During page migration, the copy_highpage function is used to copy the
page data to the target page. If the source page is a userspace page
with MTE tags, the KASAN tag of the target page must have the match-all
tag in order to avoid tag check faults during subsequent accesses to the
page by the kernel. However, the target page may have been allocated in
a number of ways, some of which will use the KASAN allocator and will
therefore end up setting the KASAN tag to a non-match-all tag. Therefore,
update the target page's KASAN tag to match the source page.
We ended up unintentionally fixing this issue as a result of a bad
merge conflict resolution between commit e059853d14ca ("arm64: mte:
Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64:
kasan: Revert "arm64: mte: reset the page tag in page->flags""), which
preserved a tag reset for PG_mte_tagged pages which was considered to be
unnecessary at the time. Because SW tags KASAN uses separate tag storage,
update the code to only reset the tags when HW tags KASAN is enabled.
Signed-off-by: Peter Collingbourne <pcc(a)google.com>
Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd8570650583…
Reported-by: "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee(a)mediatek.com>
Cc: <stable(a)vger.kernel.org> # 6.1
---
For the stable branch, e059853d14ca needs to be cherry-picked and the following
merge conflict resolution is needed:
- page_kasan_tag_reset(to);
+ if (kasan_hw_tags_enabled())
+ page_kasan_tag_reset(to);
- /* It's a new page, shouldn't have been tagged yet */
- WARN_ON_ONCE(!try_page_mte_tagging(to));
arch/arm64/mm/copypage.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c
index 8dd5a8fe64b4..4aadcfb01754 100644
--- a/arch/arm64/mm/copypage.c
+++ b/arch/arm64/mm/copypage.c
@@ -22,7 +22,8 @@ void copy_highpage(struct page *to, struct page *from)
copy_page(kto, kfrom);
if (system_supports_mte() && page_mte_tagged(from)) {
- page_kasan_tag_reset(to);
+ if (kasan_hw_tags_enabled())
+ page_kasan_tag_reset(to);
/* It's a new page, shouldn't have been tagged yet */
WARN_ON_ONCE(!try_page_mte_tagging(to));
mte_copy_page_tags(kto, kfrom);
--
2.39.1.581.gbfd45094c4-goog
Use power state to decide whether we can enter or leave IPS accurately,
and then prevent to power on/off twice.
The commit 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS")
would like to prevent this as well, but it still can't entirely handle all
cases. The exception is that WiFi gets connected and does suspend/resume,
it will power on twice and cause it failed to power on after resuming,
like:
rtw_8723de 0000:03:00.0: failed to poll offset=0x6 mask=0x2 value=0x2
rtw_8723de 0000:03:00.0: mac power on failed
rtw_8723de 0000:03:00.0: failed to power on mac
rtw_8723de 0000:03:00.0: leave idle state failed
rtw_8723de 0000:03:00.0: failed to leave ips state
rtw_8723de 0000:03:00.0: failed to leave idle state
rtw_8723de 0000:03:00.0: failed to send h2c command
To fix this, introduce new flag RTW_FLAG_POWERON to reflect power state,
and call rtw_mac_pre_system_cfg() to configure registers properly between
power-off/-on.
Reported-by: Paul Gover <pmw.gover(a)yahoo.co.uk>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217016
Fixes: 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS")
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com>
---
Hi Kalle,
This patch is to fix 8723DE failed to power on after system resume. Please
queue this to 6.3
Thank you
Ping-Ke
---
drivers/net/wireless/realtek/rtw88/coex.c | 2 +-
drivers/net/wireless/realtek/rtw88/mac.c | 10 ++++++++++
drivers/net/wireless/realtek/rtw88/main.h | 2 +-
drivers/net/wireless/realtek/rtw88/ps.c | 4 ++--
drivers/net/wireless/realtek/rtw88/wow.c | 2 +-
5 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c
index 38697237ee5f0..86467d2f8888c 100644
--- a/drivers/net/wireless/realtek/rtw88/coex.c
+++ b/drivers/net/wireless/realtek/rtw88/coex.c
@@ -4056,7 +4056,7 @@ void rtw_coex_display_coex_info(struct rtw_dev *rtwdev, struct seq_file *m)
rtwdev->stats.tx_throughput, rtwdev->stats.rx_throughput);
seq_printf(m, "%-40s = %u/ %u/ %u\n",
"IPS/ Low Power/ PS mode",
- test_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags),
+ !test_bit(RTW_FLAG_POWERON, rtwdev->flags),
test_bit(RTW_FLAG_LEISURE_PS_DEEP, rtwdev->flags),
rtwdev->lps_conf.mode);
diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
index 4e5c194aac299..dae64901bac5a 100644
--- a/drivers/net/wireless/realtek/rtw88/mac.c
+++ b/drivers/net/wireless/realtek/rtw88/mac.c
@@ -273,6 +273,11 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
if (rtw_pwr_seq_parser(rtwdev, pwr_seq))
return -EINVAL;
+ if (pwr_on)
+ set_bit(RTW_FLAG_POWERON, rtwdev->flags);
+ else
+ clear_bit(RTW_FLAG_POWERON, rtwdev->flags);
+
return 0;
}
@@ -335,6 +340,11 @@ int rtw_mac_power_on(struct rtw_dev *rtwdev)
ret = rtw_mac_power_switch(rtwdev, true);
if (ret == -EALREADY) {
rtw_mac_power_switch(rtwdev, false);
+
+ ret = rtw_mac_pre_system_cfg(rtwdev);
+ if (ret)
+ goto err;
+
ret = rtw_mac_power_switch(rtwdev, true);
if (ret)
goto err;
diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
index 165f299e8e1f9..d4a53d5567451 100644
--- a/drivers/net/wireless/realtek/rtw88/main.h
+++ b/drivers/net/wireless/realtek/rtw88/main.h
@@ -356,7 +356,7 @@ enum rtw_flags {
RTW_FLAG_RUNNING,
RTW_FLAG_FW_RUNNING,
RTW_FLAG_SCANNING,
- RTW_FLAG_INACTIVE_PS,
+ RTW_FLAG_POWERON,
RTW_FLAG_LEISURE_PS,
RTW_FLAG_LEISURE_PS_DEEP,
RTW_FLAG_DIG_DISABLE,
diff --git a/drivers/net/wireless/realtek/rtw88/ps.c b/drivers/net/wireless/realtek/rtw88/ps.c
index 11594940d6b00..996365575f44f 100644
--- a/drivers/net/wireless/realtek/rtw88/ps.c
+++ b/drivers/net/wireless/realtek/rtw88/ps.c
@@ -25,7 +25,7 @@ static int rtw_ips_pwr_up(struct rtw_dev *rtwdev)
int rtw_enter_ips(struct rtw_dev *rtwdev)
{
- if (test_and_set_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags))
+ if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags))
return 0;
rtw_coex_ips_notify(rtwdev, COEX_IPS_ENTER);
@@ -50,7 +50,7 @@ int rtw_leave_ips(struct rtw_dev *rtwdev)
{
int ret;
- if (!test_and_clear_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags))
+ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
return 0;
rtw_hci_link_ps(rtwdev, false);
diff --git a/drivers/net/wireless/realtek/rtw88/wow.c b/drivers/net/wireless/realtek/rtw88/wow.c
index 89dc595094d5c..16ddee577efec 100644
--- a/drivers/net/wireless/realtek/rtw88/wow.c
+++ b/drivers/net/wireless/realtek/rtw88/wow.c
@@ -592,7 +592,7 @@ static int rtw_wow_leave_no_link_ps(struct rtw_dev *rtwdev)
if (rtw_get_lps_deep_mode(rtwdev) != LPS_DEEP_MODE_NONE)
rtw_leave_lps_deep(rtwdev);
} else {
- if (test_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags)) {
+ if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags)) {
rtw_wow->ips_enabled = true;
ret = rtw_leave_ips(rtwdev);
if (ret)
--
2.25.1
The quilt patch titled
Subject: mm/MADV_COLLAPSE: set EAGAIN on unexpected page refcount
has been removed from the -mm tree. Its filename was
mm-madv_collapse-set-eagain-on-unexpected-page-refcount.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Zach O'Keefe" <zokeefe(a)google.com>
Subject: mm/MADV_COLLAPSE: set EAGAIN on unexpected page refcount
Date: Tue, 24 Jan 2023 17:57:37 -0800
During collapse, in a few places we check to see if a given small page has
any unaccounted references. If the refcount on the page doesn't match our
expectations, it must be there is an unknown user concurrently interested
in the page, and so it's not safe to move the contents elsewhere.
However, the unaccounted pins are likely an ephemeral state.
In this situation, MADV_COLLAPSE returns -EINVAL when it should return
-EAGAIN. This could cause userspace to conclude that the syscall
failed, when it in fact could succeed by retrying.
Link: https://lkml.kernel.org/r/20230125015738.912924-1-zokeefe@google.com
Fixes: 7d8faaf15545 ("mm/madvise: introduce MADV_COLLAPSE sync hugepage collapse")
Signed-off-by: Zach O'Keefe <zokeefe(a)google.com>
Reported-by: Hugh Dickins <hughd(a)google.com>
Acked-by: Hugh Dickins <hughd(a)google.com>
Reviewed-by: Yang Shi <shy828301(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/khugepaged.c~mm-madv_collapse-set-eagain-on-unexpected-page-refcount
+++ a/mm/khugepaged.c
@@ -2611,6 +2611,7 @@ static int madvise_collapse_errno(enum s
case SCAN_CGROUP_CHARGE_FAIL:
return -EBUSY;
/* Resource temporary unavailable - trying again might succeed */
+ case SCAN_PAGE_COUNT:
case SCAN_PAGE_LOCK:
case SCAN_PAGE_LRU:
case SCAN_DEL_PAGE_LRU:
_
Patches currently in -mm which might be from zokeefe(a)google.com are
The quilt patch titled
Subject: mm/filemap: fix page end in filemap_get_read_batch
has been removed from the -mm tree. Its filename was
mm-filemap-fix-page-end-in-filemap_get_read_batch.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Qian Yingjin <qian(a)ddn.com>
Subject: mm/filemap: fix page end in filemap_get_read_batch
Date: Wed, 8 Feb 2023 10:24:00 +0800
I was running traces of the read code against an RAID storage system to
understand why read requests were being misaligned against the underlying
RAID strips. I found that the page end offset calculation in
filemap_get_read_batch() was off by one.
When a read is submitted with end offset 1048575, then it calculates the
end page for read of 256 when it should be 255. "last_index" is the index
of the page beyond the end of the read and it should be skipped when get a
batch of pages for read in @filemap_get_read_batch().
The below simple patch fixes the problem. This code was introduced in
kernel 5.12.
Link: https://lkml.kernel.org/r/20230208022400.28962-1-coolqyj@163.com
Fixes: cbd59c48ae2b ("mm/filemap: use head pages in generic_file_buffered_read")
Signed-off-by: Qian Yingjin <qian(a)ddn.com>
Reviewed-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/filemap.c~mm-filemap-fix-page-end-in-filemap_get_read_batch
+++ a/mm/filemap.c
@@ -2588,18 +2588,19 @@ static int filemap_get_pages(struct kioc
struct folio *folio;
int err = 0;
+ /* "last_index" is the index of the page beyond the end of the read */
last_index = DIV_ROUND_UP(iocb->ki_pos + iter->count, PAGE_SIZE);
retry:
if (fatal_signal_pending(current))
return -EINTR;
- filemap_get_read_batch(mapping, index, last_index, fbatch);
+ filemap_get_read_batch(mapping, index, last_index - 1, fbatch);
if (!folio_batch_count(fbatch)) {
if (iocb->ki_flags & IOCB_NOIO)
return -EAGAIN;
page_cache_sync_readahead(mapping, ra, filp, index,
last_index - index);
- filemap_get_read_batch(mapping, index, last_index, fbatch);
+ filemap_get_read_batch(mapping, index, last_index - 1, fbatch);
}
if (!folio_batch_count(fbatch)) {
if (iocb->ki_flags & (IOCB_NOWAIT | IOCB_WAITQ))
_
Patches currently in -mm which might be from qian(a)ddn.com are
From: Dave Ertman <david.m.ertman(a)intel.com>
RDMA is not supported in ice on a PF that has been added to a bonded
interface. To enforce this, when an interface enters a bond, we unplug
the auxiliary device that supports RDMA functionality. This unplug
currently happens in the context of handling the netdev bonding event.
This event is sent to the ice driver under RTNL context. This is causing
a deadlock where the RDMA driver is waiting for the RTNL lock to complete
the removal.
Defer the unplugging/re-plugging of the auxiliary device to the service
task so that it is not performed under the RTNL lock context.
Cc: stable(a)vger.kernel.org # 6.1.x
Reported-by: Jaroslav Pulchart <jaroslav.pulchart(a)gooddata.com>
Link: https://lore.kernel.org/netdev/CAK8fFZ6A_Gphw_3-QMGKEFQk=sfCw1Qmq0TVZK3rtAi…
Fixes: 5cb1ebdbc434 ("ice: Fix race condition during interface enslave")
Fixes: 4eace75e0853 ("RDMA/irdma: Report the correct link speed")
Signed-off-by: Dave Ertman <david.m.ertman(a)intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com>
---
v2:
(Removed from original pull request)
- Reversed order of bit processing in ice_service_task for PLUG/UNPLUG
v1: https://lore.kernel.org/netdev/20230131213703.1347761-2-anthony.l.nguyen@in…
drivers/net/ethernet/intel/ice/ice.h | 14 +++++---------
drivers/net/ethernet/intel/ice/ice_main.c | 19 ++++++++-----------
2 files changed, 13 insertions(+), 20 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index 713069f809ec..3cad5e6b2ad1 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -506,6 +506,7 @@ enum ice_pf_flags {
ICE_FLAG_VF_VLAN_PRUNING,
ICE_FLAG_LINK_LENIENT_MODE_ENA,
ICE_FLAG_PLUG_AUX_DEV,
+ ICE_FLAG_UNPLUG_AUX_DEV,
ICE_FLAG_MTU_CHANGED,
ICE_FLAG_GNSS, /* GNSS successfully initialized */
ICE_PF_FLAGS_NBITS /* must be last */
@@ -950,16 +951,11 @@ static inline void ice_set_rdma_cap(struct ice_pf *pf)
*/
static inline void ice_clear_rdma_cap(struct ice_pf *pf)
{
- /* We can directly unplug aux device here only if the flag bit
- * ICE_FLAG_PLUG_AUX_DEV is not set because ice_unplug_aux_dev()
- * could race with ice_plug_aux_dev() called from
- * ice_service_task(). In this case we only clear that bit now and
- * aux device will be unplugged later once ice_plug_aux_device()
- * called from ice_service_task() finishes (see ice_service_task()).
+ /* defer unplug to service task to avoid RTNL lock and
+ * clear PLUG bit so that pending plugs don't interfere
*/
- if (!test_and_clear_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags))
- ice_unplug_aux_dev(pf);
-
+ clear_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags);
+ set_bit(ICE_FLAG_UNPLUG_AUX_DEV, pf->flags);
clear_bit(ICE_FLAG_RDMA_ENA, pf->flags);
}
#endif /* _ICE_H_ */
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 8ec24f6cf6be..10d1c5b10d2a 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -2316,18 +2316,15 @@ static void ice_service_task(struct work_struct *work)
}
}
- if (test_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags)) {
- /* Plug aux device per request */
- ice_plug_aux_dev(pf);
+ /* unplug aux dev per request, if an unplug request came in
+ * while processing a plug request, this will handle it
+ */
+ if (test_and_clear_bit(ICE_FLAG_UNPLUG_AUX_DEV, pf->flags))
+ ice_unplug_aux_dev(pf);
- /* Mark plugging as done but check whether unplug was
- * requested during ice_plug_aux_dev() call
- * (e.g. from ice_clear_rdma_cap()) and if so then
- * plug aux device.
- */
- if (!test_and_clear_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags))
- ice_unplug_aux_dev(pf);
- }
+ /* Plug aux device per request */
+ if (test_and_clear_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags))
+ ice_plug_aux_dev(pf);
if (test_and_clear_bit(ICE_FLAG_MTU_CHANGED, pf->flags)) {
struct iidc_event *event;
--
2.38.1
On a heavily loaded machine there can be lock contention on the
global buffers lock. Add a percpu list to cache buffers on when
lock contention is encountered.
When allocating buffers attempt to use cached buffers first,
before taking the global buffers lock. When freeing buffers
try to put them back to the global list but if contention is
encountered, put the buffer on the percpu list.
The length of time a buffer is held on the percpu list is dynamically
adjusted based on lock contention. The amount of hold time is rapidly
increased and slow ramped down.
Fixes: df323337e507 ("apparmor: Use a memory pool instead per-CPU caches")
Link: https://lore.kernel.org/lkml/cfd5cc6f-5943-2e06-1dbe-f4b4ad5c1fa1@canonical…
Signed-off-by: John Johansen <john.johansen(a)canonical.com>
Reported-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Signed-off-by: Anil Altinay <aaltinay(a)google.com>
Cc: stable(a)vger.kernel.org
---
security/apparmor/lsm.c | 73 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 68 insertions(+), 5 deletions(-)
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index c6728a629437..56b22e2def4c 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -49,12 +49,19 @@ union aa_buffer {
char buffer[1];
};
+struct aa_local_cache {
+ unsigned int contention;
+ unsigned int hold;
+ struct list_head head;
+};
+
#define RESERVE_COUNT 2
static int reserve_count = RESERVE_COUNT;
static int buffer_count;
static LIST_HEAD(aa_global_buffers);
static DEFINE_SPINLOCK(aa_buffers_lock);
+static DEFINE_PER_CPU(struct aa_local_cache, aa_local_buffers);
/*
* LSM hook functions
@@ -1634,14 +1641,43 @@ static int param_set_mode(const char *val, const struct kernel_param *kp)
return 0;
}
+static void update_contention(struct aa_local_cache *cache)
+{
+ cache->contention += 3;
+ if (cache->contention > 9)
+ cache->contention = 9;
+ cache->hold += 1 << cache->contention; /* 8, 64, 512 */
+}
+
char *aa_get_buffer(bool in_atomic)
{
union aa_buffer *aa_buf;
+ struct aa_local_cache *cache;
bool try_again = true;
gfp_t flags = (GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_NOWARN);
+ /* use per cpu cached buffers first */
+ cache = get_cpu_ptr(&aa_local_buffers);
+ if (!list_empty(&cache->head)) {
+ aa_buf = list_first_entry(&cache->head, union aa_buffer, list);
+ list_del(&aa_buf->list);
+ cache->hold--;
+ put_cpu_ptr(&aa_local_buffers);
+ return &aa_buf->buffer[0];
+ }
+ put_cpu_ptr(&aa_local_buffers);
+ if (!spin_trylock(&aa_buffers_lock)) {
+ cache = get_cpu_ptr(&aa_local_buffers);
+ update_contention(cache);
+ put_cpu_ptr(&aa_local_buffers);
+ spin_lock(&aa_buffers_lock);
+ } else {
+ cache = get_cpu_ptr(&aa_local_buffers);
+ if (cache->contention)
+ cache->contention--;
+ put_cpu_ptr(&aa_local_buffers);
+ }
retry:
- spin_lock(&aa_buffers_lock);
if (buffer_count > reserve_count ||
(in_atomic && !list_empty(&aa_global_buffers))) {
aa_buf = list_first_entry(&aa_global_buffers, union aa_buffer,
@@ -1667,6 +1703,7 @@ char *aa_get_buffer(bool in_atomic)
if (!aa_buf) {
if (try_again) {
try_again = false;
+ spin_lock(&aa_buffers_lock);
goto retry;
}
pr_warn_once("AppArmor: Failed to allocate a memory buffer.\n");
@@ -1678,15 +1715,32 @@ char *aa_get_buffer(bool in_atomic)
void aa_put_buffer(char *buf)
{
union aa_buffer *aa_buf;
+ struct aa_local_cache *cache;
if (!buf)
return;
aa_buf = container_of(buf, union aa_buffer, buffer[0]);
- spin_lock(&aa_buffers_lock);
- list_add(&aa_buf->list, &aa_global_buffers);
- buffer_count++;
- spin_unlock(&aa_buffers_lock);
+ cache = get_cpu_ptr(&aa_local_buffers);
+ if (!cache->hold) {
+ put_cpu_ptr(&aa_local_buffers);
+ if (spin_trylock(&aa_buffers_lock)) {
+ list_add(&aa_buf->list, &aa_global_buffers);
+ buffer_count++;
+ spin_unlock(&aa_buffers_lock);
+ cache = get_cpu_ptr(&aa_local_buffers);
+ if (cache->contention)
+ cache->contention--;
+ put_cpu_ptr(&aa_local_buffers);
+ return;
+ }
+ cache = get_cpu_ptr(&aa_local_buffers);
+ update_contention(cache);
+ }
+
+ /* cache in percpu list */
+ list_add(&aa_buf->list, &cache->head);
+ put_cpu_ptr(&aa_local_buffers);
}
/*
@@ -1728,6 +1782,15 @@ static int __init alloc_buffers(void)
union aa_buffer *aa_buf;
int i, num;
+ /*
+ * per cpu set of cached allocated buffers used to help reduce
+ * lock contention
+ */
+ for_each_possible_cpu(i) {
+ per_cpu(aa_local_buffers, i).contention = 0;
+ per_cpu(aa_local_buffers, i).hold = 0;
+ INIT_LIST_HEAD(&per_cpu(aa_local_buffers, i).head);
+ }
/*
* A function may require two buffers at once. Usually the buffers are
* used for a short period of time and are shared. On UP kernel buffers
--
2.39.2.637.g21b0678d19-goog
The patch titled
Subject: nilfs2: fix underflow in second superblock position calculations
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
nilfs2-fix-underflow-in-second-superblock-position-calculations.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: fix underflow in second superblock position calculations
Date: Wed, 15 Feb 2023 07:40:43 +0900
Macro NILFS_SB2_OFFSET_BYTES, which computes the position of the second
superblock, underflows when the argument device size is less than 4096
bytes. Therefore, when using this macro, it is necessary to check in
advance that the device size is not less than a lower limit, or at least
that underflow does not occur.
The current nilfs2 implementation lacks this check, causing out-of-bound
block access when mounting devices smaller than 4096 bytes:
I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0
phys_seg 1 prio class 2
NILFS (loop0): unable to read secondary superblock (blocksize = 1024)
In addition, when trying to resize the filesystem to a size below 4096
bytes, this underflow occurs in nilfs_resize_fs(), passing a huge number
of segments to nilfs_sufile_resize(), corrupting parameters such as the
number of segments in superblocks. This causes excessive loop iterations
in nilfs_sufile_resize() during a subsequent resize ioctl, causing
semaphore ns_segctor_sem to block for a long time and hang the writer
thread:
INFO: task segctord:5067 blocked for more than 143 seconds.
Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:segctord state:D stack:23456 pid:5067 ppid:2
flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5293 [inline]
__schedule+0x1409/0x43f0 kernel/sched/core.c:6606
schedule+0xc3/0x190 kernel/sched/core.c:6682
rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190
nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]
nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570
kthread+0x270/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
...
Call Trace:
<TASK>
folio_mark_accessed+0x51c/0xf00 mm/swap.c:515
__nilfs_get_page_block fs/nilfs2/page.c:42 [inline]
nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61
nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121
nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176
nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251
nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]
nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]
nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777
nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422
nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]
nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301
...
This fixes these issues by inserting appropriate minimum device size
checks or anti-underflow checks, depending on where the macro is used.
Link: https://lkml.kernel.org/r/0000000000004e1dfa05f4a48e6b@google.com
Link: https://lkml.kernel.org/r/20230214224043.24141-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Reported-by: <syzbot+f0c4082ce5ebebdac63b(a)syzkaller.appspotmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/fs/nilfs2/ioctl.c~nilfs2-fix-underflow-in-second-superblock-position-calculations
+++ a/fs/nilfs2/ioctl.c
@@ -1114,7 +1114,14 @@ static int nilfs_ioctl_set_alloc_range(s
minseg = range[0] + segbytes - 1;
do_div(minseg, segbytes);
+
+ if (range[1] < 4096)
+ goto out;
+
maxseg = NILFS_SB2_OFFSET_BYTES(range[1]);
+ if (maxseg < segbytes)
+ goto out;
+
do_div(maxseg, segbytes);
maxseg--;
--- a/fs/nilfs2/super.c~nilfs2-fix-underflow-in-second-superblock-position-calculations
+++ a/fs/nilfs2/super.c
@@ -409,6 +409,15 @@ int nilfs_resize_fs(struct super_block *
goto out;
/*
+ * Prevent underflow in second superblock position calculation.
+ * The exact minimum size check is done in nilfs_sufile_resize().
+ */
+ if (newsize < 4096) {
+ ret = -ENOSPC;
+ goto out;
+ }
+
+ /*
* Write lock is required to protect some functions depending
* on the number of segments, the number of reserved segments,
* and so forth.
--- a/fs/nilfs2/the_nilfs.c~nilfs2-fix-underflow-in-second-superblock-position-calculations
+++ a/fs/nilfs2/the_nilfs.c
@@ -544,9 +544,15 @@ static int nilfs_load_super_block(struct
{
struct nilfs_super_block **sbp = nilfs->ns_sbp;
struct buffer_head **sbh = nilfs->ns_sbh;
- u64 sb2off = NILFS_SB2_OFFSET_BYTES(bdev_nr_bytes(nilfs->ns_bdev));
+ u64 sb2off, devsize = bdev_nr_bytes(nilfs->ns_bdev);
int valid[2], swp = 0;
+ if (devsize < NILFS_SEG_MIN_BLOCKS * NILFS_MIN_BLOCK_SIZE + 4096) {
+ nilfs_err(sb, "device size too small");
+ return -EINVAL;
+ }
+ sb2off = NILFS_SB2_OFFSET_BYTES(devsize);
+
sbp[0] = nilfs_read_super_block(sb, NILFS_SB_OFFSET_BYTES, blocksize,
&sbh[0]);
sbp[1] = nilfs_read_super_block(sb, sb2off, blocksize, &sbh[1]);
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
nilfs2-fix-underflow-in-second-superblock-position-calculations.patch
The patch titled
Subject: hugetlb: check for undefined shift on 32 bit architectures
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
hugetlb-check-for-undefined-shift-on-32-bit-architectures.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Subject: hugetlb: check for undefined shift on 32 bit architectures
Date: Wed, 15 Feb 2023 17:35:42 -0800
Users can specify the hugetlb page size in the mmap, shmget and
memfd_create system calls. This is done by using 6 bits within the flags
argument to encode the base-2 logarithm of the desired page size. The
routine hstate_sizelog() uses the log2 value to find the corresponding
hugetlb hstate structure. Converting the log2 value (page_size_log) to
potential hugetlb page size is the simple statement:
1UL << page_size_log
Because only 6 bits are used for page_size_log, the left shift can not be
greater than 63. This is fine on 64 bit architectures where a long is 64
bits. However, if a value greater than 31 is passed on a 32 bit
architecture (where long is 32 bits) the shift will result in undefined
behavior. This was generally not an issue as the result of the undefined
shift had to exactly match hugetlb page size to proceed.
Recent improvements in runtime checking have resulted in this undefined
behavior throwing errors such as reported below.
Fix by comparing page_size_log to BITS_PER_LONG before doing shift.
Link: https://lkml.kernel.org/r/20230216013542.138708-1-mike.kravetz@oracle.com
Link: https://lore.kernel.org/lkml/CA+G9fYuei_Tr-vN9GS7SfFyU1y9hNysnf=PB7kT0=yv4M…
Fixes: 42d7395feb56 ("mm: support more pagesizes for MAP_HUGETLB/SHM_HUGETLB")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Reviewed-by: Jesper Juhl <jesperjuhl76(a)gmail.com>
Acked-by: Muchun Song <songmuchun(a)bytedance.com>
Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
Tested-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Cc: Anders Roxell <anders.roxell(a)linaro.org>
Cc: Andi Kleen <ak(a)linux.intel.com>
Cc: Sasha Levin <sashal(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/include/linux/hugetlb.h~hugetlb-check-for-undefined-shift-on-32-bit-architectures
+++ a/include/linux/hugetlb.h
@@ -743,7 +743,10 @@ static inline struct hstate *hstate_size
if (!page_size_log)
return &default_hstate;
- return size_to_hstate(1UL << page_size_log);
+ if (page_size_log < BITS_PER_LONG)
+ return size_to_hstate(1UL << page_size_log);
+
+ return NULL;
}
static inline struct hstate *hstate_vma(struct vm_area_struct *vma)
_
Patches currently in -mm which might be from mike.kravetz(a)oracle.com are
hugetlb-check-for-undefined-shift-on-32-bit-architectures.patch
The patch titled
Subject: mm/migrate: fix wrongly apply write bit after mkdirty on sparc64
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-migrate-fix-wrongly-apply-write-bit-after-mkdirty-on-sparc64.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Peter Xu <peterx(a)redhat.com>
Subject: mm/migrate: fix wrongly apply write bit after mkdirty on sparc64
Date: Thu, 16 Feb 2023 10:30:59 -0500
Nick Bowler reported another sparc64 breakage after the young/dirty
persistent work for page migration (per "Link:" below). That's after a
similar report [2].
It turns out page migration was overlooked, and it wasn't failing before
because page migration was not enabled in the initial report test
environment.
David proposed another way [2] to fix this from sparc64 side, but that
patch didn't land somehow. Neither did I check whether there's any other
arch that has similar issues.
Let's fix it for now as simple as moving the write bit handling to be
after dirty, like what we did before.
Note: this is based on mm-unstable, because the breakage was since 6.1 and
we're at a very late stage of 6.2 (-rc8), so I assume for this specific
case we should target this at 6.3.
[1] https://lore.kernel.org/all/20221021160603.GA23307@u164.east.ru/
[2] https://lore.kernel.org/all/20221212130213.136267-1-david@redhat.com/
Link: https://lkml.kernel.org/r/20230216153059.256739-1-peterx@redhat.com
Fixes: 2e3468778dbe ("mm: remember young/dirty bit for page migrations")
Link: https://lore.kernel.org/all/CADyTPExpEqaJiMGoV+Z6xVgL50ZoMJg49B10LcZ=8eg19u…
Signed-off-by: Peter Xu <peterx(a)redhat.com>
Reported-by: Nick Bowler <nbowler(a)draconx.ca>
Acked-by: David Hildenbrand <david(a)redhat.com>
Tested-by: Nick Bowler <nbowler(a)draconx.ca>
Cc: <regressions(a)lists.linux.dev>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/huge_memory.c~mm-migrate-fix-wrongly-apply-write-bit-after-mkdirty-on-sparc64
+++ a/mm/huge_memory.c
@@ -3272,8 +3272,6 @@ void remove_migration_pmd(struct page_vm
pmde = mk_huge_pmd(new, READ_ONCE(vma->vm_page_prot));
if (pmd_swp_soft_dirty(*pvmw->pmd))
pmde = pmd_mksoft_dirty(pmde);
- if (is_writable_migration_entry(entry))
- pmde = maybe_pmd_mkwrite(pmde, vma);
if (pmd_swp_uffd_wp(*pvmw->pmd))
pmde = pmd_wrprotect(pmd_mkuffd_wp(pmde));
if (!is_migration_entry_young(entry))
@@ -3281,6 +3279,10 @@ void remove_migration_pmd(struct page_vm
/* NOTE: this may contain setting soft-dirty on some archs */
if (PageDirty(new) && is_migration_entry_dirty(entry))
pmde = pmd_mkdirty(pmde);
+ if (is_writable_migration_entry(entry))
+ pmde = maybe_pmd_mkwrite(pmde, vma);
+ else
+ pmde = pmd_wrprotect(pmde);
if (PageAnon(new)) {
rmap_t rmap_flags = RMAP_COMPOUND;
--- a/mm/migrate.c~mm-migrate-fix-wrongly-apply-write-bit-after-mkdirty-on-sparc64
+++ a/mm/migrate.c
@@ -224,6 +224,8 @@ static bool remove_migration_pte(struct
pte = maybe_mkwrite(pte, vma);
else if (pte_swp_uffd_wp(*pvmw.pte))
pte = pte_mkuffd_wp(pte);
+ else
+ pte = pte_wrprotect(pte);
if (folio_test_anon(folio) && !is_readable_migration_entry(entry))
rmap_flags |= RMAP_EXCLUSIVE;
_
Patches currently in -mm which might be from peterx(a)redhat.com are
mm-migrate-fix-wrongly-apply-write-bit-after-mkdirty-on-sparc64.patch
mm-uffd-fix-comment-in-handling-pte-markers.patch
This patch introduce a new internal flag per lkb value to handle
internal flags which are handled not on wire. The current lkb internal
flags stored as lkb->lkb_flags are split in upper and lower bits, the
lower bits are used to share internal flags over wire for other cluster
wide lkb copies on other nodes.
In commit 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks")
we introduced a new internal flag for pending callbacks for the dlm
callback queue. This flag is protected by the lkb->lkb_cb_lock lock.
This patch overlooked that on dlm receive path and the mentioned upper
and lower bits, that dlm will read the flags, mask it and write it
back. As example receive_flags() in fs/dlm/lock.c. This flag
manipulation is not done atomically and is not protected by
lkb->lkb_cb_lock. This has unknown side effects of the current callback
handling.
In future we should move to set/clear/test bit functionality and avoid
read, mask and writing back flag values. In later patches we will move
the upper parts to the new introduced internal lkb flags which are not
shared between other cluster nodes to the new non shared internal flag
field to avoid similar issues.
Cc: stable(a)vger.kernel.org
Fixes: 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks")
Reported-by: Bob Peterson <rpeterso(a)redhat.com>
Signed-off-by: Alexander Aring <aahringo(a)redhat.com>
---
fs/dlm/ast.c | 9 ++++-----
fs/dlm/dlm_internal.h | 7 ++++++-
fs/dlm/user.c | 2 +-
3 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c
index 26fef9945cc9..7daffdd99f99 100644
--- a/fs/dlm/ast.c
+++ b/fs/dlm/ast.c
@@ -45,7 +45,7 @@ void dlm_purge_lkb_callbacks(struct dlm_lkb *lkb)
kref_put(&cb->ref, dlm_release_callback);
}
- lkb->lkb_flags &= ~DLM_IFL_CB_PENDING;
+ clear_bit(DLM_IFLNS_CB_PENDING, &lkb->lkb_insflags);
/* invalidate */
dlm_callback_set_last_ptr(&lkb->lkb_last_cast, NULL);
@@ -103,10 +103,9 @@ int dlm_enqueue_lkb_callback(struct dlm_lkb *lkb, uint32_t flags, int mode,
cb->sb_status = status;
cb->sb_flags = (sbflags & 0x000000FF);
kref_init(&cb->ref);
- if (!(lkb->lkb_flags & DLM_IFL_CB_PENDING)) {
- lkb->lkb_flags |= DLM_IFL_CB_PENDING;
+ if (!test_and_set_bit(DLM_IFLNS_CB_PENDING, &lkb->lkb_insflags))
rv = DLM_ENQUEUE_CALLBACK_NEED_SCHED;
- }
+
list_add_tail(&cb->list, &lkb->lkb_callbacks);
if (flags & DLM_CB_CAST)
@@ -209,7 +208,7 @@ void dlm_callback_work(struct work_struct *work)
spin_lock(&lkb->lkb_cb_lock);
rv = dlm_dequeue_lkb_callback(lkb, &cb);
if (rv == DLM_DEQUEUE_CALLBACK_EMPTY) {
- lkb->lkb_flags &= ~DLM_IFL_CB_PENDING;
+ clear_bit(DLM_IFLNS_CB_PENDING, &lkb->lkb_insflags);
spin_unlock(&lkb->lkb_cb_lock);
break;
}
diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h
index ab1a55337a6e..b967b4d7d55d 100644
--- a/fs/dlm/dlm_internal.h
+++ b/fs/dlm/dlm_internal.h
@@ -211,7 +211,11 @@ struct dlm_args {
#endif
#define DLM_IFL_DEADLOCK_CANCEL 0x01000000
#define DLM_IFL_STUB_MS 0x02000000 /* magic number for m_flags */
-#define DLM_IFL_CB_PENDING 0x04000000
+
+/* lkb_insflags */
+
+#define DLM_IFLNS_CB_PENDING 0
+
/* least significant 2 bytes are message changed, they are full transmitted
* but at receive side only the 2 bytes LSB will be set.
*
@@ -246,6 +250,7 @@ struct dlm_lkb {
uint32_t lkb_exflags; /* external flags from caller */
uint32_t lkb_sbflags; /* lksb flags */
uint32_t lkb_flags; /* internal flags */
+ unsigned long lkb_insflags; /* internal non shared flags */
uint32_t lkb_lvbseq; /* lvb sequence number */
int8_t lkb_status; /* granted, waiting, convert */
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 35129505ddda..98488a1b702d 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -884,7 +884,7 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count,
goto try_another;
case DLM_DEQUEUE_CALLBACK_LAST:
list_del_init(&lkb->lkb_cb_list);
- lkb->lkb_flags &= ~DLM_IFL_CB_PENDING;
+ clear_bit(DLM_IFLNS_CB_PENDING, &lkb->lkb_insflags);
break;
case DLM_DEQUEUE_CALLBACK_SUCCESS:
break;
--
2.31.1
radix_tree_preload() warns on attempting to call it with an allocation
mask that doesn't allow blocking. While that warning could arguably
be removed, we need to handle radix insertion failures anyway as they
are more likely if we cannot block to get memory.
Remove legacy BUG_ON()'s and turn them into proper errors instead, one
for the allocation failure and one for finding a page that doesn't
match the correct index.
Cc: stable(a)vger.kernel.org # 5.10+
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
---
drivers/block/brd.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 1ddada0cdaca..6019ef23344f 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -84,6 +84,7 @@ static int brd_insert_page(struct brd_device *brd, sector_t sector, gfp_t gfp)
{
pgoff_t idx;
struct page *page;
+ int ret = 0;
page = brd_lookup_page(brd, sector);
if (page)
@@ -93,7 +94,7 @@ static int brd_insert_page(struct brd_device *brd, sector_t sector, gfp_t gfp)
if (!page)
return -ENOMEM;
- if (radix_tree_preload(gfp)) {
+ if (gfpflags_allow_blocking(gfp) && radix_tree_preload(gfp)) {
__free_page(page);
return -ENOMEM;
}
@@ -104,8 +105,10 @@ static int brd_insert_page(struct brd_device *brd, sector_t sector, gfp_t gfp)
if (radix_tree_insert(&brd->brd_pages, idx, page)) {
__free_page(page);
page = radix_tree_lookup(&brd->brd_pages, idx);
- BUG_ON(!page);
- BUG_ON(page->index != idx);
+ if (!page)
+ ret = -ENOMEM;
+ else if (page->index != idx)
+ ret = -EIO;
} else {
brd->brd_nr_pages++;
}
--
2.39.1
From: Mario Limonciello <mario.limonciello(a)amd.com>
BugLink: https://bugs.launchpad.net/bugs/2007581
Commit 5467801f1fcb ("gpio: Restrict usage of GPIO chip irq members
before initialization") attempted to fix a race condition that lead to a
NULL pointer, but in the process caused a regression for _AEI/_EVT
declared GPIOs.
This manifests in messages showing deferred probing while trying to
allocate IRQs like so:
amd_gpio AMDI0030:00: Failed to translate GPIO pin 0x0000 to IRQ, err -517
amd_gpio AMDI0030:00: Failed to translate GPIO pin 0x002C to IRQ, err -517
amd_gpio AMDI0030:00: Failed to translate GPIO pin 0x003D to IRQ, err -517
[ .. more of the same .. ]
The code for walking _AEI doesn't handle deferred probing and so this
leads to non-functional GPIO interrupts.
Fix this issue by moving the call to `acpi_gpiochip_request_interrupts`
to occur after gc->irc.initialized is set.
Fixes: 5467801f1fcb ("gpio: Restrict usage of GPIO chip irq members before initialization")
Link: https://lore.kernel.org/linux-gpio/BL1PR12MB51577A77F000A008AA694675E2EF9@B…
Link: https://bugzilla.suse.com/show_bug.cgi?id=1198697
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215850
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1979
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1976
Reported-by: Mario Limonciello <mario.limonciello(a)amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Shreeya Patel <shreeya.patel(a)collabora.com>
Tested-By: Samuel Čavoj <samuel(a)cavoj.net>
Tested-By: lukeluk498(a)gmail.com Link:
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Acked-by: Linus Walleij <linus.walleij(a)linaro.org>
Reviewed-and-tested-by: Takashi Iwai <tiwai(a)suse.de>
Cc: Shreeya Patel <shreeya.patel(a)collabora.com>
Cc: stable(a)vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
(backported from commit 06fb4ecfeac7e00d6704fa5ed19299f2fefb3cc9)
Signed-off-by: Asmaa Mnebhi <asmaa(a)nvidia.com>
---
drivers/gpio/gpiolib.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index e4d47e00c392..049cdfc975b3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2329,8 +2329,6 @@ static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
gpiochip_set_irq_hooks(gpiochip);
- acpi_gpiochip_request_interrupts(gpiochip);
-
/*
* Using barrier() here to prevent compiler from reordering
* gc->irq.initialized before initialization of above
@@ -2340,6 +2338,8 @@ static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
gpiochip->irq.initialized = true;
+ acpi_gpiochip_request_interrupts(gpiochip);
+
return 0;
}
--
2.30.1
From: Shreeya Patel <shreeya.patel(a)collabora.com>
BugLink: https://bugs.launchpad.net/bugs/2007581
GPIO chip irq members are exposed before they could be completely
initialized and this leads to race conditions.
One such issue was observed for the gc->irq.domain variable which
was accessed through the I2C interface in gpiochip_to_irq() before
it could be initialized by gpiochip_add_irqchip(). This resulted in
Kernel NULL pointer dereference.
Following are the logs for reference :-
kernel: Call Trace:
kernel: gpiod_to_irq+0x53/0x70
kernel: acpi_dev_gpio_irq_get_by+0x113/0x1f0
kernel: i2c_acpi_get_irq+0xc0/0xd0
kernel: i2c_device_probe+0x28a/0x2a0
kernel: really_probe+0xf2/0x460
kernel: RIP: 0010:gpiochip_to_irq+0x47/0xc0
To avoid such scenarios, restrict usage of GPIO chip irq members before
they are completely initialized.
Signed-off-by: Shreeya Patel <shreeya.patel(a)collabora.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com>
Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org>
Signed-off-by: Bartosz Golaszewski <brgl(a)bgdev.pl>
(backported from commit 5467801f1fcbdc46bc7298a84dbf3ca1ff2a7320)
Signed-off-by: Asmaa Mnebhi <asmaa(a)nvidia.com>
---
drivers/gpio/gpiolib.c | 19 +++++++++++++++++++
include/linux/gpio/driver.h | 9 +++++++++
2 files changed, 28 insertions(+)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index abdf448b11a3..e4d47e00c392 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2146,6 +2146,16 @@ static int gpiochip_to_irq(struct gpio_chip *chip, unsigned offset)
{
struct irq_domain *domain = chip->irq.domain;
+#ifdef CONFIG_GPIOLIB_IRQCHIP
+ /*
+ * Avoid race condition with other code, which tries to lookup
+ * an IRQ before the irqchip has been properly registered,
+ * i.e. while gpiochip is still being brought up.
+ */
+ if (!chip->irq.initialized)
+ return -EPROBE_DEFER;
+#endif
+
if (!gpiochip_irqchip_irq_valid(chip, offset))
return -ENXIO;
@@ -2321,6 +2331,15 @@ static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
acpi_gpiochip_request_interrupts(gpiochip);
+ /*
+ * Using barrier() here to prevent compiler from reordering
+ * gc->irq.initialized before initialization of above
+ * GPIO chip irq members.
+ */
+ barrier();
+
+ gpiochip->irq.initialized = true;
+
return 0;
}
diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index 5dd9c982e2cb..15418caf76fc 100644
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -201,6 +201,15 @@ struct gpio_irq_chip {
*/
bool threaded;
+ /**
+ * @initialized:
+ *
+ * Flag to track GPIO chip irq member's initialization.
+ * This flag will make sure GPIO chip irq members are not used
+ * before they are initialized.
+ */
+ bool initialized;
+
/**
* @init_hw: optional routine to initialize hardware before
* an IRQ chip will be added. This is quite useful when
--
2.30.1
Users can specify the hugetlb page size in the mmap, shmget and
memfd_create system calls. This is done by using 6 bits within the
flags argument to encode the base-2 logarithm of the desired page size.
The routine hstate_sizelog() uses the log2 value to find the
corresponding hugetlb hstate structure. Converting the log2 value
(page_size_log) to potential hugetlb page size is the simple statement:
1UL << page_size_log
Because only 6 bits are used for page_size_log, the left shift can not
be greater than 63. This is fine on 64 bit architectures where a long
is 64 bits. However, if a value greater than 31 is passed on a 32 bit
architecture (where long is 32 bits) the shift will result in undefined
behavior. This was generally not an issue as the result of the
undefined shift had to exactly match hugetlb page size to proceed.
Recent improvements in runtime checking have resulted in this undefined
behavior throwing errors such as reported below.
Fix by comparing page_size_log to BITS_PER_LONG before doing shift.
Reported-by: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Link: https://lore.kernel.org/lkml/CA+G9fYuei_Tr-vN9GS7SfFyU1y9hNysnf=PB7kT0=yv4M…
Fixes: 42d7395feb56 ("mm: support more pagesizes for MAP_HUGETLB/SHM_HUGETLB")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
---
include/linux/hugetlb.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index df6dd624ccfe..8b45720f9475 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -781,7 +781,10 @@ static inline struct hstate *hstate_sizelog(int page_size_log)
if (!page_size_log)
return &default_hstate;
- return size_to_hstate(1UL << page_size_log);
+ if (page_size_log < BITS_PER_LONG)
+ return size_to_hstate(1UL << page_size_log);
+
+ return NULL;
}
static inline struct hstate *hstate_vma(struct vm_area_struct *vma)
--
2.39.1
By default, non-mq drivers do not support nowait. This causes io_uring
to use a slower path as the driver cannot be trust not to block. brd
can safely set the nowait flag, as worst case all it does is a NOIO
allocation.
For io_uring, this makes a substantial difference. Before:
submitter=0, tid=453, file=/dev/ram0, node=-1
polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128
Engine=io_uring, sq_ring=128, cq_ring=128
IOPS=440.03K, BW=1718MiB/s, IOS/call=32/31
IOPS=428.96K, BW=1675MiB/s, IOS/call=32/32
IOPS=442.59K, BW=1728MiB/s, IOS/call=32/31
IOPS=419.65K, BW=1639MiB/s, IOS/call=32/32
IOPS=426.82K, BW=1667MiB/s, IOS/call=32/31
and after:
submitter=0, tid=354, file=/dev/ram0, node=-1
polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128
Engine=io_uring, sq_ring=128, cq_ring=128
IOPS=3.37M, BW=13.15GiB/s, IOS/call=32/31
IOPS=3.45M, BW=13.46GiB/s, IOS/call=32/31
IOPS=3.43M, BW=13.42GiB/s, IOS/call=32/32
IOPS=3.43M, BW=13.39GiB/s, IOS/call=32/31
IOPS=3.43M, BW=13.38GiB/s, IOS/call=32/31
or about an 8x in difference. Now that brd is prepared to deal with
REQ_NOWAIT reads/writes, mark it as supporting that.
Cc: stable(a)vger.kernel.org # 5.10+
Link: https://lore.kernel.org/linux-block/20230203103005.31290-1-p.raghav@samsung…
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
---
drivers/block/brd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 6019ef23344f..522530a6ebca 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -418,6 +418,7 @@ static int brd_alloc(int i)
/* Tell the block layer that this is not a rotational device */
blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue);
blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue);
+ blk_queue_flag_set(QUEUE_FLAG_NOWAIT, disk->queue);
err = add_disk(disk);
if (err)
goto out_cleanup_disk;
--
2.39.1
by Linux kernel regression tracking (Thorsten Leemhuis)
[adding Chih-Kang Chang (author), Kalle (committer) and LKML to the list
of recipients]
[anyone who replies to this: feel free to remove stable(a)vger.kernel.org
from the recipients, this is a mainline regression]
[TLDR: I'm adding this report to the list of tracked Linux kernel
regressions; the text you find below is based on a few templates
paragraphs you might have encountered already in similar form.
See link in footer if these mails annoy you.]
On 09.02.23 20:59, Paul Gover wrote:
> Suspend/Resume was working OK on kernel 6.0.13, broken since 6.1.1
> (I've not tried kernels between those, except in the bisect below.)
> All subsequent 6,1 kernels exhibit the same behaviour.
>
> Suspend works OK, but on Resume, there's a flicker, and then it reboots.
> Sometimes the screen gets restored to its contents at the time of suspend. but
> less than a second later, it starts rebooting.
> To reproduce, simply boot, suspend, and resume.
>
> Git bisect blames RTW88
> commit 6bf3a083407b5d404d70efc3a5ac75b472e5efa9
TWIMC, that's "wifi: rtw88: add flag check before enter or leave IPS"
> I'll attach bisect log, dmesg and configs to the bug I've opened
> https://bugzilla.kernel.org/show_bug.cgi?id=217016
>
> dmesg from the following boot show a hardware error.
> It's not there when the system resumes or reboots with 6.0.13,
> and if I don't suspend & resume, there are no reported errors.
>
> The problem occurs under both Wayland and X11, and from the command line via
> echo mem>/sys/power.state
>
>
> Vanilla kernels, untainted, compiled with GCC; my system is Gentoo FWIW, but I
> do my own kernels direct from a git clone of stable.
>
> Couldn't find anything similar with Google or the mailing lists.
>
> **Hardware:**
>
> HP Laptop 15-bw0xx
> AMD A9-9420 RADEON R5, 5 COMPUTE CORES
> Stoney [Radeon R2/R3/R4/R5 Graphics]
> 4 GB memory
> RTL8723DE PCIe adapter
>
> **Kernel**
>
> Kernel command line:
> psmouse.synaptics_intertouch=1 pcie_aspm=force rdrand=force rootfstype=f2fs
> root=LABEL=gentoo
>
> CONFIG_RTW88=m
> CONFIG_RTW88_CORE=m
> CONFIG_RTW88_PCI=m
> CONFIG_RTW88_8723D=m
> # CONFIG_RTW88_8822BE is not set
> # CONFIG_RTW88_8822CE is not set
> CONFIG_RTW88_8723DE=m
> # CONFIG_RTW88_8821CE is not set
> # CONFIG_RTW88_DEBUG is not set
> # CONFIG_RTW88_DEBUGFS is not set
> # CONFIG_RTW89 is not set
Thanks for the report. To be sure the issue doesn't fall through the
cracks unnoticed, I'm adding it to regzbot, the Linux kernel regression
tracking bot:
#regzbot ^introduced 6bf3a083407b
#regzbot title wifi: rtw88: resume broken (reboot)
#regzbot ignore-activity
This isn't a regression? This issue or a fix for it are already
discussed somewhere else? It was fixed already? You want to clarify when
the regression started to happen? Or point out I got the title or
something else totally wrong? Then just reply and tell me -- ideally
while also telling regzbot about it, as explained by the page listed in
the footer of this mail.
Developers: When fixing the issue, remember to add 'Link:' tags pointing
to the report (the parent of this mail). See page linked in footer for
details.
Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
--
Everything you wanna know about Linux kernel regression tracking:
https://linux-regtracking.leemhuis.info/about/#tldr
If I did something stupid, please tell me, as explained on that page.
Fixed optkprobe issues, mainly related to the x86 architecture.
Yang Jihong (2):
x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
x86/kprobes: Fix arch_check_optimized_kprobe check within
optimized_kprobe range
arch/x86/kernel/kprobes/opt.c | 6 +++---
include/linux/kprobes.h | 2 ++
kernel/kprobes.c | 4 ++--
3 files changed, 7 insertions(+), 5 deletions(-)
--
Changes since v1:
- Remove patch1 since there is already a fix patch.
- Add "cc stable" and modify comment for patch2.
- Use "kprobe_disarmed" instead of "kprobe_disabled" for patch3.
- Add fix commmit and "cc stable" for patch3.
2.30.GIT
--
Az SFG Finance struktúra pénzügyi segítséget nyújt a világ bármely pontján
lakóhellyel rendelkező természetes vagy jogi személynek.
Segítségre van szüksége a napi finanszírozási problémák megoldásához?
Mennyire van szükséged ?
Most vagy soha.
Lépjen kapcsolatba finanszírozási csoportunkkal a Facebook Messengeren:
https://www.facebook.com/sfg.finances
VAGY E-mailben: sg.finance(a)gmail.com
From: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com>
Direction from hardware is that ring buffers should never be mapped
via the BAR on systems with LLC. There are too many caching pitfalls
due to the way BAR accesses are routed. So it is safest to just not
use it.
Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com>
Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere")
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com>
Cc: intel-gfx(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v4.9+
---
drivers/gpu/drm/i915/gt/intel_ring.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c
index fb1d2595392ed..8675ec8ead353 100644
--- a/drivers/gpu/drm/i915/gt/intel_ring.c
+++ b/drivers/gpu/drm/i915/gt/intel_ring.c
@@ -53,7 +53,7 @@ int intel_ring_pin(struct intel_ring *ring, struct i915_gem_ww_ctx *ww)
if (unlikely(ret))
goto err_unpin;
- if (i915_vma_is_map_and_fenceable(vma)) {
+ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) {
addr = (void __force *)i915_vma_pin_iomap(vma);
} else {
int type = i915_coherent_map_type(vma->vm->i915, vma->obj, false);
@@ -98,7 +98,7 @@ void intel_ring_unpin(struct intel_ring *ring)
return;
i915_vma_unset_ggtt_write(vma);
- if (i915_vma_is_map_and_fenceable(vma))
+ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) {
i915_vma_unpin_iomap(vma);
else
i915_gem_object_unpin_map(vma->obj);
--
2.39.1
When f2fs skipped a gc round during victim migration, there was a bug which
would skip all upcoming gc rounds unconditionally because skipped_gc_rwsem
was not initialized. It fixes the bug by correctly initializing the
skipped_gc_rwsem inside the gc loop.
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Signed-off-by: Yonggil Song <yonggil.song(a)samsung.com>
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index b22f49a6f128..81d326abaac1 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1786,8 +1786,8 @@ int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control)
prefree_segments(sbi));
cpc.reason = __get_cp_reason(sbi);
- sbi->skipped_gc_rwsem = 0;
gc_more:
+ sbi->skipped_gc_rwsem = 0;
if (unlikely(!(sbi->sb->s_flags & SB_ACTIVE))) {
ret = -EINVAL;
goto stop;
--
2.34.1
Cześć,
Otrzymałeś moją poprzednią wiadomość? Skontaktowałem się z tobą
wcześniej, ale wiadomość nie wróciła, więc postanowiłem napisać
ponownie. Potwierdź, czy to otrzymasz, abym mógł kontynuować,
czekam na Twoją odpowiedź.
Pozdrowienia,
Pani Reacheal
From: John Harrison <John.C.Harrison(a)Intel.com>
Direction from hardware is that stolen memory should never be used for
ring buffer allocations on platforms with LLC. There are too many
caching pitfalls due to the way stolen memory accesses are routed. So
it is safest to just not use it.
Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com>
Fixes: c58b735fc762 ("drm/i915: Allocate rings from stolen")
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com>
Cc: intel-gfx(a)lists.freedesktop.org
Cc: <stable(a)vger.kernel.org> # v4.9+
---
drivers/gpu/drm/i915/gt/intel_ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c
index 15ec64d881c44..fb1d2595392ed 100644
--- a/drivers/gpu/drm/i915/gt/intel_ring.c
+++ b/drivers/gpu/drm/i915/gt/intel_ring.c
@@ -116,7 +116,7 @@ static struct i915_vma *create_ring_vma(struct i915_ggtt *ggtt, int size)
obj = i915_gem_object_create_lmem(i915, size, I915_BO_ALLOC_VOLATILE |
I915_BO_ALLOC_PM_VOLATILE);
- if (IS_ERR(obj) && i915_ggtt_has_aperture(ggtt))
+ if (IS_ERR(obj) && i915_ggtt_has_aperture(ggtt) && !HAS_LLC(i915))
obj = i915_gem_object_create_stolen(i915, size);
if (IS_ERR(obj))
obj = i915_gem_object_create_internal(i915, size);
--
2.39.1
Hi Greg, Sasha,
Here are two MPTCP patches backports (patches 2-3/4), and one
prerequisite (patch 1/4), that recently failed to apply to the 6.1
stable tree. They prevent some locking issues with MPTCP.
After having cherry-picked patch 1/4 -- a simple refactoring to make a
function more generic -- patch 2/4 applied without any issue.
For patch 3/4, I had to resolve two simple function because two
if-statements around the modified code have curly braces in v6.1, not
later, see commit 976d302fb616 ("mptcp: deduplicate error paths on
endpoint creation").
On top of that, patch 4/4 fixes MPTCP userspace PM selftest that has
been recently broken due to a backport done in v6.1.8.
Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
---
Matthieu Baerts (2):
mptcp: sockopt: make 'tcp_fastopen_connect' generic
selftests: mptcp: userspace: fix v4-v6 test in v6.1
Paolo Abeni (2):
mptcp: fix locking for setsockopt corner-case
mptcp: fix locking for in-kernel listener creation
net/mptcp/pm_netlink.c | 10 ++++++----
net/mptcp/sockopt.c | 20 ++++++++++++++------
net/mptcp/subflow.c | 2 +-
tools/testing/selftests/net/mptcp/userspace_pm.sh | 11 +++++++++++
4 files changed, 32 insertions(+), 11 deletions(-)
---
base-commit: 9012d1ebd3236e1d741ab4264f1d14e276c2e29f
change-id: 20230214-upstream-stable-20230214-linux-6-1-12-rc1-mptcp-fixes-df24a5f41151
Best regards,
--
Matthieu Baerts <matthieu.baerts(a)tessares.net>
Hello,
Here is the next batch of backports for 5.15.y. These patches have
already been ACK'd on the xfs mailing list. Testing included
25 runs of auto group on 12 xfs configs. No regressions were seen.
I checked xfs/538 was run without issue as this test was mentioned
in 56486f307100. Also, from 86d40f1e49e9, I ran ran xfs/117 with
XFS compiled as a module and TEST_FS_MODULE_REOLOAD set, but I was
unable to reproduce the issue.
Below I've outlined which series the backports came from:
series "xfs: intent whiteouts" (1):
[01/10] cb512c921639613ce03f87e62c5e93ed9fe8c84d
xfs: zero inode fork buffer at allocation
[02/10] c230a4a85bcdbfc1a7415deec6caf04e8fca1301
xfs: fix potential log item leak
series "xfs: fix random format verification issues" (2):
[1/4] dc04db2aa7c9307e740d6d0e173085301c173b1a
xfs: detect self referencing btree sibling pointers
[2/4] 1eb70f54c445fcbb25817841e774adb3d912f3e8 -> already in 5.15.y
xfs: validate inode fork size against fork format
[3/4] dd0d2f9755191690541b09e6385d0f8cd8bc9d8f
xfs: set XFS_FEAT_NLINK correctly
[4/4] f0f5f658065a5af09126ec892e4c383540a1c77f
xfs: validate v5 feature fields
series "xfs: small fixes for 5.19 cycle" (3):
[1/3] 5672225e8f2a872a22b0cecedba7a6644af1fb84
xfs: avoid unnecessary runtime sibling pointer endian conversions
[2/3] 5b55cbc2d72632e874e50d2e36bce608e55aaaea
fs: don't assert fail on perag references on teardown
[2/3] 56486f307100e8fc66efa2ebd8a71941fa10bf6f
xfs: assert in xfs_btree_del_cursor should take into account error
series "xfs: random fixes for 5.19" (4):
[1/2] 86d40f1e49e9a909d25c35ba01bea80dbcd758cb
xfs: purge dquots after inode walk fails during quotacheck
[2/2] a54f78def73d847cb060b18c4e4a3d1d26c9ca6d
xfs: don't leak btree cursor when insrec fails after a split
(1) https://lore.kernel.org/all/20220503221728.185449-1-david@fromorbit.com/
(2) https://lore.kernel.org/all/20220502082018.1076561-1-david@fromorbit.com/
(3) https://lore.kernel.org/all/20220524022158.1849458-1-david@fromorbit.com/
(4) https://lore.kernel.org/all/165337056527.993079.1232300816023906959.stgit@m…
- Leah
Darrick J. Wong (2):
xfs: purge dquots after inode walk fails during quotacheck
xfs: don't leak btree cursor when insrec fails after a split
Dave Chinner (8):
xfs: zero inode fork buffer at allocation
xfs: fix potential log item leak
xfs: detect self referencing btree sibling pointers
xfs: set XFS_FEAT_NLINK correctly
xfs: validate v5 feature fields
xfs: avoid unnecessary runtime sibling pointer endian conversions
xfs: don't assert fail on perag references on teardown
xfs: assert in xfs_btree_del_cursor should take into account error
fs/xfs/libxfs/xfs_ag.c | 3 +-
fs/xfs/libxfs/xfs_btree.c | 175 +++++++++++++++++++++++++--------
fs/xfs/libxfs/xfs_inode_fork.c | 12 ++-
fs/xfs/libxfs/xfs_sb.c | 70 +++++++++++--
fs/xfs/xfs_bmap_item.c | 2 +
fs/xfs/xfs_icreate_item.c | 1 +
fs/xfs/xfs_qm.c | 9 +-
fs/xfs/xfs_refcount_item.c | 2 +
fs/xfs/xfs_rmap_item.c | 2 +
9 files changed, 221 insertions(+), 55 deletions(-)
--
2.39.1.581.gbfd45094c4-goog
[Greetings]
I'm Dr. Breiner, a research consultant with one of the leading
laboratories in the United Kingdom.
Our company is one of the most respected indigenous multi-million
pharma companies, manufacturing hundreds of lifesaving
biopharmaceutical products and medical consumables. Our range
includes anti-diabetic, anti-inflammatory, and analgesic drugs,
vaccines, antimalarial drugs, and other essential medical
consumables.
I have a business proposal that will be of interest to you. I'll
explain it in detail if you let me know if you'd like to hear
more. Please keep in mind that you can decide not to move forward
with me at any point during or after my detailed explanation.
But please be sure to trust me; you will not experience any
regret whatsoever.
I look forward to hearing back from you. If you have any
questions, please do not hesitate to contact me.
Best regards
[Dr. Breiner]
No upstream commit exists: the problem addressed here is that
'commit 75309018a24d ("s390: add support for TIF_NOTIFY_SIGNAL")'
was backported to 5.10. This commit is broken, but nobody noticed
upstream, since shortly after s390 converted to generic entry with
'commit 56e62a737028 ("s390: convert to generic entry")', which
implicitly fixed the problem outlined below.
Thread flag is set to TIF_NOTIFY_SIGNAL for io_uring work. The io work
user or syscall calls do_signal when either one of the TIF_SIGPENDING or
TIF_NOTIFY_SIGNAL flag is set. However, do_signal does consider only
TIF_SIGPENDING signal and ignores TIF_NOTIFY_SIGNAL condition. This
means get_signal is never invoked for TIF_NOTIFY_SIGNAL and hence the
flag is not cleared, which results in an endless do_signal loop.
Reference: 'commit 788d0824269b ("io_uring: import 5.15-stable io_uring")'
Fixes: 75309018a24d ("s390: add support for TIF_NOTIFY_SIGNAL")
Cc: stable(a)vger.kernel.org # 5.10.162
Acked-by: Heiko Carstens <hca(a)linux.ibm.com>
Acked-by: Sven Schnelle <svens(a)linux.ibm.com>
Signed-off-by: Sumanth Korikkar <sumanthk(a)linux.ibm.com>
---
v2->v3:
Correct changelog.
v1->v2:
Add the changelog.
arch/s390/kernel/signal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index b27b6c1f058d..9e900a8977bd 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -472,7 +472,7 @@ void do_signal(struct pt_regs *regs)
current->thread.system_call =
test_pt_regs_flag(regs, PIF_SYSCALL) ? regs->int_code : 0;
- if (test_thread_flag(TIF_SIGPENDING) && get_signal(&ksig)) {
+ if (get_signal(&ksig)) {
/* Whee! Actually deliver the signal. */
if (current->thread.system_call) {
regs->int_code = current->thread.system_call;
--
2.37.2
Hi,
This patch fixes the issue for s390 stable kernel starting 5.10.162.
The issue was specifically seen after stable version 5.10.162:
Following commits can trigger it:
1. stable commit id - 788d0824269b ("io_uring: import 5.15-stable
io_uring") can trigger this problem.
2. upstream commit id - 75309018a24d ("s390: add support for
TIF_NOTIFY_SIGNAL")
Problem:
qemu and user processes could stall when TIF_NOTIFY_SIGNAL is set from
io_uring work.
Affected users:
The issue was first raised by the debian team, where the s390
bullseye build systems are affected.
Upstream commit Id:
* The attached patch has no upstream commit. However, the stable kernel
5.10.162+ uses upstream commit id - 75309018a24d ("s390: add support for
TIF_NOTIFY_SIGNAL"), which would need this fix
* Starting from v5.12, there are s390 generic entry commits
56e62a737028 ("s390: convert to generic entry") and its relevant fixes,
which are recommended and should address these problems.
Kernel version to be applied:
stable kernel 5.10.162+
Thanks.
Sumanth
Sumanth Korikkar (1):
s390/signal: fix endless loop in do_signal
arch/s390/kernel/signal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--
2.37.2
If a non-root cgroup gets removed when there is a thread that registered
trigger and is polling on a pressure file within the cgroup, the polling
waitqueue gets freed in the following path.
do_rmdir
cgroup_rmdir
kernfs_drain_open_files
cgroup_file_release
cgroup_pressure_release
psi_trigger_destroy
However, the polling thread still has a reference to the pressure file and
will access the freed waitqueue when the file is closed or upon exit.
fput
ep_eventpoll_release
ep_free
ep_remove_wait_queue
remove_wait_queue
This results in use-after-free as pasted below.
The fundamental problem here is that cgroup_file_release() (and
consequently waitqueue's lifetime) is not tied to the file's real lifetime.
Using wake_up_pollfree() here might be less than ideal, but it is in line
with the comment at commit 42288cb44c4b ("wait: add wake_up_pollfree()")
since the waitqueue's lifetime is not tied to file's one and can be
considered as another special case. While this would be fixable by somehow
making cgroup_file_release() be tied to the fput(), it would require
sizable refactoring at cgroups or higher layer which might be more
justifiable if we identify more cases like this.
BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x60/0xc0
Write of size 4 at addr ffff88810e625328 by task a.out/4404
CPU: 19 PID: 4404 Comm: a.out Not tainted 6.2.0-rc6 #38
Hardware name: Amazon EC2 c5a.8xlarge/, BIOS 1.0 10/16/2017
Call Trace:
<TASK>
dump_stack_lvl+0x73/0xa0
print_report+0x16c/0x4e0
? _printk+0x59/0x80
? __virt_addr_valid+0xb8/0x130
? _raw_spin_lock_irqsave+0x60/0xc0
kasan_report+0xc3/0xf0
? _raw_spin_lock_irqsave+0x60/0xc0
kasan_check_range+0x2d2/0x310
_raw_spin_lock_irqsave+0x60/0xc0
remove_wait_queue+0x1a/0xa0
ep_free+0x12c/0x170
ep_eventpoll_release+0x26/0x30
__fput+0x202/0x400
task_work_run+0x11d/0x170
do_exit+0x495/0x1130
? update_cfs_rq_load_avg+0x2c2/0x2e0
do_group_exit+0x100/0x100
get_signal+0xd67/0xde0
? finish_task_switch+0x15f/0x3a0
arch_do_signal_or_restart+0x2a/0x2b0
exit_to_user_mode_prepare+0x94/0x100
syscall_exit_to_user_mode+0x20/0x40
do_syscall_64+0x52/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f8e392bfb91
Code: Unable to access opcode bytes at 0x7f8e392bfb67.
RSP: 002b:00007fff261e08d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000022
RAX: fffffffffffffdfe RBX: 0000000000000000 RCX: 00007f8e392bfb91
RDX: 0000000000000001 RSI: 00007fff261e08e8 RDI: 0000000000000004
RBP: 00007fff261e0920 R08: 0000000000400780 R09: 00007f8e3960f240
R10: 00000000000003df R11: 0000000000000246 R12: 00000000004005a0
R13: 00007fff261e0a00 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Allocated by task 4404:
kasan_set_track+0x3d/0x60
__kasan_kmalloc+0x85/0x90
psi_trigger_create+0x113/0x3e0
pressure_write+0x146/0x2e0
cgroup_file_write+0x11c/0x250
kernfs_fop_write_iter+0x186/0x220
vfs_write+0x3d8/0x5c0
ksys_write+0x90/0x110
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 4407:
kasan_set_track+0x3d/0x60
kasan_save_free_info+0x27/0x40
____kasan_slab_free+0x11d/0x170
slab_free_freelist_hook+0x87/0x150
__kmem_cache_free+0xcb/0x180
psi_trigger_destroy+0x2e8/0x310
cgroup_file_release+0x4f/0xb0
kernfs_drain_open_files+0x165/0x1f0
kernfs_drain+0x162/0x1a0
__kernfs_remove+0x1fb/0x310
kernfs_remove_by_name_ns+0x95/0xe0
cgroup_addrm_files+0x67f/0x700
cgroup_destroy_locked+0x283/0x3c0
cgroup_rmdir+0x29/0x100
kernfs_iop_rmdir+0xd1/0x140
vfs_rmdir+0xfe/0x240
do_rmdir+0x13d/0x280
__x64_sys_rmdir+0x2c/0x30
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
v4: updated commit message
v3: updated commit message and the comment in the code
v2: updated commit message
Link: https://lore.kernel.org/lkml/20230106224859.4123476-1-kamatam@amazon.com/
Fixes: 0e94682b73bf ("psi: introduce psi monitor")
Cc: stable(a)vger.kernel.org
Signed-off-by: Munehisa Kamata <kamatam(a)amazon.com>
Signed-off-by: Mengchi Cheng <mengcc(a)amazon.com>
Acked-by: Suren Baghdasaryan <surenb(a)google.com>
---
kernel/sched/psi.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 8ac8b81bfee6..02e011cabe91 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1343,10 +1343,11 @@ void psi_trigger_destroy(struct psi_trigger *t)
group = t->group;
/*
- * Wakeup waiters to stop polling. Can happen if cgroup is deleted
- * from under a polling process.
+ * Wakeup waiters to stop polling and clear the queue to prevent it from
+ * being accessed later. Can happen if cgroup is deleted from under a
+ * polling process.
*/
- wake_up_interruptible(&t->event_wait);
+ wake_up_pollfree(&t->event_wait);
mutex_lock(&group->trigger_lock);
--
2.38.1
This bug is marked as fixed by commit:
ext4: block range must be validated before use in ext4_mb_clear_bb()
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Android 5.10
Dashboard link: https://syzkaller.appspot.com/bug?extid=15cd994e273307bf5cfa
---
[1] I expect the commit to be present in:
1. android12-5.10-lts branch of
https://android.googlesource.com/kernel/common
There is an error
tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
master
head: c911f03f8d444e623724fddd82b07a7e1af42338
commit: d5924531dd8ad012ad13eb4d6a5e120c3dadfc05 arm64/kexec: Test page
size support with new TGRAN range values
#
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
When I compile the ko file, I add [-Werror=type-limits] compilation
options, an error is reported during compilation.
The log is as follows:
./arch/arm64/include/asm/cpufeature.h: In function
‘system_supports_4kb_granule’:
./arch/arm64/include/asm/cpufeature.h:653:14: error:
comparison of unsigned expression >= 0 is always true [-Werror=type-limits]
return (val >= ID_AA64MMFR0_TGRAN4_SUPPORTED_MIN) &&
^~
./arch/arm64/include/asm/cpufeature.h: In function
‘system_supports_64kb_granule’:
./arch/arm64/include/asm/cpufeature.h:666:14: error:
comparison of unsigned expression >= 0 is always true [-Werror=type-limits]
return (val >= ID_AA64MMFR0_TGRAN64_SUPPORTED_MIN) &&
^~
"val" variable type is "u32"
"#define ID_AA64MMFR0_TGRAN4_SUPPORTED_MIN 0x0"
"#define ID_AA64MMFR0_TGRAN64_SUPPORTED_MIN 0x0"
comparison of val >= 0 is always true.
If you fix the issue, kindly add following tag where applicable
Reported-by: heyuqiang <heyuqiang1(a)huawei.com>
Thanks
When a connection was established without going through
NL80211_CMD_CONNECT, the ssid was never set in the wireless_dev struct.
Now we set it in __cfg80211_connect_result() when it is not already set.
When using a userspace configuration that does not call
cfg80211_connect() (can be checked with breakpoints in the kernel),
this patch should allow `networkctl status device_name` to output the
SSID instead of null.
Reported-by: Yohan Prod'homme <kernel(a)zoddo.fr>
Fixes: 7b0a0e3c3a88 (wifi: cfg80211: do some rework towards MLO link APIs)
CC: Kalle Valo <kvalo(a)kernel.org>
Cc: Denis Kirjanov <dkirjanov(a)suse.de>
Cc: linux-wireless(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216711
Signed-off-by: Marc Bornand <dev.mbornand(a)systemb.ch>
---
changes since v4:
- style: use xmas tree
- better fixes tag
- fix typo in commit message
- explain how to test the patch
- fix fixes tag
- move change log
- changing the title to something better
changes since v3:
- add missing NULL check
- add missing break
changes since v2:
- The code was tottaly rewritten based on the disscution of the
v2 patch.
- the ssid is set in __cfg80211_connect_result() and only if the ssid is
not already set.
- Do not add an other ssid reset path since it is already done in
__cfg80211_disconnected()
---
net/wireless/sme.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 4b5b6ee0fe01..032464a38787 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -724,6 +724,7 @@ void __cfg80211_connect_result(struct net_device *dev,
{
struct wireless_dev *wdev = dev->ieee80211_ptr;
const struct element *country_elem = NULL;
+ const struct element *ssid;
const u8 *country_data;
u8 country_datalen;
#ifdef CONFIG_CFG80211_WEXT
@@ -883,6 +884,22 @@ void __cfg80211_connect_result(struct net_device *dev,
country_data, country_datalen);
kfree(country_data);
+ if (wdev->u.client.ssid_len == 0) {
+ rcu_read_lock();
+ for_each_valid_link(cr, link) {
+ ssid = ieee80211_bss_get_elem(cr->links[link].bss,
+ WLAN_EID_SSID);
+
+ if (!ssid || ssid->datalen == 0)
+ continue;
+
+ memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen);
+ wdev->u.client.ssid_len = ssid->datalen;
+ break;
+ }
+ rcu_read_unlock();
+ }
+
return;
out:
for_each_valid_link(cr, link)
--
2.39.2
changes since v3:
- add missing NULL check
- add missing break
changes since v2:
- The code was tottaly rewritten based on the disscution of the
v2 patch.
- the ssid is set in __cfg80211_connect_result() and only if the ssid is
not already set.
- Do not add an other ssid reset path since it is already done in
__cfg80211_disconnected()
When a connexion was established without going through
NL80211_CMD_CONNECT, the ssid was never set in the wireless_dev struct.
Now we set it in __cfg80211_connect_result() when it is not already set.
Reported-by: Yohan Prod'homme <kernel(a)zoddo.fr>
Fixes: 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1
Cc: linux-wireless(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216711
Signed-off-by: Marc Bornand <dev.mbornand(a)systemb.ch>
---
net/wireless/sme.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 4b5b6ee0fe01..b552d6c20a26 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -723,6 +723,7 @@ void __cfg80211_connect_result(struct net_device *dev,
bool wextev)
{
struct wireless_dev *wdev = dev->ieee80211_ptr;
+ const struct element *ssid;
const struct element *country_elem = NULL;
const u8 *country_data;
u8 country_datalen;
@@ -883,6 +884,22 @@ void __cfg80211_connect_result(struct net_device *dev,
country_data, country_datalen);
kfree(country_data);
+ if (wdev->u.client.ssid_len == 0) {
+ rcu_read_lock();
+ for_each_valid_link(cr, link) {
+ ssid = ieee80211_bss_get_elem(cr->links[link].bss,
+ WLAN_EID_SSID);
+
+ if (!ssid || ssid->datalen == 0)
+ continue;
+
+ memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen);
+ wdev->u.client.ssid_len = ssid->datalen;
+ break;
+ }
+ rcu_read_unlock();
+ }
+
return;
out:
for_each_valid_link(cr, link)
--
2.39.1
This is the start of the stable review cycle for the 5.10.168 release.
There are 139 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 15 Feb 2023 14:46:51 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.168-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.168-rc1
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
nvmem: core: fix return value
David Chen <david.chen(a)nutanix.com>
Fix page corruption caused by racy check in __free_pages
Heiner Kallweit <hkallweit1(a)gmail.com>
arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
Heiner Kallweit <hkallweit1(a)gmail.com>
arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive
Heiner Kallweit <hkallweit1(a)gmail.com>
arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
Guo Ren <guoren(a)linux.alibaba.com>
riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
Xiubo Li <xiubli(a)redhat.com>
ceph: flush cap releases when the session is flushed
Prashant Malani <pmalani(a)chromium.org>
usb: typec: altmodes/displayport: Fix probe pin assign check
Mark Pearson <mpearson-lenovo(a)squebb.ca>
usb: core: add quirk for Alcor Link AK9563 smartcard reader
Anand Jain <anand.jain(a)oracle.com>
btrfs: free device in btrfs_close_devices for a single device filesystem
Alan Stern <stern(a)rowland.harvard.edu>
net: USB: Fix wrong-direction WARNING in plusb.c
ZhaoLong Wang <wangzhaolong1(a)huawei.com>
cifs: Fix use-after-free in rdata->read_into_pages()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
Serge Semin <Sergey.Semin(a)baikalelectronics.ru>
spi: dw: Fix wrong FIFO level setting for long xfers
Maxim Korotkov <korotkov.maxim.s(a)gmail.com>
pinctrl: single: fix potential NULL dereference
Joel Stanley <joel(a)jms.id.au>
pinctrl: aspeed: Fix confusing types in return value
Dan Carpenter <error27(a)gmail.com>
ALSA: pci: lx6464es: fix a debug loop
Hangbin Liu <liuhangbin(a)gmail.com>
selftests: forwarding: lib: quote the sysctl values
Pietro Borrello <borrello(a)diag.uniroma1.it>
rds: rds_rm_zerocopy_callback() use list_first_entry()
Shay Drory <shayd(a)nvidia.com>
net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
Shay Drory <shayd(a)nvidia.com>
net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
Dragos Tatulea <dtatulea(a)nvidia.com>
net/mlx5e: IPoIB, Show unknown speed instead of error
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q"
Anirudh Venkataramanan <anirudh.venkataramanan(a)intel.com>
ice: Do not use WQ_MEM_RECLAIM flag for workqueue
Herton R. Krzesinski <herton(a)redhat.com>
uapi: add missing ip/ipv6 header dependencies for linux/stddef.h
Neel Patel <neel.patel(a)amd.com>
ionic: clean interrupt before enabling queue to avoid credit race
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
Qi Zheng <zhengqi.arch(a)bytedance.com>
bonding: fix error checking in bond_debug_reregister()
Christian Hopps <chopps(a)chopps.org>
xfrm: fix bug with DSCP copy to v6 from v4 tunnel
Yang Yingliang <yangyingliang(a)huawei.com>
RDMA/usnic: use iommu_map_atomic() under spin_lock()
Dragos Tatulea <dtatulea(a)nvidia.com>
IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
Eric Dumazet <edumazet(a)google.com>
xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
Dean Luick <dean.luick(a)cornelisnetworks.com>
IB/hfi1: Restore allocated resources on failed copyout
Anastasia Belova <abelova(a)astralinux.ru>
xfrm: compat: change expression for switch in xfrm_xlate64
Devid Antonio Filoni <devid.filoni(a)egluetechnologies.com>
can: j1939: do not wait 250 ms if the same addr was already claimed
Mark Brown <broonie(a)kernel.org>
of/address: Return an error when no valid dma-ranges are found
Shiju Jose <shiju.jose(a)huawei.com>
tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw
Guillaume Pinot <texitoi(a)texitoi.eu>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360
Artemii Karasev <karasev(a)ispras.ru>
ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
Edson Juliano Drosdeck <edson.drosdeck(a)gmail.com>
ALSA: hda/realtek: Add Positivo N14KP6-TG
Alexander Potapenko <glider(a)google.com>
btrfs: zlib: zero-initialize zlib workspace
Josef Bacik <josef(a)toxicpanda.com>
btrfs: limit device extents to the device size
Mike Kravetz <mike.kravetz(a)oracle.com>
migrate: hugetlb: check for hugetlb shared PMD in node migration
Miaohe Lin <linmiaohe(a)huawei.com>
mm/migration: return errno when isolate_huge_page failed
Andreas Kemnade <andreas(a)kemnade.info>
iio:adc:twl6030: Enable measurement of VAC
Martin KaFai Lau <kafai(a)fb.com>
bpf: Do not reject when the stack read size is different from the tracked scalar size
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
nvmem: core: fix registration vs use race
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
nvmem: core: fix cleanup after dev_set_name()
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
nvmem: core: remove nvmem_config wp_gpio
Gaosheng Cui <cuigaosheng1(a)huawei.com>
nvmem: core: add error handling for dev_set_name
Christophe Kerello <christophe.kerello(a)foss.st.com>
nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
Minsuk Kang <linuxlovemin(a)yonsei.ac.kr>
wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
Chao Yu <chao(a)kernel.org>
f2fs: fix to do sanity check on i_extra_isize in is_alive()
Dongliang Mu <dzm91(a)hust.edu.cn>
fbdev: smscufx: fix error handling code in ufx_usb_probe
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
serial: 8250_dma: Fix DMA Rx rearm race
Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
serial: 8250_dma: Fix DMA Rx completion race
Michael Walle <michael(a)walle.cc>
nvmem: core: fix cell removal on error
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
nvmem: core: initialise nvmem->id early
Rob Clark <robdclark(a)chromium.org>
drm/i915: Fix potential bit_17 double-free
Phillip Lougher <phillip(a)squashfs.org.uk>
Squashfs: fix handling and sanity checking of xattr_ids count
Longlong Xia <xialonglong1(a)huawei.com>
mm/swapfile: add cond_resched() in get_swap_pages()
Zheng Yongjun <zhengyongjun3(a)huawei.com>
fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
Joerg Roedel <jroedel(a)suse.de>
x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses
Mike Kravetz <mike.kravetz(a)oracle.com>
mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
Andreas Schwab <schwab(a)suse.de>
riscv: disable generation of unwind tables
Helge Deller <deller(a)gmx.de>
parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
Helge Deller <deller(a)gmx.de>
parisc: Fix return code of pdc_iodc_print()
Johan Hovold <johan+linaro(a)kernel.org>
nvmem: qcom-spmi-sdam: fix module autoloading
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix MAGN sensor scale and unit
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix failed initialization ODR mode assignment
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix incorrect ODR mode readback
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix map label of channel type to MAGN sensor
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix IMU data bits returned to user space
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
Carlos Song <carlos.song(a)nxp.com>
iio: imu: fxos8700: fix ACCEL measurement range selection
Andreas Kemnade <andreas(a)kemnade.info>
iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
Xiongfeng Wang <wangxiongfeng2(a)huawei.com>
iio: adc: berlin2-adc: Add missing of_node_put() in error path
Dmitry Perchanov <dmitry.perchanov(a)intel.com>
iio: hid: fix the retval in accel_3d_capture_sample
Ard Biesheuvel <ardb(a)kernel.org>
efi: Accept version 2 of memory attributes table
Victor Shyba <victor1984(a)riseup.net>
ALSA: hda/realtek: Add Acer Predator PH315-54
Alexander Egorenkov <egorenar(a)linux.ibm.com>
watchdog: diag288_wdt: fix __diag288() inline assembly
Alexander Egorenkov <egorenar(a)linux.ibm.com>
watchdog: diag288_wdt: do not use stack buffers for hardware data
Natalia Petrova <n.petrova(a)fintech.ru>
net: qrtr: free memory on error path in radix_tree_insert()
Samuel Thibault <samuel.thibault(a)ens-lyon.org>
fbcon: Check font dimension limits
Werner Sembach <wse(a)tuxedocomputers.com>
Input: i8042 - add Clevo PCX0DX to i8042 quirk table
Werner Sembach <wse(a)tuxedocomputers.com>
Input: i8042 - add TUXEDO devices to i8042 quirk tables
Werner Sembach <wse(a)tuxedocomputers.com>
Input: i8042 - merge quirk tables
Werner Sembach <wse(a)tuxedocomputers.com>
Input: i8042 - move __initconst to fix code styling warning
George Kennedy <george.kennedy(a)oracle.com>
vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
Udipto Goswami <quic_ugoswami(a)quicinc.com>
usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
Neil Armstrong <neil.armstrong(a)linaro.org>
usb: dwc3: qcom: enable vbus override when in OTG dr-mode
Wesley Cheng <wcheng(a)codeaurora.org>
usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
Olivier Moysan <olivier.moysan(a)foss.st.com>
iio: adc: stm32-dfsdm: fill module aliases
Hyunwoo Kim <v4bel(a)theori.io>
net/x25: Fix to not accept on connected socket
Koba Ko <koba.ko(a)canonical.com>
platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table
Randy Dunlap <rdunlap(a)infradead.org>
i2c: rk3x: fix a bunch of kernel-doc warnings
Mike Christie <michael.christie(a)oracle.com>
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
Maurizio Lombardi <mlombard(a)redhat.com>
scsi: target: core: Fix warning on RT kernels
Stefan Wahren <stefan.wahren(a)i2se.com>
i2c: mxs: suppress probe-deferral error message
Magnus Karlsson <magnus.karlsson(a)intel.com>
qede: execute xdp_do_flush() before napi_complete_done()
Bhaskar Upadhaya <bupadhaya(a)marvell.com>
qede: add netpoll support for qede driver
Anton Gusev <aagusev(a)ispras.ru>
efi: fix potential NULL deref in efi_mem_reserve_persistent
Fedor Pchelkin <pchelkin(a)ispras.ru>
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
Parav Pandit <parav(a)nvidia.com>
virtio-net: Keep stop() to follow mirror sequence of open()
Andrei Gherzan <andrei.gherzan(a)canonical.com>
selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
Andrei Gherzan <andrei.gherzan(a)canonical.com>
selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
Andrei Gherzan <andrei.gherzan(a)canonical.com>
selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
Andrei Gherzan <andrei.gherzan(a)canonical.com>
selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
ata: libata: Fix sata_down_spd_limit() when no link speed is reported
Ziyang Xuan <william.xuanziyang(a)huawei.com>
can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
Tom Rix <trix(a)redhat.com>
igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp()
Chris Healy <healych(a)amazon.com>
net: phy: meson-gxl: Add generic dummy stubs for MMD register access
Fedor Pchelkin <pchelkin(a)ispras.ru>
squashfs: harden sanity check in squashfs_read_xattr_id_table
Florian Westphal <fw(a)strlen.de>
netfilter: br_netfilter: disable sabotage_in hook after first suppression
Hyunwoo Kim <v4bel(a)theori.io>
netrom: Fix use-after-free caused by accept on already connected socket
Andre Kalb <andre.kalb(a)sma.de>
net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
Íñigo Huguet <ihuguet(a)redhat.com>
sfc: correctly advertise tunneled IPv6 segmentation
Magnus Karlsson <magnus.karlsson(a)intel.com>
virtio-net: execute xdp_do_flush() before napi_complete_done()
Al Viro <viro(a)zeniv.linux.org.uk>
fix "direction" argument of iov_iter_kvec()
Al Viro <viro(a)zeniv.linux.org.uk>
fix iov_iter_bvec() "direction" argument
Al Viro <viro(a)zeniv.linux.org.uk>
READ is "data destination", not source...
Al Viro <viro(a)zeniv.linux.org.uk>
WRITE is "data source", not destination...
Eric Auger <eric.auger(a)redhat.com>
vhost/net: Clear the pending messages when the backend is removed
Martin K. Petersen <martin.petersen(a)oracle.com>
scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
drm/vc4: hdmi: make CEC adapter name unique
Pierluigi Passaro <pierluigi.p(a)variscite.com>
arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
Jakub Sitnicki <jakub(a)cloudflare.com>
bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
Eduard Zingerman <eddyz87(a)gmail.com>
bpf: Fix to preserve reg parent/live fields when copying range info
Martin KaFai Lau <kafai(a)fb.com>
bpf: Support <8-byte scalar spill and refill
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/bpf: Move common helpers into bpf_jit.h
Christophe Leroy <christophe.leroy(a)csgroup.eu>
powerpc/bpf: Change register numbering for bpf_set/is_seen_register()
Artemii Karasev <karasev(a)ispras.ru>
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
Yonghong Song <yhs(a)fb.com>
bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/imc-pmu: Revert nest_init_lock to being a mutex
Paul Chaignon <paul(a)isovalent.com>
bpf: Fix incorrect state pruning for <8B spill/fill
Yuan Can <yuancan(a)huawei.com>
bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +-
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 6 +-
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +-
arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h | 2 +-
arch/parisc/kernel/firmware.c | 5 +-
arch/parisc/kernel/ptrace.c | 15 +-
arch/powerpc/net/bpf_jit.h | 35 +
arch/powerpc/net/bpf_jit64.h | 19 -
arch/powerpc/net/bpf_jit_comp64.c | 28 +-
arch/powerpc/perf/imc-pmu.c | 14 +-
arch/riscv/Makefile | 3 +
arch/riscv/mm/cacheflush.c | 4 +-
arch/x86/include/asm/debugreg.h | 26 +-
drivers/ata/libata-core.c | 2 +-
drivers/bus/sunxi-rsb.c | 8 +-
drivers/firewire/core-cdev.c | 4 +-
drivers/firmware/efi/efi.c | 2 +
drivers/firmware/efi/memattr.c | 2 +-
drivers/fpga/stratix10-soc.c | 4 +-
drivers/fsi/fsi-sbefifo.c | 6 +-
drivers/gpu/drm/i915/gem/i915_gem_tiling.c | 9 +-
drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +-
drivers/i2c/busses/i2c-mxs.c | 4 +-
drivers/i2c/busses/i2c-rk3x.c | 44 +-
drivers/iio/accel/hid-sensor-accel-3d.c | 1 +
drivers/iio/adc/berlin2-adc.c | 4 +-
drivers/iio/adc/stm32-dfsdm-adc.c | 1 +
drivers/iio/adc/twl6030-gpadc.c | 32 +
drivers/iio/imu/fxos8700_core.c | 111 +-
drivers/infiniband/hw/hfi1/file_ops.c | 7 +-
drivers/infiniband/hw/usnic/usnic_uiom.c | 8 +-
drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 +
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
drivers/input/serio/i8042-x86ia64io.h | 1188 ++++++++++++--------
drivers/net/bonding/bond_debugfs.c | 2 +-
drivers/net/ethernet/intel/ice/ice_main.c | 2 +-
drivers/net/ethernet/intel/igc/igc_ptp.c | 14 +-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 3 +-
.../ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 13 +-
drivers/net/ethernet/mscc/ocelot_flower.c | 24 +-
drivers/net/ethernet/pensando/ionic/ionic_lif.c | 15 +-
drivers/net/ethernet/qlogic/qede/qede_fp.c | 10 +-
drivers/net/ethernet/sfc/efx.c | 5 +-
drivers/net/phy/dp83822.c | 6 +-
drivers/net/phy/meson-gxl.c | 4 +
drivers/net/usb/plusb.c | 4 +-
drivers/net/virtio_net.c | 8 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 17 +
drivers/nvmem/core.c | 45 +-
drivers/nvmem/qcom-spmi-sdam.c | 1 +
drivers/of/address.c | 21 +-
drivers/pinctrl/aspeed/pinctrl-aspeed.c | 2 +-
drivers/pinctrl/intel/pinctrl-intel.c | 16 +-
drivers/pinctrl/pinctrl-single.c | 2 +
drivers/platform/x86/dell-wmi.c | 3 +
drivers/scsi/iscsi_tcp.c | 9 +-
drivers/scsi/scsi_scan.c | 7 +-
drivers/spi/spi-dw-core.c | 2 +-
drivers/target/target_core_file.c | 4 +-
drivers/target/target_core_tmr.c | 4 +-
drivers/tty/serial/8250/8250_dma.c | 26 +-
drivers/tty/vt/vc_screen.c | 9 +-
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc3/dwc3-qcom.c | 10 +-
drivers/usb/gadget/function/f_fs.c | 4 +-
drivers/usb/typec/altmodes/displayport.c | 8 +-
drivers/vhost/net.c | 3 +
drivers/vhost/vhost.c | 3 +-
drivers/vhost/vhost.h | 1 +
drivers/video/fbdev/core/fbcon.c | 7 +-
drivers/video/fbdev/smscufx.c | 46 +-
drivers/watchdog/diag288_wdt.c | 15 +-
drivers/xen/pvcalls-back.c | 8 +-
fs/btrfs/volumes.c | 22 +-
fs/btrfs/zlib.c | 2 +-
fs/ceph/mds_client.c | 6 +
fs/cifs/file.c | 4 +-
fs/f2fs/gc.c | 18 +-
fs/proc/task_mmu.c | 4 +-
fs/squashfs/squashfs_fs.h | 2 +-
fs/squashfs/squashfs_fs_sb.h | 2 +-
fs/squashfs/xattr.h | 4 +-
fs/squashfs/xattr_id.c | 4 +-
include/linux/hugetlb.h | 19 +-
include/linux/nvmem-provider.h | 4 +-
include/linux/util_macros.h | 12 +
include/uapi/linux/ip.h | 1 +
include/uapi/linux/ipv6.h | 1 +
kernel/bpf/verifier.c | 102 +-
kernel/trace/bpf_trace.c | 3 +-
kernel/trace/trace.c | 3 -
mm/gup.c | 2 +-
mm/hugetlb.c | 6 +-
mm/memory-failure.c | 2 +-
mm/memory_hotplug.c | 2 +-
mm/mempolicy.c | 5 +-
mm/migrate.c | 7 +-
mm/page_alloc.c | 5 +-
mm/swapfile.c | 1 +
net/bridge/br_netfilter_hooks.c | 1 +
net/can/j1939/address-claim.c | 40 +
net/can/j1939/transport.c | 4 -
net/ipv4/tcp_bpf.c | 4 +-
net/netrom/af_netrom.c | 5 +
net/openvswitch/datapath.c | 12 +-
net/qrtr/ns.c | 5 +-
net/rds/message.c | 6 +-
net/x25/af_x25.c | 6 +
net/xfrm/xfrm_compat.c | 4 +-
net/xfrm/xfrm_input.c | 3 +-
sound/pci/hda/patch_realtek.c | 3 +
sound/pci/hda/patch_via.c | 3 +
sound/pci/lx6464es/lx_core.c | 11 +-
sound/synth/emux/emux_nrpn.c | 3 +
tools/testing/selftests/net/forwarding/lib.sh | 4 +-
tools/testing/selftests/net/udpgso_bench.sh | 24 +-
tools/testing/selftests/net/udpgso_bench_rx.c | 4 +-
tools/testing/selftests/net/udpgso_bench_tx.c | 36 +-
119 files changed, 1573 insertions(+), 855 deletions(-)
Some TBT3 devices have a hard time reliably responding to bit banging
requests correctly when connected to AMD USB4 hosts running Linux.
These problems are not reported in any other CM, and comparing the
implementations the Linux CM is the only one that utilizes bit banging
to access the DROM. Other CM implementations access the DROM directly
from the NVM instead of bit banging.
Adjust the flow to try this on TBT3 devices before resorting to bit
banging.
Cc: stable(a)vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com>
---
drivers/thunderbolt/eeprom.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index c90d22f56d4e1..d9d9567bb938b 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -640,6 +640,10 @@ int tb_drom_read(struct tb_switch *sw)
return 0;
}
+ /* TBT3 devices have the DROM as part of NVM */
+ if (tb_drom_copy_nvm(sw, &size) == 0)
+ goto parse;
+
res = tb_drom_read_n(sw, 14, (u8 *) &size, 2);
if (res)
return res;
--
2.25.1
This is a note to let you know that I've just added the patch titled
usb: typec: tcpm: fix create duplicate source/sink-capabilities file
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
From f430e60b78c6359ba4cb4e521d7df7f9a0484e03 Mon Sep 17 00:00:00 2001
From: Xu Yang <xu.yang_2(a)nxp.com>
Date: Tue, 14 Feb 2023 14:56:35 +0800
Subject: usb: typec: tcpm: fix create duplicate source/sink-capabilities file
The kernel will dump in the below cases:
sysfs: cannot create duplicate filename
'/devices/virtual/usb_power_delivery/pd1/source-capabilities'
1. After soft reset has completed, an Explicit Contract negotiation occurs.
The sink device will receive source capabilitys again. This will cause
a duplicate source-capabilities file be created.
2. Power swap twice on a device that is initailly sink role.
This will unregister existing capabilities when above cases occurs.
Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities")
cc: <stable(a)vger.kernel.org>
Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Link: https://lore.kernel.org/r/20230214065635.972698-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpm.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index a0d943d78580..7d8c53d96c3b 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -4570,6 +4570,8 @@ static void run_state_machine(struct tcpm_port *port)
case SOFT_RESET:
port->message_id = 0;
port->rx_msgid = -1;
+ /* remove existing capabilities */
+ usb_power_delivery_unregister_capabilities(port->partner_source_caps);
tcpm_pd_send_control(port, PD_CTRL_ACCEPT);
tcpm_ams_finish(port);
if (port->pwr_role == TYPEC_SOURCE) {
@@ -4589,6 +4591,8 @@ static void run_state_machine(struct tcpm_port *port)
case SOFT_RESET_SEND:
port->message_id = 0;
port->rx_msgid = -1;
+ /* remove existing capabilities */
+ usb_power_delivery_unregister_capabilities(port->partner_source_caps);
if (tcpm_pd_send_control(port, PD_CTRL_SOFT_RESET))
tcpm_set_state_cond(port, hard_reset_state(port), 0);
else
@@ -4718,6 +4722,8 @@ static void run_state_machine(struct tcpm_port *port)
tcpm_set_state(port, SNK_STARTUP, 0);
break;
case PR_SWAP_SNK_SRC_SINK_OFF:
+ /* will be source, remove existing capabilities */
+ usb_power_delivery_unregister_capabilities(port->partner_source_caps);
/*
* Prevent vbus discharge circuit from turning on during PR_SWAP
* as this is not a disconnect.
--
2.39.1
Assert PCI Configuration Enable bit after probe. When this bit is left to
0 in the endpoint mode, the RK3399 PCIe endpoint core will generate
configuration request retry status (CRS) messages back to the root complex.
Assert this bit after probe to allow the RK3399 PCIe endpoint core to reply
to configuration requests from the root complex.
This is documented in section 17.5.8.1.2 of the RK3399 TRM.
Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller")
Cc: stable(a)vger.kernel.org
Signed-off-by: Rick Wertenbroek <rick.wertenbroek(a)gmail.com>
---
drivers/pci/controller/pcie-rockchip-ep.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
index 9b835377b..4c84e403e 100644
--- a/drivers/pci/controller/pcie-rockchip-ep.c
+++ b/drivers/pci/controller/pcie-rockchip-ep.c
@@ -623,6 +623,8 @@ static int rockchip_pcie_ep_probe(struct platform_device *pdev)
ep->irq_pci_addr = ROCKCHIP_PCIE_EP_DUMMY_IRQ_ADDR;
+ rockchip_pcie_write(rockchip, PCIE_CLIENT_CONF_ENABLE, PCIE_CLIENT_CONFIG);
+
return 0;
err_epc_mem_exit:
pci_epc_mem_exit(epc);
--
2.25.1
Certain AMD processors are vulnerable to a cross-thread return address
predictions bug. When running in SMT mode and one of the sibling threads
transitions out of C0 state, the other thread gets access to twice as many
entries in the RSB, but unfortunately the predictions of the now-halted
logical processor are not purged. Therefore, the executing processor
could speculatively execute from locations that the now-halted processor
had trained the RSB on.
The Spectre v2 mitigations cover the Linux kernel, as it fills the RSB
when context switching to the idle thread. However, KVM allows a VMM to
prevent exiting guest mode when transitioning out of C0 using the
KVM_CAP_X86_DISABLE_EXITS capability can be used by a VMM to change this
behavior. To mitigate the cross-thread return address predictions bug,
a VMM must not be allowed to override the default behavior to intercept
C0 transitions.
These patches introduce a KVM module parameter that, if set, will prevent
the user from disabling the HLT, MWAIT and CSTATE exits.
The patches apply to the 5.15 stable tree, and Greg has already received
them through a git bundle. The difference is only in context, but it is
too much for "git cherry-pick" so here they are.
Thanks,
Paolo
Tom Lendacky (3):
x86/speculation: Identify processors vulnerable to SMT RSB predictions
KVM: x86: Mitigate the cross-thread return address predictions bug
Documentation/hw-vuln: Add documentation for Cross-Thread Return
Predictions
.../admin-guide/hw-vuln/cross-thread-rsb.rst | 92 +++++++++++++++++++
Documentation/admin-guide/hw-vuln/index.rst | 1 +
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/kernel/cpu/common.c | 9 +-
arch/x86/kvm/x86.c | 43 ++++++---
5 files changed, 133 insertions(+), 13 deletions(-)
create mode 100644 Documentation/admin-guide/hw-vuln/cross-thread-rsb.rst
--
2.39.1