- Linux-stable-mirror - lists.linaro.org

+ ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: ocfs2: fix DIO failure due to insufficient transaction credits has been added to the -mm mm-hotfixes-unstable branch. Its filename is ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Jan Kara <jack(a)suse.cz> Subject: ocfs2: fix DIO failure due to insufficient transaction credits Date: Fri, 14 Jun 2024 16:52:43 +0200 The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits(). This however does not take into account that the IO could be arbitrarily large and can contain arbitrary number of extents. Extent tree manipulations do often extend the current transaction but not in all of the cases. For example if we have only single block extents in the tree, ocfs2_mark_extent_written() will end up calling ocfs2_replace_extent_rec() all the time and we will never extend the current transaction and eventually exhaust all the transaction credits if the IO contains many single block extents. Make sure the transaction always has enough credits for one extent insert before each call of ocfs2_mark_extent_written(). Link: https://lkml.kernel.org/r/20240614145243.8837-1-jack@suse.cz Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Heming Zhao <heming.zhao(a)suse.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/aops.c | 5 +++++ fs/ocfs2/journal.c | 17 +++++++++++++++++ fs/ocfs2/journal.h | 2 ++ fs/ocfs2/ocfs2_trace.h | 2 ++ 4 files changed, 26 insertions(+) --- a/fs/ocfs2/aops.c~ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits +++ a/fs/ocfs2/aops.c @@ -2366,6 +2366,11 @@ static int ocfs2_dio_end_io_write(struct } list_for_each_entry(ue, &dwc->dw_zero_list, ue_node) { + ret = ocfs2_assure_trans_credits(handle, credits); + if (ret < 0) { + mlog_errno(ret); + break; + } ret = ocfs2_mark_extent_written(inode, &et, handle, ue->ue_cpos, 1, ue->ue_phys, --- a/fs/ocfs2/journal.c~ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits +++ a/fs/ocfs2/journal.c @@ -446,6 +446,23 @@ bail: } /* + * Make sure handle has at least 'nblocks' credits available. If it does not + * have that many credits available, we will try to extend the handle to have + * enough credits. If that fails, we will restart transaction to have enough + * credits. Similar notes regarding data consistency and locking implications + * as for ocfs2_extend_trans() apply here. + */ +int ocfs2_assure_trans_credits(handle_t *handle, int nblocks) +{ + int old_nblks = jbd2_handle_buffer_credits(handle); + + trace_ocfs2_assure_trans_credits(old_nblks); + if (old_nblks >= nblocks) + return 0; + return ocfs2_extend_trans(handle, nblocks - old_nblks); +} + +/* * If we have fewer than thresh credits, extend by OCFS2_MAX_TRANS_DATA. * If that fails, restart the transaction & regain write access for the * buffer head which is used for metadata modifications. --- a/fs/ocfs2/journal.h~ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits +++ a/fs/ocfs2/journal.h @@ -243,6 +243,8 @@ handle_t *ocfs2_start_trans(struct int ocfs2_commit_trans(struct ocfs2_super *osb, handle_t *handle); int ocfs2_extend_trans(handle_t *handle, int nblocks); +int ocfs2_assure_trans_credits(handle_t *handle, + int nblocks); int ocfs2_allocate_extend_trans(handle_t *handle, int thresh); --- a/fs/ocfs2/ocfs2_trace.h~ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits +++ a/fs/ocfs2/ocfs2_trace.h @@ -2577,6 +2577,8 @@ DEFINE_OCFS2_ULL_UINT_EVENT(ocfs2_commit DEFINE_OCFS2_INT_INT_EVENT(ocfs2_extend_trans); +DEFINE_OCFS2_INT_EVENT(ocfs2_assure_trans_credits); + DEFINE_OCFS2_INT_EVENT(ocfs2_extend_trans_restart); DEFINE_OCFS2_INT_INT_EVENT(ocfs2_allocate_extend_trans); _ Patches currently in -mm which might be from jack(a)suse.cz are ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch

1 year, 2 months

1
0
0 0

[PATCH 1/2] docs: stable-kernel-rules: provide example of specifying target series

by Shung-Hsi Yu

Provide a concrete example of how to specify what stable series should be targeted for change inclusion. Looking around on the stable mailing list this seems like a common practice already, so let's mention that in the documentation as well (but worded so it is not interpreted as the only way to do so). Signed-off-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> --- Documentation/process/stable-kernel-rules.rst | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst index edf90bbe30f4..daa542988095 100644 --- a/Documentation/process/stable-kernel-rules.rst +++ b/Documentation/process/stable-kernel-rules.rst @@ -57,10 +57,13 @@ options for cases where a mainlined patch needs adjustments to apply in older series (for example due to API changes). When using option 2 or 3 you can ask for your change to be included in specific -stable series. When doing so, ensure the fix or an equivalent is applicable, -submitted, or already present in all newer stable trees still supported. This is -meant to prevent regressions that users might later encounter on updating, if -e.g. a fix merged for 5.19-rc1 would be backported to 5.10.y, but not to 5.15.y. +stable series, one way to do so is by specifying the target series in the +subject prefix (e.g. '[PATCH stable 5.15 5.10]' asks that the patch to be +included in both 5.10.y and 5.15.y). When doing so, ensure the fix or an +equivalent is applicable, submitted, or already present in all newer stable +trees still supported. This is meant to prevent regressions that users might +later encounter on updating, if e.g. a fix merged for 5.19-rc1 would be +backported to 5.10.y, but not to 5.15.y. .. _option_1: -- 2.45.1

1 year, 2 months

3
5
0 0

+ kasan-fix-bad-call-to-unpoison_slab_object.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: kasan: fix bad call to unpoison_slab_object has been added to the -mm mm-hotfixes-unstable branch. Its filename is kasan-fix-bad-call-to-unpoison_slab_object.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Andrey Konovalov <andreyknvl(a)gmail.com> Subject: kasan: fix bad call to unpoison_slab_object Date: Fri, 14 Jun 2024 16:32:38 +0200 Commit 29d7355a9d05 ("kasan: save alloc stack traces for mempool") messed up one of the calls to unpoison_slab_object: the last two arguments are supposed to be GFP flags and whether to init the object memory. Fix the call. Without this fix, __kasan_mempool_unpoison_object provides the object's size as GFP flags to unpoison_slab_object, which can cause LOCKDEP reports (and probably other issues). Link: https://lkml.kernel.org/r/20240614143238.60323-1-andrey.konovalov@linux.dev Fixes: 29d7355a9d05 ("kasan: save alloc stack traces for mempool") Signed-off-by: Andrey Konovalov <andreyknvl(a)gmail.com> Reported-by: Brad Spengler <spender(a)grsecurity.net> Acked-by: Marco Elver <elver(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/kasan/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/kasan/common.c~kasan-fix-bad-call-to-unpoison_slab_object +++ a/mm/kasan/common.c @@ -532,7 +532,7 @@ void __kasan_mempool_unpoison_object(voi return; /* Unpoison the object and save alloc info for non-kmalloc() allocations. */ - unpoison_slab_object(slab->slab_cache, ptr, size, flags); + unpoison_slab_object(slab->slab_cache, ptr, flags, false); /* Poison the redzone and save alloc info for kmalloc() allocations. */ if (is_kmalloc_cache(slab->slab_cache)) _ Patches currently in -mm which might be from andreyknvl(a)gmail.com are kasan-fix-bad-call-to-unpoison_slab_object.patch

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] io_uring: check for non-NULL file pointer in" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 5fc16fa5f13b3c06fdb959ef262050bd810416a2 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061318-hypocrite-elude-31f3@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 5fc16fa5f13b ("io_uring: check for non-NULL file pointer in io_file_can_poll()") 95041b93e90a ("io_uring: add io_file_can_poll() helper") 521223d7c229 ("io_uring/cancel: don't default to setting req->work.cancel_seq") 4bcb982cce74 ("io_uring: expand main struct io_kiocb flags to 64-bits") 595e52284d24 ("io_uring/poll: don't enable lazy wake for POLLEXCLUSIVE") 4de520f1fcef ("Merge tag 'io_uring-futex-2023-10-30' of git://git.kernel.dk/linux") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 5fc16fa5f13b3c06fdb959ef262050bd810416a2 Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe(a)kernel.dk> Date: Sat, 1 Jun 2024 12:25:35 -0600 Subject: [PATCH] io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The trace leading to that looks as follows: BUG: kernel NULL pointer dereference, address: 00000000000000b0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 67 PID: 1633 Comm: buf-ring-invali Not tainted 6.8.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 2/2/2022 RIP: 0010:io_buffer_select+0xc3/0x210 Code: 00 00 48 39 d1 0f 82 ae 00 00 00 48 81 4b 48 00 00 01 00 48 89 73 70 0f b7 50 0c 66 89 53 42 85 ed 0f 85 d2 00 00 00 48 8b 13 <48> 8b 92 b0 00 00 00 48 83 7a 40 00 0f 84 21 01 00 00 4c 8b 20 5b RSP: 0018:ffffb7bec38c7d88 EFLAGS: 00010246 RAX: ffff97af2be61000 RBX: ffff97af234f1700 RCX: 0000000000000040 RDX: 0000000000000000 RSI: ffff97aecfb04820 RDI: ffff97af234f1700 RBP: 0000000000000000 R08: 0000000000200030 R09: 0000000000000020 R10: ffffb7bec38c7dc8 R11: 000000000000c000 R12: ffffb7bec38c7db8 R13: ffff97aecfb05800 R14: ffff97aecfb05800 R15: ffff97af2be5e000 FS: 00007f852f74b740(0000) GS:ffff97b1eeec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000b0 CR3: 000000016deab005 CR4: 0000000000370ef0 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x14d/0x420 ? do_user_addr_fault+0x61/0x6a0 ? exc_page_fault+0x6c/0x150 ? asm_exc_page_fault+0x22/0x30 ? io_buffer_select+0xc3/0x210 __io_import_iovec+0xb5/0x120 io_readv_prep_async+0x36/0x70 io_queue_sqe_fallback+0x20/0x260 io_submit_sqes+0x314/0x630 __do_sys_io_uring_enter+0x339/0xbc0 ? __do_sys_io_uring_register+0x11b/0xc50 ? vm_mmap_pgoff+0xce/0x160 do_syscall_64+0x5f/0x180 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x55e0a110a67e Code: ba cc 00 00 00 45 31 c0 44 0f b6 92 d0 00 00 00 31 d2 41 b9 08 00 00 00 41 83 e2 01 41 c1 e2 04 41 09 c2 b8 aa 01 00 00 0f 05 <c3> 90 89 30 eb a9 0f 1f 40 00 48 8b 42 20 8b 00 a8 06 75 af 85 f6 because the request is marked forced ASYNC and has a bad file fd, and hence takes the forced async prep path. Current kernels with the request async prep cleaned up can no longer hit this issue, but for ease of backporting, let's add this safety check in here too as it really doesn't hurt. For both cases, this will inevitably end with a CQE posted with -EBADF. Cc: stable(a)vger.kernel.org Fixes: a76c0b31eef5 ("io_uring: commit non-pollable provided mapped buffers upfront") Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h index 624ca9076a50..726e6367af4d 100644 --- a/io_uring/io_uring.h +++ b/io_uring/io_uring.h @@ -433,7 +433,7 @@ static inline bool io_file_can_poll(struct io_kiocb *req) { if (req->flags & REQ_F_CAN_POLL) return true; - if (file_can_poll(req->file)) { + if (req->file && file_can_poll(req->file)) { req->flags |= REQ_F_CAN_POLL; return true; }

1 year, 2 months

2
1
0 0

Re: [PATCH 6.9 000/157] 6.9.5-rc1 review

by Ronald Warsow

Hi Greg +++ Update +++ the below crash seems to only to happen with mesa-24.1.x mesa-24.0.9 is fine filled a bug report: https://bugzilla.redhat.com/show_bug.cgi?id=2292434 ==== Jun 13 18:49:22 obelix.fritz.box kernel: RIP: 0010:drm_suballoc_free+0x13/0x110 [drm_suballoc_helper] Jun 13 18:49:22 obelix.fritz.box kernel: Code: eb ce 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 85 ff 0f 84 e1 00 00 00 41 54 55 48 89 fd 53 48 89 f3 <4c> 8b 67 20 4c 89 e7 e8 61 53 bd e2 48 85 db 0f 84 9f 00 00 00 48 Jun 13 18:49:22 obelix.fritz.box kernel: RSP: 0018:ffff9caa851f7630 EFLAGS: 00010286 Jun 13 18:49:22 obelix.fritz.box kernel: RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 000000000000890b Jun 13 18:49:22 obelix.fritz.box kernel: RDX: 00000000000088fb RSI: 0000000000000000 RDI: fffffffffffffe00 Jun 13 18:49:22 obelix.fritz.box kernel: RBP: fffffffffffffe00 R08: 0000000000000000 R09: 0000000000000001 Jun 13 18:49:22 obelix.fritz.box kernel: R10: 0000000000000000 R11: 0000000000000180 R12: ffff8ebf913c1158 Jun 13 18:49:22 obelix.fritz.box kernel: R13: fffffffffffffe00 R14: ffff9caa851f78a8 R15: ffff8ebf913c0000 Jun 13 18:49:22 obelix.fritz.box kernel: FS: 00007fd4f4640b00(0000) GS:ffff8ec2cf980000(0000) knlGS:0000000000000000 Jun 13 18:49:22 obelix.fritz.box kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jun 13 18:49:22 obelix.fritz.box kernel: CR2: fffffffffffffe20 CR3: 0000000110bc4001 CR4: 0000000000770ef0 Jun 13 18:49:22 obelix.fritz.box kernel: PKRU: 55555554 Jun 13 18:49:22 obelix.fritz.box kernel: Call Trace: Jun 13 18:49:22 obelix.fritz.box kernel: <TASK> Jun 13 18:49:22 obelix.fritz.box kernel: ? __die_body.cold+0x19/0x2c Jun 13 18:49:22 obelix.fritz.box kernel: ? page_fault_oops+0x155/0x280 Jun 13 18:49:22 obelix.fritz.box kernel: ? search_module_extables+0x10/0x50 Jun 13 18:49:22 obelix.fritz.box kernel: ? search_bpf_extables+0x56/0x80 Jun 13 18:49:22 obelix.fritz.box kernel: ? exc_page_fault+0x7a/0x80 Jun 13 18:49:22 obelix.fritz.box kernel: ? asm_exc_page_fault+0x22/0x30 Jun 13 18:49:22 obelix.fritz.box kernel: ? drm_suballoc_free+0x13/0x110 [drm_suballoc_helper] Jun 13 18:49:22 obelix.fritz.box kernel: xe_migrate_update_pgtables+0x692/0x9b0 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: ? kmalloc_trace+0x11f/0x2d0 Jun 13 18:49:22 obelix.fritz.box kernel: __xe_pt_bind_vma+0x492/0xbe0 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: xe_vm_bind_vma+0xa6/0x2e0 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: xe_vm_bind+0xf3/0x200 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: __xe_vma_op_execute+0x278/0x490 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: xe_vm_bind_ioctl+0x1ce0/0x1f20 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: drm_ioctl_kernel+0xa7/0x100 [drm] Jun 13 18:49:22 obelix.fritz.box kernel: drm_ioctl+0x312/0x5c0 [drm] Jun 13 18:49:22 obelix.fritz.box kernel: ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: __x64_sys_ioctl+0x40d/0xb70 Jun 13 18:49:22 obelix.fritz.box kernel: do_syscall_64+0x7a/0x160 Jun 13 18:49:22 obelix.fritz.box kernel: ? __x64_sys_ioctl+0x13e/0xb70 Jun 13 18:49:22 obelix.fritz.box kernel: ? __count_memcg_events+0x43/0xb0 Jun 13 18:49:22 obelix.fritz.box kernel: ? handle_mm_fault+0x1f9/0x300 Jun 13 18:49:22 obelix.fritz.box kernel: ? syscall_exit_to_user_mode+0x68/0x1e0 Jun 13 18:49:22 obelix.fritz.box kernel: ? do_syscall_64+0x86/0x160 Jun 13 18:49:22 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 18:49:22 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 18:49:22 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 18:49:22 obelix.fritz.box kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Jun 13 18:49:22 obelix.fritz.box kernel: RIP: 0033:0x7fd4f4d23d2d Jun 13 18:49:22 obelix.fritz.box kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Jun 13 18:49:22 obelix.fritz.box kernel: RSP: 002b:00007fff94738650 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Jun 13 18:49:22 obelix.fritz.box kernel: RAX: ffffffffffffffda RBX: 00007fff94738710 RCX: 00007fd4f4d23d2d Jun 13 18:49:22 obelix.fritz.box kernel: RDX: 00007fff94738710 RSI: 0000000040886445 RDI: 0000000000000010 Jun 13 18:49:22 obelix.fritz.box kernel: RBP: 00007fff947386a0 R08: 0000000000001000 R09: 0000000000000000 Jun 13 18:49:22 obelix.fritz.box kernel: R10: 0000555a7a0fded0 R11: 0000000000000246 R12: 0000000000000010 Jun 13 18:49:22 obelix.fritz.box kernel: R13: 0000000000000000 R14: 0000555a78671160 R15: 0000555a7a234fa0 Jun 13 18:49:22 obelix.fritz.box kernel: </TASK> Jun 13 18:49:22 obelix.fritz.box kernel: Modules linked in: vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) rfcomm nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables bnep iwlmvm mac80211 libarc4 snd_hda_codec_hdmi intel_rapl_common kvm_intel iwlwifi snd_hda_codec_realtek kvm btusb snd_hda_codec_generic btintel snd_hda_scodec_component bluetooth snd_hda_intel cfg80211 snd_intel_dspcfg snd_hda_codec snd_hda_core mei_hdcp mei_pxp rfkill nfnetlink xe drm_ttm_helper ttm agpgart i2c_algo_bit gpu_sched drm_buddy drm_suballoc_helper drm_gpuvm drm_exec drm_display_helper drm_kms_helper drm Jun 13 18:49:22 obelix.fritz.box kernel: CR2: fffffffffffffe20 Jun 13 18:49:22 obelix.fritz.box kernel: ---[ end trace 0000000000000000 ]--- Jun 13 18:49:22 obelix.fritz.box kernel: RIP: 0010:drm_suballoc_free+0x13/0x110 [drm_suballoc_helper] Jun 13 18:49:22 obelix.fritz.box kernel: Code: eb ce 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 85 ff 0f 84 e1 00 00 00 41 54 55 48 89 fd 53 48 89 f3 <4c> 8b 67 20 4c 89 e7 e8 61 53 bd e2 48 85 db 0f 84 9f 00 00 00 48 Jun 13 18:49:22 obelix.fritz.box kernel: RSP: 0018:ffff9caa851f7630 EFLAGS: 00010286 Jun 13 18:49:22 obelix.fritz.box kernel: RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 000000000000890b Jun 13 18:49:22 obelix.fritz.box kernel: RDX: 00000000000088fb RSI: 0000000000000000 RDI: fffffffffffffe00 Jun 13 18:49:22 obelix.fritz.box kernel: RBP: fffffffffffffe00 R08: 0000000000000000 R09: 0000000000000001 Jun 13 18:49:22 obelix.fritz.box kernel: R10: 0000000000000000 R11: 0000000000000180 R12: ffff8ebf913c1158 Jun 13 18:49:22 obelix.fritz.box kernel: R13: fffffffffffffe00 R14: ffff9caa851f78a8 R15: ffff8ebf913c0000 Jun 13 18:49:22 obelix.fritz.box kernel: FS: 00007fd4f4640b00(0000) GS:ffff8ec2cf980000(0000) knlGS:0000000000000000 Jun 13 18:49:22 obelix.fritz.box kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jun 13 18:49:22 obelix.fritz.box kernel: CR2: fffffffffffffe20 CR3: 0000000110bc4001 CR4: 0000000000770ef0 Jun 13 18:49:22 obelix.fritz.box kernel: PKRU: 55555554 Jun 13 18:49:22 obelix.fritz.box kernel: note: Xorg[3657] exited with irqs disabled

1 year, 2 months

1
0
0 0

[PATCH] net: usb: ax88179_178a: fix link status when link is set to down/up

by Jose Ignacio Tornos Martinez

The idea was to keep only one reset at initialization stage in order to reduce the total delay, or the reset from usbnet_probe or the reset from usbnet_open. I have seen that restarting from usbnet_probe is necessary to avoid doing too complex things. But when the link is set to down/up (for example to configure a different mac address) the link is not correctly recovered unless a reset is commanded from usbnet_open. So, detect the initialization stage (first call) to not reset from usbnet_open after the reset from usbnet_probe and after this stage, always reset from usbnet_open too (when the link needs to be rechecked). Apply to all the possible devices, the behavior now is going to be the same. cc: stable(a)vger.kernel.org # 6.6+ Fixes: 56f78615bcb1 ("net: usb: ax88179_178a: avoid writing the mac address before first reading") Reported-by: Isaac Ganoung <inventor500(a)vivaldi.net> Reported-by: Yongqin Liu <yongqin.liu(a)linaro.org> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> --- drivers/net/usb/ax88179_178a.c | 37 ++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 11 deletions(-) diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c index 377be0d9ef14..a0edb410f746 100644 --- a/drivers/net/usb/ax88179_178a.c +++ b/drivers/net/usb/ax88179_178a.c @@ -174,6 +174,7 @@ struct ax88179_data { u32 wol_supported; u32 wolopts; u8 disconnecting; + u8 initialized; }; struct ax88179_int_data { @@ -1672,6 +1673,18 @@ static int ax88179_reset(struct usbnet *dev) return 0; } +static int ax88179_net_reset(struct usbnet *dev) +{ + struct ax88179_data *ax179_data = dev->driver_priv; + + if (ax179_data->initialized) + ax88179_reset(dev); + else + ax179_data->initialized = 1; + + return 0; +} + static int ax88179_stop(struct usbnet *dev) { u16 tmp16; @@ -1691,6 +1704,7 @@ static const struct driver_info ax88179_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1703,6 +1717,7 @@ static const struct driver_info ax88178a_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1715,7 +1730,7 @@ static const struct driver_info cypress_GX3_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1728,7 +1743,7 @@ static const struct driver_info dlink_dub1312_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1741,7 +1756,7 @@ static const struct driver_info sitecom_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1754,7 +1769,7 @@ static const struct driver_info samsung_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1767,7 +1782,7 @@ static const struct driver_info lenovo_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1780,7 +1795,7 @@ static const struct driver_info belkin_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1793,7 +1808,7 @@ static const struct driver_info toshiba_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1806,7 +1821,7 @@ static const struct driver_info mct_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1819,7 +1834,7 @@ static const struct driver_info at_umc2000_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1832,7 +1847,7 @@ static const struct driver_info at_umc200_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, @@ -1845,7 +1860,7 @@ static const struct driver_info at_umc2000sp_info = { .unbind = ax88179_unbind, .status = ax88179_status, .link_reset = ax88179_link_reset, - .reset = ax88179_reset, + .reset = ax88179_net_reset, .stop = ax88179_stop, .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, -- 2.44.0

1 year, 2 months

4
12
0 0

[PATCH 6.6] backport: fix 6.6 backport of changes to fork

by Leah Rumancik

The original backport didn't move the code to link the vma into the MT and also the code to increment the map_count causing ~15 xfstests (including ext4/303 generic/051 generic/054 generic/069) to hard fail on some platforms. This patch resolves test failures. Fixes: cec11fa2eb51 ("fork: defer linking file vma until vma is fully initialized") Signed-off-by: Leah Rumancik <leah.rumancik(a)gmail.com> --- kernel/fork.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index 2eab916b504b..3bf0203c2195 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -733,6 +733,12 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, if (is_vm_hugetlb_page(tmp)) hugetlb_dup_vma_private(tmp); + /* Link the vma into the MT */ + if (vma_iter_bulk_store(&vmi, tmp)) + goto fail_nomem_vmi_store; + + mm->map_count++; + if (tmp->vm_ops && tmp->vm_ops->open) tmp->vm_ops->open(tmp); @@ -752,11 +758,6 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, i_mmap_unlock_write(mapping); } - /* Link the vma into the MT */ - if (vma_iter_bulk_store(&vmi, tmp)) - goto fail_nomem_vmi_store; - - mm->map_count++; if (!(tmp->vm_flags & VM_WIPEONFORK)) retval = copy_page_range(tmp, mpnt); -- 2.45.1.288.g0e0cd299f1-goog

1 year, 2 months

3
6
0 0

[PATCH v2] kcov: don't lose track of remote references during softirqs

by Aleksandr Nogikh

In kcov_remote_start()/kcov_remote_stop(), we swap the previous KCOV metadata of the current task into a per-CPU variable. However, the kcov_mode_enabled(mode) check is not sufficient in the case of remote KCOV coverage: current->kcov_mode always remains KCOV_MODE_DISABLED for remote KCOV objects. If the original task that has invoked the KCOV_REMOTE_ENABLE ioctl happens to get interrupted and kcov_remote_start() is called, it ultimately leads to kcov_remote_stop() NOT restoring the original KCOV reference. So when the task exits, all registered remote KCOV handles remain active forever. Fix it by introducing a special kcov_mode that is assigned to the task that owns a KCOV remote object. It makes kcov_mode_enabled() return true and yet does not trigger coverage collection in __sanitizer_cov_trace_pc() and write_comp_data(). Cc: stable(a)vger.kernel.org Signed-off-by: Aleksandr Nogikh <nogikh(a)google.com> Reviewed-by: Dmitry Vyukov <dvyukov(a)google.com> Reviewed-by: Andrey Konovalov <andreyknvl(a)gmail.com> Tested-by: Andrey Konovalov <andreyknvl(a)gmail.com> Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts") --- Changes v1 -> v2: * Replaced WRITE_ONCE() with an ordinary assignment. * Added stable(a)vger.kernel.org to the Cc list. --- include/linux/kcov.h | 2 ++ kernel/kcov.c | 1 + 2 files changed, 3 insertions(+) diff --git a/include/linux/kcov.h b/include/linux/kcov.h index b851ba415e03..3b479a3d235a 100644 --- a/include/linux/kcov.h +++ b/include/linux/kcov.h @@ -21,6 +21,8 @@ enum kcov_mode { KCOV_MODE_TRACE_PC = 2, /* Collecting comparison operands mode. */ KCOV_MODE_TRACE_CMP = 3, + /* The process owns a KCOV remote reference. */ + KCOV_MODE_REMOTE = 4, }; #define KCOV_IN_CTXSW (1 << 30) diff --git a/kernel/kcov.c b/kernel/kcov.c index c3124f6d5536..f0a69d402066 100644 --- a/kernel/kcov.c +++ b/kernel/kcov.c @@ -632,6 +632,7 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd, return -EINVAL; kcov->mode = mode; t->kcov = kcov; + t->kcov_mode = KCOV_MODE_REMOTE; kcov->t = t; kcov->remote = true; kcov->remote_size = remote_arg->area_size; -- 2.45.2.627.g7a2c4fd464-goog

1 year, 2 months

1
0
0 0

[GIT PULL] memblock:fix validation of NUMA coverage

by Mike Rapoport

Hi Linus, The following changes since commit 1613e604df0cd359cf2a7fbd9be7a0bcfacfabd0: Linux 6.10-rc1 (2024-05-26 15:20:12 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock for you to fetch changes up to 3ac36aa7307363b7247ccb6f6a804e11496b2b36: x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node() (2024-06-06 22:20:39 +0300) ---------------------------------------------------------------- Jan Beulich (2): memblock: make memblock_set_node() also warn about use of MAX_NUMNODES x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node() arch/x86/mm/numa.c | 6 +++--- mm/memblock.c | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) -- Sincerely yours, Mike.

1 year, 2 months

4
7
0 0

[PATCH] net: do not leave dangling sk pointer in inet_create()/inet6_create()

by Ignat Korchagin

It is possible to trigger a use-after-free by: * attaching an fentry probe to __sock_release() and the probe calling the bpf_get_socket_cookie() helper * running traceroute -I 1.1.1.1 on a freshly booted VM A KASAN enabled kernel will log something like below (decoded): [ 78.328507][ T299] ================================================================== [ 78.329018][ T299] BUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) [ 78.329366][ T299] Read of size 8 at addr ffff888007110dd8 by task traceroute/299 [ 78.329366][ T299] [ 78.329366][ T299] CPU: 2 PID: 299 Comm: traceroute Tainted: G E 6.10.0-rc2+ #2 [ 78.329366][ T299] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 78.329366][ T299] Call Trace: [ 78.329366][ T299] <TASK> [ 78.329366][ T299] dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) [ 78.329366][ T299] print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) [ 78.329366][ T299] ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) [ 78.329366][ T299] kasan_report (mm/kasan/report.c:603) [ 78.329366][ T299] ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) [ 78.329366][ T299] kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) [ 78.329366][ T299] __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) [ 78.329366][ T299] bpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) [ 78.329366][ T299] bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e [ 78.329366][ T299] bpf_trampoline_6442506592+0x47/0xaf [ 78.329366][ T299] __sock_release (net/socket.c:652) [ 78.329366][ T299] __sock_create (net/socket.c:1601) [ 78.329366][ T299] ? srso_return_thunk (arch/x86/lib/retpoline.S:224) [ 78.329366][ T299] __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) [ 78.329366][ T299] ? __pfx___sys_socket (net/socket.c:1702) [ 78.329366][ T299] ? srso_return_thunk (arch/x86/lib/retpoline.S:224) [ 78.329366][ T299] ? up_read (./arch/x86/include/asm/atomic64_64.h:79 ./include/linux/atomic/atomic-arch-fallback.h:2749 ./include/linux/atomic/atomic-long.h:184 ./include/linux/atomic/atomic-instrumented.h:3317 kernel/locking/rwsem.c:1347 kernel/locking/rwsem.c:1622) [ 78.329366][ T299] ? srso_return_thunk (arch/x86/lib/retpoline.S:224) [ 78.329366][ T299] ? do_user_addr_fault (arch/x86/mm/fault.c:1419) [ 78.329366][ T299] __x64_sys_socket (net/socket.c:1718) [ 78.329366][ T299] ? srso_return_thunk (arch/x86/lib/retpoline.S:224) [ 78.329366][ T299] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 78.329366][ T299] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 78.329366][ T299] RIP: 0033:0x7f4022818ca7 [ 78.329366][ T299] Code: 73 01 c3 48 8b 0d 59 71 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 29 71 0c 00 f7 d8 64 89 01 48 All code ======== 0: 73 01 jae 0x3 2: c3 ret 3: 48 8b 0d 59 71 0c 00 mov 0xc7159(%rip),%rcx # 0xc7163 a: f7 d8 neg %eax c: 64 89 01 mov %eax,%fs:(%rcx) f: 48 83 c8 ff or $0xffffffffffffffff,%rax 13: c3 ret 14: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 1b: 00 00 00 1e: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 23: b8 29 00 00 00 mov $0x29,%eax 28: 0f 05 syscall 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 01 jae 0x33 32: c3 ret 33: 48 8b 0d 29 71 0c 00 mov 0xc7129(%rip),%rcx # 0xc7163 3a: f7 d8 neg %eax 3c: 64 89 01 mov %eax,%fs:(%rcx) 3f: 48 rex.W Code starting with the faulting instruction =========================================== 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 6: 73 01 jae 0x9 8: c3 ret 9: 48 8b 0d 29 71 0c 00 mov 0xc7129(%rip),%rcx # 0xc7139 10: f7 d8 neg %eax 12: 64 89 01 mov %eax,%fs:(%rcx) 15: 48 rex.W [ 78.329366][ T299] RSP: 002b:00007ffd57e63db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 78.329366][ T299] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f4022818ca7 [ 78.329366][ T299] RDX: 0000000000000001 RSI: 0000000000000002 RDI: 0000000000000002 [ 78.329366][ T299] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000564be3dc8ec0 [ 78.329366][ T299] R10: 0c41e8ba3f6107df R11: 0000000000000246 R12: 0000564bbab801e0 [ 78.329366][ T299] R13: 0000000000000000 R14: 0000564bbab7db18 R15: 00007f4022934020 [ 78.329366][ T299] </TASK> [ 78.329366][ T299] [ 78.329366][ T299] Allocated by task 299 on cpu 2 at 78.328492s: [ 78.329366][ T299] kasan_save_stack (mm/kasan/common.c:48) [ 78.329366][ T299] kasan_save_track (mm/kasan/common.c:68) [ 78.329366][ T299] __kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338) [ 78.329366][ T299] kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007) [ 78.329366][ T299] sk_prot_alloc (net/core/sock.c:2075) [ 78.329366][ T299] sk_alloc (net/core/sock.c:2134) [ 78.329366][ T299] inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252) [ 78.329366][ T299] __sock_create (net/socket.c:1572) [ 78.329366][ T299] __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) [ 78.329366][ T299] __x64_sys_socket (net/socket.c:1718) [ 78.329366][ T299] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 78.329366][ T299] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 78.329366][ T299] [ 78.329366][ T299] Freed by task 299 on cpu 2 at 78.328502s: [ 78.329366][ T299] kasan_save_stack (mm/kasan/common.c:48) [ 78.329366][ T299] kasan_save_track (mm/kasan/common.c:68) [ 78.329366][ T299] kasan_save_free_info (mm/kasan/generic.c:582) [ 78.329366][ T299] poison_slab_object (mm/kasan/common.c:242) [ 78.329366][ T299] __kasan_slab_free (mm/kasan/common.c:256) [ 78.329366][ T299] kmem_cache_free (mm/slub.c:4437 mm/slub.c:4511) [ 78.329366][ T299] __sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208) [ 78.329366][ T299] inet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252) [ 78.329366][ T299] __sock_create (net/socket.c:1572) [ 78.329366][ T299] __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) [ 78.329366][ T299] __x64_sys_socket (net/socket.c:1718) [ 78.329366][ T299] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 78.329366][ T299] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 78.329366][ T299] [ 78.329366][ T299] The buggy address belongs to the object at ffff888007110d80 [ 78.329366][ T299] which belongs to the cache PING of size 976 [ 78.329366][ T299] The buggy address is located 88 bytes inside of [ 78.329366][ T299] freed 976-byte region [ffff888007110d80, ffff888007111150) [ 78.329366][ T299] [ 78.329366][ T299] The buggy address belongs to the physical page: [ 78.329366][ T299] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7110 [ 78.329366][ T299] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 78.329366][ T299] flags: 0x1ffff800000040(head|node=0|zone=1|lastcpupid=0x1ffff) [ 78.329366][ T299] page_type: 0xffffefff(slab) [ 78.329366][ T299] raw: 001ffff800000040 ffff888002f328c0 dead000000000122 0000000000000000 [ 78.329366][ T299] raw: 0000000000000000 00000000801c001c 00000001ffffefff 0000000000000000 [ 78.329366][ T299] head: 001ffff800000040 ffff888002f328c0 dead000000000122 0000000000000000 [ 78.329366][ T299] head: 0000000000000000 00000000801c001c 00000001ffffefff 0000000000000000 [ 78.329366][ T299] head: 001ffff800000003 ffffea00001c4401 ffffffffffffffff 0000000000000000 [ 78.329366][ T299] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 78.329366][ T299] page dumped because: kasan: bad access detected [ 78.329366][ T299] [ 78.329366][ T299] Memory state around the buggy address: [ 78.329366][ T299] ffff888007110c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.329366][ T299] ffff888007110d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.329366][ T299] >ffff888007110d80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.329366][ T299] ^ [ 78.329366][ T299] ffff888007110e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.329366][ T299] ffff888007110e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.329366][ T299] ================================================================== [ 78.366431][ T299] Disabling lock debugging due to kernel taint Fix this by ensuring the error path of inet_create()/inet6_create do not leave a dangling sk pointer after sk was released. Fixes: 086c653f5862 ("sock: struct proto hash function may error") Fixes: 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications") Cc: stable(a)vger.kernel.org Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> --- net/ipv4/af_inet.c | 3 +++ net/ipv6/af_inet6.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index b24d74616637..db53701db29e 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -378,6 +378,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, err = sk->sk_prot->hash(sk); if (err) { sk_common_release(sk); + sock->sk = NULL; goto out; } } @@ -386,6 +387,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, err = sk->sk_prot->init(sk); if (err) { sk_common_release(sk); + sock->sk = NULL; goto out; } } @@ -394,6 +396,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); if (err) { sk_common_release(sk); + sock->sk = NULL; goto out; } } diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index 8041dc181bd4..6d5ebb2af928 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -254,6 +254,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, err = sk->sk_prot->hash(sk); if (err) { sk_common_release(sk); + sock->sk = NULL; goto out; } } @@ -261,6 +262,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, err = sk->sk_prot->init(sk); if (err) { sk_common_release(sk); + sock->sk = NULL; goto out; } } @@ -269,6 +271,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); if (err) { sk_common_release(sk); + sock->sk = NULL; goto out; } } -- 2.39.2

1 year, 2 months

2
4
0 0

[PATCH v2] kasan: fix bad call to unpoison_slab_object

by andrey.konovalov＠linux.dev

From: Andrey Konovalov <andreyknvl(a)gmail.com> Commit 29d7355a9d05 ("kasan: save alloc stack traces for mempool") messed up one of the calls to unpoison_slab_object: the last two arguments are supposed to be GFP flags and whether to init the object memory. Fix the call. Without this fix, __kasan_mempool_unpoison_object provides the object's size as GFP flags to unpoison_slab_object, which can cause LOCKDEP reports (and probably other issues). Fixes: 29d7355a9d05 ("kasan: save alloc stack traces for mempool") Reported-by: Brad Spengler <spender(a)grsecurity.net> Cc: stable(a)vger.kernel.org Acked-by: Marco Elver <elver(a)google.com> Signed-off-by: Andrey Konovalov <andreyknvl(a)gmail.com> --- Changes v1->v2: - Fix typo in commit message. - CC stable. --- mm/kasan/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index e7c9a4dc89f8..85e7c6b4575c 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -532,7 +532,7 @@ void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip) return; /* Unpoison the object and save alloc info for non-kmalloc() allocations. */ - unpoison_slab_object(slab->slab_cache, ptr, size, flags); + unpoison_slab_object(slab->slab_cache, ptr, flags, false); /* Poison the redzone and save alloc info for kmalloc() allocations. */ if (is_kmalloc_cache(slab->slab_cache)) -- 2.25.1

1 year, 2 months

1
0
0 0

[PATCH v2 1/2] drm/i915/mso: using joiner is not possible with eDP MSO

by Jani Nikula

It's not possible to use the joiner at the same time with eDP MSO. When a panel needs MSO, it's not optional, so MSO trumps joiner. While just reporting false for intel_dp_has_joiner() should be sufficient, also skip creation of the joiner force enable debugfs to better handle this in testing. Cc: stable(a)vger.kernel.org Cc: Ville Syrjala <ville.syrjala(a)linux.intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1668 Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> --- drivers/gpu/drm/i915/display/intel_display_debugfs.c | 8 ++++++-- drivers/gpu/drm/i915/display/intel_dp.c | 4 ++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_display_debugfs.c b/drivers/gpu/drm/i915/display/intel_display_debugfs.c index 91757fed9c6d..5eb31404436c 100644 --- a/drivers/gpu/drm/i915/display/intel_display_debugfs.c +++ b/drivers/gpu/drm/i915/display/intel_display_debugfs.c @@ -1546,8 +1546,12 @@ void intel_connector_debugfs_add(struct intel_connector *connector) if (DISPLAY_VER(i915) >= 11 && (connector_type == DRM_MODE_CONNECTOR_DisplayPort || connector_type == DRM_MODE_CONNECTOR_eDP)) { - debugfs_create_bool("i915_bigjoiner_force_enable", 0644, root, - &connector->force_bigjoiner_enable); + struct intel_dp *intel_dp = intel_attached_dp(connector); + + /* eDP MSO is not compatible with joiner */ + if (!intel_dp->mso_link_count) + debugfs_create_bool("i915_bigjoiner_force_enable", 0644, root, + &connector->force_bigjoiner_enable); } if (connector_type == DRM_MODE_CONNECTOR_DSI || diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c index 9a9bb0f5b7fe..ab33c9de393a 100644 --- a/drivers/gpu/drm/i915/display/intel_dp.c +++ b/drivers/gpu/drm/i915/display/intel_dp.c @@ -465,6 +465,10 @@ bool intel_dp_has_joiner(struct intel_dp *intel_dp) struct intel_encoder *encoder = &intel_dig_port->base; struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); + /* eDP MSO is not compatible with joiner */ + if (intel_dp->mso_link_count) + return false; + return DISPLAY_VER(dev_priv) >= 12 || (DISPLAY_VER(dev_priv) == 11 && encoder->port != PORT_A); -- 2.39.2

1 year, 2 months

2
2
0 0

Please backport 2d43cc701b96 to v6.9 and v6.6

by Michael Ellerman

Hi stable team, Can you please backport: 2d43cc701b96 ("powerpc/uaccess: Fix build errors seen with GCC 13/14") To v6.9 and v6.6. It was marked for backporting, but hasn't been picked up AFAICS. I'm not sure if it clashed with the asm_goto_output changes or something. But it backports cleanly to the current stable branches. It needs a custom backport for earlier kernels, I'll send those. cheers

1 year, 2 months

2
2
0 0

[PATCH v6.1] powerpc/uaccess: Fix build errors seen with GCC 13/14

by Michael Ellerman

commit 2d43cc701b96f910f50915ac4c2a0cae5deb734c upstream. Building ppc64le_defconfig with GCC 14 fails with assembler errors: CC fs/readdir.o /tmp/ccdQn0mD.s: Assembler messages: /tmp/ccdQn0mD.s:212: Error: operand out of domain (18 is not a multiple of 4) /tmp/ccdQn0mD.s:226: Error: operand out of domain (18 is not a multiple of 4) ... [6 lines] /tmp/ccdQn0mD.s:1699: Error: operand out of domain (18 is not a multiple of 4) A snippet of the asm shows: # ../fs/readdir.c:210: unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); ld 9,0(29) # MEM[(u64 *)name_38(D) + _88 * 1], MEM[(u64 *)name_38(D) + _88 * 1] # 210 "../fs/readdir.c" 1 1: std 9,18(8) # put_user # *__pus_addr_52, MEM[(u64 *)name_38(D) + _88 * 1] The 'std' instruction requires a 4-byte aligned displacement because it is a DS-form instruction, and as the assembler says, 18 is not a multiple of 4. A similar error is seen with GCC 13 and CONFIG_UBSAN_SIGNED_WRAP=y. The fix is to change the constraint on the memory operand to put_user(), from "m" which is a general memory reference to "YZ". The "Z" constraint is documented in the GCC manual PowerPC machine constraints, and specifies a "memory operand accessed with indexed or indirect addressing". "Y" is not documented in the manual but specifies a "memory operand for a DS-form instruction". Using both allows the compiler to generate a DS-form "std" or X-form "stdx" as appropriate. Unfortunately clang doesn't support the "Y" constraint so that has to be behind an ifdef. Although the build error is only seen with GCC 13/14, that appears to just be luck. The constraint has been incorrect since it was first added. Fixes: c20beffeec3c ("powerpc/uaccess: Use flexible addressing with __put_user()/__get_user()") Suggested-by: Kewen Lin <linkw(a)gcc.gnu.org> [mpe: Drop CONFIG_PPC_KERNEL_PREFIXED ifdef for backport] Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240529123029.146953-1-mpe@ellerman.id.au --- arch/powerpc/include/asm/uaccess.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h index 45d4c9cf3f3a..661046150e49 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -80,9 +80,20 @@ __pu_failed: \ : \ : label) +#ifdef CONFIG_CC_IS_CLANG +#define DS_FORM_CONSTRAINT "Z<>" +#else +#define DS_FORM_CONSTRAINT "YZ<>" +#endif + #ifdef __powerpc64__ -#define __put_user_asm2_goto(x, ptr, label) \ - __put_user_asm_goto(x, ptr, label, "std") +#define __put_user_asm2_goto(x, addr, label) \ + asm goto ("1: std%U1%X1 %0,%1 # put_user\n" \ + EX_TABLE(1b, %l2) \ + : \ + : "r" (x), DS_FORM_CONSTRAINT (*addr) \ + : \ + : label) #else /* __powerpc64__ */ #define __put_user_asm2_goto(x, addr, label) \ asm goto( \ -- 2.45.1

1 year, 2 months

1
0
0 0

[PATCH v5.15] powerpc/uaccess: Fix build errors seen with GCC 13/14

by Michael Ellerman

commit 2d43cc701b96f910f50915ac4c2a0cae5deb734c upstream. Building ppc64le_defconfig with GCC 14 fails with assembler errors: CC fs/readdir.o /tmp/ccdQn0mD.s: Assembler messages: /tmp/ccdQn0mD.s:212: Error: operand out of domain (18 is not a multiple of 4) /tmp/ccdQn0mD.s:226: Error: operand out of domain (18 is not a multiple of 4) ... [6 lines] /tmp/ccdQn0mD.s:1699: Error: operand out of domain (18 is not a multiple of 4) A snippet of the asm shows: # ../fs/readdir.c:210: unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); ld 9,0(29) # MEM[(u64 *)name_38(D) + _88 * 1], MEM[(u64 *)name_38(D) + _88 * 1] # 210 "../fs/readdir.c" 1 1: std 9,18(8) # put_user # *__pus_addr_52, MEM[(u64 *)name_38(D) + _88 * 1] The 'std' instruction requires a 4-byte aligned displacement because it is a DS-form instruction, and as the assembler says, 18 is not a multiple of 4. A similar error is seen with GCC 13 and CONFIG_UBSAN_SIGNED_WRAP=y. The fix is to change the constraint on the memory operand to put_user(), from "m" which is a general memory reference to "YZ". The "Z" constraint is documented in the GCC manual PowerPC machine constraints, and specifies a "memory operand accessed with indexed or indirect addressing". "Y" is not documented in the manual but specifies a "memory operand for a DS-form instruction". Using both allows the compiler to generate a DS-form "std" or X-form "stdx" as appropriate. Unfortunately clang doesn't support the "Y" constraint so that has to be behind an ifdef. Although the build error is only seen with GCC 13/14, that appears to just be luck. The constraint has been incorrect since it was first added. Fixes: c20beffeec3c ("powerpc/uaccess: Use flexible addressing with __put_user()/__get_user()") Suggested-by: Kewen Lin <linkw(a)gcc.gnu.org> [mpe: Drop CONFIG_PPC_KERNEL_PREFIXED ifdef for backport] Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240529123029.146953-1-mpe@ellerman.id.au --- arch/powerpc/include/asm/uaccess.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h index b2680070d65d..6013a7fc74ba 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -90,9 +90,20 @@ __pu_failed: \ : \ : label) +#ifdef CONFIG_CC_IS_CLANG +#define DS_FORM_CONSTRAINT "Z<>" +#else +#define DS_FORM_CONSTRAINT "YZ<>" +#endif + #ifdef __powerpc64__ -#define __put_user_asm2_goto(x, ptr, label) \ - __put_user_asm_goto(x, ptr, label, "std") +#define __put_user_asm2_goto(x, addr, label) \ + asm goto ("1: std%U1%X1 %0,%1 # put_user\n" \ + EX_TABLE(1b, %l2) \ + : \ + : "r" (x), DS_FORM_CONSTRAINT (*addr) \ + : \ + : label) #else /* __powerpc64__ */ #define __put_user_asm2_goto(x, addr, label) \ asm_volatile_goto( \ -- 2.45.1

1 year, 2 months

1
0
0 0

[PATCH 6.6 000/301] 6.6.31-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.31 release. There are 301 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 16 May 2024 10:09:32 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.31-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.31-rc1 Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: fix firmware check error path Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: fix info leak when fetching fw build id Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: fix info leak when fetching board id Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: generalise device address check Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: fix NVM configuration parsing Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: add missing firmware sanity checks Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: fix wcn3991 device address check Johan Hovold <johan+linaro(a)kernel.org> Bluetooth: qca: fix invalid device address check Steven Rostedt (Google) <rostedt(a)goodmis.org> eventfs: Do not treat events directory different than other directories Steven Rostedt (Google) <rostedt(a)goodmis.org> eventfs: Do not differentiate the toplevel events directory Steven Rostedt (Google) <rostedt(a)goodmis.org> tracefs: Still use mount point as default permissions for instances Steven Rostedt (Google) <rostedt(a)goodmis.org> tracefs: Reset permissions on remount if permissions are options Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: do not grant v2 lease if parent lease key and epoch are not set Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: avoid to send duplicate lease break notifications Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: off ipv6only for both ipv4/ipv6 binding Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: fix setting spi bus clock rate Johan Hovold <johan+linaro(a)kernel.org> regulator: core: fix debugfs creation regression Sean Anderson <sean.anderson(a)linux.dev> nvme-pci: Add quirk for broken MSIs Peter Xu <peterx(a)redhat.com> mm/userfaultfd: reset ptes when close() for wr-protected ones Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: use memalloc_nofs_save() in page_cache_ra_order() Michael Ellerman <mpe(a)ellerman.id.au> selftests/mm: fix powerpc ARCH check Thomas Gleixner <tglx(a)linutronix.de> x86/apic: Don't access the APIC when disabling x2APIC Lakshmi Yadlapati <lakshmiy(a)us.ibm.com> hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> net: fix out-of-bounds access in ops_init Volodymyr Babchuk <Volodymyr_Babchuk(a)epam.com> arm64: dts: qcom: sa8155p-adp: fix SDHC2 CD pin configuration Hersen Wu <hersenxs.wu(a)amd.com> drm/amd/display: Fix incorrect DSC instance for MST George Shen <george.shen(a)amd.com> drm/amd/display: Handle Y carry-over in VCP X.Y calculation Karthikeyan Ramasubramanian <kramasub(a)chromium.org> drm/i915/bios: Fix parsing backlight BDB data Andi Shyti <andi.shyti(a)linux.intel.com> drm/i915/gt: Automate CCS Mode setting during engine resets Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/i915/audio: Fix audio time stamp programming for DP Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: Fix invalid reads in fence signaled events Ian Forbes <ian.forbes(a)broadcom.com> drm/vmwgfx: Fix Legacy Display Unit Zack Rusin <zack.rusin(a)broadcom.com> drm/ttm: Print the memory decryption status just once Alex Deucher <alexander.deucher(a)amd.com> drm/amdkfd: don't allow mapping the MMIO HDP page with large pages Dave Airlie <airlied(a)redhat.com> Revert "drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()" Lyude Paul <lyude(a)redhat.com> drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor() Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add lunar lake point M DID Frank Oltmanns <frank(a)oltmanns.dev> clk: sunxi-ng: a64: Set minimum and maximum rate for PLL-MIPI Frank Oltmanns <frank(a)oltmanns.dev> clk: sunxi-ng: common: Support minimum and maximum rate Viken Dadhaniya <quic_vdadhani(a)quicinc.com> slimbus: qcom-ngd-ctrl: Add timeout for wait operation Jim Cromie <jim.cromie(a)gmail.com> dyndbg: fix old BUG_ON in >control parser Joao Paulo Goncalves <joao.goncalves(a)toradex.com> ASoC: ti: davinci-mcasp: Fix race condition during probe Sameer Pujar <spujar(a)nvidia.com> ASoC: tegra: Fix DSPK 16-bit playback Doug Berger <opendmb(a)gmail.com> net: bcmgenet: synchronize UMAC_CMD access Doug Berger <opendmb(a)gmail.com> net: bcmgenet: synchronize use of bcmgenet_set_rx_mode() Doug Berger <opendmb(a)gmail.com> net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access Max Filippov <jcmvbkbc(a)gmail.com> xtensa: fix MAKE_PC_FROM_RA second argument Paolo Abeni <pabeni(a)redhat.com> tipc: fix UAF in error path Vitaly Lifshits <vitaly.lifshits(a)intel.com> e1000e: change usleep_range to udelay in PHY mdic access Alexander Potapenko <glider(a)google.com> kmsan: compiler_types: declare __no_sanitize_or_inline Hans de Goede <hdegoede(a)redhat.com> iio: accel: mxc4005: Interrupt handling fixes Vasileios Amoiridis <vassilisamir(a)gmail.com> iio: pressure: Fixes BME280 SPI driver data Ramona Gradinariu <ramona.bolboaca13(a)gmail.com> iio:imu: adis16475: Fix sync mode setting Javier Carrasco <javier.carrasco.cruz(a)gmail.com> dt-bindings: iio: health: maxim,max30102: fix compatible check Sven Schnelle <svens(a)linux.ibm.com> workqueue: Fix selection of wake_cpu in kick_pool() Gregory Detal <gregory.detal(a)gmail.com> mptcp: only allow set existing scheduler for net.mptcp.scheduler Paolo Abeni <pabeni(a)redhat.com> mptcp: ensure snd_nxt is properly initialized on connect Dan Carpenter <dan.carpenter(a)linaro.org> mm/slab: make __free(kfree) accept error pointers Liam R. Howlett <Liam.Howlett(a)oracle.com> maple_tree: fix mas_empty_area_rev() null pointer dereference Qu Wenruo <wqu(a)suse.com> btrfs: set correct ram_bytes when splitting ordered extent Dominique Martinet <dominique.martinet(a)atmark-techno.com> btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() Takashi Sakamoto <o-takashi(a)sakamocchi.jp> firewire: ohci: fulfill timestamp for some local asynchronous transaction Aman Dhoot <amandhoot12(a)gmail.com> ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Check for port partner validity before consuming it Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: unregister existing source caps before re-registration RD Babiera <rdbabiera(a)google.com> usb: typec: tcpm: clear pd_event queue in PORT_RESET Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: core: Prevent phy suspend during init Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: xhci-plat: Don't include xhci.h Chris Wulff <Chris.Wulff(a)biamp.com> usb: gadget: f_fs: Fix a race condition when processing setup packets. Wesley Cheng <quic_wcheng(a)quicinc.com> usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete Ivan Avdeev <me(a)provod.works> usb: gadget: uvc: use correct buffer size when parsing configfs lists Peter Korsgaard <peter(a)korsgaard.com> usb: gadget: composite: fix OS descriptors w_value logic Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix access violation during port device removal Guenter Roeck <linux(a)roeck-us.net> usb: ohci: Prevent missed ohci interrupts Alan Stern <stern(a)rowland.harvard.edu> usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device Christian A. Ehrhardt <lk(a)c--e.de> usb: typec: ucsi: Fix connector check on init Christian A. Ehrhardt <lk(a)c--e.de> usb: typec: ucsi: Check for notifications after init Linus Torvalds <torvalds(a)linux-foundation.org> Reapply "drm/qxl: simplify qxl_fence_wait" Thanassis Avgerinos <thanassis.avgerinos(a)gmail.com> firewire: nosy: ensure user_length is taken into account when fetching packet contents Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() Christian König <christian.koenig(a)amd.com> drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 Michel Dänzer <mdaenzer(a)redhat.com> drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible Gabe Teeger <gabe.teeger(a)amd.com> drm/amd/display: Atom Integrated System Info v2_2 for DCN35 Kent Gibson <warthog618(a)gmail.com> gpiolib: cdev: fix uninitialised kfifo Kent Gibson <warthog618(a)gmail.com> gpiolib: cdev: relocate debounce_period_us from struct gpio_desc Zhongqiu Han <quic_zhonhan(a)quicinc.com> gpiolib: cdev: Fix use after free in lineinfo_changed_notify Mario Limonciello <mario.limonciello(a)amd.com> dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users Douglas Anderson <dianders(a)chromium.org> drm/connector: Add \n to message about demoting connector force-probes Jerome Brunet <jbrunet(a)baylibre.com> drm/meson: dw-hdmi: add bandgap setting for g12 Jerome Brunet <jbrunet(a)baylibre.com> drm/meson: dw-hdmi: power up phy on device init Steffen Bätz <steffen(a)innosonix.de> net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family Yonglong Liu <liuyonglong(a)huawei.com> net: hns3: fix kernel crash when devlink reload during initialization Yonglong Liu <liuyonglong(a)huawei.com> net: hns3: fix port vlan filter not disabled issue Peiyang Wang <wangpeiyang1(a)huawei.com> net: hns3: use appropriate barrier function after setting a bit value Peiyang Wang <wangpeiyang1(a)huawei.com> net: hns3: release PTP resources if pf initialization failed Peiyang Wang <wangpeiyang1(a)huawei.com> net: hns3: change type of numa_node_mask as nodemask_t Jian Shen <shenjian15(a)huawei.com> net: hns3: direct return when receive a unknown mailbox message Peiyang Wang <wangpeiyang1(a)huawei.com> net: hns3: using user configure after hardware reset Wen Gu <guwen(a)linux.alibaba.com> net/smc: fix neighbour and rtable leak in smc_ib_find_route() Eric Dumazet <edumazet(a)google.com> ipv6: prevent NULL dereference in ip6_output() Eric Dumazet <edumazet(a)google.com> ipv6: annotate data-races around cnf.disable_ipv6 Lukasz Majewski <lukma(a)denx.de> hsr: Simplify code for announcing HSR nodes timer setup Eric Dumazet <edumazet(a)google.com> net-sysfs: convert dev->operstate reads to lockless ones Eric Dumazet <edumazet(a)google.com> ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() Daniel Golle <daniel(a)makrotopia.org> dt-bindings: net: mediatek: remove wrongly added clocks and SerDes David Howells <dhowells(a)redhat.com> rxrpc: Only transmit one ACK per jumbo packet received David Howells <dhowells(a)redhat.com> rxrpc: Fix congestion control algorithm David Howells <dhowells(a)redhat.com> rxrpc: Fix the names of the fields in the ACK trailer struct Ido Schimmel <idosch(a)nvidia.com> selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC Hangbin Liu <liuhangbin(a)gmail.com> selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace Shigeru Yoshida <syoshida(a)redhat.com> ipv6: Fix potential uninit-value access in __ip6_make_skb() Felix Fietkau <nbd(a)nbd.name> net: bridge: fix corrupted ethernet header on multicast-to-unicast Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> nfc: nci: Fix kcov check in nci_rx_work() Eric Dumazet <edumazet(a)google.com> phonet: fix rtm_phonet_notify() skb allocation Aleksa Savic <savicaleksa83(a)gmail.com> hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock Aleksa Savic <savicaleksa83(a)gmail.com> hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() Aleksa Savic <savicaleksa83(a)gmail.com> hwmon: (corsair-cpro) Use a separate buffer for sending commands Roded Zats <rzats(a)paloaltonetworks.com> rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Marek Vasut <marex(a)denx.de> net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs Duoming Zhou <duoming(a)zju.edu.cn> Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout Sungwoo Kim <iam(a)sung-woo.kim> Bluetooth: HCI: Fix potential null-ptr-deref Sungwoo Kim <iam(a)sung-woo.kim> Bluetooth: msft: fix slab-use-after-free in msft_do_close() Duoming Zhou <duoming(a)zju.edu.cn> Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Eric Dumazet <edumazet(a)google.com> tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets Boy.Wu <boy.wu(a)mediatek.com> ARM: 9381/1: kasan: clear stale stack poison Paul Davey <paul.davey(a)alliedtelesis.co.nz> xfrm: Preserve vlan tags for transport mode software GRO Al Viro <viro(a)zeniv.linux.org.uk> qibfs: fix dentry leak Olga Kornievskaia <kolga(a)netapp.com> SUNRPC: add a missing rpc_stat for TCP TLS Li Nan <linan122(a)huawei.com> blk-iocost: do not WARN if iocg was already offlined Vanillan Wang <vanillanwang(a)163.com> net:usb:qmi_wwan: support Rolling modules Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: silence UBSAN warning (v3) Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add Granite Rapids-D to HPM CPU list Lyude Paul <lyude(a)redhat.com> drm/nouveau/dp: Don't probe eDP ports twice harder Krzysztof Kozlowski <krzk(a)kernel.org> gpio: lpc32xx: fix module autoloading Joakim Sindholt <opensource(a)zhasha.com> fs/9p: drop inodes immediately on non-.L too Stephen Boyd <sboyd(a)kernel.org> clk: Don't hold prepare_lock when calling kref_put() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpio: crystalcove: Use -ENOTSUPP consistently Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpio: wcove: Use -ENOTSUPP consistently Michael Ellerman <mpe(a)ellerman.id.au> powerpc/crypto/chacha-p10: Fix failure on non Power10 Jeff Layton <jlayton(a)kernel.org> 9p: explicitly deny setlease attempts Joakim Sindholt <opensource(a)zhasha.com> fs/9p: fix the cache always being enabled on files with qid flags Joakim Sindholt <opensource(a)zhasha.com> fs/9p: translate O_TRUNC into OTRUNC Joakim Sindholt <opensource(a)zhasha.com> fs/9p: only translate RWX permissions for plain 9P2000 Krzysztof Kozlowski <krzk(a)kernel.org> iommu: mtk: fix module autoloading Steve French <stfrench(a)microsoft.com> smb3: fix broken reconnect when password changing on the server by allowing password rotation Michael Kelley <mhklinux(a)outlook.com> Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted Rick Edgecombe <rick.p.edgecombe(a)intel.com> uio_hv_generic: Don't free decrypted memory Rick Edgecombe <rick.p.edgecombe(a)intel.com> hv_netvsc: Don't free decrypted memory Rick Edgecombe <rick.p.edgecombe(a)intel.com> Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl Rick Edgecombe <rick.p.edgecombe(a)intel.com> Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails John Stultz <jstultz(a)google.com> selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior Zhigang Luo <Zhigang.Luo(a)amd.com> amd/amdkfd: sync all devices to wait all processes being evicted Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix VCN allocation in CPX partition Alex Hung <alex.hung(a)amd.com> drm/amd/display: Skip on writeback when it's not applicable Tao Zhou <tao.zhou1(a)amd.com> drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2 Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Refine IB schedule error logging Justin Ernst <justin.ernst(a)hpe.com> tools/power/turbostat: Fix uncore frequency file string Jiaxun Yang <jiaxun.yang(a)flygoat.com> MIPS: scall: Save thread_info.syscall unconditionally on entry Thierry Reding <treding(a)nvidia.com> gpu: host1x: Do not setup DMA for virtual devices Rik van Riel <riel(a)surriel.com> blk-iocost: avoid out of bounds shift Xiang Chen <chenxiang66(a)hisilicon.com> scsi: hisi_sas: Handle the NCQ error returned by D2H frame Maurizio Lombardi <mlombard(a)redhat.com> scsi: target: Fix SELinux error when systemd-modules loads the target module Wei Yang <richard.weiyang(a)gmail.com> memblock tests: fix undefined reference to `BIT' Wei Yang <richard.weiyang(a)gmail.com> memblock tests: fix undefined reference to `panic' Wei Yang <richard.weiyang(a)gmail.com> memblock tests: fix undefined reference to `early_pfn_to_nid' Boris Burkov <boris(a)bur.io> btrfs: always clear PERTRANS metadata during commit Boris Burkov <boris(a)bur.io> btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve Len Brown <len.brown(a)intel.com> tools/power turbostat: Fix warning upon failed /dev/cpu_dma_latency read Patryk Wlazlyn <patryk.wlazlyn(a)linux.intel.com> tools/power turbostat: Print ucode revision only if valid Peng Liu <liupeng17(a)lenovo.com> tools/power turbostat: Fix Bzy_MHz documentation typo Wyes Karny <wyes.karny(a)amd.com> tools/power turbostat: Increase the limit for fd opened Doug Smythies <dsmythies(a)telus.net> tools/power turbostat: Fix added raw MSR output Adam Goldman <adamg(a)pobox.com> firewire: ohci: mask bus reset interrupts between ISR and bottom half Chen Ni <nichen(a)iscas.ac.cn> ata: sata_gemini: Check clk_enable() result Jeff Layton <jlayton(a)kernel.org> vboxsf: explicitly deny setlease attempts Phil Elwell <phil(a)raspberrypi.com> net: bcmgenet: Reset RBUF on first open Li Nan <linan122(a)huawei.com> block: fix overflow in blk_ioctl_discard() Takashi Iwai <tiwai(a)suse.de> ALSA: line6: Zero-initialize message buffers Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Fix MCQ mode dev command timeout Yihang Li <liyihang9(a)huawei.com> scsi: libsas: Align SMP request allocation to ARCH_DMA_MINALIGN Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: WLUN suspend dev/link state error recovery André Apitzsch <git(a)apitzsch.eu> regulator: tps65132: Add of_match table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend Borislav Petkov (AMD) <bp(a)alien8.de> kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries Mark Rutland <mark.rutland(a)arm.com> selftests/ftrace: Fix event filter target_func selection Andrei Matei <andreimatei1(a)gmail.com> bpf: Check bloom filter map value size Jonathan Kim <Jonathan.Kim(a)amd.com> drm/amdkfd: range check cp bad op exception interrupts Mukul Joshi <mukul.joshi(a)amd.com> drm/amdkfd: Check cgroup when returning DMABuf info Anand Jain <anand.jain(a)oracle.com> btrfs: return accurate error code on open failure in open_fs_devices() Saurav Kashyap <skashyap(a)marvell.com> scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> scsi: mpi3mr: Avoid memcpy field-spanning write WARNING linke li <lilinke99(a)qq.com> net: mark racy access on sk->sk_rcvbuf Benjamin Berg <benjamin.berg(a)intel.com> wifi: iwlwifi: mvm: guard against invalid STA ID on removal Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: read txq->read_ptr under lock Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: fix prep_connection error path Igor Artemiev <Igor.A.Artemiev(a)mcst.ru> wifi: cfg80211: fix rdev_dump_mpp() arguments order Jeff Johnson <quic_jjohnson(a)quicinc.com> wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc Andrew Price <anprice(a)redhat.com> gfs2: Fix invalid metadata access in punch_hole Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Use a dedicated lock for ras_fwlog state Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port() Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Move NPIV's transport unregistration to after resource clean up Rohit Ner <rohitner(a)google.com> scsi: ufs: core: Fix MCQ MAC configuration Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() Marc Zyngier <maz(a)kernel.org> KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id Will Deacon <will(a)kernel.org> swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE Nayna Jain <nayna(a)linux.ibm.com> powerpc/pseries: make max polling consistent for longer H_CALLs Jernej Skrabec <jernej.skrabec(a)gmail.com> clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change Adam Skladowski <a39.skl(a)gmail.com> clk: qcom: smd-rpm: Restore msm8976 num_clk Richard Gobert <richardbgobert(a)gmail.com> net: gro: add flush check in udp_gro_receive_segment Richard Gobert <richardbgobert(a)gmail.com> net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb Richard Gobert <richardbgobert(a)gmail.com> net: gro: parse ipv6 ext headers without frag0 invalidation Shigeru Yoshida <syoshida(a)redhat.com> ipv4: Fix uninit-value access in __ip_make_skb() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> drm/panel: ili9341: Use predefined error codes Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> drm/panel: ili9341: Respect deferred probe Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> drm/panel: ili9341: Correct use of device property APIs Alexandra Winter <wintera(a)linux.ibm.com> s390/qeth: Fix kernel panic after setting hsuid Guillaume Nault <gnault(a)redhat.com> vxlan: Pull inner IP header in vxlan_rcv(). Xin Long <lucien.xin(a)gmail.com> tipc: fix a possible memleak in tipc_buf_append Jeffrey Altman <jaltman(a)auristor.com> rxrpc: Clients must accept conn from any address Felix Fietkau <nbd(a)nbd.name> net: core: reject skb_copy(_expand) for fraglist GSO skbs Felix Fietkau <nbd(a)nbd.name> net: bridge: fix multicast-to-unicast with fraglist GSO Mans Rullgard <mans(a)mansr.com> spi: fix null pointer dereference within spi_sync Shashank Sharma <shashank.sharma(a)amd.com> drm/amdgpu: fix doorbell regression Marek Behún <kabel(a)kernel.org> net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> cxgb4: Properly lock TX queue for the selftest. Bui Quang Minh <minhquangbui99(a)gmail.com> s390/cio: Ensure the copied buf is NUL terminated Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() Jerome Brunet <jbrunet(a)baylibre.com> ASoC: meson: cards: select SND_DYNAMIC_MINORS Jerome Brunet <jbrunet(a)baylibre.com> ASoC: meson: axg-tdm-interface: manage formatters in trigger Jerome Brunet <jbrunet(a)baylibre.com> ASoC: meson: axg-card: make links nonatomic Jerome Brunet <jbrunet(a)baylibre.com> ASoC: meson: axg-fifo: use threaded irq to check periods Jerome Brunet <jbrunet(a)baylibre.com> ASoC: meson: axg-fifo: use FIELD helpers Guillaume Nault <gnault(a)redhat.com> vxlan: Add missing VNI filter counter update in arp_reduce(). Guillaume Nault <gnault(a)redhat.com> vxlan: Fix racy device stats updates. Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: qede: use return from qede_parse_actions() Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: qede: use return from qede_parse_flow_attr() for flow_spec Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: qede: use return from qede_parse_flow_attr() for flower Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: qede: sanitize 'rc' in qede_add_tc_flower_fltr() Oswald Buddenhagen <oswald.buddenhagen(a)gmx.de> ALSA: emu10k1: fix E-MU dock initialization Oswald Buddenhagen <oswald.buddenhagen(a)gmx.de> ALSA: emu10k1: move the whole GPIO event handling to the workqueue Oswald Buddenhagen <oswald.buddenhagen(a)gmx.de> ALSA: emu10k1: factor out snd_emu1010_load_dock_firmware() Oswald Buddenhagen <oswald.buddenhagen(a)gmx.de> ALSA: emu10k1: fix E-MU card dock presence monitoring David Howells <dhowells(a)redhat.com> Fix a potential infinite loop in extract_user_to_sg() Jens Remus <jremus(a)linux.ibm.com> s390/vdso: Add CFI for RA register to asm macro vdso_func David Bauer <mail(a)david-bauer.net> net l2tp: drop flow hash on forward Kuniyuki Iwashima <kuniyu(a)amazon.com> nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). Bui Quang Minh <minhquangbui99(a)gmail.com> octeontx2-af: avoid off-by-one read from userspace Bui Quang Minh <minhquangbui99(a)gmail.com> bna: ensure the copied buf is NUL terminated Toke Høiland-Jørgensen <toke(a)redhat.com> xdp: use flags field to disambiguate broadcast redirect Claudio Imbrenda <imbrenda(a)linux.ibm.com> s390/mm: Fix clearing storage keys for huge pages Claudio Imbrenda <imbrenda(a)linux.ibm.com> s390/mm: Fix storage key clearing for guest huge pages Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> ASoC: codecs: wsa881x: set clk_stop_mode1 flag Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> ASoC: Intel: avs: Set name of control as in topology Xu Kuohai <xukuohai(a)huawei.com> riscv, bpf: Fix incorrect runtime stats Xu Kuohai <xukuohai(a)huawei.com> bpf, arm64: Fix incorrect runtime stats Devyn Liu <liudingyuan(a)huawei.com> spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs David Lechner <dlechner(a)baylibre.com> spi: axi-spi-engine: fix version format string David Lechner <dlechner(a)baylibre.com> spi: axi-spi-engine: use common AXI macros David Lechner <dlechner(a)baylibre.com> spi: axi-spi-engine: move msg state to new struct David Lechner <dlechner(a)baylibre.com> spi: axi-spi-engine: use devm_spi_alloc_host() David Lechner <dlechner(a)baylibre.com> spi: axi-spi-engine: simplify driver data allocation Li Zetao <lizetao1(a)huawei.com> spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled() Anton Protopopov <aspsk(a)isovalent.com> bpf: Fix a verifier verbose message Yi Zhang <yi.zhang(a)redhat.com> nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ASoC: SOF: Intel: add default firmware library path for LNL Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: Introduce generic names for IPC types Richard Fitzgerald <rf(a)opensource.cirrus.com> regmap: Add regmap_read_bypassed() Jason Xing <kernelxing(a)tencent.com> bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Andrii Nakryiko <andrii(a)kernel.org> bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition Matti Vaittinen <mazziesaccount(a)gmail.com> regulator: change devm_regulator_get_enable_optional() stub to return Ok Matti Vaittinen <mazziesaccount(a)gmail.com> regulator: change stubbed devm_regulator_get_enable to return Ok AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> regulator: mt6360: De-capitalize devicetree regulator subnodes Zeng Heng <zengheng4(a)huawei.com> pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator Arnd Bergmann <arnd(a)arndb.de> power: rt9455: hide unused rt9455_boost_voltage_values Hans de Goede <hdegoede(a)redhat.com> pinctrl: baytrail: Fix selecting gpio pinctrl state Kuniyuki Iwashima <kuniyu(a)amazon.com> nfs: Handle error of rpc_proc_register() in nfs_net_init(). Josef Bacik <josef(a)toxicpanda.com> nfs: make the rpc_stat per net namespace Josef Bacik <josef(a)toxicpanda.com> nfs: expose /proc/net/sunrpc/nfs in net namespaces Josef Bacik <josef(a)toxicpanda.com> sunrpc: add a struct rpc_stats arg to rpc_create_args Chen-Yu Tsai <wenst(a)chromium.org> pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE Chen-Yu Tsai <wenst(a)chromium.org> pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback Dan Carpenter <dan.carpenter(a)linaro.org> pinctrl: core: delete incorrect free in pinctrl_enable() Jan Dakinevich <jan.dakinevich(a)salutedevices.com> pinctrl/meson: fix typo in PDM's pin name Billy Tsai <billy_tsai(a)aspeedtech.com> pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T Tim Jiang <quic_tjiang(a)quicinc.com> Bluetooth: qca: add support for QCA2066 Daniel Okazaki <dtokazaki(a)google.com> eeprom: at24: fix memory corruption race condition Heiner Kallweit <hkallweit1(a)gmail.com> eeprom: at24: Probe for DDR3 thermal sensor in the SPD case Wedson Almeida Filho <walmeida(a)microsoft.com> rust: kernel: require `Send` for `Module` implementations Johannes Berg <johannes.berg(a)intel.com> wifi: nl80211: don't free NULL coalescing rule Benno Lossin <benno.lossin(a)proton.me> rust: macros: fix soundness issue in `module!` macro Thomas Bertschinger <tahbertschinger(a)gmail.com> rust: module: place generated init_module() function in .init.text Christian Marangi <ansuelsmth(a)gmail.com> mtd: limit OTP NVMEM cell parse to non-NAND devices Rafał Miłecki <rafal(a)milecki.pl> nvmem: add explicit config option to read old syntax fixed OF cells Vinod Koul <vkoul(a)kernel.org> dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" Bumyong Lee <bumyong.lee(a)samsung.com> dmaengine: pl330: issue_pending waits until WFP state ------------- Diffstat: .../bindings/iio/health/maxim,max30102.yaml | 2 +- .../devicetree/bindings/net/mediatek,net.yaml | 22 +- Makefile | 4 +- arch/arm/kernel/sleep.S | 4 + arch/arm64/boot/dts/qcom/sa8155p-adp.dts | 30 +- arch/arm64/kvm/vgic/vgic-kvm-device.c | 12 +- arch/arm64/net/bpf_jit_comp.c | 6 +- arch/mips/include/asm/ptrace.h | 2 +- arch/mips/kernel/asm-offsets.c | 1 + arch/mips/kernel/ptrace.c | 15 +- arch/mips/kernel/scall32-o32.S | 23 +- arch/mips/kernel/scall64-n32.S | 3 +- arch/mips/kernel/scall64-n64.S | 3 +- arch/mips/kernel/scall64-o32.S | 33 +- arch/powerpc/crypto/chacha-p10-glue.c | 8 +- arch/powerpc/include/asm/plpks.h | 5 +- arch/powerpc/platforms/pseries/iommu.c | 8 + arch/powerpc/platforms/pseries/plpks.c | 10 +- arch/riscv/net/bpf_jit_comp64.c | 6 +- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 + arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 2 +- arch/x86/kernel/apic/apic.c | 16 +- arch/xtensa/include/asm/processor.h | 8 +- arch/xtensa/include/asm/ptrace.h | 2 +- arch/xtensa/kernel/process.c | 5 +- arch/xtensa/kernel/stacktrace.c | 3 +- block/blk-iocost.c | 14 +- block/ioctl.c | 5 +- drivers/ata/sata_gemini.c | 5 +- drivers/base/regmap/regmap.c | 37 +++ drivers/bluetooth/btqca.c | 208 ++++++++++++- drivers/bluetooth/btqca.h | 8 +- drivers/bluetooth/hci_qca.c | 13 +- drivers/clk/clk.c | 12 +- drivers/clk/qcom/clk-smd-rpm.c | 1 + drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 2 + drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +- drivers/clk/sunxi-ng/ccu_common.c | 19 ++ drivers/clk/sunxi-ng/ccu_common.h | 3 + drivers/firewire/nosy.c | 6 +- drivers/firewire/ohci.c | 14 +- drivers/gpio/gpio-crystalcove.c | 2 +- drivers/gpio/gpio-lpc32xx.c | 1 + drivers/gpio/gpio-wcove.c | 2 +- drivers/gpio/gpiolib-cdev.c | 181 +++++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 56 ++-- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 15 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 16 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 17 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v10.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v11.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 48 ++- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 1 + .../display/dc/dcn31/dcn31_hpo_dp_link_encoder.c | 6 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 2 +- drivers/gpu/drm/drm_connector.c | 2 +- drivers/gpu/drm/i915/display/intel_audio.c | 113 +------ drivers/gpu/drm/i915/display/intel_bios.c | 19 +- drivers/gpu/drm/i915/display/intel_vbt_defs.h | 5 - drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 6 +- drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h | 2 +- drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 +- drivers/gpu/drm/meson/meson_dw_hdmi.c | 70 ++--- drivers/gpu/drm/nouveau/nouveau_dp.c | 13 +- drivers/gpu/drm/panel/Kconfig | 2 +- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 13 +- drivers/gpu/drm/qxl/qxl_release.c | 50 +--- drivers/gpu/drm/radeon/pptable.h | 10 +- drivers/gpu/drm/ttm/ttm_tt.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- drivers/gpu/host1x/bus.c | 8 - drivers/hv/channel.c | 29 +- drivers/hv/connection.c | 29 +- drivers/hwmon/corsair-cpro.c | 43 ++- drivers/hwmon/pmbus/ucd9000.c | 6 +- drivers/iio/accel/mxc4005.c | 24 +- drivers/iio/imu/adis16475.c | 4 +- drivers/iio/pressure/bmp280-spi.c | 4 +- drivers/infiniband/hw/qib/qib_fs.c | 1 + drivers/iommu/mtk_iommu.c | 1 + drivers/iommu/mtk_iommu_v1.c | 1 + drivers/misc/eeprom/at24.c | 47 ++- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/mtd/mtdcore.c | 2 + drivers/net/dsa/mv88e6xxx/chip.c | 20 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 32 +- drivers/net/ethernet/broadcom/genet/bcmgenet.h | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 8 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 +- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 52 ++-- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 5 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 20 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- drivers/net/ethernet/intel/e1000e/phy.c | 8 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +- drivers/net/ethernet/micrel/ks8851_common.c | 16 +- drivers/net/ethernet/qlogic/qede/qede_filter.c | 14 +- drivers/net/hyperv/netvsc.c | 7 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan/vxlan_core.c | 49 ++- drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 7 +- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/nvme.h | 5 + drivers/nvme/host/pci.c | 14 +- drivers/nvmem/apple-efuses.c | 1 + drivers/nvmem/core.c | 8 +- drivers/nvmem/imx-ocotp-scu.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/meson-efuse.c | 1 + drivers/nvmem/meson-mx-efuse.c | 1 + drivers/nvmem/microchip-otpc.c | 1 + drivers/nvmem/mtk-efuse.c | 1 + drivers/nvmem/qcom-spmi-sdam.c | 1 + drivers/nvmem/qfprom.c | 1 + drivers/nvmem/rave-sp-eeprom.c | 1 + drivers/nvmem/rockchip-efuse.c | 1 + drivers/nvmem/sc27xx-efuse.c | 1 + drivers/nvmem/sec-qfprom.c | 1 + drivers/nvmem/sprd-efuse.c | 1 + drivers/nvmem/stm32-romem.c | 1 + drivers/nvmem/sunplus-ocotp.c | 1 + drivers/nvmem/sunxi_sid.c | 1 + drivers/nvmem/uniphier-efuse.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 1 + drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +-- drivers/pinctrl/core.c | 8 +- drivers/pinctrl/devicetree.c | 10 +- drivers/pinctrl/intel/pinctrl-baytrail.c | 74 ++--- drivers/pinctrl/intel/pinctrl-intel.h | 4 + drivers/pinctrl/mediatek/pinctrl-paris.c | 40 +-- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +- .../x86/intel/speed_select_if/isst_if_common.c | 1 + drivers/power/supply/mt6360_charger.c | 2 +- drivers/power/supply/rt9455_charger.c | 2 + drivers/regulator/core.c | 27 +- drivers/regulator/mt6360-regulator.c | 32 +- drivers/regulator/tps65132-regulator.c | 7 + drivers/rtc/nvmem.c | 1 + drivers/s390/cio/cio_inject.c | 2 +- drivers/s390/net/qeth_core_main.c | 69 ++--- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/lpfc/lpfc.h | 2 +- drivers/scsi/lpfc/lpfc_attr.c | 4 +- drivers/scsi/lpfc/lpfc_bsg.c | 20 +- drivers/scsi/lpfc/lpfc_debugfs.c | 12 +- drivers/scsi/lpfc/lpfc_els.c | 20 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 5 +- drivers/scsi/lpfc/lpfc_init.c | 5 +- drivers/scsi/lpfc/lpfc_nvme.c | 4 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 34 +-- drivers/scsi/lpfc/lpfc_vport.c | 8 +- drivers/scsi/mpi3mr/mpi3mr_app.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-axi-spi-engine.c | 229 +++++++------- drivers/spi/spi-hisi-kunpeng.c | 2 - drivers/spi/spi-microchip-core-qspi.c | 1 + drivers/spi/spi.c | 1 + drivers/target/target_core_configfs.c | 12 + drivers/ufs/core/ufs-mcq.c | 2 +- drivers/ufs/core/ufshcd.c | 9 +- drivers/uio/uio_hv_generic.c | 12 +- drivers/usb/core/hub.c | 5 +- drivers/usb/core/port.c | 8 +- drivers/usb/dwc3/core.c | 90 +++--- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 2 + drivers/usb/dwc3/host.c | 27 ++ drivers/usb/gadget/composite.c | 6 +- drivers/usb/gadget/function/f_fs.c | 9 +- drivers/usb/gadget/function/uvc_configfs.c | 4 +- drivers/usb/host/ohci-hcd.c | 8 + drivers/usb/host/xhci-plat.h | 4 +- drivers/usb/host/xhci-rzv2m.c | 1 + drivers/usb/typec/tcpm/tcpm.c | 36 ++- drivers/usb/typec/ucsi/ucsi.c | 12 +- drivers/w1/slaves/w1_ds250x.c | 1 + fs/9p/fid.h | 3 - fs/9p/vfs_file.c | 2 + fs/9p/vfs_inode.c | 5 +- fs/9p/vfs_super.c | 1 + fs/btrfs/inode.c | 2 +- fs/btrfs/ordered-data.c | 1 + fs/btrfs/send.c | 4 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/volumes.c | 18 +- fs/gfs2/bmap.c | 5 +- fs/nfs/client.c | 5 +- fs/nfs/inode.c | 13 +- fs/nfs/internal.h | 2 - fs/nfs/netns.h | 2 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/connect.c | 8 + fs/smb/client/fs_context.c | 21 ++ fs/smb/client/fs_context.h | 2 + fs/smb/client/misc.c | 1 + fs/smb/client/smb2pdu.c | 11 + fs/smb/server/oplock.c | 35 ++- fs/smb/server/transport_tcp.c | 4 + fs/tracefs/event_inode.c | 74 ++--- fs/tracefs/inode.c | 92 +++++- fs/tracefs/internal.h | 14 +- fs/userfaultfd.c | 4 + fs/vboxsf/file.c | 1 + include/linux/compiler_types.h | 11 + include/linux/dma-fence.h | 7 - include/linux/gfp_types.h | 2 + include/linux/hyperv.h | 1 + include/linux/nvmem-provider.h | 2 + include/linux/regmap.h | 8 + include/linux/regulator/consumer.h | 4 +- include/linux/skbuff.h | 15 + include/linux/skmsg.h | 2 + include/linux/slab.h | 2 +- include/linux/sunrpc/clnt.h | 1 + include/net/gro.h | 9 + include/net/xfrm.h | 3 + include/sound/emu10k1.h | 3 +- include/sound/sof.h | 7 +- include/trace/events/rxrpc.h | 2 +- include/uapi/linux/kfd_ioctl.h | 17 +- include/uapi/scsi/scsi_bsg_mpi3mr.h | 2 +- kernel/bpf/bloom_filter.c | 13 + kernel/bpf/verifier.c | 3 +- kernel/dma/swiotlb.c | 1 + kernel/workqueue.c | 8 +- lib/Kconfig.debug | 5 +- lib/dynamic_debug.c | 6 +- lib/maple_tree.c | 16 +- lib/scatterlist.c | 2 +- mm/readahead.c | 4 + net/8021q/vlan_core.c | 2 + net/bluetooth/hci_core.c | 3 +- net/bluetooth/hci_event.c | 2 + net/bluetooth/l2cap_core.c | 3 + net/bluetooth/msft.c | 2 +- net/bluetooth/msft.h | 4 +- net/bluetooth/sco.c | 4 + net/bridge/br_forward.c | 9 +- net/bridge/br_netlink.c | 3 +- net/core/filter.c | 42 ++- net/core/gro.c | 1 + net/core/link_watch.c | 4 +- net/core/net-sysfs.c | 4 +- net/core/net_namespace.c | 13 +- net/core/rtnetlink.c | 6 +- net/core/skbuff.c | 27 +- net/core/skmsg.c | 5 +- net/core/sock.c | 4 +- net/hsr/hsr_device.c | 31 +- net/ipv4/af_inet.c | 1 + net/ipv4/ip_output.c | 2 +- net/ipv4/raw.c | 3 + net/ipv4/tcp.c | 4 +- net/ipv4/tcp_input.c | 2 + net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_output.c | 4 +- net/ipv4/udp.c | 3 +- net/ipv4/udp_offload.c | 15 +- net/ipv4/xfrm4_input.c | 6 +- net/ipv6/addrconf.c | 11 +- net/ipv6/fib6_rules.c | 6 +- net/ipv6/ip6_input.c | 4 +- net/ipv6/ip6_offload.c | 52 +++- net/ipv6/ip6_output.c | 4 +- net/ipv6/udp.c | 3 +- net/ipv6/udp_offload.c | 3 +- net/ipv6/xfrm6_input.c | 6 +- net/l2tp/l2tp_eth.c | 3 + net/mac80211/ieee80211_i.h | 4 +- net/mac80211/mlme.c | 5 +- net/mptcp/ctrl.c | 39 ++- net/mptcp/protocol.c | 3 + net/nfc/nci/core.c | 1 + net/nsh/nsh.c | 14 +- net/phonet/pn_netlink.c | 2 +- net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_object.c | 7 +- net/rxrpc/conn_event.c | 16 +- net/rxrpc/conn_object.c | 9 +- net/rxrpc/input.c | 71 +++-- net/rxrpc/output.c | 14 +- net/rxrpc/protocol.h | 6 +- net/smc/smc_ib.c | 19 +- net/sunrpc/clnt.c | 5 +- net/sunrpc/xprtsock.c | 1 + net/tipc/msg.c | 8 +- net/wireless/nl80211.c | 2 + net/wireless/trace.h | 2 +- net/xfrm/xfrm_input.c | 8 + rust/kernel/lib.rs | 2 +- rust/macros/module.rs | 185 +++++++----- scripts/Makefile.modfinal | 2 +- sound/hda/intel-sdw-acpi.c | 2 + sound/pci/emu10k1/emu10k1.c | 3 +- sound/pci/emu10k1/emu10k1_main.c | 139 +++++---- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/wsa881x.c | 1 + sound/soc/intel/avs/topology.c | 2 + sound/soc/meson/Kconfig | 1 + sound/soc/meson/axg-card.c | 1 + sound/soc/meson/axg-fifo.c | 56 ++-- sound/soc/meson/axg-fifo.h | 12 +- sound/soc/meson/axg-frddr.c | 5 +- sound/soc/meson/axg-tdm-interface.c | 34 ++- sound/soc/meson/axg-toddr.c | 22 +- sound/soc/sof/intel/hda-dsp.c | 20 +- sound/soc/sof/intel/pci-lnl.c | 3 + sound/soc/tegra/tegra186_dspk.c | 7 +- sound/soc/ti/davinci-mcasp.c | 12 +- sound/usb/line6/driver.c | 6 +- tools/include/linux/kernel.h | 1 + tools/include/linux/mm.h | 5 + tools/include/linux/panic.h | 19 ++ tools/power/x86/turbostat/turbostat.8 | 2 +- tools/power/x86/turbostat/turbostat.c | 45 ++- .../selftests/bpf/prog_tests/bloom_filter_map.c | 6 + .../ftrace/test.d/filter/event-filter-function.tc | 2 +- tools/testing/selftests/mm/Makefile | 6 +- .../selftests/net/test_bridge_neigh_suppress.sh | 333 ++++++++++----------- tools/testing/selftests/timers/valid-adjtimex.c | 73 +++-- 338 files changed, 3043 insertions(+), 1798 deletions(-)

1 year, 2 months

9
311
0 0

[PATCH v6] af_packet: Handle outgoing VLAN packets without hardware offloading

by Chengen Du

The issue initially stems from libpcap. The ethertype will be overwritten as the VLAN TPID if the network interface lacks hardware VLAN offloading. In the outbound packet path, if hardware VLAN offloading is unavailable, the VLAN tag is inserted into the payload but then cleared from the sk_buff struct. Consequently, this can lead to a false negative when checking for the presence of a VLAN tag, causing the packet sniffing outcome to lack VLAN tag information (i.e., TCI-TPID). As a result, the packet capturing tool may be unable to parse packets as expected. The TCI-TPID is missing because the prb_fill_vlan_info() function does not modify the tp_vlan_tci/tp_vlan_tpid values, as the information is in the payload and not in the sk_buff struct. The skb_vlan_tag_present() function only checks vlan_all in the sk_buff struct. In cooked mode, the L2 header is stripped, preventing the packet capturing tool from determining the correct TCI-TPID value. Additionally, the protocol in SLL is incorrect, which means the packet capturing tool cannot parse the L3 header correctly. Link: https://github.com/the-tcpdump-group/libpcap/issues/1105 Link: https://lore.kernel.org/netdev/20240520070348.26725-1-chengen.du@canonical.… Fixes: 393e52e33c6c ("packet: deliver VLAN TCI to userspace") Cc: stable(a)vger.kernel.org Signed-off-by: Chengen Du <chengen.du(a)canonical.com> --- net/packet/af_packet.c | 57 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 55 insertions(+), 2 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index ea3ebc160e25..8cffbe1f912d 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -538,6 +538,43 @@ static void *packet_current_frame(struct packet_sock *po, return packet_lookup_frame(po, rb, rb->head, status); } +static u16 vlan_get_tci(struct sk_buff *skb) +{ + struct vlan_hdr vhdr, *vh; + u8 *skb_orig_data = skb->data; + int skb_orig_len = skb->len; + + skb_push(skb, skb->data - skb_mac_header(skb)); + vh = skb_header_pointer(skb, ETH_HLEN, sizeof(vhdr), &vhdr); + if (skb_orig_data != skb->data) { + skb->data = skb_orig_data; + skb->len = skb_orig_len; + } + if (unlikely(!vh)) + return 0; + + return ntohs(vh->h_vlan_TCI); +} + +static __be16 vlan_get_protocol_dgram(struct sk_buff *skb) +{ + __be16 proto = skb->protocol; + + if (unlikely(eth_type_vlan(proto))) { + u8 *skb_orig_data = skb->data; + int skb_orig_len = skb->len; + + skb_push(skb, skb->data - skb_mac_header(skb)); + proto = __vlan_get_protocol(skb, proto, NULL); + if (skb_orig_data != skb->data) { + skb->data = skb_orig_data; + skb->len = skb_orig_len; + } + } + + return proto; +} + static void prb_del_retire_blk_timer(struct tpacket_kbdq_core *pkc) { del_timer_sync(&pkc->retire_blk_timer); @@ -1007,10 +1044,16 @@ static void prb_clear_rxhash(struct tpacket_kbdq_core *pkc, static void prb_fill_vlan_info(struct tpacket_kbdq_core *pkc, struct tpacket3_hdr *ppd) { + struct packet_sock *po = container_of(pkc, struct packet_sock, rx_ring.prb_bdqc); + if (skb_vlan_tag_present(pkc->skb)) { ppd->hv1.tp_vlan_tci = skb_vlan_tag_get(pkc->skb); ppd->hv1.tp_vlan_tpid = ntohs(pkc->skb->vlan_proto); ppd->tp_status = TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID; + } else if (unlikely(po->sk.sk_type == SOCK_DGRAM && eth_type_vlan(pkc->skb->protocol))) { + ppd->hv1.tp_vlan_tci = vlan_get_tci(pkc->skb); + ppd->hv1.tp_vlan_tpid = ntohs(pkc->skb->protocol); + ppd->tp_status = TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID; } else { ppd->hv1.tp_vlan_tci = 0; ppd->hv1.tp_vlan_tpid = 0; @@ -2428,6 +2471,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, h.h2->tp_vlan_tci = skb_vlan_tag_get(skb); h.h2->tp_vlan_tpid = ntohs(skb->vlan_proto); status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID; + } else if (unlikely(sk->sk_type == SOCK_DGRAM && eth_type_vlan(skb->protocol))) { + h.h2->tp_vlan_tci = vlan_get_tci(skb); + h.h2->tp_vlan_tpid = ntohs(skb->protocol); + status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID; } else { h.h2->tp_vlan_tci = 0; h.h2->tp_vlan_tpid = 0; @@ -2457,7 +2504,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, sll->sll_halen = dev_parse_header(skb, sll->sll_addr); sll->sll_family = AF_PACKET; sll->sll_hatype = dev->type; - sll->sll_protocol = skb->protocol; + sll->sll_protocol = (sk->sk_type == SOCK_DGRAM) ? + vlan_get_protocol_dgram(skb) : skb->protocol; sll->sll_pkttype = skb->pkt_type; if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) sll->sll_ifindex = orig_dev->ifindex; @@ -3482,7 +3530,8 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, /* Original length was stored in sockaddr_ll fields */ origlen = PACKET_SKB_CB(skb)->sa.origlen; sll->sll_family = AF_PACKET; - sll->sll_protocol = skb->protocol; + sll->sll_protocol = (sock->type == SOCK_DGRAM) ? + vlan_get_protocol_dgram(skb) : skb->protocol; } sock_recv_cmsgs(msg, sk, skb); @@ -3539,6 +3588,10 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, aux.tp_vlan_tci = skb_vlan_tag_get(skb); aux.tp_vlan_tpid = ntohs(skb->vlan_proto); aux.tp_status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID; + } else if (unlikely(sock->type == SOCK_DGRAM && eth_type_vlan(skb->protocol))) { + aux.tp_vlan_tci = vlan_get_tci(skb); + aux.tp_vlan_tpid = ntohs(skb->protocol); + aux.tp_status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID; } else { aux.tp_vlan_tci = 0; aux.tp_vlan_tpid = 0; -- 2.43.0

1 year, 2 months

2
11
0 0

Intel e1000e driver bug on stable (6.9.x)

by Ismael Luceno

Hi, I noticed that the NIC started to fail on a couple of notebooks [0] [1] after upgrading to 6.9.1. I tracked down the problem to commit 861e8086029e ("e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue", 2024-03-03), included in all 6.9.x releases. The fix is in commit bfd546a552e1 ("e1000e: move force SMBUS near the end of enable_ulp function", 2024-05-28) from mainline. The NIC fails right after boot on both systems I tried; I mention because the description is a bit unclear about that on the fix, maybe other systems are affected differently. Best regards. [0] HP ZBook 17 Gen 1 (D5D93AV) [8086:153a (rev 04)] [1] Lenovo Thinkpad P15 Gen 1 [8086:0d4c]

1 year, 2 months

3
3
0 0

[PATCH 6.6] Revert "fork: defer linking file vma until vma is fully initialized"

by Sam James

This reverts commit cec11fa2eb512ebe3a459c185f4aca1d44059bbf. The backport is incomplete and causes xfstests failures. The consequences of the incomplete backport seem worse than the original issue, so pick the lesser evil and revert until a full backport is ready. Link: https://lore.kernel.org/stable/20240604004751.3883227-1-leah.rumancik@gmail… Reported-by: Leah Rumancik <leah.rumancik(a)gmail.com> Signed-off-by: Sam James <sam(a)gentoo.org> --- kernel/fork.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index 2eab916b504bf..177ce7438db6b 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -727,15 +727,6 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, } else if (anon_vma_fork(tmp, mpnt)) goto fail_nomem_anon_vma_fork; vm_flags_clear(tmp, VM_LOCKED_MASK); - /* - * Copy/update hugetlb private vma information. - */ - if (is_vm_hugetlb_page(tmp)) - hugetlb_dup_vma_private(tmp); - - if (tmp->vm_ops && tmp->vm_ops->open) - tmp->vm_ops->open(tmp); - file = tmp->vm_file; if (file) { struct address_space *mapping = file->f_mapping; @@ -752,6 +743,12 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, i_mmap_unlock_write(mapping); } + /* + * Copy/update hugetlb private vma information. + */ + if (is_vm_hugetlb_page(tmp)) + hugetlb_dup_vma_private(tmp); + /* Link the vma into the MT */ if (vma_iter_bulk_store(&vmi, tmp)) goto fail_nomem_vmi_store; @@ -760,6 +757,9 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, if (!(tmp->vm_flags & VM_WIPEONFORK)) retval = copy_page_range(tmp, mpnt); + if (tmp->vm_ops && tmp->vm_ops->open) + tmp->vm_ops->open(tmp); + if (retval) goto loop_out; } -- 2.45.2

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm/memory-failure: fix handling of dissolved but not taken" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 8cf360b9d6a840700e06864236a01a883b34bbad # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061349-snowdrop-pusher-dcdb@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 8cf360b9d6a8 ("mm/memory-failure: fix handling of dissolved but not taken off from buddy pages") b6fd410c32f1 ("memory-failure: use a folio in me_huge_page()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8cf360b9d6a840700e06864236a01a883b34bbad Mon Sep 17 00:00:00 2001 From: Miaohe Lin <linmiaohe(a)huawei.com> Date: Thu, 23 May 2024 15:12:17 +0800 Subject: [PATCH] mm/memory-failure: fix handling of dissolved but not taken off from buddy pages When I did memory failure tests recently, below panic occurs: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8cee00 flags: 0x6fffe0000000000(node=1|zone=2|lastcpupid=0x7fff) raw: 06fffe0000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000009 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(!PageBuddy(page)) ------------[ cut here ]------------ kernel BUG at include/linux/page-flags.h:1009! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:__del_page_from_free_list+0x151/0x180 RSP: 0018:ffffa49c90437998 EFLAGS: 00000046 RAX: 0000000000000035 RBX: 0000000000000009 RCX: ffff8dd8dfd1c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff8dd8dfd1c9c0 RBP: ffffd901233b8000 R08: ffffffffab5511f8 R09: 0000000000008c69 R10: 0000000000003c15 R11: ffffffffab5511f8 R12: ffff8dd8fffc0c80 R13: 0000000000000001 R14: ffff8dd8fffc0c80 R15: 0000000000000009 FS: 00007ff916304740(0000) GS:ffff8dd8dfd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055eae50124c8 CR3: 00000008479e0000 CR4: 00000000000006f0 Call Trace: <TASK> __rmqueue_pcplist+0x23b/0x520 get_page_from_freelist+0x26b/0xe40 __alloc_pages_noprof+0x113/0x1120 __folio_alloc_noprof+0x11/0xb0 alloc_buddy_hugetlb_folio.isra.0+0x5a/0x130 __alloc_fresh_hugetlb_folio+0xe7/0x140 alloc_pool_huge_folio+0x68/0x100 set_max_huge_pages+0x13d/0x340 hugetlb_sysctl_handler_common+0xe8/0x110 proc_sys_call_handler+0x194/0x280 vfs_write+0x387/0x550 ksys_write+0x64/0xe0 do_syscall_64+0xc2/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff916114887 RSP: 002b:00007ffec8a2fd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055eae500e350 RCX: 00007ff916114887 RDX: 0000000000000004 RSI: 000055eae500e390 RDI: 0000000000000003 RBP: 000055eae50104c0 R08: 0000000000000000 R09: 000055eae50104c0 R10: 0000000000000077 R11: 0000000000000246 R12: 0000000000000004 R13: 0000000000000004 R14: 00007ff916216b80 R15: 00007ff916216a00 </TASK> Modules linked in: mce_inject hwpoison_inject ---[ end trace 0000000000000000 ]--- And before the panic, there had an warning about bad page state: BUG: Bad page state in process page-types pfn:8cee00 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8cee00 flags: 0x6fffe0000000000(node=1|zone=2|lastcpupid=0x7fff) page_type: 0xffffff7f(buddy) raw: 06fffe0000000000 ffffd901241c0008 ffffd901240f8008 0000000000000000 raw: 0000000000000000 0000000000000009 00000000ffffff7f 0000000000000000 page dumped because: nonzero mapcount Modules linked in: mce_inject hwpoison_inject CPU: 8 PID: 154211 Comm: page-types Not tainted 6.9.0-rc4-00499-g5544ec3178e2-dirty #22 Call Trace: <TASK> dump_stack_lvl+0x83/0xa0 bad_page+0x63/0xf0 free_unref_page+0x36e/0x5c0 unpoison_memory+0x50b/0x630 simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110 debugfs_attr_write+0x42/0x60 full_proxy_write+0x5b/0x80 vfs_write+0xcd/0x550 ksys_write+0x64/0xe0 do_syscall_64+0xc2/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f189a514887 RSP: 002b:00007ffdcd899718 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f189a514887 RDX: 0000000000000009 RSI: 00007ffdcd899730 RDI: 0000000000000003 RBP: 00007ffdcd8997a0 R08: 0000000000000000 R09: 00007ffdcd8994b2 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcda199a8 R13: 0000000000404af1 R14: 000000000040ad78 R15: 00007f189a7a5040 </TASK> The root cause should be the below race: memory_failure try_memory_failure_hugetlb me_huge_page __page_handle_poison dissolve_free_hugetlb_folio drain_all_pages -- Buddy page can be isolated e.g. for compaction. take_page_off_buddy -- Failed as page is not in the buddy list. -- Page can be putback into buddy after compaction. page_ref_inc -- Leads to buddy page with refcnt = 1. Then unpoison_memory() can unpoison the page and send the buddy page back into buddy list again leading to the above bad page state warning. And bad_page() will call page_mapcount_reset() to remove PageBuddy from buddy page leading to later VM_BUG_ON_PAGE(!PageBuddy(page)) when trying to allocate this page. Fix this issue by only treating __page_handle_poison() as successful when it returns 1. Link: https://lkml.kernel.org/r/20240523071217.1696196-1-linmiaohe@huawei.com Fixes: ceaf8fbea79a ("mm, hwpoison: skip raw hwpoison page in freeing 1GB hugepage") Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Naoya Horiguchi <nao.horiguchi(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/memory-failure.c b/mm/memory-failure.c index a9fe9eda593f..d3c830e817e3 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1221,7 +1221,7 @@ static int me_huge_page(struct page_state *ps, struct page *p) * subpages. */ folio_put(folio); - if (__page_handle_poison(p) >= 0) { + if (__page_handle_poison(p) > 0) { page_ref_inc(p); res = MF_RECOVERED; } else { @@ -2091,7 +2091,7 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags, int *hugetlb */ if (res == 0) { folio_unlock(folio); - if (__page_handle_poison(p) >= 0) { + if (__page_handle_poison(p) > 0) { page_ref_inc(p); res = MF_RECOVERED; } else {

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] mm/huge_memory: don't unpoison huge_zero_folio" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x fe6f86f4b40855a130a19aa589f9ba7f650423f4 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061358-duplicate-demeaning-9772@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: fe6f86f4b408 ("mm/huge_memory: don't unpoison huge_zero_folio") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fe6f86f4b40855a130a19aa589f9ba7f650423f4 Mon Sep 17 00:00:00 2001 From: Miaohe Lin <linmiaohe(a)huawei.com> Date: Thu, 16 May 2024 20:26:08 +0800 Subject: [PATCH] mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently, below panic occurs: kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 PID: 137 Comm: kswapd1 Not tainted 6.9.0-rc4-00491-gd5ce28f156fe-dirty #14 RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 Call Trace: <TASK> do_shrink_slab+0x14f/0x6a0 shrink_slab+0xca/0x8c0 shrink_node+0x2d0/0x7d0 balance_pgdat+0x33a/0x720 kswapd+0x1f3/0x410 kthread+0xd5/0x100 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: mce_inject hwpoison_inject ---[ end trace 0000000000000000 ]--- RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 The root cause is that HWPoison flag will be set for huge_zero_folio without increasing the folio refcnt. But then unpoison_memory() will decrease the folio refcnt unexpectedly as it appears like a successfully hwpoisoned folio leading to VM_BUG_ON_PAGE(page_ref_count(page) == 0) when releasing huge_zero_folio. Skip unpoisoning huge_zero_folio in unpoison_memory() to fix this issue. We're not prepared to unpoison huge_zero_folio yet. Link: https://lkml.kernel.org/r/20240516122608.22610-1-linmiaohe@huawei.com Fixes: 478d134e9506 ("mm/huge_memory: do not overkill when splitting huge_zero_page") Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Yang Shi <shy828301(a)gmail.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Reviewed-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Naoya Horiguchi <nao.horiguchi(a)gmail.com> Cc: Xu Yu <xuyu(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 16ada4fb02b7..a9fe9eda593f 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2546,6 +2546,13 @@ int unpoison_memory(unsigned long pfn) goto unlock_mutex; } + if (is_huge_zero_folio(folio)) { + unpoison_pr_info("Unpoison: huge zero page is not supported %#lx\n", + pfn, &unpoison_rs); + ret = -EOPNOTSUPP; + goto unlock_mutex; + } + if (!PageHWPoison(p)) { unpoison_pr_info("Unpoison: Page was already unpoisoned %#lx\n", pfn, &unpoison_rs);

1 year, 2 months

2
1
0 0

[PATCH] fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes

by Thomas Zimmermann

Test the vesa_attributes field in struct screen_info for compatibility with VGA hardware. Vesafb currently tests bit 1 in screen_info's capabilities field, It sets the framebuffer address size and is unrelated to VGA. Section 4.4 of the Vesa VBE 2.0 specifications defines that bit 5 in the mode's attributes field signals VGA compatibility. The mode is compatible with VGA hardware if the bit is clear. In that case, the driver can access VGA state of the VBE's underlying hardware. The vesafb driver uses this feature to program the color LUT in palette modes. Without, colors might be incorrect. The problem got introduced in commit 89ec4c238e7a ("[PATCH] vesafb: Fix incorrect logo colors in x86_64"). It incorrectly stores the mode attributes in the screen_info's capabilities field and updates vesafb accordingly. Later, commit 5e8ddcbe8692 ("Video mode probing support for the new x86 setup code") fixed the screen_info, but did not update vesafb. Color output still tends to work, because bit 1 in capabilities is usually 0. Besides fixing the bug in vesafb, this commit introduces a helper that reads the correct bit from screen_info. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: 5e8ddcbe8692 ("Video mode probing support for the new x86 setup code") Cc: <stable(a)vger.kernel.org> # v2.6.23+ --- drivers/video/fbdev/vesafb.c | 2 +- include/linux/screen_info.h | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/vesafb.c b/drivers/video/fbdev/vesafb.c index 8ab64ae4cad3e..5a161750a3aee 100644 --- a/drivers/video/fbdev/vesafb.c +++ b/drivers/video/fbdev/vesafb.c @@ -271,7 +271,7 @@ static int vesafb_probe(struct platform_device *dev) if (si->orig_video_isVGA != VIDEO_TYPE_VLFB) return -ENODEV; - vga_compat = (si->capabilities & 2) ? 0 : 1; + vga_compat = !__screen_info_vbe_mode_nonvga(si); vesafb_fix.smem_start = si->lfb_base; vesafb_defined.bits_per_pixel = si->lfb_depth; if (15 == vesafb_defined.bits_per_pixel) diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h index 75303c126285a..95f2a339de329 100644 --- a/include/linux/screen_info.h +++ b/include/linux/screen_info.h @@ -49,6 +49,11 @@ static inline u64 __screen_info_lfb_size(const struct screen_info *si, unsigned return lfb_size; } +static inline bool __screen_info_vbe_mode_nonvga(const struct screen_info *si) +{ + return si->vesa_attributes & BIT(5); // VGA if _not_ set +} + static inline unsigned int __screen_info_video_type(unsigned int type) { switch (type) { -- 2.45.2

1 year, 2 months

3
8
0 0

[PATCH net v1 1/2] net: phy: dp83tg720: wake up PHYs in managed mode

by Oleksij Rempel

In case this PHY is bootstrapped for managed mode, we need to manually wake it. Otherwise no link will be detected. Cc: stable(a)vger.kernel.org Fixes: cb80ee2f9bee1 ("net: phy: Add support for the DP83TG720S Ethernet PHY") Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de> --- drivers/net/phy/dp83tg720.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/net/phy/dp83tg720.c b/drivers/net/phy/dp83tg720.c index 326c9770a6dcc..1186dfc70fb3c 100644 --- a/drivers/net/phy/dp83tg720.c +++ b/drivers/net/phy/dp83tg720.c @@ -17,6 +17,11 @@ #define DP83TG720S_PHY_RESET 0x1f #define DP83TG720S_HW_RESET BIT(15) +#define DP83TG720S_LPS_CFG3 0x18c +/* Power modes are documented as bit fields but used as values */ +/* Power Mode 0 is Normal mode */ +#define DP83TG720S_LPS_CFG3_PWR_MODE_0 BIT(0) + #define DP83TG720S_RGMII_DELAY_CTRL 0x602 /* In RGMII mode, Enable or disable the internal delay for RXD */ #define DP83TG720S_RGMII_RX_CLK_SEL BIT(1) @@ -154,10 +159,17 @@ static int dp83tg720_config_init(struct phy_device *phydev) */ usleep_range(1000, 2000); - if (phy_interface_is_rgmii(phydev)) - return dp83tg720_config_rgmii_delay(phydev); + if (phy_interface_is_rgmii(phydev)) { + ret = dp83tg720_config_rgmii_delay(phydev); + if (ret) + return ret; + } - return 0; + /* In case the PHY is bootstrapped in managed mode, we need to + * wake it. + */ + return phy_write_mmd(phydev, MDIO_MMD_VEND2, DP83TG720S_LPS_CFG3, + DP83TG720S_LPS_CFG3_PWR_MODE_0); } static struct phy_driver dp83tg720_driver[] = { -- 2.39.2

1 year, 2 months

2
4
0 0

[PATCH] scsi: ufs: core: Free memory allocated for model before reinit

by Joel Slebodnick

Under the conditions that a device is to be reinitialized within ufshcd_probe_hba, the device must first be fully reset. Resetting the device should include freeing U8 model (member of dev_info) but does not, and this causes a memory leak. ufs_put_device_desc is responsible for freeing model. unreferenced object 0xffff3f63008bee60 (size 32): comm "kworker/u33:1", pid 60, jiffies 4294892642 hex dump (first 32 bytes): 54 48 47 4a 46 47 54 30 54 32 35 42 41 5a 5a 41 THGJFGT0T25BAZZA 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc ed7ff1a9): [<ffffb86705f1243c>] kmemleak_alloc+0x34/0x40 [<ffffb8670511cee4>] __kmalloc_noprof+0x1e4/0x2fc [<ffffb86705c247fc>] ufshcd_read_string_desc+0x94/0x190 [<ffffb86705c26854>] ufshcd_device_init+0x480/0xdf8 [<ffffb86705c27b68>] ufshcd_probe_hba+0x3c/0x404 [<ffffb86705c29264>] ufshcd_async_scan+0x40/0x370 [<ffffb86704f43e9c>] async_run_entry_fn+0x34/0xe0 [<ffffb86704f34638>] process_one_work+0x154/0x298 [<ffffb86704f34a74>] worker_thread+0x2f8/0x408 [<ffffb86704f3cfa4>] kthread+0x114/0x118 [<ffffb86704e955a0>] ret_from_fork+0x10/0x20 Fixes: 96a7141da332 ("scsi: ufs: core: Add support for reinitializing the UFS device") Cc: <stable(a)vger.kernel.org> Reviewed-by: Andrew Halaney <ahalaney(a)redhat.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Joel Slebodnick <jslebodn(a)redhat.com> --- drivers/ufs/core/ufshcd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 0cf07194bbe8..a0407b9213ca 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -8787,6 +8787,7 @@ static int ufshcd_probe_hba(struct ufs_hba *hba, bool init_dev_params) (hba->quirks & UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH)) { /* Reset the device and controller before doing reinit */ ufshcd_device_reset(hba); + ufs_put_device_desc(hba); ufshcd_hba_stop(hba); ufshcd_vops_reinit_notify(hba); ret = ufshcd_hba_enable(hba); -- 2.40.1

1 year, 2 months

3
2
0 0

FAILED: patch "[PATCH] mm/huge_memory: don't unpoison huge_zero_folio" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x fe6f86f4b40855a130a19aa589f9ba7f650423f4 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061359-shimmy-enable-1fbd@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: fe6f86f4b408 ("mm/huge_memory: don't unpoison huge_zero_folio") 6c54312f9689 ("mm/memory-failure: fix hardware poison check in unpoison_memory()") a6fddef49eef ("mm/memory-failure: convert unpoison_memory() to folios") 9637d7dfb19c ("mm/memory-failure: convert free_raw_hwp_pages() to folios") 2ff6cecee669 ("mm/memory-failure: convert hugetlb_clear_page_hwpoison to folios") bc1cfde19467 ("mm/memory-failure: convert try_memory_failure_hugetlb() to folios") 911565b82853 ("mm/hugetlb: convert destroy_compound_gigantic_page() to folios") e0ff42804233 ("mm/memory-failure.c: cleanup in unpoison_memory") cb67f4282bf9 ("mm,thp,rmap: simplify compound page mapcount handling") dad6a5eb5556 ("mm,hugetlb: use folio fields in second tail page") f074732d599e ("mm/hugetlb_cgroup: convert hugetlb_cgroup_from_page() to folios") a098c977722c ("mm/hugetlb_cgroup: convert __set_hugetlb_cgroup() to folios") 5033091de814 ("mm/hwpoison: introduce per-memory_block hwpoison counter") a46c9304b4bb ("mm/hwpoison: pass pfn to num_poisoned_pages_*()") d027122d8363 ("mm/hwpoison: move definitions of num_poisoned_pages_* to memory-failure.c") e591ef7d96d6 ("mm,hwpoison,hugetlb,memory_hotplug: hotremove memory section with hwpoisoned hugepage") b66d00dfebe7 ("mm: memory-failure: make action_result() return int") 4781593d5dba ("mm/hugetlb: unify clearing of RestoreReserve for private pages") 149562f75094 ("mm/hugetlb: add hugetlb_folio_subpool() helpers") d340625f4849 ("mm: add private field of first tail to struct page and struct folio") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fe6f86f4b40855a130a19aa589f9ba7f650423f4 Mon Sep 17 00:00:00 2001 From: Miaohe Lin <linmiaohe(a)huawei.com> Date: Thu, 16 May 2024 20:26:08 +0800 Subject: [PATCH] mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently, below panic occurs: kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 PID: 137 Comm: kswapd1 Not tainted 6.9.0-rc4-00491-gd5ce28f156fe-dirty #14 RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 Call Trace: <TASK> do_shrink_slab+0x14f/0x6a0 shrink_slab+0xca/0x8c0 shrink_node+0x2d0/0x7d0 balance_pgdat+0x33a/0x720 kswapd+0x1f3/0x410 kthread+0xd5/0x100 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: mce_inject hwpoison_inject ---[ end trace 0000000000000000 ]--- RIP: 0010:shrink_huge_zero_page_scan+0x168/0x1a0 RSP: 0018:ffff9933c6c57bd0 EFLAGS: 00000246 RAX: 000000000000003e RBX: 0000000000000000 RCX: ffff88f61fc5c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff88f61fc5c9c0 RBP: ffffcd7c446b0000 R08: ffffffff9a9405f0 R09: 0000000000005492 R10: 00000000000030ea R11: ffffffff9a9405f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88e703c4ac00 FS: 0000000000000000(0000) GS:ffff88f61fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f4da6e9878 CR3: 0000000c71048000 CR4: 00000000000006f0 The root cause is that HWPoison flag will be set for huge_zero_folio without increasing the folio refcnt. But then unpoison_memory() will decrease the folio refcnt unexpectedly as it appears like a successfully hwpoisoned folio leading to VM_BUG_ON_PAGE(page_ref_count(page) == 0) when releasing huge_zero_folio. Skip unpoisoning huge_zero_folio in unpoison_memory() to fix this issue. We're not prepared to unpoison huge_zero_folio yet. Link: https://lkml.kernel.org/r/20240516122608.22610-1-linmiaohe@huawei.com Fixes: 478d134e9506 ("mm/huge_memory: do not overkill when splitting huge_zero_page") Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Yang Shi <shy828301(a)gmail.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Reviewed-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Naoya Horiguchi <nao.horiguchi(a)gmail.com> Cc: Xu Yu <xuyu(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 16ada4fb02b7..a9fe9eda593f 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2546,6 +2546,13 @@ int unpoison_memory(unsigned long pfn) goto unlock_mutex; } + if (is_huge_zero_folio(folio)) { + unpoison_pr_info("Unpoison: huge zero page is not supported %#lx\n", + pfn, &unpoison_rs); + ret = -EOPNOTSUPP; + goto unlock_mutex; + } + if (!PageHWPoison(p)) { unpoison_pr_info("Unpoison: Page was already unpoisoned %#lx\n", pfn, &unpoison_rs);

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] iommu/dma: Trace bounce buffer usage when mapping buffers" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x a63c357b9fd56ad5fe64616f5b22835252c6a76a # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024012226-unmanned-marshy-5819@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: a63c357b9fd5 ("iommu/dma: Trace bounce buffer usage when mapping buffers") f316ba0a8814 ("dma-iommu: Check that swiotlb is active before trying to use it") a17e3026bc4d ("iommu: Move flush queue data into iommu_dma_cookie") f7f07484542f ("iommu/iova: Move flush queue code to iommu-dma") ea4d71bb5e3f ("iommu/iova: Consolidate flush queue code") 87f60cc65d24 ("iommu/vt-d: Use put_pages_list") 649ad9835a37 ("iommu/iova: Squash flush_cb abstraction") d5c383f2c98a ("iommu/iova: Squash entry_dtor abstraction") d7061627d701 ("iommu/iova: Fix race between FQ timeout and teardown") 2e727bffbe93 ("iommu/dma: Check CONFIG_SWIOTLB more broadly") 9b49bbc2c4df ("iommu/dma: Fold _swiotlb helpers into callers") ee9d4097cc14 ("iommu/dma: Skip extra sync during unmap w/swiotlb") 06e620345d54 ("iommu/dma: Fix arch_sync_dma for map") 08ae5d4a1ae9 ("iommu/dma: Fix sync_sg with swiotlb") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From a63c357b9fd56ad5fe64616f5b22835252c6a76a Mon Sep 17 00:00:00 2001 From: "Isaac J. Manjarres" <isaacmanjarres(a)google.com> Date: Fri, 8 Dec 2023 15:41:40 -0800 Subject: [PATCH] iommu/dma: Trace bounce buffer usage when mapping buffers When commit 82612d66d51d ("iommu: Allow the dma-iommu api to use bounce buffers") was introduced, it did not add the logic for tracing the bounce buffer usage from iommu_dma_map_page(). All of the users of swiotlb_tbl_map_single() trace their bounce buffer usage, except iommu_dma_map_page(). This makes it difficult to track SWIOTLB usage from that function. Thus, trace bounce buffer usage from iommu_dma_map_page(). Fixes: 82612d66d51d ("iommu: Allow the dma-iommu api to use bounce buffers") Cc: stable(a)vger.kernel.org # v5.15+ Cc: Tom Murphy <murphyt7(a)tcd.ie> Cc: Lu Baolu <baolu.lu(a)linux.intel.com> Cc: Saravana Kannan <saravanak(a)google.com> Signed-off-by: Isaac J. Manjarres <isaacmanjarres(a)google.com> Link: https://lore.kernel.org/r/20231208234141.2356157-1-isaacmanjarres@google.com Signed-off-by: Joerg Roedel <jroedel(a)suse.de> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 85163a83df2f..037fcf826407 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -29,6 +29,7 @@ #include <linux/spinlock.h> #include <linux/swiotlb.h> #include <linux/vmalloc.h> +#include <trace/events/swiotlb.h> #include "dma-iommu.h" @@ -1156,6 +1157,8 @@ static dma_addr_t iommu_dma_map_page(struct device *dev, struct page *page, return DMA_MAPPING_ERROR; } + trace_swiotlb_bounced(dev, phys, size); + aligned_size = iova_align(iovad, size); phys = swiotlb_tbl_map_single(dev, phys, size, aligned_size, iova_mask(iovad), dir, attrs);

1 year, 2 months

4
6
0 0

FAILED: patch "[PATCH] mm/vmalloc: fix vmalloc which may return null if called with" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 8e0545c83d672750632f46e3f9ad95c48c91a0fc # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061303-heap-catalyst-0a58@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 8e0545c83d67 ("mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL") e9c3cda4d86e ("mm, vmalloc: fix high order __GFP_NOFAIL allocations") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8e0545c83d672750632f46e3f9ad95c48c91a0fc Mon Sep 17 00:00:00 2001 From: "Hailong.Liu" <hailong.liu(a)oppo.com> Date: Fri, 10 May 2024 18:01:31 +0800 Subject: [PATCH] mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb ("vmalloc: back off when the current task is OOM-killed"). A possible scenario is as follows: process-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() --> oom-killer send SIGKILL to process-a if (fatal_signal_pending(current)) break; --> return NULL; To fix this, do not check fatal_signal_pending() in vm_area_alloc_pages() if __GFP_NOFAIL set. This issue occurred during OPLUS KASAN TEST. Below is part of the log -> oom-killer sends signal to process [65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198 [65731.259685] [T32454] Call trace: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] show_stack+0x18/0x24 [65731.259756] [T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] [T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] die_kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] el1_abort+0x3c/0x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454] el1h_64_sync+0x68/0x6c [65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 --> be->decompressed_pages = kvcalloc(be->nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); kernel panic by NULL pointer dereference. erofs assume kvmalloc with __GFP_NOFAIL never return NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] read_pages+0x170/0xadc [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] handle_mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c Link: https://lkml.kernel.org/r/20240510100131.1865-1-hailong.liu@oppo.com Fixes: 9376130c390a ("mm/vmalloc: add support for __GFP_NOFAIL") Signed-off-by: Hailong.Liu <hailong.liu(a)oppo.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Suggested-by: Barry Song <21cnbao(a)gmail.com> Reported-by: Oven <liyangouwen1(a)oppo.com> Reviewed-by: Barry Song <baohua(a)kernel.org> Reviewed-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Cc: Chao Yu <chao(a)kernel.org> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Gao Xiang <xiang(a)kernel.org> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 6641be0ca80b..5d3aa2dc88a8 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -3498,7 +3498,7 @@ vm_area_alloc_pages(gfp_t gfp, int nid, { unsigned int nr_allocated = 0; gfp_t alloc_gfp = gfp; - bool nofail = false; + bool nofail = gfp & __GFP_NOFAIL; struct page *page; int i; @@ -3555,12 +3555,11 @@ vm_area_alloc_pages(gfp_t gfp, int nid, * and compaction etc. */ alloc_gfp &= ~__GFP_NOFAIL; - nofail = true; } /* High-order pages or fallback path if "bulk" fails. */ while (nr_allocated < nr_pages) { - if (fatal_signal_pending(current)) + if (!nofail && fatal_signal_pending(current)) break; if (nid == NUMA_NO_NODE)

1 year, 2 months

2
1
0 0

+ mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch tentatively added to mm-hotfixes-stable branch

by Andrew Morton

The patch titled Subject: mm: fix incorrect vbq reference in purge_fragmented_block has been added to the -mm mm-hotfixes-stable branch. Its filename is mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-stable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Subject: mm: fix incorrect vbq reference in purge_fragmented_block Date: Fri, 7 Jun 2024 10:31:16 +0800 xa_for_each() in _vm_unmap_aliases() loops through all vbs. However, since commit 062eacf57ad9 ("mm: vmalloc: remove a global vmap_blocks xarray") the vb from xarray may not be on the corresponding CPU vmap_block_queue. Consequently, purge_fragmented_block() might use the wrong vbq->lock to protect the free list, leading to vbq->free breakage. Incorrect lock protection can exhaust all vmalloc space as follows: CPU0 CPU1 +--------------------------------------------+ | +--------------------+ +-----+ | +--> | |---->| |------+ | CPU1:vbq free_list | | vb1 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ _vm_unmap_aliases() vb_alloc() new_vmap_block() xa_for_each(&vbq->vmap_blocks, idx, vb) --> vb in CPU1:vbq->freelist purge_fragmented_block(vb) spin_lock(&vbq->lock) spin_lock(&vbq->lock) --> use CPU0:vbq->lock --> use CPU1:vbq->lock list_del_rcu(&vb->free_list) list_add_tail_rcu(&vb->free_list, &vbq->free) __list_del(vb->prev, vb->next) next->prev = prev +--------------------+ | | | CPU1:vbq free_list | +---| |<--+ | +--------------------+ | +----------------------------+ __list_add(new, head->prev, head) +--------------------------------------------+ | +--------------------+ +-----+ | +--> | |---->| |------+ | CPU1:vbq free_list | | vb2 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ prev->next = next +--------------------------------------------+ |----------------------------+ | | +--------------------+ | +-----+ | +--> | |--+ | |------+ | CPU1:vbq free_list | | vb2 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ Here��s a list breakdown. All vbs, which were to be added to ��prev��, cannot be used by list_for_each_entry_rcu(vb, &vbq->free, free_list) in vb_alloc(). Thus, vmalloc space is exhausted. This issue affects both erofs and f2fs, the stacktrace is as follows: erofs: [<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624 [<ffffffd4ffb946f4>] schedule+0x7c [<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24 [<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0 [<ffffffd4ff1b46f4>] z_erofs_lz4_decompress+0x278 [<ffffffd4ff1b8ac4>] z_erofs_decompress_queue+0x650 [<ffffffd4ff1b8328>] z_erofs_runqueue+0x7f4 [<ffffffd4ff1b66a8>] z_erofs_read_folio+0x104 [<ffffffd4feeb6fec>] filemap_read_folio+0x6c [<ffffffd4feeb68c4>] filemap_fault+0x300 [<ffffffd4fef0ecac>] __do_fault+0xc8 [<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70 [<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0 f2fs: [<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624 [<ffffffd4ffb946f4>] schedule+0x7c [<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24 [<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0 [<ffffffd4ff1a3b60>] f2fs_prepare_decomp_mem+0x144 [<ffffffd4ff1a6c24>] f2fs_alloc_dic+0x264 [<ffffffd4ff175468>] f2fs_read_multi_pages+0x428 [<ffffffd4ff17b46c>] f2fs_mpage_readpages+0x314 [<ffffffd4ff1785c4>] f2fs_readahead+0x50 [<ffffffd4feec3384>] read_pages+0x80 [<ffffffd4feec32c0>] page_cache_ra_unbounded+0x1a0 [<ffffffd4feec39e8>] page_cache_ra_order+0x274 [<ffffffd4feeb6cec>] do_sync_mmap_readahead+0x11c [<ffffffd4feeb6764>] filemap_fault+0x1a0 [<ffffffd4ff1423bc>] f2fs_filemap_fault+0x28 [<ffffffd4fef0ecac>] __do_fault+0xc8 [<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70 [<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0 To fix this, introducee cpu within vmap_block to record which this vb belongs to. Link: https://lkml.kernel.org/r/20240607023116.1720640-1-zhaoyang.huang@unisoc.com Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") Signed-off-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Suggested-by: Hailong.Liu <hailong.liu(a)oppo.com> Reviewed-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/vmalloc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) --- a/mm/vmalloc.c~mm-fix-incorrect-vbq-reference-in-purge_fragmented_block +++ a/mm/vmalloc.c @@ -2498,6 +2498,7 @@ struct vmap_block { struct list_head free_list; struct rcu_head rcu_head; struct list_head purge; + unsigned int cpu; }; /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ @@ -2625,8 +2626,15 @@ static void *new_vmap_block(unsigned int free_vmap_area(va); return ERR_PTR(err); } - - vbq = raw_cpu_ptr(&vmap_block_queue); + /* + * list_add_tail_rcu could happened in another core + * rather than vb->cpu due to task migration, which + * is safe as list_add_tail_rcu will ensure the list's + * integrity together with list_for_each_rcu from read + * side. + */ + vb->cpu = raw_smp_processor_id(); + vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); spin_lock(&vbq->lock); list_add_tail_rcu(&vb->free_list, &vbq->free); spin_unlock(&vbq->lock); @@ -2654,9 +2662,10 @@ static void free_vmap_block(struct vmap_ } static bool purge_fragmented_block(struct vmap_block *vb, - struct vmap_block_queue *vbq, struct list_head *purge_list, - bool force_purge) + struct list_head *purge_list, bool force_purge) { + struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || vb->dirty == VMAP_BBMAP_BITS) return false; @@ -2704,7 +2713,7 @@ static void purge_fragmented_blocks(int continue; spin_lock(&vb->lock); - purge_fragmented_block(vb, vbq, &purge, true); + purge_fragmented_block(vb, &purge, true); spin_unlock(&vb->lock); } rcu_read_unlock(); @@ -2841,7 +2850,7 @@ static void _vm_unmap_aliases(unsigned l * not purgeable, check whether there is dirty * space to be flushed. */ - if (!purge_fragmented_block(vb, vbq, &purge_list, false) && + if (!purge_fragmented_block(vb, &purge_list, false) && vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { unsigned long va_start = vb->va->va_start; unsigned long s, e; _ Patches currently in -mm which might be from zhaoyang.huang(a)unisoc.com are mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch mm-optimization-on-page-allocation-when-cma-enabled.patch

1 year, 2 months

1
0
0 0

[PATCHv5 1/1] mm: fix incorrect vbq reference in purge_fragmented_block

by zhaoyang.huang

From: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> The function xa_for_each() in _vm_unmap_aliases() loops through all vbs. However, since commit 062eacf57ad9 ("mm: vmalloc: remove a global vmap_blocks xarray") the vb from xarray may not be on the corresponding CPU vmap_block_queue. Consequently, purge_fragmented_block() might use the wrong vbq->lock to protect the free list, leading to vbq->free breakage. Incorrect lock protection can exhaust all vmalloc space as follows: CPU0 CPU1 +--------------------------------------------+ | +--------------------+ +-----+ | +--> | |---->| |------+ | CPU1:vbq free_list | | vb1 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ _vm_unmap_aliases() vb_alloc() new_vmap_block() xa_for_each(&vbq->vmap_blocks, idx, vb) --> vb in CPU1:vbq->freelist purge_fragmented_block(vb) spin_lock(&vbq->lock) spin_lock(&vbq->lock) --> use CPU0:vbq->lock --> use CPU1:vbq->lock list_del_rcu(&vb->free_list) list_add_tail_rcu(&vb->free_list, &vbq->free) __list_del(vb->prev, vb->next) next->prev = prev +--------------------+ | | | CPU1:vbq free_list | +---| |<--+ | +--------------------+ | +----------------------------+ __list_add(new, head->prev, head) +--------------------------------------------+ | +--------------------+ +-----+ | +--> | |---->| |------+ | CPU1:vbq free_list | | vb2 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ prev->next = next +--------------------------------------------+ |----------------------------+ | | +--------------------+ | +-----+ | +--> | |--+ | |------+ | CPU1:vbq free_list | | vb2 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ Here’s a list breakdown. All vbs, which were to be added to ‘prev’, cannot be used by list_for_each_entry_rcu(vb, &vbq->free, free_list) in vb_alloc(). Thus, vmalloc space is exhausted. This issue affects both erofs and f2fs, the stacktrace is as follows: erofs: [<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624 [<ffffffd4ffb946f4>] schedule+0x7c [<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24 [<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0 [<ffffffd4ff1b46f4>] z_erofs_lz4_decompress+0x278 [<ffffffd4ff1b8ac4>] z_erofs_decompress_queue+0x650 [<ffffffd4ff1b8328>] z_erofs_runqueue+0x7f4 [<ffffffd4ff1b66a8>] z_erofs_read_folio+0x104 [<ffffffd4feeb6fec>] filemap_read_folio+0x6c [<ffffffd4feeb68c4>] filemap_fault+0x300 [<ffffffd4fef0ecac>] __do_fault+0xc8 [<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70 [<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0 f2fs: [<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624 [<ffffffd4ffb946f4>] schedule+0x7c [<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24 [<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0 [<ffffffd4ff1a3b60>] f2fs_prepare_decomp_mem+0x144 [<ffffffd4ff1a6c24>] f2fs_alloc_dic+0x264 [<ffffffd4ff175468>] f2fs_read_multi_pages+0x428 [<ffffffd4ff17b46c>] f2fs_mpage_readpages+0x314 [<ffffffd4ff1785c4>] f2fs_readahead+0x50 [<ffffffd4feec3384>] read_pages+0x80 [<ffffffd4feec32c0>] page_cache_ra_unbounded+0x1a0 [<ffffffd4feec39e8>] page_cache_ra_order+0x274 [<ffffffd4feeb6cec>] do_sync_mmap_readahead+0x11c [<ffffffd4feeb6764>] filemap_fault+0x1a0 [<ffffffd4ff1423bc>] f2fs_filemap_fault+0x28 [<ffffffd4fef0ecac>] __do_fault+0xc8 [<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70 [<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0 To fix this, replace xa_for_each() with list_for_each_entry_rcu() which reverts commit fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") Cc: stable(a)vger.kernel.org Suggested-by: Hailong.Liu <hailong.liu(a)oppo.com> Signed-off-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> --- v2: introduce cpu in vmap_block to record the right CPU number v3: use get_cpu/put_cpu to prevent schedule between core v4: replace get_cpu/put_cpu by another API to avoid disabling preemption v5: update the commit message by Hailong.Liu --- --- mm/vmalloc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 22aa63f4ef63..89eb034f4ac6 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2458,6 +2458,7 @@ struct vmap_block { struct list_head free_list; struct rcu_head rcu_head; struct list_head purge; + unsigned int cpu; }; /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ @@ -2585,8 +2586,15 @@ static void *new_vmap_block(unsigned int order, gfp_t gfp_mask) free_vmap_area(va); return ERR_PTR(err); } - - vbq = raw_cpu_ptr(&vmap_block_queue); + /* + * list_add_tail_rcu could happened in another core + * rather than vb->cpu due to task migration, which + * is safe as list_add_tail_rcu will ensure the list's + * integrity together with list_for_each_rcu from read + * side. + */ + vb->cpu = raw_smp_processor_id(); + vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); spin_lock(&vbq->lock); list_add_tail_rcu(&vb->free_list, &vbq->free); spin_unlock(&vbq->lock); @@ -2614,9 +2622,10 @@ static void free_vmap_block(struct vmap_block *vb) } static bool purge_fragmented_block(struct vmap_block *vb, - struct vmap_block_queue *vbq, struct list_head *purge_list, - bool force_purge) + struct list_head *purge_list, bool force_purge) { + struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || vb->dirty == VMAP_BBMAP_BITS) return false; @@ -2664,7 +2673,7 @@ static void purge_fragmented_blocks(int cpu) continue; spin_lock(&vb->lock); - purge_fragmented_block(vb, vbq, &purge, true); + purge_fragmented_block(vb, &purge, true); spin_unlock(&vb->lock); } rcu_read_unlock(); @@ -2801,7 +2810,7 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush) * not purgeable, check whether there is dirty * space to be flushed. */ - if (!purge_fragmented_block(vb, vbq, &purge_list, false) && + if (!purge_fragmented_block(vb, &purge_list, false) && vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { unsigned long va_start = vb->va->va_start; unsigned long s, e; -- 2.25.1

1 year, 2 months

3
2
0 0

[update PATCHv5 1/1] mm: fix incorrect vbq reference in purge_fragmented_block

by zhaoyang.huang

From: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> The function xa_for_each() in _vm_unmap_aliases() loops through all vbs. However, since commit 062eacf57ad9 ("mm: vmalloc: remove a global vmap_blocks xarray") the vb from xarray may not be on the corresponding CPU vmap_block_queue. Consequently, purge_fragmented_block() might use the wrong vbq->lock to protect the free list, leading to vbq->free breakage. Incorrect lock protection can exhaust all vmalloc space as follows: CPU0 CPU1 +--------------------------------------------+ | +--------------------+ +-----+ | +--> | |---->| |------+ | CPU1:vbq free_list | | vb1 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ _vm_unmap_aliases() vb_alloc() new_vmap_block() xa_for_each(&vbq->vmap_blocks, idx, vb) --> vb in CPU1:vbq->freelist purge_fragmented_block(vb) spin_lock(&vbq->lock) spin_lock(&vbq->lock) --> use CPU0:vbq->lock --> use CPU1:vbq->lock list_del_rcu(&vb->free_list) list_add_tail_rcu(&vb->free_list, &vbq->free) __list_del(vb->prev, vb->next) next->prev = prev +--------------------+ | | | CPU1:vbq free_list | +---| |<--+ | +--------------------+ | +----------------------------+ __list_add(new, head->prev, head) +--------------------------------------------+ | +--------------------+ +-----+ | +--> | |---->| |------+ | CPU1:vbq free_list | | vb2 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ prev->next = next +--------------------------------------------+ |----------------------------+ | | +--------------------+ | +-----+ | +--> | |--+ | |------+ | CPU1:vbq free_list | | vb2 | +--- | |<----| |<-----+ | +--------------------+ +-----+ | +--------------------------------------------+ Here’s a list breakdown. All vbs, which were to be added to ‘prev’, cannot be used by list_for_each_entry_rcu(vb, &vbq->free, free_list) in vb_alloc(). Thus, vmalloc space is exhausted. This issue affects both erofs and f2fs, the stacktrace is as follows: erofs: [<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624 [<ffffffd4ffb946f4>] schedule+0x7c [<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24 [<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0 [<ffffffd4ff1b46f4>] z_erofs_lz4_decompress+0x278 [<ffffffd4ff1b8ac4>] z_erofs_decompress_queue+0x650 [<ffffffd4ff1b8328>] z_erofs_runqueue+0x7f4 [<ffffffd4ff1b66a8>] z_erofs_read_folio+0x104 [<ffffffd4feeb6fec>] filemap_read_folio+0x6c [<ffffffd4feeb68c4>] filemap_fault+0x300 [<ffffffd4fef0ecac>] __do_fault+0xc8 [<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70 [<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0 f2fs: [<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624 [<ffffffd4ffb946f4>] schedule+0x7c [<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24 [<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0 [<ffffffd4ff1a3b60>] f2fs_prepare_decomp_mem+0x144 [<ffffffd4ff1a6c24>] f2fs_alloc_dic+0x264 [<ffffffd4ff175468>] f2fs_read_multi_pages+0x428 [<ffffffd4ff17b46c>] f2fs_mpage_readpages+0x314 [<ffffffd4ff1785c4>] f2fs_readahead+0x50 [<ffffffd4feec3384>] read_pages+0x80 [<ffffffd4feec32c0>] page_cache_ra_unbounded+0x1a0 [<ffffffd4feec39e8>] page_cache_ra_order+0x274 [<ffffffd4feeb6cec>] do_sync_mmap_readahead+0x11c [<ffffffd4feeb6764>] filemap_fault+0x1a0 [<ffffffd4ff1423bc>] f2fs_filemap_fault+0x28 [<ffffffd4fef0ecac>] __do_fault+0xc8 [<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70 [<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0 To fix this, introducing cpu within vmap_block to record which this vb belongs to. Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") Cc: stable(a)vger.kernel.org Suggested-by: Hailong.Liu <hailong.liu(a)oppo.com> Signed-off-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> --- v2: introduce cpu in vmap_block to record the right CPU number v3: use get_cpu/put_cpu to prevent schedule between core v4: replace get_cpu/put_cpu by another API to avoid disabling preemption v5: update the commit message by Hailong.Liu --- --- mm/vmalloc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 22aa63f4ef63..89eb034f4ac6 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2458,6 +2458,7 @@ struct vmap_block { struct list_head free_list; struct rcu_head rcu_head; struct list_head purge; + unsigned int cpu; }; /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ @@ -2585,8 +2586,15 @@ static void *new_vmap_block(unsigned int order, gfp_t gfp_mask) free_vmap_area(va); return ERR_PTR(err); } - - vbq = raw_cpu_ptr(&vmap_block_queue); + /* + * list_add_tail_rcu could happened in another core + * rather than vb->cpu due to task migration, which + * is safe as list_add_tail_rcu will ensure the list's + * integrity together with list_for_each_rcu from read + * side. + */ + vb->cpu = raw_smp_processor_id(); + vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); spin_lock(&vbq->lock); list_add_tail_rcu(&vb->free_list, &vbq->free); spin_unlock(&vbq->lock); @@ -2614,9 +2622,10 @@ static void free_vmap_block(struct vmap_block *vb) } static bool purge_fragmented_block(struct vmap_block *vb, - struct vmap_block_queue *vbq, struct list_head *purge_list, - bool force_purge) + struct list_head *purge_list, bool force_purge) { + struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || vb->dirty == VMAP_BBMAP_BITS) return false; @@ -2664,7 +2673,7 @@ static void purge_fragmented_blocks(int cpu) continue; spin_lock(&vb->lock); - purge_fragmented_block(vb, vbq, &purge, true); + purge_fragmented_block(vb, &purge, true); spin_unlock(&vb->lock); } rcu_read_unlock(); @@ -2801,7 +2810,7 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush) * not purgeable, check whether there is dirty * space to be flushed. */ - if (!purge_fragmented_block(vb, vbq, &purge_list, false) && + if (!purge_fragmented_block(vb, &purge_list, false) && vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { unsigned long va_start = vb->va->va_start; unsigned long s, e; -- 2.25.1

1 year, 2 months

1
0
0 0

[Resend PATCHv4 1/1] mm: fix incorrect vbq reference in purge_fragmented_block

by zhaoyang.huang

From: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> vmalloc area runs out in our ARM64 system during an erofs test as vm_map_ram failed[1]. By following the debug log, we find that vm_map_ram()->vb_alloc() will allocate new vb->va which corresponding to 4MB vmalloc area as list_for_each_entry_rcu returns immediately when vbq->free->next points to vbq->free. That is to say, 65536 times of page fault after the list's broken will run out of the whole vmalloc area. This should be introduced by one vbq->free->next point to vbq->free which makes list_for_each_entry_rcu can not iterate the list and find the BUG. [1] PID: 1 TASK: ffffff80802b4e00 CPU: 6 COMMAND: "init" #0 [ffffffc08006afe0] __switch_to at ffffffc08111d5cc #1 [ffffffc08006b040] __schedule at ffffffc08111dde0 #2 [ffffffc08006b0a0] schedule at ffffffc08111e294 #3 [ffffffc08006b0d0] schedule_preempt_disabled at ffffffc08111e3f0 #4 [ffffffc08006b140] __mutex_lock at ffffffc08112068c #5 [ffffffc08006b180] __mutex_lock_slowpath at ffffffc08111f8f8 #6 [ffffffc08006b1a0] mutex_lock at ffffffc08111f834 #7 [ffffffc08006b1d0] reclaim_and_purge_vmap_areas at ffffffc0803ebc3c #8 [ffffffc08006b290] alloc_vmap_area at ffffffc0803e83fc #9 [ffffffc08006b300] vm_map_ram at ffffffc0803e78c0 Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") For detailed reason of broken list, please refer to below URL https://lore.kernel.org/all/20240531024820.5507-1-hailong.liu@oppo.com/ Suggested-by: Hailong.Liu <hailong.liu(a)oppo.com> Signed-off-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> --- v2: introduce cpu in vmap_block to record the right CPU number v3: use get_cpu/put_cpu to prevent schedule between core v4: replace get_cpu/put_cpu by another API to avoid disabling preemption --- --- mm/vmalloc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 22aa63f4ef63..89eb034f4ac6 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2458,6 +2458,7 @@ struct vmap_block { struct list_head free_list; struct rcu_head rcu_head; struct list_head purge; + unsigned int cpu; }; /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ @@ -2585,8 +2586,15 @@ static void *new_vmap_block(unsigned int order, gfp_t gfp_mask) free_vmap_area(va); return ERR_PTR(err); } - - vbq = raw_cpu_ptr(&vmap_block_queue); + /* + * list_add_tail_rcu could happened in another core + * rather than vb->cpu due to task migration, which + * is safe as list_add_tail_rcu will ensure the list's + * integrity together with list_for_each_rcu from read + * side. + */ + vb->cpu = raw_smp_processor_id(); + vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); spin_lock(&vbq->lock); list_add_tail_rcu(&vb->free_list, &vbq->free); spin_unlock(&vbq->lock); @@ -2614,9 +2622,10 @@ static void free_vmap_block(struct vmap_block *vb) } static bool purge_fragmented_block(struct vmap_block *vb, - struct vmap_block_queue *vbq, struct list_head *purge_list, - bool force_purge) + struct list_head *purge_list, bool force_purge) { + struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || vb->dirty == VMAP_BBMAP_BITS) return false; @@ -2664,7 +2673,7 @@ static void purge_fragmented_blocks(int cpu) continue; spin_lock(&vb->lock); - purge_fragmented_block(vb, vbq, &purge, true); + purge_fragmented_block(vb, &purge, true); spin_unlock(&vb->lock); } rcu_read_unlock(); @@ -2801,7 +2810,7 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush) * not purgeable, check whether there is dirty * space to be flushed. */ - if (!purge_fragmented_block(vb, vbq, &purge_list, false) && + if (!purge_fragmented_block(vb, &purge_list, false) && vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { unsigned long va_start = vb->va->va_start; unsigned long s, e; -- 2.25.1

1 year, 2 months

7
15
0 0

[PATCH v3 2/2] usb: Do not query the IO advice hints grouping mode page for USB devices

by Bart Van Assche

Recently it was reported that the following USB storage devices are unusable with Linux kernel 6.9: * Kingston DataTraveler G2 * Garmin FR35 This is because attempting to read the IO advice hints grouping mode page causes these devices to reset. Hence do not read the IO advice hints grouping mode page from USB storage devices. Acked-by: Alan Stern <stern(a)rowland.harvard.edu> Cc: stable(a)vger.kernel.org Fixes: 4f53138fffc2 ("scsi: sd: Translate data lifetime information") Reported-by: Joao Machado <jocrismachado(a)gmail.com> Closes: https://lore.kernel.org/linux-scsi/20240130214911.1863909-1-bvanassche@acm.… Tested-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Bisected-by: Christian Heusel <christian(a)heusel.eu> Reported-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Closes: https://lore.kernel.org/linux-scsi/CACLx9VdpUanftfPo2jVAqXdcWe8Y43MsDeZmMPo… Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/usb/storage/scsiglue.c | 6 ++++++ drivers/usb/storage/uas.c | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c index b31464740f6c..8c8b5e6041cc 100644 --- a/drivers/usb/storage/scsiglue.c +++ b/drivers/usb/storage/scsiglue.c @@ -79,6 +79,12 @@ static int slave_alloc (struct scsi_device *sdev) if (us->protocol == USB_PR_BULK && us->max_lun > 0) sdev->sdev_bflags |= BLIST_FORCELUN; + /* + * Some USB storage devices reset if the IO advice hints grouping mode + * page is queried. Hence skip that mode page. + */ + sdev->sdev_bflags |= BLIST_SKIP_IO_HINTS; + return 0; } diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c index a48870a87a29..b610a2de4ae5 100644 --- a/drivers/usb/storage/uas.c +++ b/drivers/usb/storage/uas.c @@ -21,6 +21,7 @@ #include <scsi/scsi.h> #include <scsi/scsi_eh.h> #include <scsi/scsi_dbg.h> +#include <scsi/scsi_devinfo.h> #include <scsi/scsi_cmnd.h> #include <scsi/scsi_device.h> #include <scsi/scsi_host.h> @@ -820,6 +821,12 @@ static int uas_slave_alloc(struct scsi_device *sdev) struct uas_dev_info *devinfo = (struct uas_dev_info *)sdev->host->hostdata; + /* + * Some USB storage devices reset if the IO advice hints grouping mode + * page is queried. Hence skip that mode page. + */ + sdev->sdev_bflags |= BLIST_SKIP_IO_HINTS; + sdev->hostdata = devinfo; return 0; }

1 year, 2 months

1
0
0 0

[PATCH v3 1/2] scsi: core: Introduce the BLIST_SKIP_IO_HINTS flag

by Bart Van Assche

Prepare for skipping the IO advice hints grouping mode page for USB storage devices. Cc: Alan Stern <stern(a)rowland.harvard.edu> Cc: Joao Machado <jocrismachado(a)gmail.com> Cc: Andy Shevchenko <andy.shevchenko(a)gmail.com> Cc: Christian Heusel <christian(a)heusel.eu> Cc: stable(a)vger.kernel.org Fixes: 4f53138fffc2 ("scsi: sd: Translate data lifetime information") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/scsi/sd.c | 4 ++++ include/scsi/scsi_devinfo.h | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 3a43e2209751..fcf3d7730466 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -63,6 +63,7 @@ #include <scsi/scsi_cmnd.h> #include <scsi/scsi_dbg.h> #include <scsi/scsi_device.h> +#include <scsi/scsi_devinfo.h> #include <scsi/scsi_driver.h> #include <scsi/scsi_eh.h> #include <scsi/scsi_host.h> @@ -3117,6 +3118,9 @@ static void sd_read_io_hints(struct scsi_disk *sdkp, unsigned char *buffer) struct scsi_mode_data data; int res; + if (sdp->sdev_bflags & BLIST_SKIP_IO_HINTS) + return; + res = scsi_mode_sense(sdp, /*dbd=*/0x8, /*modepage=*/0x0a, /*subpage=*/0x05, buffer, SD_BUF_SIZE, SD_TIMEOUT, sdkp->max_retries, &data, &sshdr); diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h index 6b548dc2c496..5856b68a5180 100644 --- a/include/scsi/scsi_devinfo.h +++ b/include/scsi/scsi_devinfo.h @@ -69,8 +69,10 @@ #define BLIST_RETRY_ITF ((__force blist_flags_t)(1ULL << 32)) /* Always retry ABORTED_COMMAND with ASC 0xc1 */ #define BLIST_RETRY_ASC_C1 ((__force blist_flags_t)(1ULL << 33)) +/* Do not query the IO advice hints grouping mode page */ +#define BLIST_SKIP_IO_HINTS ((__force blist_flags_t)(1ULL << 34)) -#define __BLIST_LAST_USED BLIST_RETRY_ASC_C1 +#define __BLIST_LAST_USED BLIST_SKIP_IO_HINTS #define __BLIST_HIGH_UNUSED (~(__BLIST_LAST_USED | \ (__force blist_flags_t) \

1 year, 2 months

1
0
0 0

+ mm-shmem-fix-getting-incorrect-lruvec-when-replacing-a-shmem-folio.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm: shmem: fix getting incorrect lruvec when replacing a shmem folio has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-shmem-fix-getting-incorrect-lruvec-when-replacing-a-shmem-folio.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Baolin Wang <baolin.wang(a)linux.alibaba.com> Subject: mm: shmem: fix getting incorrect lruvec when replacing a shmem folio Date: Thu, 13 Jun 2024 16:21:19 +0800 When testing shmem swapin, I encountered the warning below on my machine. The reason is that replacing an old shmem folio with a new one causes mem_cgroup_migrate() to clear the old folio's memcg data. As a result, the old folio cannot get the correct memcg's lruvec needed to remove itself from the LRU list when it is being freed. This could lead to possible serious problems, such as LRU list crashes due to holding the wrong LRU lock, and incorrect LRU statistics. To fix this issue, we can fallback to use the mem_cgroup_replace_folio() to replace the old shmem folio. [ 5241.100311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5d9960 [ 5241.100317] head: order:4 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 5241.100319] flags: 0x17fffe0000040068(uptodate|lru|head|swapbacked|node=0|zone=2|lastcpupid=0x3ffff) [ 5241.100323] raw: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000 [ 5241.100325] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100326] head: 17fffe0000040068 fffffdffd6687948 fffffdffd69ae008 0000000000000000 [ 5241.100327] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100328] head: 17fffe0000000204 fffffdffd6665801 ffffffffffffffff 0000000000000000 [ 5241.100329] head: 0000000a00000010 0000000000000000 00000000ffffffff 0000000000000000 [ 5241.100330] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled()) [ 5241.100338] ------------[ cut here ]------------ [ 5241.100339] WARNING: CPU: 19 PID: 78402 at include/linux/memcontrol.h:775 folio_lruvec_lock_irqsave+0x140/0x150 [...] [ 5241.100374] pc : folio_lruvec_lock_irqsave+0x140/0x150 [ 5241.100375] lr : folio_lruvec_lock_irqsave+0x138/0x150 [ 5241.100376] sp : ffff80008b38b930 [...] [ 5241.100398] Call trace: [ 5241.100399] folio_lruvec_lock_irqsave+0x140/0x150 [ 5241.100401] __page_cache_release+0x90/0x300 [ 5241.100404] __folio_put+0x50/0x108 [ 5241.100406] shmem_replace_folio+0x1b4/0x240 [ 5241.100409] shmem_swapin_folio+0x314/0x528 [ 5241.100411] shmem_get_folio_gfp+0x3b4/0x930 [ 5241.100412] shmem_fault+0x74/0x160 [ 5241.100414] __do_fault+0x40/0x218 [ 5241.100417] do_shared_fault+0x34/0x1b0 [ 5241.100419] do_fault+0x40/0x168 [ 5241.100420] handle_pte_fault+0x80/0x228 [ 5241.100422] __handle_mm_fault+0x1c4/0x440 [ 5241.100424] handle_mm_fault+0x60/0x1f0 [ 5241.100426] do_page_fault+0x120/0x488 [ 5241.100429] do_translation_fault+0x4c/0x68 [ 5241.100431] do_mem_abort+0x48/0xa0 [ 5241.100434] el0_da+0x38/0xc0 [ 5241.100436] el0t_64_sync_handler+0x68/0xc0 [ 5241.100437] el0t_64_sync+0x14c/0x150 [ 5241.100439] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/3c11000dd6c1df83015a8321a859e9775ebbc23e.17182661… Fixes: 85ce2c517ade ("memcontrol: only transfer the memcg data for migration") Signed-off-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Nhat Pham <nphamcs(a)gmail.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/shmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/shmem.c~mm-shmem-fix-getting-incorrect-lruvec-when-replacing-a-shmem-folio +++ a/mm/shmem.c @@ -1786,7 +1786,7 @@ static int shmem_replace_folio(struct fo xa_lock_irq(&swap_mapping->i_pages); error = shmem_replace_entry(swap_mapping, swap_index, old, new); if (!error) { - mem_cgroup_migrate(old, new); + mem_cgroup_replace_folio(old, new); __lruvec_stat_mod_folio(new, NR_FILE_PAGES, 1); __lruvec_stat_mod_folio(new, NR_SHMEM, 1); __lruvec_stat_mod_folio(old, NR_FILE_PAGES, -1); _ Patches currently in -mm which might be from baolin.wang(a)linux.alibaba.com are mm-shmem-fix-getting-incorrect-lruvec-when-replacing-a-shmem-folio.patch mm-memory-extend-finish_fault-to-support-large-folio.patch mm-memory-extend-finish_fault-to-support-large-folio-fix.patch mm-shmem-add-thp-validation-for-pmd-mapped-thp-related-statistics.patch mm-shmem-add-multi-size-thp-sysfs-interface-for-anonymous-shmem.patch mm-shmem-add-multi-size-thp-sysfs-interface-for-anonymous-shmem-fix.patch mm-shmem-add-mthp-support-for-anonymous-shmem.patch mm-shmem-add-mthp-size-alignment-in-shmem_get_unmapped_area.patch mm-shmem-add-mthp-counters-for-anonymous-shmem.patch

1 year, 2 months

1
0
0 0

+ mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm: fix incorrect vbq reference in purge_fragmented_block has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Subject: mm: fix incorrect vbq reference in purge_fragmented_block Date: Fri, 7 Jun 2024 10:31:16 +0800 vmalloc area runs out in our ARM64 system during an erofs test as vm_map_ram failed[1]. By following the debug log, we find that vm_map_ram()->vb_alloc() will allocate new vb->va which corresponding to 4MB vmalloc area as list_for_each_entry_rcu returns immediately when vbq->free->next points to vbq->free. That is to say, 65536 times of page fault after the list's broken will run out of the whole vmalloc area. This should be introduced by one vbq->free->next point to vbq->free which makes list_for_each_entry_rcu can not iterate the list and find the BUG. [1] PID: 1 TASK: ffffff80802b4e00 CPU: 6 COMMAND: "init" #0 [ffffffc08006afe0] __switch_to at ffffffc08111d5cc #1 [ffffffc08006b040] __schedule at ffffffc08111dde0 #2 [ffffffc08006b0a0] schedule at ffffffc08111e294 #3 [ffffffc08006b0d0] schedule_preempt_disabled at ffffffc08111e3f0 #4 [ffffffc08006b140] __mutex_lock at ffffffc08112068c #5 [ffffffc08006b180] __mutex_lock_slowpath at ffffffc08111f8f8 #6 [ffffffc08006b1a0] mutex_lock at ffffffc08111f834 #7 [ffffffc08006b1d0] reclaim_and_purge_vmap_areas at ffffffc0803ebc3c #8 [ffffffc08006b290] alloc_vmap_area at ffffffc0803e83fc #9 [ffffffc08006b300] vm_map_ram at ffffffc0803e78c0 For detailed descri[ption of the broken list, please see https://lore.kernel.org/all/20240531024820.5507-1-hailong.liu@oppo.com/ Link: https://lkml.kernel.org/r/20240607023116.1720640-1-zhaoyang.huang@unisoc.com Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") Signed-off-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Suggested-by: Hailong.Liu <hailong.liu(a)oppo.com> Reviewed-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/vmalloc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) --- a/mm/vmalloc.c~mm-fix-incorrect-vbq-reference-in-purge_fragmented_block +++ a/mm/vmalloc.c @@ -2498,6 +2498,7 @@ struct vmap_block { struct list_head free_list; struct rcu_head rcu_head; struct list_head purge; + unsigned int cpu; }; /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ @@ -2625,8 +2626,15 @@ static void *new_vmap_block(unsigned int free_vmap_area(va); return ERR_PTR(err); } - - vbq = raw_cpu_ptr(&vmap_block_queue); + /* + * list_add_tail_rcu could happened in another core + * rather than vb->cpu due to task migration, which + * is safe as list_add_tail_rcu will ensure the list's + * integrity together with list_for_each_rcu from read + * side. + */ + vb->cpu = raw_smp_processor_id(); + vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); spin_lock(&vbq->lock); list_add_tail_rcu(&vb->free_list, &vbq->free); spin_unlock(&vbq->lock); @@ -2654,9 +2662,10 @@ static void free_vmap_block(struct vmap_ } static bool purge_fragmented_block(struct vmap_block *vb, - struct vmap_block_queue *vbq, struct list_head *purge_list, - bool force_purge) + struct list_head *purge_list, bool force_purge) { + struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || vb->dirty == VMAP_BBMAP_BITS) return false; @@ -2704,7 +2713,7 @@ static void purge_fragmented_blocks(int continue; spin_lock(&vb->lock); - purge_fragmented_block(vb, vbq, &purge, true); + purge_fragmented_block(vb, &purge, true); spin_unlock(&vb->lock); } rcu_read_unlock(); @@ -2841,7 +2850,7 @@ static void _vm_unmap_aliases(unsigned l * not purgeable, check whether there is dirty * space to be flushed. */ - if (!purge_fragmented_block(vb, vbq, &purge_list, false) && + if (!purge_fragmented_block(vb, &purge_list, false) && vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { unsigned long va_start = vb->va->va_start; unsigned long s, e; _ Patches currently in -mm which might be from zhaoyang.huang(a)unisoc.com are mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch mm-optimization-on-page-allocation-when-cma-enabled.patch

1 year, 2 months

1
0
0 0

6.6.y: cifs broken since 6.6.23 writing big files with vers=1.0 and 2.0

by Thomas Voegtle

Hello, a machine booted with Linux 6.6.23 up to 6.6.32: writing /dev/zero with dd on a mounted cifs share with vers=1.0 or vers=2.0 slows down drastically in my setup after writing approx. 46GB of data. The whole machine gets unresponsive as it was under very high IO load. It pings but opening a new ssh session needs too much time. I can stop the dd (ctrl-c) and after a few minutes the machine is fine again. cifs with vers=3.1.1 seems to be fine with 6.6.32. Linux 6.10-rc3 is fine with vers=1.0 and vers=2.0. Bisected down to: cifs-fix-writeback-data-corruption.patch which is: Upstream commit f3dc1bdb6b0b0693562c7c54a6c28bafa608ba3c and linux-stable commit e45deec35bf7f1f4f992a707b2d04a8c162f2240 Reverting this patch on 6.6.32 fixes the problem for me. Thomas

1 year, 2 months

3
8
0 0

[PATCH v2 1/2] scsi: core: Introduce the BLIST_SKIP_IO_HINTS flag

by Bart Van Assche

Prepare for skipping reading the IO hints VPD page for USB storage devices. Cc: Alan Stern <stern(a)rowland.harvard.edu> Cc: Joao Machado <jocrismachado(a)gmail.com> Cc: Andy Shevchenko <andy.shevchenko(a)gmail.com> Cc: Christian Heusel <christian(a)heusel.eu> Cc: stable(a)vger.kernel.org Fixes: 4f53138fffc2 ("scsi: sd: Translate data lifetime information") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/scsi/sd.c | 4 ++++ include/scsi/scsi_devinfo.h | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 3a43e2209751..fcf3d7730466 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -63,6 +63,7 @@ #include <scsi/scsi_cmnd.h> #include <scsi/scsi_dbg.h> #include <scsi/scsi_device.h> +#include <scsi/scsi_devinfo.h> #include <scsi/scsi_driver.h> #include <scsi/scsi_eh.h> #include <scsi/scsi_host.h> @@ -3117,6 +3118,9 @@ static void sd_read_io_hints(struct scsi_disk *sdkp, unsigned char *buffer) struct scsi_mode_data data; int res; + if (sdp->sdev_bflags & BLIST_SKIP_IO_HINTS) + return; + res = scsi_mode_sense(sdp, /*dbd=*/0x8, /*modepage=*/0x0a, /*subpage=*/0x05, buffer, SD_BUF_SIZE, SD_TIMEOUT, sdkp->max_retries, &data, &sshdr); diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h index 6b548dc2c496..fa8721e49dec 100644 --- a/include/scsi/scsi_devinfo.h +++ b/include/scsi/scsi_devinfo.h @@ -69,8 +69,10 @@ #define BLIST_RETRY_ITF ((__force blist_flags_t)(1ULL << 32)) /* Always retry ABORTED_COMMAND with ASC 0xc1 */ #define BLIST_RETRY_ASC_C1 ((__force blist_flags_t)(1ULL << 33)) +/* Do not read the I/O hints mode page */ +#define BLIST_SKIP_IO_HINTS ((__force blist_flags_t)(1ULL << 34)) -#define __BLIST_LAST_USED BLIST_RETRY_ASC_C1 +#define __BLIST_LAST_USED BLIST_SKIP_IO_HINTS #define __BLIST_HIGH_UNUSED (~(__BLIST_LAST_USED | \ (__force blist_flags_t) \

1 year, 2 months

3
2
0 0

[PATCH 2/2] scsi: core: Do not query IO hints for USB devices

by Bart Van Assche

Recently it was reported that the following USB storage devices are unusable with Linux kernel 6.9: * Kingston DataTraveler G2 * Garmin FR35 This is because attempting to read the IO hint VPD page causes these devices to reset. Hence do not read the IO hint VPD page from USB storage devices. Cc: Alan Stern <stern(a)rowland.harvard.edu> Cc: linux-usb(a)vger.kernel.org Cc: Joao Machado <jocrismachado(a)gmail.com> Cc: Andy Shevchenko <andy.shevchenko(a)gmail.com> Cc: Christian Heusel <christian(a)heusel.eu> Cc: stable(a)vger.kernel.org Fixes: 4f53138fffc2 ("scsi: sd: Translate data lifetime information") Reported-by: Joao Machado <jocrismachado(a)gmail.com> Closes: https://lore.kernel.org/linux-scsi/20240130214911.1863909-1-bvanassche@acm.… Tested-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Bisected-by: Christian Heusel <christian(a)heusel.eu> Reported-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Closes: https://lore.kernel.org/linux-scsi/CACLx9VdpUanftfPo2jVAqXdcWe8Y43MsDeZmMPo… Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/usb/storage/scsiglue.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c index b31464740f6c..9a7185c68872 100644 --- a/drivers/usb/storage/scsiglue.c +++ b/drivers/usb/storage/scsiglue.c @@ -79,6 +79,8 @@ static int slave_alloc (struct scsi_device *sdev) if (us->protocol == USB_PR_BULK && us->max_lun > 0) sdev->sdev_bflags |= BLIST_FORCELUN; + sdev->sdev_bflags |= BLIST_SKIP_IO_HINTS; + return 0; }

1 year, 2 months

3
6
0 0

FAILED: patch "[PATCH] kbuild: Remove support for Clang's ThinLTO caching" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x aba091547ef6159d52471f42a3ef531b7b660ed8 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061342-unimpeded-hardcover-349c@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: aba091547ef6 ("kbuild: Remove support for Clang's ThinLTO caching") 1db773da58df ("kbuild: remove old Rust docs output path") 7ea01d3169a2 ("rust: delete rust-project.json when running make clean") 8afc66e8d43b ("Merge tag 'kbuild-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From aba091547ef6159d52471f42a3ef531b7b660ed8 Mon Sep 17 00:00:00 2001 From: Nathan Chancellor <nathan(a)kernel.org> Date: Wed, 1 May 2024 15:55:25 -0700 Subject: [PATCH] kbuild: Remove support for Clang's ThinLTO caching MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is an issue in clang's ThinLTO caching (enabled for the kernel via '--thinlto-cache-dir') with .incbin, which the kernel occasionally uses to include data within the kernel, such as the .config file for /proc/config.gz. For example, when changing the .config and rebuilding vmlinux, the copy of .config in vmlinux does not match the copy of .config in the build folder: $ echo 'CONFIG_LTO_NONE=n CONFIG_LTO_CLANG_THIN=y CONFIG_IKCONFIG=y CONFIG_HEADERS_INSTALL=y' >kernel/configs/repro.config $ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 clean defconfig repro.config vmlinux ... $ grep CONFIG_HEADERS_INSTALL .config CONFIG_HEADERS_INSTALL=y $ scripts/extract-ikconfig vmlinux | grep CONFIG_HEADERS_INSTALL CONFIG_HEADERS_INSTALL=y $ scripts/config -d HEADERS_INSTALL $ make -kj"$(nproc)" ARCH=x86_64 LLVM=1 vmlinux ... UPD kernel/config_data GZIP kernel/config_data.gz CC kernel/configs.o ... LD vmlinux ... $ grep CONFIG_HEADERS_INSTALL .config # CONFIG_HEADERS_INSTALL is not set $ scripts/extract-ikconfig vmlinux | grep CONFIG_HEADERS_INSTALL CONFIG_HEADERS_INSTALL=y Without '--thinlto-cache-dir' or when using full LTO, this issue does not occur. Benchmarking incremental builds on a few different machines with and without the cache shows a 20% increase in incremental build time without the cache when measured by touching init/main.c and running 'make all'. ARCH=arm64 defconfig + CONFIG_LTO_CLANG_THIN=y on an arm64 host: Benchmark 1: With ThinLTO cache Time (mean ± σ): 56.347 s ± 0.163 s [User: 83.768 s, System: 24.661 s] Range (min … max): 56.109 s … 56.594 s 10 runs Benchmark 2: Without ThinLTO cache Time (mean ± σ): 67.740 s ± 0.479 s [User: 718.458 s, System: 31.797 s] Range (min … max): 67.059 s … 68.556 s 10 runs Summary With ThinLTO cache ran 1.20 ± 0.01 times faster than Without ThinLTO cache ARCH=x86_64 defconfig + CONFIG_LTO_CLANG_THIN=y on an x86_64 host: Benchmark 1: With ThinLTO cache Time (mean ± σ): 85.772 s ± 0.252 s [User: 91.505 s, System: 8.408 s] Range (min … max): 85.447 s … 86.244 s 10 runs Benchmark 2: Without ThinLTO cache Time (mean ± σ): 103.833 s ± 0.288 s [User: 232.058 s, System: 8.569 s] Range (min … max): 103.286 s … 104.124 s 10 runs Summary With ThinLTO cache ran 1.21 ± 0.00 times faster than Without ThinLTO cache While it is unfortunate to take this performance improvement off the table, correctness is more important. If/when this is fixed in LLVM, it can potentially be brought back in a conditional manner. Alternatively, a developer can just disable LTO if doing incremental compiles quickly is important, as a full compile cycle can still take over a minute even with the cache and it is unlikely that LTO will result in functional differences for a kernel change. Cc: stable(a)vger.kernel.org Fixes: dc5723b02e52 ("kbuild: add support for Clang LTO") Reported-by: Yifan Hong <elsk(a)google.com> Closes: https://github.com/ClangBuiltLinux/linux/issues/2021 Reported-by: Masami Hiramatsu <mhiramat(a)kernel.org> Closes: https://lore.kernel.org/r/20220327115526.cc4b0ff55fc53c97683c3e4d@kernel.or… Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> diff --git a/Makefile b/Makefile index 026971f9f6bc..12e1a792b8de 100644 --- a/Makefile +++ b/Makefile @@ -942,7 +942,6 @@ endif ifdef CONFIG_LTO_CLANG ifdef CONFIG_LTO_CLANG_THIN CC_FLAGS_LTO := -flto=thin -fsplit-lto-unit -KBUILD_LDFLAGS += --thinlto-cache-dir=$(extmod_prefix).thinlto-cache else CC_FLAGS_LTO := -flto endif @@ -1480,7 +1479,7 @@ endif # CONFIG_MODULES # Directories & files removed with 'make clean' CLEAN_FILES += vmlinux.symvers modules-only.symvers \ modules.builtin modules.builtin.modinfo modules.nsdeps \ - compile_commands.json .thinlto-cache rust/test \ + compile_commands.json rust/test \ rust-project.json .vmlinux.objs .vmlinux.export.c # Directories & files removed with 'make mrproper' @@ -1787,7 +1786,7 @@ PHONY += compile_commands.json clean-dirs := $(KBUILD_EXTMOD) clean: rm-files := $(KBUILD_EXTMOD)/Module.symvers $(KBUILD_EXTMOD)/modules.nsdeps \ - $(KBUILD_EXTMOD)/compile_commands.json $(KBUILD_EXTMOD)/.thinlto-cache + $(KBUILD_EXTMOD)/compile_commands.json PHONY += prepare # now expand this into a simple variable to reduce the cost of shell evaluations

1 year, 2 months

2
1
0 0

Regression Impact from Commit dceb683ab87c on Kubernetes Hairpin Tests

by Allen Pais

Hi Greg, I hope this message finds you well. I'm reaching out to report a regression issue linked to the commit dceb683ab87c(v5.15.158), which addresses the netfilter subsystem by skipping the conntrack input hook for promiscuous packets. [dceb683ab87c 2024-04-09 netfilter: br_netfilter: skip conntrack input hook for promiscuous packets.] Unfortunately, this update appears to be breaking Kubernetes hairpin tests, impacting the normal functionality expected in Kubernetes environments. Additionally, it's worth noting that this specific commit is associated with a security vulnerability, as detailed in the NVD: CVE-2024-27018. We have bisected the issue to the specific commit dceb683ab87c. By reverting this commit, we confirmed that the Kubernetes hairpin test issues are resolved. However, given that this commit addresses the security vulnerability CVE-2024-27018, directly reverting it is not a viable option. We’re in a tricky position and would greatly appreciate your advice on how we might approach this problem. Thank you for your attention to this matter. I look forward to your guidance on how we might proceed. Best regards, Allen

1 year, 2 months

2
2
0 0

[PATCH v2 2/2] scsi: core: Do not query IO hints for USB devices

by Bart Van Assche

Recently it was reported that the following USB storage devices are unusable with Linux kernel 6.9: * Kingston DataTraveler G2 * Garmin FR35 This is because attempting to read the IO hint VPD page causes these devices to reset. Hence do not read the IO hint VPD page from USB storage devices. Cc: Alan Stern <stern(a)rowland.harvard.edu> Cc: linux-usb(a)vger.kernel.org Cc: Joao Machado <jocrismachado(a)gmail.com> Cc: Andy Shevchenko <andy.shevchenko(a)gmail.com> Cc: Christian Heusel <christian(a)heusel.eu> Cc: stable(a)vger.kernel.org Fixes: 4f53138fffc2 ("scsi: sd: Translate data lifetime information") Reported-by: Joao Machado <jocrismachado(a)gmail.com> Closes: https://lore.kernel.org/linux-scsi/20240130214911.1863909-1-bvanassche@acm.… Tested-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Bisected-by: Christian Heusel <christian(a)heusel.eu> Reported-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Closes: https://lore.kernel.org/linux-scsi/CACLx9VdpUanftfPo2jVAqXdcWe8Y43MsDeZmMPo… Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/usb/storage/scsiglue.c | 6 ++++++ drivers/usb/storage/uas.c | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c index b31464740f6c..b4cf0349fd0d 100644 --- a/drivers/usb/storage/scsiglue.c +++ b/drivers/usb/storage/scsiglue.c @@ -79,6 +79,12 @@ static int slave_alloc (struct scsi_device *sdev) if (us->protocol == USB_PR_BULK && us->max_lun > 0) sdev->sdev_bflags |= BLIST_FORCELUN; + /* + * Some USB storage devices reset if the IO hints VPD page is queried. + * Hence skip that VPD page. + */ + sdev->sdev_bflags |= BLIST_SKIP_IO_HINTS; + return 0; } diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c index a48870a87a29..77fdfb6a90c8 100644 --- a/drivers/usb/storage/uas.c +++ b/drivers/usb/storage/uas.c @@ -21,6 +21,7 @@ #include <scsi/scsi.h> #include <scsi/scsi_eh.h> #include <scsi/scsi_dbg.h> +#include <scsi/scsi_devinfo.h> #include <scsi/scsi_cmnd.h> #include <scsi/scsi_device.h> #include <scsi/scsi_host.h> @@ -820,6 +821,12 @@ static int uas_slave_alloc(struct scsi_device *sdev) struct uas_dev_info *devinfo = (struct uas_dev_info *)sdev->host->hostdata; + /* + * Some USB storage devices reset if the IO hints VPD page is queried. + * Hence skip that VPD page. + */ + sdev->sdev_bflags |= BLIST_SKIP_IO_HINTS; + sdev->hostdata = devinfo; return 0; }

1 year, 2 months

3
2
0 0

Re: [PATCH 6.9 000/157] 6.9.5-rc1 review

by Ronald Warsow

Hi Greg ... today I had a crash with 6.9.4, see below seems not to be reproduceable with 6.9.5-rc1 ==== the above last sentence is *NOT* true, cause 6.9.5-rc1 show the same behavior (this time compiled with gcc) Jun 13 18:49:22 obelix.fritz.box kernel: Hardware name: ASUS System Product Name/ROG STRIX B560-G GAMING WIFI, BIOS 2203 02/06/2024 Jun 13 18:49:22 obelix.fritz.box kernel: RIP: 0010:drm_suballoc_free+0x13/0x110 [drm_suballoc_helper] Jun 13 18:49:22 obelix.fritz.box kernel: Code: eb ce 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 85 ff 0f 84 e1 00 00 00 41 54 55 48 89 fd 53 48 89 f3 <4c> 8b 67 20 4c 89 e7 e8 61 53 bd e2 48 85 db 0f 84 9f 00 00 00 48 Jun 13 18:49:22 obelix.fritz.box kernel: RSP: 0018:ffff9caa851f7630 EFLAGS: 00010286 Jun 13 18:49:22 obelix.fritz.box kernel: RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 000000000000890b Jun 13 18:49:22 obelix.fritz.box kernel: RDX: 00000000000088fb RSI: 0000000000000000 RDI: fffffffffffffe00 Jun 13 18:49:22 obelix.fritz.box kernel: RBP: fffffffffffffe00 R08: 0000000000000000 R09: 0000000000000001 Jun 13 18:49:22 obelix.fritz.box kernel: R10: 0000000000000000 R11: 0000000000000180 R12: ffff8ebf913c1158 Jun 13 18:49:22 obelix.fritz.box kernel: R13: fffffffffffffe00 R14: ffff9caa851f78a8 R15: ffff8ebf913c0000 Jun 13 18:49:22 obelix.fritz.box kernel: FS: 00007fd4f4640b00(0000) GS:ffff8ec2cf980000(0000) knlGS:0000000000000000 Jun 13 18:49:22 obelix.fritz.box kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jun 13 18:49:22 obelix.fritz.box kernel: CR2: fffffffffffffe20 CR3: 0000000110bc4001 CR4: 0000000000770ef0 Jun 13 18:49:22 obelix.fritz.box kernel: PKRU: 55555554 Jun 13 18:49:22 obelix.fritz.box kernel: Call Trace: Jun 13 18:49:22 obelix.fritz.box kernel: <TASK> Jun 13 18:49:22 obelix.fritz.box kernel: ? __die_body.cold+0x19/0x2c Jun 13 18:49:22 obelix.fritz.box kernel: ? page_fault_oops+0x155/0x280 Jun 13 18:49:22 obelix.fritz.box kernel: ? search_module_extables+0x10/0x50 Jun 13 18:49:22 obelix.fritz.box kernel: ? search_bpf_extables+0x56/0x80 Jun 13 18:49:22 obelix.fritz.box kernel: ? exc_page_fault+0x7a/0x80 Jun 13 18:49:22 obelix.fritz.box kernel: ? asm_exc_page_fault+0x22/0x30 Jun 13 18:49:22 obelix.fritz.box kernel: ? drm_suballoc_free+0x13/0x110 [drm_suballoc_helper] Jun 13 18:49:22 obelix.fritz.box kernel: xe_migrate_update_pgtables+0x692/0x9b0 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: ? kmalloc_trace+0x11f/0x2d0 Jun 13 18:49:22 obelix.fritz.box kernel: __xe_pt_bind_vma+0x492/0xbe0 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: xe_vm_bind_vma+0xa6/0x2e0 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: xe_vm_bind+0xf3/0x200 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: __xe_vma_op_execute+0x278/0x490 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: xe_vm_bind_ioctl+0x1ce0/0x1f20 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: drm_ioctl_kernel+0xa7/0x100 [drm] Jun 13 18:49:22 obelix.fritz.box kernel: drm_ioctl+0x312/0x5c0 [drm] Jun 13 18:49:22 obelix.fritz.box kernel: ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] Jun 13 18:49:22 obelix.fritz.box kernel: __x64_sys_ioctl+0x40d/0xb70 Jun 13 18:49:22 obelix.fritz.box kernel: do_syscall_64+0x7a/0x160 Jun 13 18:49:22 obelix.fritz.box kernel: ? __x64_sys_ioctl+0x13e/0xb70 Jun 13 18:49:22 obelix.fritz.box kernel: ? __count_memcg_events+0x43/0xb0 Jun 13 18:49:22 obelix.fritz.box kernel: ? handle_mm_fault+0x1f9/0x300 Jun 13 18:49:22 obelix.fritz.box kernel: ? syscall_exit_to_user_mode+0x68/0x1e0 Jun 13 18:49:22 obelix.fritz.box kernel: ? do_syscall_64+0x86/0x160 Jun 13 18:49:22 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 18:49:22 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 18:49:22 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 18:49:22 obelix.fritz.box kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Jun 13 18:49:22 obelix.fritz.box kernel: RIP: 0033:0x7fd4f4d23d2d Jun 13 18:49:22 obelix.fritz.box kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Jun 13 18:49:22 obelix.fritz.box kernel: RSP: 002b:00007fff94738650 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Jun 13 18:49:22 obelix.fritz.box kernel: RAX: ffffffffffffffda RBX: 00007fff94738710 RCX: 00007fd4f4d23d2d Jun 13 18:49:22 obelix.fritz.box kernel: RDX: 00007fff94738710 RSI: 0000000040886445 RDI: 0000000000000010 Jun 13 18:49:22 obelix.fritz.box kernel: RBP: 00007fff947386a0 R08: 0000000000001000 R09: 0000000000000000 Jun 13 18:49:22 obelix.fritz.box kernel: R10: 0000555a7a0fded0 R11: 0000000000000246 R12: 0000000000000010 Jun 13 18:49:22 obelix.fritz.box kernel: R13: 0000000000000000 R14: 0000555a78671160 R15: 0000555a7a234fa0 Jun 13 18:49:22 obelix.fritz.box kernel: </TASK> Jun 13 18:49:22 obelix.fritz.box kernel: Modules linked in: vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) rfcomm nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables bnep iwlmvm mac80211 libarc4 snd_hda_codec_hdmi intel_rapl_common kvm_intel iwlwifi snd_hda_codec_realtek kvm btusb snd_hda_codec_generic btintel snd_hda_scodec_component bluetooth snd_hda_intel cfg80211 snd_intel_dspcfg snd_hda_codec snd_hda_core mei_hdcp mei_pxp rfkill nfnetlink xe drm_ttm_helper ttm agpgart i2c_algo_bit gpu_sched drm_buddy drm_suballoc_helper drm_gpuvm drm_exec drm_display_helper drm_kms_helper drm Jun 13 18:49:22 obelix.fritz.box kernel: CR2: fffffffffffffe20 Jun 13 18:49:22 obelix.fritz.box kernel: ---[ end trace 0000000000000000 ]--- Jun 13 18:49:22 obelix.fritz.box kernel: RIP: 0010:drm_suballoc_free+0x13/0x110 [drm_suballoc_helper] Jun 13 18:49:22 obelix.fritz.box kernel: Code: eb ce 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 85 ff 0f 84 e1 00 00 00 41 54 55 48 89 fd 53 48 89 f3 <4c> 8b 67 20 4c 89 e7 e8 61 53 bd e2 48 85 db 0f 84 9f 00 00 00 48 Jun 13 18:49:22 obelix.fritz.box kernel: RSP: 0018:ffff9caa851f7630 EFLAGS: 00010286 Jun 13 18:49:22 obelix.fritz.box kernel: RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 000000000000890b Jun 13 18:49:22 obelix.fritz.box kernel: RDX: 00000000000088fb RSI: 0000000000000000 RDI: fffffffffffffe00 Jun 13 18:49:22 obelix.fritz.box kernel: RBP: fffffffffffffe00 R08: 0000000000000000 R09: 0000000000000001 Jun 13 18:49:22 obelix.fritz.box kernel: R10: 0000000000000000 R11: 0000000000000180 R12: ffff8ebf913c1158 Jun 13 18:49:22 obelix.fritz.box kernel: R13: fffffffffffffe00 R14: ffff9caa851f78a8 R15: ffff8ebf913c0000 Jun 13 18:49:22 obelix.fritz.box kernel: FS: 00007fd4f4640b00(0000) GS:ffff8ec2cf980000(0000) knlGS:0000000000000000 Jun 13 18:49:22 obelix.fritz.box kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jun 13 18:49:22 obelix.fritz.box kernel: CR2: fffffffffffffe20 CR3: 0000000110bc4001 CR4: 0000000000770ef0 Jun 13 18:49:22 obelix.fritz.box kernel: PKRU: 55555554 Jun 13 18:49:22 obelix.fritz.box kernel: note: Xorg[3657] exited with irqs disabled

1 year, 2 months

1
0
0 0

[PATCH] leds: mt6360: fix memory leak in mt6360_init_isnk_properties()

by Javier Carrasco

The fwnode_for_each_child_node() loop requires manual intervention to decrement the child refcount in case of an early return. Add the missing calls to fwnode_handle_put(child) to avoid memory leaks in the error paths. Cc: stable(a)vger.kernel.org Fixes: 679f8652064b ("leds: Add mt6360 driver") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> --- This bug was found while analyzing the code and I have no real hardware to validate the fix beyond compilation and static analysis. But given that the child node is only used to retrieve some properties within the fwnode_for_each_child_node(), and it is not used outside the loop, the fix is straightforward. Nevertheless, any tests to catch regressions with real hardware are always welcome. The bug has been around since the driver was added. --- drivers/leds/flash/leds-mt6360.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/leds/flash/leds-mt6360.c b/drivers/leds/flash/leds-mt6360.c index 1b75b4d36834..4c74f1cf01f0 100644 --- a/drivers/leds/flash/leds-mt6360.c +++ b/drivers/leds/flash/leds-mt6360.c @@ -643,14 +643,17 @@ static int mt6360_init_isnk_properties(struct mt6360_led *led, ret = fwnode_property_read_u32(child, "reg", &reg); if (ret || reg > MT6360_LED_ISNK3 || - priv->leds_active & BIT(reg)) + priv->leds_active & BIT(reg)) { + fwnode_handle_put(child); return -EINVAL; + } ret = fwnode_property_read_u32(child, "color", &color); if (ret) { dev_err(priv->dev, "led %d, no color specified\n", led->led_no); + fwnode_handle_put(child); return ret; } --- base-commit: d35b2284e966c0bef3e2182a5c5ea02177dd32e4 change-id: 20240610-leds-mt6360-memleak-78faf3e435b0 Best regards, -- Javier Carrasco <javier.carrasco.cruz(a)gmail.com>

1 year, 2 months

4
4
0 0

[PATCH V4 1/8] clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL

by Ajit Pandey

In LUCID EVO PLL CAL_L_VAL and L_VAL bitfields are part of single PLL_L_VAL register. Update for L_VAL bitfield values in PLL_L_VAL register using regmap_write() API in __alpha_pll_trion_set_rate callback will override LUCID EVO PLL initial configuration related to PLL_CAL_L_VAL bit fields in PLL_L_VAL register. Observed random PLL lock failures during PLL enable due to such override in PLL calibration value. Use regmap_update_bits() with L_VAL bitfield mask instead of regmap_write() API to update only PLL_L_VAL bitfields in __alpha_pll_trion_set_rate callback. Fixes: 260e36606a03 ("clk: qcom: clk-alpha-pll: add Lucid EVO PLL configuration interfaces") Cc: stable(a)vger.kernel.org Signed-off-by: Ajit Pandey <quic_ajipan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> --- drivers/clk/qcom/clk-alpha-pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c index c51647e37df8..a538559caaa0 100644 --- a/drivers/clk/qcom/clk-alpha-pll.c +++ b/drivers/clk/qcom/clk-alpha-pll.c @@ -1665,7 +1665,7 @@ static int __alpha_pll_trion_set_rate(struct clk_hw *hw, unsigned long rate, if (ret < 0) return ret; - regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l); + regmap_update_bits(pll->clkr.regmap, PLL_L_VAL(pll), LUCID_EVO_PLL_L_VAL_MASK, l); regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a); /* Latch the PLL input */ -- 2.25.1

1 year, 2 months

3
2
0 0

[PATCH v2] leds: triggers: flush pending brightness before activating trigger

by Thomas Weißschuh

The race fixed in timer_trig_activate() between a blocking set_brightness() call and trigger->activate() can affect any trigger. So move the call to flush_work() into led_trigger_set() where it can avoid the race for all triggers. Fixes: 0db37915d912 ("leds: avoid races with workqueue") Fixes: 8c0f693c6eff ("leds: avoid flush_work in atomic context") Cc: stable(a)vger.kernel.org Tested-by: Dustin L. Howett <dustin(a)howett.net> Signed-off-by: Thomas Weißschuh <linux(a)weissschuh.net> --- Changes in v2: - Cc stable - Add Dustin's Tested-by - Rebase against led/for-leds-next - Always execute flush_work(), similar to synchronize_rcu() - Link to v1: https://lore.kernel.org/r/20240603-led-trigger-flush-v1-1-c904c6e2fb34@weis… --- Commit 7abae7a11fc9 ("leds: trigger: Call synchronize_rcu() before calling trig->activate()") alone also solves the issue that the LED stays completely off after enabling the trigger. But there is a recognizable timeframe where it is disabled in between. Also from a correctness perspective, this seems like a coincidence and the call to flush_work() is the correct fix for that race. --- drivers/leds/led-triggers.c | 6 ++++++ drivers/leds/trigger/ledtrig-timer.c | 5 ----- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c index 59deadb86335..78eb20093b2c 100644 --- a/drivers/leds/led-triggers.c +++ b/drivers/leds/led-triggers.c @@ -201,6 +201,12 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) */ synchronize_rcu(); + /* + * If "set brightness to 0" is pending in workqueue, + * we don't want that to be reordered after ->activate() + */ + flush_work(&led_cdev->set_brightness_work); + ret = 0; if (trig->activate) ret = trig->activate(led_cdev); diff --git a/drivers/leds/trigger/ledtrig-timer.c b/drivers/leds/trigger/ledtrig-timer.c index b4688d1d9d2b..1d213c999d40 100644 --- a/drivers/leds/trigger/ledtrig-timer.c +++ b/drivers/leds/trigger/ledtrig-timer.c @@ -110,11 +110,6 @@ static int timer_trig_activate(struct led_classdev *led_cdev) led_cdev->flags &= ~LED_INIT_DEFAULT_TRIGGER; } - /* - * If "set brightness to 0" is pending in workqueue, we don't - * want that to be reordered after blink_set() - */ - flush_work(&led_cdev->set_brightness_work); led_blink_set(led_cdev, &led_cdev->blink_delay_on, &led_cdev->blink_delay_off); --- base-commit: 005408af25d5550e1bd22a18bf371651969c17ee change-id: 20240603-led-trigger-flush-3bef303eb902 Best regards, -- Thomas Weißschuh <linux(a)weissschuh.net>

1 year, 2 months

2
1
0 0

[PATCH net] gve: Clear napi->skb before dev_kfree_skb_any()

by Ziwei Xiao

gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it is freed with dev_kfree_skb_any(). This can result in a subsequent call to napi_get_frags returning a dangling pointer. Fix this by clearing napi->skb before the skb is freed. Fixes: 9b8dd5e5ea48 ("gve: DQO: Add RX path") Cc: stable(a)vger.kernel.org Reported-by: Shailend Chand <shailend(a)google.com> Signed-off-by: Ziwei Xiao <ziweixiao(a)google.com> Reviewed-by: Harshitha Ramamurthy <hramamurthy(a)google.com> Reviewed-by: Shailend Chand <shailend(a)google.com> Reviewed-by: Praveen Kaligineedi <pkaligineedi(a)google.com> --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/ethernet/google/gve/gve_rx_dqo.c index c1c912de59c7..1154c1d8f66f 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -647,11 +647,13 @@ static void gve_rx_skb_hash(struct sk_buff *skb, skb_set_hash(skb, le32_to_cpu(compl_desc->hash), hash_type); } -static void gve_rx_free_skb(struct gve_rx_ring *rx) +static void gve_rx_free_skb(struct napi_struct *napi, struct gve_rx_ring *rx) { if (!rx->ctx.skb_head) return; + if (rx->ctx.skb_head == napi->skb) + napi->skb = NULL; dev_kfree_skb_any(rx->ctx.skb_head); rx->ctx.skb_head = NULL; rx->ctx.skb_tail = NULL; @@ -950,7 +952,7 @@ int gve_rx_poll_dqo(struct gve_notify_block *block, int budget) err = gve_rx_dqo(napi, rx, compl_desc, complq->head, rx->q_num); if (err < 0) { - gve_rx_free_skb(rx); + gve_rx_free_skb(napi, rx); u64_stats_update_begin(&rx->statss); if (err == -ENOMEM) rx->rx_skb_alloc_fail++; @@ -993,7 +995,7 @@ int gve_rx_poll_dqo(struct gve_notify_block *block, int budget) /* gve_rx_complete_skb() will consume skb if successful */ if (gve_rx_complete_skb(rx, napi, compl_desc, feat) != 0) { - gve_rx_free_skb(rx); + gve_rx_free_skb(napi, rx); u64_stats_update_begin(&rx->statss); rx->rx_desc_err_dropped_pkt++; u64_stats_update_end(&rx->statss); -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

3
2
0 0

FAILED: patch "[PATCH] mmc: davinci: Don't strip remove function when driver is" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 55c421b364482b61c4c45313a535e61ed5ae4ea3 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061227-zit-rupture-640c@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 55c421b36448 ("mmc: davinci: Don't strip remove function when driver is builtin") bc1711e8332d ("mmc: davinci_mmc: Convert to platform remove callback returning void") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 55c421b364482b61c4c45313a535e61ed5ae4ea3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig(a)pengutronix.de> Date: Sun, 24 Mar 2024 12:40:17 +0100 Subject: [PATCH] mmc: davinci: Don't strip remove function when driver is builtin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 8bd938919687..d7427894e0bc 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1337,7 +1337,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static void __exit davinci_mmcsd_remove(struct platform_device *pdev) +static void davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1392,7 +1392,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove_new = __exit_p(davinci_mmcsd_remove), + .remove_new = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, };

1 year, 2 months

3
3
0 0

Re: [PATCH 6.9 000/157] 6.9.5-rc1 review

by Ronald Warsow

Hi Greg no regressions *here* on x86_64 (RKL, Intel 11th Gen. CPU) Thanks Tested-by: Ronald Warsow <rwarsow(a)gmx.de> ==== for the record: today I had a crash with 6.9.4, see below seems not to be reproduceable with 6.9.5-rc1 Kernel was compiled with LLVM=1 and Xe Graphic driver Crash happend 3 times while editing a LibreOffice Calc sheet only a hard reset got the box to live again Jun 13 14:47:40 obelix.fritz.box kernel: BUG: unable to handle page fault for address: fffffffffffffe20 Jun 13 14:47:40 obelix.fritz.box kernel: #PF: supervisor read access in kernel mode Jun 13 14:47:40 obelix.fritz.box kernel: #PF: error_code(0x0000) - not-present page Jun 13 14:47:40 obelix.fritz.box kernel: PGD 3d822f067 P4D 3d822f067 PUD 3d8231067 PMD 0 Jun 13 14:47:40 obelix.fritz.box kernel: Oops: 0000 [#1] PREEMPT SMP NOPTI Jun 13 14:47:40 obelix.fritz.box kernel: CPU: 5 PID: 2680 Comm: Xorg Tainted: G OE 6.9.4_MY_LLVM #1 Jun 13 14:47:40 obelix.fritz.box kernel: Hardware name: ASUS System Product Name/ROG STRIX B560-G GAMING WIFI, BIOS 2203 02/06/2024 Jun 13 14:47:40 obelix.fritz.box kernel: RIP: 0010:drm_suballoc_free+0x10/0xf0 [drm_suballoc_helper] Jun 13 14:47:40 obelix.fritz.box kernel: Code: e9 56 ff ff ff e8 20 6c bd e9 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 85 ff 74 50 41 57 41 56 53 49 89 f7 49 89 fe <48> 8b 5f 20 48 89 df e8 94 2f be e9 4d 85 ff 74 2a 49 8b 47 30 a8 Jun 13 14:47:40 obelix.fritz.box kernel: RSP: 0018:ffff9ecb068fb570 EFLAGS: 00010286 Jun 13 14:47:40 obelix.fritz.box kernel: RAX: fffffffffffffe00 RBX: 00000000fffffe00 RCX: 0000000000003e45 Jun 13 14:47:40 obelix.fritz.box kernel: RDX: 0000000000003e35 RSI: 0000000000000000 RDI: fffffffffffffe00 Jun 13 14:47:40 obelix.fritz.box kernel: RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffab258530 Jun 13 14:47:40 obelix.fritz.box kernel: R10: 0000000000000001 R11: 0000000000000005 R12: 0000000000000008 Jun 13 14:47:40 obelix.fritz.box kernel: R13: ffff9ecb068fb710 R14: fffffffffffffe00 R15: 0000000000000000 Jun 13 14:47:40 obelix.fritz.box kernel: FS: 00007f98cc24fb00(0000) GS:ffff8f870f680000(0000) knlGS:0000000000000000 Jun 13 14:47:40 obelix.fritz.box kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jun 13 14:47:40 obelix.fritz.box kernel: CR2: fffffffffffffe20 CR3: 0000000112d62002 CR4: 0000000000770ef0 Jun 13 14:47:40 obelix.fritz.box kernel: PKRU: 55555554 Jun 13 14:47:40 obelix.fritz.box kernel: Call Trace: Jun 13 14:47:40 obelix.fritz.box kernel: <TASK> Jun 13 14:47:40 obelix.fritz.box kernel: ? __die_body+0x61/0xb0 Jun 13 14:47:40 obelix.fritz.box kernel: ? page_fault_oops+0x2f4/0x400 Jun 13 14:47:40 obelix.fritz.box kernel: ? do_kern_addr_fault+0x92/0xd0 Jun 13 14:47:40 obelix.fritz.box kernel: ? exc_page_fault+0x60/0x70 Jun 13 14:47:40 obelix.fritz.box kernel: ? asm_exc_page_fault+0x22/0x30 Jun 13 14:47:40 obelix.fritz.box kernel: ? drm_suballoc_free+0x10/0xf0 [drm_suballoc_helper] Jun 13 14:47:40 obelix.fritz.box kernel: xe_migrate_update_pgtables+0x7d1/0x880 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: __xe_pt_bind_vma+0x909/0xd40 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: ? ttm_bo_validate+0x3f/0x1c0 [ttm] Jun 13 14:47:40 obelix.fritz.box kernel: xe_vm_bind_vma+0x12f/0x290 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: xe_vm_bind+0xb3/0x1b0 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: __xe_vma_op_execute+0x3cb/0x4e0 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: vm_bind_ioctl_ops_execute+0x94/0x230 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: xe_vm_bind_ioctl+0xe0a/0x1370 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: drm_ioctl_kernel+0xb6/0x100 [drm] Jun 13 14:47:40 obelix.fritz.box kernel: drm_ioctl+0x354/0x4d0 [drm] Jun 13 14:47:40 obelix.fritz.box kernel: ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] Jun 13 14:47:40 obelix.fritz.box kernel: __x64_sys_ioctl+0xdc3/0xf10 Jun 13 14:47:40 obelix.fritz.box kernel: ? do_syscall_64+0x96/0x140 Jun 13 14:47:40 obelix.fritz.box kernel: ? __x64_sys_ioctl+0x66/0xf10 Jun 13 14:47:40 obelix.fritz.box kernel: ? __count_memcg_events+0x47/0xb0 Jun 13 14:47:40 obelix.fritz.box kernel: ? handle_mm_fault+0xb39/0x11b0 Jun 13 14:47:40 obelix.fritz.box kernel: ? mt_find+0x99/0x140 Jun 13 14:47:40 obelix.fritz.box kernel: do_syscall_64+0x8a/0x140 Jun 13 14:47:40 obelix.fritz.box kernel: ? syscall_exit_to_user_mode+0x71/0x90 Jun 13 14:47:40 obelix.fritz.box kernel: ? do_syscall_64+0x96/0x140 Jun 13 14:47:40 obelix.fritz.box kernel: ? do_user_addr_fault+0x372/0x720 Jun 13 14:47:40 obelix.fritz.box kernel: ? syscall_exit_to_user_mode+0x71/0x90 Jun 13 14:47:40 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 14:47:40 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 14:47:40 obelix.fritz.box kernel: ? clear_bhb_loop+0x45/0xa0 Jun 13 14:47:40 obelix.fritz.box kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Jun 13 14:47:40 obelix.fritz.box kernel: RIP: 0033:0x7f98cc955d2d Jun 13 14:47:40 obelix.fritz.box kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Jun 13 14:47:40 obelix.fritz.box kernel: RSP: 002b:00007ffd7b24c7d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Jun 13 14:47:40 obelix.fritz.box kernel: RAX: ffffffffffffffda RBX: 00007ffd7b24c890 RCX: 00007f98cc955d2d Jun 13 14:47:40 obelix.fritz.box kernel: RDX: 00007ffd7b24c890 RSI: 0000000040886445 RDI: 0000000000000010 Jun 13 14:47:40 obelix.fritz.box kernel: RBP: 00007ffd7b24c820 R08: 0000000000006000 R09: 0000000000000000 Jun 13 14:47:40 obelix.fritz.box kernel: R10: 000055fa0f794010 R11: 0000000000000246 R12: 0000000000000010 Jun 13 14:47:40 obelix.fritz.box kernel: R13: 0000000000000000 R14: 000055fa0f84a170 R15: 000055fa1140a090 Jun 13 14:47:40 obelix.fritz.box kernel: </TASK> Jun 13 14:47:40 obelix.fritz.box kernel: Modules linked in: rfcomm nft_fib_inet nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_reject_inet nft_reject nf_reject_ipv6 nf_reject_ipv4 nft_ct nft_chain_nat nf_nat vboxnetadp(OE) vboxnetflt(OE) nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables vboxdrv(OE) bnep iwlmvm mac80211 btusb btintel snd_hda_codec_hdmi bluetooth libarc4 snd_hda_codec_realtek snd_hda_scodec_component snd_hda_codec_generic iwlwifi intel_rapl_common kvm_intel snd_hda_intel snd_intel_dspcfg snd_hda_codec kvm cfg80211 snd_hda_core mei_pxp mei_hdcp rfkill nfnetlink xe i2c_algo_bit drm_display_helper drm_kms_helper drm_buddy drm_suballoc_helper gpu_sched drm_ttm_helper ttm agpgart drm_gpuvm drm_exec drm Jun 13 14:47:40 obelix.fritz.box kernel: CR2: fffffffffffffe20 Jun 13 14:47:40 obelix.fritz.box kernel: ---[ end trace 0000000000000000 ]--- Jun 13 14:47:40 obelix.fritz.box kernel: RIP: 0010:drm_suballoc_free+0x10/0xf0 [drm_suballoc_helper] Jun 13 14:47:40 obelix.fritz.box kernel: Code: e9 56 ff ff ff e8 20 6c bd e9 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 85 ff 74 50 41 57 41 56 53 49 89 f7 49 89 fe <48> 8b 5f 20 48 89 df e8 94 2f be e9 4d 85 ff 74 2a 49 8b 47 30 a8 Jun 13 14:47:40 obelix.fritz.box kernel: RSP: 0018:ffff9ecb068fb570 EFLAGS: 00010286 Jun 13 14:47:40 obelix.fritz.box kernel: RAX: fffffffffffffe00 RBX: 00000000fffffe00 RCX: 0000000000003e45 Jun 13 14:47:40 obelix.fritz.box kernel: RDX: 0000000000003e35 RSI: 0000000000000000 RDI: fffffffffffffe00 Jun 13 14:47:40 obelix.fritz.box kernel: RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffab258530 Jun 13 14:47:40 obelix.fritz.box kernel: R10: 0000000000000001 R11: 0000000000000005 R12: 0000000000000008 Jun 13 14:47:40 obelix.fritz.box kernel: R13: ffff9ecb068fb710 R14: fffffffffffffe00 R15: 0000000000000000 Jun 13 14:47:40 obelix.fritz.box kernel: FS: 00007f98cc24fb00(0000) GS:ffff8f870f680000(0000) knlGS:0000000000000000 Jun 13 14:47:40 obelix.fritz.box kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jun 13 14:47:40 obelix.fritz.box kernel: CR2: fffffffffffffe20 CR3: 0000000112d62002 CR4: 0000000000770ef0 Jun 13 14:47:40 obelix.fritz.box kernel: PKRU: 55555554 Jun 13 14:47:40 obelix.fritz.box kernel: note: Xorg[2680] exited with irqs disabled

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] s390/cpacf: Split and rework cpacf query functions" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 830999bd7e72f4128b9dfa37090d9fa8120ce323 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061358-scanning-hacksaw-0540@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 830999bd7e72 ("s390/cpacf: Split and rework cpacf query functions") b84d0c417a5a ("s390/cpacf: get rid of register asm") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 830999bd7e72f4128b9dfa37090d9fa8120ce323 Mon Sep 17 00:00:00 2001 From: Harald Freudenberger <freude(a)linux.ibm.com> Date: Fri, 3 May 2024 11:31:42 +0200 Subject: [PATCH] s390/cpacf: Split and rework cpacf query functions Rework the cpacf query functions to use the correct RRE or RRF instruction formats and set register fields within instructions correctly. Fixes: 1afd43e0fbba ("s390/crypto: allow to query all known cpacf functions") Reported-by: Nina Schoetterl-Glausch <nsg(a)linux.ibm.com> Suggested-by: Heiko Carstens <hca(a)linux.ibm.com> Suggested-by: Juergen Christ <jchrist(a)linux.ibm.com> Suggested-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Holger Dengler <dengler(a)linux.ibm.com> Reviewed-by: Juergen Christ <jchrist(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> diff --git a/arch/s390/include/asm/cpacf.h b/arch/s390/include/asm/cpacf.h index b378e2b57ad8..153dc4fcc40a 100644 --- a/arch/s390/include/asm/cpacf.h +++ b/arch/s390/include/asm/cpacf.h @@ -166,28 +166,79 @@ typedef struct { unsigned char bytes[16]; } cpacf_mask_t; -/** - * cpacf_query() - check if a specific CPACF function is available - * @opcode: the opcode of the crypto instruction - * @func: the function code to test for - * - * Executes the query function for the given crypto instruction @opcode - * and checks if @func is available - * - * Returns 1 if @func is available for @opcode, 0 otherwise - */ -static __always_inline void __cpacf_query(unsigned int opcode, cpacf_mask_t *mask) +static __always_inline void __cpacf_query_rre(u32 opc, u8 r1, u8 r2, + cpacf_mask_t *mask) { asm volatile( - " lghi 0,0\n" /* query function */ - " lgr 1,%[mask]\n" - " spm 0\n" /* pckmo doesn't change the cc */ - /* Parameter regs are ignored, but must be nonzero and unique */ - "0: .insn rrf,%[opc] << 16,2,4,6,0\n" - " brc 1,0b\n" /* handle partial completion */ - : "=m" (*mask) - : [mask] "d" ((unsigned long)mask), [opc] "i" (opcode) - : "cc", "0", "1"); + " la %%r1,%[mask]\n" + " xgr %%r0,%%r0\n" + " .insn rre,%[opc] << 16,%[r1],%[r2]\n" + : [mask] "=R" (*mask) + : [opc] "i" (opc), + [r1] "i" (r1), [r2] "i" (r2) + : "cc", "r0", "r1"); +} + +static __always_inline void __cpacf_query_rrf(u32 opc, + u8 r1, u8 r2, u8 r3, u8 m4, + cpacf_mask_t *mask) +{ + asm volatile( + " la %%r1,%[mask]\n" + " xgr %%r0,%%r0\n" + " .insn rrf,%[opc] << 16,%[r1],%[r2],%[r3],%[m4]\n" + : [mask] "=R" (*mask) + : [opc] "i" (opc), [r1] "i" (r1), [r2] "i" (r2), + [r3] "i" (r3), [m4] "i" (m4) + : "cc", "r0", "r1"); +} + +static __always_inline void __cpacf_query(unsigned int opcode, + cpacf_mask_t *mask) +{ + switch (opcode) { + case CPACF_KDSA: + __cpacf_query_rre(CPACF_KDSA, 0, 2, mask); + break; + case CPACF_KIMD: + __cpacf_query_rre(CPACF_KIMD, 0, 2, mask); + break; + case CPACF_KLMD: + __cpacf_query_rre(CPACF_KLMD, 0, 2, mask); + break; + case CPACF_KM: + __cpacf_query_rre(CPACF_KM, 2, 4, mask); + break; + case CPACF_KMA: + __cpacf_query_rrf(CPACF_KMA, 2, 4, 6, 0, mask); + break; + case CPACF_KMAC: + __cpacf_query_rre(CPACF_KMAC, 0, 2, mask); + break; + case CPACF_KMC: + __cpacf_query_rre(CPACF_KMC, 2, 4, mask); + break; + case CPACF_KMCTR: + __cpacf_query_rrf(CPACF_KMCTR, 2, 4, 6, 0, mask); + break; + case CPACF_KMF: + __cpacf_query_rre(CPACF_KMF, 2, 4, mask); + break; + case CPACF_KMO: + __cpacf_query_rre(CPACF_KMO, 2, 4, mask); + break; + case CPACF_PCC: + __cpacf_query_rre(CPACF_PCC, 0, 0, mask); + break; + case CPACF_PCKMO: + __cpacf_query_rre(CPACF_PCKMO, 0, 0, mask); + break; + case CPACF_PRNO: + __cpacf_query_rre(CPACF_PRNO, 2, 4, mask); + break; + default: + BUG(); + } } static __always_inline int __cpacf_check_opcode(unsigned int opcode) @@ -215,6 +266,16 @@ static __always_inline int __cpacf_check_opcode(unsigned int opcode) } } +/** + * cpacf_query() - check if a specific CPACF function is available + * @opcode: the opcode of the crypto instruction + * @func: the function code to test for + * + * Executes the query function for the given crypto instruction @opcode + * and checks if @func is available + * + * Returns 1 if @func is available for @opcode, 0 otherwise + */ static __always_inline int cpacf_query(unsigned int opcode, cpacf_mask_t *mask) { if (__cpacf_check_opcode(opcode)) {

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] s390/cpacf: Split and rework cpacf query functions" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 830999bd7e72f4128b9dfa37090d9fa8120ce323 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061359-wasting-ribcage-b58b@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: 830999bd7e72 ("s390/cpacf: Split and rework cpacf query functions") b84d0c417a5a ("s390/cpacf: get rid of register asm") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 830999bd7e72f4128b9dfa37090d9fa8120ce323 Mon Sep 17 00:00:00 2001 From: Harald Freudenberger <freude(a)linux.ibm.com> Date: Fri, 3 May 2024 11:31:42 +0200 Subject: [PATCH] s390/cpacf: Split and rework cpacf query functions Rework the cpacf query functions to use the correct RRE or RRF instruction formats and set register fields within instructions correctly. Fixes: 1afd43e0fbba ("s390/crypto: allow to query all known cpacf functions") Reported-by: Nina Schoetterl-Glausch <nsg(a)linux.ibm.com> Suggested-by: Heiko Carstens <hca(a)linux.ibm.com> Suggested-by: Juergen Christ <jchrist(a)linux.ibm.com> Suggested-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Holger Dengler <dengler(a)linux.ibm.com> Reviewed-by: Juergen Christ <jchrist(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> diff --git a/arch/s390/include/asm/cpacf.h b/arch/s390/include/asm/cpacf.h index b378e2b57ad8..153dc4fcc40a 100644 --- a/arch/s390/include/asm/cpacf.h +++ b/arch/s390/include/asm/cpacf.h @@ -166,28 +166,79 @@ typedef struct { unsigned char bytes[16]; } cpacf_mask_t; -/** - * cpacf_query() - check if a specific CPACF function is available - * @opcode: the opcode of the crypto instruction - * @func: the function code to test for - * - * Executes the query function for the given crypto instruction @opcode - * and checks if @func is available - * - * Returns 1 if @func is available for @opcode, 0 otherwise - */ -static __always_inline void __cpacf_query(unsigned int opcode, cpacf_mask_t *mask) +static __always_inline void __cpacf_query_rre(u32 opc, u8 r1, u8 r2, + cpacf_mask_t *mask) { asm volatile( - " lghi 0,0\n" /* query function */ - " lgr 1,%[mask]\n" - " spm 0\n" /* pckmo doesn't change the cc */ - /* Parameter regs are ignored, but must be nonzero and unique */ - "0: .insn rrf,%[opc] << 16,2,4,6,0\n" - " brc 1,0b\n" /* handle partial completion */ - : "=m" (*mask) - : [mask] "d" ((unsigned long)mask), [opc] "i" (opcode) - : "cc", "0", "1"); + " la %%r1,%[mask]\n" + " xgr %%r0,%%r0\n" + " .insn rre,%[opc] << 16,%[r1],%[r2]\n" + : [mask] "=R" (*mask) + : [opc] "i" (opc), + [r1] "i" (r1), [r2] "i" (r2) + : "cc", "r0", "r1"); +} + +static __always_inline void __cpacf_query_rrf(u32 opc, + u8 r1, u8 r2, u8 r3, u8 m4, + cpacf_mask_t *mask) +{ + asm volatile( + " la %%r1,%[mask]\n" + " xgr %%r0,%%r0\n" + " .insn rrf,%[opc] << 16,%[r1],%[r2],%[r3],%[m4]\n" + : [mask] "=R" (*mask) + : [opc] "i" (opc), [r1] "i" (r1), [r2] "i" (r2), + [r3] "i" (r3), [m4] "i" (m4) + : "cc", "r0", "r1"); +} + +static __always_inline void __cpacf_query(unsigned int opcode, + cpacf_mask_t *mask) +{ + switch (opcode) { + case CPACF_KDSA: + __cpacf_query_rre(CPACF_KDSA, 0, 2, mask); + break; + case CPACF_KIMD: + __cpacf_query_rre(CPACF_KIMD, 0, 2, mask); + break; + case CPACF_KLMD: + __cpacf_query_rre(CPACF_KLMD, 0, 2, mask); + break; + case CPACF_KM: + __cpacf_query_rre(CPACF_KM, 2, 4, mask); + break; + case CPACF_KMA: + __cpacf_query_rrf(CPACF_KMA, 2, 4, 6, 0, mask); + break; + case CPACF_KMAC: + __cpacf_query_rre(CPACF_KMAC, 0, 2, mask); + break; + case CPACF_KMC: + __cpacf_query_rre(CPACF_KMC, 2, 4, mask); + break; + case CPACF_KMCTR: + __cpacf_query_rrf(CPACF_KMCTR, 2, 4, 6, 0, mask); + break; + case CPACF_KMF: + __cpacf_query_rre(CPACF_KMF, 2, 4, mask); + break; + case CPACF_KMO: + __cpacf_query_rre(CPACF_KMO, 2, 4, mask); + break; + case CPACF_PCC: + __cpacf_query_rre(CPACF_PCC, 0, 0, mask); + break; + case CPACF_PCKMO: + __cpacf_query_rre(CPACF_PCKMO, 0, 0, mask); + break; + case CPACF_PRNO: + __cpacf_query_rre(CPACF_PRNO, 2, 4, mask); + break; + default: + BUG(); + } } static __always_inline int __cpacf_check_opcode(unsigned int opcode) @@ -215,6 +266,16 @@ static __always_inline int __cpacf_check_opcode(unsigned int opcode) } } +/** + * cpacf_query() - check if a specific CPACF function is available + * @opcode: the opcode of the crypto instruction + * @func: the function code to test for + * + * Executes the query function for the given crypto instruction @opcode + * and checks if @func is available + * + * Returns 1 if @func is available for @opcode, 0 otherwise + */ static __always_inline int cpacf_query(unsigned int opcode, cpacf_mask_t *mask) { if (__cpacf_check_opcode(opcode)) {

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] s390/cpacf: Split and rework cpacf query functions" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 830999bd7e72f4128b9dfa37090d9fa8120ce323 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061300-undead-mortuary-7444@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: 830999bd7e72 ("s390/cpacf: Split and rework cpacf query functions") b84d0c417a5a ("s390/cpacf: get rid of register asm") 5c8e10f83262 ("s390: mark __cpacf_query() as __always_inline") e60fb8bf68d4 ("s390/cpacf: mark scpacf_query() as __always_inline") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 830999bd7e72f4128b9dfa37090d9fa8120ce323 Mon Sep 17 00:00:00 2001 From: Harald Freudenberger <freude(a)linux.ibm.com> Date: Fri, 3 May 2024 11:31:42 +0200 Subject: [PATCH] s390/cpacf: Split and rework cpacf query functions Rework the cpacf query functions to use the correct RRE or RRF instruction formats and set register fields within instructions correctly. Fixes: 1afd43e0fbba ("s390/crypto: allow to query all known cpacf functions") Reported-by: Nina Schoetterl-Glausch <nsg(a)linux.ibm.com> Suggested-by: Heiko Carstens <hca(a)linux.ibm.com> Suggested-by: Juergen Christ <jchrist(a)linux.ibm.com> Suggested-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Holger Dengler <dengler(a)linux.ibm.com> Reviewed-by: Juergen Christ <jchrist(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> diff --git a/arch/s390/include/asm/cpacf.h b/arch/s390/include/asm/cpacf.h index b378e2b57ad8..153dc4fcc40a 100644 --- a/arch/s390/include/asm/cpacf.h +++ b/arch/s390/include/asm/cpacf.h @@ -166,28 +166,79 @@ typedef struct { unsigned char bytes[16]; } cpacf_mask_t; -/** - * cpacf_query() - check if a specific CPACF function is available - * @opcode: the opcode of the crypto instruction - * @func: the function code to test for - * - * Executes the query function for the given crypto instruction @opcode - * and checks if @func is available - * - * Returns 1 if @func is available for @opcode, 0 otherwise - */ -static __always_inline void __cpacf_query(unsigned int opcode, cpacf_mask_t *mask) +static __always_inline void __cpacf_query_rre(u32 opc, u8 r1, u8 r2, + cpacf_mask_t *mask) { asm volatile( - " lghi 0,0\n" /* query function */ - " lgr 1,%[mask]\n" - " spm 0\n" /* pckmo doesn't change the cc */ - /* Parameter regs are ignored, but must be nonzero and unique */ - "0: .insn rrf,%[opc] << 16,2,4,6,0\n" - " brc 1,0b\n" /* handle partial completion */ - : "=m" (*mask) - : [mask] "d" ((unsigned long)mask), [opc] "i" (opcode) - : "cc", "0", "1"); + " la %%r1,%[mask]\n" + " xgr %%r0,%%r0\n" + " .insn rre,%[opc] << 16,%[r1],%[r2]\n" + : [mask] "=R" (*mask) + : [opc] "i" (opc), + [r1] "i" (r1), [r2] "i" (r2) + : "cc", "r0", "r1"); +} + +static __always_inline void __cpacf_query_rrf(u32 opc, + u8 r1, u8 r2, u8 r3, u8 m4, + cpacf_mask_t *mask) +{ + asm volatile( + " la %%r1,%[mask]\n" + " xgr %%r0,%%r0\n" + " .insn rrf,%[opc] << 16,%[r1],%[r2],%[r3],%[m4]\n" + : [mask] "=R" (*mask) + : [opc] "i" (opc), [r1] "i" (r1), [r2] "i" (r2), + [r3] "i" (r3), [m4] "i" (m4) + : "cc", "r0", "r1"); +} + +static __always_inline void __cpacf_query(unsigned int opcode, + cpacf_mask_t *mask) +{ + switch (opcode) { + case CPACF_KDSA: + __cpacf_query_rre(CPACF_KDSA, 0, 2, mask); + break; + case CPACF_KIMD: + __cpacf_query_rre(CPACF_KIMD, 0, 2, mask); + break; + case CPACF_KLMD: + __cpacf_query_rre(CPACF_KLMD, 0, 2, mask); + break; + case CPACF_KM: + __cpacf_query_rre(CPACF_KM, 2, 4, mask); + break; + case CPACF_KMA: + __cpacf_query_rrf(CPACF_KMA, 2, 4, 6, 0, mask); + break; + case CPACF_KMAC: + __cpacf_query_rre(CPACF_KMAC, 0, 2, mask); + break; + case CPACF_KMC: + __cpacf_query_rre(CPACF_KMC, 2, 4, mask); + break; + case CPACF_KMCTR: + __cpacf_query_rrf(CPACF_KMCTR, 2, 4, 6, 0, mask); + break; + case CPACF_KMF: + __cpacf_query_rre(CPACF_KMF, 2, 4, mask); + break; + case CPACF_KMO: + __cpacf_query_rre(CPACF_KMO, 2, 4, mask); + break; + case CPACF_PCC: + __cpacf_query_rre(CPACF_PCC, 0, 0, mask); + break; + case CPACF_PCKMO: + __cpacf_query_rre(CPACF_PCKMO, 0, 0, mask); + break; + case CPACF_PRNO: + __cpacf_query_rre(CPACF_PRNO, 2, 4, mask); + break; + default: + BUG(); + } } static __always_inline int __cpacf_check_opcode(unsigned int opcode) @@ -215,6 +266,16 @@ static __always_inline int __cpacf_check_opcode(unsigned int opcode) } } +/** + * cpacf_query() - check if a specific CPACF function is available + * @opcode: the opcode of the crypto instruction + * @func: the function code to test for + * + * Executes the query function for the given crypto instruction @opcode + * and checks if @func is available + * + * Returns 1 if @func is available for @opcode, 0 otherwise + */ static __always_inline int cpacf_query(unsigned int opcode, cpacf_mask_t *mask) { if (__cpacf_check_opcode(opcode)) {

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] cifs: fix creating sockets when using sfu mount options" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 518549c120e671c4906f77d1802b97e9b23f673a # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061319-machine-lanky-74ba@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 518549c120e6 ("cifs: fix creating sockets when using sfu mount options") c6ff459037b2 ("smb: client: instantiate when creating SFU files") b0348e459c83 ("smb: client: introduce cifs_sfu_make_node()") 45e724022e27 ("smb: client: set correct file type from NFS reparse points") 539aad7f14da ("smb: client: introduce ->parse_reparse_point()") ed3e0a149b58 ("smb: client: implement ->query_reparse_point() for SMB1") 72bc63f5e23a ("smb3: fix creating FIFOs when mounting with "sfu" mount option") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 518549c120e671c4906f77d1802b97e9b23f673a Mon Sep 17 00:00:00 2001 From: Steve French <stfrench(a)microsoft.com> Date: Wed, 29 May 2024 18:16:56 -0500 Subject: [PATCH] cifs: fix creating sockets when using sfu mount options When running fstest generic/423 with sfu mount option, it was being skipped due to inability to create sockets: generic/423 [not run] cifs does not support mknod/mkfifo which can also be easily reproduced with their af_unix tool: ./src/af_unix /mnt1/socket-two bind: Operation not permitted Fix sfu mount option to allow creating and reporting sockets. Cc: stable(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h index c46d418c1c0c..a2072ab9e586 100644 --- a/fs/smb/client/cifspdu.h +++ b/fs/smb/client/cifspdu.h @@ -2574,7 +2574,7 @@ typedef struct { struct win_dev { - unsigned char type[8]; /* IntxCHR or IntxBLK or LnxFIFO*/ + unsigned char type[8]; /* IntxCHR or IntxBLK or LnxFIFO or LnxSOCK */ __le64 major; __le64 minor; } __attribute__((packed)); diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index 262576573eb5..4a8aa1de9522 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -606,6 +606,10 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, mnr = le64_to_cpu(*(__le64 *)(pbuf+16)); fattr->cf_rdev = MKDEV(mjr, mnr); } + } else if (memcmp("LnxSOCK", pbuf, 8) == 0) { + cifs_dbg(FYI, "Socket\n"); + fattr->cf_mode |= S_IFSOCK; + fattr->cf_dtype = DT_SOCK; } else if (memcmp("IntxLNK", pbuf, 7) == 0) { cifs_dbg(FYI, "Symlink\n"); fattr->cf_mode |= S_IFLNK; diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 4ce6c3121a7e..c8e536540895 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4997,6 +4997,9 @@ static int __cifs_sfu_make_node(unsigned int xid, struct inode *inode, pdev.major = cpu_to_le64(MAJOR(dev)); pdev.minor = cpu_to_le64(MINOR(dev)); break; + case S_IFSOCK: + strscpy(pdev.type, "LnxSOCK"); + break; case S_IFIFO: strscpy(pdev.type, "LnxFIFO"); break;

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] cifs: fix creating sockets when using sfu mount options" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 518549c120e671c4906f77d1802b97e9b23f673a # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061318-percolate-breeching-4de7@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 518549c120e6 ("cifs: fix creating sockets when using sfu mount options") c6ff459037b2 ("smb: client: instantiate when creating SFU files") b0348e459c83 ("smb: client: introduce cifs_sfu_make_node()") 45e724022e27 ("smb: client: set correct file type from NFS reparse points") 539aad7f14da ("smb: client: introduce ->parse_reparse_point()") ed3e0a149b58 ("smb: client: implement ->query_reparse_point() for SMB1") 72bc63f5e23a ("smb3: fix creating FIFOs when mounting with "sfu" mount option") a18280e7fdea ("smb: cilent: set reparse mount points as automounts") 9a49e221a641 ("smb: client: do not query reparse points twice on symlinks") 5f71ebc41294 ("smb: client: parse reparse point flag in create response") 348a04a8d113 ("smb: client: get rid of dfs code dep in namespace.c") 0a049935e47e ("smb: client: get rid of dfs naming in automount code") 561f82a3a24c ("smb: client: rename cifs_dfs_ref.c to namespace.c") c5f44a3d5477 ("smb: client: make smb2_compound_op() return resp buffer on success") 8b4e285d8ce3 ("smb: client: move some params to cifs_open_info_data") c071b34f62dd ("cifs: is_network_name_deleted should return a bool") 3ae872de4107 ("smb: client: fix shared DFS root mounts with different prefixes") 49024ec8795e ("smb: client: fix parsing of source mount option") d439b29057e2 ("smb: client: fix broken file attrs with nodfs mounts") 33f736187d08 ("cifs: prevent use-after-free by freeing the cfile later") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 518549c120e671c4906f77d1802b97e9b23f673a Mon Sep 17 00:00:00 2001 From: Steve French <stfrench(a)microsoft.com> Date: Wed, 29 May 2024 18:16:56 -0500 Subject: [PATCH] cifs: fix creating sockets when using sfu mount options When running fstest generic/423 with sfu mount option, it was being skipped due to inability to create sockets: generic/423 [not run] cifs does not support mknod/mkfifo which can also be easily reproduced with their af_unix tool: ./src/af_unix /mnt1/socket-two bind: Operation not permitted Fix sfu mount option to allow creating and reporting sockets. Cc: stable(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h index c46d418c1c0c..a2072ab9e586 100644 --- a/fs/smb/client/cifspdu.h +++ b/fs/smb/client/cifspdu.h @@ -2574,7 +2574,7 @@ typedef struct { struct win_dev { - unsigned char type[8]; /* IntxCHR or IntxBLK or LnxFIFO*/ + unsigned char type[8]; /* IntxCHR or IntxBLK or LnxFIFO or LnxSOCK */ __le64 major; __le64 minor; } __attribute__((packed)); diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index 262576573eb5..4a8aa1de9522 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -606,6 +606,10 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, mnr = le64_to_cpu(*(__le64 *)(pbuf+16)); fattr->cf_rdev = MKDEV(mjr, mnr); } + } else if (memcmp("LnxSOCK", pbuf, 8) == 0) { + cifs_dbg(FYI, "Socket\n"); + fattr->cf_mode |= S_IFSOCK; + fattr->cf_dtype = DT_SOCK; } else if (memcmp("IntxLNK", pbuf, 7) == 0) { cifs_dbg(FYI, "Symlink\n"); fattr->cf_mode |= S_IFLNK; diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 4ce6c3121a7e..c8e536540895 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4997,6 +4997,9 @@ static int __cifs_sfu_make_node(unsigned int xid, struct inode *inode, pdev.major = cpu_to_le64(MAJOR(dev)); pdev.minor = cpu_to_le64(MINOR(dev)); break; + case S_IFSOCK: + strscpy(pdev.type, "LnxSOCK"); + break; case S_IFIFO: strscpy(pdev.type, "LnxFIFO"); break;

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 7373a51e7998b508af7136530f3a997b286ce81c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061340-jogger-smooth-6cf5@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors") 09a46acb3697 ("nilfs2: return the mapped address from nilfs_get_page()") 79ea65563ad8 ("nilfs2: Remove check for PageError") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7373a51e7998b508af7136530f3a997b286ce81c Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Tue, 4 Jun 2024 22:42:55 +0900 Subject: [PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. Link: https://lkml.kernel.org/r/20240604134255.7165-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+c8166c541d3971bf6c87(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8166c541d3971bf6c87 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index a002a44ff161..52e50b1b7f22 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -607,7 +607,7 @@ int nilfs_empty_dir(struct inode *inode) kaddr = nilfs_get_folio(inode, i, &folio); if (IS_ERR(kaddr)) - continue; + return 0; de = (struct nilfs_dir_entry *)kaddr; kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 7373a51e7998b508af7136530f3a997b286ce81c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061339-promenade-licking-9943@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors") 09a46acb3697 ("nilfs2: return the mapped address from nilfs_get_page()") 79ea65563ad8 ("nilfs2: Remove check for PageError") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7373a51e7998b508af7136530f3a997b286ce81c Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Tue, 4 Jun 2024 22:42:55 +0900 Subject: [PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. Link: https://lkml.kernel.org/r/20240604134255.7165-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+c8166c541d3971bf6c87(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8166c541d3971bf6c87 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index a002a44ff161..52e50b1b7f22 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -607,7 +607,7 @@ int nilfs_empty_dir(struct inode *inode) kaddr = nilfs_get_folio(inode, i, &folio); if (IS_ERR(kaddr)) - continue; + return 0; de = (struct nilfs_dir_entry *)kaddr; kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 7373a51e7998b508af7136530f3a997b286ce81c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061338-mothball-scrooge-f07e@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors") 09a46acb3697 ("nilfs2: return the mapped address from nilfs_get_page()") 79ea65563ad8 ("nilfs2: Remove check for PageError") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7373a51e7998b508af7136530f3a997b286ce81c Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Tue, 4 Jun 2024 22:42:55 +0900 Subject: [PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. Link: https://lkml.kernel.org/r/20240604134255.7165-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+c8166c541d3971bf6c87(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8166c541d3971bf6c87 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index a002a44ff161..52e50b1b7f22 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -607,7 +607,7 @@ int nilfs_empty_dir(struct inode *inode) kaddr = nilfs_get_folio(inode, i, &folio); if (IS_ERR(kaddr)) - continue; + return 0; de = (struct nilfs_dir_entry *)kaddr; kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 7373a51e7998b508af7136530f3a997b286ce81c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061337-eclair-moneywise-df20@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors") 09a46acb3697 ("nilfs2: return the mapped address from nilfs_get_page()") 79ea65563ad8 ("nilfs2: Remove check for PageError") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7373a51e7998b508af7136530f3a997b286ce81c Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Tue, 4 Jun 2024 22:42:55 +0900 Subject: [PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. Link: https://lkml.kernel.org/r/20240604134255.7165-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+c8166c541d3971bf6c87(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8166c541d3971bf6c87 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index a002a44ff161..52e50b1b7f22 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -607,7 +607,7 @@ int nilfs_empty_dir(struct inode *inode) kaddr = nilfs_get_folio(inode, i, &folio); if (IS_ERR(kaddr)) - continue; + return 0; de = (struct nilfs_dir_entry *)kaddr; kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 7373a51e7998b508af7136530f3a997b286ce81c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061336-douche-credibly-5e48@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors") 09a46acb3697 ("nilfs2: return the mapped address from nilfs_get_page()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7373a51e7998b508af7136530f3a997b286ce81c Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Tue, 4 Jun 2024 22:42:55 +0900 Subject: [PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. Link: https://lkml.kernel.org/r/20240604134255.7165-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+c8166c541d3971bf6c87(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8166c541d3971bf6c87 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index a002a44ff161..52e50b1b7f22 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -607,7 +607,7 @@ int nilfs_empty_dir(struct inode *inode) kaddr = nilfs_get_folio(inode, i, &folio); if (IS_ERR(kaddr)) - continue; + return 0; de = (struct nilfs_dir_entry *)kaddr; kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 7373a51e7998b508af7136530f3a997b286ce81c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061335-elevating-tumble-532e@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 7373a51e7998 ("nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors") 09a46acb3697 ("nilfs2: return the mapped address from nilfs_get_page()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7373a51e7998b508af7136530f3a997b286ce81c Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Tue, 4 Jun 2024 22:42:55 +0900 Subject: [PATCH] nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. Link: https://lkml.kernel.org/r/20240604134255.7165-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+c8166c541d3971bf6c87(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8166c541d3971bf6c87 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index a002a44ff161..52e50b1b7f22 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -607,7 +607,7 @@ int nilfs_empty_dir(struct inode *inode) kaddr = nilfs_get_folio(inode, i, &folio); if (IS_ERR(kaddr)) - continue; + return 0; de = (struct nilfs_dir_entry *)kaddr; kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix potential kernel bug due to lack of writeback" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x a4ca369ca221bb7e06c725792ac107f0e48e82e7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061330-jolliness-decorator-05e9@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: a4ca369ca221 ("nilfs2: fix potential kernel bug due to lack of writeback flag waiting") ff5710c3f3c2 ("nilfs2: convert nilfs_segctor_prepare_write to use folios") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From a4ca369ca221bb7e06c725792ac107f0e48e82e7 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Thu, 30 May 2024 23:15:56 +0900 Subject: [PATCH] nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com Fixes: 9ff05123e3bf ("nilfs2: segment constructor") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 60d4f59f7665..6ea81f1d5094 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1652,6 +1652,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh->b_folio != bd_folio) { if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1665,6 +1666,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh == segbuf->sb_super_root) { if (bh->b_folio != bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1681,6 +1683,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix potential kernel bug due to lack of writeback" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x a4ca369ca221bb7e06c725792ac107f0e48e82e7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061328-whinny-taking-53a8@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: a4ca369ca221 ("nilfs2: fix potential kernel bug due to lack of writeback flag waiting") ff5710c3f3c2 ("nilfs2: convert nilfs_segctor_prepare_write to use folios") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From a4ca369ca221bb7e06c725792ac107f0e48e82e7 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Thu, 30 May 2024 23:15:56 +0900 Subject: [PATCH] nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com Fixes: 9ff05123e3bf ("nilfs2: segment constructor") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 60d4f59f7665..6ea81f1d5094 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1652,6 +1652,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh->b_folio != bd_folio) { if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1665,6 +1666,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh == segbuf->sb_super_root) { if (bh->b_folio != bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1681,6 +1683,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix potential kernel bug due to lack of writeback" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x a4ca369ca221bb7e06c725792ac107f0e48e82e7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061327-aerobics-siberian-30c2@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: a4ca369ca221 ("nilfs2: fix potential kernel bug due to lack of writeback flag waiting") ff5710c3f3c2 ("nilfs2: convert nilfs_segctor_prepare_write to use folios") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From a4ca369ca221bb7e06c725792ac107f0e48e82e7 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Thu, 30 May 2024 23:15:56 +0900 Subject: [PATCH] nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com Fixes: 9ff05123e3bf ("nilfs2: segment constructor") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 60d4f59f7665..6ea81f1d5094 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1652,6 +1652,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh->b_folio != bd_folio) { if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1665,6 +1666,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh == segbuf->sb_super_root) { if (bh->b_folio != bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1681,6 +1683,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix potential kernel bug due to lack of writeback" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x a4ca369ca221bb7e06c725792ac107f0e48e82e7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061326-unleash-doorbell-437e@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: a4ca369ca221 ("nilfs2: fix potential kernel bug due to lack of writeback flag waiting") ff5710c3f3c2 ("nilfs2: convert nilfs_segctor_prepare_write to use folios") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From a4ca369ca221bb7e06c725792ac107f0e48e82e7 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Thu, 30 May 2024 23:15:56 +0900 Subject: [PATCH] nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com Fixes: 9ff05123e3bf ("nilfs2: segment constructor") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 60d4f59f7665..6ea81f1d5094 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1652,6 +1652,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh->b_folio != bd_folio) { if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1665,6 +1666,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh == segbuf->sb_super_root) { if (bh->b_folio != bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1681,6 +1683,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix potential kernel bug due to lack of writeback" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x a4ca369ca221bb7e06c725792ac107f0e48e82e7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061325-rubbing-sappiness-1a44@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: a4ca369ca221 ("nilfs2: fix potential kernel bug due to lack of writeback flag waiting") ff5710c3f3c2 ("nilfs2: convert nilfs_segctor_prepare_write to use folios") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From a4ca369ca221bb7e06c725792ac107f0e48e82e7 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Thu, 30 May 2024 23:15:56 +0900 Subject: [PATCH] nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com Fixes: 9ff05123e3bf ("nilfs2: segment constructor") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 60d4f59f7665..6ea81f1d5094 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1652,6 +1652,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh->b_folio != bd_folio) { if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1665,6 +1666,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh == segbuf->sb_super_root) { if (bh->b_folio != bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1681,6 +1683,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] nilfs2: fix potential kernel bug due to lack of writeback" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x a4ca369ca221bb7e06c725792ac107f0e48e82e7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061324-prize-qualifier-989e@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: a4ca369ca221 ("nilfs2: fix potential kernel bug due to lack of writeback flag waiting") ff5710c3f3c2 ("nilfs2: convert nilfs_segctor_prepare_write to use folios") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From a4ca369ca221bb7e06c725792ac107f0e48e82e7 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Thu, 30 May 2024 23:15:56 +0900 Subject: [PATCH] nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com Fixes: 9ff05123e3bf ("nilfs2: segment constructor") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 60d4f59f7665..6ea81f1d5094 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1652,6 +1652,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh->b_folio != bd_folio) { if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1665,6 +1666,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh == segbuf->sb_super_root) { if (bh->b_folio != bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio); @@ -1681,6 +1683,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } if (bd_folio) { folio_lock(bd_folio); + folio_wait_writeback(bd_folio); folio_clear_dirty_for_io(bd_folio); folio_start_writeback(bd_folio); folio_unlock(bd_folio);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] bpf: fix multi-uprobe PID filtering logic" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 46ba0e49b64232adac35a2bc892f1710c5b0fb7f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061330-custody-resolved-131a@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 46ba0e49b642 ("bpf: fix multi-uprobe PID filtering logic") f17d1a18a3dd ("selftests/bpf: Add more uprobe multi fail tests") 0d83786f5661 ("selftests/bpf: Add test for abnormal cnt during multi-uprobe attachment") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 46ba0e49b64232adac35a2bc892f1710c5b0fb7f Mon Sep 17 00:00:00 2001 From: Andrii Nakryiko <andrii(a)kernel.org> Date: Tue, 21 May 2024 09:33:57 -0700 Subject: [PATCH] bpf: fix multi-uprobe PID filtering logic Current implementation of PID filtering logic for multi-uprobes in uprobe_prog_run() is filtering down to exact *thread*, while the intent for PID filtering it to filter by *process* instead. The check in uprobe_prog_run() also differs from the analogous one in uprobe_multi_link_filter() for some reason. The latter is correct, checking task->mm, not the task itself. Fix the check in uprobe_prog_run() to perform the same task->mm check. While doing this, we also update get_pid_task() use to use PIDTYPE_TGID type of lookup, given the intent is to get a representative task of an entire process. This doesn't change behavior, but seems more logical. It would hold task group leader task now, not any random thread task. Last but not least, given multi-uprobe support is half-broken due to this PID filtering logic (depending on whether PID filtering is important or not), we need to make it easy for user space consumers (including libbpf) to easily detect whether PID filtering logic was already fixed. We do it here by adding an early check on passed pid parameter. If it's negative (and so has no chance of being a valid PID), we return -EINVAL. Previous behavior would eventually return -ESRCH ("No process found"), given there can't be any process with negative PID. This subtle change won't make any practical change in behavior, but will allow applications to detect PID filtering fixes easily. Libbpf fixes take advantage of this in the next patch. Cc: stable(a)vger.kernel.org Acked-by: Jiri Olsa <jolsa(a)kernel.org> Fixes: b733eeade420 ("bpf: Add pid filter support for uprobe_multi link") Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20240521163401.3005045-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index f5154c051d2c..1baaeb9ca205 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -3295,7 +3295,7 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe, struct bpf_run_ctx *old_run_ctx; int err = 0; - if (link->task && current != link->task) + if (link->task && current->mm != link->task->mm) return 0; if (sleepable) @@ -3396,8 +3396,9 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr upath = u64_to_user_ptr(attr->link_create.uprobe_multi.path); uoffsets = u64_to_user_ptr(attr->link_create.uprobe_multi.offsets); cnt = attr->link_create.uprobe_multi.cnt; + pid = attr->link_create.uprobe_multi.pid; - if (!upath || !uoffsets || !cnt) + if (!upath || !uoffsets || !cnt || pid < 0) return -EINVAL; if (cnt > MAX_UPROBE_MULTI_CNT) return -E2BIG; @@ -3421,10 +3422,9 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr goto error_path_put; } - pid = attr->link_create.uprobe_multi.pid; if (pid) { rcu_read_lock(); - task = get_pid_task(find_vpid(pid), PIDTYPE_PID); + task = get_pid_task(find_vpid(pid), PIDTYPE_TGID); rcu_read_unlock(); if (!task) { err = -ESRCH; diff --git a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c index 8269cdee33ae..38fda42fd70f 100644 --- a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c +++ b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c @@ -397,7 +397,7 @@ static void test_attach_api_fails(void) link_fd = bpf_link_create(prog_fd, 0, BPF_TRACE_UPROBE_MULTI, &opts); if (!ASSERT_ERR(link_fd, "link_fd")) goto cleanup; - ASSERT_EQ(link_fd, -ESRCH, "pid_is_wrong"); + ASSERT_EQ(link_fd, -EINVAL, "pid_is_wrong"); cleanup: if (link_fd >= 0)

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] btrfs: fix leak of qgroup extent records after transaction" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x fb33eb2ef0d88e75564983ef057b44c5b7e4fded # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061357-december-gaming-f1a1@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: fb33eb2ef0d8 ("btrfs: fix leak of qgroup extent records after transaction abort") 99f09ce309b8 ("btrfs: make btrfs_destroy_delayed_refs() return void") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb33eb2ef0d88e75564983ef057b44c5b7e4fded Mon Sep 17 00:00:00 2001 From: Filipe Manana <fdmanana(a)suse.com> Date: Mon, 3 Jun 2024 12:49:08 +0100 Subject: [PATCH] btrfs: fix leak of qgroup extent records after transaction abort Qgroup extent records are created when delayed ref heads are created and then released after accounting extents at btrfs_qgroup_account_extents(), called during the transaction commit path. If a transaction is aborted we free the qgroup records by calling btrfs_qgroup_destroy_extent_records() at btrfs_destroy_delayed_refs(), unless we don't have delayed references. We are incorrectly assuming that no delayed references means we don't have qgroup extents records. We can currently have no delayed references because we ran them all during a transaction commit and the transaction was aborted after that due to some error in the commit path. So fix this by ensuring we btrfs_qgroup_destroy_extent_records() at btrfs_destroy_delayed_refs() even if we don't have any delayed references. Reported-by: syzbot+0fecc032fa134afd49df(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/0000000000004e7f980619f91835@google.com/ Fixes: 81f7eb00ff5b ("btrfs: destroy qgroup extent records on transaction abort") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index a91a8056758a..242ada7e47b4 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -4538,18 +4538,10 @@ static void btrfs_destroy_delayed_refs(struct btrfs_transaction *trans, struct btrfs_fs_info *fs_info) { struct rb_node *node; - struct btrfs_delayed_ref_root *delayed_refs; + struct btrfs_delayed_ref_root *delayed_refs = &trans->delayed_refs; struct btrfs_delayed_ref_node *ref; - delayed_refs = &trans->delayed_refs; - spin_lock(&delayed_refs->lock); - if (atomic_read(&delayed_refs->num_entries) == 0) { - spin_unlock(&delayed_refs->lock); - btrfs_debug(fs_info, "delayed_refs has NO entry"); - return; - } - while ((node = rb_first_cached(&delayed_refs->href_root)) != NULL) { struct btrfs_delayed_ref_head *head; struct rb_node *n;

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] btrfs: qgroup: update rescan message levels and error codes" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 1fa7603d569b9e738e9581937ba8725cd7d39b48 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061307-gab-underfoot-f7db@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 1fa7603d569b ("btrfs: qgroup: update rescan message levels and error codes") 182940f4f4db ("btrfs: qgroup: add new quota mode for simple quotas") 6b0cd63bc75c ("btrfs: qgroup: introduce quota mode") 515020900d44 ("btrfs: read raid stripe tree from disk") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 1fa7603d569b9e738e9581937ba8725cd7d39b48 Mon Sep 17 00:00:00 2001 From: David Sterba <dsterba(a)suse.com> Date: Thu, 2 May 2024 22:45:58 +0200 Subject: [PATCH] btrfs: qgroup: update rescan message levels and error codes On filesystems without enabled quotas there's still a warning message in the logs when rescan is called. In that case it's not a problem that should be reported, rescan can be called unconditionally. Change the error code to ENOTCONN which is used for 'quotas not enabled' elsewhere. Remove message (also a warning) when rescan is called during an ongoing rescan, this brings no useful information and the error code is sufficient. Change message levels to debug for now, they can be removed eventually. CC: stable(a)vger.kernel.org # 6.6+ Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index eb28141d5c37..f93354a96909 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -3820,14 +3820,14 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, /* we're resuming qgroup rescan at mount time */ if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN)) { - btrfs_warn(fs_info, + btrfs_debug(fs_info, "qgroup rescan init failed, qgroup rescan is not queued"); ret = -EINVAL; } else if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON)) { - btrfs_warn(fs_info, + btrfs_debug(fs_info, "qgroup rescan init failed, qgroup is not enabled"); - ret = -EINVAL; + ret = -ENOTCONN; } if (ret) @@ -3838,14 +3838,12 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, if (init_flags) { if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN) { - btrfs_warn(fs_info, - "qgroup rescan is already in progress"); ret = -EINPROGRESS; } else if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON)) { - btrfs_warn(fs_info, + btrfs_debug(fs_info, "qgroup rescan init failed, qgroup is not enabled"); - ret = -EINVAL; + ret = -ENOTCONN; } else if (btrfs_qgroup_mode(fs_info) == BTRFS_QGROUP_MODE_DISABLED) { /* Quota disable is in progress */ ret = -EBUSY;

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] tracefs: Update inode permissions on remount" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 27c046484382d78b4abb0a6e9905a20121af9b35 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061310-exemplify-snore-c1b0@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 27c046484382 ("tracefs: Update inode permissions on remount") baa23a8d4360 ("tracefs: Reset permissions on remount if permissions are options") 8dce06e98c70 ("eventfs: Clean up dentry ops and add revalidate function") 49304c2b93e4 ("tracefs: dentry lookup crapectomy") 4fa4b010b83f ("eventfs: Initialize the tracefs inode properly") d81786f53aec ("tracefs: Zero out the tracefs_inode when allocating it") 29142dc92c37 ("tracefs: remove stale 'update_gid' code") 8186fff7ab64 ("tracefs/eventfs: Use root and instance inodes as default ownership") b0f7e2d739b4 ("eventfs: Remove "lookup" parameter from create_dir/file_dentry()") ad579864637a ("tracefs: Check for dentry->d_inode exists in set_gid()") 7e8358edf503 ("eventfs: Fix file and directory uid and gid ownership") 0dfc852b6fe3 ("eventfs: Have event files and directories default to parent uid and gid") 5eaf7f0589c0 ("eventfs: Fix events beyond NAME_MAX blocking tasks") f49f950c217b ("eventfs: Make sure that parent->d_inode is locked in creating files/dirs") fc4561226fea ("eventfs: Do not allow NULL parent to eventfs_start_creating()") bcae32c5632f ("eventfs: Move taking of inode_lock into dcache_dir_open_wrapper()") 71cade82f2b5 ("eventfs: Do not invalidate dentry in create_file/dir_dentry()") 88903daecacf ("eventfs: Remove expectation that ei->is_freed means ei->dentry == NULL") 44365329f821 ("eventfs: Hold eventfs_mutex when calling callback functions") 28e12c09f5aa ("eventfs: Save ownership and mode") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 27c046484382d78b4abb0a6e9905a20121af9b35 Mon Sep 17 00:00:00 2001 From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> Date: Thu, 23 May 2024 01:14:27 -0400 Subject: [PATCH] tracefs: Update inode permissions on remount When a remount happens, if a gid or uid is specified update the inodes to have the same gid and uid. This will allow the simplification of the permissions logic for the dynamically created files and directories. Link: https://lore.kernel.org/linux-trace-kernel/20240523051539.592429986@goodmis… Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Masahiro Yamada <masahiroy(a)kernel.org> Fixes: baa23a8d4360d ("tracefs: Reset permissions on remount if permissions are options") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 55a40a730b10..5dfb1ccd56ea 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -317,20 +317,29 @@ void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid) if (!ei) return; - if (update_uid) + if (update_uid) { ei->attr.mode &= ~EVENTFS_SAVE_UID; + ei->attr.uid = ti->vfs_inode.i_uid; + } - if (update_gid) + + if (update_gid) { ei->attr.mode &= ~EVENTFS_SAVE_GID; + ei->attr.gid = ti->vfs_inode.i_gid; + } if (!ei->entry_attrs) return; for (int i = 0; i < ei->nr_entries; i++) { - if (update_uid) + if (update_uid) { ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID; - if (update_gid) + ei->entry_attrs[i].uid = ti->vfs_inode.i_uid; + } + if (update_gid) { ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID; + ei->entry_attrs[i].gid = ti->vfs_inode.i_gid; + } } } diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index a827f6a716c4..9252e0d78ea2 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -373,12 +373,21 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) rcu_read_lock(); list_for_each_entry_rcu(ti, &tracefs_inodes, list) { - if (update_uid) + if (update_uid) { ti->flags &= ~TRACEFS_UID_PERM_SET; + ti->vfs_inode.i_uid = fsi->uid; + } - if (update_gid) + if (update_gid) { ti->flags &= ~TRACEFS_GID_PERM_SET; + ti->vfs_inode.i_gid = fsi->gid; + } + /* + * Note, the above ti->vfs_inode updates are + * used in eventfs_remount() so they must come + * before calling it. + */ if (ti->flags & TRACEFS_EVENT_INODE) eventfs_remount(ti, update_uid, update_gid); }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] tracefs: Update inode permissions on remount" failed to apply to 6.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y git checkout FETCH_HEAD git cherry-pick -x 27c046484382d78b4abb0a6e9905a20121af9b35 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061309-pliable-outcast-adb7@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^.. Possible dependencies: 27c046484382 ("tracefs: Update inode permissions on remount") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 27c046484382d78b4abb0a6e9905a20121af9b35 Mon Sep 17 00:00:00 2001 From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> Date: Thu, 23 May 2024 01:14:27 -0400 Subject: [PATCH] tracefs: Update inode permissions on remount When a remount happens, if a gid or uid is specified update the inodes to have the same gid and uid. This will allow the simplification of the permissions logic for the dynamically created files and directories. Link: https://lore.kernel.org/linux-trace-kernel/20240523051539.592429986@goodmis… Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Masahiro Yamada <masahiroy(a)kernel.org> Fixes: baa23a8d4360d ("tracefs: Reset permissions on remount if permissions are options") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 55a40a730b10..5dfb1ccd56ea 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -317,20 +317,29 @@ void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid) if (!ei) return; - if (update_uid) + if (update_uid) { ei->attr.mode &= ~EVENTFS_SAVE_UID; + ei->attr.uid = ti->vfs_inode.i_uid; + } - if (update_gid) + + if (update_gid) { ei->attr.mode &= ~EVENTFS_SAVE_GID; + ei->attr.gid = ti->vfs_inode.i_gid; + } if (!ei->entry_attrs) return; for (int i = 0; i < ei->nr_entries; i++) { - if (update_uid) + if (update_uid) { ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID; - if (update_gid) + ei->entry_attrs[i].uid = ti->vfs_inode.i_uid; + } + if (update_gid) { ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID; + ei->entry_attrs[i].gid = ti->vfs_inode.i_gid; + } } } diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index a827f6a716c4..9252e0d78ea2 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -373,12 +373,21 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) rcu_read_lock(); list_for_each_entry_rcu(ti, &tracefs_inodes, list) { - if (update_uid) + if (update_uid) { ti->flags &= ~TRACEFS_UID_PERM_SET; + ti->vfs_inode.i_uid = fsi->uid; + } - if (update_gid) + if (update_gid) { ti->flags &= ~TRACEFS_GID_PERM_SET; + ti->vfs_inode.i_gid = fsi->gid; + } + /* + * Note, the above ti->vfs_inode updates are + * used in eventfs_remount() so they must come + * before calling it. + */ if (ti->flags & TRACEFS_EVENT_INODE) eventfs_remount(ti, update_uid, update_gid); }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] eventfs: Update all the eventfs_inodes from the events" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 340f0c7067a95281ad13734f8225f49c6cf52067 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061306-handed-oyster-2002@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") 27c046484382 ("tracefs: Update inode permissions on remount") baa23a8d4360 ("tracefs: Reset permissions on remount if permissions are options") 8dce06e98c70 ("eventfs: Clean up dentry ops and add revalidate function") 49304c2b93e4 ("tracefs: dentry lookup crapectomy") 4fa4b010b83f ("eventfs: Initialize the tracefs inode properly") d81786f53aec ("tracefs: Zero out the tracefs_inode when allocating it") 29142dc92c37 ("tracefs: remove stale 'update_gid' code") 8186fff7ab64 ("tracefs/eventfs: Use root and instance inodes as default ownership") b0f7e2d739b4 ("eventfs: Remove "lookup" parameter from create_dir/file_dentry()") ad579864637a ("tracefs: Check for dentry->d_inode exists in set_gid()") 7e8358edf503 ("eventfs: Fix file and directory uid and gid ownership") 0dfc852b6fe3 ("eventfs: Have event files and directories default to parent uid and gid") 5eaf7f0589c0 ("eventfs: Fix events beyond NAME_MAX blocking tasks") f49f950c217b ("eventfs: Make sure that parent->d_inode is locked in creating files/dirs") fc4561226fea ("eventfs: Do not allow NULL parent to eventfs_start_creating()") bcae32c5632f ("eventfs: Move taking of inode_lock into dcache_dir_open_wrapper()") 71cade82f2b5 ("eventfs: Do not invalidate dentry in create_file/dir_dentry()") 88903daecacf ("eventfs: Remove expectation that ei->is_freed means ei->dentry == NULL") 44365329f821 ("eventfs: Hold eventfs_mutex when calling callback functions") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 340f0c7067a95281ad13734f8225f49c6cf52067 Mon Sep 17 00:00:00 2001 From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> Date: Thu, 23 May 2024 01:14:28 -0400 Subject: [PATCH] eventfs: Update all the eventfs_inodes from the events descriptor The change to update the permissions of the eventfs_inode had the misconception that using the tracefs_inode would find all the eventfs_inodes that have been updated and reset them on remount. The problem with this approach is that the eventfs_inodes are freed when they are no longer used (basically the reason the eventfs system exists). When they are freed, the updated eventfs_inodes are not reset on a remount because their tracefs_inodes have been freed. Instead, since the events directory eventfs_inode always has a tracefs_inode pointing to it (it is not freed when finished), and the events directory has a link to all its children, have the eventfs_remount() function only operate on the events eventfs_inode and have it descend into its children updating their uid and gids. Link: https://lore.kernel.org/all/CAK7LNARXgaWw3kH9JgrnH4vK6fr8LDkNKf3wq8NhMWJrVw… Link: https://lore.kernel.org/linux-trace-kernel/20240523051539.754424703@goodmis… Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Fixes: baa23a8d4360d ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Masahiro Yamada <masahiroy(a)kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 5dfb1ccd56ea..129d0f54ba62 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -305,6 +305,45 @@ static const struct file_operations eventfs_file_operations = { .llseek = generic_file_llseek, }; +static void eventfs_set_attrs(struct eventfs_inode *ei, bool update_uid, kuid_t uid, + bool update_gid, kgid_t gid, int level) +{ + struct eventfs_inode *ei_child; + + /* Update events/<system>/<event> */ + if (WARN_ON_ONCE(level > 3)) + return; + + if (update_uid) { + ei->attr.mode &= ~EVENTFS_SAVE_UID; + ei->attr.uid = uid; + } + + if (update_gid) { + ei->attr.mode &= ~EVENTFS_SAVE_GID; + ei->attr.gid = gid; + } + + list_for_each_entry(ei_child, &ei->children, list) { + eventfs_set_attrs(ei_child, update_uid, uid, update_gid, gid, level + 1); + } + + if (!ei->entry_attrs) + return; + + for (int i = 0; i < ei->nr_entries; i++) { + if (update_uid) { + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID; + ei->entry_attrs[i].uid = uid; + } + if (update_gid) { + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID; + ei->entry_attrs[i].gid = gid; + } + } + +} + /* * On a remount of tracefs, if UID or GID options are set, then * the mount point inode permissions should be used. @@ -314,33 +353,12 @@ void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid) { struct eventfs_inode *ei = ti->private; - if (!ei) + /* Only the events directory does the updates */ + if (!ei || !ei->is_events || ei->is_freed) return; - if (update_uid) { - ei->attr.mode &= ~EVENTFS_SAVE_UID; - ei->attr.uid = ti->vfs_inode.i_uid; - } - - - if (update_gid) { - ei->attr.mode &= ~EVENTFS_SAVE_GID; - ei->attr.gid = ti->vfs_inode.i_gid; - } - - if (!ei->entry_attrs) - return; - - for (int i = 0; i < ei->nr_entries; i++) { - if (update_uid) { - ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID; - ei->entry_attrs[i].uid = ti->vfs_inode.i_uid; - } - if (update_gid) { - ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID; - ei->entry_attrs[i].gid = ti->vfs_inode.i_gid; - } - } + eventfs_set_attrs(ei, update_uid, ti->vfs_inode.i_uid, + update_gid, ti->vfs_inode.i_gid, 0); } /* Return the evenfs_inode of the "events" directory */

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] eventfs: Update all the eventfs_inodes from the events" failed to apply to 6.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y git checkout FETCH_HEAD git cherry-pick -x 340f0c7067a95281ad13734f8225f49c6cf52067 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061305-kilogram-handheld-7bd9@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^.. Possible dependencies: 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") 27c046484382 ("tracefs: Update inode permissions on remount") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 340f0c7067a95281ad13734f8225f49c6cf52067 Mon Sep 17 00:00:00 2001 From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> Date: Thu, 23 May 2024 01:14:28 -0400 Subject: [PATCH] eventfs: Update all the eventfs_inodes from the events descriptor The change to update the permissions of the eventfs_inode had the misconception that using the tracefs_inode would find all the eventfs_inodes that have been updated and reset them on remount. The problem with this approach is that the eventfs_inodes are freed when they are no longer used (basically the reason the eventfs system exists). When they are freed, the updated eventfs_inodes are not reset on a remount because their tracefs_inodes have been freed. Instead, since the events directory eventfs_inode always has a tracefs_inode pointing to it (it is not freed when finished), and the events directory has a link to all its children, have the eventfs_remount() function only operate on the events eventfs_inode and have it descend into its children updating their uid and gids. Link: https://lore.kernel.org/all/CAK7LNARXgaWw3kH9JgrnH4vK6fr8LDkNKf3wq8NhMWJrVw… Link: https://lore.kernel.org/linux-trace-kernel/20240523051539.754424703@goodmis… Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Fixes: baa23a8d4360d ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Masahiro Yamada <masahiroy(a)kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 5dfb1ccd56ea..129d0f54ba62 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -305,6 +305,45 @@ static const struct file_operations eventfs_file_operations = { .llseek = generic_file_llseek, }; +static void eventfs_set_attrs(struct eventfs_inode *ei, bool update_uid, kuid_t uid, + bool update_gid, kgid_t gid, int level) +{ + struct eventfs_inode *ei_child; + + /* Update events/<system>/<event> */ + if (WARN_ON_ONCE(level > 3)) + return; + + if (update_uid) { + ei->attr.mode &= ~EVENTFS_SAVE_UID; + ei->attr.uid = uid; + } + + if (update_gid) { + ei->attr.mode &= ~EVENTFS_SAVE_GID; + ei->attr.gid = gid; + } + + list_for_each_entry(ei_child, &ei->children, list) { + eventfs_set_attrs(ei_child, update_uid, uid, update_gid, gid, level + 1); + } + + if (!ei->entry_attrs) + return; + + for (int i = 0; i < ei->nr_entries; i++) { + if (update_uid) { + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID; + ei->entry_attrs[i].uid = uid; + } + if (update_gid) { + ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID; + ei->entry_attrs[i].gid = gid; + } + } + +} + /* * On a remount of tracefs, if UID or GID options are set, then * the mount point inode permissions should be used. @@ -314,33 +353,12 @@ void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid) { struct eventfs_inode *ei = ti->private; - if (!ei) + /* Only the events directory does the updates */ + if (!ei || !ei->is_events || ei->is_freed) return; - if (update_uid) { - ei->attr.mode &= ~EVENTFS_SAVE_UID; - ei->attr.uid = ti->vfs_inode.i_uid; - } - - - if (update_gid) { - ei->attr.mode &= ~EVENTFS_SAVE_GID; - ei->attr.gid = ti->vfs_inode.i_gid; - } - - if (!ei->entry_attrs) - return; - - for (int i = 0; i < ei->nr_entries; i++) { - if (update_uid) { - ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_UID; - ei->entry_attrs[i].uid = ti->vfs_inode.i_uid; - } - if (update_gid) { - ei->entry_attrs[i].mode &= ~EVENTFS_SAVE_GID; - ei->entry_attrs[i].gid = ti->vfs_inode.i_gid; - } - } + eventfs_set_attrs(ei, update_uid, ti->vfs_inode.i_uid, + update_gid, ti->vfs_inode.i_gid, 0); } /* Return the evenfs_inode of the "events" directory */

1 year, 2 months

1
0
0 0

[PATCH v2] usb: ucsi: stm32: fix command completion handling

by Fabrice Gasnier

Sometimes errors are seen, when doing DR swap, like: [ 24.672481] ucsi-stm32g0-i2c 0-0035: UCSI_GET_PDOS failed (-5) [ 24.720188] ucsi-stm32g0-i2c 0-0035: ucsi_handle_connector_change: GET_CONNECTOR_STATUS failed (-5) There may be some race, which lead to read CCI, before the command complete flag is set, hence returning -EIO. Similar fix has been done also in ucsi_acpi [1]. In case of a spurious or otherwise delayed notification it is possible that CCI still reports the previous completion. The UCSI spec is aware of this and provides two completion bits in CCI, one for normal commands and one for acks. As acks and commands alternate the notification handler can determine if the completion bit is from the current command. To fix this add the ACK_PENDING bit for ucsi_stm32g0 and only complete commands if the completion bit matches. [1] https://lore.kernel.org/lkml/20240121204123.275441-3-lk@c--e.de/ Fixes: 72849d4fcee7 ("usb: typec: ucsi: stm32g0: add support for stm32g0 controller") Signed-off-by: Fabrice Gasnier <fabrice.gasnier(a)foss.st.com> --- Changes in v2: rebase and define ACK_PENDING as commented by Dmitry. --- drivers/usb/typec/ucsi/ucsi_stm32g0.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/drivers/usb/typec/ucsi/ucsi_stm32g0.c b/drivers/usb/typec/ucsi/ucsi_stm32g0.c index ac48b7763114..ac69288e8bb0 100644 --- a/drivers/usb/typec/ucsi/ucsi_stm32g0.c +++ b/drivers/usb/typec/ucsi/ucsi_stm32g0.c @@ -65,6 +65,7 @@ struct ucsi_stm32g0 { struct device *dev; unsigned long flags; #define COMMAND_PENDING 1 +#define ACK_PENDING 2 const char *fw_name; struct ucsi *ucsi; bool suspended; @@ -396,9 +397,13 @@ static int ucsi_stm32g0_sync_write(struct ucsi *ucsi, unsigned int offset, const size_t len) { struct ucsi_stm32g0 *g0 = ucsi_get_drvdata(ucsi); + bool ack = UCSI_COMMAND(*(u64 *)val) == UCSI_ACK_CC_CI; int ret; - set_bit(COMMAND_PENDING, &g0->flags); + if (ack) + set_bit(ACK_PENDING, &g0->flags); + else + set_bit(COMMAND_PENDING, &g0->flags); ret = ucsi_stm32g0_async_write(ucsi, offset, val, len); if (ret) @@ -406,9 +411,14 @@ static int ucsi_stm32g0_sync_write(struct ucsi *ucsi, unsigned int offset, const if (!wait_for_completion_timeout(&g0->complete, msecs_to_jiffies(5000))) ret = -ETIMEDOUT; + else + return 0; out_clear_bit: - clear_bit(COMMAND_PENDING, &g0->flags); + if (ack) + clear_bit(ACK_PENDING, &g0->flags); + else + clear_bit(COMMAND_PENDING, &g0->flags); return ret; } @@ -429,8 +439,9 @@ static irqreturn_t ucsi_stm32g0_irq_handler(int irq, void *data) if (UCSI_CCI_CONNECTOR(cci)) ucsi_connector_change(g0->ucsi, UCSI_CCI_CONNECTOR(cci)); - if (test_bit(COMMAND_PENDING, &g0->flags) && - cci & (UCSI_CCI_ACK_COMPLETE | UCSI_CCI_COMMAND_COMPLETE)) + if (cci & UCSI_CCI_ACK_COMPLETE && test_and_clear_bit(ACK_PENDING, &g0->flags)) + complete(&g0->complete); + if (cci & UCSI_CCI_COMMAND_COMPLETE && test_and_clear_bit(COMMAND_PENDING, &g0->flags)) complete(&g0->complete); return IRQ_HANDLED; -- 2.25.1

1 year, 2 months

3
2
0 0

FAILED: patch "[PATCH] ext4: fix slab-out-of-bounds in" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061335-payee-pamphlet-09d5@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 13df4d44a3aa ("ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()") 57341fe3179c ("ext4: refactor out ext4_generic_attr_show()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 Mon Sep 17 00:00:00 2001 From: Baokun Li <libaokun1(a)huawei.com> Date: Tue, 19 Mar 2024 19:33:20 +0800 Subject: [PATCH] ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists() We can trigger a slab-out-of-bounds with the following commands: mkfs.ext4 -F /dev/$disk 10G mount /dev/$disk /tmp/test echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc echo test > /tmp/test/file && sync ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11 CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521 Call Trace: dump_stack_lvl+0x2c/0x50 kasan_report+0xb6/0xf0 ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] ext4_mb_regular_allocator+0x19e9/0x2370 [ext4] ext4_mb_new_blocks+0x88a/0x1370 [ext4] ext4_ext_map_blocks+0x14f7/0x2390 [ext4] ext4_map_blocks+0x569/0xea0 [ext4] ext4_do_writepages+0x10f6/0x1bc0 [ext4] [...] ================================================================== The flow of issue triggering is as follows: // Set s_mb_group_prealloc to 2147483647 via sysfs ext4_mb_new_blocks ext4_mb_normalize_request ext4_mb_normalize_group_request ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc ext4_mb_regular_allocator ext4_mb_choose_next_group ext4_mb_choose_next_group_best_avail mb_avg_fragment_size_order order = fls(len) - 2 = 29 ext4_mb_find_good_group_avg_frag_lists frag_list = &sbi->s_mb_avg_fragment_size[order] if (list_empty(frag_list)) // Trigger SOOB! At 4k block size, the length of the s_mb_avg_fragment_size list is 14, but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds to be triggered by an attempt to access an element at index 29. Add a new attr_id attr_clusters_in_group with values in the range [0, sbi->s_clusters_per_group] and declare mb_group_prealloc as that type to fix the issue. In addition avoid returning an order from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb) and reduce some useless loops. Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)") CC: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240319113325.3110393-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 12b3f196010b..dbf04f91516c 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -831,6 +831,8 @@ static int mb_avg_fragment_size_order(struct super_block *sb, ext4_grpblk_t len) return 0; if (order == MB_NUM_ORDERS(sb)) order--; + if (WARN_ON_ONCE(order > MB_NUM_ORDERS(sb))) + order = MB_NUM_ORDERS(sb) - 1; return order; } @@ -1008,6 +1010,8 @@ static void ext4_mb_choose_next_group_best_avail(struct ext4_allocation_context * goal length. */ order = fls(ac->ac_g_ex.fe_len) - 1; + if (WARN_ON_ONCE(order - 1 > MB_NUM_ORDERS(ac->ac_sb))) + order = MB_NUM_ORDERS(ac->ac_sb); min_order = order - sbi->s_mb_best_avail_max_trim_order; if (min_order < 0) min_order = 0; diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 7f455b5f22c0..ddd71673176c 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -29,6 +29,7 @@ typedef enum { attr_trigger_test_error, attr_first_error_time, attr_last_error_time, + attr_clusters_in_group, attr_feature, attr_pointer_ui, attr_pointer_ul, @@ -207,13 +208,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444); EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead, ext4_sb_info, s_inode_readahead_blks); +EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group, + ext4_sb_info, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal); EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats); EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan); EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan); EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs); EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request); -EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups); EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); @@ -376,6 +378,7 @@ static ssize_t ext4_generic_attr_show(struct ext4_attr *a, switch (a->attr_id) { case attr_inode_readahead: + case attr_clusters_in_group: case attr_pointer_ui: if (a->attr_ptr == ptr_ext4_super_block_offset) return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr)); @@ -455,6 +458,14 @@ static ssize_t ext4_generic_attr_store(struct ext4_attr *a, else *((unsigned int *) ptr) = t; return len; + case attr_clusters_in_group: + ret = kstrtouint(skip_spaces(buf), 0, &t); + if (ret) + return ret; + if (t > sbi->s_clusters_per_group) + return -EINVAL; + *((unsigned int *) ptr) = t; + return len; case attr_pointer_ul: ret = kstrtoul(skip_spaces(buf), 0, &lt); if (ret)

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] ext4: fix slab-out-of-bounds in" failed to apply to 6.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y git checkout FETCH_HEAD git cherry-pick -x 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061334-impish-backdrop-1c34@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^.. Possible dependencies: 13df4d44a3aa ("ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()") 57341fe3179c ("ext4: refactor out ext4_generic_attr_show()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 Mon Sep 17 00:00:00 2001 From: Baokun Li <libaokun1(a)huawei.com> Date: Tue, 19 Mar 2024 19:33:20 +0800 Subject: [PATCH] ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists() We can trigger a slab-out-of-bounds with the following commands: mkfs.ext4 -F /dev/$disk 10G mount /dev/$disk /tmp/test echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc echo test > /tmp/test/file && sync ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11 CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521 Call Trace: dump_stack_lvl+0x2c/0x50 kasan_report+0xb6/0xf0 ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] ext4_mb_regular_allocator+0x19e9/0x2370 [ext4] ext4_mb_new_blocks+0x88a/0x1370 [ext4] ext4_ext_map_blocks+0x14f7/0x2390 [ext4] ext4_map_blocks+0x569/0xea0 [ext4] ext4_do_writepages+0x10f6/0x1bc0 [ext4] [...] ================================================================== The flow of issue triggering is as follows: // Set s_mb_group_prealloc to 2147483647 via sysfs ext4_mb_new_blocks ext4_mb_normalize_request ext4_mb_normalize_group_request ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc ext4_mb_regular_allocator ext4_mb_choose_next_group ext4_mb_choose_next_group_best_avail mb_avg_fragment_size_order order = fls(len) - 2 = 29 ext4_mb_find_good_group_avg_frag_lists frag_list = &sbi->s_mb_avg_fragment_size[order] if (list_empty(frag_list)) // Trigger SOOB! At 4k block size, the length of the s_mb_avg_fragment_size list is 14, but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds to be triggered by an attempt to access an element at index 29. Add a new attr_id attr_clusters_in_group with values in the range [0, sbi->s_clusters_per_group] and declare mb_group_prealloc as that type to fix the issue. In addition avoid returning an order from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb) and reduce some useless loops. Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)") CC: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240319113325.3110393-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 12b3f196010b..dbf04f91516c 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -831,6 +831,8 @@ static int mb_avg_fragment_size_order(struct super_block *sb, ext4_grpblk_t len) return 0; if (order == MB_NUM_ORDERS(sb)) order--; + if (WARN_ON_ONCE(order > MB_NUM_ORDERS(sb))) + order = MB_NUM_ORDERS(sb) - 1; return order; } @@ -1008,6 +1010,8 @@ static void ext4_mb_choose_next_group_best_avail(struct ext4_allocation_context * goal length. */ order = fls(ac->ac_g_ex.fe_len) - 1; + if (WARN_ON_ONCE(order - 1 > MB_NUM_ORDERS(ac->ac_sb))) + order = MB_NUM_ORDERS(ac->ac_sb); min_order = order - sbi->s_mb_best_avail_max_trim_order; if (min_order < 0) min_order = 0; diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 7f455b5f22c0..ddd71673176c 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -29,6 +29,7 @@ typedef enum { attr_trigger_test_error, attr_first_error_time, attr_last_error_time, + attr_clusters_in_group, attr_feature, attr_pointer_ui, attr_pointer_ul, @@ -207,13 +208,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444); EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead, ext4_sb_info, s_inode_readahead_blks); +EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group, + ext4_sb_info, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal); EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats); EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan); EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan); EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs); EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request); -EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups); EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); @@ -376,6 +378,7 @@ static ssize_t ext4_generic_attr_show(struct ext4_attr *a, switch (a->attr_id) { case attr_inode_readahead: + case attr_clusters_in_group: case attr_pointer_ui: if (a->attr_ptr == ptr_ext4_super_block_offset) return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr)); @@ -455,6 +458,14 @@ static ssize_t ext4_generic_attr_store(struct ext4_attr *a, else *((unsigned int *) ptr) = t; return len; + case attr_clusters_in_group: + ret = kstrtouint(skip_spaces(buf), 0, &t); + if (ret) + return ret; + if (t > sbi->s_clusters_per_group) + return -EINVAL; + *((unsigned int *) ptr) = t; + return len; case attr_pointer_ul: ret = kstrtoul(skip_spaces(buf), 0, &lt); if (ret)

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] 9p: add missing locking around taking dentry fid list" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x c898afdc15645efb555acb6d85b484eb40a45409 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061333-wincing-tackle-2315@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: c898afdc1564 ("9p: add missing locking around taking dentry fid list") b48dbb998d70 ("9p fid refcount: add p9_fid_get/put wrappers") 47b1e3432b06 ("9p: Remove unnecessary variable for old fids while walking from d_parent") cba83f47fc0e ("9p: Track the root fid with its own variable during lookups") b0017602fdf6 ("9p: fix EBADF errors in cached mode") 2a3dcbccd64b ("9p: Fix refcounting during full path walks for fid lookups") beca774fc51a ("9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl") 6e195b0f7c8e ("9p: fix a bunch of checkpatch warnings") eb497943fa21 ("9p: Convert to using the netfs helper lib to do reads and caching") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From c898afdc15645efb555acb6d85b484eb40a45409 Mon Sep 17 00:00:00 2001 From: Dominique Martinet <asmadeus(a)codewreck.org> Date: Tue, 21 May 2024 21:13:36 +0900 Subject: [PATCH] 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248 Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335 The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible. Fixes: 154372e67d40 ("fs/9p: fix create-unlink-getattr idiom") Cc: stable(a)vger.kernel.org Reported-by: Meysam Firouzi Reported-by: Amirmohammad Eftekhar Reviewed-by: Christian Schoenebeck <linux_oss(a)crudebyte.com> Message-ID: <20240521122947.1080227-1-asmadeus(a)codewreck.org> Signed-off-by: Dominique Martinet <asmadeus(a)codewreck.org> diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c index f16f73581634..01338d4c2d9e 100644 --- a/fs/9p/vfs_dentry.c +++ b/fs/9p/vfs_dentry.c @@ -48,12 +48,17 @@ static int v9fs_cached_dentry_delete(const struct dentry *dentry) static void v9fs_dentry_release(struct dentry *dentry) { struct hlist_node *p, *n; + struct hlist_head head; p9_debug(P9_DEBUG_VFS, " dentry: %pd (%p)\n", dentry, dentry); - hlist_for_each_safe(p, n, (struct hlist_head *)&dentry->d_fsdata) + + spin_lock(&dentry->d_lock); + hlist_move_list((struct hlist_head *)&dentry->d_fsdata, &head); + spin_unlock(&dentry->d_lock); + + hlist_for_each_safe(p, n, &head) p9_fid_put(hlist_entry(p, struct p9_fid, dlist)); - dentry->d_fsdata = NULL; } static int v9fs_lookup_revalidate(struct dentry *dentry, unsigned int flags)

1 year, 2 months

1
0
0 0

[PATCH] drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms

by Alex Deucher

From: Lang Yu <Lang.Yu(a)amd.com> Observed on gfx8 ASIC where KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM is used. Two attachments use the same VM, root PD would be locked twice. [ 57.910418] Call Trace: [ 57.793726] ? reserve_bo_and_cond_vms+0x111/0x1c0 [amdgpu] [ 57.793820] amdgpu_amdkfd_gpuvm_unmap_memory_from_gpu+0x6c/0x1c0 [amdgpu] [ 57.793923] ? idr_get_next_ul+0xbe/0x100 [ 57.793933] kfd_process_device_free_bos+0x7e/0xf0 [amdgpu] [ 57.794041] kfd_process_wq_release+0x2ae/0x3c0 [amdgpu] [ 57.794141] ? process_scheduled_works+0x29c/0x580 [ 57.794147] process_scheduled_works+0x303/0x580 [ 57.794157] ? __pfx_worker_thread+0x10/0x10 [ 57.794160] worker_thread+0x1a2/0x370 [ 57.794165] ? __pfx_worker_thread+0x10/0x10 [ 57.794167] kthread+0x11b/0x150 [ 57.794172] ? __pfx_kthread+0x10/0x10 [ 57.794177] ret_from_fork+0x3d/0x60 [ 57.794181] ? __pfx_kthread+0x10/0x10 [ 57.794184] ret_from_fork_asm+0x1b/0x30 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3007 Tested-by: Tomáš Trnka <trnka(a)scm.com> Signed-off-by: Lang Yu <Lang.Yu(a)amd.com> Reviewed-by: Felix Kuehling <felix.kuehling(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org (cherry picked from commit 2a705f3e49d20b59cd9e5cc3061b2d92ebe1e5f0) --- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c index e4d4e55c08ad..0535b07987d9 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c @@ -1188,7 +1188,8 @@ static int reserve_bo_and_cond_vms(struct kgd_mem *mem, int ret; ctx->sync = &mem->sync; - drm_exec_init(&ctx->exec, DRM_EXEC_INTERRUPTIBLE_WAIT, 0); + drm_exec_init(&ctx->exec, DRM_EXEC_INTERRUPTIBLE_WAIT | + DRM_EXEC_IGNORE_DUPLICATES, 0); drm_exec_until_all_locked(&ctx->exec) { ctx->n_vms = 0; list_for_each_entry(entry, &mem->attachments, list) { -- 2.45.1

1 year, 2 months

4
7
0 0

[tip: x86/urgent] x86/boot: Don't add the EFI stub to targets, again

by tip-bot2 for Benjamin Segall

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: b2747f108b8034271fd5289bd8f3a7003e0775a3 Gitweb: https://git.kernel.org/tip/b2747f108b8034271fd5289bd8f3a7003e0775a3 Author: Benjamin Segall <bsegall(a)google.com> AuthorDate: Wed, 12 Jun 2024 12:44:44 -07:00 Committer: Borislav Petkov (AMD) <bp(a)alien8.de> CommitterDate: Thu, 13 Jun 2024 10:32:36 +02:00 x86/boot: Don't add the EFI stub to targets, again This is a re-commit of da05b143a308 ("x86/boot: Don't add the EFI stub to targets") after the tagged patch incorrectly reverted it. vmlinux-objs-y is added to targets, with an assumption that they are all relative to $(obj); adding a $(objtree)/drivers/... path causes the build to incorrectly create a useless arch/x86/boot/compressed/drivers/... directory tree. Fix this just by using a different make variable for the EFI stub. Fixes: cb8bda8ad443 ("x86/boot/compressed: Rename efi_thunk_64.S to efi-mixed.S") Signed-off-by: Ben Segall <bsegall(a)google.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Ard Biesheuvel <ardb(a)kernel.org> Cc: stable(a)vger.kernel.org # v6.1+ Link: https://lore.kernel.org/r/xm267ceukksz.fsf@bsegall.svl.corp.google.com --- arch/x86/boot/compressed/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile index 243ee86..f205164 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -105,9 +105,9 @@ vmlinux-objs-$(CONFIG_UNACCEPTED_MEMORY) += $(obj)/mem.o vmlinux-objs-$(CONFIG_EFI) += $(obj)/efi.o vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_mixed.o -vmlinux-objs-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a +vmlinux-libs-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a -$(obj)/vmlinux: $(vmlinux-objs-y) FORCE +$(obj)/vmlinux: $(vmlinux-objs-y) $(vmlinux-libs-y) FORCE $(call if_changed,ld) OBJCOPYFLAGS_vmlinux.bin := -R .comment -S

1 year, 2 months

1
0
0 0

[PATCH stable 4.19] xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING

by Shung-Hsi Yu

Two additional changes not present in the original patch: 1. Check optlen in the XDP_UMEM_REG case as well. It was added in commit c05cd36458147 ("xsk: add support to allow unaligned chunk placement") but seems like too big of a change for stable 2. copy_from_sockptr() in the context was replace copy_from_usr() because commit a7b75c5a8c414 ("net: pass a sockptr_t into ->setsockopt") was not present [ Upstream commit 237f3cf13b20db183d3706d997eedc3c49eacd44 ] From: Eric Dumazet <edumazet(a)google.com> syzbot reported an illegal copy in xsk_setsockopt() [1] Make sure to validate setsockopt() @optlen parameter. [1] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08 </TASK> Allocated by task 7549: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888028c6cde0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes to the right of allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2) The buggy address belongs to the physical page: page:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001 raw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2175 allocate_slab mm/slub.c:2338 [inline] new_slab+0x84/0x2f0 mm/slub.c:2391 ___slab_alloc+0xc73/0x1260 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] __do_kmalloc_node mm/slub.c:3965 [inline] __kmalloc_node+0x2db/0x4e0 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] __vmalloc_area_node mm/vmalloc.c:3197 [inline] __vmalloc_node_range+0x5f9/0x14a0 mm/vmalloc.c:3392 __vmalloc_node mm/vmalloc.c:3457 [inline] vzalloc+0x79/0x90 mm/vmalloc.c:3530 bpf_check+0x260/0x19010 kernel/bpf/verifier.c:21162 bpf_prog_load+0x1667/0x20f0 kernel/bpf/syscall.c:2895 __sys_bpf+0x4ee/0x810 kernel/bpf/syscall.c:5631 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 page last free pid 6650 tgid 6647 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x95d/0xa80 mm/page_alloc.c:2346 free_unref_page_list+0x5a3/0x850 mm/page_alloc.c:2532 release_pages+0x2117/0x2400 mm/swap.c:1042 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] tlb_flush_mmu+0x34d/0x4e0 mm/mmu_gather.c:300 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:392 exit_mmap+0x4b6/0xd40 mm/mmap.c:3300 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:569 do_exit+0x99e/0x27e0 kernel/exit.c:865 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 get_signal+0x176e/0x1850 kernel/signal.c:2907 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:105 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline] syscall_exit_to_user_mode+0xc9/0x360 kernel/entry/common.c:212 do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Memory state around the buggy address: ffff888028c6cc80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc ffff888028c6cd00: fa fc fc fc fa fc fc fc 00 fc fc fc 06 fc fc fc >ffff888028c6cd80: fa fc fc fc fa fc fc fc fa fc fc fc 02 fc fc fc ^ ffff888028c6ce00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc ffff888028c6ce80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc Fixes: 423f38329d26 ("xsk: add umem fill queue support and mmap") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: "Björn Töpel" <bjorn(a)kernel.org> Cc: Magnus Karlsson <magnus.karlsson(a)intel.com> Cc: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Cc: Jonathan Lemon <jonathan.lemon(a)gmail.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240404202738.3634547-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> --- net/xdp/xsk.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 6bb0649c028c..d5a9c43930de 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -515,6 +515,8 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname, struct xdp_umem_reg mr; struct xdp_umem *umem; + if (optlen < sizeof(mr)) + return -EINVAL; if (copy_from_user(&mr, optval, sizeof(mr))) return -EFAULT; @@ -542,6 +544,8 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname, struct xsk_queue **q; int entries; + if (optlen < sizeof(entries)) + return -EINVAL; if (copy_from_user(&entries, optval, sizeof(entries))) return -EFAULT; -- 2.45.1

1 year, 2 months

2
3
0 0

[PATCH stable 5.4] xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING

by Shung-Hsi Yu

[ Upstream commit 237f3cf13b20db183d3706d997eedc3c49eacd44 ] From: Eric Dumazet <edumazet(a)google.com> syzbot reported an illegal copy in xsk_setsockopt() [1] Make sure to validate setsockopt() @optlen parameter. [1] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08 </TASK> Allocated by task 7549: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888028c6cde0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes to the right of allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2) The buggy address belongs to the physical page: page:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001 raw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2175 allocate_slab mm/slub.c:2338 [inline] new_slab+0x84/0x2f0 mm/slub.c:2391 ___slab_alloc+0xc73/0x1260 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] __do_kmalloc_node mm/slub.c:3965 [inline] __kmalloc_node+0x2db/0x4e0 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] __vmalloc_area_node mm/vmalloc.c:3197 [inline] __vmalloc_node_range+0x5f9/0x14a0 mm/vmalloc.c:3392 __vmalloc_node mm/vmalloc.c:3457 [inline] vzalloc+0x79/0x90 mm/vmalloc.c:3530 bpf_check+0x260/0x19010 kernel/bpf/verifier.c:21162 bpf_prog_load+0x1667/0x20f0 kernel/bpf/syscall.c:2895 __sys_bpf+0x4ee/0x810 kernel/bpf/syscall.c:5631 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 page last free pid 6650 tgid 6647 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x95d/0xa80 mm/page_alloc.c:2346 free_unref_page_list+0x5a3/0x850 mm/page_alloc.c:2532 release_pages+0x2117/0x2400 mm/swap.c:1042 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] tlb_flush_mmu+0x34d/0x4e0 mm/mmu_gather.c:300 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:392 exit_mmap+0x4b6/0xd40 mm/mmap.c:3300 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:569 do_exit+0x99e/0x27e0 kernel/exit.c:865 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 get_signal+0x176e/0x1850 kernel/signal.c:2907 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:105 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline] syscall_exit_to_user_mode+0xc9/0x360 kernel/entry/common.c:212 do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Memory state around the buggy address: ffff888028c6cc80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc ffff888028c6cd00: fa fc fc fc fa fc fc fc 00 fc fc fc 06 fc fc fc >ffff888028c6cd80: fa fc fc fc fa fc fc fc fa fc fc fc 02 fc fc fc ^ ffff888028c6ce00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc ffff888028c6ce80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc Fixes: 423f38329d26 ("xsk: add umem fill queue support and mmap") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: "Björn Töpel" <bjorn(a)kernel.org> Cc: Magnus Karlsson <magnus.karlsson(a)intel.com> Cc: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Cc: Jonathan Lemon <jonathan.lemon(a)gmail.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240404202738.3634547-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [shung-hsi.yu: copy_from_sockptr() in the context was replaced with copy_from_usr() because commit a7b75c5a8c414 ("net: pass a sockptr_t into ->setsockopt") was not present] Signed-off-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> --- Moved the description about diversion from original patch down to the very bottom as that seems to be what other are doing[1], and seems to fit the bottom-posting style better. 1: https://lore.kernel.org/stable/20240602152233.78240-1-gpiccoli@igalia.com/ --- net/xdp/xsk.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index d04a2345bc3f..2ffcda7b1678 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -809,6 +809,8 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname, struct xsk_queue **q; int entries; + if (optlen < sizeof(entries)) + return -EINVAL; if (copy_from_user(&entries, optval, sizeof(entries))) return -EFAULT; -- 2.45.2

1 year, 2 months

2
1
0 0

[PATCH v2 4.19.y 1/1] net: fix __dst_negative_advice() race

by Lee Jones

From: Eric Dumazet <edumazet(a)google.com> __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets") Reported-by: Clement Lecigne <clecigne(a)google.com> Diagnosed-by: Clement Lecigne <clecigne(a)google.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> (cherry picked from commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e) [Lee: Stable backport] Signed-off-by: Lee Jones <lee(a)kernel.org> --- include/net/dst_ops.h | 2 +- include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 30 insertions(+), 47 deletions(-) diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h index 632086b2f644..3ae2fda29507 100644 --- a/include/net/dst_ops.h +++ b/include/net/dst_ops.h @@ -24,7 +24,7 @@ struct dst_ops { void (*destroy)(struct dst_entry *); void (*ifdown)(struct dst_entry *, struct net_device *dev, int how); - struct dst_entry * (*negative_advice)(struct dst_entry *); + void (*negative_advice)(struct sock *sk, struct dst_entry *); void (*link_failure)(struct sk_buff *); void (*update_pmtu)(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb, u32 mtu, diff --git a/include/net/sock.h b/include/net/sock.h index b5a929a4bc74..6304e287087f 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1915,19 +1915,12 @@ sk_dst_get(struct sock *sk) static inline void dst_negative_advice(struct sock *sk) { - struct dst_entry *ndst, *dst = __sk_dst_get(sk); + struct dst_entry *dst = __sk_dst_get(sk); sk_rethink_txhash(sk); - if (dst && dst->ops->negative_advice) { - ndst = dst->ops->negative_advice(dst); - - if (ndst != dst) { - rcu_assign_pointer(sk->sk_dst_cache, ndst); - sk_tx_queue_clear(sk); - WRITE_ONCE(sk->sk_dst_pending_confirm, 0); - } - } + if (dst && dst->ops->negative_advice) + dst->ops->negative_advice(sk, dst); } static inline void diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 301460510535..3c5401dafdee 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -140,7 +140,8 @@ static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie); static unsigned int ipv4_default_advmss(const struct dst_entry *dst); static unsigned int ipv4_mtu(const struct dst_entry *dst); -static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst); +static void ipv4_negative_advice(struct sock *sk, + struct dst_entry *dst); static void ipv4_link_failure(struct sk_buff *skb); static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb, u32 mtu, @@ -848,22 +849,15 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf __ip_do_redirect(rt, skb, &fl4, true); } -static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst) +static void ipv4_negative_advice(struct sock *sk, + struct dst_entry *dst) { struct rtable *rt = (struct rtable *)dst; - struct dst_entry *ret = dst; - if (rt) { - if (dst->obsolete > 0) { - ip_rt_put(rt); - ret = NULL; - } else if ((rt->rt_flags & RTCF_REDIRECTED) || - rt->dst.expires) { - ip_rt_put(rt); - ret = NULL; - } - } - return ret; + if ((dst->obsolete > 0) || + (rt->rt_flags & RTCF_REDIRECTED) || + rt->dst.expires) + sk_dst_reset(sk); } /* diff --git a/net/ipv6/route.c b/net/ipv6/route.c index b4d9acb1bc10..db349679b112 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -88,7 +88,8 @@ enum rt6_nud_state { static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie); static unsigned int ip6_default_advmss(const struct dst_entry *dst); static unsigned int ip6_mtu(const struct dst_entry *dst); -static struct dst_entry *ip6_negative_advice(struct dst_entry *); +static void ip6_negative_advice(struct sock *sk, + struct dst_entry *dst); static void ip6_dst_destroy(struct dst_entry *); static void ip6_dst_ifdown(struct dst_entry *, struct net_device *dev, int how); @@ -2281,24 +2282,24 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie) return dst_ret; } -static struct dst_entry *ip6_negative_advice(struct dst_entry *dst) +static void ip6_negative_advice(struct sock *sk, + struct dst_entry *dst) { struct rt6_info *rt = (struct rt6_info *) dst; - if (rt) { - if (rt->rt6i_flags & RTF_CACHE) { - rcu_read_lock(); - if (rt6_check_expired(rt)) { - rt6_remove_exception_rt(rt); - dst = NULL; - } - rcu_read_unlock(); - } else { - dst_release(dst); - dst = NULL; + if (rt->rt6i_flags & RTF_CACHE) { + rcu_read_lock(); + if (rt6_check_expired(rt)) { + /* counteract the dst_release() in sk_dst_reset() */ + dst_hold(dst); + sk_dst_reset(sk); + + rt6_remove_exception_rt(rt); } + rcu_read_unlock(); + return; } - return dst; + sk_dst_reset(sk); } static void ip6_link_failure(struct sk_buff *skb) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index c8a7a5739425..fb76a2ee8873 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2556,15 +2556,10 @@ static void xfrm_link_failure(struct sk_buff *skb) /* Impossible. Such dst must be popped before reaches point of failure. */ } -static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst) +static void xfrm_negative_advice(struct sock *sk, struct dst_entry *dst) { - if (dst) { - if (dst->obsolete) { - dst_release(dst); - dst = NULL; - } - } - return dst; + if (dst->obsolete) + sk_dst_reset(sk); } static void xfrm_init_pmtu(struct xfrm_dst **bundle, int nr) -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

2
6
0 0

FAILED: patch "[PATCH] wifi: ath10k: fix QCOM_RPROC_COMMON dependency" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 21ae74e1bf18331ae5e279bd96304b3630828009 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061314-platypus-impaired-f82d@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 21ae74e1bf18 ("wifi: ath10k: fix QCOM_RPROC_COMMON dependency") d03407183d97 ("wifi: ath10k: fix QCOM_SMEM dependency") 4d79f6f34bbb ("wifi: ath10k: Store WLAN firmware version in SMEM image table") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 21ae74e1bf18331ae5e279bd96304b3630828009 Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Date: Fri, 17 May 2024 10:00:28 +0300 Subject: [PATCH] wifi: ath10k: fix QCOM_RPROC_COMMON dependency If ath10k_snoc is built-in, while Qualcomm remoteprocs are built as modules, compilation fails with: /usr/bin/aarch64-linux-gnu-ld: drivers/net/wireless/ath/ath10k/snoc.o: in function `ath10k_modem_init': drivers/net/wireless/ath/ath10k/snoc.c:1534: undefined reference to `qcom_register_ssr_notifier' /usr/bin/aarch64-linux-gnu-ld: drivers/net/wireless/ath/ath10k/snoc.o: in function `ath10k_modem_deinit': drivers/net/wireless/ath/ath10k/snoc.c:1551: undefined reference to `qcom_unregister_ssr_notifier' Add corresponding dependency to ATH10K_SNOC Kconfig entry so that it's built as module if QCOM_RPROC_COMMON is built as module too. Fixes: 747ff7d3d742 ("ath10k: Don't always treat modem stop events as crashes") Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://msgid.link/20240511-ath10k-snoc-dep-v1-1-9666e3af5c27@linaro.org diff --git a/drivers/net/wireless/ath/ath10k/Kconfig b/drivers/net/wireless/ath/ath10k/Kconfig index e6ea884cafc1..4f385f4a8cef 100644 --- a/drivers/net/wireless/ath/ath10k/Kconfig +++ b/drivers/net/wireless/ath/ath10k/Kconfig @@ -45,6 +45,7 @@ config ATH10K_SNOC depends on ATH10K depends on ARCH_QCOM || COMPILE_TEST depends on QCOM_SMEM + depends on QCOM_RPROC_COMMON || QCOM_RPROC_COMMON=n select QCOM_SCM select QCOM_QMI_HELPERS help

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] wifi: ath10k: fix QCOM_RPROC_COMMON dependency" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 21ae74e1bf18331ae5e279bd96304b3630828009 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061313-wistful-dipping-5d5b@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 21ae74e1bf18 ("wifi: ath10k: fix QCOM_RPROC_COMMON dependency") d03407183d97 ("wifi: ath10k: fix QCOM_SMEM dependency") 4d79f6f34bbb ("wifi: ath10k: Store WLAN firmware version in SMEM image table") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 21ae74e1bf18331ae5e279bd96304b3630828009 Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Date: Fri, 17 May 2024 10:00:28 +0300 Subject: [PATCH] wifi: ath10k: fix QCOM_RPROC_COMMON dependency If ath10k_snoc is built-in, while Qualcomm remoteprocs are built as modules, compilation fails with: /usr/bin/aarch64-linux-gnu-ld: drivers/net/wireless/ath/ath10k/snoc.o: in function `ath10k_modem_init': drivers/net/wireless/ath/ath10k/snoc.c:1534: undefined reference to `qcom_register_ssr_notifier' /usr/bin/aarch64-linux-gnu-ld: drivers/net/wireless/ath/ath10k/snoc.o: in function `ath10k_modem_deinit': drivers/net/wireless/ath/ath10k/snoc.c:1551: undefined reference to `qcom_unregister_ssr_notifier' Add corresponding dependency to ATH10K_SNOC Kconfig entry so that it's built as module if QCOM_RPROC_COMMON is built as module too. Fixes: 747ff7d3d742 ("ath10k: Don't always treat modem stop events as crashes") Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://msgid.link/20240511-ath10k-snoc-dep-v1-1-9666e3af5c27@linaro.org diff --git a/drivers/net/wireless/ath/ath10k/Kconfig b/drivers/net/wireless/ath/ath10k/Kconfig index e6ea884cafc1..4f385f4a8cef 100644 --- a/drivers/net/wireless/ath/ath10k/Kconfig +++ b/drivers/net/wireless/ath/ath10k/Kconfig @@ -45,6 +45,7 @@ config ATH10K_SNOC depends on ATH10K depends on ARCH_QCOM || COMPILE_TEST depends on QCOM_SMEM + depends on QCOM_RPROC_COMMON || QCOM_RPROC_COMMON=n select QCOM_SCM select QCOM_QMI_HELPERS help

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] irqchip/riscv-intc: Prevent memory leak when" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 0110c4b110477bb1f19b0d02361846be7ab08300 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061358-defile-outplayed-f986@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 0110c4b11047 ("irqchip/riscv-intc: Prevent memory leak when riscv_intc_init_common() fails") f4cc33e78ba8 ("irqchip/riscv-intc: Introduce Andes hart-level interrupt controller") 96303bcb401c ("irqchip/riscv-intc: Allow large non-standard interrupt number") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0110c4b110477bb1f19b0d02361846be7ab08300 Mon Sep 17 00:00:00 2001 From: Sunil V L <sunilvl(a)ventanamicro.com> Date: Mon, 27 May 2024 13:41:13 +0530 Subject: [PATCH] irqchip/riscv-intc: Prevent memory leak when riscv_intc_init_common() fails When riscv_intc_init_common() fails, the firmware node allocated is not freed. Add the missing free(). Fixes: 7023b9d83f03 ("irqchip/riscv-intc: Add ACPI support") Signed-off-by: Sunil V L <sunilvl(a)ventanamicro.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Anup Patel <anup(a)brainfault.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240527081113.616189-1-sunilvl@ventanamicro.com diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c index 9e71c4428814..4f3a12383a1e 100644 --- a/drivers/irqchip/irq-riscv-intc.c +++ b/drivers/irqchip/irq-riscv-intc.c @@ -253,8 +253,9 @@ IRQCHIP_DECLARE(andes, "andestech,cpu-intc", riscv_intc_init); static int __init riscv_intc_acpi_init(union acpi_subtable_headers *header, const unsigned long end) { - struct fwnode_handle *fn; struct acpi_madt_rintc *rintc; + struct fwnode_handle *fn; + int rc; rintc = (struct acpi_madt_rintc *)header; @@ -273,7 +274,11 @@ static int __init riscv_intc_acpi_init(union acpi_subtable_headers *header, return -ENOMEM; } - return riscv_intc_init_common(fn, &riscv_intc_chip); + rc = riscv_intc_init_common(fn, &riscv_intc_chip); + if (rc) + irq_domain_free_fwnode(fn); + + return rc; } IRQCHIP_ACPI_DECLARE(riscv_intc, ACPI_MADT_TYPE_RINTC, NULL,

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success on" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061321-cleaver-straddle-c86d@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9a21701edc41 ("selftests/mm: conform test to TAP format output") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:56 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success on Aarch64 Patch series "Fixes for compaction_test", v2. The compaction_test memory selftest introduces fragmentation in memory and then tries to allocate as many hugepages as possible. This series addresses some problems. On Aarch64, if nr_hugepages == 0, then the test trivially succeeds since compaction_index becomes 0, which is less than 3, due to no division by zero exception being raised. We fix that by checking for division by zero. Secondly, correctly set the number of hugepages to zero before trying to set a large number of them. Now, consider a situation in which, at the start of the test, a non-zero number of hugepages have been already set (while running the entire selftests/mm suite, or manually by the admin). The test operates on 80% of memory to avoid OOM-killer invocation, and because some memory is already blocked by hugepages, it would increase the chance of OOM-killing. Also, since mem_free used in check_compaction() is the value before we set nr_hugepages to zero, the chance that the compaction_index will be small is very high if the preset nr_hugepages was high, leading to a bogus test success. This patch (of 3): Currently, if at runtime we are not able to allocate a huge page, the test will trivially pass on Aarch64 due to no exception being raised on division by zero while computing compaction_index. Fix that by checking for nr_hugepages == 0. Anyways, in general, avoid a division by zero by exiting the program beforehand. While at it, fix a typo, and handle the case where the number of hugepages may overflow an integer. Link: https://lkml.kernel.org/r/20240521074358.675031-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20240521074358.675031-2-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 4f42eb7d7636..0b249a06a60b 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,12 +82,13 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned int hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size) { + unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[10] = {0}; - char nr_hugepages[10] = {0}; + char initial_nr_hugepages[20] = {0}; + char nr_hugepages[20] = {0}; /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -134,7 +135,12 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) /* We should have been able to request at least 1/3 rd of the memory in huge pages */ - compaction_index = mem_free/(atoi(nr_hugepages) * hugepage_size); + nr_hugepages_ul = strtoul(nr_hugepages, NULL, 10); + if (!nr_hugepages_ul) { + ksft_print_msg("ERROR: No memory is available as huge pages\n"); + goto close_fd; + } + compaction_index = mem_free/(nr_hugepages_ul * hugepage_size); lseek(fd, 0, SEEK_SET); @@ -145,11 +151,11 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) goto close_fd; } - ksft_print_msg("Number of huge pages allocated = %d\n", - atoi(nr_hugepages)); + ksft_print_msg("Number of huge pages allocated = %lu\n", + nr_hugepages_ul); if (compaction_index > 3) { - ksft_print_msg("ERROR: Less that 1/%d of memory is available\n" + ksft_print_msg("ERROR: Less than 1/%d of memory is available\n" "as huge pages\n", compaction_index); goto close_fd; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success on" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061319-groovy-unequal-0931@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9a21701edc41 ("selftests/mm: conform test to TAP format output") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:56 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success on Aarch64 Patch series "Fixes for compaction_test", v2. The compaction_test memory selftest introduces fragmentation in memory and then tries to allocate as many hugepages as possible. This series addresses some problems. On Aarch64, if nr_hugepages == 0, then the test trivially succeeds since compaction_index becomes 0, which is less than 3, due to no division by zero exception being raised. We fix that by checking for division by zero. Secondly, correctly set the number of hugepages to zero before trying to set a large number of them. Now, consider a situation in which, at the start of the test, a non-zero number of hugepages have been already set (while running the entire selftests/mm suite, or manually by the admin). The test operates on 80% of memory to avoid OOM-killer invocation, and because some memory is already blocked by hugepages, it would increase the chance of OOM-killing. Also, since mem_free used in check_compaction() is the value before we set nr_hugepages to zero, the chance that the compaction_index will be small is very high if the preset nr_hugepages was high, leading to a bogus test success. This patch (of 3): Currently, if at runtime we are not able to allocate a huge page, the test will trivially pass on Aarch64 due to no exception being raised on division by zero while computing compaction_index. Fix that by checking for nr_hugepages == 0. Anyways, in general, avoid a division by zero by exiting the program beforehand. While at it, fix a typo, and handle the case where the number of hugepages may overflow an integer. Link: https://lkml.kernel.org/r/20240521074358.675031-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20240521074358.675031-2-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 4f42eb7d7636..0b249a06a60b 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,12 +82,13 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned int hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size) { + unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[10] = {0}; - char nr_hugepages[10] = {0}; + char initial_nr_hugepages[20] = {0}; + char nr_hugepages[20] = {0}; /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -134,7 +135,12 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) /* We should have been able to request at least 1/3 rd of the memory in huge pages */ - compaction_index = mem_free/(atoi(nr_hugepages) * hugepage_size); + nr_hugepages_ul = strtoul(nr_hugepages, NULL, 10); + if (!nr_hugepages_ul) { + ksft_print_msg("ERROR: No memory is available as huge pages\n"); + goto close_fd; + } + compaction_index = mem_free/(nr_hugepages_ul * hugepage_size); lseek(fd, 0, SEEK_SET); @@ -145,11 +151,11 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) goto close_fd; } - ksft_print_msg("Number of huge pages allocated = %d\n", - atoi(nr_hugepages)); + ksft_print_msg("Number of huge pages allocated = %lu\n", + nr_hugepages_ul); if (compaction_index > 3) { - ksft_print_msg("ERROR: Less that 1/%d of memory is available\n" + ksft_print_msg("ERROR: Less than 1/%d of memory is available\n" "as huge pages\n", compaction_index); goto close_fd; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success on" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061318-finalize-junior-4cb2@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9a21701edc41 ("selftests/mm: conform test to TAP format output") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:56 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success on Aarch64 Patch series "Fixes for compaction_test", v2. The compaction_test memory selftest introduces fragmentation in memory and then tries to allocate as many hugepages as possible. This series addresses some problems. On Aarch64, if nr_hugepages == 0, then the test trivially succeeds since compaction_index becomes 0, which is less than 3, due to no division by zero exception being raised. We fix that by checking for division by zero. Secondly, correctly set the number of hugepages to zero before trying to set a large number of them. Now, consider a situation in which, at the start of the test, a non-zero number of hugepages have been already set (while running the entire selftests/mm suite, or manually by the admin). The test operates on 80% of memory to avoid OOM-killer invocation, and because some memory is already blocked by hugepages, it would increase the chance of OOM-killing. Also, since mem_free used in check_compaction() is the value before we set nr_hugepages to zero, the chance that the compaction_index will be small is very high if the preset nr_hugepages was high, leading to a bogus test success. This patch (of 3): Currently, if at runtime we are not able to allocate a huge page, the test will trivially pass on Aarch64 due to no exception being raised on division by zero while computing compaction_index. Fix that by checking for nr_hugepages == 0. Anyways, in general, avoid a division by zero by exiting the program beforehand. While at it, fix a typo, and handle the case where the number of hugepages may overflow an integer. Link: https://lkml.kernel.org/r/20240521074358.675031-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20240521074358.675031-2-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 4f42eb7d7636..0b249a06a60b 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,12 +82,13 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned int hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size) { + unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[10] = {0}; - char nr_hugepages[10] = {0}; + char initial_nr_hugepages[20] = {0}; + char nr_hugepages[20] = {0}; /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -134,7 +135,12 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) /* We should have been able to request at least 1/3 rd of the memory in huge pages */ - compaction_index = mem_free/(atoi(nr_hugepages) * hugepage_size); + nr_hugepages_ul = strtoul(nr_hugepages, NULL, 10); + if (!nr_hugepages_ul) { + ksft_print_msg("ERROR: No memory is available as huge pages\n"); + goto close_fd; + } + compaction_index = mem_free/(nr_hugepages_ul * hugepage_size); lseek(fd, 0, SEEK_SET); @@ -145,11 +151,11 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) goto close_fd; } - ksft_print_msg("Number of huge pages allocated = %d\n", - atoi(nr_hugepages)); + ksft_print_msg("Number of huge pages allocated = %lu\n", + nr_hugepages_ul); if (compaction_index > 3) { - ksft_print_msg("ERROR: Less that 1/%d of memory is available\n" + ksft_print_msg("ERROR: Less than 1/%d of memory is available\n" "as huge pages\n", compaction_index); goto close_fd; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success on" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061317-attractor-approval-2f8a@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9a21701edc41 ("selftests/mm: conform test to TAP format output") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:56 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success on Aarch64 Patch series "Fixes for compaction_test", v2. The compaction_test memory selftest introduces fragmentation in memory and then tries to allocate as many hugepages as possible. This series addresses some problems. On Aarch64, if nr_hugepages == 0, then the test trivially succeeds since compaction_index becomes 0, which is less than 3, due to no division by zero exception being raised. We fix that by checking for division by zero. Secondly, correctly set the number of hugepages to zero before trying to set a large number of them. Now, consider a situation in which, at the start of the test, a non-zero number of hugepages have been already set (while running the entire selftests/mm suite, or manually by the admin). The test operates on 80% of memory to avoid OOM-killer invocation, and because some memory is already blocked by hugepages, it would increase the chance of OOM-killing. Also, since mem_free used in check_compaction() is the value before we set nr_hugepages to zero, the chance that the compaction_index will be small is very high if the preset nr_hugepages was high, leading to a bogus test success. This patch (of 3): Currently, if at runtime we are not able to allocate a huge page, the test will trivially pass on Aarch64 due to no exception being raised on division by zero while computing compaction_index. Fix that by checking for nr_hugepages == 0. Anyways, in general, avoid a division by zero by exiting the program beforehand. While at it, fix a typo, and handle the case where the number of hugepages may overflow an integer. Link: https://lkml.kernel.org/r/20240521074358.675031-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20240521074358.675031-2-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 4f42eb7d7636..0b249a06a60b 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,12 +82,13 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned int hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size) { + unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[10] = {0}; - char nr_hugepages[10] = {0}; + char initial_nr_hugepages[20] = {0}; + char nr_hugepages[20] = {0}; /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -134,7 +135,12 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) /* We should have been able to request at least 1/3 rd of the memory in huge pages */ - compaction_index = mem_free/(atoi(nr_hugepages) * hugepage_size); + nr_hugepages_ul = strtoul(nr_hugepages, NULL, 10); + if (!nr_hugepages_ul) { + ksft_print_msg("ERROR: No memory is available as huge pages\n"); + goto close_fd; + } + compaction_index = mem_free/(nr_hugepages_ul * hugepage_size); lseek(fd, 0, SEEK_SET); @@ -145,11 +151,11 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) goto close_fd; } - ksft_print_msg("Number of huge pages allocated = %d\n", - atoi(nr_hugepages)); + ksft_print_msg("Number of huge pages allocated = %lu\n", + nr_hugepages_ul); if (compaction_index > 3) { - ksft_print_msg("ERROR: Less that 1/%d of memory is available\n" + ksft_print_msg("ERROR: Less than 1/%d of memory is available\n" "as huge pages\n", compaction_index); goto close_fd; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success on" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061315-breeding-carry-caf4@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9a21701edc41 ("selftests/mm: conform test to TAP format output") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:56 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success on Aarch64 Patch series "Fixes for compaction_test", v2. The compaction_test memory selftest introduces fragmentation in memory and then tries to allocate as many hugepages as possible. This series addresses some problems. On Aarch64, if nr_hugepages == 0, then the test trivially succeeds since compaction_index becomes 0, which is less than 3, due to no division by zero exception being raised. We fix that by checking for division by zero. Secondly, correctly set the number of hugepages to zero before trying to set a large number of them. Now, consider a situation in which, at the start of the test, a non-zero number of hugepages have been already set (while running the entire selftests/mm suite, or manually by the admin). The test operates on 80% of memory to avoid OOM-killer invocation, and because some memory is already blocked by hugepages, it would increase the chance of OOM-killing. Also, since mem_free used in check_compaction() is the value before we set nr_hugepages to zero, the chance that the compaction_index will be small is very high if the preset nr_hugepages was high, leading to a bogus test success. This patch (of 3): Currently, if at runtime we are not able to allocate a huge page, the test will trivially pass on Aarch64 due to no exception being raised on division by zero while computing compaction_index. Fix that by checking for nr_hugepages == 0. Anyways, in general, avoid a division by zero by exiting the program beforehand. While at it, fix a typo, and handle the case where the number of hugepages may overflow an integer. Link: https://lkml.kernel.org/r/20240521074358.675031-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20240521074358.675031-2-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 4f42eb7d7636..0b249a06a60b 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,12 +82,13 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned int hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size) { + unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[10] = {0}; - char nr_hugepages[10] = {0}; + char initial_nr_hugepages[20] = {0}; + char nr_hugepages[20] = {0}; /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -134,7 +135,12 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) /* We should have been able to request at least 1/3 rd of the memory in huge pages */ - compaction_index = mem_free/(atoi(nr_hugepages) * hugepage_size); + nr_hugepages_ul = strtoul(nr_hugepages, NULL, 10); + if (!nr_hugepages_ul) { + ksft_print_msg("ERROR: No memory is available as huge pages\n"); + goto close_fd; + } + compaction_index = mem_free/(nr_hugepages_ul * hugepage_size); lseek(fd, 0, SEEK_SET); @@ -145,11 +151,11 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) goto close_fd; } - ksft_print_msg("Number of huge pages allocated = %d\n", - atoi(nr_hugepages)); + ksft_print_msg("Number of huge pages allocated = %lu\n", + nr_hugepages_ul); if (compaction_index > 3) { - ksft_print_msg("ERROR: Less that 1/%d of memory is available\n" + ksft_print_msg("ERROR: Less than 1/%d of memory is available\n" "as huge pages\n", compaction_index); goto close_fd; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success on" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061314-unlit-filled-c396@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9a21701edc41 ("selftests/mm: conform test to TAP format output") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From d4202e66a4b1fe6968f17f9f09bbc30d08f028a1 Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:56 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success on Aarch64 Patch series "Fixes for compaction_test", v2. The compaction_test memory selftest introduces fragmentation in memory and then tries to allocate as many hugepages as possible. This series addresses some problems. On Aarch64, if nr_hugepages == 0, then the test trivially succeeds since compaction_index becomes 0, which is less than 3, due to no division by zero exception being raised. We fix that by checking for division by zero. Secondly, correctly set the number of hugepages to zero before trying to set a large number of them. Now, consider a situation in which, at the start of the test, a non-zero number of hugepages have been already set (while running the entire selftests/mm suite, or manually by the admin). The test operates on 80% of memory to avoid OOM-killer invocation, and because some memory is already blocked by hugepages, it would increase the chance of OOM-killing. Also, since mem_free used in check_compaction() is the value before we set nr_hugepages to zero, the chance that the compaction_index will be small is very high if the preset nr_hugepages was high, leading to a bogus test success. This patch (of 3): Currently, if at runtime we are not able to allocate a huge page, the test will trivially pass on Aarch64 due to no exception being raised on division by zero while computing compaction_index. Fix that by checking for nr_hugepages == 0. Anyways, in general, avoid a division by zero by exiting the program beforehand. While at it, fix a typo, and handle the case where the number of hugepages may overflow an integer. Link: https://lkml.kernel.org/r/20240521074358.675031-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20240521074358.675031-2-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 4f42eb7d7636..0b249a06a60b 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,12 +82,13 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned int hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size) { + unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[10] = {0}; - char nr_hugepages[10] = {0}; + char initial_nr_hugepages[20] = {0}; + char nr_hugepages[20] = {0}; /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -134,7 +135,12 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) /* We should have been able to request at least 1/3 rd of the memory in huge pages */ - compaction_index = mem_free/(atoi(nr_hugepages) * hugepage_size); + nr_hugepages_ul = strtoul(nr_hugepages, NULL, 10); + if (!nr_hugepages_ul) { + ksft_print_msg("ERROR: No memory is available as huge pages\n"); + goto close_fd; + } + compaction_index = mem_free/(nr_hugepages_ul * hugepage_size); lseek(fd, 0, SEEK_SET); @@ -145,11 +151,11 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size) goto close_fd; } - ksft_print_msg("Number of huge pages allocated = %d\n", - atoi(nr_hugepages)); + ksft_print_msg("Number of huge pages allocated = %lu\n", + nr_hugepages_ul); if (compaction_index > 3) { - ksft_print_msg("ERROR: Less that 1/%d of memory is available\n" + ksft_print_msg("ERROR: Less than 1/%d of memory is available\n" "as huge pages\n", compaction_index); goto close_fd; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success and" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061355-send-backwash-9965@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") 69e545edbe8b ("selftests/mm: ksft_exit functions do not return") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9c1490d911f8 ("selftests/mm: log skipped compaction test as a skip") 8c9eea721a98 ("selftests/mm: skip test if application doesn't has root privileges") 9a21701edc41 ("selftests/mm: conform test to TAP format output") cb6e7cae1886 ("selftests/mm: gup_test: conform test to TAP format output") 019b277b680f ("selftests: mm: skip whole test instead of failure") 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") 05f1edac8009 ("selftests/mm: run all tests from run_vmtests.sh") 000303329752 ("selftests/mm: make migration test robust to failure") f6dd4e223d87 ("selftests/mm: skip soft-dirty tests on arm64") ba91e7e5d15a ("selftests/mm: add tests for HWPOISON hugetlbfs read") 63773d2b593d ("Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:58 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation Reset nr_hugepages to zero before the start of the test. If a non-zero number of hugepages is already set before the start of the test, the following problems arise: - The probability of the test getting OOM-killed increases. Proof: The test wants to run on 80% of available memory to prevent OOM-killing (see original code comments). Let the value of mem_free at the start of the test, when nr_hugepages = 0, be x. In the other case, when nr_hugepages > 0, let the memory consumed by hugepages be y. In the former case, the test operates on 0.8 * x of memory. In the latter, the test operates on 0.8 * (x - y) of memory, with y already filled, hence, memory consumed is y + 0.8 * (x - y) = 0.8 * x + 0.2 * y > 0.8 * x. Q.E.D - The probability of a bogus test success increases. Proof: Let the memory consumed by hugepages be greater than 25% of x, with x and y defined as above. The definition of compaction_index is c_index = (x - y)/z where z is the memory consumed by hugepages after trying to increase them again. In check_compaction(), we set the number of hugepages to zero, and then increase them back; the probability that they will be set back to consume at least y amount of memory again is very high (since there is not much delay between the two attempts of changing nr_hugepages). Hence, z >= y > (x/4) (by the 25% assumption). Therefore, c_index = (x - y)/z <= (x - y)/y = x/y - 1 < 4 - 1 = 3 hence, c_index can always be forced to be less than 3, thereby the test succeeding always. Q.E.D Link: https://lkml.kernel.org/r/20240521074358.675031-4-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 5e9bd1da9370..e140558e6f53 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,13 +82,16 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned long hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size, + unsigned long initial_nr_hugepages) { unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; char nr_hugepages[20] = {0}; + char init_nr_hugepages[20] = {0}; + + sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages); /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -102,23 +105,6 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto out; } - if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) { - ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - - /* Start with the initial condition of 0 huge pages*/ - if (write(fd, "0", sizeof(char)) != sizeof(char)) { - ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - /* Request a large number of huge pages. The Kernel will allocate as much as it can */ if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { @@ -146,8 +132,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) lseek(fd, 0, SEEK_SET); - if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages)) - != strlen(initial_nr_hugepages)) { + if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages)) + != strlen(init_nr_hugepages)) { ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n", strerror(errno)); goto close_fd; @@ -171,6 +157,41 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) return ret; } +int set_zero_hugepages(unsigned long *initial_nr_hugepages) +{ + int fd, ret = -1; + char nr_hugepages[20] = {0}; + + fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK); + if (fd < 0) { + ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto out; + } + if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) { + ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + lseek(fd, 0, SEEK_SET); + + /* Start with the initial condition of 0 huge pages */ + if (write(fd, "0", sizeof(char)) != sizeof(char)) { + ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + *initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10); + ret = 0; + + close_fd: + close(fd); + + out: + return ret; +} int main(int argc, char **argv) { @@ -181,6 +202,7 @@ int main(int argc, char **argv) unsigned long mem_free = 0; unsigned long hugepage_size = 0; long mem_fragmentable_MB = 0; + unsigned long initial_nr_hugepages; ksft_print_header(); @@ -189,6 +211,10 @@ int main(int argc, char **argv) ksft_set_plan(1); + /* Start the test without hugepages reducing mem_free */ + if (set_zero_hugepages(&initial_nr_hugepages)) + ksft_exit_fail(); + lim.rlim_cur = RLIM_INFINITY; lim.rlim_max = RLIM_INFINITY; if (setrlimit(RLIMIT_MEMLOCK, &lim)) @@ -232,7 +258,8 @@ int main(int argc, char **argv) entry = entry->next; } - if (check_compaction(mem_free, hugepage_size) == 0) + if (check_compaction(mem_free, hugepage_size, + initial_nr_hugepages) == 0) ksft_exit_pass(); ksft_exit_fail();

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success and" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061353-scanner-unusable-1d09@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") 69e545edbe8b ("selftests/mm: ksft_exit functions do not return") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9c1490d911f8 ("selftests/mm: log skipped compaction test as a skip") 8c9eea721a98 ("selftests/mm: skip test if application doesn't has root privileges") 9a21701edc41 ("selftests/mm: conform test to TAP format output") cb6e7cae1886 ("selftests/mm: gup_test: conform test to TAP format output") 019b277b680f ("selftests: mm: skip whole test instead of failure") 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") 05f1edac8009 ("selftests/mm: run all tests from run_vmtests.sh") 000303329752 ("selftests/mm: make migration test robust to failure") f6dd4e223d87 ("selftests/mm: skip soft-dirty tests on arm64") ba91e7e5d15a ("selftests/mm: add tests for HWPOISON hugetlbfs read") 63773d2b593d ("Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:58 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation Reset nr_hugepages to zero before the start of the test. If a non-zero number of hugepages is already set before the start of the test, the following problems arise: - The probability of the test getting OOM-killed increases. Proof: The test wants to run on 80% of available memory to prevent OOM-killing (see original code comments). Let the value of mem_free at the start of the test, when nr_hugepages = 0, be x. In the other case, when nr_hugepages > 0, let the memory consumed by hugepages be y. In the former case, the test operates on 0.8 * x of memory. In the latter, the test operates on 0.8 * (x - y) of memory, with y already filled, hence, memory consumed is y + 0.8 * (x - y) = 0.8 * x + 0.2 * y > 0.8 * x. Q.E.D - The probability of a bogus test success increases. Proof: Let the memory consumed by hugepages be greater than 25% of x, with x and y defined as above. The definition of compaction_index is c_index = (x - y)/z where z is the memory consumed by hugepages after trying to increase them again. In check_compaction(), we set the number of hugepages to zero, and then increase them back; the probability that they will be set back to consume at least y amount of memory again is very high (since there is not much delay between the two attempts of changing nr_hugepages). Hence, z >= y > (x/4) (by the 25% assumption). Therefore, c_index = (x - y)/z <= (x - y)/y = x/y - 1 < 4 - 1 = 3 hence, c_index can always be forced to be less than 3, thereby the test succeeding always. Q.E.D Link: https://lkml.kernel.org/r/20240521074358.675031-4-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 5e9bd1da9370..e140558e6f53 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,13 +82,16 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned long hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size, + unsigned long initial_nr_hugepages) { unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; char nr_hugepages[20] = {0}; + char init_nr_hugepages[20] = {0}; + + sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages); /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -102,23 +105,6 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto out; } - if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) { - ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - - /* Start with the initial condition of 0 huge pages*/ - if (write(fd, "0", sizeof(char)) != sizeof(char)) { - ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - /* Request a large number of huge pages. The Kernel will allocate as much as it can */ if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { @@ -146,8 +132,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) lseek(fd, 0, SEEK_SET); - if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages)) - != strlen(initial_nr_hugepages)) { + if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages)) + != strlen(init_nr_hugepages)) { ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n", strerror(errno)); goto close_fd; @@ -171,6 +157,41 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) return ret; } +int set_zero_hugepages(unsigned long *initial_nr_hugepages) +{ + int fd, ret = -1; + char nr_hugepages[20] = {0}; + + fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK); + if (fd < 0) { + ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto out; + } + if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) { + ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + lseek(fd, 0, SEEK_SET); + + /* Start with the initial condition of 0 huge pages */ + if (write(fd, "0", sizeof(char)) != sizeof(char)) { + ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + *initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10); + ret = 0; + + close_fd: + close(fd); + + out: + return ret; +} int main(int argc, char **argv) { @@ -181,6 +202,7 @@ int main(int argc, char **argv) unsigned long mem_free = 0; unsigned long hugepage_size = 0; long mem_fragmentable_MB = 0; + unsigned long initial_nr_hugepages; ksft_print_header(); @@ -189,6 +211,10 @@ int main(int argc, char **argv) ksft_set_plan(1); + /* Start the test without hugepages reducing mem_free */ + if (set_zero_hugepages(&initial_nr_hugepages)) + ksft_exit_fail(); + lim.rlim_cur = RLIM_INFINITY; lim.rlim_max = RLIM_INFINITY; if (setrlimit(RLIMIT_MEMLOCK, &lim)) @@ -232,7 +258,8 @@ int main(int argc, char **argv) entry = entry->next; } - if (check_compaction(mem_free, hugepage_size) == 0) + if (check_compaction(mem_free, hugepage_size, + initial_nr_hugepages) == 0) ksft_exit_pass(); ksft_exit_fail();

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success and" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061351-oxidize-alright-8eee@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") 69e545edbe8b ("selftests/mm: ksft_exit functions do not return") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9c1490d911f8 ("selftests/mm: log skipped compaction test as a skip") 8c9eea721a98 ("selftests/mm: skip test if application doesn't has root privileges") 9a21701edc41 ("selftests/mm: conform test to TAP format output") cb6e7cae1886 ("selftests/mm: gup_test: conform test to TAP format output") 019b277b680f ("selftests: mm: skip whole test instead of failure") 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") 05f1edac8009 ("selftests/mm: run all tests from run_vmtests.sh") 000303329752 ("selftests/mm: make migration test robust to failure") f6dd4e223d87 ("selftests/mm: skip soft-dirty tests on arm64") ba91e7e5d15a ("selftests/mm: add tests for HWPOISON hugetlbfs read") 63773d2b593d ("Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:58 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation Reset nr_hugepages to zero before the start of the test. If a non-zero number of hugepages is already set before the start of the test, the following problems arise: - The probability of the test getting OOM-killed increases. Proof: The test wants to run on 80% of available memory to prevent OOM-killing (see original code comments). Let the value of mem_free at the start of the test, when nr_hugepages = 0, be x. In the other case, when nr_hugepages > 0, let the memory consumed by hugepages be y. In the former case, the test operates on 0.8 * x of memory. In the latter, the test operates on 0.8 * (x - y) of memory, with y already filled, hence, memory consumed is y + 0.8 * (x - y) = 0.8 * x + 0.2 * y > 0.8 * x. Q.E.D - The probability of a bogus test success increases. Proof: Let the memory consumed by hugepages be greater than 25% of x, with x and y defined as above. The definition of compaction_index is c_index = (x - y)/z where z is the memory consumed by hugepages after trying to increase them again. In check_compaction(), we set the number of hugepages to zero, and then increase them back; the probability that they will be set back to consume at least y amount of memory again is very high (since there is not much delay between the two attempts of changing nr_hugepages). Hence, z >= y > (x/4) (by the 25% assumption). Therefore, c_index = (x - y)/z <= (x - y)/y = x/y - 1 < 4 - 1 = 3 hence, c_index can always be forced to be less than 3, thereby the test succeeding always. Q.E.D Link: https://lkml.kernel.org/r/20240521074358.675031-4-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 5e9bd1da9370..e140558e6f53 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,13 +82,16 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned long hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size, + unsigned long initial_nr_hugepages) { unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; char nr_hugepages[20] = {0}; + char init_nr_hugepages[20] = {0}; + + sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages); /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -102,23 +105,6 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto out; } - if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) { - ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - - /* Start with the initial condition of 0 huge pages*/ - if (write(fd, "0", sizeof(char)) != sizeof(char)) { - ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - /* Request a large number of huge pages. The Kernel will allocate as much as it can */ if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { @@ -146,8 +132,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) lseek(fd, 0, SEEK_SET); - if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages)) - != strlen(initial_nr_hugepages)) { + if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages)) + != strlen(init_nr_hugepages)) { ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n", strerror(errno)); goto close_fd; @@ -171,6 +157,41 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) return ret; } +int set_zero_hugepages(unsigned long *initial_nr_hugepages) +{ + int fd, ret = -1; + char nr_hugepages[20] = {0}; + + fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK); + if (fd < 0) { + ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto out; + } + if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) { + ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + lseek(fd, 0, SEEK_SET); + + /* Start with the initial condition of 0 huge pages */ + if (write(fd, "0", sizeof(char)) != sizeof(char)) { + ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + *initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10); + ret = 0; + + close_fd: + close(fd); + + out: + return ret; +} int main(int argc, char **argv) { @@ -181,6 +202,7 @@ int main(int argc, char **argv) unsigned long mem_free = 0; unsigned long hugepage_size = 0; long mem_fragmentable_MB = 0; + unsigned long initial_nr_hugepages; ksft_print_header(); @@ -189,6 +211,10 @@ int main(int argc, char **argv) ksft_set_plan(1); + /* Start the test without hugepages reducing mem_free */ + if (set_zero_hugepages(&initial_nr_hugepages)) + ksft_exit_fail(); + lim.rlim_cur = RLIM_INFINITY; lim.rlim_max = RLIM_INFINITY; if (setrlimit(RLIMIT_MEMLOCK, &lim)) @@ -232,7 +258,8 @@ int main(int argc, char **argv) entry = entry->next; } - if (check_compaction(mem_free, hugepage_size) == 0) + if (check_compaction(mem_free, hugepage_size, + initial_nr_hugepages) == 0) ksft_exit_pass(); ksft_exit_fail();

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success and" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061349-imply-endnote-102d@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") 69e545edbe8b ("selftests/mm: ksft_exit functions do not return") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9c1490d911f8 ("selftests/mm: log skipped compaction test as a skip") 8c9eea721a98 ("selftests/mm: skip test if application doesn't has root privileges") 9a21701edc41 ("selftests/mm: conform test to TAP format output") cb6e7cae1886 ("selftests/mm: gup_test: conform test to TAP format output") 019b277b680f ("selftests: mm: skip whole test instead of failure") 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") 05f1edac8009 ("selftests/mm: run all tests from run_vmtests.sh") 000303329752 ("selftests/mm: make migration test robust to failure") f6dd4e223d87 ("selftests/mm: skip soft-dirty tests on arm64") ba91e7e5d15a ("selftests/mm: add tests for HWPOISON hugetlbfs read") 63773d2b593d ("Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:58 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation Reset nr_hugepages to zero before the start of the test. If a non-zero number of hugepages is already set before the start of the test, the following problems arise: - The probability of the test getting OOM-killed increases. Proof: The test wants to run on 80% of available memory to prevent OOM-killing (see original code comments). Let the value of mem_free at the start of the test, when nr_hugepages = 0, be x. In the other case, when nr_hugepages > 0, let the memory consumed by hugepages be y. In the former case, the test operates on 0.8 * x of memory. In the latter, the test operates on 0.8 * (x - y) of memory, with y already filled, hence, memory consumed is y + 0.8 * (x - y) = 0.8 * x + 0.2 * y > 0.8 * x. Q.E.D - The probability of a bogus test success increases. Proof: Let the memory consumed by hugepages be greater than 25% of x, with x and y defined as above. The definition of compaction_index is c_index = (x - y)/z where z is the memory consumed by hugepages after trying to increase them again. In check_compaction(), we set the number of hugepages to zero, and then increase them back; the probability that they will be set back to consume at least y amount of memory again is very high (since there is not much delay between the two attempts of changing nr_hugepages). Hence, z >= y > (x/4) (by the 25% assumption). Therefore, c_index = (x - y)/z <= (x - y)/y = x/y - 1 < 4 - 1 = 3 hence, c_index can always be forced to be less than 3, thereby the test succeeding always. Q.E.D Link: https://lkml.kernel.org/r/20240521074358.675031-4-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 5e9bd1da9370..e140558e6f53 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,13 +82,16 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned long hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size, + unsigned long initial_nr_hugepages) { unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; char nr_hugepages[20] = {0}; + char init_nr_hugepages[20] = {0}; + + sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages); /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -102,23 +105,6 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto out; } - if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) { - ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - - /* Start with the initial condition of 0 huge pages*/ - if (write(fd, "0", sizeof(char)) != sizeof(char)) { - ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - /* Request a large number of huge pages. The Kernel will allocate as much as it can */ if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { @@ -146,8 +132,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) lseek(fd, 0, SEEK_SET); - if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages)) - != strlen(initial_nr_hugepages)) { + if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages)) + != strlen(init_nr_hugepages)) { ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n", strerror(errno)); goto close_fd; @@ -171,6 +157,41 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) return ret; } +int set_zero_hugepages(unsigned long *initial_nr_hugepages) +{ + int fd, ret = -1; + char nr_hugepages[20] = {0}; + + fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK); + if (fd < 0) { + ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto out; + } + if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) { + ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + lseek(fd, 0, SEEK_SET); + + /* Start with the initial condition of 0 huge pages */ + if (write(fd, "0", sizeof(char)) != sizeof(char)) { + ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + *initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10); + ret = 0; + + close_fd: + close(fd); + + out: + return ret; +} int main(int argc, char **argv) { @@ -181,6 +202,7 @@ int main(int argc, char **argv) unsigned long mem_free = 0; unsigned long hugepage_size = 0; long mem_fragmentable_MB = 0; + unsigned long initial_nr_hugepages; ksft_print_header(); @@ -189,6 +211,10 @@ int main(int argc, char **argv) ksft_set_plan(1); + /* Start the test without hugepages reducing mem_free */ + if (set_zero_hugepages(&initial_nr_hugepages)) + ksft_exit_fail(); + lim.rlim_cur = RLIM_INFINITY; lim.rlim_max = RLIM_INFINITY; if (setrlimit(RLIMIT_MEMLOCK, &lim)) @@ -232,7 +258,8 @@ int main(int argc, char **argv) entry = entry->next; } - if (check_compaction(mem_free, hugepage_size) == 0) + if (check_compaction(mem_free, hugepage_size, + initial_nr_hugepages) == 0) ksft_exit_pass(); ksft_exit_fail();

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success and" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061347-carat-unguided-96cc@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") 69e545edbe8b ("selftests/mm: ksft_exit functions do not return") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9c1490d911f8 ("selftests/mm: log skipped compaction test as a skip") 8c9eea721a98 ("selftests/mm: skip test if application doesn't has root privileges") 9a21701edc41 ("selftests/mm: conform test to TAP format output") cb6e7cae1886 ("selftests/mm: gup_test: conform test to TAP format output") 019b277b680f ("selftests: mm: skip whole test instead of failure") 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") 05f1edac8009 ("selftests/mm: run all tests from run_vmtests.sh") 000303329752 ("selftests/mm: make migration test robust to failure") f6dd4e223d87 ("selftests/mm: skip soft-dirty tests on arm64") ba91e7e5d15a ("selftests/mm: add tests for HWPOISON hugetlbfs read") 63773d2b593d ("Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:58 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation Reset nr_hugepages to zero before the start of the test. If a non-zero number of hugepages is already set before the start of the test, the following problems arise: - The probability of the test getting OOM-killed increases. Proof: The test wants to run on 80% of available memory to prevent OOM-killing (see original code comments). Let the value of mem_free at the start of the test, when nr_hugepages = 0, be x. In the other case, when nr_hugepages > 0, let the memory consumed by hugepages be y. In the former case, the test operates on 0.8 * x of memory. In the latter, the test operates on 0.8 * (x - y) of memory, with y already filled, hence, memory consumed is y + 0.8 * (x - y) = 0.8 * x + 0.2 * y > 0.8 * x. Q.E.D - The probability of a bogus test success increases. Proof: Let the memory consumed by hugepages be greater than 25% of x, with x and y defined as above. The definition of compaction_index is c_index = (x - y)/z where z is the memory consumed by hugepages after trying to increase them again. In check_compaction(), we set the number of hugepages to zero, and then increase them back; the probability that they will be set back to consume at least y amount of memory again is very high (since there is not much delay between the two attempts of changing nr_hugepages). Hence, z >= y > (x/4) (by the 25% assumption). Therefore, c_index = (x - y)/z <= (x - y)/y = x/y - 1 < 4 - 1 = 3 hence, c_index can always be forced to be less than 3, thereby the test succeeding always. Q.E.D Link: https://lkml.kernel.org/r/20240521074358.675031-4-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 5e9bd1da9370..e140558e6f53 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,13 +82,16 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned long hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size, + unsigned long initial_nr_hugepages) { unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; char nr_hugepages[20] = {0}; + char init_nr_hugepages[20] = {0}; + + sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages); /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -102,23 +105,6 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto out; } - if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) { - ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - - /* Start with the initial condition of 0 huge pages*/ - if (write(fd, "0", sizeof(char)) != sizeof(char)) { - ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - /* Request a large number of huge pages. The Kernel will allocate as much as it can */ if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { @@ -146,8 +132,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) lseek(fd, 0, SEEK_SET); - if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages)) - != strlen(initial_nr_hugepages)) { + if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages)) + != strlen(init_nr_hugepages)) { ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n", strerror(errno)); goto close_fd; @@ -171,6 +157,41 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) return ret; } +int set_zero_hugepages(unsigned long *initial_nr_hugepages) +{ + int fd, ret = -1; + char nr_hugepages[20] = {0}; + + fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK); + if (fd < 0) { + ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto out; + } + if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) { + ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + lseek(fd, 0, SEEK_SET); + + /* Start with the initial condition of 0 huge pages */ + if (write(fd, "0", sizeof(char)) != sizeof(char)) { + ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + *initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10); + ret = 0; + + close_fd: + close(fd); + + out: + return ret; +} int main(int argc, char **argv) { @@ -181,6 +202,7 @@ int main(int argc, char **argv) unsigned long mem_free = 0; unsigned long hugepage_size = 0; long mem_fragmentable_MB = 0; + unsigned long initial_nr_hugepages; ksft_print_header(); @@ -189,6 +211,10 @@ int main(int argc, char **argv) ksft_set_plan(1); + /* Start the test without hugepages reducing mem_free */ + if (set_zero_hugepages(&initial_nr_hugepages)) + ksft_exit_fail(); + lim.rlim_cur = RLIM_INFINITY; lim.rlim_max = RLIM_INFINITY; if (setrlimit(RLIMIT_MEMLOCK, &lim)) @@ -232,7 +258,8 @@ int main(int argc, char **argv) entry = entry->next; } - if (check_compaction(mem_free, hugepage_size) == 0) + if (check_compaction(mem_free, hugepage_size, + initial_nr_hugepages) == 0) ksft_exit_pass(); ksft_exit_fail();

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success and" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061345-fanciness-reheat-95c1@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") 69e545edbe8b ("selftests/mm: ksft_exit functions do not return") f3b7568c4942 ("selftests/mm: log a consistent test name for check_compaction") 9c1490d911f8 ("selftests/mm: log skipped compaction test as a skip") 8c9eea721a98 ("selftests/mm: skip test if application doesn't has root privileges") 9a21701edc41 ("selftests/mm: conform test to TAP format output") cb6e7cae1886 ("selftests/mm: gup_test: conform test to TAP format output") 019b277b680f ("selftests: mm: skip whole test instead of failure") 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:58 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation Reset nr_hugepages to zero before the start of the test. If a non-zero number of hugepages is already set before the start of the test, the following problems arise: - The probability of the test getting OOM-killed increases. Proof: The test wants to run on 80% of available memory to prevent OOM-killing (see original code comments). Let the value of mem_free at the start of the test, when nr_hugepages = 0, be x. In the other case, when nr_hugepages > 0, let the memory consumed by hugepages be y. In the former case, the test operates on 0.8 * x of memory. In the latter, the test operates on 0.8 * (x - y) of memory, with y already filled, hence, memory consumed is y + 0.8 * (x - y) = 0.8 * x + 0.2 * y > 0.8 * x. Q.E.D - The probability of a bogus test success increases. Proof: Let the memory consumed by hugepages be greater than 25% of x, with x and y defined as above. The definition of compaction_index is c_index = (x - y)/z where z is the memory consumed by hugepages after trying to increase them again. In check_compaction(), we set the number of hugepages to zero, and then increase them back; the probability that they will be set back to consume at least y amount of memory again is very high (since there is not much delay between the two attempts of changing nr_hugepages). Hence, z >= y > (x/4) (by the 25% assumption). Therefore, c_index = (x - y)/z <= (x - y)/y = x/y - 1 < 4 - 1 = 3 hence, c_index can always be forced to be less than 3, thereby the test succeeding always. Q.E.D Link: https://lkml.kernel.org/r/20240521074358.675031-4-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 5e9bd1da9370..e140558e6f53 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,13 +82,16 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned long hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size, + unsigned long initial_nr_hugepages) { unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; char nr_hugepages[20] = {0}; + char init_nr_hugepages[20] = {0}; + + sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages); /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -102,23 +105,6 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto out; } - if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) { - ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - - /* Start with the initial condition of 0 huge pages*/ - if (write(fd, "0", sizeof(char)) != sizeof(char)) { - ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - /* Request a large number of huge pages. The Kernel will allocate as much as it can */ if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { @@ -146,8 +132,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) lseek(fd, 0, SEEK_SET); - if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages)) - != strlen(initial_nr_hugepages)) { + if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages)) + != strlen(init_nr_hugepages)) { ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n", strerror(errno)); goto close_fd; @@ -171,6 +157,41 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) return ret; } +int set_zero_hugepages(unsigned long *initial_nr_hugepages) +{ + int fd, ret = -1; + char nr_hugepages[20] = {0}; + + fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK); + if (fd < 0) { + ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto out; + } + if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) { + ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + lseek(fd, 0, SEEK_SET); + + /* Start with the initial condition of 0 huge pages */ + if (write(fd, "0", sizeof(char)) != sizeof(char)) { + ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + *initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10); + ret = 0; + + close_fd: + close(fd); + + out: + return ret; +} int main(int argc, char **argv) { @@ -181,6 +202,7 @@ int main(int argc, char **argv) unsigned long mem_free = 0; unsigned long hugepage_size = 0; long mem_fragmentable_MB = 0; + unsigned long initial_nr_hugepages; ksft_print_header(); @@ -189,6 +211,10 @@ int main(int argc, char **argv) ksft_set_plan(1); + /* Start the test without hugepages reducing mem_free */ + if (set_zero_hugepages(&initial_nr_hugepages)) + ksft_exit_fail(); + lim.rlim_cur = RLIM_INFINITY; lim.rlim_max = RLIM_INFINITY; if (setrlimit(RLIMIT_MEMLOCK, &lim)) @@ -232,7 +258,8 @@ int main(int argc, char **argv) entry = entry->next; } - if (check_compaction(mem_free, hugepage_size) == 0) + if (check_compaction(mem_free, hugepage_size, + initial_nr_hugepages) == 0) ksft_exit_pass(); ksft_exit_fail();

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix bogus test success and" failed to apply to 6.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y git checkout FETCH_HEAD git cherry-pick -x fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061344-citric-service-140d@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^.. Possible dependencies: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") d4202e66a4b1 ("selftests/mm: compaction_test: fix bogus test success on Aarch64") 69e545edbe8b ("selftests/mm: ksft_exit functions do not return") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From fb9293b6b0156fbf6ab97a1625d99a29c36d9f0c Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:58 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation Reset nr_hugepages to zero before the start of the test. If a non-zero number of hugepages is already set before the start of the test, the following problems arise: - The probability of the test getting OOM-killed increases. Proof: The test wants to run on 80% of available memory to prevent OOM-killing (see original code comments). Let the value of mem_free at the start of the test, when nr_hugepages = 0, be x. In the other case, when nr_hugepages > 0, let the memory consumed by hugepages be y. In the former case, the test operates on 0.8 * x of memory. In the latter, the test operates on 0.8 * (x - y) of memory, with y already filled, hence, memory consumed is y + 0.8 * (x - y) = 0.8 * x + 0.2 * y > 0.8 * x. Q.E.D - The probability of a bogus test success increases. Proof: Let the memory consumed by hugepages be greater than 25% of x, with x and y defined as above. The definition of compaction_index is c_index = (x - y)/z where z is the memory consumed by hugepages after trying to increase them again. In check_compaction(), we set the number of hugepages to zero, and then increase them back; the probability that they will be set back to consume at least y amount of memory again is very high (since there is not much delay between the two attempts of changing nr_hugepages). Hence, z >= y > (x/4) (by the 25% assumption). Therefore, c_index = (x - y)/z <= (x - y)/y = x/y - 1 < 4 - 1 = 3 hence, c_index can always be forced to be less than 3, thereby the test succeeding always. Q.E.D Link: https://lkml.kernel.org/r/20240521074358.675031-4-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 5e9bd1da9370..e140558e6f53 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -82,13 +82,16 @@ int prereq(void) return -1; } -int check_compaction(unsigned long mem_free, unsigned long hugepage_size) +int check_compaction(unsigned long mem_free, unsigned long hugepage_size, + unsigned long initial_nr_hugepages) { unsigned long nr_hugepages_ul; int fd, ret = -1; int compaction_index = 0; - char initial_nr_hugepages[20] = {0}; char nr_hugepages[20] = {0}; + char init_nr_hugepages[20] = {0}; + + sprintf(init_nr_hugepages, "%lu", initial_nr_hugepages); /* We want to test with 80% of available memory. Else, OOM killer comes in to play */ @@ -102,23 +105,6 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto out; } - if (read(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages)) <= 0) { - ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - - /* Start with the initial condition of 0 huge pages*/ - if (write(fd, "0", sizeof(char)) != sizeof(char)) { - ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", - strerror(errno)); - goto close_fd; - } - - lseek(fd, 0, SEEK_SET); - /* Request a large number of huge pages. The Kernel will allocate as much as it can */ if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) { @@ -146,8 +132,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) lseek(fd, 0, SEEK_SET); - if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages)) - != strlen(initial_nr_hugepages)) { + if (write(fd, init_nr_hugepages, strlen(init_nr_hugepages)) + != strlen(init_nr_hugepages)) { ksft_print_msg("Failed to write value to /proc/sys/vm/nr_hugepages: %s\n", strerror(errno)); goto close_fd; @@ -171,6 +157,41 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) return ret; } +int set_zero_hugepages(unsigned long *initial_nr_hugepages) +{ + int fd, ret = -1; + char nr_hugepages[20] = {0}; + + fd = open("/proc/sys/vm/nr_hugepages", O_RDWR | O_NONBLOCK); + if (fd < 0) { + ksft_print_msg("Failed to open /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto out; + } + if (read(fd, nr_hugepages, sizeof(nr_hugepages)) <= 0) { + ksft_print_msg("Failed to read from /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + lseek(fd, 0, SEEK_SET); + + /* Start with the initial condition of 0 huge pages */ + if (write(fd, "0", sizeof(char)) != sizeof(char)) { + ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n", + strerror(errno)); + goto close_fd; + } + + *initial_nr_hugepages = strtoul(nr_hugepages, NULL, 10); + ret = 0; + + close_fd: + close(fd); + + out: + return ret; +} int main(int argc, char **argv) { @@ -181,6 +202,7 @@ int main(int argc, char **argv) unsigned long mem_free = 0; unsigned long hugepage_size = 0; long mem_fragmentable_MB = 0; + unsigned long initial_nr_hugepages; ksft_print_header(); @@ -189,6 +211,10 @@ int main(int argc, char **argv) ksft_set_plan(1); + /* Start the test without hugepages reducing mem_free */ + if (set_zero_hugepages(&initial_nr_hugepages)) + ksft_exit_fail(); + lim.rlim_cur = RLIM_INFINITY; lim.rlim_max = RLIM_INFINITY; if (setrlimit(RLIMIT_MEMLOCK, &lim)) @@ -232,7 +258,8 @@ int main(int argc, char **argv) entry = entry->next; } - if (check_compaction(mem_free, hugepage_size) == 0) + if (check_compaction(mem_free, hugepage_size, + initial_nr_hugepages) == 0) ksft_exit_pass(); ksft_exit_fail();

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix incorrect write of zero to" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 9ad665ef55eaad1ead1406a58a34f615a7c18b5e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061334-splinter-unshipped-1c3e@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9ad665ef55eaad1ead1406a58a34f615a7c18b5e Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:57 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages Currently, the test tries to set nr_hugepages to zero, but that is not actually done because the file offset is not reset after read(). Fix that using lseek(). Link: https://lkml.kernel.org/r/20240521074358.675031-3-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 0b249a06a60b..5e9bd1da9370 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -108,6 +108,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto close_fd; } + lseek(fd, 0, SEEK_SET); + /* Start with the initial condition of 0 huge pages*/ if (write(fd, "0", sizeof(char)) != sizeof(char)) { ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n",

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix incorrect write of zero to" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 9ad665ef55eaad1ead1406a58a34f615a7c18b5e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061333-unicorn-unstaffed-01d6@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9ad665ef55eaad1ead1406a58a34f615a7c18b5e Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:57 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages Currently, the test tries to set nr_hugepages to zero, but that is not actually done because the file offset is not reset after read(). Fix that using lseek(). Link: https://lkml.kernel.org/r/20240521074358.675031-3-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 0b249a06a60b..5e9bd1da9370 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -108,6 +108,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto close_fd; } + lseek(fd, 0, SEEK_SET); + /* Start with the initial condition of 0 huge pages*/ if (write(fd, "0", sizeof(char)) != sizeof(char)) { ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n",

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix incorrect write of zero to" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 9ad665ef55eaad1ead1406a58a34f615a7c18b5e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061332-catering-triage-c259@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9ad665ef55eaad1ead1406a58a34f615a7c18b5e Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:57 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages Currently, the test tries to set nr_hugepages to zero, but that is not actually done because the file offset is not reset after read(). Fix that using lseek(). Link: https://lkml.kernel.org/r/20240521074358.675031-3-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 0b249a06a60b..5e9bd1da9370 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -108,6 +108,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto close_fd; } + lseek(fd, 0, SEEK_SET); + /* Start with the initial condition of 0 huge pages*/ if (write(fd, "0", sizeof(char)) != sizeof(char)) { ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n",

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix incorrect write of zero to" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 9ad665ef55eaad1ead1406a58a34f615a7c18b5e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061331-trilogy-bulk-6fc0@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9ad665ef55eaad1ead1406a58a34f615a7c18b5e Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:57 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages Currently, the test tries to set nr_hugepages to zero, but that is not actually done because the file offset is not reset after read(). Fix that using lseek(). Link: https://lkml.kernel.org/r/20240521074358.675031-3-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 0b249a06a60b..5e9bd1da9370 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -108,6 +108,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto close_fd; } + lseek(fd, 0, SEEK_SET); + /* Start with the initial condition of 0 huge pages*/ if (write(fd, "0", sizeof(char)) != sizeof(char)) { ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n",

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] selftests/mm: compaction_test: fix incorrect write of zero to" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 9ad665ef55eaad1ead1406a58a34f615a7c18b5e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061331-these-daunting-6dba@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 9ad665ef55ea ("selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 9ad665ef55eaad1ead1406a58a34f615a7c18b5e Mon Sep 17 00:00:00 2001 From: Dev Jain <dev.jain(a)arm.com> Date: Tue, 21 May 2024 13:13:57 +0530 Subject: [PATCH] selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages Currently, the test tries to set nr_hugepages to zero, but that is not actually done because the file offset is not reset after read(). Fix that using lseek(). Link: https://lkml.kernel.org/r/20240521074358.675031-3-dev.jain@arm.com Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory") Signed-off-by: Dev Jain <dev.jain(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Sri Jayaramappa <sjayaram(a)akamai.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c index 0b249a06a60b..5e9bd1da9370 100644 --- a/tools/testing/selftests/mm/compaction_test.c +++ b/tools/testing/selftests/mm/compaction_test.c @@ -108,6 +108,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size) goto close_fd; } + lseek(fd, 0, SEEK_SET); + /* Start with the initial condition of 0 huge pages*/ if (write(fd, "0", sizeof(char)) != sizeof(char)) { ksft_print_msg("Failed to write 0 to /proc/sys/vm/nr_hugepages: %s\n",

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm: /proc/pid/smaps_rollup: avoid skipping vma after getting" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 6d065f507d82307d6161ac75c025111fb8b08a46 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061335-lunchbox-playroom-cf81@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 6d065f507d82 ("mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again") 250cb40f0afe ("task_mmu: convert to vma iterator") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 6d065f507d82307d6161ac75c025111fb8b08a46 Mon Sep 17 00:00:00 2001 From: Yuanyuan Zhong <yzhong(a)purestorage.com> Date: Thu, 23 May 2024 12:35:31 -0600 Subject: [PATCH] mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again After switching smaps_rollup to use VMA iterator, searching for next entry is part of the condition expression of the do-while loop. So the current VMA needs to be addressed before the continue statement. Otherwise, with some VMAs skipped, userspace observed memory consumption from /proc/pid/smaps_rollup will be smaller than the sum of the corresponding fields from /proc/pid/smaps. Link: https://lkml.kernel.org/r/20240523183531.2535436-1-yzhong@purestorage.com Fixes: c4c84f06285e ("fs/proc/task_mmu: stop using linked list and highest_vm_end") Signed-off-by: Yuanyuan Zhong <yzhong(a)purestorage.com> Reviewed-by: Mohamed Khalfella <mkhalfella(a)purestorage.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index e5a5f015ff03..f8d35f993fe5 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -970,12 +970,17 @@ static int show_smaps_rollup(struct seq_file *m, void *v) break; /* Case 1 and 2 above */ - if (vma->vm_start >= last_vma_end) + if (vma->vm_start >= last_vma_end) { + smap_gather_stats(vma, &mss, 0); + last_vma_end = vma->vm_end; continue; + } /* Case 4 above */ - if (vma->vm_end > last_vma_end) + if (vma->vm_end > last_vma_end) { smap_gather_stats(vma, &mss, last_vma_end); + last_vma_end = vma->vm_end; + } } } for_each_vma(vmi, vma);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm/hugetlb: pass correct order_per_bit to" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 55d134a7b499c77e7cfd0ee41046f3c376e791e5 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061318-magical-unclamped-49ef@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 55d134a7b499 ("mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid") a01f43901cfb ("hugetlb: be sure to free demoted CMA pages to CMA") 79dfc695525f ("hugetlb: add demote hugetlb page sysfs interfaces") 6eb4e88a6d27 ("hugetlb: create remove_hugetlb_page() to separate functionality") 262443c0421e ("hugetlb: no need to drop hugetlb_lock to call cma_release") 9157c31186c3 ("hugetlb: convert PageHugeTemporary() to HPageTemporary flag") 8f251a3d5ce3 ("hugetlb: convert page_huge_active() HPageMigratable flag") d6995da31122 ("hugetlb: use page.private for hugetlb specific page flags") dbfee5aee7e5 ("hugetlb: fix update_and_free_page contig page struct assumption") ecbf4724e606 ("mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active") 0eb2df2b5629 ("mm: hugetlb: fix a race between isolating and freeing page") 585fc0d2871c ("mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 55d134a7b499c77e7cfd0ee41046f3c376e791e5 Mon Sep 17 00:00:00 2001 From: Frank van der Linden <fvdl(a)google.com> Date: Thu, 4 Apr 2024 16:25:15 +0000 Subject: [PATCH] mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid The hugetlb_cma code passes 0 in the order_per_bit argument to cma_declare_contiguous_nid (the alignment, computed using the page order, is correctly passed in). This causes a bit in the cma allocation bitmap to always represent a 4k page, making the bitmaps potentially very large, and slower. It would create bitmaps that would be pretty big. E.g. for a 4k page size on x86, hugetlb_cma=64G would mean a bitmap size of (64G / 4k) / 8 == 2M. With HUGETLB_PAGE_ORDER as order_per_bit, as intended, this would be (64G / 2M) / 8 == 4k. So, that's quite a difference. Also, this restricted the hugetlb_cma area to ((PAGE_SIZE << MAX_PAGE_ORDER) * 8) * PAGE_SIZE (e.g. 128G on x86) , since bitmap_alloc uses normal page allocation, and is thus restricted by MAX_PAGE_ORDER. Specifying anything about that would fail the CMA initialization. So, correctly pass in the order instead. Link: https://lkml.kernel.org/r/20240404162515.527802-2-fvdl@google.com Fixes: cf11e85fc08c ("mm: hugetlb: optionally allocate gigantic hugepages using cma") Signed-off-by: Frank van der Linden <fvdl(a)google.com> Acked-by: Roman Gushchin <roman.gushchin(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 228c886c46c1..5dc3f5ea3a2e 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -7794,9 +7794,9 @@ void __init hugetlb_cma_reserve(int order) * huge page demotion. */ res = cma_declare_contiguous_nid(0, size, 0, - PAGE_SIZE << HUGETLB_PAGE_ORDER, - 0, false, name, - &hugetlb_cma[nid], nid); + PAGE_SIZE << HUGETLB_PAGE_ORDER, + HUGETLB_PAGE_ORDER, false, name, + &hugetlb_cma[nid], nid); if (res) { pr_warn("hugetlb_cma: reservation failed: err %d, node %d", res, nid);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm/hugetlb: pass correct order_per_bit to" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 55d134a7b499c77e7cfd0ee41046f3c376e791e5 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061317-rework-obituary-d23b@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 55d134a7b499 ("mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid") a01f43901cfb ("hugetlb: be sure to free demoted CMA pages to CMA") 79dfc695525f ("hugetlb: add demote hugetlb page sysfs interfaces") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 55d134a7b499c77e7cfd0ee41046f3c376e791e5 Mon Sep 17 00:00:00 2001 From: Frank van der Linden <fvdl(a)google.com> Date: Thu, 4 Apr 2024 16:25:15 +0000 Subject: [PATCH] mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid The hugetlb_cma code passes 0 in the order_per_bit argument to cma_declare_contiguous_nid (the alignment, computed using the page order, is correctly passed in). This causes a bit in the cma allocation bitmap to always represent a 4k page, making the bitmaps potentially very large, and slower. It would create bitmaps that would be pretty big. E.g. for a 4k page size on x86, hugetlb_cma=64G would mean a bitmap size of (64G / 4k) / 8 == 2M. With HUGETLB_PAGE_ORDER as order_per_bit, as intended, this would be (64G / 2M) / 8 == 4k. So, that's quite a difference. Also, this restricted the hugetlb_cma area to ((PAGE_SIZE << MAX_PAGE_ORDER) * 8) * PAGE_SIZE (e.g. 128G on x86) , since bitmap_alloc uses normal page allocation, and is thus restricted by MAX_PAGE_ORDER. Specifying anything about that would fail the CMA initialization. So, correctly pass in the order instead. Link: https://lkml.kernel.org/r/20240404162515.527802-2-fvdl@google.com Fixes: cf11e85fc08c ("mm: hugetlb: optionally allocate gigantic hugepages using cma") Signed-off-by: Frank van der Linden <fvdl(a)google.com> Acked-by: Roman Gushchin <roman.gushchin(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 228c886c46c1..5dc3f5ea3a2e 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -7794,9 +7794,9 @@ void __init hugetlb_cma_reserve(int order) * huge page demotion. */ res = cma_declare_contiguous_nid(0, size, 0, - PAGE_SIZE << HUGETLB_PAGE_ORDER, - 0, false, name, - &hugetlb_cma[nid], nid); + PAGE_SIZE << HUGETLB_PAGE_ORDER, + HUGETLB_PAGE_ORDER, false, name, + &hugetlb_cma[nid], nid); if (res) { pr_warn("hugetlb_cma: reservation failed: err %d, node %d", res, nid);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm/cma: drop incorrect alignment check in" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x b174f139bdc8aaaf72f5b67ad1bd512c4868a87e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061304-wolverine-clamshell-84a2@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: b174f139bdc8 ("mm/cma: drop incorrect alignment check in cma_init_reserved_mem") e16faf26780f ("cma: factor out minimum alignment requirement") 658aafc8139c ("memblock: exclude MEMBLOCK_NOMAP regions from kmemleak") a7259df76702 ("memblock: make memblock_find_in_range method private") a70bb580bfea ("Merge tag 'devicetree-for-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b174f139bdc8aaaf72f5b67ad1bd512c4868a87e Mon Sep 17 00:00:00 2001 From: Frank van der Linden <fvdl(a)google.com> Date: Thu, 4 Apr 2024 16:25:14 +0000 Subject: [PATCH] mm/cma: drop incorrect alignment check in cma_init_reserved_mem cma_init_reserved_mem uses IS_ALIGNED to check if the size represented by one bit in the cma allocation bitmask is aligned with CMA_MIN_ALIGNMENT_BYTES (pageblock size). However, this is too strict, as this will fail if order_per_bit > pageblock_order, which is a valid configuration. We could check IS_ALIGNED both ways, but since both numbers are powers of two, no check is needed at all. Link: https://lkml.kernel.org/r/20240404162515.527802-1-fvdl@google.com Fixes: de9e14eebf33 ("drivers: dma-contiguous: add initialization from device tree") Signed-off-by: Frank van der Linden <fvdl(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/cma.c b/mm/cma.c index 01f5a8f71ddf..3e9724716bad 100644 --- a/mm/cma.c +++ b/mm/cma.c @@ -182,10 +182,6 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, if (!size || !memblock_is_region_reserved(base, size)) return -EINVAL; - /* alignment should be aligned with order_per_bit */ - if (!IS_ALIGNED(CMA_MIN_ALIGNMENT_PAGES, 1 << order_per_bit)) - return -EINVAL; - /* ensure minimal alignment required by mm core */ if (!IS_ALIGNED(base | size, CMA_MIN_ALIGNMENT_BYTES)) return -EINVAL;

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm/cma: drop incorrect alignment check in" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x b174f139bdc8aaaf72f5b67ad1bd512c4868a87e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061303-scouting-precise-e914@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: b174f139bdc8 ("mm/cma: drop incorrect alignment check in cma_init_reserved_mem") e16faf26780f ("cma: factor out minimum alignment requirement") 658aafc8139c ("memblock: exclude MEMBLOCK_NOMAP regions from kmemleak") a7259df76702 ("memblock: make memblock_find_in_range method private") a70bb580bfea ("Merge tag 'devicetree-for-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b174f139bdc8aaaf72f5b67ad1bd512c4868a87e Mon Sep 17 00:00:00 2001 From: Frank van der Linden <fvdl(a)google.com> Date: Thu, 4 Apr 2024 16:25:14 +0000 Subject: [PATCH] mm/cma: drop incorrect alignment check in cma_init_reserved_mem cma_init_reserved_mem uses IS_ALIGNED to check if the size represented by one bit in the cma allocation bitmask is aligned with CMA_MIN_ALIGNMENT_BYTES (pageblock size). However, this is too strict, as this will fail if order_per_bit > pageblock_order, which is a valid configuration. We could check IS_ALIGNED both ways, but since both numbers are powers of two, no check is needed at all. Link: https://lkml.kernel.org/r/20240404162515.527802-1-fvdl@google.com Fixes: de9e14eebf33 ("drivers: dma-contiguous: add initialization from device tree") Signed-off-by: Frank van der Linden <fvdl(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/cma.c b/mm/cma.c index 01f5a8f71ddf..3e9724716bad 100644 --- a/mm/cma.c +++ b/mm/cma.c @@ -182,10 +182,6 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, if (!size || !memblock_is_region_reserved(base, size)) return -EINVAL; - /* alignment should be aligned with order_per_bit */ - if (!IS_ALIGNED(CMA_MIN_ALIGNMENT_PAGES, 1 << order_per_bit)) - return -EINVAL; - /* ensure minimal alignment required by mm core */ if (!IS_ALIGNED(base | size, CMA_MIN_ALIGNMENT_BYTES)) return -EINVAL;

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm/cma: drop incorrect alignment check in" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x b174f139bdc8aaaf72f5b67ad1bd512c4868a87e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061302-polyester-ahead-33a7@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: b174f139bdc8 ("mm/cma: drop incorrect alignment check in cma_init_reserved_mem") e16faf26780f ("cma: factor out minimum alignment requirement") 658aafc8139c ("memblock: exclude MEMBLOCK_NOMAP regions from kmemleak") a7259df76702 ("memblock: make memblock_find_in_range method private") a70bb580bfea ("Merge tag 'devicetree-for-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b174f139bdc8aaaf72f5b67ad1bd512c4868a87e Mon Sep 17 00:00:00 2001 From: Frank van der Linden <fvdl(a)google.com> Date: Thu, 4 Apr 2024 16:25:14 +0000 Subject: [PATCH] mm/cma: drop incorrect alignment check in cma_init_reserved_mem cma_init_reserved_mem uses IS_ALIGNED to check if the size represented by one bit in the cma allocation bitmask is aligned with CMA_MIN_ALIGNMENT_BYTES (pageblock size). However, this is too strict, as this will fail if order_per_bit > pageblock_order, which is a valid configuration. We could check IS_ALIGNED both ways, but since both numbers are powers of two, no check is needed at all. Link: https://lkml.kernel.org/r/20240404162515.527802-1-fvdl@google.com Fixes: de9e14eebf33 ("drivers: dma-contiguous: add initialization from device tree") Signed-off-by: Frank van der Linden <fvdl(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/cma.c b/mm/cma.c index 01f5a8f71ddf..3e9724716bad 100644 --- a/mm/cma.c +++ b/mm/cma.c @@ -182,10 +182,6 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, if (!size || !memblock_is_region_reserved(base, size)) return -EINVAL; - /* alignment should be aligned with order_per_bit */ - if (!IS_ALIGNED(CMA_MIN_ALIGNMENT_PAGES, 1 << order_per_bit)) - return -EINVAL; - /* ensure minimal alignment required by mm core */ if (!IS_ALIGNED(base | size, CMA_MIN_ALIGNMENT_BYTES)) return -EINVAL;

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mm/cma: drop incorrect alignment check in" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x b174f139bdc8aaaf72f5b67ad1bd512c4868a87e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061301-runt-mannish-7604@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: b174f139bdc8 ("mm/cma: drop incorrect alignment check in cma_init_reserved_mem") e16faf26780f ("cma: factor out minimum alignment requirement") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b174f139bdc8aaaf72f5b67ad1bd512c4868a87e Mon Sep 17 00:00:00 2001 From: Frank van der Linden <fvdl(a)google.com> Date: Thu, 4 Apr 2024 16:25:14 +0000 Subject: [PATCH] mm/cma: drop incorrect alignment check in cma_init_reserved_mem cma_init_reserved_mem uses IS_ALIGNED to check if the size represented by one bit in the cma allocation bitmask is aligned with CMA_MIN_ALIGNMENT_BYTES (pageblock size). However, this is too strict, as this will fail if order_per_bit > pageblock_order, which is a valid configuration. We could check IS_ALIGNED both ways, but since both numbers are powers of two, no check is needed at all. Link: https://lkml.kernel.org/r/20240404162515.527802-1-fvdl@google.com Fixes: de9e14eebf33 ("drivers: dma-contiguous: add initialization from device tree") Signed-off-by: Frank van der Linden <fvdl(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Marek Szyprowski <m.szyprowski(a)samsung.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/cma.c b/mm/cma.c index 01f5a8f71ddf..3e9724716bad 100644 --- a/mm/cma.c +++ b/mm/cma.c @@ -182,10 +182,6 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, if (!size || !memblock_is_region_reserved(base, size)) return -EINVAL; - /* alignment should be aligned with order_per_bit */ - if (!IS_ALIGNED(CMA_MIN_ALIGNMENT_PAGES, 1 << order_per_bit)) - return -EINVAL; - /* ensure minimal alignment required by mm core */ if (!IS_ALIGNED(base | size, CMA_MIN_ALIGNMENT_BYTES)) return -EINVAL;

1 year, 2 months

1
0
0 0

[PATCH 6.1 1/1] net: fix __dst_negative_advice() race

by Lee Jones

From: Eric Dumazet <edumazet(a)google.com> __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets") Reported-by: Clement Lecigne <clecigne(a)google.com> Diagnosed-by: Clement Lecigne <clecigne(a)google.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> (cherry picked from commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e) [Lee: Stable backport] Signed-off-by: Lee Jones <lee(a)kernel.org> --- include/net/dst_ops.h | 2 +- include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 30 insertions(+), 47 deletions(-) diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h index 632086b2f644..3ae2fda29507 100644 --- a/include/net/dst_ops.h +++ b/include/net/dst_ops.h @@ -24,7 +24,7 @@ struct dst_ops { void (*destroy)(struct dst_entry *); void (*ifdown)(struct dst_entry *, struct net_device *dev, int how); - struct dst_entry * (*negative_advice)(struct dst_entry *); + void (*negative_advice)(struct sock *sk, struct dst_entry *); void (*link_failure)(struct sk_buff *); void (*update_pmtu)(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb, u32 mtu, diff --git a/include/net/sock.h b/include/net/sock.h index 77298c74822a..9dab48207874 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2212,17 +2212,10 @@ sk_dst_get(struct sock *sk) static inline void __dst_negative_advice(struct sock *sk) { - struct dst_entry *ndst, *dst = __sk_dst_get(sk); + struct dst_entry *dst = __sk_dst_get(sk); - if (dst && dst->ops->negative_advice) { - ndst = dst->ops->negative_advice(dst); - - if (ndst != dst) { - rcu_assign_pointer(sk->sk_dst_cache, ndst); - sk_tx_queue_clear(sk); - WRITE_ONCE(sk->sk_dst_pending_confirm, 0); - } - } + if (dst && dst->ops->negative_advice) + dst->ops->negative_advice(sk, dst); } static inline void dst_negative_advice(struct sock *sk) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 6c0f1e347b85..fcbacd39febe 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -132,7 +132,8 @@ struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie); static unsigned int ipv4_default_advmss(const struct dst_entry *dst); INDIRECT_CALLABLE_SCOPE unsigned int ipv4_mtu(const struct dst_entry *dst); -static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst); +static void ipv4_negative_advice(struct sock *sk, + struct dst_entry *dst); static void ipv4_link_failure(struct sk_buff *skb); static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb, u32 mtu, @@ -837,22 +838,15 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf __ip_do_redirect(rt, skb, &fl4, true); } -static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst) +static void ipv4_negative_advice(struct sock *sk, + struct dst_entry *dst) { struct rtable *rt = (struct rtable *)dst; - struct dst_entry *ret = dst; - if (rt) { - if (dst->obsolete > 0) { - ip_rt_put(rt); - ret = NULL; - } else if ((rt->rt_flags & RTCF_REDIRECTED) || - rt->dst.expires) { - ip_rt_put(rt); - ret = NULL; - } - } - return ret; + if ((dst->obsolete > 0) || + (rt->rt_flags & RTCF_REDIRECTED) || + rt->dst.expires) + sk_dst_reset(sk); } /* diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 887599d351b8..2611f7897413 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -87,7 +87,8 @@ struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie); static unsigned int ip6_default_advmss(const struct dst_entry *dst); INDIRECT_CALLABLE_SCOPE unsigned int ip6_mtu(const struct dst_entry *dst); -static struct dst_entry *ip6_negative_advice(struct dst_entry *); +static void ip6_negative_advice(struct sock *sk, + struct dst_entry *dst); static void ip6_dst_destroy(struct dst_entry *); static void ip6_dst_ifdown(struct dst_entry *, struct net_device *dev, int how); @@ -2762,24 +2763,24 @@ INDIRECT_CALLABLE_SCOPE struct dst_entry *ip6_dst_check(struct dst_entry *dst, } EXPORT_INDIRECT_CALLABLE(ip6_dst_check); -static struct dst_entry *ip6_negative_advice(struct dst_entry *dst) +static void ip6_negative_advice(struct sock *sk, + struct dst_entry *dst) { struct rt6_info *rt = (struct rt6_info *) dst; - if (rt) { - if (rt->rt6i_flags & RTF_CACHE) { - rcu_read_lock(); - if (rt6_check_expired(rt)) { - rt6_remove_exception_rt(rt); - dst = NULL; - } - rcu_read_unlock(); - } else { - dst_release(dst); - dst = NULL; + if (rt->rt6i_flags & RTF_CACHE) { + rcu_read_lock(); + if (rt6_check_expired(rt)) { + /* counteract the dst_release() in sk_dst_reset() */ + dst_hold(dst); + sk_dst_reset(sk); + + rt6_remove_exception_rt(rt); } + rcu_read_unlock(); + return; } - return dst; + sk_dst_reset(sk); } static void ip6_link_failure(struct sk_buff *skb) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index e47c670c7e2c..5fddde2d5bc4 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -3772,15 +3772,10 @@ static void xfrm_link_failure(struct sk_buff *skb) /* Impossible. Such dst must be popped before reaches point of failure. */ } -static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst) +static void xfrm_negative_advice(struct sock *sk, struct dst_entry *dst) { - if (dst) { - if (dst->obsolete) { - dst_release(dst); - dst = NULL; - } - } - return dst; + if (dst->obsolete) + sk_dst_reset(sk); } static void xfrm_init_pmtu(struct xfrm_dst **bundle, int nr) -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

1
5
0 0

FAILED: patch "[PATCH] rtla/timerlat: Fix histogram report when a cpu count is 0" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 01b05fc0e5f3aec443a9a8ffa0022cbca2fd3608 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061354-playtime-clumsy-d741@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 01b05fc0e5f3 ("rtla/timerlat: Fix histogram report when a cpu count is 0") ed774f7481fa ("rtla/timerlat_hist: Add timerlat user-space support") 2091336b9a8b ("rtla/timerlat_hist: Add auto-analysis support") 272ced2556e6 ("rtla: Add --house-keeping option") a957cbc02531 ("rtla: Add -C cgroup support") 9fa48a2477de ("rtla/timerlat: Add auto-analysis only option") 1f428356c38d ("rtla: Add hwnoise tool") ce6cc6f70cad ("Documentation/rtla: Add timerlat-top auto-analysis options") 5def33df84d2 ("rtla/timerlat: Add auto-analysis support to timerlat top") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 01b05fc0e5f3aec443a9a8ffa0022cbca2fd3608 Mon Sep 17 00:00:00 2001 From: John Kacur <jkacur(a)redhat.com> Date: Fri, 10 May 2024 15:03:18 -0400 Subject: [PATCH] rtla/timerlat: Fix histogram report when a cpu count is 0 On short runs it is possible to get no samples on a cpu, like this: # rtla timerlat hist -u -T50 Index IRQ-001 Thr-001 Usr-001 IRQ-002 Thr-002 Usr-002 2 1 0 0 0 0 0 33 0 1 0 0 0 0 36 0 0 1 0 0 0 49 0 0 0 1 0 0 52 0 0 0 0 1 0 over: 0 0 0 0 0 0 count: 1 1 1 1 1 0 min: 2 33 36 49 52 18446744073709551615 avg: 2 33 36 49 52 - max: 2 33 36 49 52 0 rtla timerlat hit stop tracing IRQ handler delay: (exit from idle) 48.21 us (91.09 %) IRQ latency: 49.11 us Timerlat IRQ duration: 2.17 us (4.09 %) Blocking thread: 1.01 us (1.90 %) swapper/2:0 1.01 us ------------------------------------------------------------------------ Thread latency: 52.93 us (100%) Max timerlat IRQ latency from idle: 49.11 us in cpu 2 Note, the value 18446744073709551615 is the same as ~0. Fix this by reporting no results for the min, avg and max if the count is 0. Link: https://lkml.kernel.org/r/20240510190318.44295-1-jkacur@redhat.com Cc: stable(a)vger.kernel.org Fixes: 1eeb6328e8b3 ("rtla/timerlat: Add timerlat hist mode") Suggested-by: Daniel Bristot de Oliveria <bristot(a)kernel.org> Signed-off-by: John Kacur <jkacur(a)redhat.com> Signed-off-by: Daniel Bristot de Oliveira <bristot(a)kernel.org> diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c index d4bab86ca1b9..fbe2c6549bf9 100644 --- a/tools/tracing/rtla/src/timerlat_hist.c +++ b/tools/tracing/rtla/src/timerlat_hist.c @@ -327,17 +327,29 @@ timerlat_print_summary(struct timerlat_hist_params *params, if (!data->hist[cpu].irq_count && !data->hist[cpu].thread_count) continue; - if (!params->no_irq) - trace_seq_printf(trace->seq, "%9llu ", - data->hist[cpu].min_irq); + if (!params->no_irq) { + if (data->hist[cpu].irq_count) + trace_seq_printf(trace->seq, "%9llu ", + data->hist[cpu].min_irq); + else + trace_seq_printf(trace->seq, " - "); + } - if (!params->no_thread) - trace_seq_printf(trace->seq, "%9llu ", - data->hist[cpu].min_thread); + if (!params->no_thread) { + if (data->hist[cpu].thread_count) + trace_seq_printf(trace->seq, "%9llu ", + data->hist[cpu].min_thread); + else + trace_seq_printf(trace->seq, " - "); + } - if (params->user_hist) - trace_seq_printf(trace->seq, "%9llu ", - data->hist[cpu].min_user); + if (params->user_hist) { + if (data->hist[cpu].user_count) + trace_seq_printf(trace->seq, "%9llu ", + data->hist[cpu].min_user); + else + trace_seq_printf(trace->seq, " - "); + } } trace_seq_printf(trace->seq, "\n"); @@ -387,17 +399,29 @@ timerlat_print_summary(struct timerlat_hist_params *params, if (!data->hist[cpu].irq_count && !data->hist[cpu].thread_count) continue; - if (!params->no_irq) - trace_seq_printf(trace->seq, "%9llu ", - data->hist[cpu].max_irq); + if (!params->no_irq) { + if (data->hist[cpu].irq_count) + trace_seq_printf(trace->seq, "%9llu ", + data->hist[cpu].max_irq); + else + trace_seq_printf(trace->seq, " - "); + } - if (!params->no_thread) - trace_seq_printf(trace->seq, "%9llu ", - data->hist[cpu].max_thread); + if (!params->no_thread) { + if (data->hist[cpu].thread_count) + trace_seq_printf(trace->seq, "%9llu ", + data->hist[cpu].max_thread); + else + trace_seq_printf(trace->seq, " - "); + } - if (params->user_hist) - trace_seq_printf(trace->seq, "%9llu ", - data->hist[cpu].max_user); + if (params->user_hist) { + if (data->hist[cpu].user_count) + trace_seq_printf(trace->seq, "%9llu ", + data->hist[cpu].max_user); + else + trace_seq_printf(trace->seq, " - "); + } } trace_seq_printf(trace->seq, "\n"); trace_seq_do_printf(trace->seq);

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] i2c: acpi: Unbind mux adapters before delete" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 3f858bbf04dbac934ac279aaee05d49eb9910051 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061326-catalyst-ridden-9b12@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: 3f858bbf04db ("i2c: acpi: Unbind mux adapters before delete") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3f858bbf04dbac934ac279aaee05d49eb9910051 Mon Sep 17 00:00:00 2001 From: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Date: Wed, 13 Mar 2024 11:16:32 +1300 Subject: [PATCH] i2c: acpi: Unbind mux adapters before delete There is an issue with ACPI overlay table removal specifically related to I2C multiplexers. Consider an ACPI SSDT Overlay that defines a PCA9548 I2C mux on an existing I2C bus. When this table is loaded we see the creation of a device for the overall PCA9548 chip and 8 further devices - one i2c_adapter each for the mux channels. These are all bound to their ACPI equivalents via an eventual invocation of acpi_bind_one(). When we unload the SSDT overlay we run into the problem. The ACPI devices are deleted as normal via acpi_device_del_work_fn() and the acpi_device_del_list. However, the following warning and stack trace is output as the deletion does not go smoothly: ------------[ cut here ]------------ kernfs: can not remove 'physical_node', no directory WARNING: CPU: 1 PID: 11 at fs/kernfs/dir.c:1674 kernfs_remove_by_name_ns+0xb9/0xc0 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u128:0 Not tainted 6.8.0-rc6+ #1 Hardware name: congatec AG conga-B7E3/conga-B7E3, BIOS 5.13 05/16/2023 Workqueue: kacpi_hotplug acpi_device_del_work_fn RIP: 0010:kernfs_remove_by_name_ns+0xb9/0xc0 Code: e4 00 48 89 ef e8 07 71 db ff 5b b8 fe ff ff ff 5d 41 5c 41 5d e9 a7 55 e4 00 0f 0b eb a6 48 c7 c7 f0 38 0d 9d e8 97 0a d5 ff <0f> 0b eb dc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffff9f864008fb28 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ef90a8d4940 RCX: 0000000000000000 RDX: ffff8f000e267d10 RSI: ffff8f000e25c780 RDI: ffff8f000e25c780 RBP: ffff8ef9186f9870 R08: 0000000000013ffb R09: 00000000ffffbfff R10: 00000000ffffbfff R11: ffff8f000e0a0000 R12: ffff9f864008fb50 R13: ffff8ef90c93dd60 R14: ffff8ef9010d0958 R15: ffff8ef9186f98c8 FS: 0000000000000000(0000) GS:ffff8f000e240000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f48f5253a08 CR3: 00000003cb82e000 CR4: 00000000003506f0 Call Trace: <TASK> ? kernfs_remove_by_name_ns+0xb9/0xc0 ? __warn+0x7c/0x130 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? report_bug+0x171/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? kernfs_remove_by_name_ns+0xb9/0xc0 acpi_unbind_one+0x108/0x180 device_del+0x18b/0x490 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_del_adapter.part.0+0x1bf/0x250 i2c_mux_del_adapters+0xa1/0xe0 i2c_device_remove+0x1e/0x80 device_release_driver_internal+0x19a/0x200 bus_remove_device+0xbf/0x100 device_del+0x157/0x490 ? __pfx_device_match_fwnode+0x10/0x10 ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_acpi_notify+0x10f/0x140 notifier_call_chain+0x58/0xd0 blocking_notifier_call_chain+0x3a/0x60 acpi_device_del_work_fn+0x85/0x1d0 process_one_work+0x134/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> ---[ end trace 0000000000000000 ]--- ... repeated 7 more times, 1 for each channel of the mux ... The issue is that the binding of the ACPI devices to their peer I2C adapters is not correctly cleaned up. Digging deeper into the issue we see that the deletion order is such that the ACPI devices matching the mux channel i2c adapters are deleted first during the SSDT overlay removal. For each of the channels we see a call to i2c_acpi_notify() with ACPI_RECONFIG_DEVICE_REMOVE but, because these devices are not actually i2c_clients, nothing is done for them. Later on, after each of the mux channels has been dealt with, we come to delete the i2c_client representing the PCA9548 device. This is the call stack we see above, whereby the kernel cleans up the i2c_client including destruction of the mux and its channel adapters. At this point we do attempt to unbind from the ACPI peers but those peers no longer exist and so we hit the kernfs errors. The fix is to augment i2c_acpi_notify() to handle i2c_adapters. But, given that the life cycle of the adapters is linked to the i2c_client, instead of deleting the i2c_adapters during the i2c_acpi_notify(), we just trigger unbinding of the ACPI device from the adapter device, and allow the clean up of the adapter to continue in the way it always has. Signed-off-by: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)kernel.org> Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Cc: <stable(a)vger.kernel.org> # v4.8+ Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c index d6037a328669..14ae0cfc325e 100644 --- a/drivers/i2c/i2c-core-acpi.c +++ b/drivers/i2c/i2c-core-acpi.c @@ -445,6 +445,11 @@ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) return i2c_find_device_by_fwnode(acpi_fwnode_handle(adev)); } +static struct i2c_adapter *i2c_acpi_find_adapter_by_adev(struct acpi_device *adev) +{ + return i2c_find_adapter_by_fwnode(acpi_fwnode_handle(adev)); +} + static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, void *arg) { @@ -471,11 +476,17 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, break; client = i2c_acpi_find_client_by_adev(adev); - if (!client) - break; + if (client) { + i2c_unregister_device(client); + put_device(&client->dev); + } + + adapter = i2c_acpi_find_adapter_by_adev(adev); + if (adapter) { + acpi_unbind_one(&adapter->dev); + put_device(&adapter->dev); + } - i2c_unregister_device(client); - put_device(&client->dev); break; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] i2c: acpi: Unbind mux adapters before delete" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 3f858bbf04dbac934ac279aaee05d49eb9910051 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061323-augmented-much-5265@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: 3f858bbf04db ("i2c: acpi: Unbind mux adapters before delete") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3f858bbf04dbac934ac279aaee05d49eb9910051 Mon Sep 17 00:00:00 2001 From: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Date: Wed, 13 Mar 2024 11:16:32 +1300 Subject: [PATCH] i2c: acpi: Unbind mux adapters before delete There is an issue with ACPI overlay table removal specifically related to I2C multiplexers. Consider an ACPI SSDT Overlay that defines a PCA9548 I2C mux on an existing I2C bus. When this table is loaded we see the creation of a device for the overall PCA9548 chip and 8 further devices - one i2c_adapter each for the mux channels. These are all bound to their ACPI equivalents via an eventual invocation of acpi_bind_one(). When we unload the SSDT overlay we run into the problem. The ACPI devices are deleted as normal via acpi_device_del_work_fn() and the acpi_device_del_list. However, the following warning and stack trace is output as the deletion does not go smoothly: ------------[ cut here ]------------ kernfs: can not remove 'physical_node', no directory WARNING: CPU: 1 PID: 11 at fs/kernfs/dir.c:1674 kernfs_remove_by_name_ns+0xb9/0xc0 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u128:0 Not tainted 6.8.0-rc6+ #1 Hardware name: congatec AG conga-B7E3/conga-B7E3, BIOS 5.13 05/16/2023 Workqueue: kacpi_hotplug acpi_device_del_work_fn RIP: 0010:kernfs_remove_by_name_ns+0xb9/0xc0 Code: e4 00 48 89 ef e8 07 71 db ff 5b b8 fe ff ff ff 5d 41 5c 41 5d e9 a7 55 e4 00 0f 0b eb a6 48 c7 c7 f0 38 0d 9d e8 97 0a d5 ff <0f> 0b eb dc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffff9f864008fb28 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ef90a8d4940 RCX: 0000000000000000 RDX: ffff8f000e267d10 RSI: ffff8f000e25c780 RDI: ffff8f000e25c780 RBP: ffff8ef9186f9870 R08: 0000000000013ffb R09: 00000000ffffbfff R10: 00000000ffffbfff R11: ffff8f000e0a0000 R12: ffff9f864008fb50 R13: ffff8ef90c93dd60 R14: ffff8ef9010d0958 R15: ffff8ef9186f98c8 FS: 0000000000000000(0000) GS:ffff8f000e240000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f48f5253a08 CR3: 00000003cb82e000 CR4: 00000000003506f0 Call Trace: <TASK> ? kernfs_remove_by_name_ns+0xb9/0xc0 ? __warn+0x7c/0x130 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? report_bug+0x171/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? kernfs_remove_by_name_ns+0xb9/0xc0 acpi_unbind_one+0x108/0x180 device_del+0x18b/0x490 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_del_adapter.part.0+0x1bf/0x250 i2c_mux_del_adapters+0xa1/0xe0 i2c_device_remove+0x1e/0x80 device_release_driver_internal+0x19a/0x200 bus_remove_device+0xbf/0x100 device_del+0x157/0x490 ? __pfx_device_match_fwnode+0x10/0x10 ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_acpi_notify+0x10f/0x140 notifier_call_chain+0x58/0xd0 blocking_notifier_call_chain+0x3a/0x60 acpi_device_del_work_fn+0x85/0x1d0 process_one_work+0x134/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> ---[ end trace 0000000000000000 ]--- ... repeated 7 more times, 1 for each channel of the mux ... The issue is that the binding of the ACPI devices to their peer I2C adapters is not correctly cleaned up. Digging deeper into the issue we see that the deletion order is such that the ACPI devices matching the mux channel i2c adapters are deleted first during the SSDT overlay removal. For each of the channels we see a call to i2c_acpi_notify() with ACPI_RECONFIG_DEVICE_REMOVE but, because these devices are not actually i2c_clients, nothing is done for them. Later on, after each of the mux channels has been dealt with, we come to delete the i2c_client representing the PCA9548 device. This is the call stack we see above, whereby the kernel cleans up the i2c_client including destruction of the mux and its channel adapters. At this point we do attempt to unbind from the ACPI peers but those peers no longer exist and so we hit the kernfs errors. The fix is to augment i2c_acpi_notify() to handle i2c_adapters. But, given that the life cycle of the adapters is linked to the i2c_client, instead of deleting the i2c_adapters during the i2c_acpi_notify(), we just trigger unbinding of the ACPI device from the adapter device, and allow the clean up of the adapter to continue in the way it always has. Signed-off-by: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)kernel.org> Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Cc: <stable(a)vger.kernel.org> # v4.8+ Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c index d6037a328669..14ae0cfc325e 100644 --- a/drivers/i2c/i2c-core-acpi.c +++ b/drivers/i2c/i2c-core-acpi.c @@ -445,6 +445,11 @@ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) return i2c_find_device_by_fwnode(acpi_fwnode_handle(adev)); } +static struct i2c_adapter *i2c_acpi_find_adapter_by_adev(struct acpi_device *adev) +{ + return i2c_find_adapter_by_fwnode(acpi_fwnode_handle(adev)); +} + static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, void *arg) { @@ -471,11 +476,17 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, break; client = i2c_acpi_find_client_by_adev(adev); - if (!client) - break; + if (client) { + i2c_unregister_device(client); + put_device(&client->dev); + } + + adapter = i2c_acpi_find_adapter_by_adev(adev); + if (adapter) { + acpi_unbind_one(&adapter->dev); + put_device(&adapter->dev); + } - i2c_unregister_device(client); - put_device(&client->dev); break; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] i2c: acpi: Unbind mux adapters before delete" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 3f858bbf04dbac934ac279aaee05d49eb9910051 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061321-unfeeling-stinging-0b73@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 3f858bbf04db ("i2c: acpi: Unbind mux adapters before delete") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3f858bbf04dbac934ac279aaee05d49eb9910051 Mon Sep 17 00:00:00 2001 From: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Date: Wed, 13 Mar 2024 11:16:32 +1300 Subject: [PATCH] i2c: acpi: Unbind mux adapters before delete There is an issue with ACPI overlay table removal specifically related to I2C multiplexers. Consider an ACPI SSDT Overlay that defines a PCA9548 I2C mux on an existing I2C bus. When this table is loaded we see the creation of a device for the overall PCA9548 chip and 8 further devices - one i2c_adapter each for the mux channels. These are all bound to their ACPI equivalents via an eventual invocation of acpi_bind_one(). When we unload the SSDT overlay we run into the problem. The ACPI devices are deleted as normal via acpi_device_del_work_fn() and the acpi_device_del_list. However, the following warning and stack trace is output as the deletion does not go smoothly: ------------[ cut here ]------------ kernfs: can not remove 'physical_node', no directory WARNING: CPU: 1 PID: 11 at fs/kernfs/dir.c:1674 kernfs_remove_by_name_ns+0xb9/0xc0 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u128:0 Not tainted 6.8.0-rc6+ #1 Hardware name: congatec AG conga-B7E3/conga-B7E3, BIOS 5.13 05/16/2023 Workqueue: kacpi_hotplug acpi_device_del_work_fn RIP: 0010:kernfs_remove_by_name_ns+0xb9/0xc0 Code: e4 00 48 89 ef e8 07 71 db ff 5b b8 fe ff ff ff 5d 41 5c 41 5d e9 a7 55 e4 00 0f 0b eb a6 48 c7 c7 f0 38 0d 9d e8 97 0a d5 ff <0f> 0b eb dc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffff9f864008fb28 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ef90a8d4940 RCX: 0000000000000000 RDX: ffff8f000e267d10 RSI: ffff8f000e25c780 RDI: ffff8f000e25c780 RBP: ffff8ef9186f9870 R08: 0000000000013ffb R09: 00000000ffffbfff R10: 00000000ffffbfff R11: ffff8f000e0a0000 R12: ffff9f864008fb50 R13: ffff8ef90c93dd60 R14: ffff8ef9010d0958 R15: ffff8ef9186f98c8 FS: 0000000000000000(0000) GS:ffff8f000e240000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f48f5253a08 CR3: 00000003cb82e000 CR4: 00000000003506f0 Call Trace: <TASK> ? kernfs_remove_by_name_ns+0xb9/0xc0 ? __warn+0x7c/0x130 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? report_bug+0x171/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? kernfs_remove_by_name_ns+0xb9/0xc0 acpi_unbind_one+0x108/0x180 device_del+0x18b/0x490 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_del_adapter.part.0+0x1bf/0x250 i2c_mux_del_adapters+0xa1/0xe0 i2c_device_remove+0x1e/0x80 device_release_driver_internal+0x19a/0x200 bus_remove_device+0xbf/0x100 device_del+0x157/0x490 ? __pfx_device_match_fwnode+0x10/0x10 ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_acpi_notify+0x10f/0x140 notifier_call_chain+0x58/0xd0 blocking_notifier_call_chain+0x3a/0x60 acpi_device_del_work_fn+0x85/0x1d0 process_one_work+0x134/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> ---[ end trace 0000000000000000 ]--- ... repeated 7 more times, 1 for each channel of the mux ... The issue is that the binding of the ACPI devices to their peer I2C adapters is not correctly cleaned up. Digging deeper into the issue we see that the deletion order is such that the ACPI devices matching the mux channel i2c adapters are deleted first during the SSDT overlay removal. For each of the channels we see a call to i2c_acpi_notify() with ACPI_RECONFIG_DEVICE_REMOVE but, because these devices are not actually i2c_clients, nothing is done for them. Later on, after each of the mux channels has been dealt with, we come to delete the i2c_client representing the PCA9548 device. This is the call stack we see above, whereby the kernel cleans up the i2c_client including destruction of the mux and its channel adapters. At this point we do attempt to unbind from the ACPI peers but those peers no longer exist and so we hit the kernfs errors. The fix is to augment i2c_acpi_notify() to handle i2c_adapters. But, given that the life cycle of the adapters is linked to the i2c_client, instead of deleting the i2c_adapters during the i2c_acpi_notify(), we just trigger unbinding of the ACPI device from the adapter device, and allow the clean up of the adapter to continue in the way it always has. Signed-off-by: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)kernel.org> Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Cc: <stable(a)vger.kernel.org> # v4.8+ Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c index d6037a328669..14ae0cfc325e 100644 --- a/drivers/i2c/i2c-core-acpi.c +++ b/drivers/i2c/i2c-core-acpi.c @@ -445,6 +445,11 @@ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) return i2c_find_device_by_fwnode(acpi_fwnode_handle(adev)); } +static struct i2c_adapter *i2c_acpi_find_adapter_by_adev(struct acpi_device *adev) +{ + return i2c_find_adapter_by_fwnode(acpi_fwnode_handle(adev)); +} + static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, void *arg) { @@ -471,11 +476,17 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, break; client = i2c_acpi_find_client_by_adev(adev); - if (!client) - break; + if (client) { + i2c_unregister_device(client); + put_device(&client->dev); + } + + adapter = i2c_acpi_find_adapter_by_adev(adev); + if (adapter) { + acpi_unbind_one(&adapter->dev); + put_device(&adapter->dev); + } - i2c_unregister_device(client); - put_device(&client->dev); break; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] i2c: acpi: Unbind mux adapters before delete" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 3f858bbf04dbac934ac279aaee05d49eb9910051 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061319-epic-chunk-b98b@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 3f858bbf04db ("i2c: acpi: Unbind mux adapters before delete") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3f858bbf04dbac934ac279aaee05d49eb9910051 Mon Sep 17 00:00:00 2001 From: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Date: Wed, 13 Mar 2024 11:16:32 +1300 Subject: [PATCH] i2c: acpi: Unbind mux adapters before delete There is an issue with ACPI overlay table removal specifically related to I2C multiplexers. Consider an ACPI SSDT Overlay that defines a PCA9548 I2C mux on an existing I2C bus. When this table is loaded we see the creation of a device for the overall PCA9548 chip and 8 further devices - one i2c_adapter each for the mux channels. These are all bound to their ACPI equivalents via an eventual invocation of acpi_bind_one(). When we unload the SSDT overlay we run into the problem. The ACPI devices are deleted as normal via acpi_device_del_work_fn() and the acpi_device_del_list. However, the following warning and stack trace is output as the deletion does not go smoothly: ------------[ cut here ]------------ kernfs: can not remove 'physical_node', no directory WARNING: CPU: 1 PID: 11 at fs/kernfs/dir.c:1674 kernfs_remove_by_name_ns+0xb9/0xc0 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u128:0 Not tainted 6.8.0-rc6+ #1 Hardware name: congatec AG conga-B7E3/conga-B7E3, BIOS 5.13 05/16/2023 Workqueue: kacpi_hotplug acpi_device_del_work_fn RIP: 0010:kernfs_remove_by_name_ns+0xb9/0xc0 Code: e4 00 48 89 ef e8 07 71 db ff 5b b8 fe ff ff ff 5d 41 5c 41 5d e9 a7 55 e4 00 0f 0b eb a6 48 c7 c7 f0 38 0d 9d e8 97 0a d5 ff <0f> 0b eb dc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffff9f864008fb28 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ef90a8d4940 RCX: 0000000000000000 RDX: ffff8f000e267d10 RSI: ffff8f000e25c780 RDI: ffff8f000e25c780 RBP: ffff8ef9186f9870 R08: 0000000000013ffb R09: 00000000ffffbfff R10: 00000000ffffbfff R11: ffff8f000e0a0000 R12: ffff9f864008fb50 R13: ffff8ef90c93dd60 R14: ffff8ef9010d0958 R15: ffff8ef9186f98c8 FS: 0000000000000000(0000) GS:ffff8f000e240000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f48f5253a08 CR3: 00000003cb82e000 CR4: 00000000003506f0 Call Trace: <TASK> ? kernfs_remove_by_name_ns+0xb9/0xc0 ? __warn+0x7c/0x130 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? report_bug+0x171/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? kernfs_remove_by_name_ns+0xb9/0xc0 acpi_unbind_one+0x108/0x180 device_del+0x18b/0x490 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_del_adapter.part.0+0x1bf/0x250 i2c_mux_del_adapters+0xa1/0xe0 i2c_device_remove+0x1e/0x80 device_release_driver_internal+0x19a/0x200 bus_remove_device+0xbf/0x100 device_del+0x157/0x490 ? __pfx_device_match_fwnode+0x10/0x10 ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_acpi_notify+0x10f/0x140 notifier_call_chain+0x58/0xd0 blocking_notifier_call_chain+0x3a/0x60 acpi_device_del_work_fn+0x85/0x1d0 process_one_work+0x134/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> ---[ end trace 0000000000000000 ]--- ... repeated 7 more times, 1 for each channel of the mux ... The issue is that the binding of the ACPI devices to their peer I2C adapters is not correctly cleaned up. Digging deeper into the issue we see that the deletion order is such that the ACPI devices matching the mux channel i2c adapters are deleted first during the SSDT overlay removal. For each of the channels we see a call to i2c_acpi_notify() with ACPI_RECONFIG_DEVICE_REMOVE but, because these devices are not actually i2c_clients, nothing is done for them. Later on, after each of the mux channels has been dealt with, we come to delete the i2c_client representing the PCA9548 device. This is the call stack we see above, whereby the kernel cleans up the i2c_client including destruction of the mux and its channel adapters. At this point we do attempt to unbind from the ACPI peers but those peers no longer exist and so we hit the kernfs errors. The fix is to augment i2c_acpi_notify() to handle i2c_adapters. But, given that the life cycle of the adapters is linked to the i2c_client, instead of deleting the i2c_adapters during the i2c_acpi_notify(), we just trigger unbinding of the ACPI device from the adapter device, and allow the clean up of the adapter to continue in the way it always has. Signed-off-by: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)kernel.org> Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Cc: <stable(a)vger.kernel.org> # v4.8+ Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c index d6037a328669..14ae0cfc325e 100644 --- a/drivers/i2c/i2c-core-acpi.c +++ b/drivers/i2c/i2c-core-acpi.c @@ -445,6 +445,11 @@ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) return i2c_find_device_by_fwnode(acpi_fwnode_handle(adev)); } +static struct i2c_adapter *i2c_acpi_find_adapter_by_adev(struct acpi_device *adev) +{ + return i2c_find_adapter_by_fwnode(acpi_fwnode_handle(adev)); +} + static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, void *arg) { @@ -471,11 +476,17 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, break; client = i2c_acpi_find_client_by_adev(adev); - if (!client) - break; + if (client) { + i2c_unregister_device(client); + put_device(&client->dev); + } + + adapter = i2c_acpi_find_adapter_by_adev(adev); + if (adapter) { + acpi_unbind_one(&adapter->dev); + put_device(&adapter->dev); + } - i2c_unregister_device(client); - put_device(&client->dev); break; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] i2c: acpi: Unbind mux adapters before delete" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 3f858bbf04dbac934ac279aaee05d49eb9910051 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061317-avid-favoring-8698@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 3f858bbf04db ("i2c: acpi: Unbind mux adapters before delete") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3f858bbf04dbac934ac279aaee05d49eb9910051 Mon Sep 17 00:00:00 2001 From: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Date: Wed, 13 Mar 2024 11:16:32 +1300 Subject: [PATCH] i2c: acpi: Unbind mux adapters before delete There is an issue with ACPI overlay table removal specifically related to I2C multiplexers. Consider an ACPI SSDT Overlay that defines a PCA9548 I2C mux on an existing I2C bus. When this table is loaded we see the creation of a device for the overall PCA9548 chip and 8 further devices - one i2c_adapter each for the mux channels. These are all bound to their ACPI equivalents via an eventual invocation of acpi_bind_one(). When we unload the SSDT overlay we run into the problem. The ACPI devices are deleted as normal via acpi_device_del_work_fn() and the acpi_device_del_list. However, the following warning and stack trace is output as the deletion does not go smoothly: ------------[ cut here ]------------ kernfs: can not remove 'physical_node', no directory WARNING: CPU: 1 PID: 11 at fs/kernfs/dir.c:1674 kernfs_remove_by_name_ns+0xb9/0xc0 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u128:0 Not tainted 6.8.0-rc6+ #1 Hardware name: congatec AG conga-B7E3/conga-B7E3, BIOS 5.13 05/16/2023 Workqueue: kacpi_hotplug acpi_device_del_work_fn RIP: 0010:kernfs_remove_by_name_ns+0xb9/0xc0 Code: e4 00 48 89 ef e8 07 71 db ff 5b b8 fe ff ff ff 5d 41 5c 41 5d e9 a7 55 e4 00 0f 0b eb a6 48 c7 c7 f0 38 0d 9d e8 97 0a d5 ff <0f> 0b eb dc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffff9f864008fb28 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ef90a8d4940 RCX: 0000000000000000 RDX: ffff8f000e267d10 RSI: ffff8f000e25c780 RDI: ffff8f000e25c780 RBP: ffff8ef9186f9870 R08: 0000000000013ffb R09: 00000000ffffbfff R10: 00000000ffffbfff R11: ffff8f000e0a0000 R12: ffff9f864008fb50 R13: ffff8ef90c93dd60 R14: ffff8ef9010d0958 R15: ffff8ef9186f98c8 FS: 0000000000000000(0000) GS:ffff8f000e240000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f48f5253a08 CR3: 00000003cb82e000 CR4: 00000000003506f0 Call Trace: <TASK> ? kernfs_remove_by_name_ns+0xb9/0xc0 ? __warn+0x7c/0x130 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? report_bug+0x171/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? kernfs_remove_by_name_ns+0xb9/0xc0 ? kernfs_remove_by_name_ns+0xb9/0xc0 acpi_unbind_one+0x108/0x180 device_del+0x18b/0x490 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_del_adapter.part.0+0x1bf/0x250 i2c_mux_del_adapters+0xa1/0xe0 i2c_device_remove+0x1e/0x80 device_release_driver_internal+0x19a/0x200 bus_remove_device+0xbf/0x100 device_del+0x157/0x490 ? __pfx_device_match_fwnode+0x10/0x10 ? srso_return_thunk+0x5/0x5f device_unregister+0xd/0x30 i2c_acpi_notify+0x10f/0x140 notifier_call_chain+0x58/0xd0 blocking_notifier_call_chain+0x3a/0x60 acpi_device_del_work_fn+0x85/0x1d0 process_one_work+0x134/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> ---[ end trace 0000000000000000 ]--- ... repeated 7 more times, 1 for each channel of the mux ... The issue is that the binding of the ACPI devices to their peer I2C adapters is not correctly cleaned up. Digging deeper into the issue we see that the deletion order is such that the ACPI devices matching the mux channel i2c adapters are deleted first during the SSDT overlay removal. For each of the channels we see a call to i2c_acpi_notify() with ACPI_RECONFIG_DEVICE_REMOVE but, because these devices are not actually i2c_clients, nothing is done for them. Later on, after each of the mux channels has been dealt with, we come to delete the i2c_client representing the PCA9548 device. This is the call stack we see above, whereby the kernel cleans up the i2c_client including destruction of the mux and its channel adapters. At this point we do attempt to unbind from the ACPI peers but those peers no longer exist and so we hit the kernfs errors. The fix is to augment i2c_acpi_notify() to handle i2c_adapters. But, given that the life cycle of the adapters is linked to the i2c_client, instead of deleting the i2c_adapters during the i2c_acpi_notify(), we just trigger unbinding of the ACPI device from the adapter device, and allow the clean up of the adapter to continue in the way it always has. Signed-off-by: Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)kernel.org> Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Cc: <stable(a)vger.kernel.org> # v4.8+ Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c index d6037a328669..14ae0cfc325e 100644 --- a/drivers/i2c/i2c-core-acpi.c +++ b/drivers/i2c/i2c-core-acpi.c @@ -445,6 +445,11 @@ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) return i2c_find_device_by_fwnode(acpi_fwnode_handle(adev)); } +static struct i2c_adapter *i2c_acpi_find_adapter_by_adev(struct acpi_device *adev) +{ + return i2c_find_adapter_by_fwnode(acpi_fwnode_handle(adev)); +} + static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, void *arg) { @@ -471,11 +476,17 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, break; client = i2c_acpi_find_client_by_adev(adev); - if (!client) - break; + if (client) { + i2c_unregister_device(client); + put_device(&client->dev); + } + + adapter = i2c_acpi_find_adapter_by_adev(adev); + if (adapter) { + acpi_unbind_one(&adapter->dev); + put_device(&adapter->dev); + } - i2c_unregister_device(client); - put_device(&client->dev); break; }

1 year, 2 months

1
0
0 0

[PATCH] firmware: qcom_scm: Mark get_wq_ctx() as atomic call

by Unnathi Chalicheemala via B4 Relay

From: Murali Nalajala <quic_mnalajal(a)quicinc.com> Currently get_wq_ctx() is wrongly configured as a standard call. Here get_wq_ctx() must be an atomic call and can't be a standard SMC call because get_wq_ctx() should not sleep again. This situation lead to a deadlock. Hence mark get_wq_ctx() as atomic call. Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic") Cc: stable(a)vger.kernel.org Signed-off-by: Murali Nalajala <quic_mnalajal(a)quicinc.com> Signed-off-by: Unnathi Chalicheemala <quic_uchalich(a)quicinc.com> --- drivers/firmware/qcom/qcom_scm-smc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/qcom/qcom_scm-smc.c b/drivers/firmware/qcom/qcom_scm-smc.c index 16cf88acfa8e..0a2a2c794d0e 100644 --- a/drivers/firmware/qcom/qcom_scm-smc.c +++ b/drivers/firmware/qcom/qcom_scm-smc.c @@ -71,7 +71,7 @@ int scm_get_wq_ctx(u32 *wq_ctx, u32 *flags, u32 *more_pending) struct arm_smccc_res get_wq_res; struct arm_smccc_args get_wq_ctx = {0}; - get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL, + get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_64, ARM_SMCCC_OWNER_SIP, SCM_SMC_FNID(QCOM_SCM_SVC_WAITQ, QCOM_SCM_WAITQ_GET_WQ_CTX)); --- base-commit: 83a7eefedc9b56fe7bfeff13b6c7356688ffa670 change-id: 20240611-get_wq_ctx_atomic-f5e9fdcb20c7 Best regards, -- Unnathi Chalicheemala <quic_uchalich(a)quicinc.com>

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] HID: i2c-hid: elan: fix reset suspend current leakage" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 0eafc58f2194dbd01d4be40f99a697681171995b # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061323-deuce-expose-15f0@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 0eafc58f2194 ("HID: i2c-hid: elan: fix reset suspend current leakage") f2f43bf15d7a ("HID: i2c-hid: elan: Add ili9882t timing") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0eafc58f2194dbd01d4be40f99a697681171995b Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan+linaro(a)kernel.org> Date: Tue, 7 May 2024 16:48:18 +0200 Subject: [PATCH] HID: i2c-hid: elan: fix reset suspend current leakage The Elan eKTH5015M touch controller found on the Lenovo ThinkPad X13s shares the VCC33 supply with other peripherals that may remain powered during suspend (e.g. when enabled as wakeup sources). The reset line is also wired so that it can be left deasserted when the supply is off. This is important as it avoids holding the controller in reset for extended periods of time when it remains powered, which can lead to increased power consumption, and also avoids leaking current through the X13s reset circuitry during suspend (and after driver unbind). Use the new 'no-reset-on-power-off' devicetree property to determine when reset needs to be asserted on power down. Notably this also avoids wasting power on machine variants without a touchscreen for which the driver would otherwise exit probe with reset asserted. Fixes: bd3cba00dcc6 ("HID: i2c-hid: elan: Add support for Elan eKTH6915 i2c-hid touchscreens") Cc: <stable(a)vger.kernel.org> # 6.0 Cc: Douglas Anderson <dianders(a)chromium.org> Tested-by: Steev Klimaszewski <steev(a)kali.org> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Link: https://lore.kernel.org/r/20240507144821.12275-5-johan+linaro@kernel.org Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c index 5b91fb106cfc..091e37933225 100644 --- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c +++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c @@ -31,6 +31,7 @@ struct i2c_hid_of_elan { struct regulator *vcc33; struct regulator *vccio; struct gpio_desc *reset_gpio; + bool no_reset_on_power_off; const struct elan_i2c_hid_chip_data *chip_data; }; @@ -40,17 +41,17 @@ static int elan_i2c_hid_power_up(struct i2chid_ops *ops) container_of(ops, struct i2c_hid_of_elan, ops); int ret; + gpiod_set_value_cansleep(ihid_elan->reset_gpio, 1); + if (ihid_elan->vcc33) { ret = regulator_enable(ihid_elan->vcc33); if (ret) - return ret; + goto err_deassert_reset; } ret = regulator_enable(ihid_elan->vccio); - if (ret) { - regulator_disable(ihid_elan->vcc33); - return ret; - } + if (ret) + goto err_disable_vcc33; if (ihid_elan->chip_data->post_power_delay_ms) msleep(ihid_elan->chip_data->post_power_delay_ms); @@ -60,6 +61,15 @@ static int elan_i2c_hid_power_up(struct i2chid_ops *ops) msleep(ihid_elan->chip_data->post_gpio_reset_on_delay_ms); return 0; + +err_disable_vcc33: + if (ihid_elan->vcc33) + regulator_disable(ihid_elan->vcc33); +err_deassert_reset: + if (ihid_elan->no_reset_on_power_off) + gpiod_set_value_cansleep(ihid_elan->reset_gpio, 0); + + return ret; } static void elan_i2c_hid_power_down(struct i2chid_ops *ops) @@ -67,7 +77,14 @@ static void elan_i2c_hid_power_down(struct i2chid_ops *ops) struct i2c_hid_of_elan *ihid_elan = container_of(ops, struct i2c_hid_of_elan, ops); - gpiod_set_value_cansleep(ihid_elan->reset_gpio, 1); + /* + * Do not assert reset when the hardware allows for it to remain + * deasserted regardless of the state of the (shared) power supply to + * avoid wasting power when the supply is left on. + */ + if (!ihid_elan->no_reset_on_power_off) + gpiod_set_value_cansleep(ihid_elan->reset_gpio, 1); + if (ihid_elan->chip_data->post_gpio_reset_off_delay_ms) msleep(ihid_elan->chip_data->post_gpio_reset_off_delay_ms); @@ -79,6 +96,7 @@ static void elan_i2c_hid_power_down(struct i2chid_ops *ops) static int i2c_hid_of_elan_probe(struct i2c_client *client) { struct i2c_hid_of_elan *ihid_elan; + int ret; ihid_elan = devm_kzalloc(&client->dev, sizeof(*ihid_elan), GFP_KERNEL); if (!ihid_elan) @@ -93,21 +111,38 @@ static int i2c_hid_of_elan_probe(struct i2c_client *client) if (IS_ERR(ihid_elan->reset_gpio)) return PTR_ERR(ihid_elan->reset_gpio); + ihid_elan->no_reset_on_power_off = of_property_read_bool(client->dev.of_node, + "no-reset-on-power-off"); + ihid_elan->vccio = devm_regulator_get(&client->dev, "vccio"); - if (IS_ERR(ihid_elan->vccio)) - return PTR_ERR(ihid_elan->vccio); + if (IS_ERR(ihid_elan->vccio)) { + ret = PTR_ERR(ihid_elan->vccio); + goto err_deassert_reset; + } ihid_elan->chip_data = device_get_match_data(&client->dev); if (ihid_elan->chip_data->main_supply_name) { ihid_elan->vcc33 = devm_regulator_get(&client->dev, ihid_elan->chip_data->main_supply_name); - if (IS_ERR(ihid_elan->vcc33)) - return PTR_ERR(ihid_elan->vcc33); + if (IS_ERR(ihid_elan->vcc33)) { + ret = PTR_ERR(ihid_elan->vcc33); + goto err_deassert_reset; + } } - return i2c_hid_core_probe(client, &ihid_elan->ops, - ihid_elan->chip_data->hid_descriptor_address, 0); + ret = i2c_hid_core_probe(client, &ihid_elan->ops, + ihid_elan->chip_data->hid_descriptor_address, 0); + if (ret) + goto err_deassert_reset; + + return 0; + +err_deassert_reset: + if (ihid_elan->no_reset_on_power_off) + gpiod_set_value_cansleep(ihid_elan->reset_gpio, 0); + + return ret; } static const struct elan_i2c_hid_chip_data elan_ekth6915_chip_data = {

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] 9p: add missing locking around taking dentry fid list" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x c898afdc15645efb555acb6d85b484eb40a45409 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061357-product-rigid-0f3e@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: c898afdc1564 ("9p: add missing locking around taking dentry fid list") b48dbb998d70 ("9p fid refcount: add p9_fid_get/put wrappers") 47b1e3432b06 ("9p: Remove unnecessary variable for old fids while walking from d_parent") cba83f47fc0e ("9p: Track the root fid with its own variable during lookups") b0017602fdf6 ("9p: fix EBADF errors in cached mode") 2a3dcbccd64b ("9p: Fix refcounting during full path walks for fid lookups") beca774fc51a ("9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl") 6e195b0f7c8e ("9p: fix a bunch of checkpatch warnings") eb497943fa21 ("9p: Convert to using the netfs helper lib to do reads and caching") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From c898afdc15645efb555acb6d85b484eb40a45409 Mon Sep 17 00:00:00 2001 From: Dominique Martinet <asmadeus(a)codewreck.org> Date: Tue, 21 May 2024 21:13:36 +0900 Subject: [PATCH] 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248 Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335 The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible. Fixes: 154372e67d40 ("fs/9p: fix create-unlink-getattr idiom") Cc: stable(a)vger.kernel.org Reported-by: Meysam Firouzi Reported-by: Amirmohammad Eftekhar Reviewed-by: Christian Schoenebeck <linux_oss(a)crudebyte.com> Message-ID: <20240521122947.1080227-1-asmadeus(a)codewreck.org> Signed-off-by: Dominique Martinet <asmadeus(a)codewreck.org> diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c index f16f73581634..01338d4c2d9e 100644 --- a/fs/9p/vfs_dentry.c +++ b/fs/9p/vfs_dentry.c @@ -48,12 +48,17 @@ static int v9fs_cached_dentry_delete(const struct dentry *dentry) static void v9fs_dentry_release(struct dentry *dentry) { struct hlist_node *p, *n; + struct hlist_head head; p9_debug(P9_DEBUG_VFS, " dentry: %pd (%p)\n", dentry, dentry); - hlist_for_each_safe(p, n, (struct hlist_head *)&dentry->d_fsdata) + + spin_lock(&dentry->d_lock); + hlist_move_list((struct hlist_head *)&dentry->d_fsdata, &head); + spin_unlock(&dentry->d_lock); + + hlist_for_each_safe(p, n, &head) p9_fid_put(hlist_entry(p, struct p9_fid, dlist)); - dentry->d_fsdata = NULL; } static int v9fs_lookup_revalidate(struct dentry *dentry, unsigned int flags)

1 year, 2 months

1
0
0 0

[PATCH -stable,4.19.x 00/40] Netfilter fixes for -stable

by Pablo Neira Ayuso

Hi Greg, Sasha, This round includes pending -stable backport fixes for 4.19. This large batch includes dependency patches and fixes which are already present in -stable kernels >= 5.4.x but not in 4.19.x. The following list shows the backported patches, I am using original commit IDs for reference: 1) 0c2a85edd143 ("netfilter: nf_tables: pass context to nft_set_destroy()") 2) f8bb7889af58 ("netfilter: nftables: rename set element data activation/deactivation functions") 3) 628bd3e49cba ("netfilter: nf_tables: drop map element references from preparation phase") 4) 3b18d5eba491 ("netfilter: nft_set_rbtree: allow loose matching of closing element in interval") 5) 340eaff65116 ("netfilter: nft_set_rbtree: Add missing expired checks") 6) c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection") 7) 61ae320a29b0 ("netfilter: nft_set_rbtree: fix null deref on element insertion") 8) f718863aca46 ("netfilter: nft_set_rbtree: fix overlap expiration walk") 9) 24138933b97b ("netfilter: nf_tables: don't skip expired elements during walk") 10) 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") 11) f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API") 12) a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API") 13) 6a33d8b73dfa ("netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path") 14) 02c6c24402bf ("netfilter: nf_tables: GC transaction race with netns dismantle") 15) 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path") 16) 8e51830e29e1 ("netfilter: nf_tables: defer gc run if previous batch is still pending") 17) 2ee52ae94baa ("netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction") 18) 96b33300fba8 ("netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention") 19) b079155faae9 ("netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration") 20) cf5000a7787c ("netfilter: nf_tables: fix memleak when more than 255 elements expired") 21) 6069da443bf6 ("netfilter: nf_tables: unregister flowtable hooks on netns exit") 22) f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") 23) 0ce7cf4127f1 ("netfilter: nftables: update table flags from the commit phase") 24) 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") 25) c9bd26513b3a ("netfilter: nf_tables: disable toggling dormant table state more than once") 26) ("netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 4.19)") NB: This patch does not exist in any upstream tree, but there is a similar patch already in 5.4 27) 917d80d376ff ("netfilter: nft_dynset: fix timeouts later than 23 days") 28) fd94d9dadee5 ("netfilter: nftables: exthdr: fix 4-byte stack OOB write") 29) 95cd4bca7b1f ("netfilter: nft_dynset: report EOPNOTSUPP on missing set feature") 30) 7b1394892de8 ("netfilter: nft_dynset: relax superfluous check on set updates") 31) 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort") 32) 6b1ca88e4bb6 ("netfilter: nf_tables: skip dead set elements in netlink dump") 33) d0009effa886 ("netfilter: nf_tables: validate NFPROTO_* family") 34) 60c0c230c6f0 ("netfilter: nft_set_rbtree: skip end interval element from gc") 35) bccebf647017 ("netfilter: nf_tables: set dormant flag on hook register failure") 36) 7e0f122c6591 ("netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()") 37) 4a0e7f2decbf ("netfilter: nf_tables: do not compare internal table flags on updates") 38) 552705a3650b ("netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout") 39) 994209ddf4f4 ("netfilter: nf_tables: reject new basechain after table flag update") 40) 1bc83a019bbe ("netfilter: nf_tables: discard table flag update with pending basechain deletion") Please, apply. Thanks. Florian Westphal (4): netfilter: nf_tables: defer gc run if previous batch is still pending netfilter: nftables: exthdr: fix 4-byte stack OOB write netfilter: nf_tables: mark newset as dead on transaction abort netfilter: nf_tables: set dormant flag on hook register failure Ignat Korchagin (1): netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() Pablo Neira Ayuso (34): netfilter: nf_tables: pass context to nft_set_destroy() netfilter: nftables: rename set element data activation/deactivation functions netfilter: nf_tables: drop map element references from preparation phase netfilter: nft_set_rbtree: allow loose matching of closing element in interval netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: fix null deref on element insertion netfilter: nft_set_rbtree: fix overlap expiration walk netfilter: nf_tables: don't skip expired elements during walk netfilter: nf_tables: GC transaction API to avoid race with control plane netfilter: nf_tables: adapt set backend to use GC transaction API netfilter: nf_tables: remove busy mark and gc batch API netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path netfilter: nf_tables: GC transaction race with netns dismantle netfilter: nf_tables: GC transaction race with abort path netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration netfilter: nf_tables: fix memleak when more than 255 elements expired netfilter: nf_tables: unregister flowtable hooks on netns exit netfilter: nf_tables: double hook unregistration in netns path netfilter: nftables: update table flags from the commit phase netfilter: nf_tables: fix table flag updates netfilter: nf_tables: disable toggling dormant table state more than once netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 4.19) netfilter: nft_dynset: fix timeouts later than 23 days netfilter: nft_dynset: report EOPNOTSUPP on missing set feature netfilter: nft_dynset: relax superfluous check on set updates netfilter: nf_tables: skip dead set elements in netlink dump netfilter: nf_tables: validate NFPROTO_* family netfilter: nft_set_rbtree: skip end interval element from gc netfilter: nf_tables: do not compare internal table flags on updates netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout netfilter: nf_tables: reject new basechain after table flag update netfilter: nf_tables: discard table flag update with pending basechain deletion Phil Sutter (1): netfilter: nft_set_rbtree: Add missing expired checks include/net/netfilter/nf_tables.h | 132 +++--- include/uapi/linux/netfilter/nf_tables.h | 1 + net/netfilter/nf_tables_api.c | 529 +++++++++++++++++++---- net/netfilter/nft_chain_filter.c | 3 + net/netfilter/nft_compat.c | 32 ++ net/netfilter/nft_dynset.c | 24 +- net/netfilter/nft_exthdr.c | 14 +- net/netfilter/nft_flow_offload.c | 5 + net/netfilter/nft_nat.c | 5 + net/netfilter/nft_rt.c | 5 + net/netfilter/nft_set_bitmap.c | 5 +- net/netfilter/nft_set_hash.c | 111 +++-- net/netfilter/nft_set_rbtree.c | 387 ++++++++++++++--- net/netfilter/nft_socket.c | 5 + net/netfilter/nft_tproxy.c | 5 + 15 files changed, 977 insertions(+), 286 deletions(-) -- 2.30.2

1 year, 2 months

2
41
0 0

[PATCH] rtc: abx80x: Fix return value of nvmem callback on read

by Joy Chakraborty

Read callbacks registered with nvmem core expect 0 to be returned on success and a negative value to be returned on failure. abx80x_nvmem_xfer() on read calls i2c_smbus_read_i2c_block_data() which returns the number of bytes read on success as per its api description, this return value is handled as an error and returned to nvmem even on success. Fix to handle all possible values that would be returned by i2c_smbus_read_i2c_block_data(). Fixes: e90ff8ede777 ("rtc: abx80x: Add nvmem support") Cc: stable(a)vger.kernel.org Signed-off-by: Joy Chakraborty <joychakr(a)google.com> --- drivers/rtc/rtc-abx80x.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/rtc-abx80x.c b/drivers/rtc/rtc-abx80x.c index fde2b8054c2e..0f5847d1ca2a 100644 --- a/drivers/rtc/rtc-abx80x.c +++ b/drivers/rtc/rtc-abx80x.c @@ -711,9 +711,16 @@ static int abx80x_nvmem_xfer(struct abx80x_priv *priv, unsigned int offset, else ret = i2c_smbus_read_i2c_block_data(priv->client, reg, len, val); - if (ret) + if (ret < 0) return ret; + if (!write) { + if (ret) + len = ret; + else + return -EIO; + } + offset += len; val += len; bytes -= len; -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

2
2
0 0

[PATCH v2] PCI: use local_pci_probe when best selected cpu is offline

by Hongchen Zhang

When the best selected CPU is offline, work_on_cpu() will stuck forever. This can be happen if a node is online while all its CPUs are offline (we can use "maxcpus=1" without "nr_cpus=1" to reproduce it), Therefore, in this case, we should call local_pci_probe() instead of work_on_cpu(). Cc: <stable(a)vger.kernel.org> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- v1 -> v2 Added the method to reproduce this issue --- drivers/pci/pci-driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c index af2996d0d17f..32a99828e6a3 100644 --- a/drivers/pci/pci-driver.c +++ b/drivers/pci/pci-driver.c @@ -386,7 +386,7 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev, free_cpumask_var(wq_domain_mask); } - if (cpu < nr_cpu_ids) + if ((cpu < nr_cpu_ids) && cpu_online(cpu)) error = work_on_cpu(cpu, local_pci_probe, &ddi); else error = local_pci_probe(&ddi); -- 2.33.0

1 year, 2 months

3
3
0 0

[PATCH v2] Input: try trimming too long modalias strings

by Jason Andryuk

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> commit 0774d19038c496f0c3602fb505c43e1b2d8eed85 upstream. If an input device declares too many capability bits then modalias string for such device may become too long and not fit into uevent buffer, resulting in failure of sending said uevent. This, in turn, may prevent userspace from recognizing existence of such devices. This is typically not a concern for real hardware devices as they have limited number of keys, but happen with synthetic devices such as ones created by xen-kbdfront driver, which creates devices as being capable of delivering all possible keys, since it doesn't know what keys the backend may produce. To deal with such devices input core will attempt to trim key data, in the hope that the rest of modalias string will fit in the given buffer. When trimming key data it will indicate that it is not complete by placing "+," sign, resulting in conversions like this: old: k71,72,73,74,78,7A,7B,7C,7D,8E,9E,A4,AD,E0,E1,E4,F8,174, new: k71,72,73,74,78,7A,7B,7C,+, This should allow existing udev rules continue to work with existing devices, and will also allow writing more complex rules that would recognize trimmed modalias and check input device characteristics by other means (for example by parsing KEY= data in uevent or parsing input device sysfs attributes). Note that the driver core may try adding more uevent environment variables once input core is done adding its own, so when forming modalias we can not use the entire available buffer, so we reduce it by somewhat an arbitrary amount (96 bytes). Reported-by: Jason Andryuk <jandryuk(a)gmail.com> Reviewed-by: Peter Hutterer <peter.hutterer(a)who-t.net> Tested-by: Jason Andryuk <jandryuk(a)gmail.com> Link: https://lore.kernel.org/r/ZjAWMQCJdrxZkvkB@google.com Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> [ Apply to linux-6.1.y ] Signed-off-by: Jason Andryuk <jason.andryuk(a)amd.com> --- For 6.1 only. Patch did not automatically apply to 6.1.y because input_print_modalias_parts() does not have const on *id. v2: Remove const from input_print_modalias() and input_print_modalias_parts() Tested on 6.1. 5.15 and earlier need an additional fixup. drivers/input/input.c | 104 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 89 insertions(+), 15 deletions(-) diff --git a/drivers/input/input.c b/drivers/input/input.c index 8b6a922f8470..78be582b5766 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -1374,19 +1374,19 @@ static int input_print_modalias_bits(char *buf, int size, char name, unsigned long *bm, unsigned int min_bit, unsigned int max_bit) { - int len = 0, i; + int bit = min_bit; + int len = 0; len += snprintf(buf, max(size, 0), "%c", name); - for (i = min_bit; i < max_bit; i++) - if (bm[BIT_WORD(i)] & BIT_MASK(i)) - len += snprintf(buf + len, max(size - len, 0), "%X,", i); + for_each_set_bit_from(bit, bm, max_bit) + len += snprintf(buf + len, max(size - len, 0), "%X,", bit); return len; } -static int input_print_modalias(char *buf, int size, struct input_dev *id, - int add_cr) +static int input_print_modalias_parts(char *buf, int size, int full_len, + struct input_dev *id) { - int len; + int len, klen, remainder, space; len = snprintf(buf, max(size, 0), "input:b%04Xv%04Xp%04Xe%04X-", @@ -1395,8 +1395,48 @@ static int input_print_modalias(char *buf, int size, struct input_dev *id, len += input_print_modalias_bits(buf + len, size - len, 'e', id->evbit, 0, EV_MAX); - len += input_print_modalias_bits(buf + len, size - len, + + /* + * Calculate the remaining space in the buffer making sure we + * have place for the terminating 0. + */ + space = max(size - (len + 1), 0); + + klen = input_print_modalias_bits(buf + len, size - len, 'k', id->keybit, KEY_MIN_INTERESTING, KEY_MAX); + len += klen; + + /* + * If we have more data than we can fit in the buffer, check + * if we can trim key data to fit in the rest. We will indicate + * that key data is incomplete by adding "+" sign at the end, like + * this: * "k1,2,3,45,+,". + * + * Note that we shortest key info (if present) is "k+," so we + * can only try to trim if key data is longer than that. + */ + if (full_len && size < full_len + 1 && klen > 3) { + remainder = full_len - len; + /* + * We can only trim if we have space for the remainder + * and also for at least "k+," which is 3 more characters. + */ + if (remainder <= space - 3) { + /* + * We are guaranteed to have 'k' in the buffer, so + * we need at least 3 additional bytes for storing + * "+," in addition to the remainder. + */ + for (int i = size - 1 - remainder - 3; i >= 0; i--) { + if (buf[i] == 'k' || buf[i] == ',') { + strcpy(buf + i + 1, "+,"); + len = i + 3; /* Not counting '\0' */ + break; + } + } + } + } + len += input_print_modalias_bits(buf + len, size - len, 'r', id->relbit, 0, REL_MAX); len += input_print_modalias_bits(buf + len, size - len, @@ -1412,12 +1452,25 @@ static int input_print_modalias(char *buf, int size, struct input_dev *id, len += input_print_modalias_bits(buf + len, size - len, 'w', id->swbit, 0, SW_MAX); - if (add_cr) - len += snprintf(buf + len, max(size - len, 0), "\n"); - return len; } +static int input_print_modalias(char *buf, int size, struct input_dev *id) +{ + int full_len; + + /* + * Printing is done in 2 passes: first one figures out total length + * needed for the modalias string, second one will try to trim key + * data in case when buffer is too small for the entire modalias. + * If the buffer is too small regardless, it will fill as much as it + * can (without trimming key data) into the buffer and leave it to + * the caller to figure out what to do with the result. + */ + full_len = input_print_modalias_parts(NULL, 0, 0, id); + return input_print_modalias_parts(buf, size, full_len, id); +} + static ssize_t input_dev_show_modalias(struct device *dev, struct device_attribute *attr, char *buf) @@ -1425,7 +1478,9 @@ static ssize_t input_dev_show_modalias(struct device *dev, struct input_dev *id = to_input_dev(dev); ssize_t len; - len = input_print_modalias(buf, PAGE_SIZE, id, 1); + len = input_print_modalias(buf, PAGE_SIZE, id); + if (len < PAGE_SIZE - 2) + len += snprintf(buf + len, PAGE_SIZE - len, "\n"); return min_t(int, len, PAGE_SIZE); } @@ -1637,6 +1692,23 @@ static int input_add_uevent_bm_var(struct kobj_uevent_env *env, return 0; } +/* + * This is a pretty gross hack. When building uevent data the driver core + * may try adding more environment variables to kobj_uevent_env without + * telling us, so we have no idea how much of the buffer we can use to + * avoid overflows/-ENOMEM elsewhere. To work around this let's artificially + * reduce amount of memory we will use for the modalias environment variable. + * + * The potential additions are: + * + * SEQNUM=18446744073709551615 - (%llu - 28 bytes) + * HOME=/ (6 bytes) + * PATH=/sbin:/bin:/usr/sbin:/usr/bin (34 bytes) + * + * 68 bytes total. Allow extra buffer - 96 bytes + */ +#define UEVENT_ENV_EXTRA_LEN 96 + static int input_add_uevent_modalias_var(struct kobj_uevent_env *env, struct input_dev *dev) { @@ -1646,9 +1718,11 @@ static int input_add_uevent_modalias_var(struct kobj_uevent_env *env, return -ENOMEM; len = input_print_modalias(&env->buf[env->buflen - 1], - sizeof(env->buf) - env->buflen, - dev, 0); - if (len >= (sizeof(env->buf) - env->buflen)) + (int)sizeof(env->buf) - env->buflen - + UEVENT_ENV_EXTRA_LEN, + dev); + if (len >= ((int)sizeof(env->buf) - env->buflen - + UEVENT_ENV_EXTRA_LEN)) return -ENOMEM; env->buflen += len; -- 2.40.1

1 year, 2 months

1
0
0 0

[PATCH] Input: try trimming too long modalias strings

by Jason Andryuk

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> commit 0774d19038c496f0c3602fb505c43e1b2d8eed85 upstream. If an input device declares too many capability bits then modalias string for such device may become too long and not fit into uevent buffer, resulting in failure of sending said uevent. This, in turn, may prevent userspace from recognizing existence of such devices. This is typically not a concern for real hardware devices as they have limited number of keys, but happen with synthetic devices such as ones created by xen-kbdfront driver, which creates devices as being capable of delivering all possible keys, since it doesn't know what keys the backend may produce. To deal with such devices input core will attempt to trim key data, in the hope that the rest of modalias string will fit in the given buffer. When trimming key data it will indicate that it is not complete by placing "+," sign, resulting in conversions like this: old: k71,72,73,74,78,7A,7B,7C,7D,8E,9E,A4,AD,E0,E1,E4,F8,174, new: k71,72,73,74,78,7A,7B,7C,+, This should allow existing udev rules continue to work with existing devices, and will also allow writing more complex rules that would recognize trimmed modalias and check input device characteristics by other means (for example by parsing KEY= data in uevent or parsing input device sysfs attributes). Note that the driver core may try adding more uevent environment variables once input core is done adding its own, so when forming modalias we can not use the entire available buffer, so we reduce it by somewhat an arbitrary amount (96 bytes). Reported-by: Jason Andryuk <jandryuk(a)gmail.com> Reviewed-by: Peter Hutterer <peter.hutterer(a)who-t.net> Tested-by: Jason Andryuk <jandryuk(a)gmail.com> Link: https://lore.kernel.org/r/ZjAWMQCJdrxZkvkB@google.com Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> [ Apply to linux-6.1.y ] Signed-off-by: Jason Andryuk <jason.andryuk(a)amd.com> --- Patch did not automatically apply to 6.1.y because input_print_modalias_parts() does not have const on *id. Tested on 6.1. Seems to also apply and build on 5.4 and 4.19. drivers/input/input.c | 104 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 89 insertions(+), 15 deletions(-) diff --git a/drivers/input/input.c b/drivers/input/input.c index 8b6a922f8470..eb2bb8cbec3c 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -1374,19 +1374,19 @@ static int input_print_modalias_bits(char *buf, int size, char name, unsigned long *bm, unsigned int min_bit, unsigned int max_bit) { - int len = 0, i; + int bit = min_bit; + int len = 0; len += snprintf(buf, max(size, 0), "%c", name); - for (i = min_bit; i < max_bit; i++) - if (bm[BIT_WORD(i)] & BIT_MASK(i)) - len += snprintf(buf + len, max(size - len, 0), "%X,", i); + for_each_set_bit_from(bit, bm, max_bit) + len += snprintf(buf + len, max(size - len, 0), "%X,", bit); return len; } -static int input_print_modalias(char *buf, int size, struct input_dev *id, - int add_cr) +static int input_print_modalias_parts(char *buf, int size, int full_len, + const struct input_dev *id) { - int len; + int len, klen, remainder, space; len = snprintf(buf, max(size, 0), "input:b%04Xv%04Xp%04Xe%04X-", @@ -1395,8 +1395,48 @@ static int input_print_modalias(char *buf, int size, struct input_dev *id, len += input_print_modalias_bits(buf + len, size - len, 'e', id->evbit, 0, EV_MAX); - len += input_print_modalias_bits(buf + len, size - len, + + /* + * Calculate the remaining space in the buffer making sure we + * have place for the terminating 0. + */ + space = max(size - (len + 1), 0); + + klen = input_print_modalias_bits(buf + len, size - len, 'k', id->keybit, KEY_MIN_INTERESTING, KEY_MAX); + len += klen; + + /* + * If we have more data than we can fit in the buffer, check + * if we can trim key data to fit in the rest. We will indicate + * that key data is incomplete by adding "+" sign at the end, like + * this: * "k1,2,3,45,+,". + * + * Note that we shortest key info (if present) is "k+," so we + * can only try to trim if key data is longer than that. + */ + if (full_len && size < full_len + 1 && klen > 3) { + remainder = full_len - len; + /* + * We can only trim if we have space for the remainder + * and also for at least "k+," which is 3 more characters. + */ + if (remainder <= space - 3) { + /* + * We are guaranteed to have 'k' in the buffer, so + * we need at least 3 additional bytes for storing + * "+," in addition to the remainder. + */ + for (int i = size - 1 - remainder - 3; i >= 0; i--) { + if (buf[i] == 'k' || buf[i] == ',') { + strcpy(buf + i + 1, "+,"); + len = i + 3; /* Not counting '\0' */ + break; + } + } + } + } + len += input_print_modalias_bits(buf + len, size - len, 'r', id->relbit, 0, REL_MAX); len += input_print_modalias_bits(buf + len, size - len, @@ -1412,12 +1452,25 @@ static int input_print_modalias(char *buf, int size, struct input_dev *id, len += input_print_modalias_bits(buf + len, size - len, 'w', id->swbit, 0, SW_MAX); - if (add_cr) - len += snprintf(buf + len, max(size - len, 0), "\n"); - return len; } +static int input_print_modalias(char *buf, int size, const struct input_dev *id) +{ + int full_len; + + /* + * Printing is done in 2 passes: first one figures out total length + * needed for the modalias string, second one will try to trim key + * data in case when buffer is too small for the entire modalias. + * If the buffer is too small regardless, it will fill as much as it + * can (without trimming key data) into the buffer and leave it to + * the caller to figure out what to do with the result. + */ + full_len = input_print_modalias_parts(NULL, 0, 0, id); + return input_print_modalias_parts(buf, size, full_len, id); +} + static ssize_t input_dev_show_modalias(struct device *dev, struct device_attribute *attr, char *buf) @@ -1425,7 +1478,9 @@ static ssize_t input_dev_show_modalias(struct device *dev, struct input_dev *id = to_input_dev(dev); ssize_t len; - len = input_print_modalias(buf, PAGE_SIZE, id, 1); + len = input_print_modalias(buf, PAGE_SIZE, id); + if (len < PAGE_SIZE - 2) + len += snprintf(buf + len, PAGE_SIZE - len, "\n"); return min_t(int, len, PAGE_SIZE); } @@ -1637,6 +1692,23 @@ static int input_add_uevent_bm_var(struct kobj_uevent_env *env, return 0; } +/* + * This is a pretty gross hack. When building uevent data the driver core + * may try adding more environment variables to kobj_uevent_env without + * telling us, so we have no idea how much of the buffer we can use to + * avoid overflows/-ENOMEM elsewhere. To work around this let's artificially + * reduce amount of memory we will use for the modalias environment variable. + * + * The potential additions are: + * + * SEQNUM=18446744073709551615 - (%llu - 28 bytes) + * HOME=/ (6 bytes) + * PATH=/sbin:/bin:/usr/sbin:/usr/bin (34 bytes) + * + * 68 bytes total. Allow extra buffer - 96 bytes + */ +#define UEVENT_ENV_EXTRA_LEN 96 + static int input_add_uevent_modalias_var(struct kobj_uevent_env *env, struct input_dev *dev) { @@ -1646,9 +1718,11 @@ static int input_add_uevent_modalias_var(struct kobj_uevent_env *env, return -ENOMEM; len = input_print_modalias(&env->buf[env->buflen - 1], - sizeof(env->buf) - env->buflen, - dev, 0); - if (len >= (sizeof(env->buf) - env->buflen)) + (int)sizeof(env->buf) - env->buflen - + UEVENT_ENV_EXTRA_LEN, + dev); + if (len >= ((int)sizeof(env->buf) - env->buflen - + UEVENT_ENV_EXTRA_LEN)) return -ENOMEM; env->buflen += len; -- 2.40.1

1 year, 2 months

2
2
0 0

[PATCH v2] virt: guest_memfd: fix reference leak on hwpoisoned page

by Paolo Bonzini

If __kvm_gmem_get_pfn() detects an hwpoisoned page, it returns -EHWPOISON but it does not put back the reference that kvm_gmem_get_folio() had grabbed. Add the forgotten folio_put(). Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory") Cc: stable(a)vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> --- Sent v1 from the wrong directory, sorry about that. virt/kvm/guest_memfd.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index 3bfe1824ec2d..19c220ec1efd 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -549,7 +549,6 @@ static int __kvm_gmem_get_pfn(struct file *file, struct kvm_memory_slot *slot, struct kvm_gmem *gmem = file->private_data; struct folio *folio; struct page *page; - int r; if (file != slot->gmem.file) { WARN_ON_ONCE(slot->gmem.file); @@ -567,8 +566,9 @@ static int __kvm_gmem_get_pfn(struct file *file, struct kvm_memory_slot *slot, return PTR_ERR(folio); if (folio_test_hwpoison(folio)) { - r = -EHWPOISON; - goto out_unlock; + folio_unlock(folio); + folio_put(folio); + return -EHWPOISON; } page = folio_file_page(folio, index); @@ -577,12 +577,8 @@ static int __kvm_gmem_get_pfn(struct file *file, struct kvm_memory_slot *slot, if (max_order) *max_order = 0; - r = 0; - -out_unlock: folio_unlock(folio); - - return r; + return 0; } int kvm_gmem_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot, -- 2.43.0

1 year, 2 months

3
2
0 0

[PATCH v2] Supports to use the default CMA when the device-specified CMA memory is not enough.

by zhai.he

From: He Zhai <zhai.he(a)nxp.com> In the current code logic, if the device-specified CMA memory allocation fails, memory will not be allocated from the default CMA area. This patch will use the default cma region when the device's specified CMA is not enough. In addition, the log level of allocation failure is changed to debug. Because these logs will be printed when memory allocation from the device specified CMA fails, but if the allocation fails, it will be allocated from the default cma area. It can easily mislead developers' judgment. Signed-off-by: He Zhai <zhai.he(a)nxp.com> --- kernel/dma/contiguous.c | 11 +++++++++-- mm/cma.c | 4 ++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c index 055da410ac71..e45cfb24500f 100644 --- a/kernel/dma/contiguous.c +++ b/kernel/dma/contiguous.c @@ -357,8 +357,13 @@ struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t gfp) /* CMA can be used only in the context which permits sleeping */ if (!gfpflags_allow_blocking(gfp)) return NULL; - if (dev->cma_area) - return cma_alloc_aligned(dev->cma_area, size, gfp); + if (dev->cma_area) { + struct page *page = NULL; + + page = cma_alloc_aligned(dev->cma_area, size, gfp); + if (page) + return page; + } if (size <= PAGE_SIZE) return NULL; @@ -406,6 +411,8 @@ void dma_free_contiguous(struct device *dev, struct page *page, size_t size) if (dev->cma_area) { if (cma_release(dev->cma_area, page, count)) return; + if (cma_release(dma_contiguous_default_area, page, count)) + return; } else { /* * otherwise, page is from either per-numa cma or default cma diff --git a/mm/cma.c b/mm/cma.c index 3e9724716bad..6e12faf1bea7 100644 --- a/mm/cma.c +++ b/mm/cma.c @@ -495,8 +495,8 @@ struct page *cma_alloc(struct cma *cma, unsigned long count, } if (ret && !no_warn) { - pr_err_ratelimited("%s: %s: alloc failed, req-size: %lu pages, ret: %d\n", - __func__, cma->name, count, ret); + pr_debug("%s: alloc failed, req-size: %lu pages, ret: %d, try to use default cma\n", + cma->name, count, ret); cma_debug_show_areas(cma); } -- 2.34.1

1 year, 2 months

4
3
0 0

reply

by Peter Chan

Hi, I have a project that I would like you to be part of for possible business collaboration in future as my company needs a new raw material supplier from your country. You might be wondering the the type of project, please get back to me so I can give you more details. Peter Chan

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] firmware: qcom_scm: disable clocks if qcom_scm_bw_enable()" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 0c50b7fcf2773b4853e83fc15aba1a196ba95966 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061237-ethically-ethically-19bc@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 0c50b7fcf277 ("firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0c50b7fcf2773b4853e83fc15aba1a196ba95966 Mon Sep 17 00:00:00 2001 From: Gabor Juhos <j4g8y7(a)gmail.com> Date: Mon, 4 Mar 2024 14:14:53 +0100 Subject: [PATCH] firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails There are several functions which are calling qcom_scm_bw_enable() then returns immediately if the call fails and leaves the clocks enabled. Change the code of these functions to disable clocks when the qcom_scm_bw_enable() call fails. This also fixes a possible dma buffer leak in the qcom_scm_pas_init_image() function. Compile tested only due to lack of hardware with interconnect support. Cc: stable(a)vger.kernel.org Fixes: 65b7ebda5028 ("firmware: qcom_scm: Add bw voting support to the SCM interface") Signed-off-by: Gabor Juhos <j4g8y7(a)gmail.com> Reviewed-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/r/20240304-qcom-scm-disable-clk-v1-1-b36e51577ca1@g… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index 520de9b5633a..e8460626fb0c 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -569,13 +569,14 @@ int qcom_scm_pas_init_image(u32 peripheral, const void *metadata, size_t size, ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; desc.args[1] = mdata_phys; ret = qcom_scm_call(__scm->dev, &desc, &res); - qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); out: @@ -637,10 +638,12 @@ int qcom_scm_pas_mem_setup(u32 peripheral, phys_addr_t addr, phys_addr_t size) ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; ret = qcom_scm_call(__scm->dev, &desc, &res); qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); return ret ? : res.result[0]; @@ -672,10 +675,12 @@ int qcom_scm_pas_auth_and_reset(u32 peripheral) ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; ret = qcom_scm_call(__scm->dev, &desc, &res); qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); return ret ? : res.result[0]; @@ -706,11 +711,12 @@ int qcom_scm_pas_shutdown(u32 peripheral) ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; ret = qcom_scm_call(__scm->dev, &desc, &res); - qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); return ret ? : res.result[0];

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] firmware: qcom_scm: disable clocks if qcom_scm_bw_enable()" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 0c50b7fcf2773b4853e83fc15aba1a196ba95966 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061236-vanity-bankbook-d9dc@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 0c50b7fcf277 ("firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0c50b7fcf2773b4853e83fc15aba1a196ba95966 Mon Sep 17 00:00:00 2001 From: Gabor Juhos <j4g8y7(a)gmail.com> Date: Mon, 4 Mar 2024 14:14:53 +0100 Subject: [PATCH] firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails There are several functions which are calling qcom_scm_bw_enable() then returns immediately if the call fails and leaves the clocks enabled. Change the code of these functions to disable clocks when the qcom_scm_bw_enable() call fails. This also fixes a possible dma buffer leak in the qcom_scm_pas_init_image() function. Compile tested only due to lack of hardware with interconnect support. Cc: stable(a)vger.kernel.org Fixes: 65b7ebda5028 ("firmware: qcom_scm: Add bw voting support to the SCM interface") Signed-off-by: Gabor Juhos <j4g8y7(a)gmail.com> Reviewed-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/r/20240304-qcom-scm-disable-clk-v1-1-b36e51577ca1@g… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index 520de9b5633a..e8460626fb0c 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -569,13 +569,14 @@ int qcom_scm_pas_init_image(u32 peripheral, const void *metadata, size_t size, ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; desc.args[1] = mdata_phys; ret = qcom_scm_call(__scm->dev, &desc, &res); - qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); out: @@ -637,10 +638,12 @@ int qcom_scm_pas_mem_setup(u32 peripheral, phys_addr_t addr, phys_addr_t size) ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; ret = qcom_scm_call(__scm->dev, &desc, &res); qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); return ret ? : res.result[0]; @@ -672,10 +675,12 @@ int qcom_scm_pas_auth_and_reset(u32 peripheral) ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; ret = qcom_scm_call(__scm->dev, &desc, &res); qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); return ret ? : res.result[0]; @@ -706,11 +711,12 @@ int qcom_scm_pas_shutdown(u32 peripheral) ret = qcom_scm_bw_enable(); if (ret) - return ret; + goto disable_clk; ret = qcom_scm_call(__scm->dev, &desc, &res); - qcom_scm_bw_disable(); + +disable_clk: qcom_scm_clk_disable(); return ret ? : res.result[0];

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mmc: davinci: Don't strip remove function when driver is" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 55c421b364482b61c4c45313a535e61ed5ae4ea3 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061231-player-lumpish-af5c@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: 55c421b36448 ("mmc: davinci: Don't strip remove function when driver is builtin") bc1711e8332d ("mmc: davinci_mmc: Convert to platform remove callback returning void") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") fa6c12e036c9 ("drm/xe/guc: Add Relay Communication ABI definitions") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 55c421b364482b61c4c45313a535e61ed5ae4ea3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig(a)pengutronix.de> Date: Sun, 24 Mar 2024 12:40:17 +0100 Subject: [PATCH] mmc: davinci: Don't strip remove function when driver is builtin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 8bd938919687..d7427894e0bc 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1337,7 +1337,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static void __exit davinci_mmcsd_remove(struct platform_device *pdev) +static void davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1392,7 +1392,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove_new = __exit_p(davinci_mmcsd_remove), + .remove_new = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, };

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mmc: davinci: Don't strip remove function when driver is" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 55c421b364482b61c4c45313a535e61ed5ae4ea3 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061230-triangle-crepe-3f0f@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: 55c421b36448 ("mmc: davinci: Don't strip remove function when driver is builtin") bc1711e8332d ("mmc: davinci_mmc: Convert to platform remove callback returning void") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 55c421b364482b61c4c45313a535e61ed5ae4ea3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig(a)pengutronix.de> Date: Sun, 24 Mar 2024 12:40:17 +0100 Subject: [PATCH] mmc: davinci: Don't strip remove function when driver is builtin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 8bd938919687..d7427894e0bc 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1337,7 +1337,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static void __exit davinci_mmcsd_remove(struct platform_device *pdev) +static void davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1392,7 +1392,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove_new = __exit_p(davinci_mmcsd_remove), + .remove_new = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, };

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mmc: davinci: Don't strip remove function when driver is" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 55c421b364482b61c4c45313a535e61ed5ae4ea3 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061229-crying-exemplary-9dce@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 55c421b36448 ("mmc: davinci: Don't strip remove function when driver is builtin") bc1711e8332d ("mmc: davinci_mmc: Convert to platform remove callback returning void") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 55c421b364482b61c4c45313a535e61ed5ae4ea3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig(a)pengutronix.de> Date: Sun, 24 Mar 2024 12:40:17 +0100 Subject: [PATCH] mmc: davinci: Don't strip remove function when driver is builtin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 8bd938919687..d7427894e0bc 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1337,7 +1337,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static void __exit davinci_mmcsd_remove(struct platform_device *pdev) +static void davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1392,7 +1392,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove_new = __exit_p(davinci_mmcsd_remove), + .remove_new = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, };

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] mmc: davinci: Don't strip remove function when driver is" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 55c421b364482b61c4c45313a535e61ed5ae4ea3 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061228-olive-jawless-313c@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 55c421b36448 ("mmc: davinci: Don't strip remove function when driver is builtin") bc1711e8332d ("mmc: davinci_mmc: Convert to platform remove callback returning void") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 55c421b364482b61c4c45313a535e61ed5ae4ea3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig(a)pengutronix.de> Date: Sun, 24 Mar 2024 12:40:17 +0100 Subject: [PATCH] mmc: davinci: Don't strip remove function when driver is builtin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 8bd938919687..d7427894e0bc 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1337,7 +1337,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static void __exit davinci_mmcsd_remove(struct platform_device *pdev) +static void davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1392,7 +1392,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove_new = __exit_p(davinci_mmcsd_remove), + .remove_new = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, };

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] media: mc: mark the media devnode as registered from the," failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 4bc60736154bc9e0e39d3b88918f5d3762ebe5e0 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061207-grooving-scholar-3378@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: 4bc60736154b ("media: mc: mark the media devnode as registered from the, start") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 4bc60736154bc9e0e39d3b88918f5d3762ebe5e0 Mon Sep 17 00:00:00 2001 From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Date: Fri, 23 Feb 2024 09:46:19 +0100 Subject: [PATCH] media: mc: mark the media devnode as registered from the, start First the media device node was created, and if successful it was marked as 'registered'. This leaves a small race condition where an application can open the device node and get an error back because the 'registered' flag was not yet set. Change the order: first set the 'registered' flag, then actually register the media device node. If that fails, then clear the flag. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Acked-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Fixes: cf4b9211b568 ("[media] media: Media device node support") Cc: stable(a)vger.kernel.org Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> diff --git a/drivers/media/mc/mc-devnode.c b/drivers/media/mc/mc-devnode.c index 7f67825c8757..318e267e798e 100644 --- a/drivers/media/mc/mc-devnode.c +++ b/drivers/media/mc/mc-devnode.c @@ -245,15 +245,14 @@ int __must_check media_devnode_register(struct media_device *mdev, kobject_set_name(&devnode->cdev.kobj, "media%d", devnode->minor); /* Part 3: Add the media and char device */ + set_bit(MEDIA_FLAG_REGISTERED, &devnode->flags); ret = cdev_device_add(&devnode->cdev, &devnode->dev); if (ret < 0) { + clear_bit(MEDIA_FLAG_REGISTERED, &devnode->flags); pr_err("%s: cdev_device_add failed\n", __func__); goto cdev_add_error; } - /* Part 4: Activate this minor. The char device can now be used. */ - set_bit(MEDIA_FLAG_REGISTERED, &devnode->flags); - return 0; cdev_add_error:

1 year, 2 months

1
0
0 0

Re: Patch "bcache: fix variable length array abuse in btree_iter" has been added to the 5.15-stable tree

by Matthew Mirvish

On Wed, Jun 12, 2024 at 05:29:10PM +0200, gregkh(a)linuxfoundation.org wrote: > > This is a note to let you know that I've just added the patch titled > > bcache: fix variable length array abuse in btree_iter > > to the 5.15-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > bcache-fix-variable-length-array-abuse-in-btree_iter.patch > and it can be found in the queue-5.15 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > Hi, I forgot to add a version tag on this -- it should only be in kernels >= v6.1, so please drop it from v5.10 & v5.15. Thanks, Matthew

1 year, 2 months

2
1
0 0

[PATCH 1/2] scsi: core: Introduce the BLIST_SKIP_IO_HINTS flag

by Bart Van Assche

Prepare for skipping reading the IO hints VPD page for USB storage devices. Cc: Alan Stern <stern(a)rowland.harvard.edu> Cc: Joao Machado <jocrismachado(a)gmail.com> Cc: Andy Shevchenko <andy.shevchenko(a)gmail.com> Cc: Christian Heusel <christian(a)heusel.eu> Cc: stable(a)vger.kernel.org Fixes: 4f53138fffc2 ("scsi: sd: Translate data lifetime information") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/scsi/sd.c | 4 ++++ include/scsi/scsi_devinfo.h | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 3a43e2209751..fcf3d7730466 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -63,6 +63,7 @@ #include <scsi/scsi_cmnd.h> #include <scsi/scsi_dbg.h> #include <scsi/scsi_device.h> +#include <scsi/scsi_devinfo.h> #include <scsi/scsi_driver.h> #include <scsi/scsi_eh.h> #include <scsi/scsi_host.h> @@ -3117,6 +3118,9 @@ static void sd_read_io_hints(struct scsi_disk *sdkp, unsigned char *buffer) struct scsi_mode_data data; int res; + if (sdp->sdev_bflags & BLIST_SKIP_IO_HINTS) + return; + res = scsi_mode_sense(sdp, /*dbd=*/0x8, /*modepage=*/0x0a, /*subpage=*/0x05, buffer, SD_BUF_SIZE, SD_TIMEOUT, sdkp->max_retries, &data, &sshdr); diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h index 6b548dc2c496..fa8721e49dec 100644 --- a/include/scsi/scsi_devinfo.h +++ b/include/scsi/scsi_devinfo.h @@ -69,8 +69,10 @@ #define BLIST_RETRY_ITF ((__force blist_flags_t)(1ULL << 32)) /* Always retry ABORTED_COMMAND with ASC 0xc1 */ #define BLIST_RETRY_ASC_C1 ((__force blist_flags_t)(1ULL << 33)) +/* Do not read the I/O hints mode page */ +#define BLIST_SKIP_IO_HINTS ((__force blist_flags_t)(1ULL << 34)) -#define __BLIST_LAST_USED BLIST_RETRY_ASC_C1 +#define __BLIST_LAST_USED BLIST_SKIP_IO_HINTS #define __BLIST_HIGH_UNUSED (~(__BLIST_LAST_USED | \ (__force blist_flags_t) \

1 year, 2 months

1
0
0 0

[PATCH] f2fs: fix to don't dirty inode for readonly filesystem

by Chao Yu

syzbot reports f2fs bug as below: kernel BUG at fs/f2fs/inode.c:933! RIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933 Call Trace: evict+0x2a4/0x620 fs/inode.c:664 dispose_list fs/inode.c:697 [inline] evict_inodes+0x5f8/0x690 fs/inode.c:747 generic_shutdown_super+0x9d/0x2c0 fs/super.c:675 kill_block_super+0x44/0x90 fs/super.c:1667 kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894 deactivate_locked_super+0xc1/0x130 fs/super.c:484 cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256 task_work_run+0x24a/0x300 kernel/task_work.c:180 ptrace_notify+0x2cd/0x380 kernel/signal.c:2399 ptrace_report_syscall include/linux/ptrace.h:411 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline] syscall_exit_work kernel/entry/common.c:251 [inline] syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296 do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88 entry_SYSCALL_64_after_hwframe+0x63/0x6b The root cause is: - do_sys_open - f2fs_lookup - __f2fs_find_entry - f2fs_i_depth_write - f2fs_mark_inode_dirty_sync - f2fs_dirty_inode - set_inode_flag(inode, FI_DIRTY_INODE) - umount - kill_f2fs_super - kill_block_super - generic_shutdown_super - sync_filesystem : sb is readonly, skip sync_filesystem() - evict_inodes - iput - f2fs_evict_inode - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE)) : trigger kernel panic When we try to repair i_current_depth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fs_evict_inode(). Cc: stable(a)vger.kernel.org Reported-by: syzbot+31e4659a3fe953aec2f4(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/000000000000e890bc0609a55cff@googl… Signed-off-by: Chao Yu <chao(a)kernel.org> --- fs/f2fs/inode.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 8f2b9f62ef73..64cda1d77fe5 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -29,6 +29,9 @@ void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync) if (is_inode_flag_set(inode, FI_NEW_INODE)) return; + if (f2fs_readonly(F2FS_I_SB(inode)->sb)) + return; + if (f2fs_inode_dirtied(inode, sync)) return; -- 2.40.1

1 year, 2 months

2
1
0 0

[PATCH] f2fs: fix return value of f2fs_convert_inline_inode()

by Chao Yu

If device is readonly, make f2fs_convert_inline_inode() return EROFS instead of zero, otherwise it may trigger panic during writeback of inline inode's dirty page as below: f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888 f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3342 [inline] f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369 do_writepages+0x359/0x870 mm/page-writeback.c:2634 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788 f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276 generic_write_sync include/linux/fs.h:2806 [inline] f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977 call_write_iter include/linux/fs.h:2114 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa72/0xc90 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Cc: stable(a)vger.kernel.org Reported-by: syzbot+848062ba19c8782ca5c8(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/000000000000d103ce06174d7ec3@googl… Signed-off-by: Chao Yu <chao(a)kernel.org> --- fs/f2fs/inline.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c index 0203c3baabb6..1fba5728be70 100644 --- a/fs/f2fs/inline.c +++ b/fs/f2fs/inline.c @@ -221,8 +221,10 @@ int f2fs_convert_inline_inode(struct inode *inode) struct page *ipage, *page; int err = 0; - if (!f2fs_has_inline_data(inode) || - f2fs_hw_is_readonly(sbi) || f2fs_readonly(sbi->sb)) + if (f2fs_hw_is_readonly(sbi) || f2fs_readonly(sbi->sb)) + return -EROFS; + + if (!f2fs_has_inline_data(inode)) return 0; err = f2fs_dquot_initialize(inode); -- 2.40.1

1 year, 2 months

2
1
0 0

[PATCH] f2fs: fix to force buffered IO on inline_data inode

by Chao Yu

It will return all zero data when DIO reading from inline_data inode, it is because f2fs_iomap_begin() assign iomap->type w/ IOMAP_HOLE incorrectly for this case. We can let iomap framework handle inline data via assigning iomap->type and iomap->inline_data correctly, however, it will be a little bit complicated when handling race case in between direct IO and buffered IO. So, let's force to use buffered IO to fix this issue. Cc: stable(a)vger.kernel.org Reported-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Chao Yu <chao(a)kernel.org> --- fs/f2fs/file.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index db6236f27852..e038910ad1e5 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -851,6 +851,8 @@ static bool f2fs_force_buffered_io(struct inode *inode, int rw) return true; if (f2fs_compressed_file(inode)) return true; + if (f2fs_has_inline_data(inode)) + return true; /* disallow direct IO if any of devices has unaligned blksize */ if (f2fs_is_multi_device(sbi) && !sbi->aligned_blksize) -- 2.40.1

1 year, 2 months

2
1
0 0

Re: [PATCH net] net: fix __dst_negative_advice() race

by Lee Jones

On Tue, 28 May 2024, Eric Dumazet wrote: > __dst_negative_advice() does not enforce proper RCU rules when > sk->dst_cache must be cleared, leading to possible UAF. > > RCU rules are that we must first clear sk->sk_dst_cache, > then call dst_release(old_dst). > > Note that sk_dst_reset(sk) is implementing this protocol correctly, > while __dst_negative_advice() uses the wrong order. > > Given that ip6_negative_advice() has special logic > against RTF_CACHE, this means each of the three ->negative_advice() > existing methods must perform the sk_dst_reset() themselves. > > Note the check against NULL dst is centralized in > __dst_negative_advice(), there is no need to duplicate > it in various callbacks. > > Many thanks to Clement Lecigne for tracking this issue. > > This old bug became visible after the blamed commit, using UDP sockets. > > Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets") > Reported-by: Clement Lecigne <clecigne(a)google.com> > Diagnosed-by: Clement Lecigne <clecigne(a)google.com> > Signed-off-by: Eric Dumazet <edumazet(a)google.com> > Cc: Tom Herbert <tom(a)herbertland.com> > --- > include/net/dst_ops.h | 2 +- > include/net/sock.h | 13 +++---------- > net/ipv4/route.c | 22 ++++++++-------------- > net/ipv6/route.c | 29 +++++++++++++++-------------- > net/xfrm/xfrm_policy.c | 11 +++-------- > 5 files changed, 30 insertions(+), 47 deletions(-) Could we have this patch in all Stable branches please? Upstream commit: Fixes: 92f1655aa2b2 ("net: fix __dst_negative_advice() race") -- Lee Jones [李琼斯]

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] proc: Move fdinfo PTRACE_MODE_READ check into the inode" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 0a960ba49869ebe8ff859d000351504dd6b93b68 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061235-hatchet-upriver-8fa7@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 0a960ba49869 ("proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0a960ba49869ebe8ff859d000351504dd6b93b68 Mon Sep 17 00:00:00 2001 From: "Tyler Hicks (Microsoft)" <code(a)tyhicks.com> Date: Tue, 30 Apr 2024 19:56:46 -0500 Subject: [PATCH] proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The following commits loosened the permissions of /proc/<PID>/fdinfo/ directory, as well as the files within it, from 0500 to 0555 while also introducing a PTRACE_MODE_READ check between the current task and <PID>'s task: - commit 7bc3fa0172a4 ("procfs: allow reading fdinfo with PTRACE_MODE_READ") - commit 1927e498aee1 ("procfs: prevent unprivileged processes accessing fdinfo dir") Before those changes, inode based system calls like inotify_add_watch(2) would fail when the current task didn't have sufficient read permissions: [...] lstat("/proc/1/task/1/fdinfo", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0 inotify_add_watch(64, "/proc/1/task/1/fdinfo", IN_MODIFY|IN_ATTRIB|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE| IN_ONLYDIR|IN_DONT_FOLLOW|IN_EXCL_UNLINK) = -1 EACCES (Permission denied) [...] This matches the documented behavior in the inotify_add_watch(2) man page: ERRORS EACCES Read access to the given file is not permitted. After those changes, inotify_add_watch(2) started succeeding despite the current task not having PTRACE_MODE_READ privileges on the target task: [...] lstat("/proc/1/task/1/fdinfo", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0 inotify_add_watch(64, "/proc/1/task/1/fdinfo", IN_MODIFY|IN_ATTRIB|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE| IN_ONLYDIR|IN_DONT_FOLLOW|IN_EXCL_UNLINK) = 1757 openat(AT_FDCWD, "/proc/1/task/1/fdinfo", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied) [...] This change in behavior broke .NET prior to v7. See the github link below for the v7 commit that inadvertently/quietly (?) fixed .NET after the kernel changes mentioned above. Return to the old behavior by moving the PTRACE_MODE_READ check out of the file .open operation and into the inode .permission operation: [...] lstat("/proc/1/task/1/fdinfo", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0 inotify_add_watch(64, "/proc/1/task/1/fdinfo", IN_MODIFY|IN_ATTRIB|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE| IN_ONLYDIR|IN_DONT_FOLLOW|IN_EXCL_UNLINK) = -1 EACCES (Permission denied) [...] Reported-by: Kevin Parsons (Microsoft) <parsonskev(a)gmail.com> Link: https://github.com/dotnet/runtime/commit/89e5469ac591b82d38510fe7de98346cce… Link: https://stackoverflow.com/questions/75379065/start-self-contained-net6-buil… Fixes: 7bc3fa0172a4 ("procfs: allow reading fdinfo with PTRACE_MODE_READ") Cc: stable(a)vger.kernel.org Cc: Christian Brauner <brauner(a)kernel.org> Cc: Christian König <christian.koenig(a)amd.com> Cc: Jann Horn <jannh(a)google.com> Cc: Kalesh Singh <kaleshsingh(a)google.com> Cc: Hardik Garg <hargar(a)linux.microsoft.com> Cc: Allen Pais <apais(a)linux.microsoft.com> Signed-off-by: Tyler Hicks (Microsoft) <code(a)tyhicks.com> Link: https://lore.kernel.org/r/20240501005646.745089-1-code@tyhicks.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> diff --git a/fs/proc/fd.c b/fs/proc/fd.c index 6e72e5ad42bc..f4b1c8b42a51 100644 --- a/fs/proc/fd.c +++ b/fs/proc/fd.c @@ -74,7 +74,18 @@ static int seq_show(struct seq_file *m, void *v) return 0; } -static int proc_fdinfo_access_allowed(struct inode *inode) +static int seq_fdinfo_open(struct inode *inode, struct file *file) +{ + return single_open(file, seq_show, inode); +} + +/** + * Shared /proc/pid/fdinfo and /proc/pid/fdinfo/fd permission helper to ensure + * that the current task has PTRACE_MODE_READ in addition to the normal + * POSIX-like checks. + */ +static int proc_fdinfo_permission(struct mnt_idmap *idmap, struct inode *inode, + int mask) { bool allowed = false; struct task_struct *task = get_proc_task(inode); @@ -88,18 +99,13 @@ static int proc_fdinfo_access_allowed(struct inode *inode) if (!allowed) return -EACCES; - return 0; + return generic_permission(idmap, inode, mask); } -static int seq_fdinfo_open(struct inode *inode, struct file *file) -{ - int ret = proc_fdinfo_access_allowed(inode); - - if (ret) - return ret; - - return single_open(file, seq_show, inode); -} +static const struct inode_operations proc_fdinfo_file_inode_operations = { + .permission = proc_fdinfo_permission, + .setattr = proc_setattr, +}; static const struct file_operations proc_fdinfo_file_operations = { .open = seq_fdinfo_open, @@ -388,6 +394,8 @@ static struct dentry *proc_fdinfo_instantiate(struct dentry *dentry, ei = PROC_I(inode); ei->fd = data->fd; + inode->i_op = &proc_fdinfo_file_inode_operations; + inode->i_fop = &proc_fdinfo_file_operations; tid_fd_update_inode(task, inode, 0); @@ -407,23 +415,13 @@ static int proc_readfdinfo(struct file *file, struct dir_context *ctx) proc_fdinfo_instantiate); } -static int proc_open_fdinfo(struct inode *inode, struct file *file) -{ - int ret = proc_fdinfo_access_allowed(inode); - - if (ret) - return ret; - - return 0; -} - const struct inode_operations proc_fdinfo_inode_operations = { .lookup = proc_lookupfdinfo, + .permission = proc_fdinfo_permission, .setattr = proc_setattr, }; const struct file_operations proc_fdinfo_operations = { - .open = proc_open_fdinfo, .read = generic_read_dir, .iterate_shared = proc_readfdinfo, .llseek = generic_file_llseek,

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] proc: Move fdinfo PTRACE_MODE_READ check into the inode" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 0a960ba49869ebe8ff859d000351504dd6b93b68 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061233-cacti-revered-a821@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 0a960ba49869 ("proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") 5d5bd24f4155 ("crypto: qat - implement dh fallback for primes > 4K") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0a960ba49869ebe8ff859d000351504dd6b93b68 Mon Sep 17 00:00:00 2001 From: "Tyler Hicks (Microsoft)" <code(a)tyhicks.com> Date: Tue, 30 Apr 2024 19:56:46 -0500 Subject: [PATCH] proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The following commits loosened the permissions of /proc/<PID>/fdinfo/ directory, as well as the files within it, from 0500 to 0555 while also introducing a PTRACE_MODE_READ check between the current task and <PID>'s task: - commit 7bc3fa0172a4 ("procfs: allow reading fdinfo with PTRACE_MODE_READ") - commit 1927e498aee1 ("procfs: prevent unprivileged processes accessing fdinfo dir") Before those changes, inode based system calls like inotify_add_watch(2) would fail when the current task didn't have sufficient read permissions: [...] lstat("/proc/1/task/1/fdinfo", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0 inotify_add_watch(64, "/proc/1/task/1/fdinfo", IN_MODIFY|IN_ATTRIB|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE| IN_ONLYDIR|IN_DONT_FOLLOW|IN_EXCL_UNLINK) = -1 EACCES (Permission denied) [...] This matches the documented behavior in the inotify_add_watch(2) man page: ERRORS EACCES Read access to the given file is not permitted. After those changes, inotify_add_watch(2) started succeeding despite the current task not having PTRACE_MODE_READ privileges on the target task: [...] lstat("/proc/1/task/1/fdinfo", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0 inotify_add_watch(64, "/proc/1/task/1/fdinfo", IN_MODIFY|IN_ATTRIB|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE| IN_ONLYDIR|IN_DONT_FOLLOW|IN_EXCL_UNLINK) = 1757 openat(AT_FDCWD, "/proc/1/task/1/fdinfo", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied) [...] This change in behavior broke .NET prior to v7. See the github link below for the v7 commit that inadvertently/quietly (?) fixed .NET after the kernel changes mentioned above. Return to the old behavior by moving the PTRACE_MODE_READ check out of the file .open operation and into the inode .permission operation: [...] lstat("/proc/1/task/1/fdinfo", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0 inotify_add_watch(64, "/proc/1/task/1/fdinfo", IN_MODIFY|IN_ATTRIB|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE| IN_ONLYDIR|IN_DONT_FOLLOW|IN_EXCL_UNLINK) = -1 EACCES (Permission denied) [...] Reported-by: Kevin Parsons (Microsoft) <parsonskev(a)gmail.com> Link: https://github.com/dotnet/runtime/commit/89e5469ac591b82d38510fe7de98346cce… Link: https://stackoverflow.com/questions/75379065/start-self-contained-net6-buil… Fixes: 7bc3fa0172a4 ("procfs: allow reading fdinfo with PTRACE_MODE_READ") Cc: stable(a)vger.kernel.org Cc: Christian Brauner <brauner(a)kernel.org> Cc: Christian König <christian.koenig(a)amd.com> Cc: Jann Horn <jannh(a)google.com> Cc: Kalesh Singh <kaleshsingh(a)google.com> Cc: Hardik Garg <hargar(a)linux.microsoft.com> Cc: Allen Pais <apais(a)linux.microsoft.com> Signed-off-by: Tyler Hicks (Microsoft) <code(a)tyhicks.com> Link: https://lore.kernel.org/r/20240501005646.745089-1-code@tyhicks.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> diff --git a/fs/proc/fd.c b/fs/proc/fd.c index 6e72e5ad42bc..f4b1c8b42a51 100644 --- a/fs/proc/fd.c +++ b/fs/proc/fd.c @@ -74,7 +74,18 @@ static int seq_show(struct seq_file *m, void *v) return 0; } -static int proc_fdinfo_access_allowed(struct inode *inode) +static int seq_fdinfo_open(struct inode *inode, struct file *file) +{ + return single_open(file, seq_show, inode); +} + +/** + * Shared /proc/pid/fdinfo and /proc/pid/fdinfo/fd permission helper to ensure + * that the current task has PTRACE_MODE_READ in addition to the normal + * POSIX-like checks. + */ +static int proc_fdinfo_permission(struct mnt_idmap *idmap, struct inode *inode, + int mask) { bool allowed = false; struct task_struct *task = get_proc_task(inode); @@ -88,18 +99,13 @@ static int proc_fdinfo_access_allowed(struct inode *inode) if (!allowed) return -EACCES; - return 0; + return generic_permission(idmap, inode, mask); } -static int seq_fdinfo_open(struct inode *inode, struct file *file) -{ - int ret = proc_fdinfo_access_allowed(inode); - - if (ret) - return ret; - - return single_open(file, seq_show, inode); -} +static const struct inode_operations proc_fdinfo_file_inode_operations = { + .permission = proc_fdinfo_permission, + .setattr = proc_setattr, +}; static const struct file_operations proc_fdinfo_file_operations = { .open = seq_fdinfo_open, @@ -388,6 +394,8 @@ static struct dentry *proc_fdinfo_instantiate(struct dentry *dentry, ei = PROC_I(inode); ei->fd = data->fd; + inode->i_op = &proc_fdinfo_file_inode_operations; + inode->i_fop = &proc_fdinfo_file_operations; tid_fd_update_inode(task, inode, 0); @@ -407,23 +415,13 @@ static int proc_readfdinfo(struct file *file, struct dir_context *ctx) proc_fdinfo_instantiate); } -static int proc_open_fdinfo(struct inode *inode, struct file *file) -{ - int ret = proc_fdinfo_access_allowed(inode); - - if (ret) - return ret; - - return 0; -} - const struct inode_operations proc_fdinfo_inode_operations = { .lookup = proc_lookupfdinfo, + .permission = proc_fdinfo_permission, .setattr = proc_setattr, }; const struct file_operations proc_fdinfo_operations = { - .open = proc_open_fdinfo, .read = generic_read_dir, .iterate_shared = proc_readfdinfo, .llseek = generic_file_llseek,

1 year, 2 months

1
0
0 0

[PATCH v2 net] bnx2x: Fix multiple UBSAN array-index-out-of-bounds

by Ghadi Elie Rahme

Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. The value of the maximum number of Ethernet queues should be limited to FP_SB_MAX_E1x in case FCOE is disabled or to [FP_SB_MAX_E1x-1] if enabled to avoid out of bounds reads and writes. Stack traces: UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2e1/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1546:11 index 28 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2fd/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1895:8 index 29 is out of range for type 'stats_query_entry [19]' CPU: 13 PID: 163 Comm: kworker/u96:1 Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Workqueue: bnx2x bnx2x_sp_task [bnx2x] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_iov_adjust_stats_req+0x3c4/0x3d0 [bnx2x] bnx2x_storm_stats_post.part.0+0x4a/0x330 [bnx2x] ? bnx2x_hw_stats_post+0x231/0x250 [bnx2x] bnx2x_stats_start+0x44/0x70 [bnx2x] bnx2x_stats_handle+0x149/0x350 [bnx2x] bnx2x_attn_int_asserted+0x998/0x9b0 [bnx2x] bnx2x_sp_task+0x491/0x5c0 [bnx2x] process_one_work+0x18d/0x3f0 </TASK> ---[ end trace ]--- Fixes: 7d0445d66a76 ("bnx2x: clamp num_queues to prevent passing a negative value") Signed-off-by: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> Cc: stable(a)vger.kernel.org --- Changes since v1: * Fix checkpatch complaints: - Wrapped commit message to comply with 75 character limit - Added space before ( in if condition drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index a8e07e51418f..c895dd680cf8 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -66,7 +66,12 @@ static int bnx2x_calc_num_queues(struct bnx2x *bp) if (is_kdump_kernel()) nq = 1; - nq = clamp(nq, 1, BNX2X_MAX_QUEUES(bp)); + int max_nq = FP_SB_MAX_E1x - 1; + + if (NO_FCOE(bp)) + max_nq = FP_SB_MAX_E1x; + + nq = clamp(nq, 1, max_nq); return nq; } -- 2.43.0

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x f592cc5794747b81e53b53dd6e80219ee25f0611 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061242-cosmetics-bronco-9d06@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: f592cc579474 ("soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request") 778279f4f5e4 ("soc: qcom: cmd-db: allow loading as a module") d6815c5c43d4 ("soc: qcom: cmd-db: Add debugfs dumping file") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From f592cc5794747b81e53b53dd6e80219ee25f0611 Mon Sep 17 00:00:00 2001 From: Maulik Shah <quic_mkshah(a)quicinc.com> Date: Thu, 15 Feb 2024 10:55:44 +0530 Subject: [PATCH] soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request Each RPMh VRM accelerator resource has 3 or 4 contiguous 4-byte aligned addresses associated with it. These control voltage, enable state, mode, and in legacy targets, voltage headroom. The current in-flight request checking logic looks for exact address matches. Requests for different addresses of the same RPMh resource as thus not detected as in-flight. Add new cmd-db API cmd_db_match_resource_addr() to enhance the in-flight request check for VRM requests by ignoring the address offset. This ensures that only one request is allowed to be in-flight for a given VRM resource. This is needed to avoid scenarios where request commands are carried out by RPMh hardware out-of-order leading to LDO regulator over-current protection triggering. Fixes: 658628e7ef78 ("drivers: qcom: rpmh-rsc: add RPMH controller for QCOM SoCs") Cc: stable(a)vger.kernel.org Reviewed-by: Konrad Dybcio <konrad.dybcio(a)linaro.org> Tested-by: Elliot Berman <quic_eberman(a)quicinc.com> # sm8650-qrd Signed-off-by: Maulik Shah <quic_mkshah(a)quicinc.com> Link: https://lore.kernel.org/r/20240215-rpmh-rsc-fixes-v4-1-9cbddfcba05b@quicinc… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c index c344107bc36c..b4e613c34a5c 100644 --- a/drivers/soc/qcom/cmd-db.c +++ b/drivers/soc/qcom/cmd-db.c @@ -1,6 +1,10 @@ /* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved. */ +/* + * Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ +#include <linux/bitfield.h> #include <linux/debugfs.h> #include <linux/kernel.h> #include <linux/module.h> @@ -17,6 +21,8 @@ #define MAX_SLV_ID 8 #define SLAVE_ID_MASK 0x7 #define SLAVE_ID_SHIFT 16 +#define SLAVE_ID(addr) FIELD_GET(GENMASK(19, 16), addr) +#define VRM_ADDR(addr) FIELD_GET(GENMASK(19, 4), addr) /** * struct entry_header: header for each entry in cmddb @@ -220,6 +226,30 @@ const void *cmd_db_read_aux_data(const char *id, size_t *len) } EXPORT_SYMBOL_GPL(cmd_db_read_aux_data); +/** + * cmd_db_match_resource_addr() - Compare if both Resource addresses are same + * + * @addr1: Resource address to compare + * @addr2: Resource address to compare + * + * Return: true if two addresses refer to the same resource, false otherwise + */ +bool cmd_db_match_resource_addr(u32 addr1, u32 addr2) +{ + /* + * Each RPMh VRM accelerator resource has 3 or 4 contiguous 4-byte + * aligned addresses associated with it. Ignore the offset to check + * for VRM requests. + */ + if (addr1 == addr2) + return true; + else if (SLAVE_ID(addr1) == CMD_DB_HW_VRM && VRM_ADDR(addr1) == VRM_ADDR(addr2)) + return true; + + return false; +} +EXPORT_SYMBOL_GPL(cmd_db_match_resource_addr); + /** * cmd_db_read_slave_id - Get the slave ID for a given resource address * diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c index c4c7aad957e6..561d8037b50a 100644 --- a/drivers/soc/qcom/rpmh-rsc.c +++ b/drivers/soc/qcom/rpmh-rsc.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 /* * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved. */ #define pr_fmt(fmt) "%s " fmt, KBUILD_MODNAME @@ -557,7 +558,7 @@ static int check_for_req_inflight(struct rsc_drv *drv, struct tcs_group *tcs, for_each_set_bit(j, &curr_enabled, MAX_CMDS_PER_TCS) { addr = read_tcs_cmd(drv, drv->regs[RSC_DRV_CMD_ADDR], i, j); for (k = 0; k < msg->num_cmds; k++) { - if (addr == msg->cmds[k].addr) + if (cmd_db_match_resource_addr(msg->cmds[k].addr, addr)) return -EBUSY; } } diff --git a/include/soc/qcom/cmd-db.h b/include/soc/qcom/cmd-db.h index c8bb56e6852a..47a6cab75e63 100644 --- a/include/soc/qcom/cmd-db.h +++ b/include/soc/qcom/cmd-db.h @@ -1,5 +1,8 @@ /* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. */ +/* + * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ #ifndef __QCOM_COMMAND_DB_H__ #define __QCOM_COMMAND_DB_H__ @@ -21,6 +24,8 @@ u32 cmd_db_read_addr(const char *resource_id); const void *cmd_db_read_aux_data(const char *resource_id, size_t *len); +bool cmd_db_match_resource_addr(u32 addr1, u32 addr2); + enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id); int cmd_db_ready(void); @@ -31,6 +36,9 @@ static inline u32 cmd_db_read_addr(const char *resource_id) static inline const void *cmd_db_read_aux_data(const char *resource_id, size_t *len) { return ERR_PTR(-ENODEV); } +static inline bool cmd_db_match_resource_addr(u32 addr1, u32 addr2) +{ return false; } + static inline enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id) { return -ENODEV; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x f592cc5794747b81e53b53dd6e80219ee25f0611 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061241-obscurity-phonics-bd3b@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: f592cc579474 ("soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request") 778279f4f5e4 ("soc: qcom: cmd-db: allow loading as a module") d6815c5c43d4 ("soc: qcom: cmd-db: Add debugfs dumping file") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From f592cc5794747b81e53b53dd6e80219ee25f0611 Mon Sep 17 00:00:00 2001 From: Maulik Shah <quic_mkshah(a)quicinc.com> Date: Thu, 15 Feb 2024 10:55:44 +0530 Subject: [PATCH] soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request Each RPMh VRM accelerator resource has 3 or 4 contiguous 4-byte aligned addresses associated with it. These control voltage, enable state, mode, and in legacy targets, voltage headroom. The current in-flight request checking logic looks for exact address matches. Requests for different addresses of the same RPMh resource as thus not detected as in-flight. Add new cmd-db API cmd_db_match_resource_addr() to enhance the in-flight request check for VRM requests by ignoring the address offset. This ensures that only one request is allowed to be in-flight for a given VRM resource. This is needed to avoid scenarios where request commands are carried out by RPMh hardware out-of-order leading to LDO regulator over-current protection triggering. Fixes: 658628e7ef78 ("drivers: qcom: rpmh-rsc: add RPMH controller for QCOM SoCs") Cc: stable(a)vger.kernel.org Reviewed-by: Konrad Dybcio <konrad.dybcio(a)linaro.org> Tested-by: Elliot Berman <quic_eberman(a)quicinc.com> # sm8650-qrd Signed-off-by: Maulik Shah <quic_mkshah(a)quicinc.com> Link: https://lore.kernel.org/r/20240215-rpmh-rsc-fixes-v4-1-9cbddfcba05b@quicinc… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c index c344107bc36c..b4e613c34a5c 100644 --- a/drivers/soc/qcom/cmd-db.c +++ b/drivers/soc/qcom/cmd-db.c @@ -1,6 +1,10 @@ /* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved. */ +/* + * Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ +#include <linux/bitfield.h> #include <linux/debugfs.h> #include <linux/kernel.h> #include <linux/module.h> @@ -17,6 +21,8 @@ #define MAX_SLV_ID 8 #define SLAVE_ID_MASK 0x7 #define SLAVE_ID_SHIFT 16 +#define SLAVE_ID(addr) FIELD_GET(GENMASK(19, 16), addr) +#define VRM_ADDR(addr) FIELD_GET(GENMASK(19, 4), addr) /** * struct entry_header: header for each entry in cmddb @@ -220,6 +226,30 @@ const void *cmd_db_read_aux_data(const char *id, size_t *len) } EXPORT_SYMBOL_GPL(cmd_db_read_aux_data); +/** + * cmd_db_match_resource_addr() - Compare if both Resource addresses are same + * + * @addr1: Resource address to compare + * @addr2: Resource address to compare + * + * Return: true if two addresses refer to the same resource, false otherwise + */ +bool cmd_db_match_resource_addr(u32 addr1, u32 addr2) +{ + /* + * Each RPMh VRM accelerator resource has 3 or 4 contiguous 4-byte + * aligned addresses associated with it. Ignore the offset to check + * for VRM requests. + */ + if (addr1 == addr2) + return true; + else if (SLAVE_ID(addr1) == CMD_DB_HW_VRM && VRM_ADDR(addr1) == VRM_ADDR(addr2)) + return true; + + return false; +} +EXPORT_SYMBOL_GPL(cmd_db_match_resource_addr); + /** * cmd_db_read_slave_id - Get the slave ID for a given resource address * diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c index c4c7aad957e6..561d8037b50a 100644 --- a/drivers/soc/qcom/rpmh-rsc.c +++ b/drivers/soc/qcom/rpmh-rsc.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 /* * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved. */ #define pr_fmt(fmt) "%s " fmt, KBUILD_MODNAME @@ -557,7 +558,7 @@ static int check_for_req_inflight(struct rsc_drv *drv, struct tcs_group *tcs, for_each_set_bit(j, &curr_enabled, MAX_CMDS_PER_TCS) { addr = read_tcs_cmd(drv, drv->regs[RSC_DRV_CMD_ADDR], i, j); for (k = 0; k < msg->num_cmds; k++) { - if (addr == msg->cmds[k].addr) + if (cmd_db_match_resource_addr(msg->cmds[k].addr, addr)) return -EBUSY; } } diff --git a/include/soc/qcom/cmd-db.h b/include/soc/qcom/cmd-db.h index c8bb56e6852a..47a6cab75e63 100644 --- a/include/soc/qcom/cmd-db.h +++ b/include/soc/qcom/cmd-db.h @@ -1,5 +1,8 @@ /* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. */ +/* + * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ #ifndef __QCOM_COMMAND_DB_H__ #define __QCOM_COMMAND_DB_H__ @@ -21,6 +24,8 @@ u32 cmd_db_read_addr(const char *resource_id); const void *cmd_db_read_aux_data(const char *resource_id, size_t *len); +bool cmd_db_match_resource_addr(u32 addr1, u32 addr2); + enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id); int cmd_db_ready(void); @@ -31,6 +36,9 @@ static inline u32 cmd_db_read_addr(const char *resource_id) static inline const void *cmd_db_read_aux_data(const char *resource_id, size_t *len) { return ERR_PTR(-ENODEV); } +static inline bool cmd_db_match_resource_addr(u32 addr1, u32 addr2) +{ return false; } + static inline enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id) { return -ENODEV; }

1 year, 2 months

1
0
0 0

FAILED: patch "[PATCH] soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x f592cc5794747b81e53b53dd6e80219ee25f0611 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024061240-pointing-endanger-621b@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: f592cc579474 ("soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request") 778279f4f5e4 ("soc: qcom: cmd-db: allow loading as a module") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From f592cc5794747b81e53b53dd6e80219ee25f0611 Mon Sep 17 00:00:00 2001 From: Maulik Shah <quic_mkshah(a)quicinc.com> Date: Thu, 15 Feb 2024 10:55:44 +0530 Subject: [PATCH] soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request Each RPMh VRM accelerator resource has 3 or 4 contiguous 4-byte aligned addresses associated with it. These control voltage, enable state, mode, and in legacy targets, voltage headroom. The current in-flight request checking logic looks for exact address matches. Requests for different addresses of the same RPMh resource as thus not detected as in-flight. Add new cmd-db API cmd_db_match_resource_addr() to enhance the in-flight request check for VRM requests by ignoring the address offset. This ensures that only one request is allowed to be in-flight for a given VRM resource. This is needed to avoid scenarios where request commands are carried out by RPMh hardware out-of-order leading to LDO regulator over-current protection triggering. Fixes: 658628e7ef78 ("drivers: qcom: rpmh-rsc: add RPMH controller for QCOM SoCs") Cc: stable(a)vger.kernel.org Reviewed-by: Konrad Dybcio <konrad.dybcio(a)linaro.org> Tested-by: Elliot Berman <quic_eberman(a)quicinc.com> # sm8650-qrd Signed-off-by: Maulik Shah <quic_mkshah(a)quicinc.com> Link: https://lore.kernel.org/r/20240215-rpmh-rsc-fixes-v4-1-9cbddfcba05b@quicinc… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c index c344107bc36c..b4e613c34a5c 100644 --- a/drivers/soc/qcom/cmd-db.c +++ b/drivers/soc/qcom/cmd-db.c @@ -1,6 +1,10 @@ /* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved. */ +/* + * Copyright (c) 2016-2018, 2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ +#include <linux/bitfield.h> #include <linux/debugfs.h> #include <linux/kernel.h> #include <linux/module.h> @@ -17,6 +21,8 @@ #define MAX_SLV_ID 8 #define SLAVE_ID_MASK 0x7 #define SLAVE_ID_SHIFT 16 +#define SLAVE_ID(addr) FIELD_GET(GENMASK(19, 16), addr) +#define VRM_ADDR(addr) FIELD_GET(GENMASK(19, 4), addr) /** * struct entry_header: header for each entry in cmddb @@ -220,6 +226,30 @@ const void *cmd_db_read_aux_data(const char *id, size_t *len) } EXPORT_SYMBOL_GPL(cmd_db_read_aux_data); +/** + * cmd_db_match_resource_addr() - Compare if both Resource addresses are same + * + * @addr1: Resource address to compare + * @addr2: Resource address to compare + * + * Return: true if two addresses refer to the same resource, false otherwise + */ +bool cmd_db_match_resource_addr(u32 addr1, u32 addr2) +{ + /* + * Each RPMh VRM accelerator resource has 3 or 4 contiguous 4-byte + * aligned addresses associated with it. Ignore the offset to check + * for VRM requests. + */ + if (addr1 == addr2) + return true; + else if (SLAVE_ID(addr1) == CMD_DB_HW_VRM && VRM_ADDR(addr1) == VRM_ADDR(addr2)) + return true; + + return false; +} +EXPORT_SYMBOL_GPL(cmd_db_match_resource_addr); + /** * cmd_db_read_slave_id - Get the slave ID for a given resource address * diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c index c4c7aad957e6..561d8037b50a 100644 --- a/drivers/soc/qcom/rpmh-rsc.c +++ b/drivers/soc/qcom/rpmh-rsc.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 /* * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved. */ #define pr_fmt(fmt) "%s " fmt, KBUILD_MODNAME @@ -557,7 +558,7 @@ static int check_for_req_inflight(struct rsc_drv *drv, struct tcs_group *tcs, for_each_set_bit(j, &curr_enabled, MAX_CMDS_PER_TCS) { addr = read_tcs_cmd(drv, drv->regs[RSC_DRV_CMD_ADDR], i, j); for (k = 0; k < msg->num_cmds; k++) { - if (addr == msg->cmds[k].addr) + if (cmd_db_match_resource_addr(msg->cmds[k].addr, addr)) return -EBUSY; } } diff --git a/include/soc/qcom/cmd-db.h b/include/soc/qcom/cmd-db.h index c8bb56e6852a..47a6cab75e63 100644 --- a/include/soc/qcom/cmd-db.h +++ b/include/soc/qcom/cmd-db.h @@ -1,5 +1,8 @@ /* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. */ +/* + * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ #ifndef __QCOM_COMMAND_DB_H__ #define __QCOM_COMMAND_DB_H__ @@ -21,6 +24,8 @@ u32 cmd_db_read_addr(const char *resource_id); const void *cmd_db_read_aux_data(const char *resource_id, size_t *len); +bool cmd_db_match_resource_addr(u32 addr1, u32 addr2); + enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id); int cmd_db_ready(void); @@ -31,6 +36,9 @@ static inline u32 cmd_db_read_addr(const char *resource_id) static inline const void *cmd_db_read_aux_data(const char *resource_id, size_t *len) { return ERR_PTR(-ENODEV); } +static inline bool cmd_db_match_resource_addr(u32 addr1, u32 addr2) +{ return false; } + static inline enum cmd_db_hw_type cmd_db_read_slave_id(const char *resource_id) { return -ENODEV; }

1 year, 2 months

1
0
0 0

Candidates for stable v6.9..v6.10-rc1 Out Of Bounds

by Ronnie Sahlberg

These commits reference out.of.bound between v6.9 and v6.10-rc1 These commits are not, yet, in stable/linux-rolling-stable. Let me know if you would rather me compare to a different repo/branch. The list has been manually pruned to only contain commits that look like actual issues. If they contain a Fixes line it has been verified that at least one of the commits that the Fixes tag(s) reference is in stable/linux-rolling-stable 2ba24864d2f61b52210b Syz Fuzzers, Out of bounds 3ebc46ca8675de6378e3 Syz Fuzzers, Out of bounds 9841991a446c87f90f66 Kernel panic, NULL pointer, Out of bounds 51fafb3cd7fcf4f46826 Out of bounds 45cf976008ddef4a9c9a Out of bounds 8b2faf1a4f3b6c748c0d Out of bounds faa4364bef2ec0060de3 Buffer overflow, Out of bounds 8ee1b439b1540ae54314 Out of bounds 7b4c74cf22d7584d1eb4 Out of bounds 1008368e1c7e36bdec01 Out of bounds -- Ronnie Sahlberg [Principal Software Engineer, Linux] P 775 384 8203 | E [email] | W ciq.com

1 year, 2 months

2
1
0 0

Candidates for stable v6.9..v6.10-rc1 KASAN

by Ronnie Sahlberg

These commits reference KASAN between v6.9 and v6.10-rc1 These commits are not, yet, in stable/linux-rolling-stable. Let me know if you would rather me compare to a different repo/branch. The list has been manually pruned to only contain commits that look like actual issues. If they contain a Fixes line it has been verified that at least one of the commits that the Fixes tag(s) reference is in stable/linux-rolling-stable 195aba96b854dd664768 KASAN, Out of bounds 2e577732e8d28b9183df Kernel panic, KASAN 20faaf30e55522bba2b5 KASAN, Syz Fuzzers, Out of bounds c1115ddbda9c930fba0f KASAN, NULL pointer -- Ronnie Sahlberg [Principal Software Engineer, Linux] P 775 384 8203 | E [email] | W ciq.com

1 year, 2 months

2
1
0 0

[PATCH 1/2 v5.10] netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV

by Kuntal Nayak

From: Pablo Neira Ayuso <pablo(a)netfilter.org> [ upstream commit 776d451648443f9884be4a1b4e38e8faf1c621f9 ] Bail out on using the tunnel dst template from other than netdev family. Add the infrastructure to check for the family in objects. Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> [KN: Backport patch according to v5.10.x source] Signed-off-by: Kuntal Nayak <kuntal.nayak(a)broadcom.com> --- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 14 +++++++++----- net/netfilter/nft_tunnel.c | 1 + 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 2da11d8c0..ab8d84775 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1174,6 +1174,7 @@ void nft_obj_notify(struct net *net, const struct nft_table *table, * @type: stateful object numeric type * @owner: module owner * @maxattr: maximum netlink attribute + * @family: address family for AF-specific object types * @policy: netlink attribute policy */ struct nft_object_type { @@ -1183,6 +1184,7 @@ struct nft_object_type { struct list_head list; u32 type; unsigned int maxattr; + u8 family; struct module *owner; const struct nla_policy *policy; }; diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 858d09b54..de56f25dc 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6234,11 +6234,15 @@ static int nft_object_dump(struct sk_buff *skb, unsigned int attr, return -1; } -static const struct nft_object_type *__nft_obj_type_get(u32 objtype) +static const struct nft_object_type *__nft_obj_type_get(u32 objtype, u8 family) { const struct nft_object_type *type; list_for_each_entry(type, &nf_tables_objects, list) { + if (type->family != NFPROTO_UNSPEC && + type->family != family) + continue; + if (objtype == type->type) return type; } @@ -6246,11 +6250,11 @@ static const struct nft_object_type *__nft_obj_type_get(u32 objtype) } static const struct nft_object_type * -nft_obj_type_get(struct net *net, u32 objtype) +nft_obj_type_get(struct net *net, u32 objtype, u8 family) { const struct nft_object_type *type; - type = __nft_obj_type_get(objtype); + type = __nft_obj_type_get(objtype, family); if (type != NULL && try_module_get(type->owner)) return type; @@ -6343,7 +6347,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, if (nlh->nlmsg_flags & NLM_F_REPLACE) return -EOPNOTSUPP; - type = __nft_obj_type_get(objtype); + type = __nft_obj_type_get(objtype, family); nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); @@ -6354,7 +6358,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, if (!nft_use_inc(&table->use)) return -EMFILE; - type = nft_obj_type_get(net, objtype); + type = nft_obj_type_get(net, objtype, family); if (IS_ERR(type)) { err = PTR_ERR(type); goto err_type; diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c index 2ee50996d..c8822fa81 100644 --- a/net/netfilter/nft_tunnel.c +++ b/net/netfilter/nft_tunnel.c @@ -684,6 +684,7 @@ static const struct nft_object_ops nft_tunnel_obj_ops = { static struct nft_object_type nft_tunnel_obj_type __read_mostly = { .type = NFT_OBJECT_TUNNEL, + .family = NFPROTO_NETDEV, .ops = &nft_tunnel_obj_ops, .maxattr = NFTA_TUNNEL_KEY_MAX, .policy = nft_tunnel_key_policy, -- 2.39.3

1 year, 2 months

2
2
0 0

stable-rc: queue_5.10: arch/powerpc/include/asm/uaccess.h:472:4: error: implicit declaration of function '__get_user_size' [-Werror,-Wimplicit-function-declaration]

by Naresh Kamboju

The Powerpc tinyconfig builds started failing on stable-rc queues for queue_5.10 branch from June 5, 2024. Please find the build log and related links below. Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> powerpc: * build/clang-18-tinyconfig * build/clang-nightly-tinyconfig * build/gcc-12-tinyconfig Build error: -------- arch/powerpc/include/asm/uaccess.h:472:4: error: implicit declaration of function '__get_user_size' [-Werror,-Wimplicit-function-declaration] 472 | __get_user_size(*(u8 *)to, from, 1, ret); | metadata: -------- git_describe: v5.10.218-265-g807add29e709 git_repo: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc-queues git_short_log: 807add29e709 ("SUNRPC: Fix loop termination condition in gss_free_in_token_pages()") Links: - https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_5.10/build/… - https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_5.10/build/… - https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_5.10/build/… -- Linaro LKFT https://lkft.linaro.org

1 year, 2 months

1
0
0 0

[PATCH 5.15] sunrpc: exclude from freezer when waiting for requests:

by cel＠kernel.org

From: NeilBrown <neilb(a)suse.de> Prior to v6.1, the freezer will only wake a kernel thread from an uninterruptible sleep. Since we changed svc_get_next_xprt() to use and IDLE sleep the freezer cannot wake it. We need to tell the freezer to ignore it instead. To make this work with only upstream commits, 5.15.y would need commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") which allows non-interruptible sleeps to be woken by the freezer. Fixes: 9b8a8e5e8129 ("nfsd: don't allow nfsd threads to be signalled.") Tested-by: Jon Hunter <jonathanh(a)nvidia.com> Signed-off-by: NeilBrown <neilb(a)suse.de> --- fs/nfs/callback.c | 2 +- fs/nfsd/nfs4proc.c | 3 ++- net/sunrpc/svc_xprt.c | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c index 46a0a2d6962e..8fe143cad4a2 100644 --- a/fs/nfs/callback.c +++ b/fs/nfs/callback.c @@ -124,7 +124,7 @@ nfs41_callback_svc(void *vrqstp) } else { spin_unlock_bh(&serv->sv_cb_lock); if (!kthread_should_stop()) - schedule(); + freezable_schedule(); finish_wait(&serv->sv_cb_waitq, &wq); } } diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 6779291efca9..e0ff2212866a 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -38,6 +38,7 @@ #include <linux/slab.h> #include <linux/kthread.h> #include <linux/namei.h> +#include <linux/freezer.h> #include <linux/sunrpc/addr.h> #include <linux/nfs_ssc.h> @@ -1322,7 +1323,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, /* allow 20secs for mount/unmount for now - revisit */ if (kthread_should_stop() || - (schedule_timeout(20*HZ) == 0)) { + (freezable_schedule_timeout(20*HZ) == 0)) { finish_wait(&nn->nfsd_ssc_waitq, &wait); kfree(work); return nfserr_eagain; diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c index b19592673eef..3cf53e3140a5 100644 --- a/net/sunrpc/svc_xprt.c +++ b/net/sunrpc/svc_xprt.c @@ -705,7 +705,7 @@ static int svc_alloc_arg(struct svc_rqst *rqstp) set_current_state(TASK_RUNNING); return -EINTR; } - schedule_timeout(msecs_to_jiffies(500)); + freezable_schedule_timeout(msecs_to_jiffies(500)); } rqstp->rq_page_end = &rqstp->rq_pages[pages]; rqstp->rq_pages[pages] = NULL; /* this might be seen in nfsd_splice_actor() */ @@ -765,7 +765,7 @@ static struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout) smp_mb__after_atomic(); if (likely(rqst_should_sleep(rqstp))) - time_left = schedule_timeout(timeout); + time_left = freezable_schedule_timeout(timeout); else __set_current_state(TASK_RUNNING); -- 2.45.1

1 year, 2 months

2
1
0 0

[PATCH v2] mtd: spinand: macronix: Add support for serial NAND flash

by Cheng Ming Lin

From: Cheng Ming Lin <chengminglin(a)mxic.com.tw> commit c374839f9b4475173e536d1eaddff45cb481dbdf upstream. MX35UF{1,2,4}GE4AD and MX35UF{1,2}GE4AC have been merged into Linux kernel mainline through upstream commit. For SPI-NAND flash support on Linux kernel LTS v5.4.y, add SPI-NAND flash MX35UF{1,2,4}GE4AD and MX35UF{1,2}GE4AC in id tables. Those five flashes have been validated on Xilinx zynq-picozed board and Linux kernel LTS v5.4.y. Cc: stable(a)vger.kernel.org # 5.4.y Signed-off-by: Cheng Ming Lin <chengminglin(a)mxic.com.tw> --- drivers/mtd/nand/spi/macronix.c | 45 +++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/drivers/mtd/nand/spi/macronix.c b/drivers/mtd/nand/spi/macronix.c index f18c6cfe8ff5..e1446798bfb3 100644 --- a/drivers/mtd/nand/spi/macronix.c +++ b/drivers/mtd/nand/spi/macronix.c @@ -132,6 +132,51 @@ static const struct spinand_info macronix_spinand_table[] = { &update_cache_variants), SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL)), + SPINAND_INFO("MX35UF4GE4AD", 0xb7, + NAND_MEMORG(1, 4096, 256, 64, 2048, 40, 1, 1, 1), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, + mx35lf1ge4ab_ecc_get_status)), + SPINAND_INFO("MX35UF2GE4AD", 0xa6, + NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, + mx35lf1ge4ab_ecc_get_status)), + SPINAND_INFO("MX35UF2GE4AC", 0xa2, + NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 1, 1, 1), + NAND_ECCREQ(4, 512), + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, + mx35lf1ge4ab_ecc_get_status)), + SPINAND_INFO("MX35UF1GE4AD", 0x96, + NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, + mx35lf1ge4ab_ecc_get_status)), + SPINAND_INFO("MX35UF1GE4AC", 0x92, + NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1), + NAND_ECCREQ(4, 512), + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, + mx35lf1ge4ab_ecc_get_status)), }; static int macronix_spinand_detect(struct spinand_device *spinand) -- 2.25.1

1 year, 2 months

2
1
0 0

[PATCH net] bnx2x: Fix multiple UBSAN array-index-out-of-bounds

by Ghadi Elie Rahme

Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of ethernet queues greater than or equal to FP_SB_MAX_E1x. The value of the maximum number of Ethernet queues should be limited to FP_SB_MAX_E1x in case FCOE is disabled or to [FP_SB_MAX_E1x-1] if enabled to avoid out of bounds reads and writes. Stack trace: UBSAN: array-index-out-of-bounds in /home/kernel/COD/linux/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2e1/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 __dev_change_flags+0x1bb/0x240 ? sock_def_readable+0x52/0xf0 dev_change_flags+0x27/0x80 do_setlink+0xab7/0xe50 ? rtnl_getlink+0x3c7/0x470 ? __nla_validate_parse+0x49/0x1d0 rtnl_setlink+0x12f/0x1f0 ? security_capable+0x47/0x80 rtnetlink_rcv_msg+0x170/0x440 ? ep_done_scan+0xe4/0x100 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5d/0x110 rtnetlink_rcv+0x15/0x30 netlink_unicast+0x243/0x380 netlink_sendmsg+0x213/0x460 __sys_sendto+0x21e/0x230 __x64_sys_sendto+0x24/0x40 x64_sys_call+0x1c33/0x25c0 do_syscall_64+0x7e/0x180 ? __task_pid_nr_ns+0x6c/0xc0 ? syscall_exit_to_user_mode+0x81/0x270 ? do_syscall_64+0x8b/0x180 ? do_syscall_64+0x8b/0x180 ? __task_pid_nr_ns+0x6c/0xc0 ? syscall_exit_to_user_mode+0x81/0x270 ? do_syscall_64+0x8b/0x180 ? do_syscall_64+0x8b/0x180 ? exc_page_fault+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in /home/kernel/COD/linux/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1546:11 index 28 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2fd/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 __dev_change_flags+0x1bb/0x240 ? sock_def_readable+0x52/0xf0 dev_change_flags+0x27/0x80 do_setlink+0xab7/0xe50 ? rtnl_getlink+0x3c7/0x470 ? __nla_validate_parse+0x49/0x1d0 rtnl_setlink+0x12f/0x1f0 ? security_capable+0x47/0x80 rtnetlink_rcv_msg+0x170/0x440 ? ep_done_scan+0xe4/0x100 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5d/0x110 rtnetlink_rcv+0x15/0x30 netlink_unicast+0x243/0x380 netlink_sendmsg+0x213/0x460 __sys_sendto+0x21e/0x230 __x64_sys_sendto+0x24/0x40 x64_sys_call+0x1c33/0x25c0 do_syscall_64+0x7e/0x180 ? __task_pid_nr_ns+0x6c/0xc0 ? syscall_exit_to_user_mode+0x81/0x270 ? do_syscall_64+0x8b/0x180 ? do_syscall_64+0x8b/0x180 ? __task_pid_nr_ns+0x6c/0xc0 ? syscall_exit_to_user_mode+0x81/0x270 ? do_syscall_64+0x8b/0x180 ? do_syscall_64+0x8b/0x180 ? exc_page_fault+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- bnx2x 0000:04:00.1: 32.000 Gb/s available PCIe bandwidth (5.0 GT/s PCIe x8 link) bnx2x 0000:04:00.1 eno50: renamed from eth0 ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in /home/kernel/COD/linux/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1895:8 index 29 is out of range for type 'stats_query_entry [19]' CPU: 13 PID: 163 Comm: kworker/u96:1 Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Workqueue: bnx2x bnx2x_sp_task [bnx2x] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_iov_adjust_stats_req+0x3c4/0x3d0 [bnx2x] bnx2x_storm_stats_post.part.0+0x4a/0x330 [bnx2x] ? bnx2x_hw_stats_post+0x231/0x250 [bnx2x] bnx2x_stats_start+0x44/0x70 [bnx2x] bnx2x_stats_handle+0x149/0x350 [bnx2x] bnx2x_attn_int_asserted+0x998/0x9b0 [bnx2x] bnx2x_sp_task+0x491/0x5c0 [bnx2x] process_one_work+0x18d/0x3f0 worker_thread+0x304/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xe4/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x47/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace ]--- Fixes: 7d0445d66a76 ("bnx2x: clamp num_queues to prevent passing a negative value") Signed-off-by: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index a8e07e51418f..837617b99089 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -66,7 +66,12 @@ static int bnx2x_calc_num_queues(struct bnx2x *bp) if (is_kdump_kernel()) nq = 1; - nq = clamp(nq, 1, BNX2X_MAX_QUEUES(bp)); + int max_nq = FP_SB_MAX_E1x - 1; + + if(NO_FCOE(bp)) + max_nq = FP_SB_MAX_E1x; + + nq = clamp(nq, 1, max_nq); return nq; } -- 2.43.0

1 year, 2 months

4
3
0 0

[PATCH 6.9.y] erofs: avoid allocating DEFLATE streams before mounting

by Gao Xiang

commit 80eb4f62056d6ae709bdd0636ab96ce660f494b2 upstream. Currently, each DEFLATE stream takes one 32 KiB permanent internal window buffer even if there is no running instance which uses DEFLATE algorithm. It's unexpected and wasteful on embedded devices with limited resources and servers with hundreds of CPU cores if DEFLATE is enabled but unused. Fixes: ffa09b3bd024 ("erofs: DEFLATE compression support") Cc: <stable(a)vger.kernel.org> # 6.6+ Reviewed-by: Sandeep Dhavale <dhavale(a)google.com> Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20240520090106.2898681-1-hsiangkao@linux.alibaba.… --- fs/erofs/decompressor_deflate.c | 55 +++++++++++++++++---------------- 1 file changed, 29 insertions(+), 26 deletions(-) diff --git a/fs/erofs/decompressor_deflate.c b/fs/erofs/decompressor_deflate.c index 81e65c453ef0..3a3461561a3c 100644 --- a/fs/erofs/decompressor_deflate.c +++ b/fs/erofs/decompressor_deflate.c @@ -46,39 +46,15 @@ int __init z_erofs_deflate_init(void) /* by default, use # of possible CPUs instead */ if (!z_erofs_deflate_nstrms) z_erofs_deflate_nstrms = num_possible_cpus(); - - for (; z_erofs_deflate_avail_strms < z_erofs_deflate_nstrms; - ++z_erofs_deflate_avail_strms) { - struct z_erofs_deflate *strm; - - strm = kzalloc(sizeof(*strm), GFP_KERNEL); - if (!strm) - goto out_failed; - - /* XXX: in-kernel zlib cannot shrink windowbits currently */ - strm->z.workspace = vmalloc(zlib_inflate_workspacesize()); - if (!strm->z.workspace) { - kfree(strm); - goto out_failed; - } - - spin_lock(&z_erofs_deflate_lock); - strm->next = z_erofs_deflate_head; - z_erofs_deflate_head = strm; - spin_unlock(&z_erofs_deflate_lock); - } return 0; - -out_failed: - erofs_err(NULL, "failed to allocate zlib workspace"); - z_erofs_deflate_exit(); - return -ENOMEM; } int z_erofs_load_deflate_config(struct super_block *sb, struct erofs_super_block *dsb, void *data, int size) { struct z_erofs_deflate_cfgs *dfl = data; + static DEFINE_MUTEX(deflate_resize_mutex); + static bool inited; if (!dfl || size < sizeof(struct z_erofs_deflate_cfgs)) { erofs_err(sb, "invalid deflate cfgs, size=%u", size); @@ -89,9 +65,36 @@ int z_erofs_load_deflate_config(struct super_block *sb, erofs_err(sb, "unsupported windowbits %u", dfl->windowbits); return -EOPNOTSUPP; } + mutex_lock(&deflate_resize_mutex); + if (!inited) { + for (; z_erofs_deflate_avail_strms < z_erofs_deflate_nstrms; + ++z_erofs_deflate_avail_strms) { + struct z_erofs_deflate *strm; + + strm = kzalloc(sizeof(*strm), GFP_KERNEL); + if (!strm) + goto failed; + /* XXX: in-kernel zlib cannot customize windowbits */ + strm->z.workspace = vmalloc(zlib_inflate_workspacesize()); + if (!strm->z.workspace) { + kfree(strm); + goto failed; + } + spin_lock(&z_erofs_deflate_lock); + strm->next = z_erofs_deflate_head; + z_erofs_deflate_head = strm; + spin_unlock(&z_erofs_deflate_lock); + } + inited = true; + } + mutex_unlock(&deflate_resize_mutex); erofs_info(sb, "EXPERIMENTAL DEFLATE feature in use. Use at your own risk!"); return 0; +failed: + mutex_unlock(&deflate_resize_mutex); + z_erofs_deflate_exit(); + return -ENOMEM; } int z_erofs_deflate_decompress(struct z_erofs_decompress_req *rq, -- 2.39.3

1 year, 2 months

2
5
0 0

[PATCH 4.19.y] neighbour: fix unaligned access to pneigh_entry

by Qingfang Deng

From: Qingfang Deng <qingfang.deng(a)siflower.com.cn> [ Upstream commit ed779fe4c9b5a20b4ab4fd6f3e19807445bb78c7 ] After the blamed commit, the member key is longer 4-byte aligned. On platforms that do not support unaligned access, e.g., MIPS32R2 with unaligned_action set to 1, this will trigger a crash when accessing an IPv6 pneigh_entry, as the key is cast to an in6_addr pointer. Change the type of the key to u32 to make it aligned. Fixes: 62dd93181aaa ("[IPV6] NDISC: Set per-entry is_router flag in Proxy NA.") Signed-off-by: Qingfang Deng <qingfang.deng(a)siflower.com.cn> --- include/net/neighbour.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/neighbour.h b/include/net/neighbour.h index e58ef9e338de..4c53e51f0799 100644 --- a/include/net/neighbour.h +++ b/include/net/neighbour.h @@ -172,7 +172,7 @@ struct pneigh_entry { possible_net_t net; struct net_device *dev; u8 flags; - u8 key[0]; + u32 key[0]; }; /* -- 2.34.1

1 year, 2 months

2
1
0 0

[PATCH stable-5.15.y 0/2] Fix PTP received on wrong port with bridged SJA1105 DSA

by Vladimir Oltean

It has been brought to my attention that what had been fixed 1 year ago here for kernels 5.18 and later: https://lore.kernel.org/netdev/20230626155112.3155993-1-vladimir.oltean@nxp… is still broken on linux-5.15.y. Short summary: PTP boundary clock is broken for ports under a VLAN-aware bridge. The reason is that the Fixes: tags in those patches were wrong. The issue originated from earlier, but the changes from 5.18 (blamed there), aka DSA FDB isolation, masked that. A straightforward cherry-pick was not possible, due to the conflict with the aforementioned DSA FDB isolation work from 5.18. So I redid patch 2/2 and marked what I had to adapt. Tested on the NXP LS1021A-TSN board. Vladimir Oltean (2): net: dsa: sja1105: always enable the INCL_SRCPT option net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT drivers/net/dsa/sja1105/sja1105_main.c | 9 ++----- net/dsa/tag_sja1105.c | 34 ++++++++++++++++++++------ 2 files changed, 28 insertions(+), 15 deletions(-) --- I'm sorry for the people who will want to backport DSA FDB isolation to linux-5.15.y :( -- 2.34.1

1 year, 2 months

2
3
0 0

[PATCH 5.10.y] x86/mm: Remove broken vsyscall emulation code from the page fault code

by Guilherme G. Piccoli

From: Linus Torvalds <torvalds(a)linux-foundation.org> commit 02b670c1f88e78f42a6c5aee155c7b26960ca054 upstream. The syzbot-reported stack trace from hell in this discussion thread actually has three nested page faults: https://lore.kernel.org/r/000000000000d5f4fc0616e816d4@google.com ... and I think that's actually the important thing here: - the first page fault is from user space, and triggers the vsyscall emulation. - the second page fault is from __do_sys_gettimeofday(), and that should just have caused the exception that then sets the return value to -EFAULT - the third nested page fault is due to _raw_spin_unlock_irqrestore() -> preempt_schedule() -> trace_sched_switch(), which then causes a BPF trace program to run, which does that bpf_probe_read_compat(), which causes that page fault under pagefault_disable(). It's quite the nasty backtrace, and there's a lot going on. The problem is literally the vsyscall emulation, which sets current->thread.sig_on_uaccess_err = 1; and that causes the fixup_exception() code to send the signal *despite* the exception being caught. And I think that is in fact completely bogus. It's completely bogus exactly because it sends that signal even when it *shouldn't* be sent - like for the BPF user mode trace gathering. In other words, I think the whole "sig_on_uaccess_err" thing is entirely broken, because it makes any nested page-faults do all the wrong things. Now, arguably, I don't think anybody should enable vsyscall emulation any more, but this test case clearly does. I think we should just make the "send SIGSEGV" be something that the vsyscall emulation does on its own, not this broken per-thread state for something that isn't actually per thread. The x86 page fault code actually tried to deal with the "incorrect nesting" by having that: if (in_interrupt()) return; which ignores the sig_on_uaccess_err case when it happens in interrupts, but as shown by this example, these nested page faults do not need to be about interrupts at all. IOW, I think the only right thing is to remove that horrendously broken code. The attached patch looks like the ObviouslyCorrect(tm) thing to do. NOTE! This broken code goes back to this commit in 2011: 4fc3490114bb ("x86-64: Set siginfo and context on vsyscall emulation faults") ... and back then the reason was to get all the siginfo details right. Honestly, I do not for a moment believe that it's worth getting the siginfo details right here, but part of the commit says: This fixes issues with UML when vsyscall=emulate. ... and so my patch to remove this garbage will probably break UML in this situation. I do not believe that anybody should be running with vsyscall=emulate in 2024 in the first place, much less if you are doing things like UML. But let's see if somebody screams. Reported-and-tested-by: syzbot+83e7f982ca045ab4405c(a)syzkaller.appspotmail.com Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Tested-by: Jiri Olsa <jolsa(a)kernel.org> Acked-by: Andy Lutomirski <luto(a)kernel.org> Link: https://lore.kernel.org/r/CAHk-=wh9D6f7HUkDgZHKmDCHUQmp+Co89GP+b8+z+G56BKey… Signed-off-by: Sasha Levin <sashal(a)kernel.org> [gpiccoli: Backport the patch due to differences in the trees. The main change between 5.10.y and 5.15.y is due to renaming the fixup function, by commit 6456a2a69ee1 ("x86/fault: Rename no_context() to kernelmode_fixup_or_oops()"). Following 2 commits cause divergence in the diffs too (in the removed lines): cd072dab453a ("x86/fault: Add a helper function to sanitize error code") d4ffd5df9d18 ("x86/fault: Fix wrong signal when vsyscall fails with pkey") Finally, there is context adjustment in the processor.h file.] Signed-off-by: Guilherme G. Piccoli <gpiccoli(a)igalia.com> --- Hi folks, this was backported by AUTOSEL up to 5.15.y; I'm manually submitting the backport to 5.4.y and 5.10.y. I've detailed a bit the changes necessary due to other nonrelated missing patches, but these are really simple and non-intrusive. Nevertheless, I've explicitely CCed x86 ML to be sure the maintainers are aware of the backport, and if anybody thinks we shouldn't do it for these (very) old releases, please respond here. Cheers, Guilherme arch/x86/entry/vsyscall/vsyscall_64.c | 28 ++------------------------- arch/x86/include/asm/processor.h | 1 - arch/x86/mm/fault.c | 27 +------------------------- 3 files changed, 3 insertions(+), 53 deletions(-) diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c index 44c33103a955..f0b817eb6e8b 100644 --- a/arch/x86/entry/vsyscall/vsyscall_64.c +++ b/arch/x86/entry/vsyscall/vsyscall_64.c @@ -98,11 +98,6 @@ static int addr_to_vsyscall_nr(unsigned long addr) static bool write_ok_or_segv(unsigned long ptr, size_t size) { - /* - * XXX: if access_ok, get_user, and put_user handled - * sig_on_uaccess_err, this could go away. - */ - if (!access_ok((void __user *)ptr, size)) { struct thread_struct *thread = &current->thread; @@ -120,10 +115,8 @@ static bool write_ok_or_segv(unsigned long ptr, size_t size) bool emulate_vsyscall(unsigned long error_code, struct pt_regs *regs, unsigned long address) { - struct task_struct *tsk; unsigned long caller; int vsyscall_nr, syscall_nr, tmp; - int prev_sig_on_uaccess_err; long ret; unsigned long orig_dx; @@ -172,8 +165,6 @@ bool emulate_vsyscall(unsigned long error_code, goto sigsegv; } - tsk = current; - /* * Check for access_ok violations and find the syscall nr. * @@ -233,12 +224,8 @@ bool emulate_vsyscall(unsigned long error_code, goto do_ret; /* skip requested */ /* - * With a real vsyscall, page faults cause SIGSEGV. We want to - * preserve that behavior to make writing exploits harder. + * With a real vsyscall, page faults cause SIGSEGV. */ - prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err; - current->thread.sig_on_uaccess_err = 1; - ret = -EFAULT; switch (vsyscall_nr) { case 0: @@ -261,23 +248,12 @@ bool emulate_vsyscall(unsigned long error_code, break; } - current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err; - check_fault: if (ret == -EFAULT) { /* Bad news -- userspace fed a bad pointer to a vsyscall. */ warn_bad_vsyscall(KERN_INFO, regs, "vsyscall fault (exploit attempt?)"); - - /* - * If we failed to generate a signal for any reason, - * generate one here. (This should be impossible.) - */ - if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) && - !sigismember(&tsk->pending.signal, SIGSEGV))) - goto sigsegv; - - return true; /* Don't emulate the ret. */ + goto sigsegv; } regs->ax = ret; diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h index 6dc3c5f0be07..c682a14299e0 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -528,7 +528,6 @@ struct thread_struct { unsigned long iopl_emul; unsigned int iopl_warn:1; - unsigned int sig_on_uaccess_err:1; /* Floating point and extended processor state */ struct fpu fpu; diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index cdb337cf92ba..98a5924d98b7 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -649,33 +649,8 @@ no_context(struct pt_regs *regs, unsigned long error_code, } /* Are we prepared to handle this kernel fault? */ - if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) { - /* - * Any interrupt that takes a fault gets the fixup. This makes - * the below recursive fault logic only apply to a faults from - * task context. - */ - if (in_interrupt()) - return; - - /* - * Per the above we're !in_interrupt(), aka. task context. - * - * In this case we need to make sure we're not recursively - * faulting through the emulate_vsyscall() logic. - */ - if (current->thread.sig_on_uaccess_err && signal) { - set_signal_archinfo(address, error_code); - - /* XXX: hwpoison faults will set the wrong code. */ - force_sig_fault(signal, si_code, (void __user *)address); - } - - /* - * Barring that, we can do the fixup and be happy. - */ + if (fixup_exception(regs, X86_TRAP_PF, error_code, address)) return; - } #ifdef CONFIG_VMAP_STACK /* -- 2.45.1

1 year, 2 months

2
1
0 0

[PATCH 6.6.y 0/4] Fix missing net_helper.sh for net/udpgro_fwd.sh test

by Po-Hsu Lin

Since upstream commit 4acffb66 "selftests: net: explicitly wait for listener ready", the net_helper.sh from commit 3bdd9fd2 "selftests/net: synchronize udpgro tests' tx and rx connection" will be needed. Otherwise selftests/net/udpgro_fwd.sh will complain about: $ sudo ./udpgro_fwd.sh ./udpgro_fwd.sh: line 4: net_helper.sh: No such file or directory IPv4 No GRO ./udpgro_fwd.sh: line 134: wait_local_port_listen: command not found Patch "selftests/net: synchronize udpgro tests' tx and rx connection" adds the missing net_helper.sh. Context adjustment is needed for applying this patch, as the BPF_FILE is different in 6.6.y Patch "selftests: net: Remove executable bits from library scripts" fixes the script permission. Patch "selftests: net: included needed helper in the install targets" and "selftests: net: List helper scripts in TEST_FILES Makefile variable" will add this helper to the Makefile and fix the installation, lib.sh needs to be ignored for them. Benjamin Poirier (2): selftests: net: Remove executable bits from library scripts selftests: net: List helper scripts in TEST_FILES Makefile variable Lucas Karpinski (1): selftests/net: synchronize udpgro tests' tx and rx connection Paolo Abeni (1): selftests: net: included needed helper in the install targets tools/testing/selftests/net/Makefile | 4 ++-- tools/testing/selftests/net/net_helper.sh | 22 ++++++++++++++++++++++ tools/testing/selftests/net/setup_loopback.sh | 0 tools/testing/selftests/net/udpgro.sh | 13 ++++++------- tools/testing/selftests/net/udpgro_bench.sh | 5 +++-- tools/testing/selftests/net/udpgro_frglist.sh | 5 +++-- 6 files changed, 36 insertions(+), 13 deletions(-) create mode 100644 tools/testing/selftests/net/net_helper.sh mode change 100755 => 100644 tools/testing/selftests/net/setup_loopback.sh -- 2.7.4

1 year, 2 months

2
5
0 0

[PATCH stable 4.19 up to 6.8] vxlan: Fix regression when dropping packets due to invalid src addresses

by Daniel Borkmann

[ Upstream commit 1cd4bc987abb2823836cbb8f887026011ccddc8a ] Commit f58f45c1e5b9 ("vxlan: drop packets from invalid src-address") has recently been added to vxlan mainly in the context of source address snooping/learning so that when it is enabled, an entry in the FDB is not being created for an invalid address for the corresponding tunnel endpoint. Before commit f58f45c1e5b9 vxlan was similarly behaving as geneve in that it passed through whichever macs were set in the L2 header. It turns out that this change in behavior breaks setups, for example, Cilium with netkit in L3 mode for Pods as well as tunnel mode has been passing before the change in f58f45c1e5b9 for both vxlan and geneve. After mentioned change it is only passing for geneve as in case of vxlan packets are dropped due to vxlan_set_mac() returning false as source and destination macs are zero which for E/W traffic via tunnel is totally fine. Fix it by only opting into the is_valid_ether_addr() check in vxlan_set_mac() when in fact source address snooping/learning is actually enabled in vxlan. This is done by moving the check into vxlan_snoop(). With this change, the Cilium connectivity test suite passes again for both tunnel flavors. Fixes: f58f45c1e5b9 ("vxlan: drop packets from invalid src-address") Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: David Bauer <mail(a)david-bauer.net> Cc: Ido Schimmel <idosch(a)nvidia.com> Cc: Nikolay Aleksandrov <razor(a)blackwall.org> Cc: Martin KaFai Lau <martin.lau(a)kernel.org> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reviewed-by: David Bauer <mail(a)david-bauer.net> Signed-off-by: David S. Miller <davem(a)davemloft.net> [ Backport note: vxlan snooping/learning not supported in 6.8 or older, so commit is simply a revert. ] Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> --- drivers/net/vxlan/vxlan_core.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c index 0a0b4a9717ce..1d0688610189 100644 --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -1615,10 +1615,6 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan, if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr)) return false; - /* Ignore packets from invalid src-address */ - if (!is_valid_ether_addr(eth_hdr(skb)->h_source)) - return false; - /* Get address from the outer IP header */ if (vxlan_get_sk_family(vs) == AF_INET) { saddr.sin.sin_addr.s_addr = ip_hdr(skb)->saddr; -- 2.34.1

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] x86/topology/amd: Evaluate SMT in CPUID leaf 0x8000001e only" failed to apply to 6.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y git checkout FETCH_HEAD git cherry-pick -x 34bf6bae3286a58762711cfbce2cf74ecd42e1b5 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024060624-platinum-ladies-9214@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^.. Possible dependencies: 34bf6bae3286 ("x86/topology/amd: Evaluate SMT in CPUID leaf 0x8000001e only on family 0x17 and greater") 21f546a43a91 ("Merge branch 'x86/urgent' into x86/cpu, to resolve conflict") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 34bf6bae3286a58762711cfbce2cf74ecd42e1b5 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner <tglx(a)linutronix.de> Date: Tue, 28 May 2024 22:21:31 +0200 Subject: [PATCH] x86/topology/amd: Evaluate SMT in CPUID leaf 0x8000001e only on family 0x17 and greater The new AMD/HYGON topology parser evaluates the SMT information in CPUID leaf 0x8000001e unconditionally while the original code restricted it to CPUs with family 0x17 and greater. This breaks family 0x15 CPUs which advertise that leaf and have a non-zero value in the SMT section. The machine boots, but the scheduler complains loudly about the mismatch of the core IDs: WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6482 sched_cpu_starting+0x183/0x250 WARNING: CPU: 0 PID: 1 at kernel/sched/topology.c:2408 build_sched_domains+0x76b/0x12b0 Add the condition back to cure it. [ bp: Make it actually build because grandpa is not concerned with trivial stuff. :-P ] Fixes: f7fb3b2dd92c ("x86/cpu: Provide an AMD/HYGON specific topology parser") Closes: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/56 Reported-by: Tim Teichmann <teichmanntim(a)outlook.de> Reported-by: Christian Heusel <christian(a)heusel.eu> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Tested-by: Tim Teichmann <teichmanntim(a)outlook.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/7skhx6mwe4hxiul64v6azhlxnokheorksqsdbp7qw6g2jduf6… diff --git a/arch/x86/kernel/cpu/topology_amd.c b/arch/x86/kernel/cpu/topology_amd.c index d419deed6a48..7d476fa697ca 100644 --- a/arch/x86/kernel/cpu/topology_amd.c +++ b/arch/x86/kernel/cpu/topology_amd.c @@ -84,9 +84,9 @@ static bool parse_8000_001e(struct topo_scan *tscan, bool has_topoext) /* * If leaf 0xb is available, then the domain shifts are set - * already and nothing to do here. + * already and nothing to do here. Only valid for family >= 0x17. */ - if (!has_topoext) { + if (!has_topoext && tscan->c->x86 >= 0x17) { /* * Leaf 0x80000008 set the CORE domain shift already. * Update the SMT domain, but do not propagate it.

1 year, 2 months

3
3
0 0

[PATCH 6.6.y] mm: ratelimit stat flush from workingset shrinker

by Jesper Dangaard Brouer

From: Shakeel Butt <shakeelb(a)google.com> commit d4a5b369ad6d8aae552752ff438dddde653a72ec upstream. One of our workloads (Postgres 14 + sysbench OLTP) regressed on newer upstream kernel and on further investigation, it seems like the cause is the always synchronous rstat flush in the count_shadow_nodes() added by the commit f82e6bf9bb9b ("mm: memcg: use rstat for non-hierarchical stats"). On further inspection it seems like we don't really need accurate stats in this function as it was already approximating the amount of appropriate shadow entries to keep for maintaining the refault information. Since there is already 2 sec periodic rstat flush, we don't need exact stats here. Let's ratelimit the rstat flush in this code path. Link: https://lkml.kernel.org/r/20231228073055.4046430-1-shakeelb@google.com Fixes: f82e6bf9bb9b ("mm: memcg: use rstat for non-hierarchical stats") Signed-off-by: Shakeel Butt <shakeelb(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Yosry Ahmed <yosryahmed(a)google.com> Cc: Yu Zhao <yuzhao(a)google.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Muchun Song <songmuchun(a)bytedance.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Jesper Dangaard Brouer <hawk(a)kernel.org> --- On production with kernel v6.6 we are observing issues with excessive cgroup rstat flushing due to the extra call to mem_cgroup_flush_stats() in count_shadow_nodes() introduced in commit f82e6bf9bb9b ("mm: memcg: use rstat for non-hierarchical stats") that commit is part of v6.6. We request backport of commit d4a5b369ad6d ("mm: ratelimit stat flush from workingset shrinker") as it have a fixes tag for this commit. IMHO it is worth explaining call path that makes count_shadow_nodes() cause excessive cgroup rstat flushing calls. Function shrink_node() calls mem_cgroup_flush_stats() on its own first, and then invokes shrink_node_memcgs(). Function shrink_node_memcgs() iterates over cgroups via mem_cgroup_iter() for each calling shrink_slab(). The shrink_slab() calls do_shrink_slab() that via shrinker->count_objects() invoke count_shadow_nodes(), and count_shadow_nodes() does a mem_cgroup_flush_stats() call, that seems unnecessary. Backport differs slightly due to v6.6.32 doesn't contain commit 7d7ef0a4686a ("mm: memcg: restore subtree stats flushing") from v6.8. --- mm/workingset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/workingset.c b/mm/workingset.c index 2559a1f2fc1c..9110957bec5b 100644 --- a/mm/workingset.c +++ b/mm/workingset.c @@ -664,7 +664,7 @@ static unsigned long count_shadow_nodes(struct shrinker *shrinker, struct lruvec *lruvec; int i; - mem_cgroup_flush_stats(); + mem_cgroup_flush_stats_ratelimited(); lruvec = mem_cgroup_lruvec(sc->memcg, NODE_DATA(sc->nid)); for (pages = 0, i = 0; i < NR_LRU_LISTS; i++) pages += lruvec_page_state_local(lruvec,

1 year, 2 months

3
3
0 0

Are the 'FAILED' notifications always sent?

by Matthieu Baerts

Hi Sasha, Thank you for the recent backports linked to MPTCP. Recently, I noticed that two patches [1] [2] with the same "Fixes" tag -- but without "Cc: stable", sorry for that -- have been backported to different stable versions. That's good, thank you! The first patch made its way to v5.15, while the second one went up to v6.8, but not to older stable versions. I understand it didn't go further because of other conflicts, and I'm ready to help to fix them. I just wanted to know if it is normal I didn't get any 'FAILED' notifications like the ones Greg send [3]: I rely on them to know which patches have been treated by the Stable team, but had conflicts. Will I get these notifications later (no hurry), or should I not rely on them to track fixes that could not be backported? Cheers, Matt [1] https://lore.kernel.org/mptcp/20240514011335.176158-2-martineau@kernel.org/ [2] https://lore.kernel.org/mptcp/20240514011335.176158-3-martineau@kernel.org/ [3] 'FAILED: patch "[PATCH] (...)" failed to apply to x.y-stable tree' -- Sponsored by the NGI0 Core fund.

1 year, 2 months

2
2
0 0

[PATCH 6.6.y 0/3] Backport of "mptcp: fix full TCP keep-alive support"

by Matthieu Baerts (NGI0)

It looks like the patch "mptcp: fix full TCP keep-alive support" has been backported up to v6.8 recently (thanks!), but not before due to conflicts. I had to adapt a bit the code not to backport new features, but the modifications were simple, and isolated from the rest. MPTCP sockopt tests have been executed, and no issues have been reported. Matthieu Baerts (NGI0) (1): mptcp: fix full TCP keep-alive support Paolo Abeni (2): mptcp: avoid some duplicate code in socket option handling mptcp: cleanup SOL_TCP handling net/mptcp/protocol.h | 3 ++ net/mptcp/sockopt.c | 123 +++++++++++++++++++++++++++++-------------- 2 files changed, 87 insertions(+), 39 deletions(-) -- 2.43.0

1 year, 2 months

2
4
0 0

[PATCH] Revert "drm/amdgpu: init iommu after amdkfd device init"

by Armin Wolf

This reverts commit 56b522f4668167096a50c39446d6263c96219f5f. A user reported that this commit breaks the integrated gpu of his notebook, causing a black screen. He was able to bisect the problematic commit and verified that by reverting it the notebook works again. He also confirmed that kernel 6.8.1 also works on his device, so the upstream commit itself seems to be ok. An amdgpu developer (Alex Deucher) confirmed that this patch should have never been ported to 5.15 in the first place, so revert this commit from the 5.15 stable series. Reported-by: Barry Kauler <bkauler(a)gmail.com> Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index 222a1d9ecf16..5f6c32ec674d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -2487,6 +2487,10 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) if (r) goto init_failed; + r = amdgpu_amdkfd_resume_iommu(adev); + if (r) + goto init_failed; + r = amdgpu_device_ip_hw_init_phase1(adev); if (r) goto init_failed; @@ -2525,10 +2529,6 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) if (!adev->gmc.xgmi.pending_reset) amdgpu_amdkfd_device_init(adev); - r = amdgpu_amdkfd_resume_iommu(adev); - if (r) - goto init_failed; - amdgpu_fru_get_product_info(adev); init_failed: -- 2.39.2

1 year, 2 months

5
6
0 0

Re: Patch "platform/x86: xiaomi-wmi: Fix race condition when reporting key events" has been added to the 6.6-stable tree

by Armin Wolf

Am 26.05.24 um 21:43 schrieb Sasha Levin: > This is a note to let you know that I've just added the patch titled > > platform/x86: xiaomi-wmi: Fix race condition when reporting key events > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > Hi, the underlying race condition can only be triggered since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs"), which afaik was introduced with kernel 6.8. Because of this, i do not think that we have to backport this commit to kernels before 6.8. Thanks, Armin Wolf > > commit 831f943a69833152081ec7393af598f0c8b415fa > Author: Armin Wolf <W_Armin(a)gmx.de> > Date: Tue Apr 2 16:30:57 2024 +0200 > > platform/x86: xiaomi-wmi: Fix race condition when reporting key events > > [ Upstream commit 290680c2da8061e410bcaec4b21584ed951479af ] > > Multiple WMI events can be received concurrently, so multiple instances > of xiaomi_wmi_notify() can be active at the same time. Since the input > device is shared between those handlers, the key input sequence can be > disturbed. > > Fix this by protecting the key input sequence with a mutex. > > Compile-tested only. > > Fixes: edb73f4f0247 ("platform/x86: wmi: add Xiaomi WMI key driver") > Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> > Link: https://lore.kernel.org/r/20240402143059.8456-2-W_Armin@gmx.de > Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy(a)linux.intel.com> > Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> > Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/platform/x86/xiaomi-wmi.c b/drivers/platform/x86/xiaomi-wmi.c > index 54a2546bb93bf..be80f0bda9484 100644 > --- a/drivers/platform/x86/xiaomi-wmi.c > +++ b/drivers/platform/x86/xiaomi-wmi.c > @@ -2,8 +2,10 @@ > /* WMI driver for Xiaomi Laptops */ > > #include <linux/acpi.h> > +#include <linux/device.h> > #include <linux/input.h> > #include <linux/module.h> > +#include <linux/mutex.h> > #include <linux/wmi.h> > > #include <uapi/linux/input-event-codes.h> > @@ -20,12 +22,21 @@ > > struct xiaomi_wmi { > struct input_dev *input_dev; > + struct mutex key_lock; /* Protects the key event sequence */ > unsigned int key_code; > }; > > +static void xiaomi_mutex_destroy(void *data) > +{ > + struct mutex *lock = data; > + > + mutex_destroy(lock); > +} > + > static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context) > { > struct xiaomi_wmi *data; > + int ret; > > if (wdev == NULL || context == NULL) > return -EINVAL; > @@ -35,6 +46,11 @@ static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context) > return -ENOMEM; > dev_set_drvdata(&wdev->dev, data); > > + mutex_init(&data->key_lock); > + ret = devm_add_action_or_reset(&wdev->dev, xiaomi_mutex_destroy, &data->key_lock); > + if (ret < 0) > + return ret; > + > data->input_dev = devm_input_allocate_device(&wdev->dev); > if (data->input_dev == NULL) > return -ENOMEM; > @@ -59,10 +75,12 @@ static void xiaomi_wmi_notify(struct wmi_device *wdev, union acpi_object *dummy) > if (data == NULL) > return; > > + mutex_lock(&data->key_lock); > input_report_key(data->input_dev, data->key_code, 1); > input_sync(data->input_dev); > input_report_key(data->input_dev, data->key_code, 0); > input_sync(data->input_dev); > + mutex_unlock(&data->key_lock); > } > > static const struct wmi_device_id xiaomi_wmi_id_table[] = {

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] drm/i915/audio: Fix audio time stamp programming for DP" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x c66b8356273c8d22498f88e4223af47a7bf8a23c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024051325-ipad-sturdily-5677@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: c66b8356273c ("drm/i915/audio: Fix audio time stamp programming for DP") 46e61ee4e01e ("drm/i915/audio: s/dev_priv/i915/") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From c66b8356273c8d22498f88e4223af47a7bf8a23c Mon Sep 17 00:00:00 2001 From: Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> Date: Tue, 30 Apr 2024 14:48:25 +0530 Subject: [PATCH] drm/i915/audio: Fix audio time stamp programming for DP Intel hardware is capable of programming the Maud/Naud SDPs on its own based on real-time clocks. While doing so, it takes care of any deviations from the theoretical values. Programming the registers explicitly with static values can interfere with this logic. Therefore, let the HW decide the Maud and Naud SDPs on it's own. Cc: stable(a)vger.kernel.org # v5.17 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8097 Co-developed-by: Kai Vehmanen <kai.vehmanen(a)intel.com> Signed-off-by: Kai Vehmanen <kai.vehmanen(a)intel.com> Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> Reviewed-by: Uma Shankar <uma.shankar(a)intel.com> Signed-off-by: Animesh Manna <animesh.manna(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240430091825.733499-1-chait… (cherry picked from commit 8e056b50d92ae7f4d6895d1c97a69a2a953cf97b) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> diff --git a/drivers/gpu/drm/i915/display/intel_audio.c b/drivers/gpu/drm/i915/display/intel_audio.c index 07e0c73204f3..ed81e1466c4b 100644 --- a/drivers/gpu/drm/i915/display/intel_audio.c +++ b/drivers/gpu/drm/i915/display/intel_audio.c @@ -76,19 +76,6 @@ struct intel_audio_funcs { struct intel_crtc_state *crtc_state); }; -/* DP N/M table */ -#define LC_810M 810000 -#define LC_540M 540000 -#define LC_270M 270000 -#define LC_162M 162000 - -struct dp_aud_n_m { - int sample_rate; - int clock; - u16 m; - u16 n; -}; - struct hdmi_aud_ncts { int sample_rate; int clock; @@ -96,60 +83,6 @@ struct hdmi_aud_ncts { int cts; }; -/* Values according to DP 1.4 Table 2-104 */ -static const struct dp_aud_n_m dp_aud_n_m[] = { - { 32000, LC_162M, 1024, 10125 }, - { 44100, LC_162M, 784, 5625 }, - { 48000, LC_162M, 512, 3375 }, - { 64000, LC_162M, 2048, 10125 }, - { 88200, LC_162M, 1568, 5625 }, - { 96000, LC_162M, 1024, 3375 }, - { 128000, LC_162M, 4096, 10125 }, - { 176400, LC_162M, 3136, 5625 }, - { 192000, LC_162M, 2048, 3375 }, - { 32000, LC_270M, 1024, 16875 }, - { 44100, LC_270M, 784, 9375 }, - { 48000, LC_270M, 512, 5625 }, - { 64000, LC_270M, 2048, 16875 }, - { 88200, LC_270M, 1568, 9375 }, - { 96000, LC_270M, 1024, 5625 }, - { 128000, LC_270M, 4096, 16875 }, - { 176400, LC_270M, 3136, 9375 }, - { 192000, LC_270M, 2048, 5625 }, - { 32000, LC_540M, 1024, 33750 }, - { 44100, LC_540M, 784, 18750 }, - { 48000, LC_540M, 512, 11250 }, - { 64000, LC_540M, 2048, 33750 }, - { 88200, LC_540M, 1568, 18750 }, - { 96000, LC_540M, 1024, 11250 }, - { 128000, LC_540M, 4096, 33750 }, - { 176400, LC_540M, 3136, 18750 }, - { 192000, LC_540M, 2048, 11250 }, - { 32000, LC_810M, 1024, 50625 }, - { 44100, LC_810M, 784, 28125 }, - { 48000, LC_810M, 512, 16875 }, - { 64000, LC_810M, 2048, 50625 }, - { 88200, LC_810M, 1568, 28125 }, - { 96000, LC_810M, 1024, 16875 }, - { 128000, LC_810M, 4096, 50625 }, - { 176400, LC_810M, 3136, 28125 }, - { 192000, LC_810M, 2048, 16875 }, -}; - -static const struct dp_aud_n_m * -audio_config_dp_get_n_m(const struct intel_crtc_state *crtc_state, int rate) -{ - int i; - - for (i = 0; i < ARRAY_SIZE(dp_aud_n_m); i++) { - if (rate == dp_aud_n_m[i].sample_rate && - crtc_state->port_clock == dp_aud_n_m[i].clock) - return &dp_aud_n_m[i]; - } - - return NULL; -} - static const struct { int clock; u32 config; @@ -387,47 +320,17 @@ hsw_dp_audio_config_update(struct intel_encoder *encoder, const struct intel_crtc_state *crtc_state) { struct drm_i915_private *i915 = to_i915(encoder->base.dev); - struct i915_audio_component *acomp = i915->display.audio.component; enum transcoder cpu_transcoder = crtc_state->cpu_transcoder; - enum port port = encoder->port; - const struct dp_aud_n_m *nm; - int rate; - u32 tmp; - rate = acomp ? acomp->aud_sample_rate[port] : 0; - nm = audio_config_dp_get_n_m(crtc_state, rate); - if (nm) - drm_dbg_kms(&i915->drm, "using Maud %u, Naud %u\n", nm->m, - nm->n); - else - drm_dbg_kms(&i915->drm, "using automatic Maud, Naud\n"); + /* Enable time stamps. Let HW calculate Maud/Naud values */ + intel_de_rmw(i915, HSW_AUD_CFG(cpu_transcoder), + AUD_CONFIG_N_VALUE_INDEX | + AUD_CONFIG_PIXEL_CLOCK_HDMI_MASK | + AUD_CONFIG_UPPER_N_MASK | + AUD_CONFIG_LOWER_N_MASK | + AUD_CONFIG_N_PROG_ENABLE, + AUD_CONFIG_N_VALUE_INDEX); - tmp = intel_de_read(i915, HSW_AUD_CFG(cpu_transcoder)); - tmp &= ~AUD_CONFIG_N_VALUE_INDEX; - tmp &= ~AUD_CONFIG_PIXEL_CLOCK_HDMI_MASK; - tmp &= ~AUD_CONFIG_N_PROG_ENABLE; - tmp |= AUD_CONFIG_N_VALUE_INDEX; - - if (nm) { - tmp &= ~AUD_CONFIG_N_MASK; - tmp |= AUD_CONFIG_N(nm->n); - tmp |= AUD_CONFIG_N_PROG_ENABLE; - } - - intel_de_write(i915, HSW_AUD_CFG(cpu_transcoder), tmp); - - tmp = intel_de_read(i915, HSW_AUD_M_CTS_ENABLE(cpu_transcoder)); - tmp &= ~AUD_CONFIG_M_MASK; - tmp &= ~AUD_M_CTS_M_VALUE_INDEX; - tmp &= ~AUD_M_CTS_M_PROG_ENABLE; - - if (nm) { - tmp |= nm->m; - tmp |= AUD_M_CTS_M_VALUE_INDEX; - tmp |= AUD_M_CTS_M_PROG_ENABLE; - } - - intel_de_write(i915, HSW_AUD_M_CTS_ENABLE(cpu_transcoder), tmp); } static void

1 year, 2 months

3
2
0 0

FAILED: patch "[PATCH] nilfs2: fix use-after-free of timer for log writer thread" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052603-deceiving-stood-2b59@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Date: Mon, 20 May 2024 22:26:19 +0900 Subject: [PATCH] nilfs2: fix use-after-free of timer for log writer thread Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log. This patch (of 3): A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure. The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime. Fix this issue by limiting the use of sc_timer only while the log writer thread is alive. Link: https://lkml.kernel.org/r/20240520132621.4054-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20240520132621.4054-2-konishi.ryusuke@gmail.com Fixes: fdce895ea5dd ("nilfs2: change sc_timer from a pointer to an embedded one in struct nilfs_sc_info") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: "Bai, Shuangpeng" <sjb7183(a)psu.edu> Closes: https://groups.google.com/g/syzkaller/c/MK_LYqtt8ko/m/8rgdWeseAwAJ Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 6be7dd423fbd..7cb34e1c9206 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -2118,8 +2118,10 @@ static void nilfs_segctor_start_timer(struct nilfs_sc_info *sci) { spin_lock(&sci->sc_state_lock); if (!(sci->sc_state & NILFS_SEGCTOR_COMMIT)) { - sci->sc_timer.expires = jiffies + sci->sc_interval; - add_timer(&sci->sc_timer); + if (sci->sc_task) { + sci->sc_timer.expires = jiffies + sci->sc_interval; + add_timer(&sci->sc_timer); + } sci->sc_state |= NILFS_SEGCTOR_COMMIT; } spin_unlock(&sci->sc_state_lock); @@ -2320,10 +2322,21 @@ int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode, */ static void nilfs_segctor_accept(struct nilfs_sc_info *sci) { + bool thread_is_alive; + spin_lock(&sci->sc_state_lock); sci->sc_seq_accepted = sci->sc_seq_request; + thread_is_alive = (bool)sci->sc_task; spin_unlock(&sci->sc_state_lock); - del_timer_sync(&sci->sc_timer); + + /* + * This function does not race with the log writer thread's + * termination. Therefore, deleting sc_timer, which should not be + * done after the log writer thread exits, can be done safely outside + * the area protected by sc_state_lock. + */ + if (thread_is_alive) + del_timer_sync(&sci->sc_timer); } /** @@ -2349,7 +2362,7 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci, int mode, int err) sci->sc_flush_request &= ~FLUSH_DAT_BIT; /* re-enable timer if checkpoint creation was not done */ - if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && + if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && sci->sc_task && time_before(jiffies, sci->sc_timer.expires)) add_timer(&sci->sc_timer); } @@ -2539,6 +2552,7 @@ static int nilfs_segctor_thread(void *arg) int timeout = 0; sci->sc_timer_task = current; + timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0); /* start sync. */ sci->sc_task = current; @@ -2606,6 +2620,7 @@ static int nilfs_segctor_thread(void *arg) end_thread: /* end sync. */ sci->sc_task = NULL; + timer_shutdown_sync(&sci->sc_timer); wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */ spin_unlock(&sci->sc_state_lock); return 0; @@ -2669,7 +2684,6 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb, INIT_LIST_HEAD(&sci->sc_gc_inodes); INIT_LIST_HEAD(&sci->sc_iput_queue); INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); - timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0); sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; sci->sc_mjcp_freq = HZ * NILFS_SC_DEFAULT_SR_FREQ; @@ -2748,7 +2762,6 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) down_write(&nilfs->ns_segctor_sem); - timer_shutdown_sync(&sci->sc_timer); kfree(sci); }

1 year, 2 months

3
2
0 0

[PATCH MANUALSEL 4.19 1/2] KVM: x86: Handle SRCU initialization failure during page track init

by Sasha Levin

From: Haimin Zhang <tcs_kernel(a)tencent.com> [ Upstream commit eb7511bf9182292ef1df1082d23039e856d1ddfb ] Check the return of init_srcu_struct(), which can fail due to OOM, when initializing the page track mechanism. Lack of checking leads to a NULL pointer deref found by a modified syzkaller. Reported-by: TCS Robot <tcs_robot(a)tencent.com> Signed-off-by: Haimin Zhang <tcs_kernel(a)tencent.com> Message-Id: <1630636626-12262-1-git-send-email-tcs_kernel(a)tencent.com> [Move the call towards the beginning of kvm_arch_init_vm. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- arch/x86/include/asm/kvm_page_track.h | 2 +- arch/x86/kvm/page_track.c | 4 ++-- arch/x86/kvm/x86.c | 7 ++++++- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/arch/x86/include/asm/kvm_page_track.h b/arch/x86/include/asm/kvm_page_track.h index 172f9749dbb2..5986bd4aacd6 100644 --- a/arch/x86/include/asm/kvm_page_track.h +++ b/arch/x86/include/asm/kvm_page_track.h @@ -46,7 +46,7 @@ struct kvm_page_track_notifier_node { struct kvm_page_track_notifier_node *node); }; -void kvm_page_track_init(struct kvm *kvm); +int kvm_page_track_init(struct kvm *kvm); void kvm_page_track_cleanup(struct kvm *kvm); void kvm_page_track_free_memslot(struct kvm_memory_slot *free, diff --git a/arch/x86/kvm/page_track.c b/arch/x86/kvm/page_track.c index 3052a59a3065..1f6b0d9b0c85 100644 --- a/arch/x86/kvm/page_track.c +++ b/arch/x86/kvm/page_track.c @@ -169,13 +169,13 @@ void kvm_page_track_cleanup(struct kvm *kvm) cleanup_srcu_struct(&head->track_srcu); } -void kvm_page_track_init(struct kvm *kvm) +int kvm_page_track_init(struct kvm *kvm) { struct kvm_page_track_notifier_head *head; head = &kvm->arch.track_notifier_head; - init_srcu_struct(&head->track_srcu); INIT_HLIST_HEAD(&head->track_notifier_list); + return init_srcu_struct(&head->track_srcu); } /* diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 417abc9ba1ad..70cb18f89029 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -9039,9 +9039,15 @@ void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) { + int ret; + if (type) return -EINVAL; + ret = kvm_page_track_init(kvm); + if (ret) + return ret; + INIT_HLIST_HEAD(&kvm->arch.mask_notifier_list); INIT_LIST_HEAD(&kvm->arch.active_mmu_pages); INIT_LIST_HEAD(&kvm->arch.zapped_obsolete_pages); @@ -9068,7 +9074,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) INIT_DELAYED_WORK(&kvm->arch.kvmclock_sync_work, kvmclock_sync_fn); kvm_hv_init_vm(kvm); - kvm_page_track_init(kvm); kvm_mmu_init_vm(kvm); if (kvm_x86_ops->vm_init) -- 2.33.0

1 year, 2 months

4
4
0 0

Backport request for ce4f78f1b53d ("riscv: signal: handle syscall restart before get_signal")

by Conor Dooley

Hey Greg, Could you please backport commit ce4f78f1b53d3327fbd32764aa333bf05fb68818 "riscv: signal: handle syscall restart before get_signal" to at least 6.6? Apparently it fixes CRIU and ptrace, but was unfortunately not given a fixes tag so I do not know how far back it is actually required. It cherry-picks to 6.1 and builds there, but I have not tested it. Thanks, Conor.

1 year, 2 months

2
1
0 0

Backport request for "powerpc/iommu: Add iommu_ops to report capabilities and allow blocking domains"

by Shawn Anastasio

Hello, Commit a940904443e432623579245babe63e2486ff327b ("powerpc/iommu: Add iommu_ops to report capabilities and allow blocking domains") fixes a regression that prevents attaching PCI devices to the vfio-pci driver on PPC64. Its inclusion in 6.1 would open the door for restoring VFIO and KVM PCI passthrough support on distros that rely on this LTS kernel. Thanks, Shawn

1 year, 2 months

2
1
0 0

Re: [PATCH net] net: sfp-bus: fix SFP mode detect from bitrate

by Daniel Golle

Hi stable team, > > On Mon, 15 Jan 2024 12:43:38 +0000 > > "Russell King (Oracle)" <rmk+kernel(a)armlinux.org.uk> wrote: > > > > > The referenced commit moved the setting of the Autoneg and pause bits > > > early in sfp_parse_support(). However, we check whether the modes are > > > empty before using the bitrate to set some modes. Setting these bits > > > so early causes that test to always be false, preventing this working, > > > and thus some modules that used to work no longer do. > > > > > > Move them just before the call to the quirk. > > > > > > Fixes: 8110633db49d ("net: sfp-bus: allow SFP quirks to override Autoneg and pause bits") > > > Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> please apply this patch also to Linux stable down to v6.4 which are affected by problems introduced by commit 8110633db49d ("net: sfp-bus: allow SFP quirks to override Autoneg and pause bits"). The fix has been applied to net tree as commit 97eb5d51b4a5 ("net: sfp-bus: fix SFP mode detect from bitrate") but never picked for older kernel versions affected as well. Thank you! Daniel

1 year, 2 months

2
1
0 0

Backport request: commit 29be9100aca2915fab54b5693309bc42956542e5 ("afs: Don't cross .backup mountpoint from backup volume")

by Jeffrey E Altman

Please backport to the following patch which was merged upstream. It should apply to linux-5.4.y and later. commit 29be9100aca2915fab54b5693309bc42956542e5 Author: Marc Dionne <marc.dionne(a)auristor.com>1 Date: Fri May 24 17:17:55 2024 +0100 afs: Don't cross .backup mountpoint from backup volume Don't cross a mountpoint that explicitly specifies a backup volume (target is <vol>.backup) when starting from a backup volume. It it not uncommon to mount a volume's backup directly in the volume itself. This can cause tools that are not paying attention to get into a loop mounting the volume onto itself as they attempt to traverse the tree, leading to a variety of problems. This doesn't prevent the general case of loops in a sequence of mountpoints, but addresses a common special case in the same way as other afs clients. Reported-by: Jan Henrik Sylvester <jan.henrik.sylvester(a)uni-hamburg.de> Link: http://lists.infradead.org/pipermail/linux-afs/2024-May/008454.html Reported-by: Markus Suvanto <markus.suvanto(a)gmail.com> Link: http://lists.infradead.org/pipermail/linux-afs/2024-February/008074.html Signed-off-by: Marc Dionne <marc.dionne(a)auristor.com> Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/768760.1716567475@warthog.procyon.org.uk Reviewed-by: Jeffrey Altman <jaltman(a)auristor.com> cc: linux-afs(a)lists.infradead.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Thank you. Jeffrey Altman

1 year, 2 months

2
1
0 0

FAILED: patch "[PATCH] io_uring: fail NOP if non-zero op flags is passed in" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 3d8f874bd620ce03f75a5512847586828ab86544 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052549-gyration-replica-129f@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3d8f874bd620ce03f75a5512847586828ab86544 Mon Sep 17 00:00:00 2001 From: Ming Lei <ming.lei(a)redhat.com> Date: Fri, 10 May 2024 11:50:27 +0800 Subject: [PATCH] io_uring: fail NOP if non-zero op flags is passed in The NOP op flags should have been checked from beginning like any other opcode, otherwise NOP may not be extended with the op flags. Given both liburing and Rust io-uring crate always zeros SQE op flags, just ignore users which play raw NOP uring interface without zeroing SQE, because NOP is just for test purpose. Then we can save one NOP2 opcode. Suggested-by: Jens Axboe <axboe(a)kernel.dk> Fixes: 2b188cc1bb85 ("Add io_uring IO interface") Cc: stable(a)vger.kernel.org Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20240510035031.78874-2-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/io_uring/nop.c b/io_uring/nop.c index d956599a3c1b..1a4e312dfe51 100644 --- a/io_uring/nop.c +++ b/io_uring/nop.c @@ -12,6 +12,8 @@ int io_nop_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { + if (READ_ONCE(sqe->rw_flags)) + return -EINVAL; return 0; }

1 year, 2 months

3
2
0 0

FAILED: patch "[PATCH] binder: fix max_thread type inconsistency" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 42316941335644a98335f209daafa4c122f28983 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052313-runner-spree-04c1@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 42316941335644a98335f209daafa4c122f28983 Mon Sep 17 00:00:00 2001 From: Carlos Llamas <cmllamas(a)google.com> Date: Sun, 21 Apr 2024 17:37:49 +0000 Subject: [PATCH] binder: fix max_thread type inconsistency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The type defined for the BINDER_SET_MAX_THREADS ioctl was changed from size_t to __u32 in order to avoid incompatibility issues between 32 and 64-bit kernels. However, the internal types used to copy from user and store the value were never updated. Use u32 to fix the inconsistency. Fixes: a9350fc859ae ("staging: android: binder: fix BINDER_SET_MAX_THREADS declaration") Reported-by: Arve Hjønnevåg <arve(a)android.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Link: https://lore.kernel.org/r/20240421173750.3117808-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/android/binder.c b/drivers/android/binder.c index dd6923d37931..b21a7b246a0d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -5367,7 +5367,7 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) goto err; break; case BINDER_SET_MAX_THREADS: { - int max_threads; + u32 max_threads; if (copy_from_user(&max_threads, ubuf, sizeof(max_threads))) { diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h index 7270d4d22207..5b7c80b99ae8 100644 --- a/drivers/android/binder_internal.h +++ b/drivers/android/binder_internal.h @@ -421,7 +421,7 @@ struct binder_proc { struct list_head todo; struct binder_stats stats; struct list_head delivered_death; - int max_threads; + u32 max_threads; int requested_threads; int requested_threads_started; int tmp_ref;

1 year, 2 months

3
2
0 0

Re: 回复: 回复: 回复: backport a patch for Linux kernel-5.15 kernel-6.1 kenrel-6.6 stable tree

by Greg KH

On Fri, May 24, 2024 at 01:07:18AM +0000, Lin Gui (桂林) wrote: > Dear @Greg KH<mailto:gregkh@linuxfoundation.org>, > > Base : kernel-5.15.159 > > diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c > index a569066..d656964 100644 > --- a/drivers/mmc/core/mmc.c > +++ b/drivers/mmc/core/mmc.c > @@ -1800,7 +1800,13 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, > if (err) > goto free_card; > > - } else if (!mmc_card_hs400es(card)) { > + } else if (mmc_card_hs400es(card)){ > + if (host->ops->execute_hs400_tuning) { > + err = host->ops->execute_hs400_tuning(host, card); > + if (err) > + goto free_card; > + } > + } else { > /* Select the desired bus width optionally */ > err = mmc_select_bus_width(card); > if (err > 0 && mmc_card_hs(card)) { > Also, please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly.

1 year, 2 months

2
5
0 0

FAILED: patch "[PATCH] maple_tree: fix mas_empty_area_rev() null pointer dereference" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 955a923d2809803980ff574270f81510112be9cf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024051347-uncross-jockstrap-5ce0@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 955a923d2809 ("maple_tree: fix mas_empty_area_rev() null pointer dereference") 29ad6bb31348 ("maple_tree: fix allocation in mas_sparse_area()") fad8e4291da5 ("maple_tree: make maple state reusable after mas_empty_area_rev()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 955a923d2809803980ff574270f81510112be9cf Mon Sep 17 00:00:00 2001 From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> Date: Mon, 22 Apr 2024 16:33:49 -0400 Subject: [PATCH] maple_tree: fix mas_empty_area_rev() null pointer dereference Currently the code calls mas_start() followed by mas_data_end() if the maple state is MA_START, but mas_start() may return with the maple state node == NULL. This will lead to a null pointer dereference when checking information in the NULL node, which is done in mas_data_end(). Avoid setting the offset if there is no node by waiting until after the maple state is checked for an empty or single entry state. A user could trigger the events to cause a kernel oops by unmapping all vmas to produce an empty maple tree, then mapping a vma that would cause the scenario described above. Link: https://lkml.kernel.org/r/20240422203349.2418465-1-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reported-by: Marius Fleischer <fleischermarius(a)gmail.com> Closes: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW… Link: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW… Tested-by: Marius Fleischer <fleischermarius(a)gmail.com> Tested-by: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 55e1b35bf877..2d7d27e6ae3c 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -5109,18 +5109,18 @@ int mas_empty_area_rev(struct ma_state *mas, unsigned long min, if (size == 0 || max - min < size - 1) return -EINVAL; - if (mas_is_start(mas)) { + if (mas_is_start(mas)) mas_start(mas); - mas->offset = mas_data_end(mas); - } else if (mas->offset >= 2) { - mas->offset -= 2; - } else if (!mas_rewind_node(mas)) { + else if ((mas->offset < 2) && (!mas_rewind_node(mas))) return -EBUSY; - } - /* Empty set. */ - if (mas_is_none(mas) || mas_is_ptr(mas)) + if (unlikely(mas_is_none(mas) || mas_is_ptr(mas))) return mas_sparse_area(mas, min, max, size, false); + else if (mas->offset >= 2) + mas->offset -= 2; + else + mas->offset = mas_data_end(mas); + /* The start of the window can only be within these values. */ mas->index = min;

1 year, 2 months

3
4
0 0

Please apply "drm/i915/hwmon: Get rid of devm" to stable trees (Option 2)

by Dixit, Ashutosh

Patch subject: drm/i915/hwmon: Get rid of devm Commit ID: 5bc9de065b8bb9b8dd8799ecb4592d0403b54281 Reason: Fixes potential kernel crash listed in https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/10366 Kernel versions: 6.2 and later

1 year, 2 months

2
1
0 0

Request for backporting of two drm patches

by Shradha Gupta

Hi all, Can you please pick up the following two drm patches to linux-5.15.y and newer? As these bugs affect these kernel versions too List of patches to be backported Patch 1: 5abffb66d12bcac84bf7b66389c571b8bb6e82bd drm: Check output polling initialized before disabling Patch 2: 048a36d8a6085bbd8ab9e5794b713b92ac986450 drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes These however do not apply cleanly on the 5.15.y branch, so I am also attaching rebased versions of these patches in the mail Thanks and Regards, Shradha.

1 year, 2 months

2
2
0 0

[PATCH] wifi: mac80211: fix monitor channel with chanctx emulation

by Johannes Berg

From: Johannes Berg <johannes.berg(a)intel.com> After the channel context emulation, there were reports that changing the monitor channel no longer works. This is because those drivers don't have WANT_MONITOR_VIF, so the setting the channel always exits out quickly. Fix this by always allocating the virtual monitor sdata, and simply not telling the driver about it unless it wanted to. This way, we have an interface/sdata to bind the chanctx to, and the emulation can work correctly. Cc: stable(a)vger.kernel.org Fixes: 0a44dfc07074 ("wifi: mac80211: simplify non-chanctx drivers") Reported-by: Savyasaachi Vanga <savyasaachiv(a)gmail.com> Closes: https://lore.kernel.org/r/chwoymvpzwtbmzryrlitpwmta5j6mtndocxsyqvdyikqu63lo… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> --- net/mac80211/driver-ops.c | 17 +++++++++++++++++ net/mac80211/iface.c | 21 +++++++++------------ net/mac80211/util.c | 2 +- 3 files changed, 27 insertions(+), 13 deletions(-) diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c index dce37ba8ebe3..254d745832cb 100644 --- a/net/mac80211/driver-ops.c +++ b/net/mac80211/driver-ops.c @@ -311,6 +311,18 @@ int drv_assign_vif_chanctx(struct ieee80211_local *local, might_sleep(); lockdep_assert_wiphy(local->hw.wiphy); + /* + * We should perhaps push emulate chanctx down and only + * make it call ->config() when the chanctx is actually + * assigned here (and unassigned below), but that's yet + * another change to all drivers to add assign/unassign + * emulation callbacks. Maybe later. + */ + if (sdata->vif.type == NL80211_IFTYPE_MONITOR && + local->emulate_chanctx && + !ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) + return 0; + if (!check_sdata_in_driver(sdata)) return -EIO; @@ -338,6 +350,11 @@ void drv_unassign_vif_chanctx(struct ieee80211_local *local, might_sleep(); lockdep_assert_wiphy(local->hw.wiphy); + if (sdata->vif.type == NL80211_IFTYPE_MONITOR && + local->emulate_chanctx && + !ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) + return; + if (!check_sdata_in_driver(sdata)) return; diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index dc42902e2693..4a49e834a9f5 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -1121,9 +1121,6 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local) struct ieee80211_sub_if_data *sdata; int ret; - if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) - return 0; - ASSERT_RTNL(); lockdep_assert_wiphy(local->hw.wiphy); @@ -1145,11 +1142,13 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local) ieee80211_set_default_queues(sdata); - ret = drv_add_interface(local, sdata); - if (WARN_ON(ret)) { - /* ok .. stupid driver, it asked for this! */ - kfree(sdata); - return ret; + if (ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) { + ret = drv_add_interface(local, sdata); + if (WARN_ON(ret)) { + /* ok .. stupid driver, it asked for this! */ + kfree(sdata); + return ret; + } } set_bit(SDATA_STATE_RUNNING, &sdata->state); @@ -1187,9 +1186,6 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local) { struct ieee80211_sub_if_data *sdata; - if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) - return; - ASSERT_RTNL(); lockdep_assert_wiphy(local->hw.wiphy); @@ -1209,7 +1205,8 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local) ieee80211_link_release_channel(&sdata->deflink); - drv_remove_interface(local, sdata); + if (ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) + drv_remove_interface(local, sdata); kfree(sdata); } diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 283bfc99417e..963ed75deb76 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1843,7 +1843,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) /* add interfaces */ sdata = wiphy_dereference(local->hw.wiphy, local->monitor_sdata); - if (sdata) { + if (sdata && ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) { /* in HW restart it exists already */ WARN_ON(local->resuming); res = drv_add_interface(local, sdata); -- 2.45.2

1 year, 2 months

1
0
0 0

Linux 6.9.4

by Greg Kroah-Hartman

I'm announcing the release of the 6.9.4 kernel. All users of the 6.9 kernel series must upgrade. The updated 6.9.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.9.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/pci/rcar-pci-host.yaml | 3 Documentation/devicetree/bindings/pci/rockchip,rk3399-pcie.yaml | 1 Documentation/devicetree/bindings/phy/qcom,sc8280xp-qmp-pcie-phy.yaml | 1 Documentation/devicetree/bindings/phy/qcom,sc8280xp-qmp-ufs-phy.yaml | 16 Documentation/devicetree/bindings/phy/qcom,usb-snps-femto-v2.yaml | 4 Documentation/devicetree/bindings/pinctrl/mediatek,mt7622-pinctrl.yaml | 92 ++-- Documentation/devicetree/bindings/pinctrl/qcom,sm4450-tlmm.yaml | 52 -- Documentation/driver-api/fpga/fpga-bridge.rst | 7 Documentation/driver-api/fpga/fpga-mgr.rst | 34 - Documentation/driver-api/fpga/fpga-region.rst | 13 Documentation/iio/adis16475.rst | 8 Makefile | 2 arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 13 arch/arm64/include/asm/asm-bug.h | 1 arch/arm64/kvm/arm.c | 50 ++ arch/loongarch/include/asm/perf_event.h | 3 arch/microblaze/kernel/Makefile | 1 arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 arch/powerpc/include/asm/hvcall.h | 2 arch/powerpc/include/asm/ppc-opcode.h | 4 arch/powerpc/kvm/book3s_hv.c | 2 arch/powerpc/kvm/book3s_hv_nestedv2.c | 4 arch/powerpc/net/bpf_jit_comp32.c | 137 +++++- arch/powerpc/platforms/pseries/lpar.c | 6 arch/powerpc/platforms/pseries/lparcfg.c | 10 arch/riscv/boot/dts/starfive/jh7110-starfive-visionfive-2.dtsi | 98 ---- arch/riscv/include/asm/sbi.h | 2 arch/riscv/kernel/cpu.c | 40 + arch/riscv/kernel/cpu_ops_sbi.c | 2 arch/riscv/kernel/cpu_ops_spinwait.c | 3 arch/riscv/kernel/cpufeature.c | 10 arch/riscv/kernel/smpboot.c | 7 arch/riscv/kernel/stacktrace.c | 20 arch/s390/boot/startup.c | 1 arch/s390/include/asm/ftrace.h | 8 arch/s390/include/asm/processor.h | 1 arch/s390/include/asm/stacktrace.h | 12 arch/s390/kernel/Makefile | 2 arch/s390/kernel/asm-offsets.c | 5 arch/s390/kernel/ipl.c | 10 arch/s390/kernel/perf_event.c | 34 - arch/s390/kernel/setup.c | 2 arch/s390/kernel/stacktrace.c | 108 ++++- arch/s390/kernel/vdso.c | 13 arch/s390/kernel/vdso32/Makefile | 4 arch/s390/kernel/vdso64/Makefile | 4 arch/s390/kernel/vdso64/vdso_user_wrapper.S | 19 arch/um/drivers/line.c | 14 arch/um/drivers/ubd_kern.c | 4 arch/um/drivers/vector_kern.c | 2 arch/um/include/asm/kasan.h | 1 arch/um/include/asm/mmu.h | 2 arch/um/include/asm/processor-generic.h | 1 arch/um/include/shared/kern_util.h | 2 arch/um/include/shared/skas/mm_id.h | 2 arch/um/os-Linux/mem.c | 1 arch/x86/Kconfig.debug | 5 arch/x86/include/asm/percpu.h | 42 -- arch/x86/kernel/apic/vector.c | 9 arch/x86/kernel/cpu/common.c | 3 arch/x86/kernel/cpu/cpu.h | 2 arch/x86/kernel/cpu/intel.c | 25 - arch/x86/kernel/cpu/topology.c | 53 ++ arch/x86/kvm/cpuid.c | 21 - arch/x86/pci/mmconfig-shared.c | 40 + arch/x86/um/shared/sysdep/archsetjmp.h | 7 arch/x86/xen/enlighten.c | 33 + block/blk-cgroup.c | 87 +++- block/blk-settings.c | 2 drivers/base/base.h | 9 drivers/base/bus.c | 9 drivers/base/module.c | 42 +- drivers/block/null_blk/main.c | 42 +- drivers/char/ppdev.c | 15 drivers/char/tpm/tpm_tis_spi_main.c | 3 drivers/cxl/core/region.c | 1 drivers/cxl/core/trace.h | 4 drivers/dma-buf/sync_debug.c | 4 drivers/dma/idma64.c | 4 drivers/dma/idxd/cdev.c | 1 drivers/extcon/Kconfig | 3 drivers/firmware/dmi-id.c | 7 drivers/firmware/efi/libstub/fdt.c | 4 drivers/firmware/efi/libstub/x86-stub.c | 28 + drivers/fpga/fpga-bridge.c | 57 +- drivers/fpga/fpga-mgr.c | 82 ++-- drivers/fpga/fpga-region.c | 24 - drivers/gpio/gpiolib-acpi.c | 19 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 19 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 8 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 drivers/gpu/drm/bridge/imx/Kconfig | 4 drivers/gpu/drm/bridge/tc358775.c | 21 - drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 2 drivers/gpu/drm/i915/gt/intel_gt_types.h | 8 drivers/gpu/drm/i915/gt/uc/abi/guc_klvs_abi.h | 6 drivers/gpu/drm/mediatek/mtk_dp.c | 2 drivers/gpu/drm/meson/meson_dw_mipi_dsi.c | 7 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 7 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 9 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 4 drivers/gpu/drm/msm/dsi/dsi_host.c | 10 drivers/gpu/drm/nouveau/nouveau_abi16.c | 3 drivers/gpu/drm/nouveau/nouveau_bo.c | 44 -- drivers/gpu/drm/panel/panel-sitronix-st7789v.c | 16 drivers/gpu/drm/xe/xe_device.c | 21 - drivers/gpu/drm/xe/xe_migrate.c | 12 drivers/gpu/drm/xe/xe_pcode.c | 115 +++-- drivers/gpu/drm/xe/xe_pcode.h | 6 drivers/gpu/drm/xe/xe_pm.c | 36 + drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 7 drivers/hwmon/intel-m10-bmc-hwmon.c | 2 drivers/hwmon/shtc1.c | 2 drivers/hwtracing/coresight/coresight-etm4x-core.c | 29 - drivers/hwtracing/coresight/coresight-etm4x.h | 31 - drivers/hwtracing/stm/core.c | 11 drivers/i2c/busses/i2c-cadence.c | 1 drivers/i2c/busses/i2c-synquacer.c | 20 drivers/i3c/master/svc-i3c-master.c | 2 drivers/iio/adc/adi-axi-adc.c | 4 drivers/iio/adc/pac1934.c | 9 drivers/iio/adc/stm32-adc.c | 1 drivers/iio/industrialio-core.c | 6 drivers/iio/pressure/dps310.c | 11 drivers/infiniband/core/addr.c | 12 drivers/input/misc/ims-pcu.c | 4 drivers/input/misc/pm8xxx-vibrator.c | 7 drivers/input/mouse/cyapa.c | 12 drivers/input/serio/ioc3kbd.c | 7 drivers/interconnect/qcom/qcm2290.c | 2 drivers/leds/leds-pwm.c | 8 drivers/mailbox/mtk-cmdq-mailbox.c | 2 drivers/media/cec/core/cec-adap.c | 24 - drivers/media/cec/core/cec-api.c | 5 drivers/media/i2c/ov2680.c | 13 drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c | 4 drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h | 2 drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c | 5 drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig | 1 drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 5 drivers/media/usb/b2c2/flexcop-usb.c | 2 drivers/media/usb/stk1160/stk1160-video.c | 20 drivers/media/v4l2-core/v4l2-subdev.c | 22 - drivers/misc/vmw_vmci/vmci_guest.c | 10 drivers/mmc/host/sdhci_am654.c | 168 ++++++-- drivers/net/Makefile | 4 drivers/net/dsa/microchip/ksz_common.c | 2 drivers/net/ethernet/amazon/ena/ena_com.c | 11 drivers/net/ethernet/cisco/enic/enic_main.c | 12 drivers/net/ethernet/freescale/fec_main.c | 10 drivers/net/ethernet/freescale/fec_ptp.c | 14 drivers/net/ethernet/intel/ice/ice_common.c | 10 drivers/net/ethernet/intel/ice/ice_ethtool.c | 19 drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 11 drivers/net/ethernet/intel/idpf/idpf_ethtool.c | 21 - drivers/net/ethernet/intel/idpf/idpf_lib.c | 1 drivers/net/ethernet/intel/idpf/idpf_txrx.c | 12 drivers/net/ethernet/intel/idpf/idpf_txrx.h | 1 drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 3 drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 56 -- drivers/net/ethernet/marvell/octeontx2/nic/qos.c | 4 drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h | 8 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 17 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 6 drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 12 drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c | 12 drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 drivers/net/ethernet/microchip/lan966x/lan966x_main.c | 6 drivers/net/ethernet/ti/icssg/icssg_classifier.c | 2 drivers/net/ipvlan/ipvlan_core.c | 4 drivers/net/netkit.c | 30 + drivers/net/phy/micrel.c | 11 drivers/net/usb/smsc95xx.c | 11 drivers/net/vrf.c | 4 drivers/net/vxlan/vxlan_core.c | 2 drivers/nvme/host/core.c | 17 drivers/nvme/host/multipath.c | 3 drivers/nvme/host/nvme.h | 1 drivers/nvme/target/configfs.c | 8 drivers/pci/controller/dwc/pcie-designware-ep.c | 120 +++-- drivers/pci/controller/dwc/pcie-tegra194.c | 3 drivers/pci/of_property.c | 2 drivers/pci/pci.c | 2 drivers/pci/pcie/edr.c | 28 - drivers/perf/arm_dmc620_pmu.c | 9 drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 54 ++ drivers/pinctrl/qcom/pinctrl-sm7150.c | 20 drivers/pinctrl/renesas/pfc-r8a779h0.c | 24 - drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 drivers/platform/x86/intel/tpmi.c | 7 drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 7 drivers/platform/x86/thinkpad_acpi.c | 5 drivers/regulator/bd71828-regulator.c | 58 -- drivers/regulator/helpers.c | 43 +- drivers/regulator/tps6287x-regulator.c | 1 drivers/regulator/tps6594-regulator.c | 16 drivers/s390/crypto/ap_bus.c | 8 drivers/s390/net/qeth_core.h | 9 drivers/scsi/sd.c | 4 drivers/soundwire/cadence_master.c | 2 drivers/spi/spi-stm32.c | 16 drivers/spi/spi.c | 4 drivers/spmi/spmi-pmic-arb.c | 12 drivers/staging/greybus/arche-apb-ctrl.c | 1 drivers/staging/greybus/arche-platform.c | 9 drivers/staging/greybus/light.c | 8 drivers/tty/serial/max3100.c | 22 - drivers/tty/serial/sc16is7xx.c | 2 drivers/tty/serial/sh-sci.c | 5 drivers/usb/fotg210/fotg210-core.c | 1 drivers/usb/gadget/function/u_audio.c | 21 - drivers/usb/host/xhci-mem.c | 22 - drivers/usb/host/xhci.h | 6 drivers/usb/typec/ucsi/ucsi.c | 21 - drivers/vfio/pci/vfio_pci_intrs.c | 4 drivers/video/backlight/mp3309c.c | 3 drivers/virtio/virtio_balloon.c | 13 drivers/virtio/virtio_pci_common.c | 4 drivers/watchdog/bd9576_wdt.c | 12 drivers/watchdog/cpu5wdt.c | 2 drivers/watchdog/sa1100_wdt.c | 5 drivers/xen/xenbus/xenbus_probe.c | 36 + fs/f2fs/data.c | 19 fs/f2fs/f2fs.h | 15 fs/f2fs/file.c | 92 ++-- fs/f2fs/gc.c | 9 fs/f2fs/node.c | 2 fs/f2fs/segment.c | 2 fs/fuse/dev.c | 3 fs/netfs/buffered_write.c | 2 fs/nfs/filelayout/filelayout.c | 4 fs/nfs/fs_context.c | 9 fs/nfs/nfs4state.c | 12 fs/ntfs3/fslog.c | 3 fs/ntfs3/inode.c | 17 fs/ntfs3/ntfs.h | 2 fs/ocfs2/localalloc.c | 19 fs/ocfs2/reservations.c | 2 fs/ocfs2/suballoc.c | 6 fs/overlayfs/dir.c | 3 fs/smb/client/cifsfs.c | 12 fs/smb/client/smb2ops.c | 1 fs/udf/inode.c | 27 - include/linux/counter.h | 1 include/linux/etherdevice.h | 8 include/linux/fortify-string.h | 22 - include/linux/fpga/fpga-bridge.h | 10 include/linux/fpga/fpga-mgr.h | 26 - include/linux/fpga/fpga-region.h | 13 include/linux/mlx5/mlx5_ifc.h | 4 include/linux/regulator/driver.h | 3 include/linux/skbuff.h | 9 include/media/cec.h | 1 include/net/bluetooth/hci_core.h | 3 include/net/dst_ops.h | 2 include/net/ip.h | 4 include/net/ip6_fib.h | 6 include/net/ip6_route.h | 11 include/net/route.h | 11 include/net/sock.h | 13 include/sound/tas2781-dsp.h | 7 include/uapi/drm/nouveau_drm.h | 7 init/Kconfig | 4 kernel/bpf/verifier.c | 10 kernel/dma/map_benchmark.c | 22 - kernel/gen_kheaders.sh | 7 kernel/irq/cpuhotplug.c | 16 kernel/trace/rv/rv.c | 2 kernel/trace/trace_probe.c | 4 lib/Kconfig.ubsan | 1 lib/strcat_kunit.c | 12 lib/string_kunit.c | 155 +++++++ lib/strscpy_kunit.c | 51 +- net/atm/clip.c | 2 net/bluetooth/6lowpan.c | 2 net/bluetooth/hci_event.c | 58 +- net/bluetooth/iso.c | 94 +--- net/core/dst_cache.c | 4 net/core/filter.c | 5 net/ethernet/eth.c | 4 net/ipv4/af_inet.c | 6 net/ipv4/devinet.c | 7 net/ipv4/icmp.c | 26 - net/ipv4/ip_input.c | 2 net/ipv4/ip_output.c | 8 net/ipv4/ip_tunnel.c | 2 net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 net/ipv4/route.c | 46 -- net/ipv4/tcp_dctcp.c | 13 net/ipv4/udp.c | 2 net/ipv4/xfrm4_policy.c | 2 net/ipv6/icmp.c | 8 net/ipv6/ila/ila_lwt.c | 4 net/ipv6/ip6_output.c | 18 net/ipv6/ip6mr.c | 2 net/ipv6/ndisc.c | 2 net/ipv6/ping.c | 2 net/ipv6/raw.c | 4 net/ipv6/route.c | 57 +- net/ipv6/seg6_hmac.c | 42 +- net/ipv6/seg6_iptunnel.c | 11 net/ipv6/tcp_ipv6.c | 4 net/ipv6/udp.c | 11 net/ipv6/xfrm6_policy.c | 2 net/l2tp/l2tp_ip.c | 2 net/l2tp/l2tp_ip6.c | 2 net/mpls/mpls_iptunnel.c | 4 net/netfilter/ipset/ip_set_list_set.c | 3 net/netfilter/ipvs/ip_vs_xmit.c | 16 net/netfilter/nf_flow_table_core.c | 8 net/netfilter/nf_flow_table_ip.c | 8 net/netfilter/nfnetlink_queue.c | 2 net/netfilter/nft_fib.c | 8 net/netfilter/nft_payload.c | 95 +++- net/netfilter/nft_rt.c | 4 net/nfc/nci/core.c | 18 net/openvswitch/actions.c | 6 net/sched/sch_taprio.c | 14 net/sctp/ipv6.c | 2 net/sctp/protocol.c | 4 net/sunrpc/auth_gss/svcauth_gss.c | 2 net/sunrpc/clnt.c | 1 net/sunrpc/xprtrdma/verbs.c | 6 net/tipc/udp_media.c | 2 net/tls/tls_main.c | 10 net/unix/af_unix.c | 47 +- net/xfrm/xfrm_policy.c | 14 scripts/Makefile.vdsoinst | 2 scripts/kconfig/symbol.c | 6 sound/core/init.c | 9 sound/core/jack.c | 21 - sound/core/seq/seq_ump_convert.c | 46 ++ sound/pci/hda/cs35l56_hda.c | 8 sound/pci/hda/hda_component.c | 16 sound/pci/hda/hda_component.h | 7 sound/pci/hda/hda_cs_dsp_ctl.c | 47 +- sound/pci/hda/patch_realtek.c | 5 sound/soc/amd/acp/acp-legacy-common.c | 96 ++++ sound/soc/amd/acp/acp-pci.c | 9 sound/soc/amd/acp/amd.h | 10 sound/soc/amd/acp/chip_offset_byte.h | 1 sound/soc/codecs/cs42l43.c | 5 sound/soc/codecs/rt715-sdca-sdw.c | 4 sound/soc/codecs/tas2552.c | 15 sound/soc/codecs/tas2781-fmwlib.c | 109 +---- sound/soc/codecs/tas2781-i2c.c | 4 sound/soc/mediatek/mt8192/mt8192-dai-tdm.c | 4 sound/soc/sof/debug.c | 23 + tools/arch/x86/intel_sdsi/intel_sdsi.c | 48 +- tools/bpf/resolve_btfids/main.c | 2 tools/lib/subcmd/parse-options.c | 8 tools/perf/Documentation/perf-list.txt | 1 tools/perf/Makefile.perf | 7 tools/perf/bench/inject-buildid.c | 2 tools/perf/bench/uprobe.c | 2 tools/perf/builtin-annotate.c | 2 tools/perf/builtin-daemon.c | 4 tools/perf/builtin-record.c | 8 tools/perf/builtin-report.c | 2 tools/perf/builtin-sched.c | 7 tools/perf/pmu-events/arch/s390/cf_z16/transaction.json | 28 - tools/perf/pmu-events/arch/s390/mapfile.csv | 2 tools/perf/tests/builtin-test.c | 37 - tools/perf/tests/code-reading.c | 10 tools/perf/tests/shell/test_arm_coresight.sh | 2 tools/perf/tests/workloads/datasym.c | 16 tools/perf/ui/browser.c | 6 tools/perf/ui/browser.h | 2 tools/perf/util/annotate.c | 19 tools/perf/util/dwarf-aux.c | 202 ++++++---- tools/perf/util/dwarf-aux.h | 17 tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 tools/perf/util/intel-pt.c | 2 tools/perf/util/machine.c | 2 tools/perf/util/perf_event_attr_fprintf.c | 26 - tools/perf/util/pmu.c | 119 ++++- tools/perf/util/pmu.h | 7 tools/perf/util/probe-event.c | 1 tools/perf/util/python.c | 10 tools/perf/util/stat-display.c | 3 tools/perf/util/symbol.c | 49 +- tools/perf/util/thread.c | 14 tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh | 2 tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh | 1 tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh | 1 tools/testing/selftests/kselftest_harness.h | 11 tools/testing/selftests/mm/mdwe_test.c | 1 tools/testing/selftests/net/amt.sh | 8 tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh | 53 -- tools/testing/selftests/net/forwarding/ethtool_rmon.sh | 4 tools/testing/selftests/net/forwarding/lib.sh | 186 ++++----- tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh | 2 tools/testing/selftests/net/lib.sh | 114 +++++ tools/testing/selftests/net/mptcp/mptcp_join.sh | 16 tools/testing/selftests/net/mptcp/simult_flows.sh | 10 tools/testing/selftests/powerpc/dexcr/Makefile | 2 tools/testing/selftests/riscv/hwprobe/.gitignore | 2 tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json | 44 ++ 403 files changed, 4026 insertions(+), 2421 deletions(-) Aaron Conole (1): openvswitch: Set the skbuff pkt_type for proper pmtud support. Adam Ford (1): drm/bridge: imx: Fix unmet depenency for PHY_FSL_SAMSUNG_HDMI_PHY Adrian Hunter (2): perf record: Fix debug message placement for test consumption perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) Aleksandr Mishin (1): drm/msm/dpu: Add callback function pointer check before its call Alex Deucher (1): drm/amdgpu: Adjust logic in amdgpu_device_partner_bandwidth() Alexander Egorenkov (2): s390/ipl: Fix incorrect initialization of len fields in nvme reipl block s390/ipl: Fix incorrect initialization of nvme dump block Alexander Lobakin (1): idpf: don't enable NAPI and interrupts prior to allocating Rx buffers Alexander Maltsev (1): netfilter: ipset: Add list flush to cancel_gc Alexander Mikhalitsyn (1): ipv4: correctly iterate over the target netns in inet_dump_ifaddr() Alison Schofield (1): cxl/trace: Correct DPA field masks for general_media & dram events Andi Shyti (1): drm/i915/gt: Fix CCS id's calculation for CCS mode setting Andrea Mayer (1): ipv6: sr: fix missing sk_buff release in seg6_input_core Andrey Konovalov (1): kasan, fortify: properly rename memintrinsics Andy Shevchenko (6): iio: core: Leave private pointer NULL when no private data supplied serial: max3100: Lock port->lock when calling uart_handle_cts_change() serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Fix bitwise types usb: fotg210: Add missing kernel doc description spi: Don't mark message DMA mapped when no transfer in it is Anshuman Khandual (1): coresight: etm4x: Fix unbalanced pm_runtime_enable() Ard Biesheuvel (1): x86/efistub: Omit physical KASLR when memory reservations exist Arnaldo Carvalho de Melo (1): perf probe: Add missing libgen.h header needed for using basename() Arnd Bergmann (5): firmware: dmi-id: add a release callback function greybus: arche-ctrl: move device table to its right location module: don't ignore sysfs_create_link() failures Input: ims-pcu - fix printf string overflow drm/i915/guc: avoid FIELD_PREP warning Bard Liao (1): ASoC: rt715-sdca-sdw: Fix wrong complete waiting in rt715_dev_resume() Benjamin Coddington (1): NFSv4: Fixup smatch warning for ambiguous return Benjamin Gray (1): selftests/powerpc/dexcr: Add -no-pie to hashchk tests Bjorn Helgaas (1): x86/pci: Skip early E820 check for ECAM region Carlos López (1): tracing/probes: fix error check in parse_btf_field() Carolina Jubran (1): net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion Chao Yu (12): f2fs: multidev: fix to recognize valid zero block address f2fs: fix to wait on page writeback in __clone_blkaddrs() f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file() f2fs: fix to relocate check condition in f2fs_fallocate() f2fs: fix to check pinfile flag in f2fs_move_file_range() f2fs: compress: fix to update i_compr_blocks correctly f2fs: compress: fix error path of inc_valid_block_count() f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock f2fs: fix to release node block count in error path of f2fs_new_node_page() f2fs: compress: don't allow unaligned truncation on released compress inode f2fs: fix to add missing iput() in gc_data_segment() Charles Keepax (1): ASoC: cs42l43: Only restrict 44.1kHz for the ASP Charlie Jenkins (3): riscv: cpufeature: Fix thead vector hwcap removal riscv: cpufeature: Fix extension subset checking riscv: selftests: Add hwprobe binaries to .gitignore Chen Ni (2): dmaengine: idma64: Add check for dma_set_max_seg_size watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() Chris Wulff (2): usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. usb: gadget: u_audio: Clear uac pointer when freed. Christoph Hellwig (2): sd: also set max_user_sectors when setting max_sectors block: stack max_user_sectors Christophe JAILLET (3): VMCI: Fix an error handling path in vmci_guest_probe_device() i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() KVM: PPC: Book3S HV nestedv2: Fix an error handling path in gs_msg_ops_kvmhv_nestedv2_config_fill_info() Christophe Leroy (1): powerpc/bpf/32: Fix failing test_bpf tests Chuck Lever (1): SUNRPC: Fix loop termination condition in gss_free_in_token_pages() Dae R. Jeong (1): tls: fix missing memory barrier in tls_init Daeho Jeong (1): f2fs: write missing last sum blk of file pinning section Damien Le Moal (1): null_blk: Fix return value of nullb_device_power_store() Dan Aloni (2): sunrpc: fix NFSACL RPC retry on soft mount rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL Dan Carpenter (3): stm class: Fix a double free in stm_register_device() backlight: mp3309c: Fix signedness bug in mp3309c_parse_fwnode() media: stk1160: fix bounds checking in stk1160_copy_video() Daniel Borkmann (2): netkit: Fix setting mac address in l2 mode netkit: Fix pkt_type override upon netkit pass verdict Danila Tikhonov (1): pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs David E. Box (3): tools/arch/x86/intel_sdsi: Fix maximum meter bundle length tools/arch/x86/intel_sdsi: Fix meter_show display tools/arch/x86/intel_sdsi: Fix meter_certificate decoding David Howells (3): netfs: Fix setting of BDP_ASYNC from iocb flags cifs: Set zero_point in the copy_file_range() and remap_file_range() cifs: Fix missing set of remote_i_size David Stevens (1): virtio_balloon: Give the balloon its own wakeup source Devyn Liu (1): gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match Dmitry Baryshkov (6): usb: typec: ucsi: allow non-partner GET_PDOS for Qualcomm devices usb: typec: ucsi: always register a link to USB PD device usb: typec: ucsi: simplify partner's PD caps registration dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: fix x1e80100-gen3x2 schema dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x Dongli Zhang (1): genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline Dongliang Mu (1): media: flexcop-usb: fix sanity check of bNumEndpoints Duoming Zhou (3): PCI: of_property: Return error for int_map allocation failure watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger um: Fix return value in ubd_init() Eric Dumazet (4): netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() ipv6: introduce dst_rt6_info() helper inet: introduce dst_rtable() helper net: fix __dst_negative_advice() race Eric Garver (1): netfilter: nft_fib: allow from forward/input without iif selector Ethan Adams (1): perf build: Fix out of tree build related to installation of sysreg-defs Eugen Hristev (1): media: mediatek: vcodec: fix possible unbalanced PM counter Fabio Estevam (3): media: ov2680: Clear the 'ret' variable on success media: ov2680: Allow probing if link-frequencies is absent media: ov2680: Do not fail if data-lanes property is absent Fedor Pchelkin (3): dma-mapping: benchmark: fix up kthread-related error handling dma-mapping: benchmark: fix node id validation dma-mapping: benchmark: handle NUMA_NO_NODE correctly Fenghua Yu (1): dmaengine: idxd: Avoid unnecessary destruction of file_ida Fenglin Wu (1): Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation Florian Fainelli (1): net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled Florian Westphal (1): netfilter: tproxy: bail out if IP has been disabled on the device Frank Li (1): i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame Friedrich Vock (1): bpf: Fix potential integer overflow in resolve_btfids Gal Pressman (2): net/mlx5: Fix MTMP register capability offset in MCAM register net/mlx5e: Fix UDP GSO for encapsulated packets Geert Uytterhoeven (3): dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties pinctrl: renesas: r8a779h0: Fix IRQ suffixes Revert "drm: Make drivers depends on DRM_DW_HDMI" Geliang Tang (1): selftests: mptcp: add ms units for tc-netem delay Gerald Loacker (3): drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel Gerd Hoffmann (1): KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID Greg Kroah-Hartman (1): Linux 6.9.4 Guenter Roeck (1): hwmon: (shtc1) Fix property misspelling Hagar Hemdan (1): efi: libstub: only free priv.runtime_map when allocated Hangbin Liu (2): ipv6: sr: fix memleak in seg6_hmac_init_algo selftests/net: use tc rule to filter the na packet Hannah Peuckmann (2): riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware riscv: dts: starfive: visionfive 2: Remove non-existing I2S hardware Hans Verkuil (4): media: cec: cec-adap: always cancel work in cec_transmit_msg_fh media: cec: cec-api: add locking in cec_release() media: cec: core: avoid recursive cec_claim_log_addrs media: cec: core: avoid confusing "transmit timed out" message Hans de Goede (1): platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit() Harald Freudenberger (1): s390/ap: Fix bind complete udev event sent after each AP bus scan Hariprasad Kelam (1): Octeontx2-pf: Free send queue buffers incase of leaf to inner He Zhe (1): perf bench internals inject-build-id: Fix trap divide when collecting just one DSO Heiko Carstens (6): s390/vdso: Use standard stack frame layout s390/stacktrace: Merge perf_callchain_user() and arch_stack_walk_user() s390/stacktrace: Skip first user stack frame s390/stacktrace: Improve detection of invalid instruction pointers s390/vdso: Introduce and use struct stack_frame_vdso_wrapper s390/stackstrace: Detect vdso stack frames Henry Wang (1): drivers/xen: Improve the late XenStore init protocol Himal Prasad Ghimiray (1): drm/xe: Change pcode timeout to 50msec while polling again Horatiu Vultur (2): net: lan966x: Remove ptp traps in case the ptp is not enabled. net: micrel: Fix lan8841_config_intr after getting out of sleep mode Hou Tao (2): fuse: set FR_PENDING atomically in fuse_resend() fuse: clear FR_SENT when re-adding requests into pending list Hsin-Te Yuan (1): ASoC: mediatek: mt8192: fix register configuration for tdm Huacai Chen (1): LoongArch: Fix callchain parse error with kernel tracepoint events again Huai-Yuan Liu (1): ppdev: Add an error check in register_device Hugo Villeneuve (1): serial: sc16is7xx: add proper sched.h include for sched_set_fifo() Ian Rogers (15): perf record: Delete session after stopping sideband thread perf test: Use a single fd for the child process out/err perf bench uprobe: Remove lib64 from libc.so.6 binary path perf docs: Document bpf event modifier perf ui browser: Don't save pointer to stack memory perf annotate: Fix memory leak in annotated_source perf ui browser: Avoid SEGV on title perf report: Avoid SEGV in report__setup_sample_type() perf thread: Fixes to thread__new() related to initializing comm libsubcmd: Fix parse-options memory leak perf stat: Don't display metric header for non-leader uncore events perf tools: Use pmus to describe type from attribute perf tools: Add/use PMU reverse lookup from config to name perf pmu: Assume sysfs events are always the same case perf pmu: Count sys and cpuid JSON events separately Ido Schimmel (1): ipv4: Fix address dump when IPv4 is disabled on an interface Ilpo Järvinen (1): PCI: Wait for Link Training==0 before starting Link retrain Iulia Tanasescu (1): Bluetooth: ISO: Handle PA sync when no BIGInfo reports are generated Ivan Orlov (1): string_kunit: Add test cases for str*cmp functions Jacob Keller (2): Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI" ice: fix accounting if a VLAN already exists Jai Luthra (1): media: ti: j721e-csi2rx: Fix races while restarting DMA Jakub Sitnicki (1): bpf: Allow delete from sockmap/sockhash only if update is allowed James Clark (8): perf tests: Make "test data symbol" more robust on Neoverse N1 perf tests: Apply attributes to all events in object code reading test perf map: Remove kernel map before updating start and end addresses perf test shell arm_coresight: Increase buffer size for Coresight basic tests perf dwarf-aux: Fix build with HAVE_DWARF_CFI_SUPPORT perf symbols: Remove map from list before updating addresses perf symbols: Update kcore map before merging in remaining symbols perf symbols: Fix ownership of string in dso__load_vmlinux() Jason-JH.Lin (1): mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown Jens Remus (2): s390/vdso: Generate unwind information for C modules s390/vdso: Create .build-id links for unstripped vdso files Jiangfeng Xiao (1): arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY Jiri Pirko (1): virtio: delete vq in vp_find_vqs_msix() when request_irq() fails Johannes Berg (1): um: vector: fix bpfflash parameter evaluation Jonathan Cameron (1): iio: adc: stm32: Fixing err code to not indicate success Joseph Qi (1): ocfs2: correctly use ocfs2_find_next_zero_bit() Judith Mendez (5): mmc: sdhci_am654: Add tuning algorithm for delay chain mmc: sdhci_am654: Write ITAPDLY for DDR52 timing mmc: sdhci_am654: Add OTAP/ITAP delay enable mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock mmc: sdhci_am654: Fix ITAPDLY for HS400 timing Karel Balej (1): Input: ioc3kbd - add device table Kees Cook (3): string: Prepare to merge strscpy_kunit.c into string_kunit.c string: Prepare to merge strcat KUnit tests into string_kunit.c ubsan: Restore dependency on ARCH_HAS_UBSAN Keith Busch (2): nvme: fix multipath batched completion accounting nvme-multipath: fix io accounting on failover Konrad Dybcio (2): interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Konstantin Komarov (3): fs/ntfs3: Check 'folio' pointer for NULL fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow fs/ntfs3: Use variable length array instead of fixed size Krzysztof Kozlowski (1): dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios Kuniyuki Iwashima (4): af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). af_unix: Annotate data-race around unix_sk(sk)->addr. af_unix: Read sk->sk_hash under bindlock during bind(). Kuppuswamy Sathyanarayanan (2): PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 Larysa Zaremba (2): ice: Interpret .set_channels() input differently idpf: Interpret .set_channels() input differently Le Ma (1): drm/amdgpu: init microcode chip name from ip versions Li Zhijian (1): cxl/region: Fix cxlr_pmem leaks Luca Ceresoli (1): Revert "drm/bridge: ti-sn65dsi83: Fix enable error path" Luke D. Jones (1): ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp MD Danish Anwar (1): net: ti: icssg-prueth: Fix start counter for ft1 filter Maher Sanalla (1): net/mlx5: Lag, do bond only if slaves agree on roce state Manivannan Sadhasivam (1): PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host Marco Pagani (3): fpga: manager: add owner module and take its refcount fpga: bridge: add owner module and take its refcount fpga: region: add owner module and take its refcount Marek Szyprowski (1): Input: cyapa - add missing input core locking to suspend/resume functions Marijn Suijten (3): drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk drm/msm/dpu: Always flush the slave INTF on the CTL drm/msm/dpu: Allow configuring multiple active DSC blocks Mario Limonciello (1): drm/amd/display: Enable colorspace property for MST connectors Marius Cristea (1): iio: adc: PAC1934: fix accessing out of bounds array index Markus Elfring (1): spmi: pmic-arb: Replace three IS_ERR() calls by null pointer checks in spmi_pmic_arb_probe() Martin Kaiser (1): nfs: keep server info for remounts Masahiro Yamada (2): x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y kconfig: fix comparison to constant symbols, 'm', 'n' Mathieu Othacehe (1): net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 Matthew Brost (1): drm/xe: Only use reserved BCS instances for usm migrate exec queue Matthew Bystrin (1): riscv: stacktrace: fixed walk_stackframe() Matthew R. Ochs (1): tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer Matthew Wilcox (Oracle) (1): udf: Convert udf_expand_file_adinicb() to use a folio Matthieu Baerts (NGI0) (4): selftests: net: lib: set 'i' as local selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky selftests: mptcp: join: mark 'fastclose' tests as flaky selftests: mptcp: join: mark 'fail' tests as flaky Matti Vaittinen (4): watchdog: bd9576: Drop "always-running" property regulator: bd71828: Don't overwrite runtime voltages regulator: pickable ranges: don't always cache vsel regulator: tps6287x: Force writing VSEL bit Maxime Ripard (1): drm: Make drivers depends on DRM_DW_HDMI Michael Walle (1): drm/bridge: tc358775: fix support for jeida-18 and jeida-24 Michal Simek (2): microblaze: Remove gcc flag for non existing early_printk.c file microblaze: Remove early printk call from cpuinfo-static.c Miguel Ojeda (1): kheaders: use `command -v` to test for existence of `cpio` Miklos Szeredi (1): ovl: remove upper umask handling from ovl_create_upper() Ming Lei (2): blk-cgroup: fix list corruption from resetting io stat blk-cgroup: fix list corruption from reorder of WRITE ->lqueued Mohamed Ahmed (1): drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations Namhyung Kim (6): perf annotate: Get rid of duplicate --group option item perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline() perf dwarf-aux: Check pointer offset when checking variables perf dwarf-aux: Add die_collect_vars() perf annotate: Fix segfault on sample histogram perf/arm-dmc620: Fix lockdep assert in ->event_init() Nathan Lynch (1): powerpc/pseries/lparcfg: drop error message from guest name lookup Neha Malcom Francis (1): regulator: tps6594-regulator: Correct multi-phase configuration Neil Armstrong (2): phy: qcom: qmp-combo: fix sm8650 voltage swing table drm/meson: gate px_clk when setting rate Niklas Neronin (1): usb: xhci: check if 'requested segments' exceeds ERST capacity Nuno Sa (1): iio: adc: adi-axi-adc: only error out in major version mismatch Olga Kornievskaia (1): pNFS/filelayout: fixup pNfs allocation modes Oliver Upton (1): KVM: arm64: Destroy mpidr_data for 'late' vCPU creation Pablo Neira Ayuso (2): netfilter: nft_payload: restore vlan q-in-q match support netfilter: nft_payload: skbuff vlan metadata mangle support Paolo Abeni (1): net: relax socket state check at accept time. Parthiban Veerasooran (1): net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM Paul Barker (1): pinctrl: renesas: rzg2l: Limit 2.5V power supply to Ethernet interfaces Paul Greenwalt (1): ice: fix 200G PHY types to link speed mapping Peter Colberg (1): hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor Peter Ujfalusi (1): ASoC: SOF: debug: Handle cases when fw_lib_prefix is not set, NULL Petr Machata (4): selftests: forwarding: Change inappropriate log_test_skip() calls selftests: forwarding: Have RET track kselftest framework constants selftests: forwarding: Convert log_test() to recognize RET values selftests: net: Unify code of busywait() and slowwait() Pierre-Louis Bossart (1): soundwire: cadence: fix invalid PDI offset Rafał Miłecki (1): dt-bindings: pinctrl: mediatek: mt7622: fix array properties Rahul Rameshbabu (2): net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules net/mlx5e: Fix IPsec tunnel mode offload feature check Ramona Gradinariu (1): docs: iio: adis16475: fix device files tables Randy Dunlap (3): counter: linux/counter.h: fix Excess kernel-doc description warning extcon: max8997: select IRQ_DOMAIN instead of depending on it media: sunxi: a83-mips-csi2: also select GENERIC_PHY Riana Tauro (1): drm/xe: check pcode init status only on root gt of root tile Richard Fitzgerald (3): ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup ALSA: hda: hda_component: Initialize shared data during bind callback ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance Roberto Sassu (1): um: Add winch to winch_handlers before registering winch IRQ Roded Zats (1): enic: Validate length of nl attributes in enic_set_vf_port Rodrigo Vivi (1): drm/xe: Add dbg messages on the suspend resume functions. Roger Pau Monne (1): xen/x86: add extra pages to unpopulated-alloc if available Rui Miguel Silva (1): greybus: lights: check return of get_channel_from_mode Ryosuke Yasuoka (2): nfc: nci: Fix uninit-value in nci_rx_work nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() Sagi Grimberg (1): nvmet: fix ns enable/disable possible hang Sai Pavan Boddu (1): i2c: cadence: Avoid fifo clear after start Sakari Ailus (1): media: v4l: Don't turn on privacy LED if streamon fails Samasth Norway Ananda (1): perf daemon: Fix file leak in daemon_session__control Samuel Holland (1): riscv: Flush the instruction cache during SMP bringup Sean Anderson (1): drm: zynqmp_dpsub: Always register bridge Sergey Matyukevich (1): riscv: prevent pt_regs corruption for secondary idle threads Shay Agroskin (1): net: ena: Fix redundant device NUMA node override Shenghao Ding (3): ASoC: tas2781: Fix a warning reported by robot kernel test ASoC: tas2552: Add TX path for capturing AUDIO-OUT data ASoC: tas2781: Fix wrong loading calibrated data sequence Shrikanth Hegde (1): powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp Srinivas Pandruvada (2): platform/x86/intel/tpmi: Handle error from tpmi_process_info() platform/x86/intel-uncore-freq: Don't present root domain on error Srinivasan Shanmugam (1): drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() Sungwoo Kim (1): Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() Suzuki K Poulose (4): coresight: etm4x: Do not hardcode IOMEM access for register restore coresight: etm4x: Do not save/restore Data trace control registers coresight: etm4x: Safe access for TRCQCLTR coresight: etm4x: Fix access to resource selector registers Sven Schnelle (2): s390/ftrace: Use unwinder instead of __builtin_return_address() s390/boot: Remove alt_stfle_fac_list from decompressor Taehee Yoo (1): selftests: net: kill smcrouted in the cleanup logic in amt.sh Takashi Iwai (6): ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e ALSA: core: Remove debugfs at disconnection ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion ALSA: seq: Fix yet another spot for system message conversion ALSA: seq: ump: Fix swapped song position pointer data Tao Su (2): Revert "selftests/harness: remove use of LINE_MAX" selftests/harness: use 1024 in place of LINE_MAX Tariq Toukan (1): net/mlx5: Do not query MPIR on embedded CPU function Tengfei Fan (1): dt-bindings: pinctrl: qcom: update functions to match with driver Tetsuo Handa (1): dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Thomas Gleixner (2): x86/topology: Handle bogus ACPI tables correctly x86/topology/intel: Unlock CPUID before evaluating anything Thomas Haemmerle (1): iio: pressure: dps310: support negative temperature values Thomas Richter (2): perf report: Fix PAI counter names for s390 virtual machines perf stat: Do not fail on metrics on s390 z/VM systems Tiwei Bie (3): um: Fix the -Wmissing-prototypes warning for __switch_mm um: Fix the -Wmissing-prototypes warning for get_thread_reg um: Fix the declaration of kasan_map_memory Tristram Ha (1): net: dsa: microchip: fix RGMII error in KSZ DSA driver Uros Bizjak (2): x86/percpu: Unify arch_raw_cpu_ptr() defines x86/percpu: Use __force to cast from __percpu address space Uwe Kleine-König (3): leds: pwm: Disable PWM when going to suspend spi: stm32: Revert change that enabled controller before asserting CS spi: stm32: Don't warn about spurious interrupts Vaibhav Jain (1): KVM: PPC: Book3S HV nestedv2: Cancel pending DEC exception Vidya Sagar (1): PCI: tegra194: Fix probe path for Endpoint mode Vijendar Mukunda (1): ASoC: amd: acp: fix for acp platform device creation failure Vladimir Oltean (2): net/sched: taprio: make q->picos_per_byte available to fill_sched_entry() net/sched: taprio: extend minimum interval restriction to entire cycle too Waiman Long (1): blk-cgroup: Properly propagate the iostat update up the hierarchy Wei Fang (1): net: fec: avoid lock evasion when reading pps_enable Wojciech Macek (1): drm/mediatek: dp: Fix mtk_dp_aux_transfer return value Wolfram Sang (1): serial: sh-sci: protect invalidating RXDMA on shutdown Wu Bo (1): f2fs: fix block migration when section is not aligned to pow2 Xianwei Zhao (1): arm64: dts: meson: fix S4 power-controller node Xiaolei Wang (1): net:fec: Add fec_enet_deinit() Yang Jihong (1): perf sched timehist: Fix -g/--call-graph option failure Yang Li (1): rv: Update rv_en(dis)able_monitor doc to match kernel-doc Ye Bin (1): vfio/pci: fix potential memory leak in vfio_intx_enable() Yoann Congal (1): printk: Fix LOG_CPU_MAX_BUF_SHIFT when BASE_SMALL is enabled Yu Kuai (1): null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' Yue Haibing (1): ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Zan Dobersek (1): drm/msm/adreno: fix CP cycles stat retrieval on a7xx Zhu Yanjun (1): null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()

1 year, 2 months

1
1
0 0

Linux 6.6.33

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.33 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/kernel-parameters.txt | 3 Documentation/devicetree/bindings/iio/adc/adi,axi-adc.yaml | 13 Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml | 18 Documentation/devicetree/bindings/pci/rcar-pci-host.yaml | 14 Documentation/devicetree/bindings/pci/rockchip,rk3399-pcie.yaml | 1 Documentation/devicetree/bindings/phy/qcom,sc8280xp-qmp-ufs-phy.yaml | 16 Documentation/devicetree/bindings/phy/qcom,usb-snps-femto-v2.yaml | 4 Documentation/devicetree/bindings/pinctrl/mediatek,mt7622-pinctrl.yaml | 92 +- Documentation/devicetree/bindings/soc/rockchip/grf.yaml | 1 Documentation/devicetree/bindings/sound/rt5645.txt | 6 Documentation/devicetree/bindings/spmi/hisilicon,hisi-spmi-controller.yaml | 4 Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml | 34 Documentation/driver-api/fpga/fpga-bridge.rst | 7 Documentation/driver-api/fpga/fpga-mgr.rst | 34 Documentation/driver-api/fpga/fpga-region.rst | 13 Documentation/driver-api/pwm.rst | 8 Documentation/filesystems/f2fs.rst | 6 MAINTAINERS | 10 Makefile | 11 arch/arm/Makefile | 7 arch/arm/configs/sunxi_defconfig | 1 arch/arm/vdso/Makefile | 25 arch/arm64/Makefile | 9 arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 13 arch/arm64/include/asm/asm-bug.h | 1 arch/arm64/kernel/vdso/Makefile | 10 arch/arm64/kernel/vdso32/Makefile | 10 arch/loongarch/Makefile | 4 arch/loongarch/include/asm/perf_event.h | 3 arch/loongarch/kernel/perf_event.c | 2 arch/loongarch/vdso/Makefile | 10 arch/m68k/kernel/entry.S | 4 arch/m68k/mac/misc.c | 36 arch/microblaze/kernel/Makefile | 1 arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 arch/openrisc/kernel/traps.c | 48 - arch/parisc/Makefile | 8 arch/parisc/kernel/parisc_ksyms.c | 1 arch/powerpc/include/asm/hvcall.h | 2 arch/powerpc/platforms/pseries/lpar.c | 6 arch/powerpc/platforms/pseries/lparcfg.c | 10 arch/powerpc/sysdev/fsl_msi.c | 2 arch/riscv/Makefile | 9 arch/riscv/boot/dts/starfive/jh7110-starfive-visionfive-2.dtsi | 40 arch/riscv/kernel/compat_vdso/Makefile | 10 arch/riscv/kernel/cpu_ops_sbi.c | 2 arch/riscv/kernel/cpu_ops_spinwait.c | 3 arch/riscv/kernel/stacktrace.c | 20 arch/riscv/kernel/vdso/Makefile | 10 arch/riscv/net/bpf_jit_comp64.c | 20 arch/s390/Makefile | 6 arch/s390/boot/startup.c | 1 arch/s390/include/asm/gmap.h | 2 arch/s390/include/asm/mmu.h | 5 arch/s390/include/asm/mmu_context.h | 1 arch/s390/include/asm/pgtable.h | 16 arch/s390/kernel/ipl.c | 10 arch/s390/kernel/setup.c | 2 arch/s390/kernel/vdso32/Makefile | 14 arch/s390/kernel/vdso64/Makefile | 15 arch/s390/kvm/kvm-s390.c | 4 arch/s390/mm/gmap.c | 165 ++- arch/s390/net/bpf_jit_comp.c | 8 arch/sh/kernel/kprobes.c | 7 arch/sh/lib/checksum.S | 67 - arch/sparc/Makefile | 5 arch/sparc/vdso/Makefile | 27 arch/um/drivers/line.c | 14 arch/um/drivers/ubd_kern.c | 4 arch/um/drivers/vector_kern.c | 2 arch/um/include/asm/kasan.h | 1 arch/um/include/asm/mmu.h | 2 arch/um/include/asm/processor-generic.h | 1 arch/um/include/shared/kern_util.h | 2 arch/um/include/shared/skas/mm_id.h | 2 arch/um/os-Linux/mem.c | 1 arch/x86/Kconfig | 8 arch/x86/Kconfig.debug | 5 arch/x86/Makefile | 7 arch/x86/boot/compressed/head_64.S | 5 arch/x86/crypto/nh-avx2-x86_64.S | 1 arch/x86/crypto/sha256-avx2-asm.S | 1 arch/x86/crypto/sha512-avx2-asm.S | 1 arch/x86/entry/vdso/Makefile | 27 arch/x86/entry/vsyscall/vsyscall_64.c | 28 arch/x86/include/asm/cmpxchg_64.h | 2 arch/x86/include/asm/pgtable_types.h | 2 arch/x86/include/asm/processor.h | 1 arch/x86/include/asm/sparsemem.h | 2 arch/x86/kernel/apic/vector.c | 9 arch/x86/kernel/tsc_sync.c | 6 arch/x86/kvm/cpuid.c | 21 arch/x86/lib/x86-opcode-map.txt | 10 arch/x86/mm/fault.c | 33 arch/x86/mm/numa.c | 4 arch/x86/mm/pat/set_memory.c | 68 + arch/x86/net/bpf_jit_comp.c | 57 - arch/x86/pci/mmconfig-shared.c | 40 arch/x86/purgatory/Makefile | 3 arch/x86/tools/relocs.c | 9 arch/x86/um/shared/sysdep/archsetjmp.h | 7 arch/x86/xen/enlighten.c | 33 block/blk-cgroup.c | 87 +- block/blk-core.c | 9 block/blk-merge.c | 2 block/blk-mq.c | 4 block/blk.h | 1 block/fops.c | 2 block/genhd.c | 2 block/partitions/cmdline.c | 49 - crypto/asymmetric_keys/Kconfig | 3 drivers/accel/ivpu/ivpu_job.c | 3 drivers/accessibility/speakup/main.c | 2 drivers/acpi/acpi_lpss.c | 1 drivers/acpi/acpica/Makefile | 1 drivers/acpi/numa/srat.c | 5 drivers/base/base.h | 9 drivers/base/bus.c | 9 drivers/base/module.c | 42 - drivers/block/null_blk/main.c | 3 drivers/bluetooth/btmrvl_main.c | 9 drivers/bluetooth/btqca.c | 4 drivers/bluetooth/btrsi.c | 1 drivers/bluetooth/btsdio.c | 8 drivers/bluetooth/btusb.c | 5 drivers/bluetooth/hci_bcm4377.c | 1 drivers/bluetooth/hci_ldisc.c | 6 drivers/bluetooth/hci_serdev.c | 5 drivers/bluetooth/hci_uart.h | 1 drivers/bluetooth/hci_vhci.c | 10 drivers/bluetooth/virtio_bt.c | 2 drivers/char/ppdev.c | 21 drivers/char/tpm/tpm_tis_spi_main.c | 3 drivers/clk/clk-renesas-pcie.c | 10 drivers/clk/mediatek/clk-mt8365-mm.c | 2 drivers/clk/mediatek/clk-pllfh.c | 2 drivers/clk/qcom/clk-alpha-pll.c | 1 drivers/clk/qcom/dispcc-sm6350.c | 11 drivers/clk/qcom/dispcc-sm8450.c | 20 drivers/clk/qcom/dispcc-sm8550.c | 20 drivers/clk/qcom/mmcc-msm8998.c | 8 drivers/clk/renesas/r8a779a0-cpg-mssr.c | 2 drivers/clk/renesas/r9a07g043-cpg.c | 9 drivers/clk/samsung/clk-exynosautov9.c | 8 drivers/cpufreq/brcmstb-avs-cpufreq.c | 5 drivers/cpufreq/cppc_cpufreq.c | 14 drivers/cpufreq/cpufreq.c | 11 drivers/crypto/bcm/spu2.c | 2 drivers/crypto/ccp/sp-platform.c | 14 drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 2 drivers/cxl/core/region.c | 1 drivers/cxl/core/trace.h | 4 drivers/dma-buf/st-dma-fence-chain.c | 12 drivers/dma-buf/st-dma-fence.c | 4 drivers/dma-buf/sync_debug.c | 4 drivers/dma/idma64.c | 4 drivers/dma/idxd/cdev.c | 1 drivers/extcon/Kconfig | 3 drivers/firmware/dmi-id.c | 7 drivers/firmware/efi/libstub/fdt.c | 4 drivers/firmware/efi/libstub/x86-stub.c | 28 drivers/firmware/qcom_scm.c | 10 drivers/firmware/raspberrypi.c | 7 drivers/fpga/dfl-pci.c | 3 drivers/fpga/fpga-bridge.c | 57 - drivers/fpga/fpga-mgr.c | 82 + drivers/fpga/fpga-region.c | 24 drivers/gpio/gpiolib-acpi.c | 19 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 8 drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 16 drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 15 drivers/gpu/drm/amd/display/dc/core/dc.c | 3 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 2 drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c | 10 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 25 drivers/gpu/drm/arm/malidp_mw.c | 5 drivers/gpu/drm/bridge/analogix/anx7625.c | 15 drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 drivers/gpu/drm/bridge/chipone-icn6211.c | 6 drivers/gpu/drm/bridge/lontium-lt8912b.c | 6 drivers/gpu/drm/bridge/lontium-lt9611.c | 6 drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 6 drivers/gpu/drm/bridge/tc358775.c | 27 drivers/gpu/drm/bridge/ti-dlpc3433.c | 17 drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 drivers/gpu/drm/ci/build.yml | 1 drivers/gpu/drm/ci/gitlab-ci.yml | 22 drivers/gpu/drm/ci/image-tags.yml | 2 drivers/gpu/drm/ci/lava-submit.sh | 2 drivers/gpu/drm/ci/test.yml | 27 drivers/gpu/drm/display/drm_dp_helper.c | 35 drivers/gpu/drm/drm_bridge.c | 10 drivers/gpu/drm/drm_edid.c | 2 drivers/gpu/drm/drm_mipi_dsi.c | 6 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 4 drivers/gpu/drm/i915/display/intel_backlight.c | 6 drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 2 drivers/gpu/drm/i915/gt/intel_gt_types.h | 8 drivers/gpu/drm/i915/gt/selftest_migrate.c | 4 drivers/gpu/drm/i915/gt/uc/abi/guc_klvs_abi.h | 6 drivers/gpu/drm/i915/gvt/interrupt.c | 13 drivers/gpu/drm/mediatek/mtk_dp.c | 2 drivers/gpu/drm/mediatek/mtk_drm_gem.c | 3 drivers/gpu/drm/meson/meson_dw_mipi_dsi.c | 7 drivers/gpu/drm/meson/meson_vclk.c | 6 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.h | 2 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 30 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 2 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 11 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 4 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 16 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 131 +-- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.h | 18 drivers/gpu/drm/msm/dp/dp_aux.c | 20 drivers/gpu/drm/msm/dp/dp_aux.h | 1 drivers/gpu/drm/msm/dp/dp_ctrl.c | 6 drivers/gpu/drm/msm/dp/dp_display.c | 4 drivers/gpu/drm/msm/dp/dp_link.c | 22 drivers/gpu/drm/msm/dp/dp_link.h | 14 drivers/gpu/drm/msm/dsi/dsi_host.c | 10 drivers/gpu/drm/mxsfb/lcdif_drv.c | 6 drivers/gpu/drm/nouveau/nouveau_abi16.c | 12 drivers/gpu/drm/nouveau/nouveau_bo.c | 44 - drivers/gpu/drm/omapdrm/Kconfig | 2 drivers/gpu/drm/omapdrm/omap_fbdev.c | 40 drivers/gpu/drm/panel/panel-edp.c | 3 drivers/gpu/drm/panel/panel-novatek-nt35950.c | 6 drivers/gpu/drm/panel/panel-samsung-atna33xc20.c | 24 drivers/gpu/drm/panel/panel-simple.c | 3 drivers/gpu/drm/panel/panel-sitronix-st7789v.c | 16 drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 22 drivers/gpu/drm/solomon/ssd130x.c | 2 drivers/gpu/drm/vc4/vc4_hdmi.c | 2 drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 7 drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 10 drivers/hid/hid-mcp2221.c | 2 drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 drivers/hwmon/intel-m10-bmc-hwmon.c | 2 drivers/hwmon/pwm-fan.c | 8 drivers/hwmon/shtc1.c | 2 drivers/hwtracing/coresight/coresight-etm4x-core.c | 29 drivers/hwtracing/coresight/coresight-etm4x.h | 31 drivers/hwtracing/stm/core.c | 11 drivers/i2c/busses/i2c-cadence.c | 1 drivers/i2c/busses/i2c-synquacer.c | 20 drivers/i3c/master/svc-i3c-master.c | 36 drivers/iio/Kconfig | 9 drivers/iio/Makefile | 1 drivers/iio/accel/mxc4005.c | 76 + drivers/iio/adc/Kconfig | 6 drivers/iio/adc/ad9467.c | 310 ++++--- drivers/iio/adc/adi-axi-adc.c | 408 ++------- drivers/iio/adc/stm32-adc.c | 1 drivers/iio/buffer/industrialio-buffer-dmaengine.c | 8 drivers/iio/industrialio-backend.c | 418 ++++++++++ drivers/iio/industrialio-core.c | 6 drivers/iio/pressure/dps310.c | 11 drivers/infiniband/core/cma.c | 4 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 57 - drivers/infiniband/hw/bnxt_re/ib_verbs.h | 7 drivers/infiniband/hw/bnxt_re/qplib_fp.c | 208 +++- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 34 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 19 drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 4 drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 drivers/infiniband/hw/bnxt_re/qplib_res.h | 46 - drivers/infiniband/hw/bnxt_re/roce_hsi.h | 67 + drivers/infiniband/hw/hns/hns_roce_cq.c | 24 drivers/infiniband/hw/hns/hns_roce_hem.h | 12 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 7 drivers/infiniband/hw/hns/hns_roce_main.c | 1 drivers/infiniband/hw/hns/hns_roce_mr.c | 15 drivers/infiniband/hw/hns/hns_roce_srq.c | 6 drivers/infiniband/hw/mlx5/mem.c | 8 drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 drivers/infiniband/hw/mlx5/mr.c | 3 drivers/infiniband/sw/rxe/rxe_comp.c | 6 drivers/infiniband/sw/rxe/rxe_net.c | 12 drivers/infiniband/sw/rxe/rxe_verbs.c | 6 drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 drivers/input/input.c | 104 ++ drivers/input/joystick/xpad.c | 2 drivers/input/misc/da7280.c | 4 drivers/input/misc/ims-pcu.c | 4 drivers/input/misc/pm8xxx-vibrator.c | 7 drivers/input/misc/pwm-beeper.c | 4 drivers/input/misc/pwm-vibra.c | 8 drivers/input/mouse/cyapa.c | 12 drivers/interconnect/qcom/qcm2290.c | 2 drivers/iommu/iommu.c | 21 drivers/irqchip/irq-alpine-msi.c | 2 drivers/irqchip/irq-loongson-pch-msi.c | 2 drivers/leds/leds-pwm.c | 10 drivers/leds/rgb/leds-pwm-multicolor.c | 4 drivers/macintosh/via-macii.c | 11 drivers/md/md-bitmap.c | 6 drivers/media/cec/core/cec-adap.c | 24 drivers/media/cec/core/cec-api.c | 5 drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 drivers/media/i2c/ov2680.c | 13 drivers/media/pci/intel/ipu3/ipu3-cio2.c | 10 drivers/media/pci/ngene/ngene-core.c | 4 drivers/media/platform/cadence/cdns-csi2rx.c | 26 drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc.c | 21 drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c | 20 drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h | 3 drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c | 11 drivers/media/platform/renesas/rcar-vin/rcar-vin.h | 2 drivers/media/platform/renesas/vsp1/vsp1_pipe.c | 2 drivers/media/platform/renesas/vsp1/vsp1_rpf.c | 10 drivers/media/platform/renesas/vsp1/vsp1_rwpf.c | 8 drivers/media/platform/renesas/vsp1/vsp1_rwpf.h | 4 drivers/media/platform/renesas/vsp1/vsp1_wpf.c | 29 drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig | 1 drivers/media/radio/radio-shark2.c | 2 drivers/media/rc/ir-rx51.c | 4 drivers/media/rc/pwm-ir-tx.c | 4 drivers/media/usb/b2c2/flexcop-usb.c | 2 drivers/media/usb/stk1160/stk1160-video.c | 20 drivers/media/usb/uvc/uvc_driver.c | 31 drivers/media/usb/uvc/uvcvideo.h | 1 drivers/media/v4l2-core/v4l2-subdev.c | 39 drivers/misc/lkdtm/Makefile | 2 drivers/misc/lkdtm/perms.c | 2 drivers/misc/pvpanic/pvpanic-mmio.c | 58 - drivers/misc/pvpanic/pvpanic-pci.c | 60 - drivers/misc/pvpanic/pvpanic.c | 76 + drivers/misc/pvpanic/pvpanic.h | 10 drivers/misc/vmw_vmci/vmci_guest.c | 10 drivers/mmc/host/sdhci_am654.c | 205 +++- drivers/mtd/mtdcore.c | 6 drivers/mtd/nand/raw/nand_hynix.c | 2 drivers/net/Makefile | 4 drivers/net/dsa/microchip/ksz_common.c | 2 drivers/net/dsa/mv88e6xxx/chip.c | 50 + drivers/net/dsa/mv88e6xxx/chip.h | 6 drivers/net/dsa/mv88e6xxx/global1.c | 89 ++ drivers/net/dsa/mv88e6xxx/global1.h | 2 drivers/net/ethernet/amazon/ena/ena_com.c | 326 ++----- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 49 - drivers/net/ethernet/amazon/ena/ena_eth_com.h | 15 drivers/net/ethernet/amazon/ena/ena_netdev.c | 32 drivers/net/ethernet/cisco/enic/enic_main.c | 12 drivers/net/ethernet/cortina/gemini.c | 12 drivers/net/ethernet/freescale/enetc/enetc.c | 2 drivers/net/ethernet/freescale/fec_main.c | 36 drivers/net/ethernet/freescale/fec_ptp.c | 14 drivers/net/ethernet/intel/ice/ice_ethtool.c | 19 drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 11 drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 3 drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 56 - drivers/net/ethernet/marvell/octeontx2/nic/qos.c | 4 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 44 - drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 6 drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h | 8 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 17 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 6 drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 2 drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 4 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 28 drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 18 drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c | 18 drivers/net/ethernet/microchip/lan966x/lan966x_main.c | 12 drivers/net/ethernet/microsoft/mana/hw_channel.c | 2 drivers/net/ethernet/qlogic/qed/qed_main.c | 9 drivers/net/ethernet/realtek/r8169_main.c | 9 drivers/net/ethernet/smsc/smc91x.h | 4 drivers/net/ethernet/sun/sungem.c | 14 drivers/net/ethernet/ti/icssg/icssg_classifier.c | 2 drivers/net/ethernet/ti/icssg/icssg_prueth.c | 14 drivers/net/ethernet/wangxun/libwx/wx_lib.c | 4 drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 8 drivers/net/ipvlan/ipvlan_core.c | 4 drivers/net/phy/micrel.c | 14 drivers/net/usb/aqc111.c | 8 drivers/net/usb/qmi_wwan.c | 3 drivers/net/usb/smsc95xx.c | 26 drivers/net/usb/sr9700.c | 10 drivers/net/wireless/ath/ar5523/ar5523.c | 14 drivers/net/wireless/ath/ath10k/core.c | 3 drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 drivers/net/wireless/ath/ath10k/hw.h | 1 drivers/net/wireless/ath/ath10k/targaddrs.h | 3 drivers/net/wireless/ath/ath10k/wmi.c | 26 drivers/net/wireless/ath/ath11k/mac.c | 9 drivers/net/wireless/ath/ath12k/qmi.c | 3 drivers/net/wireless/ath/ath12k/wmi.c | 2 drivers/net/wireless/ath/carl9170/tx.c | 3 drivers/net/wireless/ath/carl9170/usb.c | 32 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 15 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 19 drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 9 drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 19 drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 drivers/net/wireless/marvell/mwl8k.c | 2 drivers/net/wireless/mediatek/mt76/mt7603/dma.c | 46 - drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 1 drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 6 drivers/net/xen-netback/interface.c | 3 drivers/nvme/host/core.c | 23 drivers/nvme/host/multipath.c | 6 drivers/nvme/host/nvme.h | 22 drivers/nvme/host/pci.c | 8 drivers/nvme/target/auth.c | 8 drivers/nvme/target/configfs.c | 20 drivers/nvme/target/core.c | 5 drivers/nvme/target/nvmet.h | 1 drivers/nvme/target/tcp.c | 11 drivers/of/module.c | 7 drivers/pci/controller/dwc/pcie-tegra194.c | 3 drivers/pci/of_property.c | 2 drivers/pci/pci.c | 2 drivers/pci/pcie/edr.c | 28 drivers/perf/arm_dmc620_pmu.c | 9 drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 drivers/perf/hisilicon/hns3_pmu.c | 16 drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 2 drivers/pinctrl/qcom/pinctrl-sm7150.c | 20 drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 1 drivers/platform/x86/intel/tpmi.c | 7 drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 7 drivers/platform/x86/lenovo-yogabook.c | 2 drivers/platform/x86/thinkpad_acpi.c | 5 drivers/pwm/core.c | 18 drivers/pwm/pwm-sti.c | 46 - drivers/pwm/pwm-twl-led.c | 2 drivers/pwm/pwm-vt8500.c | 2 drivers/pwm/sysfs.c | 10 drivers/regulator/bd71828-regulator.c | 58 - drivers/regulator/helpers.c | 43 - drivers/regulator/irq_helpers.c | 3 drivers/regulator/pwm-regulator.c | 4 drivers/regulator/qcom-refgen-regulator.c | 1 drivers/regulator/tps6287x-regulator.c | 1 drivers/regulator/tps6594-regulator.c | 16 drivers/regulator/vqmmc-ipq4019-regulator.c | 1 drivers/s390/cio/trace.h | 2 drivers/scsi/bfa/bfad_debugfs.c | 4 drivers/scsi/hpsa.c | 2 drivers/scsi/libsas/sas_expander.c | 3 drivers/scsi/qedf/qedf_debugfs.c | 2 drivers/scsi/qla2xxx/qla_dfs.c | 2 drivers/soc/mediatek/mtk-cmdq-helper.c | 5 drivers/soc/qcom/pmic_glink.c | 26 drivers/soundwire/cadence_master.c | 2 drivers/spi/spi-stm32.c | 2 drivers/spi/spi.c | 4 drivers/staging/greybus/arche-apb-ctrl.c | 1 drivers/staging/greybus/arche-platform.c | 9 drivers/staging/greybus/light.c | 8 drivers/staging/media/atomisp/pci/sh_css.c | 1 drivers/thermal/qcom/tsens.c | 2 drivers/tty/n_gsm.c | 140 ++- drivers/tty/serial/8250/8250_bcm7271.c | 101 +- drivers/tty/serial/8250/8250_mtk.c | 8 drivers/tty/serial/max3100.c | 22 drivers/tty/serial/sc16is7xx.c | 27 drivers/tty/serial/sh-sci.c | 5 drivers/ufs/core/ufs-mcq.c | 3 drivers/ufs/core/ufshcd.c | 6 drivers/ufs/host/cdns-pltfrm.c | 2 drivers/ufs/host/ufs-qcom.c | 7 drivers/ufs/host/ufs-qcom.h | 12 drivers/usb/fotg210/fotg210-core.c | 1 drivers/usb/gadget/function/u_audio.c | 21 drivers/usb/typec/ucsi/ucsi.c | 18 drivers/usb/usbip/usbip_common.h | 6 drivers/vfio/pci/vfio_pci_intrs.c | 4 drivers/video/backlight/lm3630a_bl.c | 2 drivers/video/backlight/lp855x_bl.c | 2 drivers/video/backlight/pwm_bl.c | 12 drivers/video/fbdev/Kconfig | 4 drivers/video/fbdev/core/Kconfig | 12 drivers/video/fbdev/core/Makefile | 3 drivers/video/fbdev/core/fb_io_fops.c | 3 drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 drivers/video/fbdev/sis/init301.c | 3 drivers/video/fbdev/ssd1307fb.c | 2 drivers/virt/acrn/mm.c | 61 + drivers/virtio/virtio_pci_common.c | 4 drivers/watchdog/bd9576_wdt.c | 12 drivers/watchdog/cpu5wdt.c | 2 drivers/watchdog/sa1100_wdt.c | 5 drivers/xen/xenbus/xenbus_probe.c | 36 fs/dlm/ast.c | 14 fs/dlm/dlm_internal.h | 1 fs/dlm/user.c | 15 fs/ecryptfs/keystore.c | 4 fs/eventpoll.c | 38 fs/ext4/inode.c | 3 fs/ext4/mballoc.c | 1 fs/ext4/namei.c | 2 fs/f2fs/checkpoint.c | 10 fs/f2fs/compress.c | 64 - fs/f2fs/data.c | 148 +-- fs/f2fs/debug.c | 6 fs/f2fs/dir.c | 5 fs/f2fs/f2fs.h | 165 ++- fs/f2fs/file.c | 134 +-- fs/f2fs/gc.c | 117 +- fs/f2fs/node.c | 6 fs/f2fs/node.h | 4 fs/f2fs/recovery.c | 2 fs/f2fs/segment.c | 244 ++--- fs/f2fs/segment.h | 66 - fs/f2fs/super.c | 116 -- fs/f2fs/sysfs.c | 6 fs/gfs2/acl.h | 8 fs/gfs2/aops.c | 36 fs/gfs2/aops.h | 6 fs/gfs2/bmap.c | 4 fs/gfs2/bmap.h | 38 fs/gfs2/dir.c | 2 fs/gfs2/dir.h | 38 fs/gfs2/file.c | 2 fs/gfs2/glock.c | 97 +- fs/gfs2/glock.h | 107 +- fs/gfs2/glops.c | 5 fs/gfs2/glops.h | 4 fs/gfs2/incore.h | 3 fs/gfs2/inode.c | 15 fs/gfs2/inode.h | 52 - fs/gfs2/lock_dlm.c | 40 fs/gfs2/log.c | 21 fs/gfs2/log.h | 46 - fs/gfs2/lops.h | 22 fs/gfs2/meta_io.c | 9 fs/gfs2/meta_io.h | 20 fs/gfs2/ops_fstype.c | 28 fs/gfs2/quota.c | 8 fs/gfs2/quota.h | 35 fs/gfs2/recovery.c | 2 fs/gfs2/recovery.h | 18 fs/gfs2/rgrp.c | 12 fs/gfs2/rgrp.h | 85 +- fs/gfs2/super.c | 19 fs/gfs2/super.h | 50 - fs/gfs2/sys.c | 2 fs/gfs2/trans.c | 2 fs/gfs2/trans.h | 24 fs/gfs2/util.c | 5 fs/gfs2/util.h | 23 fs/gfs2/xattr.c | 6 fs/gfs2/xattr.h | 12 fs/jffs2/xattr.c | 3 fs/nfs/filelayout/filelayout.c | 4 fs/nfs/fs_context.c | 9 fs/nfs/nfs4state.c | 12 fs/nilfs2/ioctl.c | 2 fs/nilfs2/segment.c | 63 + fs/ntfs3/dir.c | 1 fs/ntfs3/fslog.c | 3 fs/ntfs3/index.c | 6 fs/ntfs3/inode.c | 24 fs/ntfs3/ntfs.h | 2 fs/ntfs3/record.c | 11 fs/ntfs3/super.c | 2 fs/openpromfs/inode.c | 8 fs/overlayfs/dir.c | 3 fs/smb/server/mgmt/share_config.c | 6 fs/smb/server/oplock.c | 21 fs/smb/server/smb2pdu.c | 4 fs/tracefs/event_inode.c | 156 ++- fs/tracefs/internal.h | 9 fs/udf/inode.c | 27 include/drm/display/drm_dp_helper.h | 6 include/drm/drm_displayid.h | 1 include/drm/drm_mipi_dsi.h | 6 include/linux/acpi.h | 2 include/linux/bitops.h | 1 include/linux/counter.h | 1 include/linux/cpu.h | 11 include/linux/dev_printk.h | 25 include/linux/f2fs_fs.h | 6 include/linux/fb.h | 4 include/linux/fortify-string.h | 22 include/linux/fpga/fpga-bridge.h | 10 include/linux/fpga/fpga-mgr.h | 26 include/linux/fpga/fpga-region.h | 13 include/linux/i3c/device.h | 2 include/linux/ieee80211.h | 2 include/linux/iio/adc/adi-axi-adc.h | 68 - include/linux/iio/backend.h | 72 + include/linux/iio/buffer-dmaengine.h | 3 include/linux/kthread.h | 1 include/linux/mlx5/driver.h | 1 include/linux/mlx5/mlx5_ifc.h | 4 include/linux/numa.h | 26 include/linux/nvme-tcp.h | 6 include/linux/printk.h | 2 include/linux/pwm.h | 28 include/linux/regulator/driver.h | 3 include/linux/tracefs.h | 3 include/media/cec.h | 1 include/media/v4l2-subdev.h | 4 include/net/ax25.h | 3 include/net/bluetooth/hci.h | 114 -- include/net/bluetooth/hci_core.h | 46 - include/net/bluetooth/hci_sync.h | 2 include/net/bluetooth/l2cap.h | 11 include/net/mac80211.h | 3 include/net/tcp.h | 11 include/sound/cs35l56.h | 1 include/sound/soc-acpi-intel-match.h | 2 include/sound/tas2781-dsp.h | 7 include/trace/events/asoc.h | 2 include/uapi/drm/nouveau_drm.h | 21 include/uapi/linux/bpf.h | 2 include/uapi/linux/user_events.h | 11 include/uapi/linux/virtio_bt.h | 1 include/uapi/rdma/bnxt_re-abi.h | 10 io_uring/io-wq.c | 13 io_uring/io_uring.h | 2 io_uring/nop.c | 2 kernel/Makefile | 1 kernel/bpf/syscall.c | 5 kernel/bpf/verifier.c | 39 kernel/cgroup/cpuset.c | 2 kernel/cpu.c | 14 kernel/dma/map_benchmark.c | 22 kernel/gen_kheaders.sh | 7 kernel/irq/cpuhotplug.c | 16 kernel/irq/manage.c | 15 kernel/kthread.c | 18 kernel/numa.c | 26 kernel/rcu/tasks.h | 2 kernel/rcu/tree_stall.h | 3 kernel/sched/core.c | 2 kernel/sched/fair.c | 53 - kernel/sched/isolation.c | 7 kernel/sched/topology.c | 2 kernel/smpboot.c | 3 kernel/softirq.c | 12 kernel/trace/ftrace.c | 39 kernel/trace/ring_buffer.c | 9 kernel/trace/rv/rv.c | 2 kernel/trace/trace_events.c | 12 kernel/trace/trace_events_user.c | 213 +++-- kernel/trace/trace_probe.c | 4 lib/fortify_kunit.c | 16 lib/kunit/try-catch.c | 9 lib/slub_kunit.c | 2 lib/test_hmm.c | 8 mm/damon/core.c | 3 mm/userfaultfd.c | 35 net/ax25/ax25_dev.c | 48 - net/bluetooth/hci_conn.c | 10 net/bluetooth/hci_core.c | 135 --- net/bluetooth/hci_event.c | 310 ------- net/bluetooth/hci_sock.c | 9 net/bluetooth/hci_sync.c | 138 --- net/bluetooth/l2cap_core.c | 77 + net/bluetooth/l2cap_sock.c | 91 +- net/bluetooth/mgmt.c | 84 -- net/bridge/br_device.c | 6 net/bridge/br_mst.c | 16 net/core/dev.c | 3 net/core/pktgen.c | 3 net/ipv4/af_inet.c | 4 net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 net/ipv4/tcp_dctcp.c | 13 net/ipv4/tcp_ipv4.c | 13 net/ipv4/udp.c | 21 net/ipv6/reassembly.c | 2 net/ipv6/seg6.c | 5 net/ipv6/seg6_hmac.c | 42 - net/ipv6/seg6_iptunnel.c | 11 net/ipv6/udp.c | 20 net/mac80211/mlme.c | 3 net/mac80211/rate.c | 6 net/mac80211/scan.c | 1 net/mac80211/tx.c | 13 net/mptcp/sockopt.c | 2 net/netfilter/ipset/ip_set_list_set.c | 3 net/netfilter/nfnetlink_queue.c | 2 net/netfilter/nft_fib.c | 8 net/netfilter/nft_payload.c | 95 +- net/netrom/nr_route.c | 19 net/nfc/nci/core.c | 18 net/openvswitch/actions.c | 6 net/openvswitch/flow.c | 3 net/packet/af_packet.c | 3 net/qrtr/ns.c | 27 net/sched/sch_taprio.c | 14 net/sunrpc/auth_gss/svcauth_gss.c | 12 net/sunrpc/clnt.c | 1 net/sunrpc/svc.c | 2 net/sunrpc/xprtrdma/verbs.c | 6 net/tls/tls_main.c | 10 net/unix/af_unix.c | 49 - net/wireless/nl80211.c | 14 net/wireless/trace.h | 4 scripts/Makefile.vdsoinst | 45 + scripts/kconfig/symbol.c | 6 scripts/module.lds.S | 1 sound/core/init.c | 20 sound/core/jack.c | 46 - sound/core/seq/seq_ump_convert.c | 46 + sound/core/timer.c | 10 sound/hda/intel-dsp-config.c | 27 sound/pci/emu10k1/io.c | 1 sound/pci/hda/cs35l56_hda.c | 26 sound/pci/hda/hda_cs_dsp_ctl.c | 47 - sound/pci/hda/patch_realtek.c | 5 sound/soc/amd/yc/acp6x-mach.c | 7 sound/soc/codecs/cs35l41.c | 26 sound/soc/codecs/cs35l56-shared.c | 41 sound/soc/codecs/cs35l56.c | 21 sound/soc/codecs/cs42l43.c | 5 sound/soc/codecs/da7219-aad.c | 6 sound/soc/codecs/rt5645.c | 25 sound/soc/codecs/rt715-sdca.c | 8 sound/soc/codecs/rt715-sdw.c | 1 sound/soc/codecs/rt722-sdca.c | 27 sound/soc/codecs/rt722-sdca.h | 3 sound/soc/codecs/tas2552.c | 15 sound/soc/codecs/tas2781-fmwlib.c | 109 -- sound/soc/codecs/tas2781-i2c.c | 4 sound/soc/intel/avs/boards/ssm4567.c | 1 sound/soc/intel/avs/cldma.c | 2 sound/soc/intel/avs/path.c | 1 sound/soc/intel/avs/probes.c | 14 sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 sound/soc/intel/boards/bxt_rt298.c | 1 sound/soc/intel/boards/bytcr_rt5640.c | 14 sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 sound/soc/intel/boards/kbl_da7219_max98927.c | 4 sound/soc/intel/boards/kbl_rt5660.c | 1 sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 1 sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 sound/soc/intel/boards/skl_nau88l25_max98357a.c | 1 sound/soc/intel/boards/skl_rt286.c | 1 sound/soc/intel/common/Makefile | 1 sound/soc/intel/common/soc-acpi-intel-arl-match.c | 51 + sound/soc/kirkwood/kirkwood-dma.c | 3 sound/soc/mediatek/common/mtk-soundcard-driver.c | 6 sound/soc/mediatek/mt8192/mt8192-dai-tdm.c | 4 sound/soc/sof/intel/hda.h | 1 sound/soc/sof/intel/lnl.c | 3 sound/soc/sof/intel/lnl.h | 15 sound/soc/sof/intel/mtl.c | 83 + sound/soc/sof/intel/mtl.h | 4 sound/soc/sof/intel/pci-mtl.c | 31 sound/soc/sof/ipc3-pcm.c | 1 sound/soc/sof/pcm.c | 13 sound/soc/sof/sof-audio.h | 2 tools/arch/x86/intel_sdsi/intel_sdsi.c | 48 - tools/arch/x86/lib/x86-opcode-map.txt | 10 tools/bpf/bpftool/common.c | 96 ++ tools/bpf/bpftool/iter.c | 2 tools/bpf/bpftool/main.h | 3 tools/bpf/bpftool/prog.c | 5 tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 4 tools/bpf/bpftool/struct_ops.c | 2 tools/bpf/resolve_btfids/main.c | 2 tools/include/nolibc/stdlib.h | 2 tools/include/uapi/linux/bpf.h | 2 tools/lib/bpf/libbpf.c | 2 tools/lib/perf/evlist.c | 9 tools/lib/perf/include/internal/evlist.h | 2 tools/lib/subcmd/parse-options.c | 8 tools/perf/Documentation/perf-list.txt | 1 tools/perf/arch/arm64/util/pmu.c | 6 tools/perf/bench/inject-buildid.c | 2 tools/perf/bench/uprobe.c | 2 tools/perf/builtin-annotate.c | 46 - tools/perf/builtin-daemon.c | 4 tools/perf/builtin-inject.c | 6 tools/perf/builtin-record.c | 74 + tools/perf/builtin-report.c | 42 - tools/perf/builtin-sched.c | 7 tools/perf/builtin-top.c | 44 - tools/perf/pmu-events/arch/s390/cf_z16/transaction.json | 28 tools/perf/tests/Build | 1 tools/perf/tests/attr/system-wide-dummy | 14 tools/perf/tests/attr/test-record-C0 | 4 tools/perf/tests/builtin-test.c | 1 tools/perf/tests/code-reading.c | 10 tools/perf/tests/expr.c | 31 tools/perf/tests/shell/test_arm_coresight.sh | 2 tools/perf/tests/tests.h | 1 tools/perf/tests/util.c | 31 tools/perf/tests/workloads/datasym.c | 16 tools/perf/ui/browser.c | 6 tools/perf/ui/browser.h | 2 tools/perf/ui/browsers/annotate.c | 8 tools/perf/ui/gtk/annotate.c | 6 tools/perf/ui/gtk/gtk.h | 2 tools/perf/util/annotate.c | 190 ++-- tools/perf/util/annotate.h | 32 tools/perf/util/event.c | 4 tools/perf/util/evlist.c | 18 tools/perf/util/evlist.h | 1 tools/perf/util/expr.c | 2 tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 tools/perf/util/intel-pt.c | 2 tools/perf/util/machine.c | 10 tools/perf/util/maps.c | 238 +++++ tools/perf/util/maps.h | 12 tools/perf/util/perf_event_attr_fprintf.c | 26 tools/perf/util/pmu.c | 147 ++- tools/perf/util/pmu.h | 10 tools/perf/util/pmus.c | 20 tools/perf/util/probe-event.c | 1 tools/perf/util/python.c | 10 tools/perf/util/session.c | 5 tools/perf/util/stat-display.c | 3 tools/perf/util/string.c | 48 + tools/perf/util/string2.h | 1 tools/perf/util/symbol.c | 259 ------ tools/perf/util/symbol.h | 1 tools/perf/util/symbol_conf.h | 4 tools/perf/util/thread.c | 14 tools/perf/util/thread.h | 14 tools/perf/util/top.h | 1 tools/testing/selftests/bpf/network_helpers.c | 2 tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c | 4 tools/testing/selftests/bpf/progs/bench_local_storage_create.c | 5 tools/testing/selftests/bpf/progs/local_storage.c | 20 tools/testing/selftests/bpf/progs/lsm_cgroup.c | 8 tools/testing/selftests/bpf/test_sockmap.c | 2 tools/testing/selftests/cgroup/cgroup_util.c | 8 tools/testing/selftests/cgroup/cgroup_util.h | 2 tools/testing/selftests/cgroup/test_core.c | 7 tools/testing/selftests/cgroup/test_cpu.c | 2 tools/testing/selftests/cgroup/test_cpuset.c | 2 tools/testing/selftests/cgroup/test_freezer.c | 2 tools/testing/selftests/cgroup/test_kill.c | 2 tools/testing/selftests/cgroup/test_kmem.c | 2 tools/testing/selftests/cgroup/test_memcontrol.c | 2 tools/testing/selftests/cgroup/test_zswap.c | 2 tools/testing/selftests/filesystems/binderfs/Makefile | 2 tools/testing/selftests/ftrace/test.d/dynevent/add_remove_btfarg.tc | 2 tools/testing/selftests/kcmp/kcmp_test.c | 2 tools/testing/selftests/kvm/aarch64/vgic_init.c | 50 + tools/testing/selftests/lib.mk | 12 tools/testing/selftests/net/amt.sh | 20 tools/testing/selftests/net/config | 7 tools/testing/selftests/net/forwarding/bridge_igmp.sh | 6 tools/testing/selftests/net/forwarding/bridge_mld.sh | 6 tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 tools/testing/selftests/net/mptcp/simult_flows.sh | 10 tools/testing/selftests/powerpc/dexcr/Makefile | 2 tools/testing/selftests/resctrl/Makefile | 4 tools/testing/selftests/syscall_user_dispatch/sud_test.c | 14 tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json | 44 + tools/tracing/latency/latency-collector.c | 8 865 files changed, 9357 insertions(+), 6702 deletions(-) Aapo Vienamo (1): mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() Aaron Conole (1): openvswitch: Set the skbuff pkt_type for proper pmtud support. Abdelrahman Morsy (1): HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled Adrian Hunter (4): x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS perf record: Fix debug message placement for test consumption perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) Akiva Goldberger (2): net/mlx5: Add a timeout to acquire the command queue semaphore net/mlx5: Discard command completions in internal error Al Viro (1): parisc: add missing export of __cmpxchg_u8() Aleksandr Aprelkov (1): sunrpc: removed redundant procp check Aleksandr Burakov (1): media: ngene: Add dvb_ca_en50221_init return value check Aleksandr Mishin (7): crypto: bcm - Fix pointer arithmetic cppc_cpufreq: Fix possible null pointer dereference thermal/drivers/tsens: Fix null pointer dereference ASoC: kirkwood: Fix potential NULL dereference drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference drm: vc4: Fix possible null pointer dereference drm/msm/dpu: Add callback function pointer check before its call Alexander Aring (1): dlm: fix user space lock decision to copy lvb Alexander Egorenkov (2): s390/ipl: Fix incorrect initialization of len fields in nvme reipl block s390/ipl: Fix incorrect initialization of nvme dump block Alexander Lobakin (1): bitops: add missing prototype check Alexander Maltsev (1): netfilter: ipset: Add list flush to cancel_gc Alexandre Mergnat (1): clk: mediatek: mt8365-mm: fix DPI0 parent Alexei Starovoitov (1): bpf: Fix verifier assumptions about socket->sk Alison Schofield (1): cxl/trace: Correct DPA field masks for general_media & dram events Aloka Dixit (1): wifi: ath12k: use correct flag field for 320 MHz channels Alvin Lee (1): drm/amd/display: Remove pixle rate limit for subvp Andi Shyti (1): drm/i915/gt: Fix CCS id's calculation for CCS mode setting Andrea Mayer (1): ipv6: sr: fix missing sk_buff release in seg6_input_core Andreas Gruenbacher (13): gfs2: Don't forget to complete delayed withdraw gfs2: Fix "ignore unlock failures after withdraw" gfs2: Get rid of gfs2_alloc_blocks generation parameter gfs2: Convert gfs2_internal_read to folios gfs2: Rename gfs2_lookup_{ simple => meta } gfs2: No longer use 'extern' in function declarations gfs2: Remove ill-placed consistency check gfs2: Fix potential glock use-after-free on unmount gfs2: Mark withdraws as unlikely gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn gfs2: finish_xmote cleanup gfs2: do_xmote fixes kthread: add kthread_stop_put Andrew Halaney (8): scsi: ufs: qcom: Perform read back after writing reset bit scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US scsi: ufs: qcom: Perform read back after writing unipro mode scsi: ufs: qcom: Perform read back after writing CGC enable scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H scsi: ufs: core: Perform read back after disabling interrupts scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL Andrey Konovalov (1): kasan, fortify: properly rename memintrinsics Andrii Nakryiko (1): bpf: prevent r10 register from being marked as precise Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11. Andy Shevchenko (7): ACPI: LPSS: Advertise number of chip selects via property iio: core: Leave private pointer NULL when no private data supplied serial: max3100: Lock port->lock when calling uart_handle_cts_change() serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Fix bitwise types usb: fotg210: Add missing kernel doc description spi: Don't mark message DMA mapped when no transfer in it is AngeloGioacchino Del Regno (1): ASoC: mediatek: Assign dummy when codec not specified for a DAI link Anshuman Khandual (1): coresight: etm4x: Fix unbalanced pm_runtime_enable() Anton Protopopov (1): bpf: Pack struct bpf_fib_lookup Ard Biesheuvel (3): x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 x86/purgatory: Switch to the position-independent small code model x86/efistub: Omit physical KASLR when memory reservations exist Armin Wolf (1): ACPI: Fix Generic Initiator Affinity _OSC bit Arnaldo Carvalho de Melo (1): perf probe: Add missing libgen.h header needed for using basename() Arnd Bergmann (17): nilfs2: fix out-of-range warning crypto: ccp - drop platform ifdef checks enetc: avoid truncating error message qed: avoid truncating work queue length mlx5: avoid truncating error message mlx5: stop warning for 64KB pages wifi: carl9170: re-fix fortified-memset warning ACPI: disable -Wstringop-truncation fbdev: shmobile: fix snprintf truncation powerpc/fsl-soc: hide unused const variable fbdev: sisfb: hide unused variables media: rcar-vin: work around -Wenum-compare-conditional warning firmware: dmi-id: add a release callback function greybus: arche-ctrl: move device table to its right location module: don't ignore sysfs_create_link() failures Input: ims-pcu - fix printf string overflow drm/i915/guc: avoid FIELD_PREP warning Arun T (2): ASoC: Intel: common: add ACPI matching tables for Arrow Lake ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions Baochen Qiang (2): wifi: ath10k: poll service ready message before failing wifi: ath11k: don't force enable power save on non-running vdevs Bart Van Assche (1): scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search() Basavaraj Natikar (1): HID: amd_sfh: Handle "no sensors" in PM operations Beau Belgrave (3): tracing/user_events: Allow events to persist for perfmon_capable users tracing/user_events: Prepare find/delete for same name events tracing/user_events: Fix non-spaced field matching Benjamin Coddington (1): NFSv4: Fixup smatch warning for ambiguous return Benjamin Gray (1): selftests/powerpc/dexcr: Add -no-pie to hashchk tests Bibo Mao (1): LoongArch: Lately init pmu after smp is online Binbin Zhou (3): dt-bindings: thermal: loongson,ls2k-thermal: Fix binding check issues dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition Bjorn Andersson (1): soc: qcom: pmic_glink: Make client-lock non-sleeping Bjorn Helgaas (1): x86/pci: Skip early E820 check for ECAM region Bob Pearson (3): RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt RDMA/rxe: Allow good work requests to be executed RDMA/rxe: Fix incorrect rxe_put in error path Brennan Xavier McManus (1): tools/nolibc/stdlib: fix memory error in realloc() Breno Leitao (1): af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg Brian Kubisiak (1): ecryptfs: Fix buffer size for tag 66 packet Bui Quang Minh (2): scsi: bfa: Ensure the copied buf is NUL terminated scsi: qedf: Ensure the copied buf is NUL terminated Carlos López (1): tracing/probes: fix error check in parse_btf_field() Carolina Jubran (1): net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion Catalin Popescu (1): clk: rs9: fix wrong default value for clock amplitude Cezary Rojewski (5): ASoC: Intel: Disable route checks for Skylake boards ASoC: Intel: avs: ssm4567: Do not ignore route checks ASoC: Intel: avs: Fix ASRC module initialization ASoC: Intel: avs: Fix potential integer overflow ASoC: Intel: avs: Test result of avs_get_module_entry() Chandramohan Akula (2): RDMA/bnxt_re: Refactor the queue index update RDMA/bnxt_re: Remove roundup_pow_of_two depth for all hardware queue resources Chao Yu (15): f2fs: multidev: fix to recognize valid zero block address f2fs: fix to wait on page writeback in __clone_blkaddrs() f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file() f2fs: fix to relocate check condition in f2fs_fallocate() f2fs: fix to check pinfile flag in f2fs_move_file_range() f2fs: support printk_ratelimited() in f2fs_printk() f2fs: compress: fix to update i_compr_blocks correctly f2fs: introduce get_available_block_count() for cleanup f2fs: compress: fix error path of inc_valid_block_count() f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock f2fs: fix to release node block count in error path of f2fs_new_node_page() f2fs: compress: don't allow unaligned truncation on released compress inode f2fs: fix to add missing iput() in gc_data_segment() f2fs: use f2fs_{err,info}_ratelimited() for cleanup Charles Keepax (1): ASoC: cs42l43: Only restrict 44.1kHz for the ASP Chen Ni (3): HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors dmaengine: idma64: Add check for dma_set_max_seg_size watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() Cheng Yu (1): sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write() Chengchang Tang (5): RDMA/hns: Fix deadlock on SRQ async events. RDMA/hns: Fix UAF for cq async event RDMA/hns: Fix GMV table pagesize RDMA/hns: Use complete parentheses in macros RDMA/hns: Modify the print level of CQE error Chris Lew (1): net: qrtr: ns: Fix module refcnt Chris Wulff (2): usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. usb: gadget: u_audio: Clear uac pointer when freed. Christian Brauner (1): i915: make inject_virtual_interrupt() void Christian Hewitt (1): drm/meson: vclk: fix calculation of 59.94 fractional rates Christoph Hellwig (2): block: refine the EOF check in blkdev_iomap_begin virt: acrn: stop using follow_pfn Christophe JAILLET (4): Bluetooth: Remove usage of the deprecated ida_simple_xx() API VMCI: Fix an error handling path in vmci_guest_probe_device() ppdev: Remove usage of the deprecated ida_simple_xx() API i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() Chuck Lever (2): SUNRPC: Fix gss_free_in_token_pages() SUNRPC: Fix loop termination condition in gss_free_in_token_pages() Chun-Kuang Hu (1): soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE Clément Léger (1): selftests: sud_test: return correct emulated syscall value on RISC-V Dae R. Jeong (1): tls: fix missing memory barrier in tls_init Daeho Jeong (3): f2fs: separate f2fs_gc_range() to use GC for a range f2fs: support file pinning for zoned devices f2fs: write missing last sum blk of file pinning section Dan Aloni (2): sunrpc: fix NFSACL RPC retry on soft mount rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL Dan Carpenter (7): speakup: Fix sizeof() vs ARRAY_SIZE() bug nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists() wifi: mwl8k: initialize cmd->addr[] properly Bluetooth: qca: Fix error code in qca_read_fw_build_info() ext4: fix potential unnitialized variable stm class: Fix a double free in stm_register_device() media: stk1160: fix bounds checking in stk1160_copy_video() Daniel J Blueman (1): x86/tsc: Trust initial offset in architectural TSC-adjust MSRs Daniel Starke (2): tty: n_gsm: fix possible out-of-bounds in gsm0_receive() tty: n_gsm: fix missing receive state reset after mode switch Daniele Palmas (1): net: usb: qmi_wwan: add Telit FN920C04 compositions Danila Tikhonov (1): pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs Dave Airlie (3): nouveau: add an ioctl to return vram bar size. nouveau: add an ioctl to report vram usage nouveau: report byte usage in VRAM usage. David Arinzon (1): net: ena: Reduce lines with longer column width boundary David E. Box (3): tools/arch/x86/intel_sdsi: Fix maximum meter bundle length tools/arch/x86/intel_sdsi: Fix meter_show display tools/arch/x86/intel_sdsi: Fix meter_certificate decoding David Hildenbrand (3): mm/userfaultfd: Do not place zeropages when zeropages are disallowed s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() Derek Fang (2): ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating ASoC: dt-bindings: rt5645: add cbj sleeve gpio property Derek Foreman (1): drm/etnaviv: fix tx clock gating on some GC7000 variants Detlev Casanova (1): drm/rockchip: vop2: Do not divide height twice for YUV Devyn Liu (1): gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match Dmitry Baryshkov (18): soc: qcom: pmic_glink: don't traverse clients list without a lock soc: qcom: pmic_glink: notify clients about the current state wifi: ath10k: populate board data for WCN3990 drm/msm/dp: allow voltage swing / pre emphasis of 3 drm/mipi-dsi: use correct return type for the DSC functions clk: qcom: dispcc-sm8450: fix DisplayPort clocks clk: qcom: dispcc-sm6350: fix DisplayPort clocks clk: qcom: dispcc-sm8550: fix DisplayPort clocks usb: typec: ucsi: always register a link to USB PD device usb: typec: ucsi: simplify partner's PD caps registration dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x drm/msm/dpu: remove irq_idx argument from IRQ callbacks drm/msm/dpu: extract dpu_core_irq_is_valid() helper drm/msm/dpu: add helper to get IRQ-related data drm/msm/dpu: make the irq table size static drm/msm/dpu: stop using raw IRQ indices in the kernel output drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible Dmitry Torokhov (1): Input: try trimming too long modalias strings Dongli Zhang (1): genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline Dongliang Mu (1): media: flexcop-usb: fix sanity check of bNumEndpoints Doug Berger (1): serial: 8250_bcm7271: use default_mux_rate if possible Douglas Anderson (3): drm/dp: Don't attempt AUX transfers when eDP panels are not powered drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected Duanqiang Wen (2): Revert "net: txgbe: fix i2c dev name cannot match clkdev" Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits" Duoming Zhou (8): wifi: brcmfmac: pcie: handle randbuf allocation failure ax25: Use kernel universal linked list to implement ax25_dev_list ax25: Fix reference count leak issues of ax25_dev ax25: Fix reference count leak issue of net_device lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure PCI: of_property: Return error for int_map allocation failure watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger um: Fix return value in ubd_init() Edward Liaw (1): selftests/kcmp: remove unused open mode Eric Biggers (5): KEYS: asymmetric: Add missing dependency on CRYPTO_SIG KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST crypto: x86/nh-avx2 - add missing vzeroupper crypto: x86/sha256-avx2 - add missing vzeroupper crypto: x86/sha512-avx2 - add missing vzeroupper Eric Dumazet (8): tcp: avoid premature drops in tcp_add_backlog() net: give more chances to rcu in netdev_wait_allrefs_any() usb: aqc111: stop lying about skb->truesize net: usb: sr9700: stop lying about skb->truesize net: usb: smsc95xx: stop lying about skb->truesize netrom: fix possible dead-lock in nr_rt_ioctl() af_packet: do not call packet_read_pending() from tpacket_destruct_skb() netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() Eric Garver (1): netfilter: nft_fib: allow from forward/input without iif selector Eric Sandeen (1): openpromfs: finish conversion to the new mount API Eugen Hristev (1): media: mediatek: vcodec: fix possible unbalanced PM counter Fabio Estevam (4): media: dt-bindings: ovti,ov2680: Fix the power supply names media: ov2680: Clear the 'ret' variable on success media: ov2680: Allow probing if link-frequencies is absent media: ov2680: Do not fail if data-lanes property is absent Fedor Pchelkin (3): dma-mapping: benchmark: fix up kthread-related error handling dma-mapping: benchmark: fix node id validation dma-mapping: benchmark: handle NUMA_NO_NODE correctly Felix Fietkau (2): wifi: mt76: mt7603: fix tx queue of loopback packets wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset Felix Kuehling (1): drm/amdgpu: Update BO eviction priorities Fenghua Yu (1): dmaengine: idxd: Avoid unnecessary destruction of file_ida Fenglin Wu (1): Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation Finn Thain (2): macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" m68k: mac: Fix reboot hang on Mac IIci Florian Fainelli (1): net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled Florian Westphal (1): netfilter: tproxy: bail out if IP has been disabled on the device Frank Li (4): i3c: add actual_len in i3c_priv_xfer i3c: master: svc: rename read_len as actual_len i3c: master: svc: return actual transfer data len i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame Friedrich Vock (1): bpf: Fix potential integer overflow in resolve_btfids Gabor Juhos (1): clk: qcom: clk-alpha-pll: remove invalid Stromer register offset Gabriel Krisman Bertazi (2): io-wq: write next_work before dropping acct_lock udp: Avoid call to compute_score on multiple sites Gal Pressman (2): net/mlx5: Fix MTMP register capability offset in MCAM register net/mlx5e: Fix UDP GSO for encapsulated packets Geert Uytterhoeven (5): sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() printk: Let no_printk() use _printk() dev_printk: Add and use dev_no_printk() clk: renesas: r8a779a0: Fix CANFD parent clock dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties Geliang Tang (3): selftests/bpf: Fix umount cgroup2 error in test_sockmap selftests/bpf: Fix a fd leak in error paths in open_netns selftests: mptcp: add ms units for tc-netem delay Gerald Loacker (3): drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel Gerd Hoffmann (1): KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID Giovanni Cabiddu (1): crypto: qat - specify firmware files for 402xx Greg Kroah-Hartman (1): Linux 6.6.33 Guenter Roeck (3): mm/slub, kunit: Use inverted data to corrupt kmem cache Revert "sh: Handle calling csum_partial with misaligned data" hwmon: (shtc1) Fix property misspelling Guixiong Wei (1): x86/boot: Ignore relocations in .notes sections in walk_relocs() too Hagar Hemdan (1): efi: libstub: only free priv.runtime_map when allocated Hangbin Liu (4): ipv6: sr: add missing seg6_local_exit ipv6: sr: fix incorrect unregister order ipv6: sr: fix invalid unregister error path ipv6: sr: fix memleak in seg6_hmac_init_algo Hannah Peuckmann (1): riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware Hannes Reinecke (1): nvme-tcp: add definitions for TLS cipher suites Hans Verkuil (4): media: cec: cec-adap: always cancel work in cec_transmit_msg_fh media: cec: cec-api: add locking in cec_release() media: cec: core: avoid recursive cec_claim_log_addrs media: cec: core: avoid confusing "transmit timed out" message Hans de Goede (3): ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too iio: accel: mxc4005: Reset chip on probe() and resume() platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit() Hao Chen (1): drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() Hariprasad Kelam (1): Octeontx2-pf: Free send queue buffers incase of leaf to inner He Zhe (1): perf bench internals inject-build-id: Fix trap divide when collecting just one DSO Hechao Li (1): tcp: increase the default TCP scaling ratio Heiko Carstens (1): s390/vdso: Use standard stack frame layout Heiner Kallweit (1): Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already" Helen Koike (2): drm/ci: uprev mesa version: fix container build & crosvm drm/ci: add subset-1-gfx to LAVA_TAGS and adjust shards Henry Wang (1): drivers/xen: Improve the late XenStore init protocol Herve Codina (1): net: lan966x: remove debugfs directory in probe() error path Himanshu Madhani (1): scsi: qla2xxx: Fix debugfs output for fw_resource_count Horatiu Vultur (3): net: micrel: Fix receiving the timestamp in the frame for lan8841 net: lan966x: Remove ptp traps in case the ptp is not enabled. net: micrel: Fix lan8841_config_intr after getting out of sleep mode Hsin-Te Yuan (2): drm/bridge: anx7625: Update audio status while detecting ASoC: mediatek: mt8192: fix register configuration for tdm Huacai Chen (1): LoongArch: Fix callchain parse error with kernel tracepoint events again Huai-Yuan Liu (2): drm/arm/malidp: fix a possible null pointer dereference ppdev: Add an error check in register_device Hugo Villeneuve (3): serial: sc16is7xx: add proper sched.h include for sched_set_fifo() serial: sc16is7xx: replace hardcoded divisor value with BIT() macro serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler INAGAKI Hiroshi (1): block: fix and simplify blkdevparts= cmdline parsing Ian Rogers (16): perf record: Delete session after stopping sideband thread perf record: Lazy load kernel symbols perf machine thread: Remove exited threads by default perf bench uprobe: Remove lib64 from libc.so.6 binary path perf docs: Document bpf event modifier perf ui browser: Don't save pointer to stack memory perf ui browser: Avoid SEGV on title perf report: Avoid SEGV in report__setup_sample_type() perf thread: Fixes to thread__new() related to initializing comm perf maps: Move symbol maps functions to maps.c libsubcmd: Fix parse-options memory leak perf stat: Don't display metric header for non-leader uncore events perf tools: Use pmus to describe type from attribute perf tools: Add/use PMU reverse lookup from config to name perf pmu: Assume sysfs events are always the same case perf pmu: Count sys and cpuid JSON events separately Igor Artemiev (1): wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class Ilpo Järvinen (1): PCI: Wait for Link Training==0 before starting Link retrain Ilya Denisyev (1): jffs2: prevent xattr node from overflowing the eraseblock Ilya Leoshkevich (1): s390/bpf: Emit a barrier for BPF_FETCH instructions Ilya Maximets (1): net: openvswitch: fix overwriting ct original tuple for ICMPv6 Irui Wang (1): media: mediatek: vcodec: add encoder power management helper functions Iulia Tanasescu (1): Bluetooth: ISO: Fix BIS cleanup Jack Xiao (1): drm/amdgpu/mes: fix use-after-free issue Jack Yu (4): ASoC: rt722-sdca: modify channel number to support 4 channels ASoC: rt722-sdca: add headset microphone vrefo setting ASoC: rt715: add vendor clear control register ASoC: rt715-sdca: volume step modification Jacob Keller (2): Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI" ice: fix accounting if a VLAN already exists Jaegeuk Kim (3): f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC f2fs: kill heap-based allocation f2fs: deprecate io_bits Jaewon Kim (1): clk: samsung: exynosautov9: fix wrong pll clock id value Jagan Teki (1): drm/bridge: Fix improper bridge init order with pre_enable_prev_first Jakub Kicinski (3): eth: sungem: remove .ndo_poll_controller to avoid deadlocks selftests: net: add missing config for amt.sh selftests: net: move amt to socat for better compatibility Jakub Sitnicki (1): bpf: Allow delete from sockmap/sockhash only if update is allowed James Clark (7): perf tests: Make "test data symbol" more robust on Neoverse N1 perf tests: Apply attributes to all events in object code reading test perf test shell arm_coresight: Increase buffer size for Coresight basic tests perf symbols: Fix ownership of string in dso__load_vmlinux() perf test: Add a test for strcmp_cpuid_str() expression perf pmu: Move pmu__find_core_pmu() to pmus.c perf util: Add a function for replacing characters in a string Jan Kara (2): ext4: avoid excessive credit estimate in ext4_tmpfile() udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb() Jason Gunthorpe (1): IB/mlx5: Use __iowrite64_copy() for write combining stores Jens Axboe (1): io_uring: use the right type for work_llist empty check Jens Remus (2): s390/vdso: Generate unwind information for C modules s390/vdso: Create .build-id links for unstripped vdso files Jiangfeng Xiao (1): arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY Jiawen Wu (1): net: wangxun: fix to change Rx features Jing Zhang (1): perf pmu: "Compat" supports regular expression matching identifiers Jiri Olsa (1): libbpf: Fix error message in attach_kprobe_multi Jiri Pirko (1): virtio: delete vq in vp_find_vqs_msix() when request_irq() fails Johan Hovold (1): dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references Johannes Berg (8): wifi: mac80211: don't use rate mask for scanning wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() wifi: iwlwifi: mvm: allocate STA links only for active links wifi: iwlwifi: mvm: select STA mask only for active links wifi: iwlwifi: reconfigure TLC during HW restart wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask wifi: iwlwifi: mvm: init vif works only once um: vector: fix bpfflash parameter evaluation John Hubbard (2): selftests/binderfs: use the Makefile's rules, not Make's implicit rules selftests/resctrl: fix clang build failure: use LOCAL_HDRS Jonathan Cameron (1): iio: adc: stm32: Fixing err code to not indicate success Joshua Ashton (1): drm/amd/display: Set color_mgmt_changed to true on unsuspend Judith Mendez (5): mmc: sdhci_am654: Add tuning algorithm for delay chain mmc: sdhci_am654: Write ITAPDLY for DDR52 timing mmc: sdhci_am654: Add OTAP/ITAP delay enable mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock mmc: sdhci_am654: Fix ITAPDLY for HS400 timing Juergen Gross (3): x86/pat: Introduce lookup_address_in_pgd_attr() x86/pat: Restructure _lookup_address_cpa() x86/pat: Fix W^X violation false-positives when running as Xen PV guest Junhao He (2): drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group Justin Green (1): drm/mediatek: Add 0 size check to mtk_drm_gem_obj KaiLong Wang (1): f2fs: Clean up errors in segment.h Karthikeyan Kathirvel (1): wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() Kees Cook (3): kunit/fortify: Fix mismatched kvalloc()/vfree() usage lkdtm: Disable CFI checking for perms functions wifi: nl80211: Avoid address calculations via out of bounds array indexing Keith Busch (1): nvme-multipath: fix io accounting on failover Ken Milmore (1): r8169: Fix possible ring buffer corruption on fragmented Tx packets. Kent Overstreet (1): kernel/numa.c: Move logging out of numa.h Konrad Dybcio (2): interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Konstantin Komarov (7): fs/ntfs3: Remove max link count info display during driver init fs/ntfs3: Taking DOS names into account during link counting fs/ntfs3: Fix case when index is reused during tree transformation fs/ntfs3: Break dir enumeration if directory contents error fs/ntfs3: Check 'folio' pointer for NULL fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow fs/ntfs3: Use variable length array instead of fixed size Krzysztof Kozlowski (3): regulator: qcom-refgen: fix module autoloading regulator: vqmmc-ipq4019: fix module autoloading dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios Kuniyuki Iwashima (4): af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). af_unix: Annotate data-race around unix_sk(sk)->addr. af_unix: Read sk->sk_hash under bindlock during bind(). Kuppuswamy Sathyanarayanan (2): PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 Lad Prabhakar (1): clk: renesas: r9a07g043: Add clock and reset entry for PLIC Lancelot SIX (1): drm/amdkfd: Flush the process wq before creating a kfd_process Larysa Zaremba (1): ice: Interpret .set_channels() input differently Laurent Pinchart (4): firmware: raspberrypi: Use correct device for DMA mappings media: v4l2-subdev: Fix stream handling for crop API media: v4l2-subdev: Document and enforce .s_stream() requirements media: vsp1: Remove unbalanced .s_stream(0) calls Le Ma (1): drm/amdgpu: init microcode chip name from ip versions Leo Ma (1): drm/amd/display: Fix DC mode screen flickering on DCN321 Leon Romanovsky (1): RDMA/IPoIB: Fix format truncation compilation errors Li Zhijian (1): cxl/region: Fix cxlr_pmem leaks Lijo Lazar (1): drm/amd/pm: Restore config space after reset Linus Torvalds (2): x86/mm: Remove broken vsyscall emulation code from the page fault code epoll: be better about file lifetimes Linus Walleij (1): net: ethernet: cortina: Locking fixes Lorenzo Bianconi (1): wifi: mt76: mt7915: workaround too long expansion sparse warnings Luca Ceresoli (2): iio: accel: mxc4005: allow module autoloading via OF compatible Revert "drm/bridge: ti-sn65dsi83: Fix enable error path" Luiz Augusto von Dentz (1): Bluetooth: HCI: Remove HCI_AMP support Lukas Bulwahn (1): Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS Luke D. Jones (1): ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp MD Danish Anwar (1): net: ti: icssg-prueth: Fix start counter for ft1 filter Maher Sanalla (2): net/mlx5: Reload only IB representors upon lag disable/enable net/mlx5: Lag, do bond only if slaves agree on roce state Marc Gonzalez (1): clk: qcom: mmcc-msm8998: fix venus clock issue Marco Pagani (3): fpga: manager: add owner module and take its refcount fpga: bridge: add owner module and take its refcount fpga: region: add owner module and take its refcount Marek Szyprowski (1): Input: cyapa - add missing input core locking to suspend/resume functions Marek Vasut (2): drm/lcdif: Do not disable clocks on already suspended hardware drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector Marijn Suijten (2): drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk drm/msm/dpu: Always flush the slave INTF on the CTL Mario Limonciello (1): drm/amd/display: Enable colorspace property for MST connectors Martin Kaiser (1): nfs: keep server info for remounts Masahiro Yamada (4): kbuild: unify vdso_install rules kbuild: fix build ID symlinks to installed debug VDSO files x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y kconfig: fix comparison to constant symbols, 'm', 'n' Masami Hiramatsu (Google) (1): selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly Mathieu Othacehe (1): net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 Matthew Bystrin (1): riscv: stacktrace: fixed walk_stackframe() Matthew R. Ochs (1): tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer Matthew Wilcox (Oracle) (1): udf: Convert udf_expand_file_adinicb() to use a folio Matthias Schiffer (2): net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches Matthieu Baerts (NGI0) (3): mptcp: SO_KEEPALIVE: fix getsockopt support selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky selftests: mptcp: join: mark 'fail' tests as flaky Matti Vaittinen (5): regulator: irq_helpers: duplicate IRQ name watchdog: bd9576: Drop "always-running" property regulator: bd71828: Don't overwrite runtime voltages regulator: pickable ranges: don't always cache vsel regulator: tps6287x: Force writing VSEL bit Maurizio Lombardi (2): nvmet-auth: return the error code to the nvmet_auth_host_hash() callers nvmet-auth: replace pr_debug() with pr_err() to report an error. Maxim Korotkov (1): mtd: rawnand: hynix: fixed typo Maxime Ripard (1): ARM: configs: sunxi: Enable DRM_DW_HDMI Meenakshikumar Somasundaram (1): drm/amd/display: Allocate zero bw after bw alloc enable Michael Schmitz (1): m68k: Fix spinlock race in kernel thread creation Michael Walle (1): drm/bridge: tc358775: fix support for jeida-18 and jeida-24 Michal Schmidt (2): selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Michal Simek (2): microblaze: Remove gcc flag for non existing early_printk.c file microblaze: Remove early printk call from cpuinfo-static.c Mickaël Salaün (1): kunit: Fix kthread reference Miguel Ojeda (1): kheaders: use `command -v` to test for existence of `cpio` Miklos Szeredi (1): ovl: remove upper umask handling from ovl_create_upper() Ming Lei (3): io_uring: fail NOP if non-zero op flags is passed in blk-cgroup: fix list corruption from resetting io stat blk-cgroup: fix list corruption from reorder of WRITE ->lqueued Mohamed Ahmed (1): drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations Mukesh Ojha (1): firmware: qcom: scm: Fix __scm and waitq completion variable initialization Mukul Joshi (2): drm/amdkfd: Add VRAM accounting for SVM migration drm/amdgpu: Fix VRAM memory accounting Namhyung Kim (8): perf annotate: Get rid of duplicate --group option item perf annotate: Split branch stack cycles information out of 'struct annotation_line' perf annotate: Introduce global annotation_options perf report: Convert to the global annotation_options perf top: Convert to the global annotation_options perf annotate: Use global annotation_options perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline() perf/arm-dmc620: Fix lockdep assert in ->event_init() Namjae Jeon (2): ksmbd: avoid to send duplicate oplock break notifications ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() Nandor Kracser (1): ksmbd: ignore trailing slashes in share paths Nathan Lynch (1): powerpc/pseries/lparcfg: drop error message from guest name lookup Neha Malcom Francis (1): regulator: tps6594-regulator: Correct multi-phase configuration Neil Armstrong (2): phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy drm/meson: gate px_clk when setting rate Nikita Kiryushin (2): rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow rcu: Fix buffer overflow in print_cpu_stall_info() Nikita Zhandarovich (2): wifi: carl9170: add a proper sanity check for endpoints wifi: ar5523: enable proper endpoint verification Nikolay Aleksandrov (3): net: bridge: xmit: make sure we have at least eth header len bytes selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval net: bridge: mst: fix vlan use-after-free Nilay Shroff (2): nvme: find numa distance only if controller has valid numa id nvme: cancel pending I/O if nvme controller is in terminal state Nuno Sa (10): iio: adc: ad9467: use spi_get_device_match_data() iio: adc: ad9467: use chip_info variables instead of array iio: adc: adi-axi-adc: convert to regmap iio: buffer-dmaengine: export buffer alloc and free functions iio: add the IIO backend framework iio: adc: ad9467: convert to backend framework iio: adc: adi-axi-adc: move to backend framework iio: adc: adi-axi-adc: only error out in major version mismatch dt-bindings: adc: axi-adc: update bindings for backend framework dt-bindings: adc: axi-adc: add clocks property Nícolas F. R. A. Prado (9): drm/bridge: anx7625: Don't log an error when DSI host can't be found drm/bridge: icn6211: Don't log an error when DSI host can't be found drm/bridge: lt8912b: Don't log an error when DSI host can't be found drm/bridge: lt9611: Don't log an error when DSI host can't be found drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found drm/bridge: tc358775: Don't log an error when DSI host can't be found drm/bridge: dpc3433: Don't log an error when DSI host can't be found drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found clk: mediatek: pllfh: Don't log error for missing fhctl node Oleg Nesterov (1): sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU Olga Kornievskaia (1): pNFS/filelayout: fixup pNfs allocation modes Oliver Upton (1): KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF Or Har-Toov (2): RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent RDMA/mlx5: Adding remote atomic access flag to updatable flags Oswald Buddenhagen (1): ALSA: emu10k1: make E-MU FPGA writes potentially more reliable Pablo Neira Ayuso (2): netfilter: nft_payload: restore vlan q-in-q match support netfilter: nft_payload: skbuff vlan metadata mangle support Paolo Abeni (3): tcp: define initial scaling factor value as a macro selftests: net: add more missing kernel config net: relax socket state check at accept time. Parthiban Veerasooran (1): net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM Peter Colberg (2): fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor Peter Oberparleiter (1): s390/cio: fix tracepoint subchannel type field Peter Ujfalusi (4): ASoC: SOF: Intel: mtl: Correct rom_status_reg ASoC: SOF: Intel: lnl: Correct rom_status_reg ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed ASoC: SOF: Intel: mtl: Implement firmware boot state check Petr Pavlu (1): ring-buffer: Fix a race between readers and resize checks Pierre-Louis Bossart (4): ASoC: da7219-aad: fix usage of device_get_named_child_node() ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions soundwire: cadence: fix invalid PDI offset Pin-yen Lin (1): serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup Portia Stephens (1): cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations Pratyush Yadav (1): media: cadence: csi2rx: configure DPHY before starting source stream Prike Liang (1): drm/amdgpu: Fix the ring buffer size for queue VM flush Puranjay Mohan (2): bpf, x86: Fix PROBE_MEM runtime load check riscv, bpf: make some atomic operations fully ordered Rafał Miłecki (1): dt-bindings: pinctrl: mediatek: mt7622: fix array properties Rahul Rameshbabu (2): net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules net/mlx5e: Fix IPsec tunnel mode offload feature check Randy Dunlap (4): fbdev: sh7760fb: allow modular build counter: linux/counter.h: fix Excess kernel-doc description warning extcon: max8997: select IRQ_DOMAIN instead of depending on it media: sunxi: a83-mips-csi2: also select GENERIC_PHY Ranjani Sridharan (1): ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3 Ricardo Ribalda (2): media: radio-shark2: Avoid led_names truncations media: uvcvideo: Add quirk for Logitech Rally Bar Richard Fitzgerald (5): ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup ASoC: cs35l56: Fix to ensure ASP1 registers match cache ALSA: hda: cs35l56: Initialize all ASP1 registers ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance Richard Kinder (1): wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field Rob Herring (1): dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node Robert Richter (1): x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() Roberto Sassu (1): um: Add winch to winch_handlers before registering winch IRQ Roded Zats (1): enic: Validate length of nl attributes in enic_set_vf_port Rodrigo Siqueira (1): drm/amd/display: Add VCO speed parameter for DCN31 FPU Roger Pau Monne (1): xen/x86: add extra pages to unpopulated-alloc if available Romain Gantois (1): net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe() Rui Miguel Silva (1): greybus: lights: check return of get_channel_from_mode Ryosuke Yasuoka (2): nfc: nci: Fix uninit-value in nci_rx_work nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() Ryusuke Konishi (3): nilfs2: fix use-after-free of timer for log writer thread nilfs2: fix unexpected freezing of nilfs_segctor_sync() nilfs2: fix potential hang in nilfs_detach_log_writer() Sagi Grimberg (3): nvmet-tcp: fix possible memory leak when tearing down a controller nvmet: fix nvme status code when namespace is disabled nvmet: fix ns enable/disable possible hang Sahil Siddiq (1): bpftool: Mount bpffs on provided dir instead of parent dir Sai Pavan Boddu (1): i2c: cadence: Avoid fifo clear after start Sakari Ailus (2): media: ipu3-cio2: Request IRQ earlier media: v4l: Don't turn on privacy LED if streamon fails Samasth Norway Ananda (1): perf daemon: Fix file leak in daemon_session__control Sean Anderson (1): drm: zynqmp_dpsub: Always register bridge Sean Christopherson (1): cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n Sean Young (1): pwm: Rename pwm_apply_state() to pwm_apply_might_sleep() Sebastian Urban (1): Bluetooth: compute LE flow credits based on recvbuf space Selvin Xavier (3): RDMA/bnxt_re: Update the HW interface definitions RDMA/bnxt_re: Adds MSN table capability for Gen P7 adapters RDMA/bnxt_re: Fix the sparse warnings Sergey Matyukevich (1): riscv: prevent pt_regs corruption for secondary idle threads Sergey Shtylyov (1): of: module: add buffer overflow check in of_modalias() Shay Agroskin (1): net: ena: Fix redundant device NUMA node override Shay Drory (1): net/mlx5: Enable 4 ports multiport E-switch Shenghao Ding (3): ASoC: tas2781: Fix a warning reported by robot kernel test ASoC: tas2552: Add TX path for capturing AUDIO-OUT data ASoC: tas2781: Fix wrong loading calibrated data sequence Shrikanth Hegde (2): sched/fair: Add EAS checks before updating root_domain::overutilized powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp Shuah Khan (1): tools/latency-collector: Fix -Wformat-security compile warns Souradeep Chakrabarti (1): net: mana: Fix the extra HZ in mana_hwc_send_request Srinivas Pandruvada (3): platform/x86: ISST: Add Grand Ridge to HPM CPU list platform/x86/intel/tpmi: Handle error from tpmi_process_info() platform/x86/intel-uncore-freq: Don't present root domain on error Srinivasan Shanmugam (2): drm/amd/display: Fix potential index out of bounds in color transformation function drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() Stafford Horne (1): openrisc: traps: Don't send signals to kernel mode threads Stanislav Fomichev (1): bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE Stefan Binding (1): ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config Steven Rostedt (1): ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value Steven Rostedt (Google) (5): eventfs: Do not differentiate the toplevel events directory eventfs: Create eventfs_root_inode to store dentry eventfs/tracing: Add callback for release of an eventfs_inode eventfs: Free all of the eventfs_inode after RCU eventfs: Have "events" directory get permissions from its parent Su Hui (1): wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() Sumanth Korikkar (1): s390/vdso64: filter out munaligned-symbols flag for vdso Sung Joon Kim (1): drm/amd/display: Disable seamless boot on 128b/132b encoding Suzuki K Poulose (4): coresight: etm4x: Do not hardcode IOMEM access for register restore coresight: etm4x: Do not save/restore Data trace control registers coresight: etm4x: Safe access for TRCQCLTR coresight: etm4x: Fix access to resource selector registers Sven Schnelle (1): s390/boot: Remove alt_stfle_fac_list from decompressor Swapnil Patel (1): drm/amd/display: Add dtbclk access to dcn315 Taehee Yoo (1): selftests: net: kill smcrouted in the cleanup logic in amt.sh Takashi Iwai (9): ALSA: core: Fix NULL module pointer assignment at card init ALSA: Fix deadlocks with kctl removals at disconnection ALSA: jack: Use guard() for locking ALSA: core: Remove debugfs at disconnection ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion ALSA: seq: Fix yet another spot for system message conversion ALSA: seq: ump: Fix swapped song position pointer data ALSA: timer: Set lower bound of start tick time Tetsuo Handa (1): dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Thomas Haemmerle (1): iio: pressure: dps310: support negative temperature values Thomas Richter (1): perf stat: Do not fail on metrics on s390 z/VM systems Thomas Weißschuh (2): misc/pvpanic: deduplicate common code misc/pvpanic-pci: register attributes via pci_driver Thomas Zimmermann (1): fbdev: Provide I/O-memory helpers as module Thorsten Blum (1): net: smc91x: Fix m68k kernel compilation for ColdFire CPU Tianchen Ding (1): selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted without nsdelegate Tiwei Bie (3): um: Fix the -Wmissing-prototypes warning for __switch_mm um: Fix the -Wmissing-prototypes warning for get_thread_reg um: Fix the declaration of kasan_map_memory Tony Lindgren (2): drm/omapdrm: Fix console by implementing fb_dirty drm/omapdrm: Fix console with deferred ops Tristram Ha (1): net: dsa: microchip: fix RGMII error in KSZ DSA driver Uros Bizjak (1): locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() Uwe Kleine-König (5): pwm: sti: Prepare removing pwm_chip from driver data pwm: sti: Simplify probe function using devm functions media: i2c: et8ek8: Don't strip remove function when driver is builtin leds: pwm: Disable PWM when going to suspend spi: stm32: Don't warn about spurious interrupts Valentin Obst (1): selftests: default to host arch for LLVM builds Vicki Pfau (1): Input: xpad - add support for ASUS ROG RAIKIRI Vidya Sagar (1): PCI: tegra194: Fix probe path for Endpoint mode Vignesh Raghavendra (1): mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel Vignesh Raman (1): drm/ci: update device type for volteer devices Ville Syrjälä (1): drm/edid: Parse topology block for all DispID structure v1.x Viresh Kumar (1): cpufreq: exit() callback is optional Vitalii Bursov (1): sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level Vladimir Oltean (2): net/sched: taprio: make q->picos_per_byte available to fill_sched_entry() net/sched: taprio: extend minimum interval restriction to entire cycle too Waiman Long (1): blk-cgroup: Properly propagate the iostat update up the hierarchy Wang Yao (1): modules: Drop the .export_symbol section from the final modules Wei Fang (2): net: fec: remove .ndo_poll_controller to avoid deadlocks net: fec: avoid lock evasion when reading pps_enable Wenjing Liu (1): drm/amd/display: Revert Remove pixle rate limit for subvp Wojciech Macek (1): drm/mediatek: dp: Fix mtk_dp_aux_transfer return value Wolfram Sang (2): dt-bindings: PCI: rcar-pci-host: Add optional regulators serial: sh-sci: protect invalidating RXDMA on shutdown Wu Bo (1): f2fs: fix block migration when section is not aligned to pow2 Xianwei Zhao (1): arm64: dts: meson: fix S4 power-controller node Xiaolei Wang (1): net:fec: Add fec_enet_deinit() Xingui Yang (1): scsi: libsas: Fix the failure of adding phy with zero-address to port Yang Jihong (4): perf evlist: Add evlist__findnew_tracking_event() helper perf record: Move setting tracking events before record__init_thread_masks() perf evlist: Add perf_evlist__go_system_wide() helper perf sched timehist: Fix -g/--call-graph option failure Yang Li (1): rv: Update rv_en(dis)able_monitor doc to match kernel-doc Ye Bin (1): vfio/pci: fix potential memory leak in vfio_intx_enable() Yi Liu (1): iommu: Undo pasid attachment only for the devices that have succeeded Yong Zhi (1): ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails Yonghong Song (1): bpftool: Fix missing pids during link show Yu Kuai (2): md: fix resync softlockup when bitmap size is less than array size block: support to account io_ticks precisely Yue Haibing (1): ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Yuri Karpov (1): scsi: hpsa: Fix allocation size for Scsi_Host private data Zenghui Yu (2): irqchip/alpine-msi: Fix off-by-one in allocation error path irqchip/loongson-pch-msi: Fix off-by-one on allocation error path Zhang Yi (1): ext4: remove the redundant folio_wait_stable() Zheng Yejian (1): ftrace: Fix possible use-after-free issue in ftrace_location() Zhengchao Shao (1): RDMA/hns: Fix return value in hns_roce_map_mr_sg Zhipeng Lu (1): media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries Zhu Yanjun (3): null_blk: Fix missing mutex_destroy() at module removal RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() Zqiang (1): softirq: Fix suspicious RCU usage in __do_softirq() end.to.start (1): ASoC: acp: Support microphone from device Acer 315-24p gaoxingwang (1): net: ipv6: fix wrong start position when receive hop-by-hop fragment

1 year, 2 months

1
1
0 0

Linux 6.1.93

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.93 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/media/i2c/ovti,ov2680.yaml | 18 Documentation/devicetree/bindings/pci/rcar-pci-host.yaml | 14 Documentation/devicetree/bindings/pinctrl/mediatek,mt7622-pinctrl.yaml | 92 +- Documentation/devicetree/bindings/soc/rockchip/grf.yaml | 1 Documentation/devicetree/bindings/sound/rt5645.txt | 6 Documentation/driver-api/fpga/fpga-region.rst | 13 Documentation/networking/device_drivers/ethernet/amazon/ena.rst | 32 Makefile | 2 arch/arm/configs/sunxi_defconfig | 1 arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 13 arch/arm64/include/asm/asm-bug.h | 1 arch/loongarch/include/asm/perf_event.h | 3 arch/loongarch/kernel/perf_event.c | 2 arch/m68k/kernel/entry.S | 4 arch/m68k/mac/misc.c | 36 - arch/microblaze/kernel/Makefile | 1 arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 arch/parisc/kernel/parisc_ksyms.c | 1 arch/powerpc/include/asm/hvcall.h | 2 arch/powerpc/platforms/pseries/lpar.c | 6 arch/powerpc/platforms/pseries/lparcfg.c | 10 arch/powerpc/sysdev/fsl_msi.c | 2 arch/riscv/kernel/cpu_ops_sbi.c | 2 arch/riscv/kernel/cpu_ops_spinwait.c | 3 arch/riscv/kernel/entry.S | 3 arch/riscv/kernel/stacktrace.c | 29 arch/riscv/net/bpf_jit_comp64.c | 20 arch/s390/boot/startup.c | 1 arch/s390/kernel/ipl.c | 10 arch/s390/kernel/setup.c | 2 arch/s390/kernel/vdso32/Makefile | 5 arch/s390/kernel/vdso64/Makefile | 6 arch/s390/net/bpf_jit_comp.c | 8 arch/sh/kernel/kprobes.c | 7 arch/sh/lib/checksum.S | 67 -- arch/um/drivers/line.c | 14 arch/um/drivers/ubd_kern.c | 4 arch/um/drivers/vector_kern.c | 2 arch/um/include/asm/kasan.h | 1 arch/um/include/asm/mmu.h | 2 arch/um/include/asm/processor-generic.h | 1 arch/um/include/shared/kern_util.h | 2 arch/um/include/shared/skas/mm_id.h | 2 arch/um/os-Linux/mem.c | 1 arch/x86/Kconfig.debug | 5 arch/x86/boot/compressed/head_64.S | 5 arch/x86/crypto/nh-avx2-x86_64.S | 1 arch/x86/crypto/sha256-avx2-asm.S | 1 arch/x86/crypto/sha512-avx2-asm.S | 1 arch/x86/entry/vsyscall/vsyscall_64.c | 28 arch/x86/include/asm/pgtable_types.h | 2 arch/x86/include/asm/processor.h | 1 arch/x86/include/asm/sparsemem.h | 2 arch/x86/kernel/apic/vector.c | 9 arch/x86/kernel/tsc_sync.c | 6 arch/x86/kvm/cpuid.c | 21 arch/x86/lib/x86-opcode-map.txt | 10 arch/x86/mm/fault.c | 33 - arch/x86/mm/numa.c | 4 arch/x86/mm/pat/set_memory.c | 68 +- arch/x86/purgatory/Makefile | 3 arch/x86/tools/relocs.c | 9 arch/x86/um/shared/sysdep/archsetjmp.h | 7 block/blk-core.c | 9 block/blk-merge.c | 2 block/blk-mq.c | 60 - block/blk.h | 1 block/genhd.c | 2 crypto/asymmetric_keys/Kconfig | 2 drivers/accessibility/speakup/main.c | 2 drivers/acpi/acpi_lpss.c | 1 drivers/acpi/acpica/Makefile | 1 drivers/acpi/numa/srat.c | 5 drivers/block/null_blk/main.c | 3 drivers/bluetooth/btqca.c | 4 drivers/char/ppdev.c | 21 drivers/clk/clk-renesas-pcie.c | 10 drivers/clk/mediatek/clk-mt8365-mm.c | 2 drivers/clk/qcom/dispcc-sm6350.c | 11 drivers/clk/qcom/dispcc-sm8450.c | 20 drivers/clk/qcom/mmcc-msm8998.c | 8 drivers/clk/renesas/r8a779a0-cpg-mssr.c | 2 drivers/clk/renesas/r9a07g043-cpg.c | 9 drivers/clk/samsung/clk-exynosautov9.c | 8 drivers/cpufreq/cppc_cpufreq.c | 14 drivers/cpufreq/cpufreq.c | 11 drivers/crypto/bcm/spu2.c | 2 drivers/crypto/ccp/sp-platform.c | 14 drivers/dma-buf/sync_debug.c | 4 drivers/dma/idma64.c | 4 drivers/extcon/Kconfig | 3 drivers/firmware/dmi-id.c | 7 drivers/firmware/efi/libstub/fdt.c | 4 drivers/firmware/efi/libstub/x86-stub.c | 28 drivers/firmware/raspberrypi.c | 7 drivers/fpga/dfl-pci.c | 3 drivers/fpga/fpga-region.c | 24 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 2 drivers/gpu/drm/arm/malidp_mw.c | 5 drivers/gpu/drm/bridge/analogix/anx7625.c | 6 drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 drivers/gpu/drm/bridge/chipone-icn6211.c | 6 drivers/gpu/drm/bridge/lontium-lt8912b.c | 6 drivers/gpu/drm/bridge/lontium-lt9611.c | 6 drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 6 drivers/gpu/drm/bridge/tc358775.c | 27 drivers/gpu/drm/bridge/ti-dlpc3433.c | 17 drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 drivers/gpu/drm/display/drm_dp_helper.c | 35 + drivers/gpu/drm/drm_bridge.c | 10 drivers/gpu/drm/drm_mipi_dsi.c | 6 drivers/gpu/drm/i915/gt/uc/abi/guc_klvs_abi.h | 6 drivers/gpu/drm/mediatek/Kconfig | 1 drivers/gpu/drm/mediatek/mtk_dp.c | 137 +++- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 3 drivers/gpu/drm/meson/meson_vclk.c | 6 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 17 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 drivers/gpu/drm/msm/dp/dp_aux.c | 32 drivers/gpu/drm/msm/dp/dp_aux.h | 3 drivers/gpu/drm/msm/dp/dp_ctrl.c | 16 drivers/gpu/drm/msm/dp/dp_ctrl.h | 2 drivers/gpu/drm/msm/dp/dp_display.c | 12 drivers/gpu/drm/msm/dp/dp_link.c | 22 drivers/gpu/drm/msm/dp/dp_link.h | 14 drivers/gpu/drm/msm/dsi/dsi_host.c | 10 drivers/gpu/drm/mxsfb/lcdif_drv.c | 6 drivers/gpu/drm/panel/panel-edp.c | 3 drivers/gpu/drm/panel/panel-novatek-nt35950.c | 6 drivers/gpu/drm/panel/panel-samsung-atna33xc20.c | 32 drivers/gpu/drm/panel/panel-simple.c | 3 drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 22 drivers/gpu/drm/vc4/vc4_hdmi.c | 2 drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 10 drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 drivers/hwmon/shtc1.c | 2 drivers/hwtracing/coresight/coresight-etm4x-core.c | 29 drivers/hwtracing/coresight/coresight-etm4x.h | 31 drivers/hwtracing/stm/core.c | 11 drivers/iio/adc/stm32-adc.c | 1 drivers/iio/industrialio-core.c | 6 drivers/iio/pressure/dps310.c | 11 drivers/infiniband/hw/hns/hns_roce_cq.c | 24 drivers/infiniband/hw/hns/hns_roce_hem.h | 12 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 7 drivers/infiniband/hw/hns/hns_roce_main.c | 1 drivers/infiniband/hw/hns/hns_roce_mr.c | 15 drivers/infiniband/hw/hns/hns_roce_srq.c | 6 drivers/infiniband/hw/mlx5/mem.c | 8 drivers/infiniband/hw/mlx5/mr.c | 3 drivers/infiniband/sw/rxe/rxe_comp.c | 6 drivers/infiniband/sw/rxe/rxe_net.c | 46 - drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 drivers/input/misc/ims-pcu.c | 4 drivers/input/misc/pm8xxx-vibrator.c | 7 drivers/input/mouse/cyapa.c | 12 drivers/input/serio/ioc3kbd.c | 13 drivers/interconnect/qcom/qcm2290.c | 2 drivers/irqchip/irq-alpine-msi.c | 2 drivers/irqchip/irq-loongson-pch-msi.c | 2 drivers/macintosh/via-macii.c | 11 drivers/md/md-bitmap.c | 6 drivers/media/cec/core/cec-adap.c | 24 drivers/media/cec/core/cec-api.c | 5 drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 10 drivers/media/pci/ngene/ngene-core.c | 4 drivers/media/platform/renesas/rcar-vin/rcar-vin.h | 2 drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig | 1 drivers/media/radio/radio-shark2.c | 2 drivers/media/usb/b2c2/flexcop-usb.c | 2 drivers/media/usb/stk1160/stk1160-video.c | 20 drivers/misc/vmw_vmci/vmci_guest.c | 10 drivers/mmc/host/sdhci_am654.c | 205 ++++-- drivers/mtd/mtdcore.c | 6 drivers/mtd/nand/raw/nand_hynix.c | 2 drivers/net/Makefile | 4 drivers/net/dsa/microchip/ksz_common.c | 2 drivers/net/dsa/mv88e6xxx/chip.c | 50 + drivers/net/dsa/mv88e6xxx/chip.h | 6 drivers/net/dsa/mv88e6xxx/global1.c | 89 ++ drivers/net/dsa/mv88e6xxx/global1.h | 2 drivers/net/ethernet/amazon/ena/ena_admin_defs.h | 6 drivers/net/ethernet/amazon/ena/ena_com.c | 326 +++------- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 49 - drivers/net/ethernet/amazon/ena/ena_eth_com.h | 15 drivers/net/ethernet/amazon/ena/ena_netdev.c | 163 +++-- drivers/net/ethernet/amazon/ena/ena_netdev.h | 4 drivers/net/ethernet/cisco/enic/enic_main.c | 12 drivers/net/ethernet/cortina/gemini.c | 12 drivers/net/ethernet/freescale/fec_main.c | 10 drivers/net/ethernet/freescale/fec_ptp.c | 14 drivers/net/ethernet/intel/ice/ice_ethtool.c | 19 drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 11 drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 3 drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 56 - drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 44 + drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 9 drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 23 drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h | 8 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 17 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 6 drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 12 drivers/net/ethernet/qlogic/qed/qed_main.c | 9 drivers/net/ethernet/realtek/r8169_main.c | 9 drivers/net/ethernet/smsc/smc91x.h | 4 drivers/net/ethernet/sun/sungem.c | 14 drivers/net/ipvlan/ipvlan_core.c | 4 drivers/net/phy/micrel.c | 1 drivers/net/usb/aqc111.c | 8 drivers/net/usb/qmi_wwan.c | 3 drivers/net/usb/smsc95xx.c | 26 drivers/net/usb/sr9700.c | 10 drivers/net/wireless/ath/ar5523/ar5523.c | 14 drivers/net/wireless/ath/ath10k/core.c | 3 drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 drivers/net/wireless/ath/ath10k/hw.h | 1 drivers/net/wireless/ath/ath10k/targaddrs.h | 3 drivers/net/wireless/ath/ath10k/wmi.c | 26 drivers/net/wireless/ath/ath11k/mac.c | 9 drivers/net/wireless/ath/carl9170/tx.c | 3 drivers/net/wireless/ath/carl9170/usb.c | 32 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 15 drivers/net/wireless/marvell/mwl8k.c | 2 drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 1 drivers/nvme/host/multipath.c | 3 drivers/nvme/target/auth.c | 8 drivers/nvme/target/configfs.c | 20 drivers/nvme/target/core.c | 5 drivers/nvme/target/nvmet.h | 1 drivers/nvme/target/tcp.c | 11 drivers/pci/controller/dwc/pcie-tegra194.c | 3 drivers/pci/pcie/edr.c | 28 drivers/perf/arm_dmc620_pmu.c | 9 drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 drivers/perf/hisilicon/hns3_pmu.c | 16 drivers/pwm/pwm-sti.c | 48 - drivers/regulator/bd71828-regulator.c | 58 - drivers/regulator/irq_helpers.c | 3 drivers/regulator/vqmmc-ipq4019-regulator.c | 1 drivers/s390/cio/trace.h | 2 drivers/scsi/bfa/bfad_debugfs.c | 4 drivers/scsi/hpsa.c | 2 drivers/scsi/libsas/sas_expander.c | 3 drivers/scsi/qedf/qedf_debugfs.c | 2 drivers/scsi/qla2xxx/qla_dfs.c | 2 drivers/scsi/qla2xxx/qla_init.c | 8 drivers/scsi/qla2xxx/qla_mr.c | 20 drivers/soc/mediatek/mtk-cmdq-helper.c | 5 drivers/soundwire/cadence_master.c | 2 drivers/spi/spi-stm32.c | 2 drivers/spi/spi.c | 4 drivers/staging/greybus/arche-apb-ctrl.c | 1 drivers/staging/greybus/arche-platform.c | 9 drivers/staging/greybus/light.c | 8 drivers/staging/media/atomisp/pci/sh_css.c | 1 drivers/thermal/qcom/tsens.c | 2 drivers/tty/n_gsm.c | 140 ++-- drivers/tty/serial/8250/8250_bcm7271.c | 101 +-- drivers/tty/serial/8250/8250_mtk.c | 8 drivers/tty/serial/max3100.c | 22 drivers/tty/serial/sc16is7xx.c | 2 drivers/tty/serial/sh-sci.c | 5 drivers/ufs/core/ufshcd.c | 4 drivers/ufs/host/cdns-pltfrm.c | 2 drivers/ufs/host/ufs-qcom.c | 13 drivers/ufs/host/ufs-qcom.h | 21 drivers/usb/gadget/function/u_audio.c | 21 drivers/video/fbdev/Kconfig | 4 drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 drivers/video/fbdev/sis/init301.c | 3 drivers/virt/acrn/mm.c | 61 + drivers/virtio/virtio_pci_common.c | 4 drivers/watchdog/bd9576_wdt.c | 12 drivers/watchdog/sa1100_wdt.c | 5 drivers/xen/xenbus/xenbus_probe.c | 36 - fs/ecryptfs/keystore.c | 4 fs/eventpoll.c | 38 + fs/ext4/mballoc.c | 134 ++-- fs/ext4/namei.c | 2 fs/f2fs/checkpoint.c | 4 fs/f2fs/compress.c | 2 fs/f2fs/data.c | 10 fs/f2fs/extent_cache.c | 4 fs/f2fs/file.c | 96 +- fs/f2fs/gc.c | 9 fs/f2fs/namei.c | 2 fs/f2fs/node.c | 2 fs/f2fs/segment.c | 2 fs/gfs2/glock.c | 4 fs/gfs2/glops.c | 3 fs/gfs2/util.c | 1 fs/jffs2/xattr.c | 3 fs/nfs/filelayout/filelayout.c | 4 fs/nfs/fs_context.c | 9 fs/nfs/nfs4state.c | 12 fs/nilfs2/ioctl.c | 2 fs/nilfs2/segment.c | 38 - fs/ntfs3/dir.c | 1 fs/ntfs3/fslog.c | 3 fs/ntfs3/index.c | 6 fs/ntfs3/inode.c | 7 fs/ntfs3/ntfs.h | 2 fs/ntfs3/record.c | 11 fs/ntfs3/super.c | 2 fs/openpromfs/inode.c | 8 fs/overlayfs/dir.c | 3 fs/smb/server/mgmt/share_config.c | 6 fs/smb/server/oplock.c | 21 include/drm/display/drm_dp_helper.h | 6 include/drm/drm_mipi_dsi.h | 6 include/linux/acpi.h | 2 include/linux/bitops.h | 1 include/linux/counter.h | 1 include/linux/dev_printk.h | 25 include/linux/fpga/fpga-region.h | 13 include/linux/mlx5/driver.h | 1 include/linux/numa.h | 26 include/linux/printk.h | 2 include/linux/skbuff.h | 19 include/media/cec.h | 1 include/net/ax25.h | 3 include/net/bluetooth/bluetooth.h | 2 include/net/bluetooth/l2cap.h | 11 include/net/inet6_hashtables.h | 16 include/net/inet_common.h | 2 include/net/inet_hashtables.h | 18 include/net/mac80211.h | 3 include/net/netfilter/nf_tables_core.h | 10 include/trace/events/asoc.h | 2 include/uapi/linux/bpf.h | 2 io_uring/io_uring.h | 3 io_uring/nop.c | 2 kernel/Makefile | 1 kernel/bpf/verifier.c | 10 kernel/cgroup/cpuset.c | 2 kernel/dma/map_benchmark.c | 6 kernel/irq/cpuhotplug.c | 16 kernel/numa.c | 26 kernel/rcu/tasks.h | 2 kernel/rcu/tree_stall.h | 3 kernel/sched/core.c | 2 kernel/sched/fair.c | 53 + kernel/sched/isolation.c | 7 kernel/sched/topology.c | 2 kernel/softirq.c | 12 kernel/trace/ftrace.c | 39 - kernel/trace/ring_buffer.c | 9 kernel/trace/rv/rv.c | 2 lib/kunit/try-catch.c | 9 lib/slub_kunit.c | 2 lib/test_hmm.c | 8 net/ax25/ax25_dev.c | 48 - net/bluetooth/af_bluetooth.c | 21 net/bluetooth/bnep/sock.c | 10 net/bluetooth/hci_sock.c | 10 net/bluetooth/iso.c | 10 net/bluetooth/l2cap_core.c | 56 + net/bluetooth/l2cap_sock.c | 99 ++- net/bluetooth/rfcomm/sock.c | 13 net/bluetooth/sco.c | 10 net/bridge/br_device.c | 6 net/bridge/br_mst.c | 16 net/core/dev.c | 3 net/ipv4/af_inet.c | 34 - net/ipv4/inet_hashtables.c | 29 net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 net/ipv4/tcp_dctcp.c | 13 net/ipv4/tcp_ipv4.c | 13 net/ipv4/udp.c | 55 - net/ipv6/inet6_hashtables.c | 27 net/ipv6/reassembly.c | 2 net/ipv6/seg6.c | 5 net/ipv6/seg6_hmac.c | 42 - net/ipv6/seg6_iptunnel.c | 11 net/ipv6/udp.c | 61 - net/mac80211/mlme.c | 3 net/mac80211/rate.c | 6 net/mac80211/scan.c | 1 net/mac80211/tx.c | 13 net/mptcp/sockopt.c | 2 net/netfilter/nfnetlink_queue.c | 2 net/netfilter/nft_fib.c | 8 net/netfilter/nft_payload.c | 111 ++- net/netrom/nr_route.c | 19 net/nfc/nci/core.c | 17 net/openvswitch/actions.c | 6 net/openvswitch/flow.c | 3 net/packet/af_packet.c | 3 net/qrtr/ns.c | 27 net/sunrpc/auth_gss/svcauth_gss.c | 12 net/sunrpc/clnt.c | 1 net/sunrpc/svc.c | 2 net/sunrpc/xprtrdma/verbs.c | 6 net/tls/tls_main.c | 10 net/unix/af_unix.c | 39 - net/wireless/trace.h | 4 scripts/kconfig/symbol.c | 6 sound/core/init.c | 20 sound/core/jack.c | 46 - sound/core/timer.c | 10 sound/hda/intel-dsp-config.c | 27 sound/pci/hda/hda_cs_dsp_ctl.c | 47 - sound/pci/hda/patch_realtek.c | 16 sound/soc/codecs/da7219-aad.c | 6 sound/soc/codecs/rt5645.c | 25 sound/soc/codecs/rt715-sdca.c | 8 sound/soc/codecs/rt715-sdw.c | 1 sound/soc/codecs/tas2552.c | 15 sound/soc/intel/avs/boards/ssm4567.c | 1 sound/soc/intel/avs/cldma.c | 2 sound/soc/intel/avs/path.c | 1 sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 sound/soc/intel/boards/bxt_rt298.c | 1 sound/soc/intel/boards/bytcr_rt5640.c | 14 sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 sound/soc/intel/boards/kbl_da7219_max98927.c | 4 sound/soc/intel/boards/kbl_rt5660.c | 1 sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 1 sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 sound/soc/intel/boards/skl_nau88l25_max98357a.c | 1 sound/soc/intel/boards/skl_rt286.c | 1 sound/soc/kirkwood/kirkwood-dma.c | 3 sound/soc/mediatek/mt8192/mt8192-dai-tdm.c | 4 tools/arch/x86/lib/x86-opcode-map.txt | 10 tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 4 tools/bpf/resolve_btfids/main.c | 2 tools/include/nolibc/stdlib.h | 2 tools/include/uapi/linux/bpf.h | 2 tools/lib/bpf/libbpf.c | 2 tools/lib/subcmd/parse-options.c | 8 tools/perf/Documentation/perf-list.txt | 1 tools/perf/bench/inject-buildid.c | 2 tools/perf/builtin-annotate.c | 2 tools/perf/builtin-daemon.c | 4 tools/perf/builtin-record.c | 4 tools/perf/builtin-report.c | 2 tools/perf/tests/Build | 2 tools/perf/tests/builtin-test.c | 29 tools/perf/tests/tests.h | 27 tools/perf/tests/workloads/Build | 13 tools/perf/tests/workloads/brstack.c | 40 + tools/perf/tests/workloads/datasym.c | 40 + tools/perf/tests/workloads/leafloop.c | 34 + tools/perf/tests/workloads/noploop.c | 32 tools/perf/tests/workloads/sqrtloop.c | 45 + tools/perf/tests/workloads/thloop.c | 53 + tools/perf/ui/browser.c | 6 tools/perf/ui/browser.h | 2 tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 tools/perf/util/intel-pt.c | 2 tools/perf/util/probe-event.c | 1 tools/perf/util/stat-display.c | 3 tools/testing/selftests/bpf/network_helpers.c | 2 tools/testing/selftests/bpf/test_sockmap.c | 2 tools/testing/selftests/filesystems/binderfs/Makefile | 2 tools/testing/selftests/kcmp/kcmp_test.c | 2 tools/testing/selftests/kvm/aarch64/vgic_init.c | 50 + tools/testing/selftests/lib.mk | 12 tools/testing/selftests/net/amt.sh | 20 tools/testing/selftests/net/forwarding/bridge_igmp.sh | 6 tools/testing/selftests/net/forwarding/bridge_mld.sh | 6 tools/testing/selftests/resctrl/Makefile | 4 tools/testing/selftests/syscall_user_dispatch/sud_test.c | 14 tools/tracing/latency/latency-collector.c | 8 476 files changed, 4154 insertions(+), 2396 deletions(-) Aapo Vienamo (1): mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() Aaron Conole (1): openvswitch: Set the skbuff pkt_type for proper pmtud support. Abel Vesa (1): scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5 Adham Faris (1): net/mlx5e: Fail with messages when params are not valid for XSK Adrian Hunter (3): x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) Akiva Goldberger (2): net/mlx5: Add a timeout to acquire the command queue semaphore net/mlx5: Discard command completions in internal error Al Viro (1): parisc: add missing export of __cmpxchg_u8() Aleksandr Aprelkov (1): sunrpc: removed redundant procp check Aleksandr Burakov (1): media: ngene: Add dvb_ca_en50221_init return value check Aleksandr Mishin (6): crypto: bcm - Fix pointer arithmetic cppc_cpufreq: Fix possible null pointer dereference thermal/drivers/tsens: Fix null pointer dereference ASoC: kirkwood: Fix potential NULL dereference drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference drm: vc4: Fix possible null pointer dereference Alexander Egorenkov (2): s390/ipl: Fix incorrect initialization of len fields in nvme reipl block s390/ipl: Fix incorrect initialization of nvme dump block Alexander Lobakin (1): bitops: add missing prototype check Alexandre Mergnat (1): clk: mediatek: mt8365-mm: fix DPI0 parent Andrea Mayer (1): ipv6: sr: fix missing sk_buff release in seg6_input_core Andreas Gruenbacher (2): gfs2: Don't forget to complete delayed withdraw gfs2: Fix "ignore unlock failures after withdraw" Andrew Halaney (7): scsi: ufs: qcom: Perform read back after writing reset bit scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US scsi: ufs: qcom: Perform read back after writing unipro mode scsi: ufs: qcom: Perform read back after writing CGC enable scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV scsi: ufs: core: Perform read back after disabling interrupts scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11. Andy Shevchenko (6): ACPI: LPSS: Advertise number of chip selects via property iio: core: Leave private pointer NULL when no private data supplied serial: max3100: Lock port->lock when calling uart_handle_cts_change() serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Fix bitwise types spi: Don't mark message DMA mapped when no transfer in it is AngeloGioacchino Del Regno (2): drm/mediatek: dp: Move PHY registration to new function drm/mediatek: dp: Add support for embedded DisplayPort aux-bus Anshuman Khandual (1): coresight: etm4x: Fix unbalanced pm_runtime_enable() Anton Protopopov (1): bpf: Pack struct bpf_fib_lookup Ard Biesheuvel (3): x86/efistub: Omit physical KASLR when memory reservations exist x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 x86/purgatory: Switch to the position-independent small code model Armin Wolf (1): ACPI: Fix Generic Initiator Affinity _OSC bit Arnaldo Carvalho de Melo (1): perf probe: Add missing libgen.h header needed for using basename() Arnd Bergmann (14): nilfs2: fix out-of-range warning crypto: ccp - drop platform ifdef checks qed: avoid truncating work queue length mlx5: stop warning for 64KB pages wifi: carl9170: re-fix fortified-memset warning ACPI: disable -Wstringop-truncation fbdev: shmobile: fix snprintf truncation powerpc/fsl-soc: hide unused const variable fbdev: sisfb: hide unused variables media: rcar-vin: work around -Wenum-compare-conditional warning firmware: dmi-id: add a release callback function greybus: arche-ctrl: move device table to its right location Input: ims-pcu - fix printf string overflow drm/i915/guc: avoid FIELD_PREP warning Azeem Shaikh (1): scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy() Baochen Qiang (2): wifi: ath10k: poll service ready message before failing wifi: ath11k: don't force enable power save on non-running vdevs Basavaraj Natikar (1): HID: amd_sfh: Handle "no sensors" in PM operations Benjamin Coddington (1): NFSv4: Fixup smatch warning for ambiguous return Bibo Mao (1): LoongArch: Lately init pmu after smp is online Bob Pearson (3): RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c RDMA/rxe: Fix incorrect rxe_put in error path Brennan Xavier McManus (1): tools/nolibc/stdlib: fix memory error in realloc() Breno Leitao (1): af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg Brian Kubisiak (1): ecryptfs: Fix buffer size for tag 66 packet Bui Quang Minh (2): scsi: bfa: Ensure the copied buf is NUL terminated scsi: qedf: Ensure the copied buf is NUL terminated Carolina Jubran (1): net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion Catalin Popescu (1): clk: rs9: fix wrong default value for clock amplitude Cezary Rojewski (4): ASoC: Intel: Disable route checks for Skylake boards ASoC: Intel: avs: ssm4567: Do not ignore route checks ASoC: Intel: avs: Fix ASRC module initialization ASoC: Intel: avs: Fix potential integer overflow Chaitanya Kulkarni (2): block: open code __blk_account_io_start() block: open code __blk_account_io_done() Chao Yu (11): f2fs: multidev: fix to recognize valid zero block address f2fs: fix to wait on page writeback in __clone_blkaddrs() f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file() f2fs: fix to relocate check condition in f2fs_fallocate() f2fs: fix to check pinfile flag in f2fs_move_file_range() f2fs: compress: fix to update i_compr_blocks correctly f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock f2fs: fix to release node block count in error path of f2fs_new_node_page() f2fs: compress: don't allow unaligned truncation on released compress inode f2fs: fix to add missing iput() in gc_data_segment() Chen Ni (3): HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors dmaengine: idma64: Add check for dma_set_max_seg_size watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() Cheng Yu (1): sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write() Chengchang Tang (5): RDMA/hns: Fix deadlock on SRQ async events. RDMA/hns: Fix UAF for cq async event RDMA/hns: Fix GMV table pagesize RDMA/hns: Use complete parentheses in macros RDMA/hns: Modify the print level of CQE error Chris Lew (1): net: qrtr: ns: Fix module refcnt Chris Wulff (2): usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. usb: gadget: u_audio: Clear uac pointer when freed. Christian Hewitt (1): drm/meson: vclk: fix calculation of 59.94 fractional rates Christoph Hellwig (1): virt: acrn: stop using follow_pfn Christophe JAILLET (2): VMCI: Fix an error handling path in vmci_guest_probe_device() ppdev: Remove usage of the deprecated ida_simple_xx() API Chuck Lever (2): SUNRPC: Fix loop termination condition in gss_free_in_token_pages() SUNRPC: Fix gss_free_in_token_pages() Chun-Kuang Hu (1): soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE Clément Léger (1): selftests: sud_test: return correct emulated syscall value on RISC-V Dae R. Jeong (1): tls: fix missing memory barrier in tls_init Dan Aloni (2): sunrpc: fix NFSACL RPC retry on soft mount rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL Dan Carpenter (7): speakup: Fix sizeof() vs ARRAY_SIZE() bug nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists() wifi: mwl8k: initialize cmd->addr[] properly Bluetooth: qca: Fix error code in qca_read_fw_build_info() ext4: fix potential unnitialized variable stm class: Fix a double free in stm_register_device() media: stk1160: fix bounds checking in stk1160_copy_video() Daniel J Blueman (1): x86/tsc: Trust initial offset in architectural TSC-adjust MSRs Daniel Starke (2): tty: n_gsm: fix possible out-of-bounds in gsm0_receive() tty: n_gsm: fix missing receive state reset after mode switch Daniele Palmas (1): net: usb: qmi_wwan: add Telit FN920C04 compositions David Arinzon (3): net: ena: Add dynamic recycling mechanism for rx buffers net: ena: Reduce lines with longer column width boundary net: ena: Fix DMA syncing in XDP path when SWIOTLB is on David Hildenbrand (1): drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() Derek Fang (2): ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating ASoC: dt-bindings: rt5645: add cbj sleeve gpio property Detlev Casanova (1): drm/rockchip: vop2: Do not divide height twice for YUV Dmitry Baryshkov (5): wifi: ath10k: populate board data for WCN3990 drm/msm/dp: allow voltage swing / pre emphasis of 3 drm/mipi-dsi: use correct return type for the DSC functions clk: qcom: dispcc-sm8450: fix DisplayPort clocks clk: qcom: dispcc-sm6350: fix DisplayPort clocks Dongli Zhang (1): genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline Dongliang Mu (1): media: flexcop-usb: fix sanity check of bNumEndpoints Doug Berger (1): serial: 8250_bcm7271: use default_mux_rate if possible Douglas Anderson (4): drm/dp: Don't attempt AUX transfers when eDP panels are not powered drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert drm/msm/dp: Return IRQ_NONE for unhandled interrupts drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected Drew Davenport (1): drm/panel-samsung-atna33xc20: Use ktime_get_boottime for delays Duoming Zhou (6): wifi: brcmfmac: pcie: handle randbuf allocation failure ax25: Use kernel universal linked list to implement ax25_dev_list ax25: Fix reference count leak issues of ax25_dev ax25: Fix reference count leak issue of net_device lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure um: Fix return value in ubd_init() Edward Liaw (1): selftests/kcmp: remove unused open mode Eric Biggers (4): KEYS: asymmetric: Add missing dependencies of FIPS_SIGNATURE_SELFTEST crypto: x86/nh-avx2 - add missing vzeroupper crypto: x86/sha256-avx2 - add missing vzeroupper crypto: x86/sha512-avx2 - add missing vzeroupper Eric Dumazet (9): tcp: avoid premature drops in tcp_add_backlog() net: give more chances to rcu in netdev_wait_allrefs_any() usb: aqc111: stop lying about skb->truesize net: usb: sr9700: stop lying about skb->truesize net: usb: smsc95xx: stop lying about skb->truesize net: add pskb_may_pull_reason() helper netrom: fix possible dead-lock in nr_rt_ioctl() af_packet: do not call packet_read_pending() from tpacket_destruct_skb() netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() Eric Garver (1): netfilter: nft_fib: allow from forward/input without iif selector Eric Sandeen (1): openpromfs: finish conversion to the new mount API Fabio Estevam (1): media: dt-bindings: ovti,ov2680: Fix the power supply names Fedor Pchelkin (2): dma-mapping: benchmark: fix node id validation dma-mapping: benchmark: handle NUMA_NO_NODE correctly Felix Fietkau (1): wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset Felix Kuehling (1): drm/amdgpu: Update BO eviction priorities Fenglin Wu (1): Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation Finn Thain (2): macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" m68k: mac: Fix reboot hang on Mac IIci Florian Fainelli (1): net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled Florian Westphal (2): netfilter: nft_payload: rebuild vlan header on h_proto access netfilter: tproxy: bail out if IP has been disabled on the device Friedrich Vock (1): bpf: Fix potential integer overflow in resolve_btfids Gabriel Krisman Bertazi (1): udp: Avoid call to compute_score on multiple sites Gal Pressman (1): net/mlx5e: Fix UDP GSO for encapsulated packets Geert Uytterhoeven (5): sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() printk: Let no_printk() use _printk() dev_printk: Add and use dev_no_printk() clk: renesas: r8a779a0: Fix CANFD parent clock dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties Geliang Tang (2): selftests/bpf: Fix umount cgroup2 error in test_sockmap selftests/bpf: Fix a fd leak in error paths in open_netns Gerd Hoffmann (1): KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID Greg Kroah-Hartman (1): Linux 6.1.93 Guenter Roeck (3): mm/slub, kunit: Use inverted data to corrupt kmem cache Revert "sh: Handle calling csum_partial with misaligned data" hwmon: (shtc1) Fix property misspelling Guixiong Wei (1): x86/boot: Ignore relocations in .notes sections in walk_relocs() too Guo Ren (1): riscv: stacktrace: Make walk_stackframe cross pt_regs frame Hagar Hemdan (1): efi: libstub: only free priv.runtime_map when allocated Hangbin Liu (4): ipv6: sr: add missing seg6_local_exit ipv6: sr: fix incorrect unregister order ipv6: sr: fix invalid unregister error path ipv6: sr: fix memleak in seg6_hmac_init_algo Hans Verkuil (4): media: cec: cec-adap: always cancel work in cec_transmit_msg_fh media: cec: cec-api: add locking in cec_release() media: cec: core: avoid recursive cec_claim_log_addrs media: cec: core: avoid confusing "transmit timed out" message Hans de Goede (1): ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too Hao Chen (1): drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() He Zhe (1): perf bench internals inject-build-id: Fix trap divide when collecting just one DSO Heiko Carstens (1): s390/vdso: Use standard stack frame layout Heiner Kallweit (1): Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already" Henry Wang (1): drivers/xen: Improve the late XenStore init protocol Himanshu Madhani (1): scsi: qla2xxx: Fix debugfs output for fw_resource_count Hsin-Te Yuan (1): ASoC: mediatek: mt8192: fix register configuration for tdm Huacai Chen (1): LoongArch: Fix callchain parse error with kernel tracepoint events again Huai-Yuan Liu (2): drm/arm/malidp: fix a possible null pointer dereference ppdev: Add an error check in register_device Hugo Villeneuve (1): serial: sc16is7xx: add proper sched.h include for sched_set_fifo() Ian Rogers (7): perf record: Delete session after stopping sideband thread perf docs: Document bpf event modifier perf ui browser: Don't save pointer to stack memory perf ui browser: Avoid SEGV on title perf report: Avoid SEGV in report__setup_sample_type() libsubcmd: Fix parse-options memory leak perf stat: Don't display metric header for non-leader uncore events Igor Artemiev (1): wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class Ilya Denisyev (1): jffs2: prevent xattr node from overflowing the eraseblock Ilya Leoshkevich (1): s390/bpf: Emit a barrier for BPF_FETCH instructions Ilya Maximets (1): net: openvswitch: fix overwriting ct original tuple for ICMPv6 Jack Xiao (1): drm/amdgpu/mes: fix use-after-free issue Jack Yu (2): ASoC: rt715: add vendor clear control register ASoC: rt715-sdca: volume step modification Jacob Keller (2): Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI" ice: fix accounting if a VLAN already exists Jaewon Kim (1): clk: samsung: exynosautov9: fix wrong pll clock id value Jagan Teki (1): drm/bridge: Fix improper bridge init order with pre_enable_prev_first Jakub Kicinski (2): eth: sungem: remove .ndo_poll_controller to avoid deadlocks selftests: net: move amt to socat for better compatibility Jakub Sitnicki (1): bpf: Allow delete from sockmap/sockhash only if update is allowed James Clark (1): perf tests: Make "test data symbol" more robust on Neoverse N1 Jan Kara (1): ext4: avoid excessive credit estimate in ext4_tmpfile() Jason Gunthorpe (1): IB/mlx5: Use __iowrite64_copy() for write combining stores Jens Axboe (2): io_uring: don't use TIF_NOTIFY_SIGNAL to test for availability of task_work io_uring: use the right type for work_llist empty check Jens Remus (1): s390/vdso: Generate unwind information for C modules Jiangfeng Xiao (1): arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY Jinyoung CHOI (1): f2fs: fix typos in comments Jiri Olsa (1): libbpf: Fix error message in attach_kprobe_multi Jiri Pirko (1): virtio: delete vq in vp_find_vqs_msix() when request_irq() fails Johannes Berg (2): wifi: mac80211: don't use rate mask for scanning um: vector: fix bpfflash parameter evaluation John Hubbard (2): selftests/binderfs: use the Makefile's rules, not Make's implicit rules selftests/resctrl: fix clang build failure: use LOCAL_HDRS Jonathan Cameron (1): iio: adc: stm32: Fixing err code to not indicate success Joshua Ashton (1): drm/amd/display: Set color_mgmt_changed to true on unsuspend Judith Mendez (5): mmc: sdhci_am654: Add tuning algorithm for delay chain mmc: sdhci_am654: Write ITAPDLY for DDR52 timing mmc: sdhci_am654: Add OTAP/ITAP delay enable mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock mmc: sdhci_am654: Fix ITAPDLY for HS400 timing Juergen Gross (3): x86/pat: Introduce lookup_address_in_pgd_attr() x86/pat: Restructure _lookup_address_cpa() x86/pat: Fix W^X violation false-positives when running as Xen PV guest Junhao He (2): drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group Justin Green (1): drm/mediatek: Add 0 size check to mtk_drm_gem_obj Karel Balej (1): Input: ioc3kbd - add device table Kemeng Shi (4): ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple ext4: fix unit mismatch in ext4_mb_new_blocks_simple ext4: try all groups in ext4_mb_new_blocks_simple ext4: remove unused parameter from ext4_mb_new_blocks_simple() Ken Milmore (1): r8169: Fix possible ring buffer corruption on fragmented Tx packets. Kent Overstreet (1): kernel/numa.c: Move logging out of numa.h Konrad Dybcio (2): interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Konstantin Komarov (6): fs/ntfs3: Remove max link count info display during driver init fs/ntfs3: Taking DOS names into account during link counting fs/ntfs3: Fix case when index is reused during tree transformation fs/ntfs3: Break dir enumeration if directory contents error fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow fs/ntfs3: Use variable length array instead of fixed size Krzysztof Kozlowski (1): regulator: vqmmc-ipq4019: fix module autoloading Kuniyuki Iwashima (3): af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). af_unix: Read sk->sk_hash under bindlock during bind(). Kuppuswamy Sathyanarayanan (2): PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 Lad Prabhakar (1): clk: renesas: r9a07g043: Add clock and reset entry for PLIC Lancelot SIX (1): drm/amdkfd: Flush the process wq before creating a kfd_process Larysa Zaremba (1): ice: Interpret .set_channels() input differently Laurent Pinchart (1): firmware: raspberrypi: Use correct device for DMA mappings Leon Romanovsky (1): RDMA/IPoIB: Fix format truncation compilation errors Linus Torvalds (2): x86/mm: Remove broken vsyscall emulation code from the page fault code epoll: be better about file lifetimes Linus Walleij (1): net: ethernet: cortina: Locking fixes Lorenz Bauer (2): net: export inet_lookup_reuseport and inet6_lookup_reuseport net: remove duplicate reuseport_lookup functions Luca Ceresoli (1): Revert "drm/bridge: ti-sn65dsi83: Fix enable error path" Luiz Augusto von Dentz (1): Bluetooth: Consolidate code around sk_alloc into a helper function Luke D. Jones (3): ALSA: hda/realtek: Add quirk for ASUS ROG G634Z ALSA: hda/realtek: Amend G634 quirk to enable rear speakers ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp Maher Sanalla (1): net/mlx5: Lag, do bond only if slaves agree on roce state Manivannan Sadhasivam (1): scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0 Marc Gonzalez (1): clk: qcom: mmcc-msm8998: fix venus clock issue Marco Pagani (1): fpga: region: add owner module and take its refcount Marek Szyprowski (1): Input: cyapa - add missing input core locking to suspend/resume functions Marek Vasut (2): drm/lcdif: Do not disable clocks on already suspended hardware drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector Marijn Suijten (2): drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk drm/msm/dpu: Always flush the slave INTF on the CTL Martin Kaiser (1): nfs: keep server info for remounts Masahiro Yamada (2): x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y kconfig: fix comparison to constant symbols, 'm', 'n' Mathieu Othacehe (1): net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 Matthew Bystrin (1): riscv: stacktrace: fixed walk_stackframe() Matthias Schiffer (2): net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches Matthieu Baerts (NGI0) (1): mptcp: SO_KEEPALIVE: fix getsockopt support Matti Vaittinen (3): regulator: irq_helpers: duplicate IRQ name watchdog: bd9576: Drop "always-running" property regulator: bd71828: Don't overwrite runtime voltages Maurizio Lombardi (2): nvmet-auth: return the error code to the nvmet_auth_host_hash() callers nvmet-auth: replace pr_debug() with pr_err() to report an error. Maxim Korotkov (1): mtd: rawnand: hynix: fixed typo Maxime Ripard (1): ARM: configs: sunxi: Enable DRM_DW_HDMI Michael Schmitz (1): m68k: Fix spinlock race in kernel thread creation Michael Walle (1): drm/bridge: tc358775: fix support for jeida-18 and jeida-24 Michal Simek (2): microblaze: Remove gcc flag for non existing early_printk.c file microblaze: Remove early printk call from cpuinfo-static.c Mickaël Salaün (1): kunit: Fix kthread reference Miklos Szeredi (1): ovl: remove upper umask handling from ovl_create_upper() Ming Lei (1): io_uring: fail NOP if non-zero op flags is passed in Namhyung Kim (8): perf annotate: Get rid of duplicate --group option item perf test: Add -w/--workload option perf test: Add 'thloop' test workload perf test: Add 'leafloop' test workload perf test: Add 'sqrtloop' test workload perf test: Add 'brstack' test workload perf test: Add 'datasym' test workload perf/arm-dmc620: Fix lockdep assert in ->event_init() Namjae Jeon (1): ksmbd: avoid to send duplicate oplock break notifications Nandor Kracser (1): ksmbd: ignore trailing slashes in share paths Nathan Lynch (1): powerpc/pseries/lparcfg: drop error message from guest name lookup Neil Armstrong (1): scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5 Nikita Kiryushin (2): rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow rcu: Fix buffer overflow in print_cpu_stall_info() Nikita Zhandarovich (2): wifi: carl9170: add a proper sanity check for endpoints wifi: ar5523: enable proper endpoint verification Nikolay Aleksandrov (3): net: bridge: xmit: make sure we have at least eth header len bytes selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval net: bridge: mst: fix vlan use-after-free Nilay Shroff (1): nvme: find numa distance only if controller has valid numa id Nícolas F. R. A. Prado (8): drm/bridge: anx7625: Don't log an error when DSI host can't be found drm/bridge: icn6211: Don't log an error when DSI host can't be found drm/bridge: lt8912b: Don't log an error when DSI host can't be found drm/bridge: lt9611: Don't log an error when DSI host can't be found drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found drm/bridge: tc358775: Don't log an error when DSI host can't be found drm/bridge: dpc3433: Don't log an error when DSI host can't be found drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found Oleg Nesterov (1): sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU Olga Kornievskaia (1): pNFS/filelayout: fixup pNfs allocation modes Oliver Upton (1): KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF Or Har-Toov (1): RDMA/mlx5: Adding remote atomic access flag to updatable flags Pablo Neira Ayuso (4): netfilter: nft_payload: restore vlan q-in-q match support netfilter: nft_payload: move struct nft_payload_set definition where it belongs netfilter: nft_payload: rebuild vlan header when needed netfilter: nft_payload: skbuff vlan metadata mangle support Paolo Abeni (2): inet: factor out locked section of inet_accept() in a new helper net: relax socket state check at accept time. Parthiban Veerasooran (1): net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM Peter Colberg (1): fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card Peter Oberparleiter (1): s390/cio: fix tracepoint subchannel type field Petr Pavlu (1): ring-buffer: Fix a race between readers and resize checks Pierre-Louis Bossart (3): ASoC: da7219-aad: fix usage of device_get_named_child_node() ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection soundwire: cadence: fix invalid PDI offset Pin-yen Lin (1): serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup Prike Liang (1): drm/amdgpu: Fix the ring buffer size for queue VM flush Puranjay Mohan (1): riscv, bpf: make some atomic operations fully ordered Rafał Miłecki (1): dt-bindings: pinctrl: mediatek: mt7622: fix array properties Rahul Rameshbabu (1): net/mlx5e: Fix IPsec tunnel mode offload feature check Randy Dunlap (4): fbdev: sh7760fb: allow modular build counter: linux/counter.h: fix Excess kernel-doc description warning extcon: max8997: select IRQ_DOMAIN instead of depending on it media: sunxi: a83-mips-csi2: also select GENERIC_PHY Ricardo Ribalda (1): media: radio-shark2: Avoid led_names truncations Richard Fitzgerald (1): ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup Richard Kinder (1): wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field Rob Clark (1): drm/msm: Enable clamp_to_idle for 7c3 Rob Herring (1): dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node Robert Richter (1): x86/numa: Fix SRAT lookup of CFMWS ranges with numa_fill_memblks() Roberto Sassu (1): um: Add winch to winch_handlers before registering winch IRQ Roded Zats (1): enic: Validate length of nl attributes in enic_set_vf_port Rodrigo Siqueira (1): drm/amd/display: Add VCO speed parameter for DCN31 FPU Rui Miguel Silva (1): greybus: lights: check return of get_channel_from_mode Ryosuke Yasuoka (2): nfc: nci: Fix uninit-value in nci_rx_work nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() Ryusuke Konishi (2): nilfs2: fix unexpected freezing of nilfs_segctor_sync() nilfs2: fix potential hang in nilfs_detach_log_writer() Sagi Grimberg (3): nvmet-tcp: fix possible memory leak when tearing down a controller nvmet: fix nvme status code when namespace is disabled nvmet: fix ns enable/disable possible hang Sakari Ailus (1): media: ipu3-cio2: Request IRQ earlier Samasth Norway Ananda (1): perf daemon: Fix file leak in daemon_session__control Sebastian Urban (1): Bluetooth: compute LE flow credits based on recvbuf space Sergey Matyukevich (1): riscv: prevent pt_regs corruption for secondary idle threads Shay Agroskin (1): net: ena: Fix redundant device NUMA node override Shenghao Ding (1): ASoC: tas2552: Add TX path for capturing AUDIO-OUT data Shrikanth Hegde (2): sched/fair: Add EAS checks before updating root_domain::overutilized powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp Shuah Khan (1): tools/latency-collector: Fix -Wformat-security compile warns Srinivasan Shanmugam (1): drm/amd/display: Fix potential index out of bounds in color transformation function Steven Rostedt (1): ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value Su Hui (1): wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() Sumanth Korikkar (2): s390/vdso: filter out mno-pic-data-is-text-relative cflag s390/vdso64: filter out munaligned-symbols flag for vdso Suzuki K Poulose (4): coresight: etm4x: Do not hardcode IOMEM access for register restore coresight: etm4x: Do not save/restore Data trace control registers coresight: etm4x: Safe access for TRCQCLTR coresight: etm4x: Fix access to resource selector registers Sven Schnelle (1): s390/boot: Remove alt_stfle_fac_list from decompressor Swapnil Patel (1): drm/amd/display: Add dtbclk access to dcn315 Taehee Yoo (1): selftests: net: kill smcrouted in the cleanup logic in amt.sh Takashi Iwai (5): ALSA: core: Fix NULL module pointer assignment at card init ALSA: Fix deadlocks with kctl removals at disconnection ALSA: jack: Use guard() for locking ALSA: core: Remove debugfs at disconnection ALSA: timer: Set lower bound of start tick time Tetsuo Handa (2): nfc: nci: Fix kcov check in nci_rx_work() dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Thomas Haemmerle (1): iio: pressure: dps310: support negative temperature values Thorsten Blum (1): net: smc91x: Fix m68k kernel compilation for ColdFire CPU Tiwei Bie (3): um: Fix the -Wmissing-prototypes warning for __switch_mm um: Fix the -Wmissing-prototypes warning for get_thread_reg um: Fix the declaration of kasan_map_memory Tristram Ha (1): net: dsa: microchip: fix RGMII error in KSZ DSA driver Uwe Kleine-König (5): pwm: sti: Convert to platform remove callback returning void pwm: sti: Prepare removing pwm_chip from driver data pwm: sti: Simplify probe function using devm functions Input: ioc3kbd - convert to platform remove callback returning void spi: stm32: Don't warn about spurious interrupts Valentin Obst (1): selftests: default to host arch for LLVM builds Vidya Sagar (1): PCI: tegra194: Fix probe path for Endpoint mode Vignesh Raghavendra (1): mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel Viresh Kumar (1): cpufreq: exit() callback is optional Vitalii Bursov (1): sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level Wei Fang (1): net: fec: avoid lock evasion when reading pps_enable Wojciech Macek (1): drm/mediatek: dp: Fix mtk_dp_aux_transfer return value Wolfram Sang (2): dt-bindings: PCI: rcar-pci-host: Add optional regulators serial: sh-sci: protect invalidating RXDMA on shutdown Xianwei Zhao (1): arm64: dts: meson: fix S4 power-controller node Xiaolei Wang (1): net:fec: Add fec_enet_deinit() Xingui Yang (1): scsi: libsas: Fix the failure of adding phy with zero-address to port Yang Li (1): rv: Update rv_en(dis)able_monitor doc to match kernel-doc Yonghong Song (1): bpftool: Fix missing pids during link show Yu Kuai (2): md: fix resync softlockup when bitmap size is less than array size block: support to account io_ticks precisely Yue Haibing (1): ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Yuri Karpov (1): scsi: hpsa: Fix allocation size for Scsi_Host private data Zenghui Yu (2): irqchip/alpine-msi: Fix off-by-one in allocation error path irqchip/loongson-pch-msi: Fix off-by-one on allocation error path Zheng Yejian (1): ftrace: Fix possible use-after-free issue in ftrace_location() Zhengchao Shao (1): RDMA/hns: Fix return value in hns_roce_map_mr_sg Zhipeng Lu (1): media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries Zhu Yanjun (2): null_blk: Fix missing mutex_destroy() at module removal null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() Zqiang (1): softirq: Fix suspicious RCU usage in __do_softirq() gaoxingwang (1): net: ipv6: fix wrong start position when receive hop-by-hop fragment

1 year, 2 months

1
1
0 0

[PATCH] Supports to use the default CMA when the device-specified CMA memory is not enough.

by zhai.he

From: He Zhai <zhai.he(a)nxp.com> In the current code logic, if the device-specified CMA memory allocation fails, memory will not be allocated from the default CMA area. This patch will use the default cma region when the device's specified CMA is not enough. Signed-off-by: He Zhai <zhai.he(a)nxp.com> --- kernel/dma/contiguous.c | 11 +++++++++-- mm/cma.c | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c index 055da410ac71..e45cfb24500f 100644 --- a/kernel/dma/contiguous.c +++ b/kernel/dma/contiguous.c @@ -357,8 +357,13 @@ struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t gfp) /* CMA can be used only in the context which permits sleeping */ if (!gfpflags_allow_blocking(gfp)) return NULL; - if (dev->cma_area) - return cma_alloc_aligned(dev->cma_area, size, gfp); + if (dev->cma_area) { + struct page *page = NULL; + + page = cma_alloc_aligned(dev->cma_area, size, gfp); + if (page) + return page; + } if (size <= PAGE_SIZE) return NULL; @@ -406,6 +411,8 @@ void dma_free_contiguous(struct device *dev, struct page *page, size_t size) if (dev->cma_area) { if (cma_release(dev->cma_area, page, count)) return; + if (cma_release(dma_contiguous_default_area, page, count)) + return; } else { /* * otherwise, page is from either per-numa cma or default cma diff --git a/mm/cma.c b/mm/cma.c index 3e9724716bad..f225b3f65bd2 100644 --- a/mm/cma.c +++ b/mm/cma.c @@ -495,7 +495,7 @@ struct page *cma_alloc(struct cma *cma, unsigned long count, } if (ret && !no_warn) { - pr_err_ratelimited("%s: %s: alloc failed, req-size: %lu pages, ret: %d\n", + pr_debug("%s: %s: alloc failed, req-size: %lu pages, ret: %d, try to use default cma\n", __func__, cma->name, count, ret); cma_debug_show_areas(cma); } -- 2.34.1

1 year, 2 months

4
4
0 0

[PATCH] misc: microchip: pci1xxxx: Fix return value of nvmem callbacks

by Joy Chakraborty

Read/write callbacks registered with nvmem core expect 0 to be returned on success and a negative value to be returned on failure. Currently pci1xxxx_otp_read()/pci1xxxx_otp_write() and pci1xxxx_eeprom_read()/pci1xxxx_eeprom_write() return the number of bytes read/written on success. Fix to return 0 on success. Fixes: 9ab5465349c0 ("misc: microchip: pci1xxxx: Add support to read and write into PCI1XXXX EEPROM via NVMEM sysfs") Fixes: 0969001569e4 ("misc: microchip: pci1xxxx: Add support to read and write into PCI1XXXX OTP via NVMEM sysfs") Cc: stable(a)vger.kernel.org Signed-off-by: Joy Chakraborty <joychakr(a)google.com> --- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c index 16695cb5e69c..7c3d8bedf90b 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c @@ -153,7 +153,6 @@ static int pci1xxxx_eeprom_read(void *priv_t, unsigned int off, buf[byte] = readl(rb + MMAP_EEPROM_OFFSET(EEPROM_DATA_REG)); } - ret = byte; error: release_sys_lock(priv); return ret; @@ -197,7 +196,6 @@ static int pci1xxxx_eeprom_write(void *priv_t, unsigned int off, goto error; } } - ret = byte; error: release_sys_lock(priv); return ret; @@ -258,7 +256,6 @@ static int pci1xxxx_otp_read(void *priv_t, unsigned int off, buf[byte] = readl(rb + MMAP_OTP_OFFSET(OTP_RD_DATA_OFFSET)); } - ret = byte; error: release_sys_lock(priv); return ret; @@ -315,7 +312,6 @@ static int pci1xxxx_otp_write(void *priv_t, unsigned int off, goto error; } } - ret = byte; error: release_sys_lock(priv); return ret; -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

2
1
0 0

Potential regression on Kernel 5.15.0-112.122

by Xavier Boudet

Hello, I'm using Ubuntu Ubuntu 22.04.4 LTS. I upgraded my kernel last week and obviously there is something wrong with it. When I come back on 5.15.0-107.117, everything is fine. You can find in attachment : kern.log when the kernel seems to crash. I have added lshw -short + dpkg. Let me know if you are the good contact. Thanks & Regards Xavier.

1 year, 2 months

2
1
0 0

[PATCH] platform/chrome: cros_ec_debugfs: fix wrong EC message version

by Tzung-Bi Shih

ec_read_version_supported() uses ec_params_get_cmd_versions_v1 but it wrongly uses message version 0. Fix it. Cc: stable(a)vger.kernel.org Fixes: e86264595225 ("mfd: cros_ec: add debugfs, console log file") Signed-off-by: Tzung-Bi Shih <tzungbi(a)kernel.org> --- drivers/platform/chrome/cros_ec_debugfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c index f0e9efb543df..4525ad1b59f4 100644 --- a/drivers/platform/chrome/cros_ec_debugfs.c +++ b/drivers/platform/chrome/cros_ec_debugfs.c @@ -334,6 +334,7 @@ static int ec_read_version_supported(struct cros_ec_dev *ec) if (!msg) return 0; + msg->version = 1; msg->command = EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset; msg->outsize = sizeof(*params); msg->insize = sizeof(*response); -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

3
3
0 0

[PATCH 6.1] backport: fix 6.1 backport of changes to fork

by Leah Rumancik

The original backport didn't move the code to link the vma into the MT and also the code to increment the map_count causing ~15 xfstests (including ext4/303 generic/051 generic/054 generic/069) to hard fail on some platforms. This patch resolves test failures. Fixes: 0c42f7e039ab ("fork: defer linking file vma until vma is fully initialized") Signed-off-by: Leah Rumancik <leah.rumancik(a)gmail.com> --- kernel/fork.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index 7e9a5919299b..3b44960b1385 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -668,6 +668,15 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, if (is_vm_hugetlb_page(tmp)) hugetlb_dup_vma_private(tmp); + /* Link the vma into the MT */ + mas.index = tmp->vm_start; + mas.last = tmp->vm_end - 1; + mas_store(&mas, tmp); + if (mas_is_err(&mas)) + goto fail_nomem_mas_store; + + mm->map_count++; + if (tmp->vm_ops && tmp->vm_ops->open) tmp->vm_ops->open(tmp); @@ -687,14 +696,6 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, i_mmap_unlock_write(mapping); } - /* Link the vma into the MT */ - mas.index = tmp->vm_start; - mas.last = tmp->vm_end - 1; - mas_store(&mas, tmp); - if (mas_is_err(&mas)) - goto fail_nomem_mas_store; - - mm->map_count++; if (!(tmp->vm_flags & VM_WIPEONFORK)) retval = copy_page_range(tmp, mpnt); -- 2.45.1.288.g0e0cd299f1-goog

1 year, 2 months

1
1
0 0

[PATCH v3 0/1] mm/memfd: add documentation for MFD_NOEXEC_SEAL

by jeffxu＠chromium.org

From: Jeff Xu <jeffxu(a)chromium.org> When MFD_NOEXEC_SEAL was introduced, there was one big mistake: it didn't have proper documentation. This led to a lot of confusion, especially about whether or not memfd created with the MFD_NOEXEC_SEAL flag is sealable. Before MFD_NOEXEC_SEAL, memfd had to explicitly set MFD_ALLOW_SEALING to be sealable, so it's a fair question. As one might have noticed, unlike other flags in memfd_create, MFD_NOEXEC_SEAL is actually a combination of multiple flags. The idea is to make it easier to use memfd in the most common way, which is NOEXEC + F_SEAL_EXEC + MFD_ALLOW_SEALING. This works with sysctl vm.noexec to help existing applications move to a more secure way of using memfd. Proposals have been made to put MFD_NOEXEC_SEAL non-sealable, unless MFD_ALLOW_SEALING is set, to be consistent with other flags [1] [2], Those are based on the viewpoint that each flag is an atomic unit, which is a reasonable assumption. However, MFD_NOEXEC_SEAL was designed with the intent of promoting the most secure method of using memfd, therefore a combination of multiple functionalities into one bit. Furthermore, the MFD_NOEXEC_SEAL has been added for more than one year, and multiple applications and distributions have backported and utilized it. Altering ABI now presents a degree of risk and may lead to disruption. MFD_NOEXEC_SEAL is a new flag, and applications must change their code to use it. There is no backward compatibility problem. When sysctl vm.noexec == 1 or 2, applications that don't set MFD_NOEXEC_SEAL or MFD_EXEC will get MFD_NOEXEC_SEAL memfd. And old-application might break, that is by-design, in such a system vm.noexec = 0 shall be used. Also no backward compatibility problem. I propose to include this documentation patch to assist in clarifying the semantics of MFD_NOEXEC_SEAL, thereby preventing any potential future confusion. This patch supersede previous patch which is trying different direction [3], and please remove [2] from mm-unstable branch when applying this patch. Finally, I would like to express my gratitude to David Rheinsberg and Barnabás Pőcze for initiating the discussion on the topic of sealability. [1] https://lore.kernel.org/lkml/20230714114753.170814-1-david@readahead.eu/ [2] https://lore.kernel.org/lkml/20240513191544.94754-1-pobrn@protonmail.com/ [3] https://lore.kernel.org/lkml/20240524033933.135049-1-jeffxu@google.com/ v3: Additional Randy Dunlap' comments. v2: Update according to Randy Dunlap' comments. https://lore.kernel.org/linux-mm/20240611034903.3456796-1-jeffxu@chromium.o… v1: https://lore.kernel.org/linux-mm/20240607203543.2151433-1-jeffxu@google.com/ Jeff Xu (1): mm/memfd: add documentation for MFD_NOEXEC_SEAL MFD_EXEC Documentation/userspace-api/index.rst | 1 + Documentation/userspace-api/mfd_noexec.rst | 86 ++++++++++++++++++++++ 2 files changed, 87 insertions(+) create mode 100644 Documentation/userspace-api/mfd_noexec.rst -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

1
1
0 0

[PATCH v2 0/1] mm/memfd: add documentation for MFD_NOEXEC_SEAL

by jeffxu＠chromium.org

From: Jeff Xu <jeffxu(a)chromium.org> When MFD_NOEXEC_SEAL was introduced, there was one big mistake: it didn't have proper documentation. This led to a lot of confusion, especially about whether or not memfd created with the MFD_NOEXEC_SEAL flag is sealable. Before MFD_NOEXEC_SEAL, memfd had to explicitly set MFD_ALLOW_SEALING to be sealable, so it's a fair question. As one might have noticed, unlike other flags in memfd_create, MFD_NOEXEC_SEAL is actually a combination of multiple flags. The idea is to make it easier to use memfd in the most common way, which is NOEXEC + F_SEAL_EXEC + MFD_ALLOW_SEALING. This works with sysctl vm.noexec to help existing applications move to a more secure way of using memfd. Proposals have been made to put MFD_NOEXEC_SEAL non-sealable, unless MFD_ALLOW_SEALING is set, to be consistent with other flags [1] [2], Those are based on the viewpoint that each flag is an atomic unit, which is a reasonable assumption. However, MFD_NOEXEC_SEAL was designed with the intent of promoting the most secure method of using memfd, therefore a combination of multiple functionalities into one bit. Furthermore, the MFD_NOEXEC_SEAL has been added for more than one year, and multiple applications and distributions have backported and utilized it. Altering ABI now presents a degree of risk and may lead to disruption. MFD_NOEXEC_SEAL is a new flag, and applications must change their code to use it. There is no backward compatibility problem. When sysctl vm.noexec == 1 or 2, applications that don't set MFD_NOEXEC_SEAL or MFD_EXEC will get MFD_NOEXEC_SEAL memfd. And old-application might break, that is by-design, in such a system vm.noexec = 0 shall be used. Also no backward compatibility problem. I propose to include this documentation patch to assist in clarifying the semantics of MFD_NOEXEC_SEAL, thereby preventing any potential future confusion. This patch supersede previous patch which is trying different direction [3], and please remove [2] from mm-unstable branch when applying this patch. Finally, I would like to express my gratitude to David Rheinsberg and Barnabás Pőcze for initiating the discussion on the topic of sealability. [1] https://lore.kernel.org/lkml/20230714114753.170814-1-david@readahead.eu/ [2] https://lore.kernel.org/lkml/20240513191544.94754-1-pobrn@protonmail.com/ [3] https://lore.kernel.org/lkml/20240524033933.135049-1-jeffxu@google.com/ v2: Update according to Randy Dunlap' comments. v1: https://lore.kernel.org/linux-mm/20240607203543.2151433-1-jeffxu@google.com/ Jeff Xu (1): mm/memfd: add documentation for MFD_NOEXEC_SEAL MFD_EXEC Documentation/userspace-api/index.rst | 1 + Documentation/userspace-api/mfd_noexec.rst | 86 ++++++++++++++++++++++ 2 files changed, 87 insertions(+) create mode 100644 Documentation/userspace-api/mfd_noexec.rst -- 2.45.2.505.gda0bf45e8d-goog

1 year, 2 months

3
3
0 0

[PATCH] dmaengine: fsl-edma: change the memory access from local into remote mode in i.MX 8QM

by Joy Zou

Fix the issue where MEM_TO_MEM fail on i.MX8QM due to the requirement that both source and destination addresses need pass through the IOMMU. Typically, peripheral FIFO addresses bypass the IOMMU, necessitating only one of the source or destination to go through it. Set "is_remote" to true to ensure both source and destination addresses pass through the IOMMU. iMX8 Spec define "Local" and "Remote" bus as below. Local bus: bypass IOMMU to directly access other peripheral register, such as FIFO. Remote bus: go through IOMMU to access system memory. The test fail log as follow: [ 66.268506] dmatest: dma0chan0-copy0: result #1: 'test timed out' with src_off=0x100 dst_off=0x80 len=0x3ec0 (0) [ 66.278785] dmatest: dma0chan0-copy0: summary 1 tests, 1 failures 0.32 iops 4 KB/s (0) Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support") Signed-off-by: Joy Zou <joy.zou(a)nxp.com> Cc: stable(a)vger.kernel.org --- drivers/dma/fsl-edma-common.c | 3 +++ drivers/dma/fsl-edma-common.h | 1 + drivers/dma/fsl-edma-main.c | 2 +- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/dma/fsl-edma-common.c b/drivers/dma/fsl-edma-common.c index d62f5f452a43..7accee488856 100644 --- a/drivers/dma/fsl-edma-common.c +++ b/drivers/dma/fsl-edma-common.c @@ -756,6 +756,8 @@ struct dma_async_tx_descriptor *fsl_edma_prep_memcpy(struct dma_chan *chan, fsl_desc->iscyclic = false; fsl_chan->is_sw = true; + if (fsl_edma_drvflags(fsl_chan) & FSL_EDMA_DRV_MEM_REMOTE) + fsl_chan->is_remote = true; /* To match with copy_align and max_seg_size so 1 tcd is enough */ fsl_edma_fill_tcd(fsl_chan, fsl_desc->tcd[0].vtcd, dma_src, dma_dst, @@ -835,6 +837,7 @@ void fsl_edma_free_chan_resources(struct dma_chan *chan) fsl_chan->tcd_pool = NULL; fsl_chan->is_sw = false; fsl_chan->srcid = 0; + fsl_chan->is_remote = false; if (fsl_edma_drvflags(fsl_chan) & FSL_EDMA_DRV_HAS_CHCLK) clk_disable_unprepare(fsl_chan->clk); } diff --git a/drivers/dma/fsl-edma-common.h b/drivers/dma/fsl-edma-common.h index 3f93ebb890b3..cc15c1a145eb 100644 --- a/drivers/dma/fsl-edma-common.h +++ b/drivers/dma/fsl-edma-common.h @@ -194,6 +194,7 @@ struct fsl_edma_desc { #define FSL_EDMA_DRV_HAS_PD BIT(5) #define FSL_EDMA_DRV_HAS_CHCLK BIT(6) #define FSL_EDMA_DRV_HAS_CHMUX BIT(7) +#define FSL_EDMA_DRV_MEM_REMOTE BIT(8) /* control and status register is in tcd address space, edma3 reg layout */ #define FSL_EDMA_DRV_SPLIT_REG BIT(9) #define FSL_EDMA_DRV_BUS_8BYTE BIT(10) diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c index 391e4f13dfeb..43d84cfefbe2 100644 --- a/drivers/dma/fsl-edma-main.c +++ b/drivers/dma/fsl-edma-main.c @@ -342,7 +342,7 @@ static struct fsl_edma_drvdata imx7ulp_data = { }; static struct fsl_edma_drvdata imx8qm_data = { - .flags = FSL_EDMA_DRV_HAS_PD | FSL_EDMA_DRV_EDMA3, + .flags = FSL_EDMA_DRV_HAS_PD | FSL_EDMA_DRV_EDMA3 | FSL_EDMA_DRV_MEM_REMOTE, .chreg_space_sz = 0x10000, .chreg_off = 0x10000, .setup_irq = fsl_edma3_irq_init, -- 2.37.1

1 year, 2 months

3
2
0 0

[PATCH] dt-bindings: dma: fsl-edma: fix dma-channels constraints

by Krzysztof Kozlowski

dma-channels is a number, not a list. Apply proper constraints on the actual number. Fixes: 6eb439dff645 ("dt-bindings: fsl-dma: fsl-edma: add edma3 compatible string") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- Documentation/devicetree/bindings/dma/fsl,edma.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/devicetree/bindings/dma/fsl,edma.yaml b/Documentation/devicetree/bindings/dma/fsl,edma.yaml index 825f4715499e..9ef99eb54104 100644 --- a/Documentation/devicetree/bindings/dma/fsl,edma.yaml +++ b/Documentation/devicetree/bindings/dma/fsl,edma.yaml @@ -60,8 +60,8 @@ properties: - 3 dma-channels: - minItems: 1 - maxItems: 64 + minimum: 1 + maximum: 64 clocks: minItems: 1 -- 2.43.0

1 year, 2 months

4
3
0 0

[PATCH 11/36] drm/amd/display: Add null check to dml21_find_dc_pipes_for_plane

by Hamza Mahfooz

From: Dillon Varone <dillon.varone(a)amd.com> When a phantom stream is in the process of being deconstructed, there could be pipes with no associated planes. In that case, ignore the phantom stream entirely when searching for associated pipes. Cc: stable(a)vger.kernel.org Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Dillon Varone <dillon.varone(a)amd.com> --- .../gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c index 4e12810308a4..4166332b5b89 100644 --- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c +++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_utils.c @@ -126,10 +126,15 @@ int dml21_find_dc_pipes_for_plane(const struct dc *in_dc, if (dc_phantom_stream && num_pipes > 0) { dc_phantom_stream_status = dml_ctx->config.callbacks.get_stream_status(context, dc_phantom_stream); - /* phantom plane will have same index as main */ - dc_phantom_plane = dc_phantom_stream_status->plane_states[dc_plane_index]; + if (dc_phantom_stream_status) { + /* phantom plane will have same index as main */ + dc_phantom_plane = dc_phantom_stream_status->plane_states[dc_plane_index]; - dml_ctx->config.callbacks.get_dpp_pipes_for_plane(dc_phantom_plane, &context->res_ctx, dc_phantom_pipes); + if (dc_phantom_plane) { + /* only care about phantom pipes if they contain the phantom plane */ + dml_ctx->config.callbacks.get_dpp_pipes_for_plane(dc_phantom_plane, &context->res_ctx, dc_phantom_pipes); + } + } } return num_pipes; -- 2.45.1

1 year, 2 months

1
0
0 0

[PATCH 10/36] drm/amd/display: Attempt to avoid empty TUs when endpoint is DPIA

by Hamza Mahfooz

From: Michael Strauss <michael.strauss(a)amd.com> [WHY] Empty SST TUs are illegal to transmit over a USB4 DP tunnel. Current policy is to configure stream encoder to pack 2 pixels per pclk even when ODM combine is not in use, allowing seamless dynamic ODM reconfiguration. However, in extreme edge cases where average pixel count per TU is less than 2, this can lead to unexpected empty TU generation during compliance testing. For example, VIC 1 with a 1xHBR3 link configuration will average 1.98 pix/TU. [HOW] Calculate average pixel count per TU, and block 2 pixels per clock if endpoint is a DPIA tunnel and pixel clock is low enough that we will never require 2:1 ODM combine. Cc: stable(a)vger.kernel.org # 6.6+ Reviewed-by: Wenjing Liu <wenjing.liu(a)amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Michael Strauss <michael.strauss(a)amd.com> --- .../amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 72 +++++++++++++++++++ .../amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 2 + .../amd/display/dc/hwss/dcn35/dcn35_init.c | 2 +- 3 files changed, 75 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c index 4f87316e1318..0602921399cd 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c @@ -1529,3 +1529,75 @@ void dcn35_set_long_vblank(struct pipe_ctx **pipe_ctx, } } } + +static bool should_avoid_empty_tu(struct pipe_ctx *pipe_ctx) +{ + /* Calculate average pixel count per TU, return false if under ~2.00 to + * avoid empty TUs. This is only required for DPIA tunneling as empty TUs + * are legal to generate for native DP links. Assume TU size 64 as there + * is currently no scenario where it's reprogrammed from HW default. + * MTPs have no such limitation, so this does not affect MST use cases. + */ + unsigned int pix_clk_mhz; + unsigned int symclk_mhz; + unsigned int avg_pix_per_tu_x1000; + unsigned int tu_size_bytes = 64; + struct dc_crtc_timing *timing = &pipe_ctx->stream->timing; + struct dc_link_settings *link_settings = &pipe_ctx->link_config.dp_link_settings; + const struct dc *dc = pipe_ctx->stream->link->dc; + + if (pipe_ctx->stream->link->ep_type != DISPLAY_ENDPOINT_USB4_DPIA) + return false; + + // Not necessary for MST configurations + if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) + return false; + + pix_clk_mhz = timing->pix_clk_100hz / 10000; + + // If this is true, can't block due to dynamic ODM + if (pix_clk_mhz > dc->clk_mgr->bw_params->clk_table.entries[0].dispclk_mhz) + return false; + + switch (link_settings->link_rate) { + case LINK_RATE_LOW: + symclk_mhz = 162; + break; + case LINK_RATE_HIGH: + symclk_mhz = 270; + break; + case LINK_RATE_HIGH2: + symclk_mhz = 540; + break; + case LINK_RATE_HIGH3: + symclk_mhz = 810; + break; + default: + // We shouldn't be tunneling any other rates, something is wrong + ASSERT(0); + return false; + } + + avg_pix_per_tu_x1000 = (1000 * pix_clk_mhz * tu_size_bytes) + / (symclk_mhz * link_settings->lane_count); + + // Add small empirically-decided margin to account for potential jitter + return (avg_pix_per_tu_x1000 < 2020); +} + +bool dcn35_is_dp_dig_pixel_rate_div_policy(struct pipe_ctx *pipe_ctx) +{ + struct dc *dc = pipe_ctx->stream->ctx->dc; + + if (!is_h_timing_divisible_by_2(pipe_ctx->stream)) + return false; + + if (should_avoid_empty_tu(pipe_ctx)) + return false; + + if (dc_is_dp_signal(pipe_ctx->stream->signal) && !dc->link_srv->dp_is_128b_132b_signal(pipe_ctx) && + dc->debug.enable_dp_dig_pixel_rate_div_policy) + return true; + + return false; +} diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h index bc05beba5f2c..e27b3609020f 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h @@ -97,4 +97,6 @@ void dcn35_set_static_screen_control(struct pipe_ctx **pipe_ctx, void dcn35_set_long_vblank(struct pipe_ctx **pipe_ctx, int num_pipes, uint32_t v_total_min, uint32_t v_total_max); +bool dcn35_is_dp_dig_pixel_rate_div_policy(struct pipe_ctx *pipe_ctx); + #endif /* __DC_HWSS_DCN35_H__ */ diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c index 30e6a6398839..428912f37129 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c @@ -161,7 +161,7 @@ static const struct hwseq_private_funcs dcn35_private_funcs = { .setup_hpo_hw_control = dcn35_setup_hpo_hw_control, .calculate_dccg_k1_k2_values = dcn32_calculate_dccg_k1_k2_values, .resync_fifo_dccg_dio = dcn314_resync_fifo_dccg_dio, - .is_dp_dig_pixel_rate_div_policy = dcn32_is_dp_dig_pixel_rate_div_policy, + .is_dp_dig_pixel_rate_div_policy = dcn35_is_dp_dig_pixel_rate_div_policy, .dsc_pg_control = dcn35_dsc_pg_control, .dsc_pg_status = dcn32_dsc_pg_status, .enable_plane = dcn35_enable_plane, -- 2.45.1

1 year, 2 months

1
0
0 0

[PATCH] riscv: dts: starfive: Set EMMC vqmmc maximum voltage to 3.3V on JH7110 boards

by Shengyu Qu

Currently, for JH7110 boards with EMMC slot, vqmmc voltage for EMMC is fixed to 1.8V, while the spec needs it to be 3.3V on low speed mode and should support switching to 1.8V when using higher speed mode. Since there are no other peripherals using the same voltage source of EMMC's vqmmc(ALDO4) on every board currently supported by mainline kernel, regulator-max-microvolt of ALDO4 should be set to 3.3V. Cc: stable(a)vger.kernel.org Signed-off-by: Shengyu Qu <wiagn233(a)outlook.com> Fixes: ac9a37e2d6b6 ("riscv: dts: starfive: introduce a common board dtsi for jh7110 based boards") --- arch/riscv/boot/dts/starfive/jh7110-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/riscv/boot/dts/starfive/jh7110-common.dtsi b/arch/riscv/boot/dts/starfive/jh7110-common.dtsi index 37b4c294ffcc..c7a549ec7452 100644 --- a/arch/riscv/boot/dts/starfive/jh7110-common.dtsi +++ b/arch/riscv/boot/dts/starfive/jh7110-common.dtsi @@ -244,7 +244,7 @@ emmc_vdd: aldo4 { regulator-boot-on; regulator-always-on; regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; regulator-name = "emmc_vdd"; }; }; -- 2.34.1

1 year, 2 months

2
1
0 0

[PATCH] ksmbd: fix missing use of get_write in in smb2_set_ea()

by Namjae Jeon

Fix an issue where get_write is not used in smb2_set_ea(). Fixes: 6fc0a265e1b9 ("ksmbd: fix potential circular locking issue in smb2_set_ea()") Cc: stable(a)vger.kernel.org Reported-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> --- fs/smb/server/smb2pdu.c | 7 ++++--- fs/smb/server/vfs.c | 17 +++++++++++------ fs/smb/server/vfs.h | 3 ++- fs/smb/server/vfs_cache.c | 3 ++- 4 files changed, 19 insertions(+), 11 deletions(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 8bcede718c21..63a41193f6e6 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2367,7 +2367,8 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, if (rc > 0) { rc = ksmbd_vfs_remove_xattr(idmap, path, - attr_name); + attr_name, + get_write); if (rc < 0) { ksmbd_debug(SMB, @@ -2382,7 +2383,7 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, } else { rc = ksmbd_vfs_setxattr(idmap, path, attr_name, value, le16_to_cpu(eabuf->EaValueLength), - 0, true); + 0, get_write); if (rc < 0) { ksmbd_debug(SMB, "ksmbd_vfs_setxattr is failed(%d)\n", @@ -2474,7 +2475,7 @@ static int smb2_remove_smb_xattrs(const struct path *path) !strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, STREAM_PREFIX_LEN)) { err = ksmbd_vfs_remove_xattr(idmap, path, - name); + name, true); if (err) ksmbd_debug(SMB, "remove xattr failed : %s\n", name); diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c index 51b1b0bed616..9e859ba010cf 100644 --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -1058,16 +1058,21 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length, } int ksmbd_vfs_remove_xattr(struct mnt_idmap *idmap, - const struct path *path, char *attr_name) + const struct path *path, char *attr_name, + bool get_write) { int err; - err = mnt_want_write(path->mnt); - if (err) - return err; + if (get_write == true) { + err = mnt_want_write(path->mnt); + if (err) + return err; + } err = vfs_removexattr(idmap, path->dentry, attr_name); - mnt_drop_write(path->mnt); + + if (get_write == true) + mnt_drop_write(path->mnt); return err; } @@ -1380,7 +1385,7 @@ int ksmbd_vfs_remove_sd_xattrs(struct mnt_idmap *idmap, const struct path *path) ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name)); if (!strncmp(name, XATTR_NAME_SD, XATTR_NAME_SD_LEN)) { - err = ksmbd_vfs_remove_xattr(idmap, path, name); + err = ksmbd_vfs_remove_xattr(idmap, path, name, true); if (err) ksmbd_debug(SMB, "remove xattr failed : %s\n", name); } diff --git a/fs/smb/server/vfs.h b/fs/smb/server/vfs.h index cfe1c8092f23..cb76f4b5bafe 100644 --- a/fs/smb/server/vfs.h +++ b/fs/smb/server/vfs.h @@ -114,7 +114,8 @@ int ksmbd_vfs_setxattr(struct mnt_idmap *idmap, int ksmbd_vfs_xattr_stream_name(char *stream_name, char **xattr_stream_name, size_t *xattr_stream_name_size, int s_type); int ksmbd_vfs_remove_xattr(struct mnt_idmap *idmap, - const struct path *path, char *attr_name); + const struct path *path, char *attr_name, + bool get_write); int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, unsigned int flags, struct path *parent_path, struct path *path, bool caseless); diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c index 882a87f9e3ab..3bf1b3fb6ec8 100644 --- a/fs/smb/server/vfs_cache.c +++ b/fs/smb/server/vfs_cache.c @@ -262,7 +262,8 @@ static void __ksmbd_inode_close(struct ksmbd_file *fp) ci->m_flags &= ~S_DEL_ON_CLS_STREAM; err = ksmbd_vfs_remove_xattr(file_mnt_idmap(filp), &filp->f_path, - fp->stream.name); + fp->stream.name, + true); if (err) pr_err("remove xattr failed : %s\n", fp->stream.name); -- 2.25.1

1 year, 2 months

1
0
0 0

Plymouth not showing during boot on a rpi cm4 since kernel 5.15

by Jonas Kvinge

Hi, A blank black screen is shown during boot instead of showing Plymouth. This is on a Raspberry Pi Compute Module 4 with a sourcekit.io board, this started happening since kernel 5.15. I'm using openSUSE Tumbleweed currently with kernel 6.9.3, I've tried both the default and vanilla kernel. If I press ESC once I can see the boot messages, if I press ESC again the plymouth logo is shown, so there it seems that something might be interrupting plymouth. The root partition is luks encrypted, it will wait for the password during boot, so it's easy to see whether plymouth initially shows or not. I've built kernel 5.14 on the same system, and confirmed plymouth works. I've also built kernel 5.15 and confirmed that it no longer works. I've compared the source for the 5.14 and 5.14 kernel and can see that there has been some work done to the firmware framebuffer stuff. Could anyone hint any possible source code changes that might have caused this, I can try source code changes but I need some advice where to go from here. I'm using the following cmdline options: systemd.show_status=0 vt.global_cursor_default=0 plymouth.ignore- serial-consoles video=HDMI-A-1:1920x1080M@60,rotate=90 fsck.mode=force fsck.repair=yes cgroup_enable=memory swapaccount=1 net.ifnames=0 rd.neednet=1 ip=192.168.250.20::192.168.250.200:255.255.255.0::eth0:off quiet splash Boot log: <6>[ 0.000000] [ T0] Booting Linux on physical CPU 0x0000000000 [0x410fd083] <5>[ 0.000000] [ T0] Linux version 6.9.3-7.g97b471a-vanilla (geeko@buildhost) (gcc (SUSE Linux) 13.3.0, GNU ld (GNU Binutils; openSUSE Tumbleweed) 2.42.0.20240130-3) #1 SMP PREEMPT_DYNAMIC Wed Jun 5 05:47:57 UTC 2024 (97b471a) <6>[ 0.000000] [ T0] KASLR enabled <5>[ 0.000000] [ T0] random: crng init done <6>[ 0.000000] [ T0] Machine model: Raspberry Pi Compute Module 4 Rev 1.0 <6>[ 0.000000] [ T0] efi: EFI v2.10 by Das U-Boot <6>[ 0.000000] [ T0] efi: TPMFinalLog=0x3cad3040 RTPROP=0x3cad1040 SMBIOS 3.0=0x3db45000 TPMEventLog=0x2f00f040 RNG=0x3a87b040 MEMRESERVE=0x2f00e040 <6>[ 0.000000] [ T0] Reserved memory: created CMA memory pool at 0x000000002ae00000, size 64 MiB <6>[ 0.000000] [ T0] OF: reserved mem: initialized node linux,cma, compatible id shared-dma-pool <6>[ 0.000000] [ T0] OF: reserved mem: 0x000000002ae00000..0x000000002edfffff (65536 KiB) map reusable linux,cma <6>[ 0.000000] [ T0] OF: reserved mem: 0x000000003ef643e0..0x000000003ef645df (0 KiB) nomap non-reusable nvram@1 <6>[ 0.000000] [ T0] OF: reserved mem: 0x000000003ef64620..0x000000003ef647d2 (0 KiB) nomap non-reusable nvram@0 <6>[ 0.000000] [ T0] NUMA: No NUMA configuration found <6>[ 0.000000] [ T0] NUMA: Faking a node at [mem 0x0000000000000000-0x00000000fbffffff] <6>[ 0.000000] [ T0] NUMA: NODE_DATA [mem 0xfb7e5ac0-0xfb7eafff] <6>[ 0.000000] [ T0] Zone ranges: <6>[ 0.000000] [ T0] DMA [mem 0x0000000000000000- 0x000000003fffffff] <6>[ 0.000000] [ T0] DMA32 [mem 0x0000000040000000- 0x00000000fbffffff] <6>[ 0.000000] [ T0] Normal empty <6>[ 0.000000] [ T0] Device empty <6>[ 0.000000] [ T0] Movable zone start for each node <6>[ 0.000000] [ T0] Early memory node ranges <6>[ 0.000000] [ T0] node 0: [mem 0x0000000000000000- 0x0000000000000fff] <6>[ 0.000000] [ T0] node 0: [mem 0x0000000000001000- 0x000000003cad0fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003cad1000- 0x000000003cad1fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003cad2000- 0x000000003cad2fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003cad3000- 0x000000003cae3fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003cae4000- 0x000000003caf5fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003caf6000- 0x000000003cb17fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003cb18000- 0x000000003db44fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003db45000- 0x000000003db45fff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003db46000- 0x000000003df2ffff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003df30000- 0x000000003df3ffff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003df40000- 0x000000003dffffff] <6>[ 0.000000] [ T0] node 0: [mem 0x000000003ef64000- 0x000000003ef64fff] <6>[ 0.000000] [ T0] node 0: [mem 0x0000000040000000- 0x00000000fbffffff] <6>[ 0.000000] [ T0] Initmem setup node 0 [mem 0x0000000000000000-0x00000000fbffffff] <6>[ 0.000000] [ T0] On node 0, zone DMA: 3940 pages in unavailable ranges <6>[ 0.000000] [ T0] On node 0, zone DMA32: 4251 pages in unavailable ranges <6>[ 0.000000] [ T0] On node 0, zone DMA32: 16384 pages in unavailable ranges <6>[ 0.000000] [ T0] percpu: Embedded 34 pages/cpu s101672 r8192 d29400 u139264 <7>[ 0.000000] [ T0] pcpu-alloc: s101672 r8192 d29400 u139264 alloc=34*4096 <7>[ 0.000000] [ T0] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 <6>[ 0.000000] [ T0] Detected PIPT I-cache on CPU0 <6>[ 0.000000] [ T0] CPU features: detected: Spectre-v2 <6>[ 0.000000] [ T0] CPU features: detected: Spectre-v3a <6>[ 0.000000] [ T0] CPU features: detected: Spectre-v4 <6>[ 0.000000] [ T0] CPU features: detected: Spectre-BHB <6>[ 0.000000] [ T0] CPU features: kernel page table isolation forced ON by KASLR <6>[ 0.000000] [ T0] CPU features: detected: Kernel page table isolation (KPTI) <6>[ 0.000000] [ T0] CPU features: detected: ARM erratum 1742098 <6>[ 0.000000] [ T0] CPU features: detected: ARM errata 1165522, 1319367, or 1530923 <6>[ 0.000000] [ T0] alternatives: applying boot alternatives <5>[ 0.000000] [ T0] Kernel command line: BOOT_IMAGE=/Image- 6.9.3-7.g97b471a-vanilla root=UUID=6d048af7-a4ba-4e50-8808-d686e13c286e systemd.show_status=0 vt.global_cursor_default=0 plymouth.ignore- serial-consoles video=HDMI-A-1:1920x1080M@60,rotate=90 fsck.mode=force fsck.repair=yes cgroup_enable=memory swapaccount=1 net.ifnames=0 rd.neednet=1 ip=192.168.250.20::192.168.250.200:255.255.255.0::eth0:off quiet splash <5>[ 0.000000] [ T0] Unknown kernel command line parameters "splash BOOT_IMAGE=/Image-6.9.3-7.g97b471a-vanilla cgroup_enable=memory ip=192.168.250.20::192.168.250.200:255.255.255.0::eth0:off", will be passed to user space. <6>[ 0.000000] [ T0] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes, linear) <6>[ 0.000000] [ T0] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes, linear) <6>[ 0.000000] [ T0] Fallback order for Node 0: 0 <6>[ 0.000000] [ T0] Built 1 zonelists, mobility grouping on. Total pages: 1007873 <6>[ 0.000000] [ T0] Policy zone: DMA32 <6>[ 0.000000] [ T0] mem auto-init: stack:off, heap alloc:off, heap free:off <6>[ 0.000000] [ T0] software IO TLB: area num 4. <6>[ 0.000000] [ T0] software IO TLB: mapped [mem 0x000000003687b000-0x000000003a87b000] (64MB) <6>[ 0.000000] [ T0] Memory: 935900K/4096004K available (15680K kernel code, 3632K rwdata, 15504K rodata, 10880K init, 1192K bss, 226888K reserved, 65536K cma-reserved) <6>[ 0.000000] [ T0] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 <6>[ 0.000000] [ T0] ftrace: allocating 51996 entries in 204 pages <6>[ 0.000000] [ T0] ftrace: allocated 204 pages with 4 groups <6>[ 0.000000] [ T0] trace event string verifier disabled <6>[ 0.000000] [ T0] Dynamic Preempt: voluntary <6>[ 0.000000] [ T0] rcu: Preemptible hierarchical RCU implementation. <6>[ 0.000000] [ T0] rcu: RCU event tracing is enabled. <6>[ 0.000000] [ T0] rcu: RCU restricting CPUs from NR_CPUS=480 to nr_cpu_ids=4. <6>[ 0.000000] [ T0] Trampoline variant of Tasks RCU enabled. <6>[ 0.000000] [ T0] Rude variant of Tasks RCU enabled. <6>[ 0.000000] [ T0] Tracing variant of Tasks RCU enabled. <6>[ 0.000000] [ T0] rcu: RCU calculated value of scheduler- enlistment delay is 30 jiffies. <6>[ 0.000000] [ T0] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4 <6>[ 0.000000] [ T0] RCU Tasks: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1. <6>[ 0.000000] [ T0] RCU Tasks Rude: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1. <6>[ 0.000000] [ T0] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1. <6>[ 0.000000] [ T0] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0 <6>[ 0.000000] [ T0] Root IRQ handler: gic_handle_irq <6>[ 0.000000] [ T0] GIC: Using split EOI/Deactivate mode <6>[ 0.000000] [ T0] rcu: srcu_init: Setting srcu_struct sizes based on contention. <6>[ 0.000000] [ T0] arch_timer: cp15 timer(s) running at 54.00MHz (phys). <6>[ 0.000000] [ T0] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xc743ce346, max_idle_ns: 440795203123 ns <6>[ 0.000000] [ T0] sched_clock: 56 bits at 54MHz, resolution 18ns, wraps every 4398046511102ns <6>[ 0.000358] [ T0] Console: colour dummy device 80x25 <6>[ 0.000366] [ T0] printk: legacy console [tty0] enabled <6>[ 0.000498] [ T0] Calibrating delay loop (skipped), value calculated using timer frequency.. 108.50 BogoMIPS (lpj=180000) <6>[ 0.000509] [ T0] pid_max: default: 32768 minimum: 301 <6>[ 0.000620] [ T0] LSM: initializing lsm=lockdown,capability,landlock,yama,apparmor,tomoyo,bpf,ima,evm <6>[ 0.000653] [ T0] landlock: Up and running. <6>[ 0.000656] [ T0] Yama: becoming mindful. <6>[ 0.000727] [ T0] AppArmor: AppArmor initialized <6>[ 0.000732] [ T0] TOMOYO Linux initialized <6>[ 0.000756] [ T0] LSM support for eBPF active <6>[ 0.000882] [ T0] Mount-cache hash table entries: 8192 (order: 4, 65536 bytes, linear) <6>[ 0.000911] [ T0] Mountpoint-cache hash table entries: 8192 (order: 4, 65536 bytes, linear) <6>[ 0.002423] [ T1] rcu: Hierarchical SRCU implementation. <6>[ 0.002433] [ T1] rcu: Max phase no-delay instances is 1000. <6>[ 0.004884] [ T1] Remapping and enabling EFI services. <6>[ 0.005182] [ T1] smp: Bringing up secondary CPUs ... <6>[ 0.005537] [ T0] Detected PIPT I-cache on CPU1 <6>[ 0.005612] [ T0] CPU1: Booted secondary processor 0x0000000001 [0x410fd083] <6>[ 0.006029] [ T0] Detected PIPT I-cache on CPU2 <6>[ 0.006072] [ T0] CPU2: Booted secondary processor 0x0000000002 [0x410fd083] <6>[ 0.006446] [ T0] Detected PIPT I-cache on CPU3 <6>[ 0.006492] [ T0] CPU3: Booted secondary processor 0x0000000003 [0x410fd083] <6>[ 0.006554] [ T1] smp: Brought up 1 node, 4 CPUs <6>[ 0.006562] [ T1] SMP: Total of 4 processors activated. <6>[ 0.006565] [ T1] CPU: All CPU(s) started at EL2 <6>[ 0.006578] [ T1] CPU features: detected: 32-bit EL0 Support <6>[ 0.006581] [ T1] CPU features: detected: 32-bit EL1 Support <6>[ 0.006586] [ T1] CPU features: detected: CRC32 instructions <6>[ 0.006623] [ T1] alternatives: applying system-wide alternatives <6>[ 0.007201] [ T1] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching <6>[ 0.064229] [ T36] node 0 deferred pages initialised in 57ms <6>[ 0.065222] [ T1] devtmpfs: initialized <6>[ 0.071159] [ T1] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6370867519511994 ns <6>[ 0.071185] [ T1] futex hash table entries: 1024 (order: 4, 65536 bytes, linear) <6>[ 0.072303] [ T1] pinctrl core: initialized pinctrl subsystem <6>[ 0.073590] [ T1] SMBIOS 3.7.0 present. <6>[ 0.073606] [ T1] DMI: raspberrypi rpi/rpi, BIOS 2024.04 04/01/2024 <6>[ 0.075227] [ T1] NET: Registered PF_NETLINK/PF_ROUTE protocol family <6>[ 0.075784] [ T1] DMA: preallocated 512 KiB GFP_KERNEL pool for atomic allocations <6>[ 0.075860] [ T1] DMA: preallocated 512 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations <6>[ 0.075963] [ T1] DMA: preallocated 512 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations <6>[ 0.075991] [ T1] audit: initializing netlink subsys (disabled) <5>[ 0.076120] [ T40] audit: type=2000 audit(0.073:1): state=initialized audit_enabled=0 res=1 <6>[ 0.076970] [ T1] thermal_sys: Registered thermal governor 'fair_share' <6>[ 0.076977] [ T1] thermal_sys: Registered thermal governor 'bang_bang' <6>[ 0.076981] [ T1] thermal_sys: Registered thermal governor 'step_wise' <6>[ 0.076984] [ T1] thermal_sys: Registered thermal governor 'user_space' <6>[ 0.077024] [ T1] cpuidle: using governor ladder <6>[ 0.077040] [ T1] cpuidle: using governor menu <6>[ 0.077215] [ T1] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers. <6>[ 0.077271] [ T1] ASID allocator initialised with 32768 entries <6>[ 0.078175] [ T1] Serial: AMBA PL011 UART driver <6>[ 0.087446] [ T1] platform fd500000.pcie: Fixed dependency cycle(s) with /scb/pcie@7d500000 <6>[ 0.089363] [ T1] Modules: 2G module region forced by RANDOMIZE_MODULE_REGION_FULL <6>[ 0.089370] [ T1] Modules: 0 pages in range for non-PLT usage <6>[ 0.089372] [ T1] Modules: 512496 pages in range for PLT usage <6>[ 0.090092] [ T1] HugeTLB: registered 1.00 GiB page size, pre- allocated 0 pages <6>[ 0.090101] [ T1] HugeTLB: 0 KiB vmemmap can be freed for a 1.00 GiB page <6>[ 0.090105] [ T1] HugeTLB: registered 32.0 MiB page size, pre- allocated 0 pages <6>[ 0.090108] [ T1] HugeTLB: 0 KiB vmemmap can be freed for a 32.0 MiB page <6>[ 0.090112] [ T1] HugeTLB: registered 2.00 MiB page size, pre- allocated 0 pages <6>[ 0.090115] [ T1] HugeTLB: 0 KiB vmemmap can be freed for a 2.00 MiB page <6>[ 0.090119] [ T1] HugeTLB: registered 64.0 KiB page size, pre- allocated 0 pages <6>[ 0.090122] [ T1] HugeTLB: 0 KiB vmemmap can be freed for a 64.0 KiB page <6>[ 0.090423] [ T1] Demotion targets for Node 0: null <6>[ 0.091381] [ T1] ACPI: Interpreter disabled. <6>[ 0.092096] [ T1] iommu: Default domain type: Translated <6>[ 0.092104] [ T1] iommu: DMA domain TLB invalidation policy: strict mode <6>[ 0.092487] [ T1] pps_core: LinuxPPS API ver. 1 registered <6>[ 0.092492] [ T1] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti(a)linux.it> <6>[ 0.092500] [ T1] PTP clock support registered <6>[ 0.092593] [ T1] EDAC MC: Ver: 3.0.0 <7>[ 0.092662] [ T1] EDAC DEBUG: edac_mc_sysfs_init: device mc created <6>[ 0.092847] [ T1] scmi_core: SCMI protocol bus registered <6>[ 0.092972] [ T1] efivars: Registered efivars operations <6>[ 0.094022] [ T1] NetLabel: Initializing <6>[ 0.094030] [ T1] NetLabel: domain hash size = 128 <6>[ 0.094034] [ T1] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO <6>[ 0.094067] [ T1] NetLabel: unlabeled traffic allowed by default <6>[ 0.094077] [ T1] mctp: management component transport protocol core <6>[ 0.094080] [ T1] NET: Registered PF_MCTP protocol family <6>[ 0.094306] [ T1] vgaarb: loaded <6>[ 0.094671] [ T1] clocksource: Switched to clocksource arch_sys_counter <5>[ 0.108260] [ T1] VFS: Disk quotas dquot_6.6.0 <6>[ 0.108307] [ T1] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) <6>[ 0.108792] [ T1] AppArmor: AppArmor Filesystem Enabled <6>[ 0.108849] [ T1] pnp: PnP ACPI: disabled <6>[ 0.113405] [ T1] NET: Registered PF_INET protocol family <6>[ 0.113664] [ T1] IP idents hash table entries: 65536 (order: 7, 524288 bytes, linear) <6>[ 0.146412] [ T1] tcp_listen_portaddr_hash hash table entries: 2048 (order: 3, 32768 bytes, linear) <6>[ 0.146444] [ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) <6>[ 0.146455] [ T1] TCP established hash table entries: 32768 (order: 6, 262144 bytes, linear) <6>[ 0.146583] [ T1] TCP bind hash table entries: 32768 (order: 8, 1048576 bytes, linear) <6>[ 0.147149] [ T1] TCP: Hash tables configured (established 32768 bind 32768) <6>[ 0.147453] [ T1] MPTCP token hash table entries: 4096 (order: 4, 98304 bytes, linear) <6>[ 0.147636] [ T1] UDP hash table entries: 2048 (order: 4, 65536 bytes, linear) <6>[ 0.147668] [ T1] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes, linear) <6>[ 0.147842] [ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family <6>[ 0.147872] [ T1] NET: Registered PF_XDP protocol family <6>[ 0.147886] [ T1] PCI: CLS 0 bytes, default 64 <6>[ 0.148223] [ T39] Trying to unpack rootfs image as initramfs... <6>[ 0.153907] [ T1] kvm [1]: nv: 477 coarse grained trap handlers <6>[ 0.154159] [ T1] kvm [1]: IPA Size Limit: 44 bits <6>[ 0.155921] [ T1] kvm [1]: vgic interrupt IRQ9 <6>[ 0.155963] [ T1] kvm [1]: Hyp nVHE mode initialized successfully <5>[ 0.157312] [ T1] Initialise system trusted keyrings <5>[ 0.157359] [ T1] Key type blacklist registered <6>[ 0.157638] [ T1] workingset: timestamp_bits=40 max_order=20 bucket_order=0 <6>[ 0.157735] [ T1] zbud: loaded <5>[ 0.158334] [ T1] integrity: Platform Keyring initialized <5>[ 0.158348] [ T1] integrity: Machine keyring initialized <5>[ 0.183784] [ T1] Key type asymmetric registered <5>[ 0.183804] [ T1] Asymmetric key parser 'x509' registered <6>[ 0.829023] [ T39] Freeing initrd memory: 32296K <6>[ 0.865817] [ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 245) <6>[ 0.866035] [ T1] io scheduler mq-deadline registered <6>[ 0.866049] [ T1] io scheduler kyber registered <6>[ 0.866124] [ T1] io scheduler bfq registered <6>[ 0.874900] [ T1] irq_brcmstb_l2: registered L2 intc (/soc/interrupt-controller@7ef00100, parent irq: 14) <6>[ 0.884657] [ T1] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4 <6>[ 0.918906] [ T1] Serial: 8250/16550 driver, 32 ports, IRQ sharing enabled <6>[ 0.934371] [ T1] Serial: AMBA driver <6>[ 0.935313] [ T1] msm_serial: driver initialized <6>[ 0.935836] [ T1] SuperH (H)SCI(F) driver initialized <6>[ 0.939843] [ T1] [drm] Initialized simpledrm 1.0.0 20200625 for 3e3cf000.framebuffer on minor 0 <6>[ 0.983402] [ T1] Console: switching to colour frame buffer device 240x67 <6>[ 1.011580] [ T1] simple-framebuffer 3e3cf000.framebuffer: [drm] fb0: simpledrmdrmfb frame buffer device <6>[ 1.019647] [ T1] bcm2835-power bcm2835-power: Broadcom BCM2835 power domains driver <6>[ 1.023693] [ T1] mousedev: PS/2 mouse device common for all mice <6>[ 1.036569] [ T1] ledtrig-cpu: registered to indicate activity on CPUs <6>[ 1.037948] [ T1] hid: raw HID events driver (C) Jiri Kosina <6>[ 1.038626] [ T1] bcm2835-mbox fe00b880.mailbox: mailbox enabled <6>[ 1.041971] [ T1] hw perfevents: enabled with armv8_cortex_a72 PMU driver, 7 counters available <6>[ 1.043470] [ T57] watchdog: Delayed init of the lockup detector failed: -19 <6>[ 1.043486] [ T57] watchdog: Hard watchdog permanently disabled <6>[ 1.045427] [ T1] drop_monitor: Initializing network drop monitor service <6>[ 1.045952] [ T1] NET: Registered PF_INET6 protocol family <6>[ 1.081273] [ T1] Segment Routing with IPv6 <6>[ 1.081298] [ T1] RPL Segment Routing with IPv6 <6>[ 1.081410] [ T1] In-situ OAM (IOAM) with IPv6 <6>[ 1.091616] [ T1] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level <6>[ 1.091891] [ T1] registered taskstats version 1 <5>[ 1.092579] [ T1] Loading compiled-in X.509 certificates <5>[ 1.187159] [ T1] Loaded X.509 cert 'home:jonaski:branches:Kernel:stable OBS Project: 55cdf0a4c28fecb638eae5caa71d52cf4f6d6805' <6>[ 1.198548] [ T1] page_owner is disabled <5>[ 1.199030] [ T1] Key type .fscrypt registered <5>[ 1.199042] [ T1] Key type fscrypt-provisioning registered <5>[ 1.357163] [ T1] Key type encrypted registered <6>[ 1.357209] [ T1] AppArmor: AppArmor sha256 policy hashing enabled <6>[ 1.357432] [ T1] ima: secureboot mode disabled <6>[ 1.357454] [ T1] ima: No TPM chip found, activating TPM- bypass! <5>[ 1.357483] [ T1] Loading compiled-in module X.509 certificates <5>[ 1.360660] [ T1] Loaded X.509 cert 'home:jonaski:branches:Kernel:stable OBS Project: 55cdf0a4c28fecb638eae5caa71d52cf4f6d6805' <6>[ 1.360680] [ T1] ima: Allocated hash algorithm: sha256 <6>[ 1.360735] [ T1] ima: No architecture policies found <6>[ 1.360801] [ T1] evm: Initialising EVM extended attributes: <6>[ 1.360808] [ T1] evm: security.selinux <6>[ 1.360816] [ T1] evm: security.SMACK64 (disabled) <6>[ 1.360823] [ T1] evm: security.SMACK64EXEC (disabled) <6>[ 1.360831] [ T1] evm: security.SMACK64TRANSMUTE (disabled) <6>[ 1.360838] [ T1] evm: security.SMACK64MMAP (disabled) <6>[ 1.360844] [ T1] evm: security.apparmor <6>[ 1.360851] [ T1] evm: security.ima <6>[ 1.360857] [ T1] evm: security.capability <6>[ 1.360864] [ T1] evm: HMAC attrs: 0x1 <6>[ 2.084050] [ T10] uart-pl011 fe201000.serial: there is not valid maps for state default <6>[ 2.085027] [ T10] fe201000.serial: ttyAMA0 at MMIO 0xfe201000 (irq = 22, base_baud = 0) is a PL011 rev2 <6>[ 2.085084] [ T10] printk: legacy console [ttyAMA0] enabled <6>[ 2.087488] [ T10] raspberrypi-firmware soc:firmware: Attached to firmware from 2024-03-21T14:32:15 <6>[ 2.195723] [ T1] clk: Disabling unused clocks <6>[ 2.195798] [ T1] PM: genpd: Disabling unused power domains <6>[ 2.215712] [ T1] Freeing unused kernel memory: 10880K <6>[ 2.215898] [ T1] Run /init as init process <7>[ 2.215908] [ T1] with arguments: <7>[ 2.215919] [ T1] /init <7>[ 2.215928] [ T1] splash <7>[ 2.215937] [ T1] with environment: <7>[ 2.215946] [ T1] HOME=/ <7>[ 2.215954] [ T1] TERM=linux <7>[ 2.215961] [ T1] BOOT_IMAGE=/Image-6.9.3-7.g97b471a- vanilla <7>[ 2.215969] [ T1] cgroup_enable=memory <7>[ 2.215977] [ T1] ip=192.168.250.20::192.168.250.200:255.255.255.0::eth0:off <30>[ 2.253126] [ T1] systemd[1]: System time before build time, advancing clock. <5>[ 2.281872] [ T151] efivarfs: module verification failed: signature and/or required key missing - tainting kernel <30>[ 2.305348] [ T1] systemd[1]: systemd 255.7+suse.33.g603cd1d4d8 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA -SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -XKBCOMMON -UTMP +SYSVINIT default-hierarchy=unified) <30>[ 2.305415] [ T1] systemd[1]: Detected architecture arm64. <30>[ 2.305448] [ T1] systemd[1]: Running in initrd. <30>[ 2.306785] [ T1] systemd[1]: Hostname set to <edge.vendanor.com>. <30>[ 3.171494] [ T1] systemd[1]: bpf-lsm: LSM BPF program attached <28>[ 3.511526] [ T1] systemd[1]: /usr/lib/systemd/system/plymouth-start.service:15: Unit uses KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update the service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. <30>[ 3.607987] [ T1] systemd[1]: Queued start job for default target Initrd Default Target. <30>[ 3.668149] [ T1] systemd[1]: Created slice Slice /system/systemd-cryptsetup. <30>[ 3.669051] [ T1] systemd[1]: Started Forward Password Requests to Clevis Directory Watch. <30>[ 3.669176] [ T1] systemd[1]: Expecting device /dev/disk/by- uuid/0024-3B73... <30>[ 3.669291] [ T1] systemd[1]: Expecting device /dev/disk/by- uuid/4fb99d03-eec8-4a6c-8d46-e14a6afd975a... <30>[ 3.669357] [ T1] systemd[1]: Expecting device /dev/disk/by- uuid/6d048af7-a4ba-4e50-8808-d686e13c286e... <30>[ 3.669415] [ T1] systemd[1]: Expecting device /dev/disk/by- uuid/d72be4f2-ee91-456d-901f-541085d3bab5... <30>[ 3.669525] [ T1] systemd[1]: Reached target Local Encrypted Volumes (Pre). <30>[ 3.669698] [ T1] systemd[1]: Reached target Initrd /usr File System. <30>[ 3.669886] [ T1] systemd[1]: Reached target Slice Units. <30>[ 3.670017] [ T1] systemd[1]: Reached target Swaps. <30>[ 3.670147] [ T1] systemd[1]: Reached target Timer Units. <30>[ 3.671004] [ T1] systemd[1]: Listening on D-Bus System Message Bus Socket. <30>[ 3.672037] [ T1] systemd[1]: Listening on Journal Socket (/dev/log). <30>[ 3.673001] [ T1] systemd[1]: Listening on Journal Socket. <30>[ 3.673982] [ T1] systemd[1]: Listening on udev Control Socket. <30>[ 3.674769] [ T1] systemd[1]: Listening on udev Kernel Socket. <30>[ 3.674920] [ T1] systemd[1]: Reached target Socket Units. <30>[ 3.681511] [ T1] systemd[1]: Starting Create List of Static Device Nodes... <30>[ 3.688347] [ T1] systemd[1]: Starting OpenSSH server daemon... <30>[ 3.701281] [ T1] systemd[1]: Starting Journal Service... <30>[ 3.702926] [ T1] systemd[1]: Load Kernel Modules was skipped because no trigger condition checks were met. <30>[ 3.712656] [ T1] systemd[1]: Starting Apply Kernel Variables... <28>[ 3.727266] [ T192] (sshd)[192]: sshd.service: Referenced but unset environment variable evaluates to an empty string: CRYPTO_POLICY, OPTIONS <30>[ 3.730682] [ T1] systemd[1]: Starting Virtual Console Setup... <30>[ 3.748356] [ T1] systemd[1]: Finished Create List of Static Device Nodes. <30>[ 3.765890] [ T1] systemd[1]: Starting Create Static Device Nodes in /dev gracefully... <30>[ 3.815443] [ T1] systemd[1]: Started OpenSSH server daemon. <30>[ 3.854949] [ T1] systemd[1]: Finished Apply Kernel Variables. <46>[ 3.854956] [ T193] systemd-journald[193]: Collecting audit messages is disabled. <30>[ 3.885141] [ T1] systemd[1]: Finished Create Static Device Nodes in /dev gracefully. <30>[ 3.919285] [ T1] systemd[1]: Starting Create Static Device Nodes in /dev... <30>[ 3.920143] [ T1] systemd[1]: Started Journal Service. <6>[ 5.335317] [ T359] device-mapper: uevent: version 1.0.3 <6>[ 5.335795] [ T359] device-mapper: ioctl: 4.48.0-ioctl (2023-03- 01) initialised: dm-devel(a)lists.linux.dev <6>[ 7.392918] [ T402] brcm-pcie fd500000.pcie: host bridge /scb/pcie@7d500000 ranges: <6>[ 7.392969] [ T402] brcm-pcie fd500000.pcie: No bus range found for /scb/pcie@7d500000, using [bus 00-ff] <6>[ 7.393016] [ T402] brcm-pcie fd500000.pcie: MEM 0x0600000000..0x063fffffff -> 0x00c0000000 <6>[ 7.393060] [ T402] brcm-pcie fd500000.pcie: IB MEM 0x0000000000..0x00ffffffff -> 0x0400000000 <4>[ 7.394148] [ T404] usb_phy_generic phy: dummy supplies not allowed for exclusive requests <6>[ 7.395629] [ T402] brcm-pcie fd500000.pcie: PCI host bridge to bus 0000:00 <6>[ 7.395677] [ T402] pci_bus 0000:00: root bus resource [bus 00- ff] <6>[ 7.395696] [ T402] pci_bus 0000:00: root bus resource [mem 0x600000000-0x63fffffff] (bus address [0xc0000000-0xffffffff]) <6>[ 7.395774] [ T402] pci 0000:00:00.0: [14e4:2711] type 01 class 0x060400 PCIe Root Port <6>[ 7.395814] [ T402] pci 0000:00:00.0: PCI bridge to [bus 00] <6>[ 7.395834] [ T402] pci 0000:00:00.0: bridge window [mem 0x00000000-0x000fffff] <6>[ 7.395856] [ T402] pci 0000:00:00.0: bridge window [mem 0x00000000-0x000fffff 64bit pref] <6>[ 7.395964] [ T402] pci 0000:00:00.0: PME# supported from D0 D3hot <6>[ 7.406098] [ T391] sdhci: Secure Digital Host Controller Interface driver <6>[ 7.406125] [ T391] sdhci: Copyright(c) Pierre Ossman <6>[ 7.408558] [ T391] sdhci-pltfm: SDHCI platform and OF driver helper <6>[ 7.426114] [ T380] bcmgenet fd580000.ethernet: GENET 5.0 EPHY: 0x0000 <6>[ 7.430848] [ T402] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring <4>[ 7.441980] [ T402] pci_bus 0000:01: supply vpcie3v3 not found, using dummy regulator <4>[ 7.466937] [ T402] pci_bus 0000:01: supply vpcie3v3aux not found, using dummy regulator <4>[ 7.467156] [ T402] pci_bus 0000:01: supply vpcie12v not found, using dummy regulator <6>[ 7.479045] [ T390] usbcore: registered new interface driver usbfs <6>[ 7.479187] [ T390] usbcore: registered new interface driver hub <6>[ 7.479300] [ T390] usbcore: registered new device driver usb <6>[ 7.509038] [ T399] brcmstb-i2c fef04500.i2c: @97500hz registered in polling mode <6>[ 7.517689] [ T399] brcmstb-i2c fef09500.i2c: @97500hz registered in polling mode <4>[ 7.525260] [ T390] dwc2 fe980000.usb: supply vusb_d not found, using dummy regulator <4>[ 7.525684] [ T390] dwc2 fe980000.usb: supply vusb_a not found, using dummy regulator <3>[ 7.535829] [ T392] spi_gpio fe204000.spi: cs1 >= max 1 <3>[ 7.541308] [ T392] spi_master spi0: spi_device register error /soc/spi@7e204000/slb9670@1 <4>[ 7.549875] [ T392] spi_master spi0: Failed to create SPI device for /soc/spi@7e204000/slb9670@1 <6>[ 7.579851] [ T390] dwc2 fe980000.usb: DWC OTG Controller <6>[ 7.579921] [ T390] dwc2 fe980000.usb: new USB bus registered, assigned bus number 1 <6>[ 7.579994] [ T390] dwc2 fe980000.usb: irq 33, io mem 0xfe980000 <6>[ 7.580337] [ T390] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.09 <6>[ 7.580361] [ T390] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 <6>[ 7.580374] [ T390] usb usb1: Product: DWC OTG Controller <6>[ 7.580385] [ T390] usb usb1: Manufacturer: Linux 6.9.3- 7.g97b471a-vanilla dwc2_hsotg <6>[ 7.580396] [ T390] usb usb1: SerialNumber: fe980000.usb <6>[ 7.581857] [ T390] hub 1-0:1.0: USB hub found <6>[ 7.581980] [ T390] hub 1-0:1.0: 1 port detected <6>[ 7.597667] [ T387] bcm2835-wdt bcm2835-wdt: Broadcom BCM2835 watchdog timer <6>[ 7.705269] [ T380] unimac-mdio unimac-mdio.-19: Broadcom UniMAC MDIO bus <6>[ 7.816306] [ T52] [drm] Initialized v3d 1.0.0 20180419 for fec00000.v3d on minor 1 <4>[ 7.825784] [ T403] SPI driver tpm_tis_spi has no spi_device_id for atmel,attpm20p <6>[ 7.845559] [ T10] tpm_tis_spi spi0.0: 2.0 TPM (device-id 0x1B, rev-id 22) <3>[ 7.848212] [ T402] brcm-pcie fd500000.pcie: link down <6>[ 7.858150] [ T402] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01 <6>[ 7.858222] [ T402] pci 0000:00:00.0: PCI bridge to [bus 01] <6>[ 7.859355] [ T402] pcieport 0000:00:00.0: PME: Signaling with IRQ 36 <6>[ 7.861571] [ T402] pcieport 0000:00:00.0: AER: enabled with IRQ 36 <6>[ 7.864052] [ T402] pci_bus 0000:01: busn_res: [bus 01] is released <6>[ 7.878838] [ T402] pci_bus 0000:00: busn_res: [bus 00-ff] is released <6>[ 7.914801] [ T39] mmc0: SDHCI controller on fe340000.mmc [fe340000.mmc] using ADMA <6>[ 7.928182] [ T200] usb 1-1: new high-speed USB device number 2 using dwc2 <6>[ 8.016123] [ T67] mmc0: new DDR MMC card at address 0001 <6>[ 8.055816] [ T402] mmcblk0: mmc0:0001 BJTD4R 29.1 GiB <6>[ 8.084872] [ T402] mmcblk0: p1 p2 p3 <6>[ 8.125251] [ T200] usb 1-1: New USB device found, idVendor=1a40, idProduct=0101, bcdDevice= 1.00 <6>[ 8.125294] [ T200] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 <6>[ 8.125310] [ T200] usb 1-1: Product: USB2.0 HUB <6>[ 8.129607] [ T384] Console: switching to colour dummy device 80x25 <6>[ 8.131854] [ T402] mmcblk0boot0: mmc0:0001 BJTD4R 4.00 MiB <6>[ 8.135059] [ T200] hub 1-1:1.0: USB hub found <6>[ 8.135236] [ T200] hub 1-1:1.0: 4 ports detected <6>[ 8.140226] [ T402] mmcblk0boot1: mmc0:0001 BJTD4R 4.00 MiB <6>[ 8.143873] [ T402] mmcblk0rpmb: mmc0:0001 BJTD4R 4.00 MiB, chardev (511:0) <6>[ 8.206770] [ T409] bcmgenet fd580000.ethernet: configuring instance for external RGMII (RX delay) <6>[ 8.212070] [ T384] vc4-drm gpu: bound fe400000.hvs (ops vc4_hvs_ops [vc4]) <6>[ 8.219857] [ T384] Registered IR keymap rc-cec <6>[ 8.220247] [ T384] rc rc0: vc4-hdmi-0 as /devices/platform/soc/fef00700.hdmi/rc/rc0 <6>[ 8.221469] [ T384] input: vc4-hdmi-0 as /devices/platform/soc/fef00700.hdmi/rc/rc0/input0 <6>[ 8.236751] [ T384] vc4-drm gpu: bound fef00700.hdmi (ops vc4_hdmi_ops [vc4]) <6>[ 8.245330] [ T384] Registered IR keymap rc-cec <6>[ 8.245582] [ T384] rc rc1: vc4-hdmi-1 as /devices/platform/soc/fef05700.hdmi/rc/rc1 <6>[ 8.245828] [ T384] input: vc4-hdmi-1 as /devices/platform/soc/fef05700.hdmi/rc/rc1/input1 <6>[ 8.261604] [ T384] vc4-drm gpu: bound fef05700.hdmi (ops vc4_hdmi_ops [vc4]) <6>[ 8.262160] [ T384] vc4-drm gpu: bound fe004000.txp (ops vc4_txp_ops [vc4]) <6>[ 8.271495] [ T384] vc4-drm gpu: bound fe206000.pixelvalve (ops vc4_crtc_ops [vc4]) <6>[ 8.272063] [ T384] vc4-drm gpu: bound fe207000.pixelvalve (ops vc4_crtc_ops [vc4]) <6>[ 8.272469] [ T384] vc4-drm gpu: bound fe20a000.pixelvalve (ops vc4_crtc_ops [vc4]) <6>[ 8.272738] [ T384] vc4-drm gpu: bound fe216000.pixelvalve (ops vc4_crtc_ops [vc4]) <6>[ 8.273109] [ T384] vc4-drm gpu: bound fec12000.pixelvalve (ops vc4_crtc_ops [vc4]) <6>[ 8.274095] [ T354] bcmgenet fd580000.ethernet eth0: Link is Down <6>[ 8.285705] [ T384] [drm] Initialized vc4 0.0.0 20140616 for gpu on minor 2 <6>[ 8.343940] [ T384] Console: switching to colour frame buffer device 135x120 <6>[ 8.343999] [ T384] vc4-drm gpu: [drm] fb0: vc4drmfb frame buffer device <6>[ 8.748102] [ T200] usb 1-1.1: new full-speed USB device number 3 using dwc2 <6>[ 8.940552] [ T200] usb 1-1.1: New USB device found, idVendor=0eef, idProduct=c002, bcdDevice=46.0c <6>[ 8.940592] [ T200] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 <6>[ 8.940608] [ T200] usb 1-1.1: Product: eGalaxTouch P80H46 8046 vCM-156G012 k4.02.146 <6>[ 8.940620] [ T200] usb 1-1.1: Manufacturer: eGalax Inc. <6>[ 8.977940] [ T398] usbcore: registered new interface driver usbhid <6>[ 8.977975] [ T398] usbhid: USB HID core driver <6>[ 8.996268] [ T398] input: eGalax Inc. eGalaxTouch P80H46 8046 vCM-156G012 k4.02.146 Touchscreen as /devices/platform/soc/fe980000.usb/usb1/1-1/1-1.1/1- 1.1:1.0/0003:0EEF:C002.0001/input/input2 <6>[ 8.996952] [ T398] input: eGalax Inc. eGalaxTouch P80H46 8046 vCM-156G012 k4.02.146 Mouse as /devices/platform/soc/fe980000.usb/usb1/1-1/1-1.1/1- 1.1:1.0/0003:0EEF:C002.0001/input/input4 <6>[ 8.997776] [ T398] hid-generic 0003:0EEF:C002.0001: input,hiddev96,hidraw0: USB HID v1.11 Mouse [eGalax Inc. eGalaxTouch P80H46 8046 vCM-156G012 k4.02.146] on usb-fe980000.usb-1.1/input0 <6>[ 9.113181] [ T398] input: eGalax Inc. eGalaxTouch P80H46 8046 vCM-156G012 k4.02.146 as /devices/platform/soc/fe980000.usb/usb1/1-1/1- 1.1/1-1.1:1.0/0003:0EEF:C002.0001/input/input5 <6>[ 9.113802] [ T398] input: eGalax Inc. eGalaxTouch P80H46 8046 vCM-156G012 k4.02.146 Mouse as /devices/platform/soc/fe980000.usb/usb1/1-1/1-1.1/1- 1.1:1.0/0003:0EEF:C002.0001/input/input7 <6>[ 9.114547] [ T398] hid-multitouch 0003:0EEF:C002.0001: input,hiddev96,hidraw0: USB HID v1.11 Mouse [eGalax Inc. eGalaxTouch P80H46 8046 vCM-156G012 k4.02.146] on usb-fe980000.usb-1.1/input0 <6>[ 9.118105] [ T200] usb 1-1.3: new low-speed USB device number 4 using dwc2 <6>[ 9.327403] [ T200] usb 1-1.3: New USB device found, idVendor=413c, idProduct=2106, bcdDevice= 1.50 <6>[ 9.327443] [ T200] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 <6>[ 9.327459] [ T200] usb 1-1.3: Product: Dell QuietKey Keyboard <6>[ 9.327471] [ T200] usb 1-1.3: Manufacturer: Dell <6>[ 9.342011] [ T200] input: Dell Dell QuietKey Keyboard as /devices/platform/soc/fe980000.usb/usb1/1-1/1-1.3/1- 1.3:1.0/0003:413C:2106.0002/input/input8 <6>[ 9.398881] [ T200] hid-generic 0003:413C:2106.0002: input,hidraw1: USB HID v1.10 Keyboard [Dell Dell QuietKey Keyboard] on usb-fe980000.usb-1.3/input0 <6>[ 12.322278] [ T200] bcmgenet fd580000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx <6>[ 12.368848] [ T638] NET: Registered PF_PACKET protocol family <5>[ 138.103537] [T11913] Key type trusted registered <6>[ 150.196724] [T11996] EXT4-fs (dm-0): orphan cleanup on readonly fs <6>[ 150.197829] [T11996] EXT4-fs (dm-0): mounted filesystem 6d048af7- a4ba-4e50-8808-d686e13c286e ro with ordered data mode. Quota mode: none. <46>[ 151.091791] [ T193] systemd-journald[193]: Received SIGTERM from PID 1 (systemd). <30>[ 152.162765] [ T1] systemd[1]: systemd 255.7+suse.33.g603cd1d4d8 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA -SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -XKBCOMMON -UTMP +SYSVINIT default-hierarchy=unified) <30>[ 152.162840] [ T1] systemd[1]: Detected architecture arm64. <30>[ 152.171999] [ T1] systemd[1]: Hostname set to <edge.in.jkvinge.net>. <30>[ 153.231448] [ T1] systemd[1]: bpf-lsm: LSM BPF program attached <28>[ 153.677707] [ T1] systemd[1]: /usr/lib/systemd/system/plymouth-start.service:15: Unit uses KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update the service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. <30>[ 154.796586] [ T1] systemd[1]: systemd-ask-password- plymouth.service: Deactivated successfully. <30>[ 154.802434] [ T1] systemd[1]: initrd-switch-root.service: Deactivated successfully. <30>[ 154.804241] [ T1] systemd[1]: Stopped Switch Root. <30>[ 154.817018] [ T1] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 1. <30>[ 154.824516] [ T1] systemd[1]: Created slice Slice /system/getty. <30>[ 154.830142] [ T1] systemd[1]: Created slice Slice /system/serial-getty. <30>[ 154.835786] [ T1] systemd[1]: Created slice Slice /system/systemd-fsck. <30>[ 154.839473] [ T1] systemd[1]: Created slice User and Session Slice. <30>[ 154.840537] [ T1] systemd[1]: Started Forward Password Requests to Clevis Directory Watch. <30>[ 154.841002] [ T1] systemd[1]: Dispatch Password Requests to Console Directory Watch was skipped because of an unmet condition check (ConditionPathExists=!/run/plymouth/pid). <30>[ 154.842485] [ T1] systemd[1]: Set up automount Arbitrary Executable File Formats File System Automount Point. <30>[ 154.843063] [ T1] systemd[1]: Expecting device /dev/mmcblk0p1... <30>[ 154.843413] [ T1] systemd[1]: Expecting device /dev/mmcblk0p2... <30>[ 154.843741] [ T1] systemd[1]: Expecting device /dev/ttyAMA0... <30>[ 154.844151] [ T1] systemd[1]: Reached target Block Device Preparation for /dev/mapper/rpi_rootfs. <30>[ 154.844545] [ T1] systemd[1]: Reached target Local Encrypted Volumes (Pre). <30>[ 154.844986] [ T1] systemd[1]: Reached target Local Encrypted Volumes. <30>[ 154.845456] [ T1] systemd[1]: Stopped target Switch Root. <30>[ 154.845829] [ T1] systemd[1]: Stopped target Initrd File Systems. <30>[ 154.846155] [ T1] systemd[1]: Stopped target Initrd Root File System. <30>[ 154.846526] [ T1] systemd[1]: Reached target Local Integrity Protected Volumes. <30>[ 154.846997] [ T1] systemd[1]: Reached target Remote File Systems. <30>[ 154.847370] [ T1] systemd[1]: Reached target Slice Units. <30>[ 154.847782] [ T1] systemd[1]: Reached target Swaps. <30>[ 154.848180] [ T1] systemd[1]: Reached target System Time Set. <30>[ 154.848678] [ T1] systemd[1]: Reached target Local Verity Protected Volumes. <30>[ 154.849773] [ T1] systemd[1]: Listening on Device-mapper event daemon FIFOs. <30>[ 154.851164] [ T1] systemd[1]: Listening on LVM2 poll daemon socket. <30>[ 154.852431] [ T1] systemd[1]: Listening on Syslog Socket. <30>[ 154.862042] [ T1] systemd[1]: Listening on Process Core Dump Socket. <30>[ 154.864745] [ T1] systemd[1]: Listening on udev Control Socket. <30>[ 154.866181] [ T1] systemd[1]: Listening on udev Kernel Socket. <30>[ 154.891895] [ T1] systemd[1]: Mounting Huge Pages File System... <30>[ 154.900590] [ T1] systemd[1]: Mounting POSIX Message Queue File System... <30>[ 154.909511] [ T1] systemd[1]: Mounting Kernel Debug File System... <30>[ 154.922318] [ T1] systemd[1]: Mounting Kernel Trace File System... <30>[ 154.942203] [ T1] systemd[1]: Mounting Temporary Directory /tmp... <30>[ 154.964271] [ T1] systemd[1]: Starting Load AppArmor profiles... <30>[ 154.983420] [ T1] systemd[1]: Starting Restore the current clock... <30>[ 155.006356] [ T1] systemd[1]: Starting Create List of Static Device Nodes... <30>[ 155.023319] [ T1] systemd[1]: Starting Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling... <28>[ 155.031630] [T12045] (-hwclock)[12045]: fake-hwclock- load.service: Referenced but unset environment variable evaluates to an empty string: FORCE <30>[ 155.038405] [ T1] systemd[1]: Starting Load Kernel Module configfs... <30>[ 155.053587] [ T1] systemd[1]: Starting Load Kernel Module dm_mod... <30>[ 155.070949] [ T1] systemd[1]: Starting Load Kernel Module drm... <30>[ 155.083645] [ T1] systemd[1]: Starting Load Kernel Module efi_pstore... <30>[ 155.100025] [ T1] systemd[1]: Starting Load Kernel Module fuse... <30>[ 155.109422] [ T1] systemd[1]: Starting Load Kernel Module loop... <30>[ 155.125746] [ T1] systemd[1]: Starting Load Kernel Module nvme_fabrics... <30>[ 155.126678] [ T1] systemd[1]: plymouth-switch-root.service: Deactivated successfully. <30>[ 155.127420] [ T1] systemd[1]: Stopped Plymouth switch root service. <30>[ 155.195776] [ T1] systemd[1]: Starting Journal Service... <30>[ 155.202726] [ T1] systemd[1]: Load Kernel Modules was skipped because no trigger condition checks were met. <30>[ 155.219798] [ T1] systemd[1]: Starting Remount Root and Kernel File Systems... <30>[ 155.239486] [ T1] systemd[1]: Starting Coldplug All udev Devices... <30>[ 155.255716] [ T1] systemd[1]: Starting Uncomplicated firewall... <30>[ 155.277282] [ T1] systemd[1]: Mounted Huge Pages File System. <30>[ 155.279894] [ T1] systemd[1]: Mounted POSIX Message Queue File System. <30>[ 155.283026] [ T1] systemd[1]: Mounted Kernel Debug File System. <30>[ 155.287035] [ T1] systemd[1]: Mounted Kernel Trace File System. <30>[ 155.289334] [ T1] systemd[1]: Mounted Temporary Directory /tmp. <30>[ 155.293127] [ T1] systemd[1]: Finished Create List of Static Device Nodes. <30>[ 155.297911] [ T1] systemd[1]: modprobe(a)configfs.service: Deactivated successfully. <30>[ 155.305037] [ T1] systemd[1]: Finished Load Kernel Module configfs. <30>[ 155.376238] [ T1] systemd[1]: Starting Create Static Device Nodes in /dev gracefully... <30>[ 155.401293] [ T1] systemd[1]: modprobe(a)efi_pstore.service: Deactivated successfully. <30>[ 155.408599] [ T1] systemd[1]: Finished Load Kernel Module efi_pstore. <30>[ 155.413813] [ T1] systemd[1]: modprobe(a)drm.service: Deactivated successfully. <30>[ 155.415613] [ T1] systemd[1]: Finished Load Kernel Module drm. <6>[ 155.426796] [T12063] EXT4-fs (dm-0): re-mounted 6d048af7-a4ba- 4e50-8808-d686e13c286e r/w. Quota mode: none. <30>[ 155.442647] [ T1] systemd[1]: modprobe(a)dm_mod.service: Deactivated successfully. <30>[ 155.444180] [ T1] systemd[1]: Finished Load Kernel Module dm_mod. <30>[ 155.449343] [ T1] systemd[1]: Finished Remount Root and Kernel File Systems. <30>[ 155.458998] [ T1] systemd[1]: Rebuild Hardware Database was skipped because of an unmet condition check (ConditionNeedsUpdate=/etc). <30>[ 155.459507] [ T1] systemd[1]: Platform Persistent Storage Archival was skipped because of an unmet condition check (ConditionDirectoryNotEmpty=/sys/fs/pstore). <6>[ 155.483100] [T12052] fuse: init (API version 7.40) <46>[ 155.500993] [T12055] systemd-journald[12055]: Collecting audit messages is disabled. <30>[ 155.502978] [ T1] systemd[1]: Starting Load/Save OS Random Seed... <30>[ 155.513806] [ T1] systemd[1]: modprobe(a)fuse.service: Deactivated successfully. <30>[ 155.525265] [ T1] systemd[1]: Finished Load Kernel Module fuse. <30>[ 155.558487] [ T1] systemd[1]: Mounting FUSE Control File System... <30>[ 155.560064] [ T1] systemd[1]: Started Journal Service. <6>[ 155.577583] [T12053] loop: module loaded <46>[ 155.834000] [T12055] systemd-journald[12055]: Received client request to flush runtime journal. <5>[ 155.933343] [ T40] audit: type=1400 audit(1718104978.413:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="1password" pid=12103 comm="apparmor_parser" <5>[ 155.934102] [ T40] audit: type=1400 audit(1718104978.413:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="QtWebEngineProcess" pid=12108 comm="apparmor_parser" <5>[ 155.935906] [ T40] audit: type=1400 audit(1718104978.416:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="Discord" pid=12105 comm="apparmor_parser" <5>[ 155.938548] [ T40] audit: type=1400 audit(1718104978.420:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name=4D6F6E676F444220436F6D70617373 pid=12107 comm="apparmor_parser" <5>[ 155.968297] [ T40] audit: type=1400 audit(1718104978.446:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="buildah" pid=12114 comm="apparmor_parser" <5>[ 155.969673] [ T40] audit: type=1400 audit(1718104978.450:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="brave" pid=12113 comm="apparmor_parser" <5>[ 155.970620] [ T40] audit: type=1400 audit(1718104978.450:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="busybox" pid=12115 comm="apparmor_parser" <5>[ 155.994709] [ T40] audit: type=1400 audit(1718104978.473:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ch-run" pid=12120 comm="apparmor_parser" <5>[ 156.000298] [ T40] audit: type=1400 audit(1718104978.480:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="cam" pid=12118 comm="apparmor_parser" <5>[ 156.005328] [ T40] audit: type=1400 audit(1718104978.483:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ch-checkns" pid=12119 comm="apparmor_parser" <46>[ 156.018365] [T12055] systemd-journald[12055]: /var/log/journal/e9a50eb23c21432da70186dbf116ace5/system.journal: Realtime clock jumped backwards relative to last journal entry, rotating. <46>[ 156.018446] [T12055] systemd-journald[12055]: Rotating system journal. <6>[ 159.080252] [T12364] EXT4-fs (mmcblk0p2): mounted filesystem d72be4f2-ee91-456d-901f-541085d3bab5 r/w with ordered data mode. Quota mode: none. <6>[ 159.965411] [T12294] iproc-rng200 fe104000.rng: hwrng registered <4>[ 159.983633] [T12291] vchiq: module is from the staging directory, the quality is unknown, you have been warned. <6>[ 160.048385] [T12291] bcm2835_vchiq fe00b840.mailbox: there is not valid maps for state default <4>[ 161.016879] [T12330] snd_bcm2835: module is from the staging directory, the quality is unknown, you have been warned. <6>[ 161.036589] [T12330] bcm2835-audio bcm2835-audio: card created with 8 channels <6>[ 161.043201] [T12329] mc: Linux media interface: v0.10 <6>[ 161.092787] [T12329] videodev: Linux video capture interface: v2.00 <4>[ 161.141923] [T12329] bcm2835_mmal_vchiq: module is from the staging directory, the quality is unknown, you have been warned. <4>[ 161.157121] [T12329] bcm2835_v4l2: module is from the staging directory, the quality is unknown, you have been warned. Jonas

1 year, 2 months

2
2
0 0

[PATCH] drm/i915/gt/uc: Evaluate GuC priority within locks

by Andi Shyti

The ce->guc_state.lock was made to protect guc_prio, which indicates the GuC priority level. But at the begnning of the function we perform some sanity check of guc_prio outside its protected section. Move them within the locked region. Use this occasion to expand the if statement to make it clearer. Fixes: ee242ca704d3 ("drm/i915/guc: Implement GuC priority management") Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: <stable(a)vger.kernel.org> # v5.15+ --- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c index 0eaa1064242c..1181043bc5e9 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c @@ -4267,13 +4267,18 @@ static void guc_bump_inflight_request_prio(struct i915_request *rq, u8 new_guc_prio = map_i915_prio_to_guc_prio(prio); /* Short circuit function */ - if (prio < I915_PRIORITY_NORMAL || - rq->guc_prio == GUC_PRIO_FINI || - (rq->guc_prio != GUC_PRIO_INIT && - !new_guc_prio_higher(rq->guc_prio, new_guc_prio))) + if (prio < I915_PRIORITY_NORMAL) return; spin_lock(&ce->guc_state.lock); + + if (rq->guc_prio == GUC_PRIO_FINI) + goto exit; + + if (rq->guc_prio != GUC_PRIO_INIT && + !new_guc_prio_higher(rq->guc_prio, new_guc_prio)) + goto exit; + if (rq->guc_prio != GUC_PRIO_FINI) { if (rq->guc_prio != GUC_PRIO_INIT) sub_context_inflight_prio(ce, rq->guc_prio); @@ -4281,6 +4286,8 @@ static void guc_bump_inflight_request_prio(struct i915_request *rq, add_context_inflight_prio(ce, rq->guc_prio); update_context_prio(ce); } + +exit: spin_unlock(&ce->guc_state.lock); } -- 2.45.1

1 year, 2 months

3
3
0 0

[PATCH] genirq: Keep handle_nested_irq() from touching desc->threads_active

by Peng Liu

handle_nested_irq() is supposed to be running inside the parent thread handler context. It per se has no dedicated kernel thread, thus shouldn't touch desc->threads_active. The parent kernel thread has already taken care of this. Fixes: e2c12739ccf7 ("genirq: Prevent nested thread vs synchronize_hardirq() deadlock") Cc: stable(a)vger.kernel.org Signed-off-by: Peng Liu <iwtbavbm(a)gmail.com> --- Despite of its correctness, I'm afraid the testing on my only PC can't cover the affected code path. So the patch may be totally -UNTESTED-. kernel/irq/chip.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c index dc94e0bf2c94..85d4f29134e9 100644 --- a/kernel/irq/chip.c +++ b/kernel/irq/chip.c @@ -478,7 +478,6 @@ void handle_nested_irq(unsigned int irq) } kstat_incr_irqs_this_cpu(desc); - atomic_inc(&desc->threads_active); raw_spin_unlock_irq(&desc->lock); action_ret = IRQ_NONE; @@ -487,8 +486,6 @@ void handle_nested_irq(unsigned int irq) if (!irq_settings_no_debug(desc)) note_interrupt(desc, action_ret); - - wake_threads_waitq(desc); } EXPORT_SYMBOL_GPL(handle_nested_irq); -- 2.39.2

1 year, 2 months

2
2
0 0

[PATCH 4/4] xhci: Handle TD clearing for multiple streams case

by Mathias Nyman

From: Hector Martin <marcan(a)marcan.st> When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/"should never happen" paths to ensure we at least clear any affected TDs, even if we can't issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens. This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") early on in the XHCI driver's life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted endpoints into two steps"), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious). Then later, in commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs."), it was acknowledged again. [Mathias: commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") was a targeted regression fix to the previously mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the TD clearing of multiple streams to its original state.] Apparently the commit author was aware of the problem (yet still chose to submit it): It was still mentioned as a FIXME, an xhci_dbg() was added to log the problem condition, and the remaining issue was mentioned in the commit description. The choice of making the log type xhci_dbg() for what is, at this point, a completely unhandled and known broken condition is puzzling and unfortunate, as it guarantees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you turn on DEBUG, the message doesn't really hint at there being a problem at all). It took me *months* of random xHC crashes to finally find a reliable repro and be able to do a deep dive debug session, which could all have been avoided had this unhandled, broken condition been actually reported with a warning, as it should have been as a bug intentionally left in unfixed (never mind that it shouldn't have been left in at all). > Another fix to solve clearing the caches of all stream rings with > cancelled TDs is needed, but not as urgent. 3 years after that statement and 14 years after the original bug was introduced, I think it's finally time to fix it. And maybe next time let's not leave bugs unfixed (that are actually worse than the original bug), and let's actually get people to review kernel commits please. Fixes xHC crashes and IOMMU faults with UAS devices when handling errors/faults. Easiest repro is to use `hdparm` to mark an early sector (e.g. 1024) on a disk as bad, then `cat /dev/sdX > /dev/null` in a loop. At least in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to different streams) and the one that didn't get cleared properly ends up faulting the xHC entirely when it tries to access DMA pages that have since been unmapped, referred to by the stale TDs. This normally happens quickly (after two or three loops). After this fix, I left the `cat` in a loop running overnight and experienced no xHC failures, with all read errors recovered properly. Repro'd and tested on an Apple M1 Mac Mini (dwc3 host). On systems without an IOMMU, this bug would instead silently corrupt freed memory, making this a security bug (even on systems with IOMMUs this could silently corrupt memory belonging to other USB devices on the same controller, so it's still a security bug). Given that the kernel autoprobes partition tables, I'm pretty sure a malicious USB device pretending to be a UAS device and reporting an error with the right timing could deliberately trigger a UAF and write to freed memory, with no user action. [Mathias: Commit message and code comment edit, original at:] https://lore.kernel.org/linux-usb/20240524-xhci-streams-v1-1-6b1f13819bea@m… Fixes: e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") Fixes: 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") Fixes: 674f8438c121 ("xhci: split handling halted endpoints into two steps") Cc: stable(a)vger.kernel.org Cc: security(a)kernel.org Reviewed-by: Neal Gompa <neal(a)gompa.dev> Signed-off-by: Hector Martin <marcan(a)marcan.st> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci-ring.c | 54 ++++++++++++++++++++++++++++-------- drivers/usb/host/xhci.h | 1 + 2 files changed, 44 insertions(+), 11 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 1db61bb2b9b5..fd0cde3d1569 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1031,13 +1031,27 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep) break; case TD_DIRTY: /* TD is cached, clear it */ case TD_HALTED: + case TD_CLEARING_CACHE_DEFERRED: + if (cached_td) { + if (cached_td->urb->stream_id != td->urb->stream_id) { + /* Multiple streams case, defer move dq */ + xhci_dbg(xhci, + "Move dq deferred: stream %u URB %p\n", + td->urb->stream_id, td->urb); + td->cancel_status = TD_CLEARING_CACHE_DEFERRED; + break; + } + + /* Should never happen, but clear the TD if it does */ + xhci_warn(xhci, + "Found multiple active URBs %p and %p in stream %u?\n", + td->urb, cached_td->urb, + td->urb->stream_id); + td_to_noop(xhci, ring, cached_td, false); + cached_td->cancel_status = TD_CLEARED; + } + td->cancel_status = TD_CLEARING_CACHE; - if (cached_td) - /* FIXME stream case, several stopped rings */ - xhci_dbg(xhci, - "Move dq past stream %u URB %p instead of stream %u URB %p\n", - td->urb->stream_id, td->urb, - cached_td->urb->stream_id, cached_td->urb); cached_td = td; break; } @@ -1057,10 +1071,16 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep) if (err) { /* Failed to move past cached td, just set cached TDs to no-op */ list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) { - if (td->cancel_status != TD_CLEARING_CACHE) + /* + * Deferred TDs need to have the deq pointer set after the above command + * completes, so if that failed we just give up on all of them (and + * complain loudly since this could cause issues due to caching). + */ + if (td->cancel_status != TD_CLEARING_CACHE && + td->cancel_status != TD_CLEARING_CACHE_DEFERRED) continue; - xhci_dbg(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n", - td->urb); + xhci_warn(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n", + td->urb); td_to_noop(xhci, ring, td, false); td->cancel_status = TD_CLEARED; } @@ -1346,6 +1366,7 @@ static void xhci_handle_cmd_set_deq(struct xhci_hcd *xhci, int slot_id, struct xhci_ep_ctx *ep_ctx; struct xhci_slot_ctx *slot_ctx; struct xhci_td *td, *tmp_td; + bool deferred = false; ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3])); stream_id = TRB_TO_STREAM_ID(le32_to_cpu(trb->generic.field[2])); @@ -1432,6 +1453,8 @@ static void xhci_handle_cmd_set_deq(struct xhci_hcd *xhci, int slot_id, xhci_dbg(ep->xhci, "%s: Giveback cancelled URB %p TD\n", __func__, td->urb); xhci_td_cleanup(ep->xhci, td, ep_ring, td->status); + } else if (td->cancel_status == TD_CLEARING_CACHE_DEFERRED) { + deferred = true; } else { xhci_dbg(ep->xhci, "%s: Keep cancelled URB %p TD as cancel_status is %d\n", __func__, td->urb, td->cancel_status); @@ -1441,8 +1464,17 @@ static void xhci_handle_cmd_set_deq(struct xhci_hcd *xhci, int slot_id, ep->ep_state &= ~SET_DEQ_PENDING; ep->queued_deq_seg = NULL; ep->queued_deq_ptr = NULL; - /* Restart any rings with pending URBs */ - ring_doorbell_for_active_rings(xhci, slot_id, ep_index); + + if (deferred) { + /* We have more streams to clear */ + xhci_dbg(ep->xhci, "%s: Pending TDs to clear, continuing with invalidation\n", + __func__); + xhci_invalidate_cancelled_tds(ep); + } else { + /* Restart any rings with pending URBs */ + xhci_dbg(ep->xhci, "%s: All TDs cleared, ring doorbell\n", __func__); + ring_doorbell_for_active_rings(xhci, slot_id, ep_index); + } } static void xhci_handle_cmd_reset_ep(struct xhci_hcd *xhci, int slot_id, diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index 30415158ed3c..78d014c4d884 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -1276,6 +1276,7 @@ enum xhci_cancelled_td_status { TD_DIRTY = 0, TD_HALTED, TD_CLEARING_CACHE, + TD_CLEARING_CACHE_DEFERRED, TD_CLEARED, }; -- 2.25.1

1 year, 2 months

1
0
0 0

[PATCH 3/4] xhci: Apply broken streams quirk to Etron EJ188 xHCI host

by Mathias Nyman

From: Kuangyi Chiang <ki.chiang65(a)gmail.com> As described in commit 8f873c1ff4ca ("xhci: Blacklist using streams on the Etron EJ168 controller"), EJ188 have the same issue as EJ168, where Streams do not work reliable on EJ188. So apply XHCI_BROKEN_STREAMS quirk to EJ188 as well. Cc: <stable(a)vger.kernel.org> Signed-off-by: Kuangyi Chiang <ki.chiang65(a)gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c index dd8256e4e02a..05881153883e 100644 --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c @@ -397,8 +397,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) xhci->quirks |= XHCI_BROKEN_STREAMS; } if (pdev->vendor == PCI_VENDOR_ID_ETRON && - pdev->device == PCI_DEVICE_ID_EJ188) + pdev->device == PCI_DEVICE_ID_EJ188) { xhci->quirks |= XHCI_RESET_ON_RESUME; + xhci->quirks |= XHCI_BROKEN_STREAMS; + } if (pdev->vendor == PCI_VENDOR_ID_RENESAS && pdev->device == 0x0014) { -- 2.25.1

1 year, 2 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror