <nico(a)fluxnic.net>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/fs/cramfs/inode.c~fs-cramfs-inodec-initialize-file_ra_state
+++ a/fs/cramfs/inode.c
@@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct s
unsigned int len)
{
struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
- struct file_ra_state ra;
+ struct file_ra_state ra = {};
struct page *pages[BLKS_PER_BUF];
unsigned i, blocknr, buffer;
unsigned long devsize;
_
Patches currently in -mm which might be from akpm(a)linux-foundation.org are
mm-page_alloc-reduce-page-alloc-free-sanity-checks-checkpatch-fixes.patch
mm-page_alloc-reduce-page-alloc-free-sanity-checks-fix.patch
mm-userfaultfd-support-wp-on-multiple-vmas-fix.patch
The quilt patch titled
Subject: fs: hfsplus: fix UAF issue in hfsplus_put_super
has been removed from the -mm tree. Its filename was
fs-hfsplus-fix-uaf-issue-in-hfsplus_put_super.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Dongliang Mu <mudongliangabcd(a)gmail.com>
Subject: fs: hfsplus: fix UAF issue in hfsplus_put_super
Date: Sun, 26 Feb 2023 20:49:47 +0800
The current hfsplus_put_super first calls hfs_btree_close on
sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an
use-after-free issue in hfsplus_release_folio.
As shown in hfsplus_fill_super, the error handling code also calls iput
before hfs_btree_close.
To fix this error, we move all iput calls before hfsplus_btree_close.
Note that this patch is tested on Syzbot.
Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com
Reported-by: syzbot+57e3e98f7e3b80f64d56(a)syzkaller.appspotmail.com
Tested-by: Dongliang Mu <mudongliangabcd(a)gmail.com>
Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com>
Cc: Bart Van Assche <bvanassche(a)acm.org>
Cc: Jens Axboe <axboe(a)kernel.dk>
Cc: Muchun Song <songmuchun(a)bytedance.com>
Cc: Roman Gushchin <roman.gushchin(a)linux.dev>
Cc: "Theodore Ts'o" <tytso(a)mit.edu>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/fs/hfsplus/super.c~fs-hfsplus-fix-uaf-issue-in-hfsplus_put_super
+++ a/fs/hfsplus/super.c
@@ -295,11 +295,11 @@ static void hfsplus_put_super(struct sup
hfsplus_sync_fs(sb, 1);
}
+ iput(sbi->alloc_file);
+ iput(sbi->hidden_dir);
hfs_btree_close(sbi->attr_tree);
hfs_btree_close(sbi->cat_tree);
hfs_btree_close(sbi->ext_tree);
- iput(sbi->alloc_file);
- iput(sbi->hidden_dir);
kfree(sbi->s_vhdr_buf);
kfree(sbi->s_backup_vhdr_buf);
unload_nls(sbi->nls);
_
Patches currently in -mm which might be from mudongliangabcd(a)gmail.com are
The quilt patch titled
Subject: panic: fix the panic_print NMI backtrace setting
has been removed from the -mm tree. Its filename was
panic-fixes-the-panic_print-nmi-backtrace-setting.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Guilherme G. Piccoli" <gpiccoli(a)igalia.com>
Subject: panic: fix the panic_print NMI backtrace setting
Date: Sun, 26 Feb 2023 13:08:38 -0300
Commit 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in
panic_print") introduced a setting for the "panic_print" kernel parameter
to allow users to request a NMI backtrace on panic. Problem is that the
panic_print handling happens after the secondary CPUs are already
disabled, hence this option ended-up being kind of a no-op - kernel skips
the NMI trace in idling CPUs, which is the case of offline CPUs.
Fix it by checking the NMI backtrace bit in the panic_print prior to the
CPU disabling function.
Link: https://lkml.kernel.org/r/20230226160838.414257-1-gpiccoli@igalia.com
Fixes: 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in panic_print")
Signed-off-by: Guilherme G. Piccoli <gpiccoli(a)igalia.com>
Cc: <stable(a)vger.kernel.org>
Cc: Baoquan He <bhe(a)redhat.com>
Cc: Dave Young <dyoung(a)redhat.com>
Cc: Feng Tang <feng.tang(a)intel.com>
Cc: HATAYAMA Daisuke <d.hatayama(a)jp.fujitsu.com>
Cc: Hidehiro Kawai <hidehiro.kawai.ez(a)hitachi.com>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: Michael Kelley <mikelley(a)microsoft.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Vivek Goyal <vgoyal(a)redhat.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/kernel/panic.c~panic-fixes-the-panic_print-nmi-backtrace-setting
+++ a/kernel/panic.c
@@ -212,9 +212,6 @@ static void panic_print_sys_info(bool co
return;
}
- if (panic_print & PANIC_PRINT_ALL_CPU_BT)
- trigger_all_cpu_backtrace();
-
if (panic_print & PANIC_PRINT_TASK_INFO)
show_state();
@@ -244,6 +241,30 @@ void check_panic_on_warn(const char *ori
origin, limit);
}
+/*
+ * Helper that triggers the NMI backtrace (if set in panic_print)
+ * and then performs the secondary CPUs shutdown - we cannot have
+ * the NMI backtrace after the CPUs are off!
+ */
+static void panic_other_cpus_shutdown(bool crash_kexec)
+{
+ if (panic_print & PANIC_PRINT_ALL_CPU_BT)
+ trigger_all_cpu_backtrace();
+
+ /*
+ * Note that smp_send_stop() is the usual SMP shutdown function,
+ * which unfortunately may not be hardened to work in a panic
+ * situation. If we want to do crash dump after notifier calls
+ * and kmsg_dump, we will need architecture dependent extra
+ * bits in addition to stopping other CPUs, hence we rely on
+ * crash_smp_send_stop() for that.
+ */
+ if (!crash_kexec)
+ smp_send_stop();
+ else
+ crash_smp_send_stop();
+}
+
/**
* panic - halt the system
* @fmt: The text string to print
@@ -334,23 +355,10 @@ void panic(const char *fmt, ...)
*
* Bypass the panic_cpu check and call __crash_kexec directly.
*/
- if (!_crash_kexec_post_notifiers) {
+ if (!_crash_kexec_post_notifiers)
__crash_kexec(NULL);
- /*
- * Note smp_send_stop is the usual smp shutdown function, which
- * unfortunately means it may not be hardened to work in a
- * panic situation.
- */
- smp_send_stop();
- } else {
- /*
- * If we want to do crash dump after notifier calls and
- * kmsg_dump, we will need architecture dependent extra
- * works in addition to stopping other CPUs.
- */
- crash_smp_send_stop();
- }
+ panic_other_cpus_shutdown(_crash_kexec_post_notifiers);
/*
* Run any panic handlers, including those that might need to
_
Patches currently in -mm which might be from gpiccoli(a)igalia.com are
I've been trying to reach you but all to no avail, please contact me on my private Email: Yuansusan-006(a)outlook.com
I have an important thing to discuss with you.
?
--
ATTENZIONE:
Le informazioni contenute in questo messaggio sono confidenziali
e non possono essere rivelate o utilizzate se non dal destinatario del messaggio.
Se il messaggio è stato ricevuto per errore, prego di comunicarlo immediatamente.
The patch titled
Subject: maple_tree: fix mas_skip_node() end slot detection
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
maple_tree-fix-mas_skip_node-end-slot-detection.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: maple_tree: fix mas_skip_node() end slot detection
Date: Thu, 2 Mar 2023 21:15:39 -0500
mas_skip_node() is used to move the maple state to the node with a higher
limit. It does this by walking up the tree and increasing the slot count.
Since slot count may not be able to be increased, it may need to walk up
multiple times to find room to walk right to a higher limit node. The
limit of slots that was being used was the node limit and not the last
location of data in the node. This would cause the maple state to be
shifted outside actual data and enter an error state, thus returning
-EBUSY.
The result of the incorrect error state means that mas_awalk() would
return an error instead of finding the allocation space.
The fix is to use mas_data_end() in mas_skip_node() to detect the nodes
data end point and continue walking the tree up until it is safe to move
to a node with a higher limit.
mas_skip_node() may also be passed a maple state in an error state from
mas_anode_descend() when no allocations are available. Return on such an
error state immediately.
Link: https://lkml.kernel.org/r/20230303021540.1056603-1-Liam.Howlett@oracle.com
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Reported-by: Snild Dolkow <snild(a)sony.com>
Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.…
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/lib/maple_tree.c~maple_tree-fix-mas_skip_node-end-slot-detection
+++ a/lib/maple_tree.c
@@ -5099,34 +5099,29 @@ static inline bool mas_rewind_node(struc
*/
static inline bool mas_skip_node(struct ma_state *mas)
{
- unsigned char slot, slot_count;
unsigned long *pivots;
enum maple_type mt;
- mt = mte_node_type(mas->node);
- slot_count = mt_slots[mt] - 1;
+ if (mas_is_err(mas))
+ return false;
+
do {
if (mte_is_root(mas->node)) {
- slot = mas->offset;
- if (slot > slot_count) {
+ if (mas->offset >= mas_data_end(mas)) {
mas_set_err(mas, -EBUSY);
return false;
}
} else {
mas_ascend(mas);
- slot = mas->offset;
- mt = mte_node_type(mas->node);
- slot_count = mt_slots[mt] - 1;
}
- } while (slot > slot_count);
+ } while (mas->offset >= mas_data_end(mas));
- mas->offset = ++slot;
+ mt = mte_node_type(mas->node);
pivots = ma_pivots(mas_mn(mas), mt);
- if (slot > 0)
- mas->min = pivots[slot - 1] + 1;
-
- if (slot <= slot_count)
- mas->max = pivots[slot];
+ mas->min = pivots[mas->offset] + 1;
+ mas->offset++;
+ if (mas->offset < mt_slots[mt])
+ mas->max = pivots[mas->offset];
return true;
}
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
mm-mprotect-fix-successful-vma_merge-of-next-in-do_mprotect_pkey.patch
maple_tree-fix-mas_skip_node-end-slot-detection.patch
test_maple_tree-add-more-testing-for-mas_empty_area.patch
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
The patch titled
Subject: test_maple_tree: add more testing for mas_empty_area()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
test_maple_tree-add-more-testing-for-mas_empty_area.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: test_maple_tree: add more testing for mas_empty_area()
Date: Thu, 2 Mar 2023 21:15:40 -0500
Test robust filling of an entire area of the tree, then test one beyond.
This is to test the walking back up the tree at the end of nodes and error
condition.
Test inspired by the reproducer code provided by Snild Dolkow.
Link: https://lkml.kernel.org/r/20230303021540.1056603-2-Liam.Howlett@oracle.com
Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.…
Fixes: e15e06a83923 ("lib/test_maple_tree: add testing for maple tree")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Cc: Snild Dolkow <snild(a)sony.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/lib/test_maple_tree.c~test_maple_tree-add-more-testing-for-mas_empty_area
+++ a/lib/test_maple_tree.c
@@ -2670,6 +2670,36 @@ static noinline void check_empty_area_wi
rcu_read_unlock();
}
+static noinline void check_empty_area_fill(struct maple_tree *mt)
+{
+ int loop, shift;
+ unsigned long max = 0x25D78000;
+ unsigned long size;
+ MA_STATE(mas, mt, 0, 0);
+
+ mt_set_non_kernel(99999);
+ for (shift = 12; shift <= 16; shift++) {
+ loop = 5000;
+ size = 1 << shift;
+ while (loop--) {
+ mas_lock(&mas);
+ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != 0);
+ MT_BUG_ON(mt, mas.last != mas.index + size - 1);
+ mas_store_gfp(&mas, &check_empty_area_fill, GFP_KERNEL);
+ mas_unlock(&mas);
+ mas_reset(&mas);
+ }
+ }
+
+ /* No space left. */
+ size = 0x1000;
+ rcu_read_lock();
+ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != -EBUSY);
+ rcu_read_unlock();
+
+ mt_set_non_kernel(0);
+}
+
static DEFINE_MTREE(tree);
static int maple_tree_seed(void)
{
@@ -2926,6 +2956,11 @@ static int maple_tree_seed(void)
check_empty_area_window(&tree);
mtree_destroy(&tree);
+ mt_init_flags(&tree, MT_FLAGS_ALLOC_RANGE);
+ check_empty_area_fill(&tree);
+ mtree_destroy(&tree);
+
+
#if defined(BENCH)
skip:
#endif
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
mm-mprotect-fix-successful-vma_merge-of-next-in-do_mprotect_pkey.patch
maple_tree-fix-mas_skip_node-end-slot-detection.patch
test_maple_tree-add-more-testing-for-mas_empty_area.patch
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
The patch titled
Subject: mm: teach mincore_hugetlb about pte markers
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-teach-mincore_hugetlb-about-pte-markers.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: James Houghton <jthoughton(a)google.com>
Subject: mm: teach mincore_hugetlb about pte markers
Date: Thu, 2 Mar 2023 22:24:04 +0000
By checking huge_pte_none(), we incorrectly classify PTE markers as
"present". Instead, check huge_pte_none_mostly(), classifying PTE markers
the same as if the PTE were completely blank.
PTE markers, unlike other kinds of swap entries, don't reference any
physical page and don't indicate that a physical page was mapped
previously. As such, treat them as non-present for the sake of mincore().
Link: https://lkml.kernel.org/r/20230302222404.175303-1-jthoughton@google.com
Fixes: 5c041f5d1f23 ("mm: teach core mm about pte markers")
Signed-off-by: James Houghton <jthoughton(a)google.com>
Acked-by: Peter Xu <peterx(a)redhat.com>
Cc: Axel Rasmussen <axelrasmussen(a)google.com>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: James Houghton <jthoughton(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/mincore.c~mm-teach-mincore_hugetlb-about-pte-markers
+++ a/mm/mincore.c
@@ -33,7 +33,7 @@ static int mincore_hugetlb(pte_t *pte, u
* Hugepages under user process are always in RAM and never
* swapped out, but theoretically it needs to be checked.
*/
- present = pte && !huge_pte_none(huge_ptep_get(pte));
+ present = pte && !huge_pte_none_mostly(huge_ptep_get(pte));
for (; addr != end; vec++, addr += PAGE_SIZE)
*vec = present;
walk->private = vec;
_
Patches currently in -mm which might be from jthoughton(a)google.com are
mm-teach-mincore_hugetlb-about-pte-markers.patch
This is the start of the stable review cycle for the 6.2.2 release.
There are 16 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Mar 2023 18:06:43 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.2.2-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.2.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.2.2-rc1
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Saranya Gopal <saranya.gopal(a)intel.com>
usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com>
arm64: dts: uniphier: Fix property name in PXs3 USB node
Prashanth K <quic_prashk(a)quicinc.com>
usb: gadget: u_serial: Add null pointer check in gserial_resume
Florian Zumbiehl <florz(a)florz.de>
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
usb: dwc3: pci: add support for the Intel Meteor Lake-M
Sascha Hauer <s.hauer(a)pengutronix.de>
wifi: rtw88: usb: drop now unnecessary URB size check
Sascha Hauer <s.hauer(a)pengutronix.de>
wifi: rtw88: usb: send Zero length packets if necessary
Sascha Hauer <s.hauer(a)pengutronix.de>
wifi: rtw88: usb: Set qsel correctly
Carlos Llamas <cmllamas(a)google.com>
scripts/tags.sh: fix incompatibility with PCRE2
Stylon Wang <stylon.wang(a)amd.com>
drm/amd/display: Properly reuse completion structure
Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
Thomas Weißschuh <linux(a)weissschuh.net>
vc_screen: don't clobber return value in vcs_read
Martin KaFai Lau <martin.lau(a)kernel.org>
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: arm64/sm4-gcm - Fix possible crash in GCM cryption
Vitaly Rodionov <vitalyr(a)opensource.cirrus.com>
ALSA: hda: cs35l41: Correct error condition handling
-------------
Diffstat:
Makefile | 4 +-
.../dts/socionext/uniphier-pxs3-ref-gadget0.dts | 2 +-
.../dts/socionext/uniphier-pxs3-ref-gadget1.dts | 2 +-
arch/arm64/crypto/sm4-ce-gcm-glue.c | 51 +++++++++++-----------
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++
.../gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c | 24 ++++++++++
.../gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.h | 2 +
.../gpu/drm/amd/display/dc/dcn314/dcn314_init.c | 2 +-
drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 25 +++++++++++
drivers/net/wireless/realtek/rtw88/usb.c | 18 ++------
drivers/tty/vt/vc_screen.c | 7 +--
drivers/usb/core/hub.c | 5 +--
drivers/usb/core/sysfs.c | 5 ---
drivers/usb/dwc3/dwc3-pci.c | 4 ++
drivers/usb/gadget/function/u_serial.c | 23 ++++++++--
drivers/usb/serial/option.c | 4 ++
drivers/usb/typec/pd.c | 1 -
net/core/filter.c | 4 +-
scripts/tags.sh | 2 +-
sound/pci/hda/hda_cs_dsp_ctl.c | 4 +-
20 files changed, 125 insertions(+), 67 deletions(-)
This is the start of the stable review cycle for the 5.10.171 release.
There are 19 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Mar 2023 18:06:43 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.171-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.171-rc1
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Prashanth K <quic_prashk(a)quicinc.com>
usb: gadget: u_serial: Add null pointer check in gserial_resume
Florian Zumbiehl <florz(a)florz.de>
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
Miaoqian Lin <linmq006(a)gmail.com>
drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
Carlos Llamas <cmllamas(a)google.com>
scripts/tags.sh: fix incompatibility with PCRE2
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
scripts/tags.sh: Invoke 'realpath' via 'xargs'
David Sloan <david.sloan(a)eideticom.com>
md: Flush workqueue md_rdev_misc_wq in md_alloc()
Thomas Weißschuh <linux(a)weissschuh.net>
vc_screen: don't clobber return value in vcs_read
Kuniyuki Iwashima <kuniyu(a)amazon.com>
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Martin KaFai Lau <martin.lau(a)kernel.org>
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Xin Zhao <xnzhao(a)google.com>
HID: core: Fix deadloop in hid_apply_multiplier.
Julian Anastasov <ja(a)ssi.bg>
neigh: make sure used and confirmed times are valid
Dean Luick <dean.luick(a)cornelisnetworks.com>
IB/hfi1: Assign npages earlier
David Sterba <dsterba(a)suse.com>
btrfs: send: limit number of clones and allocated memory size
Vishal Verma <vishal.l.verma(a)intel.com>
ACPI: NFIT: fix a potential deadlock during NFIT teardown
Johan Jonker <jbx6244(a)gmail.com>
ARM: dts: rockchip: add power-domains property to dp node on rk3288
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
Benedict Wong <benedictwong(a)google.com>
Fix XFRM-I support for nested ESP tunnels
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/rk3288.dtsi | 1 +
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 -
drivers/acpi/nfit/core.c | 2 +-
drivers/gpu/drm/virtio/virtgpu_object.c | 5 ++-
drivers/hid/hid-core.c | 3 ++
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 +----
drivers/md/md.c | 1 +
drivers/tty/vt/vc_screen.c | 7 ++--
drivers/usb/core/hub.c | 5 +--
drivers/usb/core/sysfs.c | 5 ---
drivers/usb/gadget/function/u_serial.c | 23 +++++++++--
drivers/usb/serial/option.c | 4 ++
fs/btrfs/send.c | 6 +--
net/caif/caif_socket.c | 1 +
net/core/filter.c | 4 +-
net/core/neighbour.c | 18 +++++++--
net/core/stream.c | 1 -
net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++++--
net/xfrm/xfrm_policy.c | 3 ++
scripts/tags.sh | 11 ++++--
21 files changed, 123 insertions(+), 46 deletions(-)
This is the start of the stable review cycle for the 5.4.234 release.
There are 13 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Mar 2023 18:06:43 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.234-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.234-rc1
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Florian Zumbiehl <florz(a)florz.de>
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
Thomas Weißschuh <linux(a)weissschuh.net>
vc_screen: don't clobber return value in vcs_read
Kuniyuki Iwashima <kuniyu(a)amazon.com>
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Martin KaFai Lau <martin.lau(a)kernel.org>
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
Xin Zhao <xnzhao(a)google.com>
HID: core: Fix deadloop in hid_apply_multiplier.
Julian Anastasov <ja(a)ssi.bg>
neigh: make sure used and confirmed times are valid
Dean Luick <dean.luick(a)cornelisnetworks.com>
IB/hfi1: Assign npages earlier
David Sterba <dsterba(a)suse.com>
btrfs: send: limit number of clones and allocated memory size
Vishal Verma <vishal.l.verma(a)intel.com>
ACPI: NFIT: fix a potential deadlock during NFIT teardown
Johan Jonker <jbx6244(a)gmail.com>
ARM: dts: rockchip: add power-domains property to dp node on rk3288
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
-------------
Diffstat:
Makefile | 4 ++--
arch/arm/boot/dts/rk3288.dtsi | 1 +
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 --
drivers/acpi/nfit/core.c | 2 +-
drivers/dma/sh/rcar-dmac.c | 5 ++++-
drivers/hid/hid-core.c | 3 +++
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++-------
drivers/tty/vt/vc_screen.c | 7 ++++---
drivers/usb/core/hub.c | 5 ++---
drivers/usb/core/sysfs.c | 5 -----
drivers/usb/serial/option.c | 4 ++++
fs/btrfs/send.c | 6 +++---
net/caif/caif_socket.c | 1 +
net/core/filter.c | 4 ++--
net/core/neighbour.c | 18 +++++++++++++++---
net/core/stream.c | 1 -
16 files changed, 44 insertions(+), 33 deletions(-)
This is the start of the stable review cycle for the 4.19.275 release.
There are 9 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Mar 2023 18:06:43 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.275-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.275-rc1
Alan Stern <stern(a)rowland.harvard.edu>
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
Florian Zumbiehl <florz(a)florz.de>
USB: serial: option: add support for VW/Skoda "Carstick LTE"
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
Thomas Weißschuh <linux(a)weissschuh.net>
vc_screen: don't clobber return value in vcs_read
Kuniyuki Iwashima <kuniyu(a)amazon.com>
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Dean Luick <dean.luick(a)cornelisnetworks.com>
IB/hfi1: Assign npages earlier
David Sterba <dsterba(a)suse.com>
btrfs: send: limit number of clones and allocated memory size
Vishal Verma <vishal.l.verma(a)intel.com>
ACPI: NFIT: fix a potential deadlock during NFIT teardown
Johan Jonker <jbx6244(a)gmail.com>
ARM: dts: rockchip: add power-domains property to dp node on rk3288
-------------
Diffstat:
Makefile | 4 ++--
arch/arm/boot/dts/rk3288.dtsi | 1 +
drivers/acpi/nfit/core.c | 2 +-
drivers/dma/sh/rcar-dmac.c | 5 ++++-
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++-------
drivers/tty/vt/vc_screen.c | 7 ++++---
drivers/usb/core/hub.c | 5 ++---
drivers/usb/core/sysfs.c | 5 -----
drivers/usb/serial/option.c | 4 ++++
fs/btrfs/send.c | 6 +++---
net/caif/caif_socket.c | 1 +
net/core/stream.c | 1 -
12 files changed, 24 insertions(+), 26 deletions(-)
From: Alvin Šipraga <alsi(a)bang-olufsen.dk>
In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free()
via g_audio_cleanup() will disconnect the card and then wait for all
resources to be released, which happens when the refcount falls to zero.
Since userspace can keep the refcount incremented by not closing the
relevant file descriptor, the call to unbind may block indefinitely.
This can cause a deadlock during reboot, as evidenced by the following
blocked task observed on my machine:
task:reboot state:D stack:0 pid:2827 ppid:569 flags:0x0000000c
Call trace:
__switch_to+0xc8/0x140
__schedule+0x2f0/0x7c0
schedule+0x60/0xd0
schedule_timeout+0x180/0x1d4
wait_for_completion+0x78/0x180
snd_card_free+0x90/0xa0
g_audio_cleanup+0x2c/0x64
afunc_unbind+0x28/0x60
...
kernel_restart+0x4c/0xac
__do_sys_reboot+0xcc/0x1ec
__arm64_sys_reboot+0x28/0x30
invoke_syscall+0x4c/0x110
...
The issue can also be observed by opening the card with arecord and
then stopping the process through the shell before unbinding:
# arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null
Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo
^Z[1]+ Stopped arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null
# echo gadget.0 > /sys/bus/gadget/drivers/configfs-gadget/unbind
(observe that the unbind command never finishes)
Fix the problem by using snd_card_free_when_closed() instead, which will
still disconnect the card as desired, but defer the task of freeing the
resources to the core once userspace closes its file descriptor.
Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Alvin Šipraga <alsi(a)bang-olufsen.dk>
---
drivers/usb/gadget/function/u_audio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index c1f62e91b012..4a42574b4a7f 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -1422,7 +1422,7 @@ void g_audio_cleanup(struct g_audio *g_audio)
uac = g_audio->uac;
card = uac->card;
if (card)
- snd_card_free(card);
+ snd_card_free_when_closed(card);
kfree(uac->p_prm.reqs);
kfree(uac->c_prm.reqs);
--
2.39.1
From: Eric Biggers <ebiggers(a)google.com>
Once all I/O using a blk_crypto_key has completed, filesystems can call
blk_crypto_evict_key(). However, the block layer doesn't call
blk_crypto_put_keyslot() until the request is being cleaned up, which
happens after upper layers have been told (via bio_endio()) the I/O has
completed. This causes a race condition where blk_crypto_evict_key()
can see 'slot_refs > 0' without there being an actual bug.
This makes __blk_crypto_evict_key() hit the
'WARN_ON_ONCE(atomic_read(&slot->slot_refs) != 0)' and return without
doing anything, eventually causing a use-after-free in
blk_crypto_reprogram_all_keys(). (This is a very rare bug and has only
been seen when per-file keys are being used with fscrypt.)
There are two options to fix this: either release the keyslot in
blk_update_request() just before bio_endio() is called on the request's
last bio, or just make __blk_crypto_evict_key() ignore slot_refs. Let's
go with the latter solution for now, since it avoids adding overhead to
the loop in blk_update_request(). (It does have the disadvantage that
hypothetical bugs where a key is evicted while still in-use become
harder to detect. But so far there haven't been any such bugs anyway.)
A related issue with __blk_crypto_evict_key() is that ->keyslot_evict
failing would cause the same use-after-free as well. Fix this by always
removing the key from the keyslot management structures.
Update the function documentation to properly document the semantics.
Fixes: 1b2628397058 ("block: Keyslot Manager for Inline Encryption")
Cc: stable(a)vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
block/blk-crypto-profile.c | 52 +++++++++++++++-----------------------
block/blk-crypto.c | 24 +++++++++++-------
2 files changed, 36 insertions(+), 40 deletions(-)
diff --git a/block/blk-crypto-profile.c b/block/blk-crypto-profile.c
index 0307fb0d95d3..29b4148cc50d 100644
--- a/block/blk-crypto-profile.c
+++ b/block/blk-crypto-profile.c
@@ -354,22 +354,11 @@ bool __blk_crypto_cfg_supported(struct blk_crypto_profile *profile,
return true;
}
-/**
- * __blk_crypto_evict_key() - Evict a key from a device.
- * @profile: the crypto profile of the device
- * @key: the key to evict. It must not still be used in any I/O.
- *
- * If the device has keyslots, this finds the keyslot (if any) that contains the
- * specified key and calls the driver's keyslot_evict function to evict it.
- *
- * Otherwise, this just calls the driver's keyslot_evict function if it is
- * implemented, passing just the key (without any particular keyslot). This
- * allows layered devices to evict the key from their underlying devices.
- *
- * Context: Process context. Takes and releases profile->lock.
- * Return: 0 on success or if there's no keyslot with the specified key, -EBUSY
- * if the keyslot is still in use, or another -errno value on other
- * error.
+/*
+ * This is an internal function that evicts a key from an inline encryption
+ * device that can be either a real device or the blk-crypto-fallback "device".
+ * It is used only for blk_crypto_evict_key(). For details on what this does,
+ * see the documentation for blk_crypto_evict_key().
*/
int __blk_crypto_evict_key(struct blk_crypto_profile *profile,
const struct blk_crypto_key *key)
@@ -389,22 +378,23 @@ int __blk_crypto_evict_key(struct blk_crypto_profile *profile,
blk_crypto_hw_enter(profile);
slot = blk_crypto_find_keyslot(profile, key);
- if (!slot)
- goto out_unlock;
-
- if (WARN_ON_ONCE(atomic_read(&slot->slot_refs) != 0)) {
- err = -EBUSY;
- goto out_unlock;
+ if (slot) {
+ /*
+ * Note: it is a bug if the key is still in use by I/O here.
+ * But 'slot_refs > 0' can't be used to detect such bugs here,
+ * since the keyslot isn't released until after upper layers
+ * have already been told the I/O is complete.
+ */
+ err = profile->ll_ops.keyslot_evict(
+ profile, key, blk_crypto_keyslot_index(slot));
+ /*
+ * Even on ->keyslot_evict failure, we must remove the
+ * blk_crypto_key from the keyslot management structures, since
+ * the caller is allowed to free it regardless.
+ */
+ hlist_del(&slot->hash_node);
+ slot->key = NULL;
}
- err = profile->ll_ops.keyslot_evict(profile, key,
- blk_crypto_keyslot_index(slot));
- if (err)
- goto out_unlock;
-
- hlist_del(&slot->hash_node);
- slot->key = NULL;
- err = 0;
-out_unlock:
blk_crypto_hw_exit(profile);
return err;
}
diff --git a/block/blk-crypto.c b/block/blk-crypto.c
index 45378586151f..3dcbe578beb2 100644
--- a/block/blk-crypto.c
+++ b/block/blk-crypto.c
@@ -399,17 +399,23 @@ int blk_crypto_start_using_key(struct block_device *bdev,
}
/**
- * blk_crypto_evict_key() - Evict a key from any inline encryption hardware
- * it may have been programmed into
- * @bdev: The block_device who's associated inline encryption hardware this key
- * might have been programmed into
- * @key: The key to evict
+ * blk_crypto_evict_key() - Evict a blk_crypto_key from a block_device
+ * @bdev: a block_device on which I/O using the key may have been done
+ * @key: the key to evict
*
- * Upper layers (filesystems) must call this function to ensure that a key is
- * evicted from any hardware that it might have been programmed into. The key
- * must not be in use by any in-flight IO when this function is called.
+ * For a given block_device, this function removes the given blk_crypto_key from
+ * the keyslot management structures and evicts it from any underlying hardware
+ * or fallback keyslot(s) it may have been programmed into.
*
- * Return: 0 on success or if the key wasn't in any keyslot; -errno on error.
+ * Upper layers must call this before freeing the blk_crypto_key. It must be
+ * called for every block_device the key may have been used on. The key must no
+ * longer be in use by any I/O when this function is called.
+ *
+ * Context: May sleep.
+ * Return: 0 on success or if the key wasn't in any keyslot; -errno if the key
+ * failed to be evicted from a hardware keyslot. Even in the -errno
+ * case, the key is removed from the keyslot management structures and
+ * the caller is allowed (and expected) to free the blk_crypto_key.
*/
int blk_crypto_evict_key(struct block_device *bdev,
const struct blk_crypto_key *key)
base-commit: 489fa31ea873282b41046d412ec741f93946fc2d
--
2.39.2
The WinSystems WS16C48 I/O address region spans offsets 0x0 through 0xA,
which is a total of 11 bytes. Fix the WS16C48_EXTENT define to the
correct value of 11 so that access to necessary device registers is
properly requested in the ws16c48_probe() callback by the
devm_request_region() function call.
Fixes: 2c05a0f29f41 ("gpio: ws16c48: Implement and utilize register structures")
Cc: Paul Demetrotion <pdemetrotion(a)winsystems.com>
Signed-off-by: William Breathitt Gray <william.gray(a)linaro.org>
---
drivers/gpio/gpio-ws16c48.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-ws16c48.c b/drivers/gpio/gpio-ws16c48.c
index e73885a4dc32..afb42a8e916f 100644
--- a/drivers/gpio/gpio-ws16c48.c
+++ b/drivers/gpio/gpio-ws16c48.c
@@ -18,7 +18,7 @@
#include <linux/spinlock.h>
#include <linux/types.h>
-#define WS16C48_EXTENT 10
+#define WS16C48_EXTENT 11
#define MAX_NUM_WS16C48 max_num_isa_dev(WS16C48_EXTENT)
static unsigned int base[MAX_NUM_WS16C48];
base-commit: 4827aae061337251bb91801b316157a78b845ec7
--
2.39.2
Make sure to clear the transfer buffer before fetching the EDID to
avoid leaking slab data to the logs on errors that leave the buffer
unchanged.
Fixes: 69c7717c20cc ("drm/edid: Dump the EDID when drm_edid_get_panel_id() has an error")
Cc: stable(a)vger.kernel.org # 6.2
Cc: Douglas Anderson <dianders(a)chromium.org>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/gpu/drm/drm_edid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 3841aba17abd..8707fe72a028 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -2797,7 +2797,7 @@ u32 drm_edid_get_panel_id(struct i2c_adapter *adapter)
* the EDID then we'll just return 0.
*/
- base_block = kmalloc(EDID_LENGTH, GFP_KERNEL);
+ base_block = kzalloc(EDID_LENGTH, GFP_KERNEL);
if (!base_block)
return 0;
--
2.39.2
The following commit has been merged into the irq/urgent branch of tip:
Commit-ID: 0fb7fb713461e44b12e72c292bf90ee300f40710
Gitweb: https://git.kernel.org/tip/0fb7fb713461e44b12e72c292bf90ee300f40710
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Wed, 01 Mar 2023 22:07:48 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Thu, 02 Mar 2023 18:09:44 +01:00
genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced
Miquel reported a warning in the MSI core which is triggered when
interrupts are freed via platform_msi_device_domain_free().
This code got reworked to use core functions for freeing the MSI
descriptors, but nothing took care to clear the msi_desc->irq entry, which
then triggers the warning in msi_free_msi_desc() which uses desc->irq to
validate that the descriptor has been torn down. The same issue exists in
msi_domain_populate_irqs().
Up to the point that msi_free_msi_descs() grew a warning for this case,
this went un-noticed.
Provide the counterpart of msi_domain_populate_irqs() and invoke it in
platform_msi_device_domain_free() before freeing the interrupts and MSI
descriptors and also in the error path of msi_domain_populate_irqs().
Fixes: 2f2940d16823 ("genirq/msi: Remove filter from msi_free_descs_free_range()")
Reported-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Tested-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/r/87mt4wkwnv.ffs@tglx
---
drivers/base/platform-msi.c | 1 +
include/linux/msi.h | 2 ++
kernel/irq/msi.c | 23 ++++++++++++++++++++++-
3 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c
index 5883e76..f37ad34 100644
--- a/drivers/base/platform-msi.c
+++ b/drivers/base/platform-msi.c
@@ -324,6 +324,7 @@ void platform_msi_device_domain_free(struct irq_domain *domain, unsigned int vir
struct platform_msi_priv_data *data = domain->host_data;
msi_lock_descs(data->dev);
+ msi_domain_depopulate_descs(data->dev, virq, nr_irqs);
irq_domain_free_irqs_common(domain, virq, nr_irqs);
msi_free_msi_descs_range(data->dev, virq, virq + nr_irqs - 1);
msi_unlock_descs(data->dev);
diff --git a/include/linux/msi.h b/include/linux/msi.h
index a112b91..15dd718 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -631,6 +631,8 @@ int msi_domain_prepare_irqs(struct irq_domain *domain, struct device *dev,
int nvec, msi_alloc_info_t *args);
int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev,
int virq, int nvec, msi_alloc_info_t *args);
+void msi_domain_depopulate_descs(struct device *dev, int virq, int nvec);
+
struct irq_domain *
__platform_msi_create_device_domain(struct device *dev,
unsigned int nvec,
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index efd21b7..d169ee0 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -1109,14 +1109,35 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev,
return 0;
fail:
- for (--virq; virq >= virq_base; virq--)
+ for (--virq; virq >= virq_base; virq--) {
+ msi_domain_depopulate_descs(dev, virq, 1);
irq_domain_free_irqs_common(domain, virq, 1);
+ }
msi_domain_free_descs(dev, &ctrl);
unlock:
msi_unlock_descs(dev);
return ret;
}
+void msi_domain_depopulate_descs(struct device *dev, int virq_base, int nvec)
+{
+ struct msi_ctrl ctrl = {
+ .domid = MSI_DEFAULT_DOMAIN,
+ .first = virq_base,
+ .last = virq_base + nvec - 1,
+ };
+ struct msi_desc *desc;
+ struct xarray *xa;
+ unsigned long idx;
+
+ if (!msi_ctrl_valid(dev, &ctrl))
+ return;
+
+ xa = &dev->msi.data->__domains[ctrl.domid].store;
+ xa_for_each_range(xa, idx, desc, ctrl.first, ctrl.last)
+ desc->irq = 0;
+}
+
/*
* Carefully check whether the device can use reservation mode. If
* reservation mode is enabled then the early activation will assign a
Re-enable the console device after suspending, causes its cflags,
ispeed and ospeed to be set anew, basing on the values stored in
uport->cons. The issue is that these values are set only once,
when parsing console parameters after boot (see uart_set_options()),
next after configuring a port in uart_port_startup() these parameteres
(cflags, ispeed and ospeed) are copied to termios structure and
the orginal one (stored in uport->cons) are cleared, but there is no place
in code where those fields are checked against 0.
When kernel calls uart_resume_port() and setups console, it copies cflags,
ispeed and ospeed values from uart->cons,but those are alread cleared.
The efect is that console is broken.
This patch address this by preserving the cflags, ispeed and
ospeed fields in uart->cons during uart_port_startup().
Signed-off-by: Lukasz Majczak <lma(a)semihalf.com>
Cc: stable(a)vger.kernel.org
---
drivers/tty/serial/serial_core.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 2bd32c8ece39..394a05c09d87 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -225,9 +225,6 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
tty->termios.c_cflag = uport->cons->cflag;
tty->termios.c_ispeed = uport->cons->ispeed;
tty->termios.c_ospeed = uport->cons->ospeed;
- uport->cons->cflag = 0;
- uport->cons->ispeed = 0;
- uport->cons->ospeed = 0;
}
/*
* Initialise the hardware port settings.
--
2.39.2.722.g9855ee24e9-goog
When buffered write fails to copy data into underlying page cache page,
ocfs2_write_end_nolock() just zeroes out and dirties the page. This can
leave dirty page beyond EOF and if page writeback tries to write this
page before write succeeds and expands i_size, page gets into
inconsistent state where page dirty bit is clear but buffer dirty bits
stay set resulting in page data never getting written and so data copied
to the page is lost. Fix the problem by invalidating page beyond EOF
after failed write.
Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()")
CC: stable(a)vger.kernel.org
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
fs/ocfs2/aops.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 1d65f6ef00ca..0394505fdce3 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1977,11 +1977,26 @@ int ocfs2_write_end_nolock(struct address_space *mapping,
}
if (unlikely(copied < len) && wc->w_target_page) {
+ loff_t new_isize;
+
if (!PageUptodate(wc->w_target_page))
copied = 0;
- ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
- start+len);
+ new_isize = max_t(loff_t, i_size_read(inode), pos + copied);
+ if (new_isize > page_offset(wc->w_target_page))
+ ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
+ start+len);
+ else {
+ /*
+ * When page is fully beyond new isize (data copy
+ * failed), do not bother zeroing the page. Invalidate
+ * it instead so that writeback does not get confused
+ * put page & buffer dirty bits into inconsistent
+ * state.
+ */
+ block_invalidate_folio(page_folio(wc->w_target_page),
+ 0, PAGE_SIZE);
+ }
}
if (wc->w_target_page)
flush_dcache_page(wc->w_target_page);
--
2.35.3
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
The function hist_field_name() cannot handle being passed a NULL field
parameter. It should never be NULL, but due to a previous bug, NULL was
passed to the function and the kernel crashed due to a NULL dereference.
Mark Rutland reported this to me on IRC.
The bug was fixed, but to prevent future bugs from crashing the kernel,
check the field and add a WARN_ON() if it is NULL.
Cc: stable(a)vger.kernel.org
Reported-by: Mark Rutland <mark.rutland(a)arm.com>
Fixes: c6afad49d127f ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
---
kernel/trace/trace_events_hist.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 6e8ab726a7b5..486cca3c2b75 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -1331,6 +1331,9 @@ static const char *hist_field_name(struct hist_field *field,
{
const char *field_name = "";
+ if (WARN_ON_ONCE(!field))
+ return field_name;
+
if (level > 1)
return field_name;
--
2.39.1
--
Hello Dear Good Day,
I hope you are doing great,
I have something important to discuss with you
if you give me a listening ear.so that I can
write you in details thank you as i wait for
your reply.
Mr Richard Godwin
syzbot sent a hung task report and Eric explains that adversarial
receiver may keep RWIN at 0 for a long time, so we are not guaranteed
to make forward progress. Thread which took tx_lock and went to sleep
may not release tx_lock for hours. Use interruptible sleep where
possible and reschedule the work if it can't take the lock.
Testing: existing selftest passes
Reported-by: syzbot+9c0268252b8ef967c62e(a)syzkaller.appspotmail.com
Fixes: 79ffe6087e91 ("net/tls: add a TX lock")
Link: https://lore.kernel.org/all/000000000000e412e905f5b46201@google.com/
Cc: stable(a)vger.kernel.org # wait 4 weeks
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
---
CC: borisp(a)nvidia.com
CC: john.fastabend(a)gmail.com
CC: simon.horman(a)netronome.com
---
net/tls/tls_sw.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 021d760f9133..635b8bf6b937 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -956,7 +956,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
MSG_CMSG_COMPAT))
return -EOPNOTSUPP;
- mutex_lock(&tls_ctx->tx_lock);
+ ret = mutex_lock_interruptible(&tls_ctx->tx_lock);
+ if (ret)
+ return ret;
lock_sock(sk);
if (unlikely(msg->msg_controllen)) {
@@ -1290,7 +1292,9 @@ int tls_sw_sendpage(struct sock *sk, struct page *page,
MSG_SENDPAGE_NOTLAST | MSG_SENDPAGE_NOPOLICY))
return -EOPNOTSUPP;
- mutex_lock(&tls_ctx->tx_lock);
+ ret = mutex_lock_interruptible(&tls_ctx->tx_lock);
+ if (ret)
+ return ret;
lock_sock(sk);
ret = tls_sw_do_sendpage(sk, page, offset, size, flags);
release_sock(sk);
@@ -2435,11 +2439,19 @@ static void tx_work_handler(struct work_struct *work)
if (!test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask))
return;
- mutex_lock(&tls_ctx->tx_lock);
- lock_sock(sk);
- tls_tx_records(sk, -1);
- release_sock(sk);
- mutex_unlock(&tls_ctx->tx_lock);
+
+ if (mutex_trylock(&tls_ctx->tx_lock)) {
+ lock_sock(sk);
+ tls_tx_records(sk, -1);
+ release_sock(sk);
+ mutex_unlock(&tls_ctx->tx_lock);
+ } else if (!test_and_set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
+ /* Someone is holding the tx_lock, they will likely run Tx
+ * and cancel the work on their way out of the lock section.
+ * Schedule a long delay just in case.
+ */
+ schedule_delayed_work(&ctx->tx_work.work, msecs_to_jiffies(10));
+ }
}
static bool tls_is_tx_ready(struct tls_sw_context_tx *ctx)
--
2.39.2
Build ID is missing for arm64 with CONFIG_MODVERSIONS=y using ld >= 2.36
on 5.4, 5.10, and 5.15
Backport Build ID fixes, which work-around ld behavior by
modifying vmlinux linker script.
This has been build tested this on {x86_64, arm64, riscv, powerpc, s390, sh}.
Simple test case:
$ readelf -n vmlinux | grep "Build ID"
Changes for v3:
- per Greg, add justification for backporting:
99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv")
which has "Fixes:" to v6.2 only content.
- rebase to v5.15.96
Changes for v2:
- rebase 5/5 c1c551bebf92 ("sh: define RUNTIME_DISCARD_EXIT") from upstream
Previous threads:
[1] v2 https://lore.kernel.org/all/20230210-tsaeger-upstream-linux-5-10-y-v2-0-ada…
[2] v1 https://lore.kernel.org/all/cover.1674851705.git.tom.saeger@oracle.com/
[3] https://lore.kernel.org/all/3df32572ec7016e783d37e185f88495831671f5d.167114…
[4] https://lore.kernel.org/all/cover.1670358255.git.tom.saeger@oracle.com/
Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com>
---
Masahiro Yamada (2):
arch: fix broken BuildID for arm64 and riscv
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
Michael Ellerman (2):
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
Tom Saeger (1):
sh: define RUNTIME_DISCARD_EXIT
arch/powerpc/kernel/vmlinux.lds.S | 6 +++++-
arch/s390/kernel/vmlinux.lds.S | 2 ++
arch/sh/kernel/vmlinux.lds.S | 1 +
include/asm-generic/vmlinux.lds.h | 5 +++++
4 files changed, 13 insertions(+), 1 deletion(-)
---
base-commit: 22d269bb30db7f5a4e71a8a813a0f4df5255f7de
change-id: 20230210-tsaeger-upstream-linux-5-10-y-e443820440f6
Best regards,
--
Tom Saeger <tom.saeger(a)oracle.com>
Build ID is missing for arm64 with CONFIG_MODVERSIONS=y using ld >= 2.36
on 5.4, 5.10, and 5.15
Backport Build ID fixes, which work-around ld behavior by
modifying vmlinux linker script.
This has been build tested this on {x86_64, arm64, riscv, powerpc, s390, sh}.
Simple test case:
$ readelf -n vmlinux | grep "Build ID"
Changes for v3:
- per Greg, add justification for backporting:
99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv")
which has "Fixes:" to v6.2 only content.
- rebase to v5.15.96
Changes for v2:
- rebase 5/5 c1c551bebf92 ("sh: define RUNTIME_DISCARD_EXIT") from upstream
Previous threads:
[1] v2 https://lore.kernel.org/all/20230210-tsaeger-upstream-linux-stable-5-15-v2-…
[2] v1 https://lore.kernel.org/all/cover.1674851705.git.tom.saeger@oracle.com/
[3] https://lore.kernel.org/all/3df32572ec7016e783d37e185f88495831671f5d.167114…
[4] https://lore.kernel.org/all/cover.1670358255.git.tom.saeger@oracle.com/
Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com>
---
Masahiro Yamada (2):
arch: fix broken BuildID for arm64 and riscv
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
Michael Ellerman (2):
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
Tom Saeger (1):
sh: define RUNTIME_DISCARD_EXIT
arch/powerpc/kernel/vmlinux.lds.S | 6 +++++-
arch/s390/kernel/vmlinux.lds.S | 2 ++
arch/sh/kernel/vmlinux.lds.S | 1 +
include/asm-generic/vmlinux.lds.h | 5 +++++
4 files changed, 13 insertions(+), 1 deletion(-)
---
base-commit: d383d0f28ecac0f3375bdfb9a0c4bfac979f6f8f
change-id: 20230210-tsaeger-upstream-linux-stable-5-15-f7bf45952c23
Best regards,
--
Tom Saeger <tom.saeger(a)oracle.com>
From: "Luke D. Jones" <luke(a)ljones.dev>
commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream
Remove the early return on LED brightness set so that any controller
application, daemon, or desktop may set the same brightness at any stage.
This is required because many ASUS ROG keyboards will default to max
brightness on laptop resume if the LEDs were set to off before sleep.
Signed-off-by: Luke D Jones <luke(a)ljones.dev>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com>
---
drivers/hid/hid-asus.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index a7a63abdea86..c7ae4b6d9fd3 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -298,9 +298,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
{
struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
cdev);
- if (led->brightness == brightness)
- return;
-
led->brightness = brightness;
schedule_work(&led->work);
}
--
2.39.1
From: "Luke D. Jones" <luke(a)ljones.dev>
commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream
Remove the early return on LED brightness set so that any controller
application, daemon, or desktop may set the same brightness at any stage.
This is required because many ASUS ROG keyboards will default to max
brightness on laptop resume if the LEDs were set to off before sleep.
Signed-off-by: Luke D Jones <luke(a)ljones.dev>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com>
---
drivers/hid/hid-asus.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 800b2364e29e..9ae8e3d5edf1 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -318,9 +318,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
{
struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
cdev);
- if (led->brightness == brightness)
- return;
-
led->brightness = brightness;
schedule_work(&led->work);
}
--
2.39.1
From: "Luke D. Jones" <luke(a)ljones.dev>
commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream
Remove the early return on LED brightness set so that any controller
application, daemon, or desktop may set the same brightness at any stage.
This is required because many ASUS ROG keyboards will default to max
brightness on laptop resume if the LEDs were set to off before sleep.
Signed-off-by: Luke D Jones <luke(a)ljones.dev>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com>
---
drivers/hid/hid-asus.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 7f84ed0afdfe..d3aca8f80de4 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -351,9 +351,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
{
struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
cdev);
- if (led->brightness == brightness)
- return;
-
led->brightness = brightness;
schedule_work(&led->work);
}
--
2.39.1
From: "Luke D. Jones" <luke(a)ljones.dev>
commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream
Remove the early return on LED brightness set so that any controller
application, daemon, or desktop may set the same brightness at any stage.
This is required because many ASUS ROG keyboards will default to max
brightness on laptop resume if the LEDs were set to off before sleep.
Signed-off-by: Luke D Jones <luke(a)ljones.dev>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com>
---
drivers/hid/hid-asus.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index f85c6e3309a0..9a6b63828634 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -402,9 +402,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
{
struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
cdev);
- if (led->brightness == brightness)
- return;
-
led->brightness = brightness;
schedule_work(&led->work);
}
--
2.39.1
There have been reports [1][2] that vmw_cmd_dx_define_query() can
be called with ctx_node->ctx set to NULL, which results in undefined
behavior in vmw_context_cotable(). Avoid this be returning an errno
code.
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Link: https://www.cve.org/CVERecord?id=CVE-2022-38096 # 1
Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2073 # 2
Cc: stable(a)vger.kernel.org
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 6b9aa2b4ef54..1e90362add96 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1256,7 +1256,7 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv,
struct vmw_resource *cotable_res;
int ret;
- if (!ctx_node)
+ if (!ctx_node || !ctx_node->ctx)
return -EINVAL;
cmd = container_of(header, typeof(*cmd), header);
--
2.39.2
From: Jia-Ju Bai <baijiaju1990(a)gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index c366a0a9ddba4..45d4a23d60444 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5626,11 +5626,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
The memcpy() will unconditionally copy PAGE_SIZE bytes, which far exceeds
the length of the array (96 bytes) that it's copying from. You can't
see the results using read() because it'll be limmited by i_size (which
is less than 96 bytes), but if you mmap the file, you can load the bytes
from the page which are beyond i_size. We need to zero the tail of the
page before marking it uptodate.
Cc: stable(a)vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") # actually v2.4.4.4
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
---
fs/freevxfs/vxfs_immed.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/fs/freevxfs/vxfs_immed.c b/fs/freevxfs/vxfs_immed.c
index 9b49ec36e667..c49612a24c18 100644
--- a/fs/freevxfs/vxfs_immed.c
+++ b/fs/freevxfs/vxfs_immed.c
@@ -30,15 +30,12 @@
*/
static int vxfs_immed_read_folio(struct file *fp, struct folio *folio)
{
- struct vxfs_inode_info *vip = VXFS_INO(folio->mapping->host);
- void *src = vip->vii_immed.vi_immed + folio_pos(folio);
- unsigned long i;
-
- for (i = 0; i < folio_nr_pages(folio); i++) {
- memcpy_to_page(folio_page(folio, i), 0, src, PAGE_SIZE);
- src += PAGE_SIZE;
- }
+ struct inode *inode = folio->mapping->host;
+ struct vxfs_inode_info *vip = VXFS_INO(inode);
+ loff_t isize = i_size_read(inode);
+ memcpy_to_file_folio(folio, 0, vip->vii_immed.vi_immed, isize);
+ folio_zero_segment(folio, isize, folio_size(folio));
folio_mark_uptodate(folio);
folio_unlock(folio);
--
2.39.1
From: Jia-Ju Bai <baijiaju1990(a)gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 999dae39f12e5..a7808f8b6f56a 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4554,11 +4554,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct ring_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
From: Jia-Ju Bai <baijiaju1990(a)gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 5e5b0c067f611..bef3d01b8ff61 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4685,11 +4685,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct ring_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
From: Jia-Ju Bai <baijiaju1990(a)gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 11e8189dd8ae9..58809fffc8171 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4769,11 +4769,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct ring_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
From: Jia-Ju Bai <baijiaju1990(a)gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 49ebb8c662682..1429d190752ee 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5324,11 +5324,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
From: Jia-Ju Bai <baijiaju1990(a)gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index ffc8696e67467..41ed07e2cbc05 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5568,11 +5568,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
From: Jia-Ju Bai <baijiaju1990(a)gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index b21bf14bae9bd..2a5856ac25ebe 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5610,11 +5610,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
From: Valentin Schneider <vschneid(a)redhat.com>
commit 7bb5da0d490b2d836c5218f5186ee588d2145310 upstream.
Patch series "kexec, panic: Making crash_kexec() NMI safe", v4.
This patch (of 2):
Most acquistions of kexec_mutex are done via mutex_trylock() - those were
a direct "translation" from:
8c5a1cf0ad3a ("kexec: use a mutex for locking rather than xchg()")
there have however been two additions since then that use mutex_lock():
crash_get_memory_size() and crash_shrink_memory().
A later commit will replace said mutex with an atomic variable, and
locking operations will become atomic_cmpxchg(). Rather than having those
mutex_lock() become while (atomic_cmpxchg(&lock, 0, 1)), turn them into
trylocks that can return -EBUSY on acquisition failure.
This does halve the printable size of the crash kernel, but that's still
neighbouring 2G for 32bit kernels which should be ample enough.
Link: https://lkml.kernel.org/r/20220630223258.4144112-1-vschneid@redhat.com
Link: https://lkml.kernel.org/r/20220630223258.4144112-2-vschneid@redhat.com
Signed-off-by: Valentin Schneider <vschneid(a)redhat.com>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: "Eric W . Biederman" <ebiederm(a)xmission.com>
Cc: Juri Lelli <jlelli(a)redhat.com>
Cc: Luis Claudio R. Goncalves <lgoncalv(a)redhat.com>
Cc: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Baoquan He <bhe(a)redhat.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: stable(a)vger.kernel.org # 5.10+
Signed-off-by: Wen Yang <wenyang.linux(a)foxmail.com>
---
include/linux/kexec.h | 2 +-
kernel/kexec_core.c | 12 ++++++++----
kernel/ksysfs.c | 7 ++++++-
3 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index a1f12e959bba..3c1deba496c9 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -380,8 +380,8 @@ extern note_buf_t __percpu *crash_notes;
extern bool kexec_in_progress;
int crash_shrink_memory(unsigned long new_size);
-size_t crash_get_memory_size(void);
void crash_free_reserved_phys_range(unsigned long begin, unsigned long end);
+ssize_t crash_get_memory_size(void);
void arch_kexec_protect_crashkres(void);
void arch_kexec_unprotect_crashkres(void);
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index c589c7a9562c..e47870f30728 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -989,13 +989,16 @@ void crash_kexec(struct pt_regs *regs)
}
}
-size_t crash_get_memory_size(void)
+ssize_t crash_get_memory_size(void)
{
- size_t size = 0;
+ ssize_t size = 0;
+
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
- mutex_lock(&kexec_mutex);
if (crashk_res.end != crashk_res.start)
size = resource_size(&crashk_res);
+
mutex_unlock(&kexec_mutex);
return size;
}
@@ -1016,7 +1019,8 @@ int crash_shrink_memory(unsigned long new_size)
unsigned long old_size;
struct resource *ram_res;
- mutex_lock(&kexec_mutex);
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
if (kexec_crash_image) {
ret = -ENOENT;
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 35859da8bd4f..e20c19e3ba49 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -106,7 +106,12 @@ KERNEL_ATTR_RO(kexec_crash_loaded);
static ssize_t kexec_crash_size_show(struct kobject *kobj,
struct kobj_attribute *attr, char *buf)
{
- return sprintf(buf, "%zu\n", crash_get_memory_size());
+ ssize_t size = crash_get_memory_size();
+
+ if (size < 0)
+ return size;
+
+ return sprintf(buf, "%zd\n", size);
}
static ssize_t kexec_crash_size_store(struct kobject *kobj,
struct kobj_attribute *attr,
--
2.37.2
From: Arnd Bergmann <arnd(a)arndb.de>
commit 4b692e861619353ce069e547a67c8d0e32d9ef3d upstream.
Patch series "compat: remove compat_alloc_user_space", v5.
Going through compat_alloc_user_space() to convert indirect system call
arguments tends to add complexity compared to handling the native and
compat logic in the same code.
This patch (of 6):
The locking is the same between the native and compat version of
sys_kexec_load(), so it can be done in the common implementation to reduce
duplication.
Link: https://lkml.kernel.org/r/20210727144859.4150043-1-arnd@kernel.org
Link: https://lkml.kernel.org/r/20210727144859.4150043-2-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Co-developed-by: Eric Biederman <ebiederm(a)xmission.com>
Co-developed-by: Christoph Hellwig <hch(a)infradead.org>
Acked-by: "Eric W. Biederman" <ebiederm(a)xmission.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de>
Cc: "James E.J. Bottomley" <James.Bottomley(a)HansenPartnership.com>
Cc: Helge Deller <deller(a)gmx.de>
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
Cc: Paul Mackerras <paulus(a)samba.org>
Cc: Heiko Carstens <hca(a)linux.ibm.com>
Cc: Vasily Gorbik <gor(a)linux.ibm.com>
Cc: Christian Borntraeger <borntraeger(a)de.ibm.com>
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: "H. Peter Anvin" <hpa(a)zytor.com>
Cc: Al Viro <viro(a)zeniv.linux.org.uk>
Cc: Feng Tang <feng.tang(a)intel.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: stable(a)vger.kernel.org # 5.10+
Signed-off-by: Wen Yang <wenyang.linux(a)foxmail.com>
---
kernel/kexec.c | 44 ++++++++++++++++----------------------------
1 file changed, 16 insertions(+), 28 deletions(-)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index c82c6c06f051..9c7aef8f4bb6 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -110,6 +110,17 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
unsigned long i;
int ret;
+ /*
+ * Because we write directly to the reserved memory region when loading
+ * crash kernels we need a mutex here to prevent multiple crash kernels
+ * from attempting to load simultaneously, and to prevent a crash kernel
+ * from loading over the top of a in use crash kernel.
+ *
+ * KISS: always take the mutex.
+ */
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
+
if (flags & KEXEC_ON_CRASH) {
dest_image = &kexec_crash_image;
if (kexec_crash_image)
@@ -121,7 +132,8 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
if (nr_segments == 0) {
/* Uninstall image */
kimage_free(xchg(dest_image, NULL));
- return 0;
+ ret = 0;
+ goto out_unlock;
}
if (flags & KEXEC_ON_CRASH) {
/*
@@ -134,7 +146,7 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
ret = kimage_alloc_init(&image, entry, nr_segments, segments, flags);
if (ret)
- return ret;
+ goto out_unlock;
if (flags & KEXEC_PRESERVE_CONTEXT)
image->preserve_context = 1;
@@ -171,6 +183,8 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
arch_kexec_protect_crashkres();
kimage_free(image);
+out_unlock:
+ mutex_unlock(&kexec_mutex);
return ret;
}
@@ -247,21 +261,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
((flags & KEXEC_ARCH_MASK) != KEXEC_ARCH_DEFAULT))
return -EINVAL;
- /* Because we write directly to the reserved memory
- * region when loading crash kernels we need a mutex here to
- * prevent multiple crash kernels from attempting to load
- * simultaneously, and to prevent a crash kernel from loading
- * over the top of a in use crash kernel.
- *
- * KISS: always take the mutex.
- */
- if (!mutex_trylock(&kexec_mutex))
- return -EBUSY;
-
result = do_kexec_load(entry, nr_segments, segments, flags);
- mutex_unlock(&kexec_mutex);
-
return result;
}
@@ -301,21 +302,8 @@ COMPAT_SYSCALL_DEFINE4(kexec_load, compat_ulong_t, entry,
return -EFAULT;
}
- /* Because we write directly to the reserved memory
- * region when loading crash kernels we need a mutex here to
- * prevent multiple crash kernels from attempting to load
- * simultaneously, and to prevent a crash kernel from loading
- * over the top of a in use crash kernel.
- *
- * KISS: always take the mutex.
- */
- if (!mutex_trylock(&kexec_mutex))
- return -EBUSY;
-
result = do_kexec_load(entry, nr_segments, ksegments, flags);
- mutex_unlock(&kexec_mutex);
-
return result;
}
#endif
--
2.37.2
From: Valentin Schneider <vschneid(a)redhat.com>
commit 05c6257433b7212f07a7e53479a8ab038fc1666a upstream.
Attempting to get a crash dump out of a debug PREEMPT_RT kernel via an NMI
panic() doesn't work. The cause of that lies in the PREEMPT_RT definition
of mutex_trylock():
if (IS_ENABLED(CONFIG_DEBUG_RT_MUTEXES) && WARN_ON_ONCE(!in_task()))
return 0;
This prevents an nmi_panic() from executing the main body of
__crash_kexec() which does the actual kexec into the kdump kernel. The
warning and return are explained by:
6ce47fd961fa ("rtmutex: Warn if trylock is called from hard/softirq context")
[...]
The reasons for this are:
1) There is a potential deadlock in the slowpath
2) Another cpu which blocks on the rtmutex will boost the task
which allegedly locked the rtmutex, but that cannot work
because the hard/softirq context borrows the task context.
Furthermore, grabbing the lock isn't NMI safe, so do away with kexec_mutex
and replace it with an atomic variable. This is somewhat overzealous as
*some* callsites could keep using a mutex (e.g. the sysfs-facing ones
like crash_shrink_memory()), but this has the benefit of involving a
single unified lock and preventing any future NMI-related surprises.
Tested by triggering NMI panics via:
$ echo 1 > /proc/sys/kernel/panic_on_unrecovered_nmi
$ echo 1 > /proc/sys/kernel/unknown_nmi_panic
$ echo 1 > /proc/sys/kernel/panic
$ ipmitool power diag
Link: https://lkml.kernel.org/r/20220630223258.4144112-3-vschneid@redhat.com
Fixes: 6ce47fd961fa ("rtmutex: Warn if trylock is called from hard/softirq context")
Signed-off-by: Valentin Schneider <vschneid(a)redhat.com>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: Baoquan He <bhe(a)redhat.com>
Cc: "Eric W . Biederman" <ebiederm(a)xmission.com>
Cc: Juri Lelli <jlelli(a)redhat.com>
Cc: Luis Claudio R. Goncalves <lgoncalv(a)redhat.com>
Cc: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: stable(a)vger.kernel.org # 5.15.x
Signed-off-by: Wen Yang <wenyang.linux(a)foxmail.com>
---
kernel/kexec.c | 11 ++++-------
kernel/kexec_core.c | 20 ++++++++++----------
kernel/kexec_file.c | 4 ++--
kernel/kexec_internal.h | 15 ++++++++++++++-
4 files changed, 30 insertions(+), 20 deletions(-)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index b5e40f069768..cb8e6e6f983c 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -93,13 +93,10 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
/*
* Because we write directly to the reserved memory region when loading
- * crash kernels we need a mutex here to prevent multiple crash kernels
- * from attempting to load simultaneously, and to prevent a crash kernel
- * from loading over the top of a in use crash kernel.
- *
- * KISS: always take the mutex.
+ * crash kernels we need a serialization here to prevent multiple crash
+ * kernels from attempting to load simultaneously.
*/
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (flags & KEXEC_ON_CRASH) {
@@ -165,7 +162,7 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
kimage_free(image);
out_unlock:
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return ret;
}
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index a101d2b77936..bdc2d952911c 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -46,7 +46,7 @@
#include <crypto/hash.h>
#include "kexec_internal.h"
-DEFINE_MUTEX(kexec_mutex);
+atomic_t __kexec_lock = ATOMIC_INIT(0);
/* Per cpu memory for storing cpu states in case of system crash. */
note_buf_t __percpu *crash_notes;
@@ -944,7 +944,7 @@ int kexec_load_disabled;
*/
void __noclone __crash_kexec(struct pt_regs *regs)
{
- /* Take the kexec_mutex here to prevent sys_kexec_load
+ /* Take the kexec_lock here to prevent sys_kexec_load
* running on one cpu from replacing the crash kernel
* we are using after a panic on a different cpu.
*
@@ -952,7 +952,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
* of memory the xchg(&kexec_crash_image) would be
* sufficient. But since I reuse the memory...
*/
- if (mutex_trylock(&kexec_mutex)) {
+ if (kexec_trylock()) {
if (kexec_crash_image) {
struct pt_regs fixed_regs;
@@ -961,7 +961,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
machine_crash_shutdown(&fixed_regs);
machine_kexec(kexec_crash_image);
}
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
}
}
STACK_FRAME_NON_STANDARD(__crash_kexec);
@@ -993,13 +993,13 @@ ssize_t crash_get_memory_size(void)
{
ssize_t size = 0;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (crashk_res.end != crashk_res.start)
size = resource_size(&crashk_res);
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return size;
}
@@ -1019,7 +1019,7 @@ int crash_shrink_memory(unsigned long new_size)
unsigned long old_size;
struct resource *ram_res;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (kexec_crash_image) {
@@ -1058,7 +1058,7 @@ int crash_shrink_memory(unsigned long new_size)
insert_resource(&iomem_resource, ram_res);
unlock:
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return ret;
}
@@ -1130,7 +1130,7 @@ int kernel_kexec(void)
{
int error = 0;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (!kexec_image) {
error = -EINVAL;
@@ -1206,7 +1206,7 @@ int kernel_kexec(void)
#endif
Unlock:
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return error;
}
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index f7a4fd4d243f..1fb7ff690577 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -343,7 +343,7 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
image = NULL;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
dest_image = &kexec_image;
@@ -415,7 +415,7 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
if ((flags & KEXEC_FILE_ON_CRASH) && kexec_crash_image)
arch_kexec_protect_crashkres();
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
kimage_free(image);
return ret;
}
diff --git a/kernel/kexec_internal.h b/kernel/kexec_internal.h
index 48aaf2ac0d0d..74da1409cd14 100644
--- a/kernel/kexec_internal.h
+++ b/kernel/kexec_internal.h
@@ -13,7 +13,20 @@ void kimage_terminate(struct kimage *image);
int kimage_is_destination_range(struct kimage *image,
unsigned long start, unsigned long end);
-extern struct mutex kexec_mutex;
+/*
+ * Whatever is used to serialize accesses to the kexec_crash_image needs to be
+ * NMI safe, as __crash_kexec() can happen during nmi_panic(), so here we use a
+ * "simple" atomic variable that is acquired with a cmpxchg().
+ */
+extern atomic_t __kexec_lock;
+static inline bool kexec_trylock(void)
+{
+ return atomic_cmpxchg_acquire(&__kexec_lock, 0, 1) == 0;
+}
+static inline void kexec_unlock(void)
+{
+ atomic_set_release(&__kexec_lock, 0);
+}
#ifdef CONFIG_KEXEC_FILE
#include <linux/purgatory.h>
--
2.37.2
From: Valentin Schneider <vschneid(a)redhat.com>
commit 7bb5da0d490b2d836c5218f5186ee588d2145310 upstream.
Patch series "kexec, panic: Making crash_kexec() NMI safe", v4.
This patch (of 2):
Most acquistions of kexec_mutex are done via mutex_trylock() - those were
a direct "translation" from:
8c5a1cf0ad3a ("kexec: use a mutex for locking rather than xchg()")
there have however been two additions since then that use mutex_lock():
crash_get_memory_size() and crash_shrink_memory().
A later commit will replace said mutex with an atomic variable, and
locking operations will become atomic_cmpxchg(). Rather than having those
mutex_lock() become while (atomic_cmpxchg(&lock, 0, 1)), turn them into
trylocks that can return -EBUSY on acquisition failure.
This does halve the printable size of the crash kernel, but that's still
neighbouring 2G for 32bit kernels which should be ample enough.
Link: https://lkml.kernel.org/r/20220630223258.4144112-1-vschneid@redhat.com
Link: https://lkml.kernel.org/r/20220630223258.4144112-2-vschneid@redhat.com
Signed-off-by: Valentin Schneider <vschneid(a)redhat.com>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: "Eric W . Biederman" <ebiederm(a)xmission.com>
Cc: Juri Lelli <jlelli(a)redhat.com>
Cc: Luis Claudio R. Goncalves <lgoncalv(a)redhat.com>
Cc: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Baoquan He <bhe(a)redhat.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: <stable(a)vger.kernel.org> # v5.15+
Signed-off-by: Wen Yang <wenyang.linux(a)foxmail.com>
---
include/linux/kexec.h | 2 +-
kernel/kexec_core.c | 12 ++++++++----
kernel/ksysfs.c | 7 ++++++-
3 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index cf042d41c87b..88c289ce3039 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -390,8 +390,8 @@ extern note_buf_t __percpu *crash_notes;
extern bool kexec_in_progress;
int crash_shrink_memory(unsigned long new_size);
-size_t crash_get_memory_size(void);
void crash_free_reserved_phys_range(unsigned long begin, unsigned long end);
+ssize_t crash_get_memory_size(void);
void arch_kexec_protect_crashkres(void);
void arch_kexec_unprotect_crashkres(void);
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 5a5d192a89ac..a101d2b77936 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -989,13 +989,16 @@ void crash_kexec(struct pt_regs *regs)
}
}
-size_t crash_get_memory_size(void)
+ssize_t crash_get_memory_size(void)
{
- size_t size = 0;
+ ssize_t size = 0;
+
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
- mutex_lock(&kexec_mutex);
if (crashk_res.end != crashk_res.start)
size = resource_size(&crashk_res);
+
mutex_unlock(&kexec_mutex);
return size;
}
@@ -1016,7 +1019,8 @@ int crash_shrink_memory(unsigned long new_size)
unsigned long old_size;
struct resource *ram_res;
- mutex_lock(&kexec_mutex);
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
if (kexec_crash_image) {
ret = -ENOENT;
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 35859da8bd4f..e20c19e3ba49 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -106,7 +106,12 @@ KERNEL_ATTR_RO(kexec_crash_loaded);
static ssize_t kexec_crash_size_show(struct kobject *kobj,
struct kobj_attribute *attr, char *buf)
{
- return sprintf(buf, "%zu\n", crash_get_memory_size());
+ ssize_t size = crash_get_memory_size();
+
+ if (size < 0)
+ return size;
+
+ return sprintf(buf, "%zd\n", size);
}
static ssize_t kexec_crash_size_store(struct kobject *kobj,
struct kobj_attribute *attr,
--
2.37.2
From: Valentin Schneider <vschneid(a)redhat.com>
commit 811d581194f7412eda97acc03d17fc77824b561f upstream.
Attempting to get a crash dump out of a debug PREEMPT_RT kernel via an NMI
panic() doesn't work. The cause of that lies in the PREEMPT_RT definition
of mutex_trylock():
if (IS_ENABLED(CONFIG_DEBUG_RT_MUTEXES) && WARN_ON_ONCE(!in_task()))
return 0;
This prevents an nmi_panic() from executing the main body of
__crash_kexec() which does the actual kexec into the kdump kernel. The
warning and return are explained by:
6ce47fd961fa ("rtmutex: Warn if trylock is called from hard/softirq context")
[...]
The reasons for this are:
1) There is a potential deadlock in the slowpath
2) Another cpu which blocks on the rtmutex will boost the task
which allegedly locked the rtmutex, but that cannot work
because the hard/softirq context borrows the task context.
Furthermore, grabbing the lock isn't NMI safe, so do away with kexec_mutex
and replace it with an atomic variable. This is somewhat overzealous as
*some* callsites could keep using a mutex (e.g. the sysfs-facing ones
like crash_shrink_memory()), but this has the benefit of involving a
single unified lock and preventing any future NMI-related surprises.
Tested by triggering NMI panics via:
$ echo 1 > /proc/sys/kernel/panic_on_unrecovered_nmi
$ echo 1 > /proc/sys/kernel/unknown_nmi_panic
$ echo 1 > /proc/sys/kernel/panic
$ ipmitool power diag
Link: https://lkml.kernel.org/r/20220630223258.4144112-3-vschneid@redhat.com
Fixes: 6ce47fd961fa ("rtmutex: Warn if trylock is called from hard/softirq context")
Signed-off-by: Valentin Schneider <vschneid(a)redhat.com>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: Baoquan He <bhe(a)redhat.com>
Cc: "Eric W . Biederman" <ebiederm(a)xmission.com>
Cc: Juri Lelli <jlelli(a)redhat.com>
Cc: Luis Claudio R. Goncalves <lgoncalv(a)redhat.com>
Cc: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: stable(a)vger.kernel.org # 5.10+
Signed-off-by: Wen Yang <wenyang.linux(a)foxmail.com>
---
kernel/kexec.c | 11 ++++-------
kernel/kexec_core.c | 20 ++++++++++----------
kernel/kexec_file.c | 4 ++--
kernel/kexec_internal.h | 15 ++++++++++++++-
4 files changed, 30 insertions(+), 20 deletions(-)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 9c7aef8f4bb6..f0f0c6555454 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -112,13 +112,10 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
/*
* Because we write directly to the reserved memory region when loading
- * crash kernels we need a mutex here to prevent multiple crash kernels
- * from attempting to load simultaneously, and to prevent a crash kernel
- * from loading over the top of a in use crash kernel.
- *
- * KISS: always take the mutex.
+ * crash kernels we need a serialization here to prevent multiple crash
+ * kernels from attempting to load simultaneously.
*/
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (flags & KEXEC_ON_CRASH) {
@@ -184,7 +181,7 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
kimage_free(image);
out_unlock:
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return ret;
}
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index e47870f30728..7a8104d48997 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -45,7 +45,7 @@
#include <crypto/sha.h>
#include "kexec_internal.h"
-DEFINE_MUTEX(kexec_mutex);
+atomic_t __kexec_lock = ATOMIC_INIT(0);
/* Per cpu memory for storing cpu states in case of system crash. */
note_buf_t __percpu *crash_notes;
@@ -943,7 +943,7 @@ int kexec_load_disabled;
*/
void __noclone __crash_kexec(struct pt_regs *regs)
{
- /* Take the kexec_mutex here to prevent sys_kexec_load
+ /* Take the kexec_lock here to prevent sys_kexec_load
* running on one cpu from replacing the crash kernel
* we are using after a panic on a different cpu.
*
@@ -951,7 +951,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
* of memory the xchg(&kexec_crash_image) would be
* sufficient. But since I reuse the memory...
*/
- if (mutex_trylock(&kexec_mutex)) {
+ if (kexec_trylock()) {
if (kexec_crash_image) {
struct pt_regs fixed_regs;
@@ -960,7 +960,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
machine_crash_shutdown(&fixed_regs);
machine_kexec(kexec_crash_image);
}
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
}
}
STACK_FRAME_NON_STANDARD(__crash_kexec);
@@ -993,13 +993,13 @@ ssize_t crash_get_memory_size(void)
{
ssize_t size = 0;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (crashk_res.end != crashk_res.start)
size = resource_size(&crashk_res);
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return size;
}
@@ -1019,7 +1019,7 @@ int crash_shrink_memory(unsigned long new_size)
unsigned long old_size;
struct resource *ram_res;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (kexec_crash_image) {
@@ -1058,7 +1058,7 @@ int crash_shrink_memory(unsigned long new_size)
insert_resource(&iomem_resource, ram_res);
unlock:
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return ret;
}
@@ -1130,7 +1130,7 @@ int kernel_kexec(void)
{
int error = 0;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
if (!kexec_image) {
error = -EINVAL;
@@ -1205,7 +1205,7 @@ int kernel_kexec(void)
#endif
Unlock:
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
return error;
}
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index fff11916aba3..b9c857782ada 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -343,7 +343,7 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
image = NULL;
- if (!mutex_trylock(&kexec_mutex))
+ if (!kexec_trylock())
return -EBUSY;
dest_image = &kexec_image;
@@ -415,7 +415,7 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
if ((flags & KEXEC_FILE_ON_CRASH) && kexec_crash_image)
arch_kexec_protect_crashkres();
- mutex_unlock(&kexec_mutex);
+ kexec_unlock();
kimage_free(image);
return ret;
}
diff --git a/kernel/kexec_internal.h b/kernel/kexec_internal.h
index 39d30ccf8d87..49d4e3ab9c96 100644
--- a/kernel/kexec_internal.h
+++ b/kernel/kexec_internal.h
@@ -15,7 +15,20 @@ int kimage_is_destination_range(struct kimage *image,
int machine_kexec_post_load(struct kimage *image);
-extern struct mutex kexec_mutex;
+/*
+ * Whatever is used to serialize accesses to the kexec_crash_image needs to be
+ * NMI safe, as __crash_kexec() can happen during nmi_panic(), so here we use a
+ * "simple" atomic variable that is acquired with a cmpxchg().
+ */
+extern atomic_t __kexec_lock;
+static inline bool kexec_trylock(void)
+{
+ return atomic_cmpxchg_acquire(&__kexec_lock, 0, 1) == 0;
+}
+static inline void kexec_unlock(void)
+{
+ atomic_set_release(&__kexec_lock, 0);
+}
#ifdef CONFIG_KEXEC_FILE
#include <linux/purgatory.h>
--
2.37.2
From: Valentin Schneider <vschneid(a)redhat.com>
commit 7bb5da0d490b2d836c5218f5186ee588d2145310 upstream.
Patch series "kexec, panic: Making crash_kexec() NMI safe", v4.
This patch (of 2):
Most acquistions of kexec_mutex are done via mutex_trylock() - those were
a direct "translation" from:
8c5a1cf0ad3a ("kexec: use a mutex for locking rather than xchg()")
there have however been two additions since then that use mutex_lock():
crash_get_memory_size() and crash_shrink_memory().
A later commit will replace said mutex with an atomic variable, and
locking operations will become atomic_cmpxchg(). Rather than having those
mutex_lock() become while (atomic_cmpxchg(&lock, 0, 1)), turn them into
trylocks that can return -EBUSY on acquisition failure.
This does halve the printable size of the crash kernel, but that's still
neighbouring 2G for 32bit kernels which should be ample enough.
Link: https://lkml.kernel.org/r/20220630223258.4144112-1-vschneid@redhat.com
Link: https://lkml.kernel.org/r/20220630223258.4144112-2-vschneid@redhat.com
Signed-off-by: Valentin Schneider <vschneid(a)redhat.com>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: "Eric W . Biederman" <ebiederm(a)xmission.com>
Cc: Juri Lelli <jlelli(a)redhat.com>
Cc: Luis Claudio R. Goncalves <lgoncalv(a)redhat.com>
Cc: Miaohe Lin <linmiaohe(a)huawei.com>
Cc: Petr Mladek <pmladek(a)suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Baoquan He <bhe(a)redhat.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: stable(a)vger.kernel.org # 5.10+
Signed-off-by: Wen Yang <wenyang.linux(a)foxmail.com>
---
include/linux/kexec.h | 2 +-
kernel/kexec_core.c | 12 ++++++++----
kernel/ksysfs.c | 7 ++++++-
3 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index a1f12e959bba..3c1deba496c9 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -380,8 +380,8 @@ extern note_buf_t __percpu *crash_notes;
extern bool kexec_in_progress;
int crash_shrink_memory(unsigned long new_size);
-size_t crash_get_memory_size(void);
void crash_free_reserved_phys_range(unsigned long begin, unsigned long end);
+ssize_t crash_get_memory_size(void);
void arch_kexec_protect_crashkres(void);
void arch_kexec_unprotect_crashkres(void);
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index c589c7a9562c..e47870f30728 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -989,13 +989,16 @@ void crash_kexec(struct pt_regs *regs)
}
}
-size_t crash_get_memory_size(void)
+ssize_t crash_get_memory_size(void)
{
- size_t size = 0;
+ ssize_t size = 0;
+
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
- mutex_lock(&kexec_mutex);
if (crashk_res.end != crashk_res.start)
size = resource_size(&crashk_res);
+
mutex_unlock(&kexec_mutex);
return size;
}
@@ -1016,7 +1019,8 @@ int crash_shrink_memory(unsigned long new_size)
unsigned long old_size;
struct resource *ram_res;
- mutex_lock(&kexec_mutex);
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
if (kexec_crash_image) {
ret = -ENOENT;
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 35859da8bd4f..e20c19e3ba49 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -106,7 +106,12 @@ KERNEL_ATTR_RO(kexec_crash_loaded);
static ssize_t kexec_crash_size_show(struct kobject *kobj,
struct kobj_attribute *attr, char *buf)
{
- return sprintf(buf, "%zu\n", crash_get_memory_size());
+ ssize_t size = crash_get_memory_size();
+
+ if (size < 0)
+ return size;
+
+ return sprintf(buf, "%zd\n", size);
}
static ssize_t kexec_crash_size_store(struct kobject *kobj,
struct kobj_attribute *attr,
--
2.37.2
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
6ec363fc6142 ("scripts/tags.sh: fix incompatibility with PCRE2")
7394d2ebb651 ("scripts/tags.sh: Invoke 'realpath' via 'xargs'")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 6ec363fc6142226b9ab5a6528f65333d729d2b6b Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas(a)google.com>
Date: Wed, 15 Feb 2023 18:38:50 +0000
Subject: [PATCH] scripts/tags.sh: fix incompatibility with PCRE2
Starting with release 10.38 PCRE2 drops default support for using \K in
lookaround patterns as described in [1]. Unfortunately, scripts/tags.sh
relies on such functionality to collect all_compiled_soures() leading to
the following error:
$ make COMPILED_SOURCE=1 tags
GEN tags
grep: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK)
The usage of \K for this pattern was introduced in commit 4f491bb6ea2a
("scripts/tags.sh: collect compiled source precisely") which speeds up
the generation of tags significantly.
In order to fix this issue without compromising the performance we can
switch over to an equivalent sed expression. The same matching pattern
is preserved here except \K is replaced with a backreference \1.
[1] https://www.pcre.org/current/doc/html/pcre2syntax.html#SEC11
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Jialu Xu <xujialu(a)vimux.org>
Cc: Vipin Sharma <vipinsh(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
Link: https://lore.kernel.org/r/20230215183850.3353198-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 1ad45f17179a..6b9001853890 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -98,7 +98,7 @@ all_compiled_sources()
{
echo include/generated/autoconf.h
find $ignore -name "*.cmd" -exec \
- grep -Poh '(?(?=^source_.* \K).*|(?=^ \K\S).*(?= \\))' {} \+ |
+ sed -n -E 's/^source_.* (.*)/\1/p; s/^ (\S.*) \\/\1/p' {} \+ |
awk '!a[$0]++'
} | xargs realpath -esq $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) |
sort -u
On Fri, Feb 10, 2023 at 12:16:29PM +0100, Sascha Hauer wrote:
> This series addresses issues for the recently added RTW88 USB support
> reported by Andreas Henriksson and also our customer.
>
> The hardware can't handle urbs that have a size of multiple of the
> bulkout_size (usually 512 bytes). The symptom is that the hardware
> stalls completely. The issue can be reproduced by sending a suitably
> sized ping packet from the device:
>
> ping -s 394 <somehost>
>
> (It's 394 bytes here on a RTL8822CU and RTL8821CU, the actual size may
> differ on other chips, it was 402 bytes on a RTL8723DU)
>
> Other than that qsel was not set correctly. The sympton here is that
> only one of multiple bulk endpoints was used to send data.
>
> Changes since v1:
> - Use URB_ZERO_PACKET to let the USB host controller handle it automatically
> rather than working around the issue.
>
> Sascha Hauer (3):
> wifi: rtw88: usb: Set qsel correctly
> wifi: rtw88: usb: send Zero length packets if necessary
> wifi: rtw88: usb: drop now unnecessary URB size check
These patches went in upstream as:
7869b834fb07c wifi: rtw88: usb: Set qsel correctly
07ce9fa6ab0e5 wifi: rtw88: usb: send Zero length packets if necessary
462c8db6a0116 wifi: rtw88: usb: drop now unnecessary URB size check
These patches make the RTW88 USB support much more reliable. Can they be
picked for the current 6.2 stable series please?
Sascha
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
This bug is marked as fixed by commit:
ext4: block range must be validated before use in ext4_mb_clear_bb()
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Android 5.10
Dashboard link: https://syzkaller.appspot.com/bug?extid=15cd994e273307bf5cfa
---
[1] I expect the commit to be present in:
1. android12-5.10-lts branch of
https://android.googlesource.com/kernel/common
Dobré ráno,
Hledám firmy, které jsou ochotné uvažovat o změně dodavatele nabízejícího hliníkové tlakové odlitky.
Garantujeme opakovatelnou kvalitu detailů s nízkou drsností povrchu a vysokou odolností proti korozi.
Výrobky chráníme pasivačním povlakem na bázi chemie Surtec 650 v plně automatizovaném procesu ponoru. Detaily práškově lakujeme na robotické lince od renomované švýcarské firmy.
Pokud vidíte příležitost ke spolupráci, kontaktujte mě.
Alan Beran
Buenos días:
Le escribo para hablarle sobre una de las mejores herramientas GPS en el mercado.
La herramienta, que me gustaría presentarle brevemente, dispone de muchas funciones útiles para su trabajo, que optimizan los procesos de transporte y le ayudan a realizar tareas de campo de manera más eficiente.
¿Quiere conocer los detalles?
Atentamente,
Antonio Valverde
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
6ec363fc6142 ("scripts/tags.sh: fix incompatibility with PCRE2")
7394d2ebb651 ("scripts/tags.sh: Invoke 'realpath' via 'xargs'")
162343a876f1 ("scripts/tags.sh: exclude tools directory from tags generation")
4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 6ec363fc6142226b9ab5a6528f65333d729d2b6b Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas(a)google.com>
Date: Wed, 15 Feb 2023 18:38:50 +0000
Subject: [PATCH] scripts/tags.sh: fix incompatibility with PCRE2
Starting with release 10.38 PCRE2 drops default support for using \K in
lookaround patterns as described in [1]. Unfortunately, scripts/tags.sh
relies on such functionality to collect all_compiled_soures() leading to
the following error:
$ make COMPILED_SOURCE=1 tags
GEN tags
grep: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK)
The usage of \K for this pattern was introduced in commit 4f491bb6ea2a
("scripts/tags.sh: collect compiled source precisely") which speeds up
the generation of tags significantly.
In order to fix this issue without compromising the performance we can
switch over to an equivalent sed expression. The same matching pattern
is preserved here except \K is replaced with a backreference \1.
[1] https://www.pcre.org/current/doc/html/pcre2syntax.html#SEC11
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Jialu Xu <xujialu(a)vimux.org>
Cc: Vipin Sharma <vipinsh(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
Link: https://lore.kernel.org/r/20230215183850.3353198-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 1ad45f17179a..6b9001853890 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -98,7 +98,7 @@ all_compiled_sources()
{
echo include/generated/autoconf.h
find $ignore -name "*.cmd" -exec \
- grep -Poh '(?(?=^source_.* \K).*|(?=^ \K\S).*(?= \\))' {} \+ |
+ sed -n -E 's/^source_.* (.*)/\1/p; s/^ (\S.*) \\/\1/p' {} \+ |
awk '!a[$0]++'
} | xargs realpath -esq $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) |
sort -u
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
6ec363fc6142 ("scripts/tags.sh: fix incompatibility with PCRE2")
7394d2ebb651 ("scripts/tags.sh: Invoke 'realpath' via 'xargs'")
162343a876f1 ("scripts/tags.sh: exclude tools directory from tags generation")
4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 6ec363fc6142226b9ab5a6528f65333d729d2b6b Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas(a)google.com>
Date: Wed, 15 Feb 2023 18:38:50 +0000
Subject: [PATCH] scripts/tags.sh: fix incompatibility with PCRE2
Starting with release 10.38 PCRE2 drops default support for using \K in
lookaround patterns as described in [1]. Unfortunately, scripts/tags.sh
relies on such functionality to collect all_compiled_soures() leading to
the following error:
$ make COMPILED_SOURCE=1 tags
GEN tags
grep: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK)
The usage of \K for this pattern was introduced in commit 4f491bb6ea2a
("scripts/tags.sh: collect compiled source precisely") which speeds up
the generation of tags significantly.
In order to fix this issue without compromising the performance we can
switch over to an equivalent sed expression. The same matching pattern
is preserved here except \K is replaced with a backreference \1.
[1] https://www.pcre.org/current/doc/html/pcre2syntax.html#SEC11
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Jialu Xu <xujialu(a)vimux.org>
Cc: Vipin Sharma <vipinsh(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
Link: https://lore.kernel.org/r/20230215183850.3353198-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 1ad45f17179a..6b9001853890 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -98,7 +98,7 @@ all_compiled_sources()
{
echo include/generated/autoconf.h
find $ignore -name "*.cmd" -exec \
- grep -Poh '(?(?=^source_.* \K).*|(?=^ \K\S).*(?= \\))' {} \+ |
+ sed -n -E 's/^source_.* (.*)/\1/p; s/^ (\S.*) \\/\1/p' {} \+ |
awk '!a[$0]++'
} | xargs realpath -esq $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) |
sort -u
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
6ec363fc6142 ("scripts/tags.sh: fix incompatibility with PCRE2")
7394d2ebb651 ("scripts/tags.sh: Invoke 'realpath' via 'xargs'")
162343a876f1 ("scripts/tags.sh: exclude tools directory from tags generation")
4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 6ec363fc6142226b9ab5a6528f65333d729d2b6b Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas(a)google.com>
Date: Wed, 15 Feb 2023 18:38:50 +0000
Subject: [PATCH] scripts/tags.sh: fix incompatibility with PCRE2
Starting with release 10.38 PCRE2 drops default support for using \K in
lookaround patterns as described in [1]. Unfortunately, scripts/tags.sh
relies on such functionality to collect all_compiled_soures() leading to
the following error:
$ make COMPILED_SOURCE=1 tags
GEN tags
grep: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK)
The usage of \K for this pattern was introduced in commit 4f491bb6ea2a
("scripts/tags.sh: collect compiled source precisely") which speeds up
the generation of tags significantly.
In order to fix this issue without compromising the performance we can
switch over to an equivalent sed expression. The same matching pattern
is preserved here except \K is replaced with a backreference \1.
[1] https://www.pcre.org/current/doc/html/pcre2syntax.html#SEC11
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Jialu Xu <xujialu(a)vimux.org>
Cc: Vipin Sharma <vipinsh(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
Link: https://lore.kernel.org/r/20230215183850.3353198-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 1ad45f17179a..6b9001853890 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -98,7 +98,7 @@ all_compiled_sources()
{
echo include/generated/autoconf.h
find $ignore -name "*.cmd" -exec \
- grep -Poh '(?(?=^source_.* \K).*|(?=^ \K\S).*(?= \\))' {} \+ |
+ sed -n -E 's/^source_.* (.*)/\1/p; s/^ (\S.*) \\/\1/p' {} \+ |
awk '!a[$0]++'
} | xargs realpath -esq $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) |
sort -u
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
6ec363fc6142 ("scripts/tags.sh: fix incompatibility with PCRE2")
7394d2ebb651 ("scripts/tags.sh: Invoke 'realpath' via 'xargs'")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 6ec363fc6142226b9ab5a6528f65333d729d2b6b Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas(a)google.com>
Date: Wed, 15 Feb 2023 18:38:50 +0000
Subject: [PATCH] scripts/tags.sh: fix incompatibility with PCRE2
Starting with release 10.38 PCRE2 drops default support for using \K in
lookaround patterns as described in [1]. Unfortunately, scripts/tags.sh
relies on such functionality to collect all_compiled_soures() leading to
the following error:
$ make COMPILED_SOURCE=1 tags
GEN tags
grep: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK)
The usage of \K for this pattern was introduced in commit 4f491bb6ea2a
("scripts/tags.sh: collect compiled source precisely") which speeds up
the generation of tags significantly.
In order to fix this issue without compromising the performance we can
switch over to an equivalent sed expression. The same matching pattern
is preserved here except \K is replaced with a backreference \1.
[1] https://www.pcre.org/current/doc/html/pcre2syntax.html#SEC11
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Jialu Xu <xujialu(a)vimux.org>
Cc: Vipin Sharma <vipinsh(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely")
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
Link: https://lore.kernel.org/r/20230215183850.3353198-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 1ad45f17179a..6b9001853890 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -98,7 +98,7 @@ all_compiled_sources()
{
echo include/generated/autoconf.h
find $ignore -name "*.cmd" -exec \
- grep -Poh '(?(?=^source_.* \K).*|(?=^ \K\S).*(?= \\))' {} \+ |
+ sed -n -E 's/^source_.* (.*)/\1/p; s/^ (\S.*) \\/\1/p' {} \+ |
awk '!a[$0]++'
} | xargs realpath -esq $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) |
sort -u
Thadeu Lima de Souza Cascardo originally sent this patch but it failed to
merge because of a compilation error:
https://lore.kernel.org/bpf/20210830183211.339054-1-cascardo@canonical.com/…
v3:
Added upstream commit hash from 4.19.y and added detail to changelog.
v2:
Removed redefinition of tmp to fix compilation with CONFIG_BPF_JIT_ALWAYS_ON
enabled.
-Edward
==
The upstream changes necessary to fix these CVEs rely on the presence of JMP32,
which is not a small backport and brings its own potential set of necessary
follow-ups.
Daniel Borkmann, John Fastabend and Alexei Starovoitov came up with a fix
involving the use of the AX register.
This has been tested against the test_verifier in 4.14.y tree and some tests
specific to the two referred CVEs. The test_bpf module was also tested.
Daniel Borkmann (4):
bpf: Do not use ax register in interpreter on div/mod
bpf: fix subprog verifier bypass by div/mod by 0 exception
bpf: Fix 32 bit src register truncation on div/mod
bpf: Fix truncation handling for mod32 dst reg wrt zero
include/linux/filter.h | 24 ++++++++++++++++++++++++
kernel/bpf/core.c | 39 ++++++++++++++-------------------------
kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++--------
net/core/filter.c | 9 ++++++++-
4 files changed, 77 insertions(+), 34 deletions(-)
base-commit: a8ad60f2af5884921167e8cede5784c7849884b2
--
2.39.2.637.g21b0678d19-goog
Greg,
Following are backports of Christian's SGID fixes that were merged to
v6.2-rc1.
Note that Christain's PR [1] contains also two ovl patches (from me).
Those two are independent fixes that have already been AUTOSELected
to 6.1.y.
Christain's fixes also contain a user observable change of behavior
to fix inconsistencies of behavior between chmod/chown and write.
This change is best described in Christain's commit to fix the expected
behavior in xfstests [2].
It is hoped that no applications rely on this minor behavioral
difference, and if we are wrong, we may need to party revert the
change, but in any case, we prefer the behavior of LTS kernels to be
consitent with that of upstream.
I ran the relevant fstests test groups on xfs and on overlayfs over xfs.
I also have backports that I prepared for 5.15 and 5.10, but those
backports include also xfs SGID fixes, so those need to go through the
xfs stable review process.
Thanks,
Amir.
[1] https://lore.kernel.org/linux-fsdevel/20221212112053.99208-1-brauner@kernel…
[2] https://lore.kernel.org/linux-fsdevel/20230103-fstests-setgid-v6-2-v3-1-595…
Christian Brauner (5):
attr: add in_group_or_capable()
fs: move should_remove_suid()
attr: add setattr_should_drop_sgid()
attr: use consistent sgid stripping checks
fs: use consistent setgid checks in is_sxid()
Documentation/trace/ftrace.rst | 2 +-
fs/attr.c | 74 +++++++++++++++++++++++++++++++---
fs/fuse/file.c | 2 +-
fs/inode.c | 64 +++++++++++++----------------
fs/internal.h | 10 ++++-
fs/ocfs2/file.c | 4 +-
fs/open.c | 8 ++--
include/linux/fs.h | 4 +-
8 files changed, 115 insertions(+), 53 deletions(-)
--
2.34.1
[Public]
Hi,
Newer GPU microcode binaries for products with DCN 314 cause the display to fail to resume from s2idle.
The following fix went into 6.3 that makes it work with both newer and older GPU microcode binaries.
Please take this to 6.1.y.
e383b12709e32 ("drm/amd/display: Move DCN314 DOMAIN power control to DMCUB")
Thanks,