- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] s390/qeth: fix deadlock during failing recovery
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Alexandra Winter <wintera(a)linux.ibm.com> mainline inclusion from mainline-v5.15-rc3 commit d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4P3 CVE: CVE-2021-47382 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed taking discipline_mutex inside qeth_do_reset(), fixing potential deadlocks. An error path was missed though, that still takes discipline_mutex and thus has the original deadlock potential. Intermittent deadlocks were seen when a qeth channel path is configured offline, causing a race between qeth_do_reset and ccwgroup_remove. Call qeth_set_offline() directly in the qeth_do_reset() error case and then a new variant of ccwgroup_set_offline(), without taking discipline_mutex. Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal") Signed-off-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Julian Wiedmann <jwi(a)linux.ibm.com> Signed-off-by: Julian Wiedmann <jwi(a)linux.ibm.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: arch/s390/include/asm/ccwgroup.h [Fix context] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/s390/include/asm/ccwgroup.h | 2 +- drivers/s390/cio/ccwgroup.c | 10 ++++++++-- drivers/s390/net/qeth_core_main.c | 3 ++- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/arch/s390/include/asm/ccwgroup.h b/arch/s390/include/asm/ccwgroup.h index ad3acb1e882b..8a22da9a735a 100644 --- a/arch/s390/include/asm/ccwgroup.h +++ b/arch/s390/include/asm/ccwgroup.h @@ -58,7 +58,7 @@ struct ccwgroup_device *get_ccwgroupdev_by_busid(struct ccwgroup_driver *gdrv, char *bus_id); extern int ccwgroup_set_online(struct ccwgroup_device *gdev); -extern int ccwgroup_set_offline(struct ccwgroup_device *gdev); +int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv); extern int ccwgroup_probe_ccwdev(struct ccw_device *cdev); extern void ccwgroup_remove_ccwdev(struct ccw_device *cdev); diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c index 483a9ecfcbb1..cfdc1c7825d0 100644 --- a/drivers/s390/cio/ccwgroup.c +++ b/drivers/s390/cio/ccwgroup.c @@ -98,12 +98,13 @@ EXPORT_SYMBOL(ccwgroup_set_online); /** * ccwgroup_set_offline() - disable a ccwgroup device * @gdev: target ccwgroup device + * @call_gdrv: Call the registered gdrv set_offline function * * This function attempts to put the ccwgroup device into the offline state. * Returns: * %0 on success and a negative error value on failure. */ -int ccwgroup_set_offline(struct ccwgroup_device *gdev) +int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv) { struct ccwgroup_driver *gdrv = to_ccwgroupdrv(gdev->dev.driver); int ret = -EINVAL; @@ -112,11 +113,16 @@ int ccwgroup_set_offline(struct ccwgroup_device *gdev) return -EAGAIN; if (gdev->state == CCWGROUP_OFFLINE) goto out; + if (!call_gdrv) { + ret = 0; + goto offline; + } if (gdrv->set_offline) ret = gdrv->set_offline(gdev); if (ret) goto out; +offline: gdev->state = CCWGROUP_OFFLINE; out: atomic_set(&gdev->onoff, 0); @@ -145,7 +151,7 @@ static ssize_t ccwgroup_online_store(struct device *dev, if (value == 1) ret = ccwgroup_set_online(gdev); else if (value == 0) - ret = ccwgroup_set_offline(gdev); + ret = ccwgroup_set_offline(gdev, true); else ret = -EINVAL; out: diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c index 6f76dee0e601..42acd82902ae 100644 --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -5396,7 +5396,8 @@ static int qeth_do_reset(void *data) dev_info(&card->gdev->dev, "Device successfully recovered!\n"); } else { - ccwgroup_set_offline(card->gdev); + qeth_set_offline(card, disc, true); + ccwgroup_set_offline(card->gdev, false); dev_warn(&card->gdev->dev, "The qeth device driver failed to recover an error on the device\n"); } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] s390/qeth: fix deadlock during failing recovery
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Alexandra Winter <wintera(a)linux.ibm.com> mainline inclusion from mainline-v5.15-rc3 commit d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4P3 CVE: CVE-2021-47382 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed taking discipline_mutex inside qeth_do_reset(), fixing potential deadlocks. An error path was missed though, that still takes discipline_mutex and thus has the original deadlock potential. Intermittent deadlocks were seen when a qeth channel path is configured offline, causing a race between qeth_do_reset and ccwgroup_remove. Call qeth_set_offline() directly in the qeth_do_reset() error case and then a new variant of ccwgroup_set_offline(), without taking discipline_mutex. Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal") Signed-off-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Julian Wiedmann <jwi(a)linux.ibm.com> Signed-off-by: Julian Wiedmann <jwi(a)linux.ibm.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: arch/s390/include/asm/ccwgroup.h [Fix context] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/s390/include/asm/ccwgroup.h | 2 +- drivers/s390/cio/ccwgroup.c | 10 ++++++++-- drivers/s390/net/qeth_core_main.c | 3 ++- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/arch/s390/include/asm/ccwgroup.h b/arch/s390/include/asm/ccwgroup.h index ad3acb1e882b..8a22da9a735a 100644 --- a/arch/s390/include/asm/ccwgroup.h +++ b/arch/s390/include/asm/ccwgroup.h @@ -58,7 +58,7 @@ struct ccwgroup_device *get_ccwgroupdev_by_busid(struct ccwgroup_driver *gdrv, char *bus_id); extern int ccwgroup_set_online(struct ccwgroup_device *gdev); -extern int ccwgroup_set_offline(struct ccwgroup_device *gdev); +int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv); extern int ccwgroup_probe_ccwdev(struct ccw_device *cdev); extern void ccwgroup_remove_ccwdev(struct ccw_device *cdev); diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c index 483a9ecfcbb1..cfdc1c7825d0 100644 --- a/drivers/s390/cio/ccwgroup.c +++ b/drivers/s390/cio/ccwgroup.c @@ -98,12 +98,13 @@ EXPORT_SYMBOL(ccwgroup_set_online); /** * ccwgroup_set_offline() - disable a ccwgroup device * @gdev: target ccwgroup device + * @call_gdrv: Call the registered gdrv set_offline function * * This function attempts to put the ccwgroup device into the offline state. * Returns: * %0 on success and a negative error value on failure. */ -int ccwgroup_set_offline(struct ccwgroup_device *gdev) +int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv) { struct ccwgroup_driver *gdrv = to_ccwgroupdrv(gdev->dev.driver); int ret = -EINVAL; @@ -112,11 +113,16 @@ int ccwgroup_set_offline(struct ccwgroup_device *gdev) return -EAGAIN; if (gdev->state == CCWGROUP_OFFLINE) goto out; + if (!call_gdrv) { + ret = 0; + goto offline; + } if (gdrv->set_offline) ret = gdrv->set_offline(gdev); if (ret) goto out; +offline: gdev->state = CCWGROUP_OFFLINE; out: atomic_set(&gdev->onoff, 0); @@ -145,7 +151,7 @@ static ssize_t ccwgroup_online_store(struct device *dev, if (value == 1) ret = ccwgroup_set_online(gdev); else if (value == 0) - ret = ccwgroup_set_offline(gdev); + ret = ccwgroup_set_offline(gdev, true); else ret = -EINVAL; out: diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c index b164dc574b46..7356fe8b3990 100644 --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -5398,7 +5398,8 @@ static int qeth_do_reset(void *data) dev_info(&card->gdev->dev, "Device successfully recovered!\n"); } else { - ccwgroup_set_offline(card->gdev); + qeth_set_offline(card, disc, true); + ccwgroup_set_offline(card->gdev, false); dev_warn(&card->gdev->dev, "The qeth device driver failed to recover an error on the device\n"); } -- 2.17.1

2 1

[PATCH OLK-5.10] net: stmmac: move the EST lock to struct stmmac_priv
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Xiaolei Wang <xiaolei.wang(a)windriver.com> mainline inclusion from mainline-v6.10-rc1 commit 36ac9e7f2e5786bd37c5cd91132e1f39c29b8197 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S5U CVE: CVE-2024-38594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reinitialize the whole EST structure would also reset the mutex lock which is embedded in the EST structure, and then trigger the following warning. To address this, move the lock to struct stmmac_priv. We also need to reacquire the mutex lock when doing this initialization. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 505 at kernel/locking/mutex.c:587 __mutex_lock+0xd84/0x1068 Modules linked in: CPU: 3 PID: 505 Comm: tc Not tainted 6.9.0-rc6-00053-g0106679839f7-dirty #29 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0xd84/0x1068 lr : __mutex_lock+0xd84/0x1068 sp : ffffffc0864e3570 x29: ffffffc0864e3570 x28: ffffffc0817bdc78 x27: 0000000000000003 x26: ffffff80c54f1808 x25: ffffff80c9164080 x24: ffffffc080d723ac x23: 0000000000000000 x22: 0000000000000002 x21: 0000000000000000 x20: 0000000000000000 x19: ffffffc083bc3000 x18: ffffffffffffffff x17: ffffffc08117b080 x16: 0000000000000002 x15: ffffff80d2d40000 x14: 00000000000002da x13: ffffff80d2d404b8 x12: ffffffc082b5a5c8 x11: ffffffc082bca680 x10: ffffffc082bb2640 x9 : ffffffc082bb2698 x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001 x5 : ffffff8178fe0d48 x4 : 0000000000000000 x3 : 0000000000000027 x2 : ffffff8178fe0d50 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: __mutex_lock+0xd84/0x1068 mutex_lock_nested+0x28/0x34 tc_setup_taprio+0x118/0x68c stmmac_setup_tc+0x50/0xf0 taprio_change+0x868/0xc9c Fixes: b2aae654a479 ("net: stmmac: add mutex lock to protect est parameters") Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Serge Semin <fancer.lancer(a)gmail.com> Reviewed-by: Andrew Halaney <ahalaney(a)redhat.com> Link: https://lore.kernel.org/r/20240513014346.1718740-2-xiaolei.wang@windriver.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c include/linux/stmmac.h [commit e9e3720002f6 wasnt merged, which get mutex add {u32 btr_reserve[2]} to struct stmmac_est for updating tas basetime.commit 2d800bc500fb wasnt merged, which add tc_taprio_qopt_cmd lead to conflicts.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 ++ .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 20 ++++++++++--------- include/linux/stmmac.h | 1 - 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h index 617c960cfb5a..b98e84a0839a 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h @@ -192,6 +192,8 @@ struct stmmac_priv { struct stmmac_extra_stats xstats ____cacheline_aligned_in_smp; struct stmmac_safety_stats sstats; struct plat_stmmacenet_data *plat; + /* Protect est parameters */ + struct mutex est_lock; struct dma_features dma_cap; struct stmmac_counters mmc; int hw_cap_support; diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c index 43165c662740..2429c57fa452 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c @@ -688,17 +688,19 @@ static int tc_setup_taprio(struct stmmac_priv *priv, if (!plat->est) return -ENOMEM; - mutex_init(&priv->plat->est->lock); + mutex_init(&priv->est_lock); } else { + mutex_lock(&priv->est_lock); memset(plat->est, 0, sizeof(*plat->est)); + mutex_unlock(&priv->est_lock); } size = qopt->num_entries; - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->plat->est->gcl_size = size; priv->plat->est->enable = qopt->enable; - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); for (i = 0; i < size; i++) { s64 delta_ns = qopt->entries[i].interval; @@ -729,7 +731,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->est->gcl[i] = delta_ns | (gates << wid); } - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); /* Adjust for real system time */ priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, &current_time); current_time_ns = timespec64_to_ktime(current_time); @@ -755,7 +757,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->est->ctr[1] = (u32)ctr; if (fpe && !priv->dma_cap.fpesel) { - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); return -EOPNOTSUPP; } @@ -763,14 +765,14 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, fpe); if (ret && fpe) { - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); netdev_err(priv->dev, "failed to enable Frame Preemption\n"); return ret; } ret = stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); if (ret) { netdev_err(priv->dev, "failed to configure EST\n"); goto disable; @@ -781,11 +783,11 @@ static int tc_setup_taprio(struct stmmac_priv *priv, disable: if (priv->plat->est) { - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->plat->est->enable = false; stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); } return ret; diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h index abf7b8ec1fb6..184d7a814dc9 100644 --- a/include/linux/stmmac.h +++ b/include/linux/stmmac.h @@ -112,7 +112,6 @@ struct stmmac_axi { #define EST_GCL 1024 struct stmmac_est { - struct mutex lock; int enable; u32 btr_offset[2]; u32 btr[2]; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: stmmac: move the EST lock to struct stmmac_priv
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Xiaolei Wang <xiaolei.wang(a)windriver.com> mainline inclusion from mainline-v6.10-rc1 commit 36ac9e7f2e5786bd37c5cd91132e1f39c29b8197 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S5U CVE: CVE-2024-38594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reinitialize the whole EST structure would also reset the mutex lock which is embedded in the EST structure, and then trigger the following warning. To address this, move the lock to struct stmmac_priv. We also need to reacquire the mutex lock when doing this initialization. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 505 at kernel/locking/mutex.c:587 __mutex_lock+0xd84/0x1068 Modules linked in: CPU: 3 PID: 505 Comm: tc Not tainted 6.9.0-rc6-00053-g0106679839f7-dirty #29 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0xd84/0x1068 lr : __mutex_lock+0xd84/0x1068 sp : ffffffc0864e3570 x29: ffffffc0864e3570 x28: ffffffc0817bdc78 x27: 0000000000000003 x26: ffffff80c54f1808 x25: ffffff80c9164080 x24: ffffffc080d723ac x23: 0000000000000000 x22: 0000000000000002 x21: 0000000000000000 x20: 0000000000000000 x19: ffffffc083bc3000 x18: ffffffffffffffff x17: ffffffc08117b080 x16: 0000000000000002 x15: ffffff80d2d40000 x14: 00000000000002da x13: ffffff80d2d404b8 x12: ffffffc082b5a5c8 x11: ffffffc082bca680 x10: ffffffc082bb2640 x9 : ffffffc082bb2698 x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001 x5 : ffffff8178fe0d48 x4 : 0000000000000000 x3 : 0000000000000027 x2 : ffffff8178fe0d50 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: __mutex_lock+0xd84/0x1068 mutex_lock_nested+0x28/0x34 tc_setup_taprio+0x118/0x68c stmmac_setup_tc+0x50/0xf0 taprio_change+0x868/0xc9c Fixes: b2aae654a479 ("net: stmmac: add mutex lock to protect est parameters") Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Serge Semin <fancer.lancer(a)gmail.com> Reviewed-by: Andrew Halaney <ahalaney(a)redhat.com> Link: https://lore.kernel.org/r/20240513014346.1718740-2-xiaolei.wang@windriver.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c include/linux/stmmac.h [commit e9e3720002f6 wasnt merged, which get mutex add {u32 btr_reserve[2]} to struct stmmac_est for updating tas basetime.commit 2d800bc500fb wasnt merged, which add tc_taprio_qopt_cmd lead to conflicts.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 ++ .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 20 ++++++++++--------- include/linux/stmmac.h | 1 - 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h index 617c960cfb5a..b98e84a0839a 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h @@ -192,6 +192,8 @@ struct stmmac_priv { struct stmmac_extra_stats xstats ____cacheline_aligned_in_smp; struct stmmac_safety_stats sstats; struct plat_stmmacenet_data *plat; + /* Protect est parameters */ + struct mutex est_lock; struct dma_features dma_cap; struct stmmac_counters mmc; int hw_cap_support; diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c index 43165c662740..2429c57fa452 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c @@ -688,17 +688,19 @@ static int tc_setup_taprio(struct stmmac_priv *priv, if (!plat->est) return -ENOMEM; - mutex_init(&priv->plat->est->lock); + mutex_init(&priv->est_lock); } else { + mutex_lock(&priv->est_lock); memset(plat->est, 0, sizeof(*plat->est)); + mutex_unlock(&priv->est_lock); } size = qopt->num_entries; - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->plat->est->gcl_size = size; priv->plat->est->enable = qopt->enable; - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); for (i = 0; i < size; i++) { s64 delta_ns = qopt->entries[i].interval; @@ -729,7 +731,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->est->gcl[i] = delta_ns | (gates << wid); } - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); /* Adjust for real system time */ priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, &current_time); current_time_ns = timespec64_to_ktime(current_time); @@ -755,7 +757,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->est->ctr[1] = (u32)ctr; if (fpe && !priv->dma_cap.fpesel) { - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); return -EOPNOTSUPP; } @@ -763,14 +765,14 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->tx_queues_to_use, priv->plat->rx_queues_to_use, fpe); if (ret && fpe) { - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); netdev_err(priv->dev, "failed to enable Frame Preemption\n"); return ret; } ret = stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); if (ret) { netdev_err(priv->dev, "failed to configure EST\n"); goto disable; @@ -781,11 +783,11 @@ static int tc_setup_taprio(struct stmmac_priv *priv, disable: if (priv->plat->est) { - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->plat->est->enable = false; stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); } return ret; diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h index 40df88728a6f..2b39981e5235 100644 --- a/include/linux/stmmac.h +++ b/include/linux/stmmac.h @@ -112,7 +112,6 @@ struct stmmac_axi { #define EST_GCL 1024 struct stmmac_est { - struct mutex lock; int enable; u32 btr_offset[2]; u32 btr[2]; -- 2.17.1

2 1

[PATCH OLK-5.10] kunit: Fix kthread reference
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Mickaël Salaün <mic(a)digikod.net> mainline inclusion from mainline-v6.10-rc1 commit f8aa1b98ce40184521ed95ec26cc115a255183b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SDW CVE: CVE-2024-38561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. Cc: Brendan Higgins <brendanhiggins(a)google.com> Cc: Shuah Khan <skhan(a)linuxfoundation.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero") Reviewed-by: David Gow <davidgow(a)google.com> Reviewed-by: Rae Moar <rmoar(a)google.com> Signed-off-by: Mickaël Salaün <mic(a)digikod.net> Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Conflicts: lib/kunit/try-catch.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- lib/kunit/try-catch.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c index d7b3fe4d5f24..e82ca9d68ded 100644 --- a/lib/kunit/try-catch.c +++ b/lib/kunit/try-catch.c @@ -11,6 +11,7 @@ #include <linux/completion.h> #include <linux/kernel.h> #include <linux/kthread.h> +#include <linux/sched/task.h> #include "try-catch-impl.h" @@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) try_catch->context = context; try_catch->try_completion = &try_completion; try_catch->try_result = 0; - task_struct = kthread_run(kunit_generic_run_threadfn_adapter, - try_catch, - "kunit_try_catch_thread"); + task_struct = kthread_create(kunit_generic_run_threadfn_adapter, + try_catch, "kunit_try_catch_thread"); if (IS_ERR(task_struct)) { try_catch->catch(try_catch->context); return; } + get_task_struct(task_struct); + wake_up_process(task_struct); time_remaining = wait_for_completion_timeout(&try_completion, kunit_test_timeout()); @@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) kthread_stop(task_struct); } + put_task_struct(task_struct); exit_code = try_catch->try_result; if (!exit_code) -- 2.17.1

2 1

[PATCH OLK-5.10] kunit: Fix kthread reference
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Mickaël Salaün <mic(a)digikod.net> mainline inclusion from mainline-v6.10-rc1 commit f8aa1b98ce40184521ed95ec26cc115a255183b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SDW CVE: CVE-2024-38561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. Cc: Brendan Higgins <brendanhiggins(a)google.com> Cc: Shuah Khan <skhan(a)linuxfoundation.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero") Reviewed-by: David Gow <davidgow(a)google.com> Reviewed-by: Rae Moar <rmoar(a)google.com> Signed-off-by: Mickaël Salaün <mic(a)digikod.net> Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Conflicts: lib/kunit/try-catch.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- lib/kunit/try-catch.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c index d7b3fe4d5f24..e82ca9d68ded 100644 --- a/lib/kunit/try-catch.c +++ b/lib/kunit/try-catch.c @@ -11,6 +11,7 @@ #include <linux/completion.h> #include <linux/kernel.h> #include <linux/kthread.h> +#include <linux/sched/task.h> #include "try-catch-impl.h" @@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) try_catch->context = context; try_catch->try_completion = &try_completion; try_catch->try_result = 0; - task_struct = kthread_run(kunit_generic_run_threadfn_adapter, - try_catch, - "kunit_try_catch_thread"); + task_struct = kthread_create(kunit_generic_run_threadfn_adapter, + try_catch, "kunit_try_catch_thread"); if (IS_ERR(task_struct)) { try_catch->catch(try_catch->context); return; } + get_task_struct(task_struct); + wake_up_process(task_struct); time_remaining = wait_for_completion_timeout(&try_completion, kunit_test_timeout()); @@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) kthread_stop(task_struct); } + put_task_struct(task_struct); exit_code = try_catch->try_result; if (!exit_code) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] kunit: Fix kthread reference
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Mickaël Salaün <mic(a)digikod.net> mainline inclusion from mainline-v6.10-rc1 commit f8aa1b98ce40184521ed95ec26cc115a255183b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SDW CVE: CVE-2024-38561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. Cc: Brendan Higgins <brendanhiggins(a)google.com> Cc: Shuah Khan <skhan(a)linuxfoundation.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero") Reviewed-by: David Gow <davidgow(a)google.com> Reviewed-by: Rae Moar <rmoar(a)google.com> Signed-off-by: Mickaël Salaün <mic(a)digikod.net> Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Conflicts: lib/kunit/try-catch.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- lib/kunit/try-catch.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c index d7b3fe4d5f24..e82ca9d68ded 100644 --- a/lib/kunit/try-catch.c +++ b/lib/kunit/try-catch.c @@ -11,6 +11,7 @@ #include <linux/completion.h> #include <linux/kernel.h> #include <linux/kthread.h> +#include <linux/sched/task.h> #include "try-catch-impl.h" @@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) try_catch->context = context; try_catch->try_completion = &try_completion; try_catch->try_result = 0; - task_struct = kthread_run(kunit_generic_run_threadfn_adapter, - try_catch, - "kunit_try_catch_thread"); + task_struct = kthread_create(kunit_generic_run_threadfn_adapter, + try_catch, "kunit_try_catch_thread"); if (IS_ERR(task_struct)) { try_catch->catch(try_catch->context); return; } + get_task_struct(task_struct); + wake_up_process(task_struct); time_remaining = wait_for_completion_timeout(&try_completion, kunit_test_timeout()); @@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) kthread_stop(task_struct); } + put_task_struct(task_struct); exit_code = try_catch->try_result; if (!exit_code) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] kunit: Fix kthread reference
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Mickaël Salaün <mic(a)digikod.net> mainline inclusion from mainline-v6.10-rc1 commit f8aa1b98ce40184521ed95ec26cc115a255183b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SDW CVE: CVE-2024-38561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. Cc: Brendan Higgins <brendanhiggins(a)google.com> Cc: Shuah Khan <skhan(a)linuxfoundation.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero") Reviewed-by: David Gow <davidgow(a)google.com> Reviewed-by: Rae Moar <rmoar(a)google.com> Signed-off-by: Mickaël Salaün <mic(a)digikod.net> Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Conflicts: lib/kunit/try-catch.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- lib/kunit/try-catch.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c index d7b3fe4d5f24..e82ca9d68ded 100644 --- a/lib/kunit/try-catch.c +++ b/lib/kunit/try-catch.c @@ -11,6 +11,7 @@ #include <linux/completion.h> #include <linux/kernel.h> #include <linux/kthread.h> +#include <linux/sched/task.h> #include "try-catch-impl.h" @@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) try_catch->context = context; try_catch->try_completion = &try_completion; try_catch->try_result = 0; - task_struct = kthread_run(kunit_generic_run_threadfn_adapter, - try_catch, - "kunit_try_catch_thread"); + task_struct = kthread_create(kunit_generic_run_threadfn_adapter, + try_catch, "kunit_try_catch_thread"); if (IS_ERR(task_struct)) { try_catch->catch(try_catch->context); return; } + get_task_struct(task_struct); + wake_up_process(task_struct); time_remaining = wait_for_completion_timeout(&try_completion, kunit_test_timeout()); @@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) kthread_stop(task_struct); } + put_task_struct(task_struct); exit_code = try_catch->try_result; if (!exit_code) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] stm class: Fix a double free in stm_register_device()
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.219 commit 713fc00c571dde4af3db2dbd5d1b0eadc327817b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D3T CVE: CVE-2024-38627 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3df463865ba42b8f88a590326f4c9ea17a1ce459 ] The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free. Fixes: 389b6699a2aa ("stm class: Fix stm device initialization order") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Amelie Delaunay <amelie.delaunay(a)foss.st.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Link: https://lore.kernel.org/r/20240429130119.1518073-2-alexander.shishkin@linux… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/hwtracing/stm/core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c index 2712e699ba08..ae9ea3a1fa2a 100644 --- a/drivers/hwtracing/stm/core.c +++ b/drivers/hwtracing/stm/core.c @@ -868,8 +868,11 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, return -ENOMEM; stm->major = register_chrdev(0, stm_data->name, &stm_fops); - if (stm->major < 0) - goto err_free; + if (stm->major < 0) { + err = stm->major; + vfree(stm); + return err; + } device_initialize(&stm->dev); stm->dev.devt = MKDEV(stm->major, 0); @@ -913,10 +916,8 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, err_device: unregister_chrdev(stm->major, stm_data->name); - /* matches device_initialize() above */ + /* calls stm_device_release() */ put_device(&stm->dev); -err_free: - vfree(stm); return err; } -- 2.17.1

2 1

[PATCH OLK-5.10] stm class: Fix a double free in stm_register_device()
by Guo Mengqi 30 Jul '24

30 Jul '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.219 commit 713fc00c571dde4af3db2dbd5d1b0eadc327817b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D3T CVE: CVE-2024-38627 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3df463865ba42b8f88a590326f4c9ea17a1ce459 ] The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free. Fixes: 389b6699a2aa ("stm class: Fix stm device initialization order") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Amelie Delaunay <amelie.delaunay(a)foss.st.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Link: https://lore.kernel.org/r/20240429130119.1518073-2-alexander.shishkin@linux… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/hwtracing/stm/core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c index 2712e699ba08..ae9ea3a1fa2a 100644 --- a/drivers/hwtracing/stm/core.c +++ b/drivers/hwtracing/stm/core.c @@ -868,8 +868,11 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, return -ENOMEM; stm->major = register_chrdev(0, stm_data->name, &stm_fops); - if (stm->major < 0) - goto err_free; + if (stm->major < 0) { + err = stm->major; + vfree(stm); + return err; + } device_initialize(&stm->dev); stm->dev.devt = MKDEV(stm->major, 0); @@ -913,10 +916,8 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, err_device: unregister_chrdev(stm->major, stm_data->name); - /* matches device_initialize() above */ + /* calls stm_device_release() */ put_device(&stm->dev); -err_free: - vfree(stm); return err; } -- 2.17.1

2 1

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-5.10] net: move to_gnet_bpf_attach_type() to filter.c
by Liu Jian 30 Jul '24

30 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGKEX -------------------------------- When use bcc tools, we met below issue: [root@localhost tools]# ./tcpconnect In file included from /virtual/main.c:15: In file included from include/net/sock.h:59: include/linux/filter.h:1502:7: error: use of undeclared identifier \ 'BPF_GNET_TCP_RECVMSG'; did you mean 'GNET_TCP_RECVMSG'? case BPF_GNET_TCP_RECVMSG: ^~~~~~~~~~~~~~~~~~~~ GNET_TCP_RECVMSG include/linux/filter.h:1491:2: note: 'GNET_TCP_RECVMSG' declared here GNET_TCP_RECVMSG = 0, ^ This is because we used it in the header file by mistake. Move the reference to filter.c. Fixes: 64ba5634c4c6 ("net: add some bpf hooks in tcp stack for network numa relationship") Fixes: e79b3265e23d ("net: add one bpf prog type for network numa relationship") Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/linux/filter.h | 17 ----------------- net/core/filter.c | 17 +++++++++++++++++ 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/include/linux/filter.h b/include/linux/filter.h index 2a0c2dd47599..273f69057384 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1495,23 +1495,6 @@ enum gnet_bpf_attach_type { MAX_GNET_BPF_ATTACH_TYPE }; -static inline enum gnet_bpf_attach_type -to_gnet_bpf_attach_type(enum bpf_attach_type attach_type) -{ - switch (attach_type) { - case BPF_GNET_TCP_RECVMSG: - return GNET_TCP_RECVMSG; - case BPF_GNET_SK_DST_SET: - return GNET_SK_DST_SET; - case BPF_GNET_RCV_NIC_NODE: - return GNET_RCV_NIC_NODE; - case BPF_GNET_SEND_NIC_NODE: - return GNET_SEND_NIC_NODE; - default: - return GNET_BPF_ATTACH_TYPE_INVALID; - } -} - struct gnet_bpf { struct bpf_prog __rcu *progs[MAX_GNET_BPF_ATTACH_TYPE]; u32 flags[MAX_GNET_BPF_ATTACH_TYPE]; diff --git a/net/core/filter.c b/net/core/filter.c index 838813229564..9c94b6a03d20 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -10699,6 +10699,23 @@ EXPORT_SYMBOL(gnet_bpf_progs); struct static_key_false gnet_bpf_enabled_key[MAX_GNET_BPF_ATTACH_TYPE]; EXPORT_SYMBOL(gnet_bpf_enabled_key); +static inline enum gnet_bpf_attach_type +to_gnet_bpf_attach_type(enum bpf_attach_type attach_type) +{ + switch (attach_type) { + case BPF_GNET_TCP_RECVMSG: + return GNET_TCP_RECVMSG; + case BPF_GNET_SK_DST_SET: + return GNET_SK_DST_SET; + case BPF_GNET_RCV_NIC_NODE: + return GNET_RCV_NIC_NODE; + case BPF_GNET_SEND_NIC_NODE: + return GNET_SEND_NIC_NODE; + default: + return GNET_BPF_ATTACH_TYPE_INVALID; + } +} + int gnet_bpf_prog_attach(const union bpf_attr *attr, enum bpf_prog_type ptype, struct bpf_prog *prog) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ipv6: sr: fix missing sk_buff release in seg6_input_core
by Dong Chenchen 30 Jul '24

30 Jul '24

From: Andrea Mayer <andrea.mayer(a)uniroma2.it> mainline inclusion from mainline-v6.10-rc1 commit 271201c09c86cd75e0fd6206bde689176e85aa21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3N2 CVE: CVE-2024-39490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv6/seg6_iptunnel.c [commit 7a3f5b0de364 add seg6_input_core() to seg6_input() for netfilter hooks of SRv6, which lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6_iptunnel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 40ac23242c37..ab2a606fdb65 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -318,10 +318,8 @@ static int seg6_input(struct sk_buff *skb) int err; err = seg6_do_srh(skb); - if (unlikely(err)) { - kfree_skb(skb); - return err; - } + if (unlikely(err)) + goto drop; slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); @@ -346,9 +344,12 @@ static int seg6_input(struct sk_buff *skb) err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); if (unlikely(err)) - return err; + goto drop; return dst_input(skb); +drop: + kfree_skb(skb); + return err; } static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb) -- 2.25.1

2 1

[PATCH OLK-5.10] ipv6: sr: fix missing sk_buff release in seg6_input_core
by Dong Chenchen 30 Jul '24

30 Jul '24

From: Andrea Mayer <andrea.mayer(a)uniroma2.it> mainline inclusion from mainline-v6.10-rc1 commit 271201c09c86cd75e0fd6206bde689176e85aa21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3N2 CVE: CVE-2024-39490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv6/seg6_iptunnel.c [commit 7a3f5b0de364 add seg6_input_core() to seg6_input() for netfilter hooks of SRv6, which lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6_iptunnel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 40ac23242c37..ab2a606fdb65 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -318,10 +318,8 @@ static int seg6_input(struct sk_buff *skb) int err; err = seg6_do_srh(skb); - if (unlikely(err)) { - kfree_skb(skb); - return err; - } + if (unlikely(err)) + goto drop; slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); @@ -346,9 +344,12 @@ static int seg6_input(struct sk_buff *skb) err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); if (unlikely(err)) - return err; + goto drop; return dst_input(skb); +drop: + kfree_skb(skb); + return err; } static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb) -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] ipv6: sr: fix missing sk_buff release in seg6_input_core
by Dong Chenchen 30 Jul '24

30 Jul '24

From: Andrea Mayer <andrea.mayer(a)uniroma2.it> mainline inclusion from mainline-v6.10-rc1 commit 271201c09c86cd75e0fd6206bde689176e85aa21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3N2 CVE: CVE-2024-39490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6_iptunnel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 03b877ff4558..a75df2ec8db0 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -459,10 +459,8 @@ static int seg6_input_core(struct net *net, struct sock *sk, int err; err = seg6_do_srh(skb); - if (unlikely(err)) { - kfree_skb(skb); - return err; - } + if (unlikely(err)) + goto drop; slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); @@ -486,7 +484,7 @@ static int seg6_input_core(struct net *net, struct sock *sk, err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); if (unlikely(err)) - return err; + goto drop; if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, @@ -494,6 +492,9 @@ static int seg6_input_core(struct net *net, struct sock *sk, skb_dst(skb)->dev, seg6_input_finish); return seg6_input_finish(dev_net(skb->dev), NULL, skb); +drop: + kfree_skb(skb); + return err; } static int seg6_input_nf(struct sk_buff *skb) -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] ipv6: sr: fix missing sk_buff release in seg6_input_core
by Dong Chenchen 30 Jul '24

30 Jul '24

From: Andrea Mayer <andrea.mayer(a)uniroma2.it> mainline inclusion from mainline-v6.10-rc1 commit 271201c09c86cd75e0fd6206bde689176e85aa21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3N2 CVE: CVE-2024-39490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6_iptunnel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 03b877ff4558..a75df2ec8db0 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -459,10 +459,8 @@ static int seg6_input_core(struct net *net, struct sock *sk, int err; err = seg6_do_srh(skb); - if (unlikely(err)) { - kfree_skb(skb); - return err; - } + if (unlikely(err)) + goto drop; slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); @@ -486,7 +484,7 @@ static int seg6_input_core(struct net *net, struct sock *sk, err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); if (unlikely(err)) - return err; + goto drop; if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, @@ -494,6 +492,9 @@ static int seg6_input_core(struct net *net, struct sock *sk, skb_dst(skb)->dev, seg6_input_finish); return seg6_input_finish(dev_net(skb->dev), NULL, skb); +drop: + kfree_skb(skb); + return err; } static int seg6_input_nf(struct sk_buff *skb) -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] ipv6: sr: fix missing sk_buff release in seg6_input_core
by Dong Chenchen 30 Jul '24

30 Jul '24

From: Andrea Mayer <andrea.mayer(a)uniroma2.it> mainline inclusion from mainline-v6.10-rc1 commit 271201c09c86cd75e0fd6206bde689176e85aa21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3N2 CVE: CVE-2024-39490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6_iptunnel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 03b877ff4558..a75df2ec8db0 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -459,10 +459,8 @@ static int seg6_input_core(struct net *net, struct sock *sk, int err; err = seg6_do_srh(skb); - if (unlikely(err)) { - kfree_skb(skb); - return err; - } + if (unlikely(err)) + goto drop; slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); @@ -486,7 +484,7 @@ static int seg6_input_core(struct net *net, struct sock *sk, err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); if (unlikely(err)) - return err; + goto drop; if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, @@ -494,6 +492,9 @@ static int seg6_input_core(struct net *net, struct sock *sk, skb_dst(skb)->dev, seg6_input_finish); return seg6_input_finish(dev_net(skb->dev), NULL, skb); +drop: + kfree_skb(skb); + return err; } static int seg6_input_nf(struct sk_buff *skb) -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] ext4: improve buffered write with more than one blocks_per_folio part 2
by Zhang Yi 30 Jul '24

30 Jul '24

Drop unnecessary state_lock in ifs, which could improve some (~10%) buffer write performance. I tested it through UnixBench on my x86 and arm64 virtual machine with 50GB ramdisk & xfs filesystem, the results shows below. 1. UnixBench Test on xfs: ./Run -i 1 -c 1 fstime-w Before: x86 File Write 1024 bufsize 2000 maxblocks 524708.0 KBps arm64 File Write 1024 bufsize 2000 maxblocks 801965.0 KBps After: x86 File Write 1024 bufsize 2000 maxblocks 571315.0 KBps arm64 File Write 1024 bufsize 2000 maxblocks 876077.0 KBps 2. Libmacro test in ext4: Before: Running: pwrite_u1k# bin/pwrite -E -C 200 -L -S -W -N pwrite_u1k -s 1k -I 500 -f /var/tmp/libmicro.1240/data prc thr usecs/call samples errors cnt/samp size pwrite_u1k 1 1 0.86016 167 0 200 1024 After: Running: pwrite_u1k# bin/pwrite -E -C 200 -L -S -W -N pwrite_u1k -s 1k -I 500 -f /var/tmp/libmicro.1957/data prc thr usecs/call samples errors cnt/samp size pwrite_u1k 1 1 0.7699 190 0 200 1024 Thanks, Yi. Matthew Wilcox (Oracle) (2): iomap: hold state_lock over call to ifs_set_range_uptodate() iomap: protect read_bytes_pending with the state_lock Zhang Yi (2): iomap: drop unnecessary state_lock when setting ifs uptodate bits iomap: drop unnecessary state_lock when changing ifs dirty bits fs/iomap/buffered-io.c | 73 +++++++++++++++++++++++++----------------- 1 file changed, 43 insertions(+), 30 deletions(-) -- 2.39.2

2 5

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the compile warning
by Zhang Zekun 30 Jul '24

30 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGJ97 --------------------------------------- Fix the following compile warning: WARNING: modpost: vmlinux.o(.text+0x854620): ... The function arm_smmu_device_probe() references the variable __initdata arm_smmu_v3_plat_info. This is often because arm_smmu_device_probe lacks a __initdata annotation or the annotation of arm_smmu_v3_plat_info is wrong. Fixes: 3bced619d7dc ("iommu/arm-smmu-v3: Change the style to identify the the hisi_platform") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index c5c25be54fd5..cedc1eda7250 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5244,7 +5244,7 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) } #ifdef CONFIG_ACPI -static struct acpi_platform_list arm_smmu_v3_plat_info[] __initdata = { +static struct acpi_platform_list arm_smmu_v3_plat_info[] = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, -- 2.17.1

2 1

[PATCH OLK-5.10] usb: gadget: ncm: Fix handling of zero block length packets
by Wang Hai 30 Jul '24

30 Jul '24

From: Krishna Kurapati <quic_kriskura(a)quicinc.com> stable inclusion from stable-v5.10.215 commit ef846cdbd100f7f9dc045e8bcd7fe4b3a3713c03 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q92E CVE: CVE-2024-35825 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70 upstream. While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometimes and have block length zero but still contain 1-2 valid datagrams present. According to the NCM spec: "If wBlockLength = 0x0000, the block is terminated by a short packet. In this case, the USB transfer must still be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent, and the size is a multiple of wMaxPacketSize for the given pipe, then no ZLP shall be sent. wBlockLength= 0x0000 must be used with extreme care, because of the possibility that the host and device may get out of sync, and because of test issues. wBlockLength = 0x0000 allows the sender to reduce latency by starting to send a very large NTB, and then shortening it when the sender discovers that there’s not sufficient data to justify sending a large NTB" However, there is a potential issue with the current implementation, as it checks for the occurrence of multiple NTBs in a single giveback by verifying if the leftover bytes to be processed is zero or not. If the block length reads zero, we would process the same NTB infintely because the leftover bytes is never zero and it leads to a crash. Fix this by bailing out if block length reads zero. Cc: stable(a)vger.kernel.org Fixes: 427694cfaafa ("usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call") Signed-off-by: Krishna Kurapati <quic_kriskura(a)quicinc.com> Reviewed-by: Maciej Żenczykowski <maze(a)google.com> Link: https://lore.kernel.org/r/20240228115441.2105585-1-quic_kriskura@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index e3b89b7c1d67..f3410dc25d12 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1357,7 +1357,7 @@ static int ncm_unwrap_ntb(struct gether *port, if (to_process == 1 && (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) { to_process--; - } else if (to_process > 0) { + } else if ((to_process > 0) && (block_len != 0)) { ntb_ptr = (unsigned char *)(ntb_ptr + block_len); goto parse_ntb; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (2): ASoC: topology: Fix references to freed memory ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (2): ASoC: topology: Fix references to freed memory ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (3): ASoC: topology: Fix references to freed memory ASoC: topology: Do not assign fields that are already set ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the compile warning
by Zhang Zekun 30 Jul '24

30 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGJ97 --------------------------------------- Fix the following compile warning: WARNING: modpost: vmlinux.o(.text+0x854620): ... The function arm_smmu_device_probe() references the variable __initdata arm_smmu_v3_plat_info. This is often because arm_smmu_device_probe lacks a __initdata annotation or the annotation of arm_smmu_v3_plat_info is wrong. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index c5c25be54fd5..cedc1eda7250 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5244,7 +5244,7 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) } #ifdef CONFIG_ACPI -static struct acpi_platform_list arm_smmu_v3_plat_info[] __initdata = { +static struct acpi_platform_list arm_smmu_v3_plat_info[] = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, -- 2.17.1

2 1

[PATCH OLK-6.6] firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
by Jinjie Ruan 30 Jul '24

30 Jul '24

From: Richard Fitzgerald <rf(a)opensource.cirrus.com> stable inclusion from stable-v6.6.41 commit 16d76857d6b5426f41b587d0bb925de3f25bfb21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMN CVE: CVE-2024-41056 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 680e126ec0400f6daecf0510c5bb97a55779ff03 ] Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size array. cs_dsp should protect against overrunning the array if the NUL terminator is missing. Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com> Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") Link: https://patch.msgid.link/20240708144855.385332-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/firmware/cirrus/cs_dsp.c [Due to not merge commit 76ea8e13aaefd firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/firmware/cirrus/cs_dsp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c index 79d4254d1f9b..fe0fb7d635f0 100644 --- a/drivers/firmware/cirrus/cs_dsp.c +++ b/drivers/firmware/cirrus/cs_dsp.c @@ -1109,7 +1109,7 @@ static inline void cs_dsp_coeff_parse_alg(struct cs_dsp *dsp, const u8 **data, blk->id = le32_to_cpu(raw->id); blk->name = raw->name; - blk->name_len = strlen(raw->name); + blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name)); blk->ncoeff = le32_to_cpu(raw->ncoeff); break; default: @@ -1142,7 +1142,7 @@ static inline void cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, const u8 **data, blk->offset = le16_to_cpu(raw->hdr.offset); blk->mem_type = le16_to_cpu(raw->hdr.type); blk->name = raw->name; - blk->name_len = strlen(raw->name); + blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name)); blk->ctl_type = le16_to_cpu(raw->ctl_type); blk->flags = le16_to_cpu(raw->flags); blk->len = le32_to_cpu(raw->len); -- 2.34.1

2 1

[PATCH] iommu/arm-smmu-v3: Fix the compile warning
by Zhang Zekun 30 Jul '24

30 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGJ97 --------------------------------------- Fix the following compile warning: WARNING: modpost: vmlinux.o(.text+0x854620): ... The function arm_smmu_device_probe() references the variable __initdata arm_smmu_v3_plat_info. This is often because arm_smmu_device_probe lacks a __initdata annotation or the annotation of arm_smmu_v3_plat_info is wrong. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index c5c25be54fd5..cedc1eda7250 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5244,7 +5244,7 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) } #ifdef CONFIG_ACPI -static struct acpi_platform_list arm_smmu_v3_plat_info[] __initdata = { +static struct acpi_platform_list arm_smmu_v3_plat_info[] = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (2): ASoC: topology: Fix references to freed memory ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PTACH OLK-6.6 0/4] ext4: improve buffered write with more than one blocks_per_folio part 2
by Zhang Yi 30 Jul '24

30 Jul '24

Drop unnecessary state_lock in ifs, which could improve some (~10%) buffer write performance. I tested it through UnixBench on my x86 and arm64 virtual machine with 50GB ramdisk & xfs filesystem, the results shows below. 1. UnixBench Test on xfs: ./Run -i 1 -c 1 fstime-w Before: x86 File Write 1024 bufsize 2000 maxblocks 524708.0 KBps arm64 File Write 1024 bufsize 2000 maxblocks 801965.0 KBps After: x86 File Write 1024 bufsize 2000 maxblocks 571315.0 KBps arm64 File Write 1024 bufsize 2000 maxblocks 876077.0 KBps 2. Libmacro test in ext4: Before: Running: pwrite_u1k# bin/pwrite -E -C 200 -L -S -W -N pwrite_u1k -s 1k -I 500 -f /var/tmp/libmicro.1240/data prc thr usecs/call samples errors cnt/samp size pwrite_u1k 1 1 0.86016 167 0 200 1024 After: Running: pwrite_u1k# bin/pwrite -E -C 200 -L -S -W -N pwrite_u1k -s 1k -I 500 -f /var/tmp/libmicro.1957/data prc thr usecs/call samples errors cnt/samp size pwrite_u1k 1 1 0.7699 190 0 200 1024 Thanks, Yi. Matthew Wilcox (Oracle) (2): iomap: hold state_lock over call to ifs_set_range_uptodate() iomap: protect read_bytes_pending with the state_lock Zhang Yi (2): iomap: drop unnecessary state_lock when setting ifs uptodate bits iomap: drop unnecessary state_lock when changing ifs dirty bits fs/iomap/buffered-io.c | 73 +++++++++++++++++++++++++----------------- 1 file changed, 43 insertions(+), 30 deletions(-) -- 2.39.2

1 4

[PATCH 0/2] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (2): ASoC: topology: Fix references to freed memory ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) -- 2.25.1

1 2

[PATCH OLK-6.6 0/4] BMA: Fix DMA reset problem and change the version
by Peng Zhang 30 Jul '24

30 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/4] BMA: Fix DMA reset problem and change the version number
by Li Nan 30 Jul '24

30 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS 15750/23378] fs/.tmp_select.o: warning: objtool: poll_select_finish()+0xc6: can't find switch jump table
by kernel test robot 30 Jul '24

30 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 87e97edb9d08052dcb1df91827fb9dd9edecf612 commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [15750/23378] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-buildonly-randconfig-001-20240729 (https://download.01.org/0day-ci/archive/20240730/202407301459.O1t38ucj-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240730/202407301459.O1t38ucj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407301459.O1t38ucj-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/.tmp_select.o: warning: objtool: poll_select_finish()+0xc6: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] filelock: Fix fcntl/close race recovery compat path
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.43 commit 73ae349534ebc377328e7d21891e589626c6e82c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEF4 CVE: CVE-2024-41020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f8138f2ad2f745b9a1c696a05b749eabe44337ea upstream. When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels. Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240723-fs-lock-recover-compatfix-v1-1-148096719… Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 76ad05f8070a..ae62ee373704 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2504,8 +2504,9 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2520,9 +2521,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, f = files_lookup_fd_locked(files, fd); spin_unlock(&files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] CVE-2024-41020
by Yifan Qiao 30 Jul '24

30 Jul '24

Eric W. Biederman (1): file: Factor files_lookup_fd_locked out of fcheck_files Jann Horn (1): filelock: Fix fcntl/close race recovery compat path include/linux/fdtable.h | 7 +++++++ fs/file.c | 2 +- fs/locks.c | 23 ++++++++++++----------- fs/proc/fd.c | 2 +- 4 files changed, 21 insertions(+), 13 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-41020
by Yifan Qiao 30 Jul '24

30 Jul '24

Eric W. Biederman (1): file: Factor files_lookup_fd_locked out of fcheck_files Jann Horn (1): filelock: Fix fcntl/close race recovery compat path include/linux/fdtable.h | 7 +++++++ fs/file.c | 2 +- fs/locks.c | 23 ++++++++++++----------- fs/proc/fd.c | 2 +- 4 files changed, 21 insertions(+), 13 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
by Yang Yingliang 30 Jul '24

30 Jul '24

From: Hagar Hemdan <hagarhem(a)amazon.com> mainline inclusion from mainline-v6.10-rc6 commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP4 CVE: CVE-2024-42090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne(a)amazon.de> Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 82b3cd6903c8..8ecb8dc19208 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1084,8 +1084,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
by Yang Yingliang 30 Jul '24

30 Jul '24

From: Hagar Hemdan <hagarhem(a)amazon.com> mainline inclusion from mainline-v6.10-rc6 commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP4 CVE: CVE-2024-42090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne(a)amazon.de> Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 82b3cd6903c8..8ecb8dc19208 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1084,8 +1084,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
by Yang Yingliang 30 Jul '24

30 Jul '24

From: Hagar Hemdan <hagarhem(a)amazon.com> mainline inclusion from mainline-v6.10-rc6 commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP4 CVE: CVE-2024-42090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne(a)amazon.de> Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index b50968f0ce2e..f8952d01fc2c 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1078,8 +1078,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } } -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] ovl: simplify ovl_parse_param_lowerdir()
by Zhihao Cheng 30 Jul '24

30 Jul '24

Christian Brauner (1): ovl: pass string to ovl_parse_layer() Zhihao Cheng (2): ovl: fix wrong lowerdir number check for parameter Opt_lowerdir ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err fs/overlayfs/params.c | 49 ++++++++++--------------------------------- 1 file changed, 11 insertions(+), 38 deletions(-) -- 2.31.1

2 4

[PATCH openEuler-22.03-LTS-SP1] filelock: Fix fcntl/close race recovery compat path
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v4.19.319 commit a561145f3ae973ebf3e0aee41624e92a6c5cb38d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEF4 CVE: CVE-2024-41020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f8138f2ad2f745b9a1c696a05b749eabe44337ea upstream. When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels. Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240723-fs-lock-recover-compatfix-v1-1-148096719… Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 6e118955b9b6..7b805e2a7f7a 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2530,8 +2530,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2545,9 +2546,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, &current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] filelock: Fix fcntl/close race recovery compat path
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v4.19.319 commit a561145f3ae973ebf3e0aee41624e92a6c5cb38d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEF4 CVE: CVE-2024-41020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f8138f2ad2f745b9a1c696a05b749eabe44337ea upstream. When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels. Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240723-fs-lock-recover-compatfix-v1-1-148096719… Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 9dc72fda5e4e..532b728a8675 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2429,8 +2429,9 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2444,9 +2445,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, &current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH OLK-6.6] firmware: cs_dsp: Fix overflow checking of wmfw header
by Yipeng Zou 30 Jul '24

30 Jul '24

From: Richard Fitzgerald <rf(a)opensource.cirrus.com> stable inclusion from stable-v6.10.15 commit 3019b86bce16fbb5bc1964f3544d0ce7d0137278 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMJ CVE: CVE-2024-41039 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer. The original code tested that the firmware data buffer contained enough bytes for the sums of the size of the structs wmfw_header + wmfw_adsp1_sizes + wmfw_footer But wmfw_adsp1_sizes is only used on ADSP1 firmware. For ADSP2 and Halo Core the equivalent struct is wmfw_adsp2_sizes, which is 4 bytes longer. So the length check didn't guarantee that there are enough bytes in the firmware buffer for a header with wmfw_adsp2_sizes. This patch splits the length check into three separate parts. Each of the wmfw_header, wmfw_adsp?_sizes and wmfw_footer are checked separately before they are used. Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com> Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") Link: https://patch.msgid.link/20240627141432.93056-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/firmware/cirrus/cs_dsp.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c index 79d4254d1f9b..f0c3c4011411 100644 --- a/drivers/firmware/cirrus/cs_dsp.c +++ b/drivers/firmware/cirrus/cs_dsp.c @@ -1267,6 +1267,10 @@ static unsigned int cs_dsp_adsp1_parse_sizes(struct cs_dsp *dsp, const struct wmfw_adsp1_sizes *adsp1_sizes; adsp1_sizes = (void *)&firmware->data[pos]; + if (sizeof(*adsp1_sizes) > firmware->size - pos) { + cs_dsp_err(dsp, "%s: file truncated\n", file); + return 0; + } cs_dsp_dbg(dsp, "%s: %d DM, %d PM, %d ZM\n", file, le32_to_cpu(adsp1_sizes->dm), le32_to_cpu(adsp1_sizes->pm), @@ -1283,6 +1287,10 @@ static unsigned int cs_dsp_adsp2_parse_sizes(struct cs_dsp *dsp, const struct wmfw_adsp2_sizes *adsp2_sizes; adsp2_sizes = (void *)&firmware->data[pos]; + if (sizeof(*adsp2_sizes) > firmware->size - pos) { + cs_dsp_err(dsp, "%s: file truncated\n", file); + return 0; + } cs_dsp_dbg(dsp, "%s: %d XM, %d YM %d PM, %d ZM\n", file, le32_to_cpu(adsp2_sizes->xm), le32_to_cpu(adsp2_sizes->ym), @@ -1322,7 +1330,6 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, struct regmap *regmap = dsp->regmap; unsigned int pos = 0; const struct wmfw_header *header; - const struct wmfw_adsp1_sizes *adsp1_sizes; const struct wmfw_footer *footer; const struct wmfw_region *region; const struct cs_dsp_region *mem; @@ -1338,10 +1345,8 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, ret = -EINVAL; - pos = sizeof(*header) + sizeof(*adsp1_sizes) + sizeof(*footer); - if (pos >= firmware->size) { - cs_dsp_err(dsp, "%s: file too short, %zu bytes\n", - file, firmware->size); + if (sizeof(*header) >= firmware->size) { + ret = -EOVERFLOW; goto out_fw; } @@ -1369,13 +1374,16 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, pos = sizeof(*header); pos = dsp->ops->parse_sizes(dsp, file, pos, firmware); + if ((pos == 0) || (sizeof(*footer) > firmware->size - pos)) { + ret = -EOVERFLOW; + goto out_fw; + } footer = (void *)&firmware->data[pos]; pos += sizeof(*footer); if (le32_to_cpu(header->len) != pos) { - cs_dsp_err(dsp, "%s: unexpected header length %d\n", - file, le32_to_cpu(header->len)); + ret = -EOVERFLOW; goto out_fw; } @@ -1501,6 +1509,9 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware, cs_dsp_buf_free(&buf_list); kfree(text); + if (ret == -EOVERFLOW) + cs_dsp_err(dsp, "%s: file content overflows file data\n", file); + return ret; } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/radeon: fix UBSAN warning in kv_dpm.c
by Kaixiong Yu 30 Jul '24

30 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v5.10.221 commit febe794b83693257f21a23d2e03ea695a62449c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR1V CVE: CVE-2024-40988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream. Adds bounds check for sumo_vid_mapping_entry. Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c index 45d04996adf5..a80e2edb7c0f 100644 --- a/drivers/gpu/drm/radeon/sumo_dpm.c +++ b/drivers/gpu/drm/radeon/sumo_dpm.c @@ -1621,6 +1621,8 @@ void sumo_construct_vid_mapping_table(struct radeon_device *rdev, for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) { if (table[i].ulSupportedSCLK != 0) { + if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES) + continue; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit = -- 2.25.1

2 1

[PATCH OLK-5.10] filelock: fix potential use-after-free in posix_lock_inode
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jeff Layton <jlayton(a)kernel.org> stable inclusion from stable-v5.10.222 commit 7d4c14f4b511fd4c0dc788084ae59b4656ace58b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKN CVE: CVE-2024-41049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92 ] Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen. Fixes: 74f6f5912693 ("locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock") Link: https://lore.kernel.org/linux-fsdevel/724ffb0a2962e912ea62bb0515deadf39c325… Reported-by: Light Hsieh (謝明燈) <Light.Hsieh(a)mediatek.com> Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://lore.kernel.org/r/20240702-filelock-6-10-v1-1-96e766aadc98@kernel.o… Reviewed-by: Alexander Aring <aahringo(a)redhat.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/locks.c b/fs/locks.c index 4e4b36c330f9..f4504008a2ea 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -1337,9 +1337,9 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request, locks_wake_up_blocks(left); } out: + trace_posix_lock_inode(inode, request, error); spin_unlock(&ctx->flc_lock); percpu_up_read(&file_rwsem); - trace_posix_lock_inode(inode, request, error); /* * Free any unused locks. */ -- 2.39.2

2 1

[PATCH OLK-6.6] drm/radeon: fix UBSAN warning in kv_dpm.c
by Kaixiong Yu 30 Jul '24

30 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v5.10.221 commit febe794b83693257f21a23d2e03ea695a62449c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR1V CVE: CVE-2024-40988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream. Adds bounds check for sumo_vid_mapping_entry. Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c index d49c145db437..f7f1ddc6cdd8 100644 --- a/drivers/gpu/drm/radeon/sumo_dpm.c +++ b/drivers/gpu/drm/radeon/sumo_dpm.c @@ -1621,6 +1621,8 @@ void sumo_construct_vid_mapping_table(struct radeon_device *rdev, for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) { if (table[i].ulSupportedSCLK != 0) { + if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES) + continue; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit = -- 2.25.1

2 1

[PATCH OLK-5.10] filelock: fix potential use-after-free in posix_lock_inode
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jeff Layton <jlayton(a)kernel.org> stable inclusion from stable-v5.10.222 commit 7d4c14f4b511fd4c0dc788084ae59b4656ace58b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKN CVE: CVE-2024-41049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92 ] Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen. Fixes: 74f6f5912693 ("locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock") Link: https://lore.kernel.org/linux-fsdevel/724ffb0a2962e912ea62bb0515deadf39c325… Reported-by: Light Hsieh (謝明燈) <Light.Hsieh(a)mediatek.com> Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://lore.kernel.org/r/20240702-filelock-6-10-v1-1-96e766aadc98@kernel.o… Reviewed-by: Alexander Aring <aahringo(a)redhat.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/locks.c b/fs/locks.c index 4e4b36c330f9..f4504008a2ea 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -1337,9 +1337,9 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request, locks_wake_up_blocks(left); } out: + trace_posix_lock_inode(inode, request, error); spin_unlock(&ctx->flc_lock); percpu_up_read(&file_rwsem); - trace_posix_lock_inode(inode, request, error); /* * Free any unused locks. */ -- 2.39.2

2 1

[PATCH OLK-6.6] filelock: fix potential use-after-free in posix_lock_inode
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jeff Layton <jlayton(a)kernel.org> stable inclusion from stable-v6.6.41 commit 432b06b69d1d354a171f7499141116536579eb6a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKN CVE: CVE-2024-41049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92 ] Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen. Fixes: 74f6f5912693 ("locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock") Link: https://lore.kernel.org/linux-fsdevel/724ffb0a2962e912ea62bb0515deadf39c325… Reported-by: Light Hsieh (謝明燈) <Light.Hsieh(a)mediatek.com> Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://lore.kernel.org/r/20240702-filelock-6-10-v1-1-96e766aadc98@kernel.o… Reviewed-by: Alexander Aring <aahringo(a)redhat.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/locks.c b/fs/locks.c index 76ad05f8070a..fb717dae9029 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -1314,9 +1314,9 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request, locks_wake_up_blocks(left); } out: + trace_posix_lock_inode(inode, request, error); spin_unlock(&ctx->flc_lock); percpu_up_read(&file_rwsem); - trace_posix_lock_inode(inode, request, error); /* * Free any unused locks. */ -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/radeon: fix UBSAN warning in kv_dpm.c
by Kaixiong Yu 30 Jul '24

30 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v5.10.221 commit febe794b83693257f21a23d2e03ea695a62449c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR1V CVE: CVE-2024-40988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream. Adds bounds check for sumo_vid_mapping_entry. Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c index b95d5d390caf..6bde7f119d9c 100644 --- a/drivers/gpu/drm/radeon/sumo_dpm.c +++ b/drivers/gpu/drm/radeon/sumo_dpm.c @@ -1619,6 +1619,8 @@ void sumo_construct_vid_mapping_table(struct radeon_device *rdev, for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) { if (table[i].ulSupportedSCLK != 0) { + if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES) + continue; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit = -- 2.25.1

2 1

[PATCH OLK-6.6] fs/ntfs3: Add a check for attr_names and oatbl
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> stable inclusion from stable-v6.6.43 commit f3124d51e4e7b56a732419d8dc270e807252334f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG8T5 CVE: CVE-2024-41018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 702d4930eb06dcfda85a2fa67e8a1a27bfa2a845 upstream. Added out-of-bound checking for *ane (ATTR_NAME_ENTRY). Reported-by: lei lu <llfamsec(a)gmail.com> Fixes: 865e7a7700d93 ("fs/ntfs3: Reduce stack usage") Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ntfs3/fslog.c | 38 ++++++++++++++++++++++++++++++++------ 1 file changed, 32 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 4085fe30bf48..2e2348f8e285 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -3722,6 +3722,8 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) u64 rec_lsn, checkpt_lsn = 0, rlsn = 0; struct ATTR_NAME_ENTRY *attr_names = NULL; + u32 attr_names_bytes = 0; + u32 oatbl_bytes = 0; struct RESTART_TABLE *dptbl = NULL; struct RESTART_TABLE *trtbl = NULL; const struct RESTART_TABLE *rt; @@ -3736,6 +3738,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) struct NTFS_RESTART *rst = NULL; struct lcb *lcb = NULL; struct OPEN_ATTR_ENRTY *oe; + struct ATTR_NAME_ENTRY *ane; struct TRANSACTION_ENTRY *tr; struct DIR_PAGE_ENTRY *dp; u32 i, bytes_per_attr_entry; @@ -4314,17 +4317,40 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) lcb = NULL; check_attribute_names2: - if (rst->attr_names_len && oatbl) { - struct ATTR_NAME_ENTRY *ane = attr_names; - while (ane->off) { + if (attr_names && oatbl) { + off = 0; + for (;;) { + /* Check we can use attribute name entry 'ane'. */ + static_assert(sizeof(*ane) == 4); + if (off + sizeof(*ane) > attr_names_bytes) { + /* just ignore the rest. */ + break; + } + + ane = Add2Ptr(attr_names, off); + t16 = le16_to_cpu(ane->off); + if (!t16) { + /* this is the only valid exit. */ + break; + } + + /* Check we can use open attribute entry 'oe'. */ + if (t16 + sizeof(*oe) > oatbl_bytes) { + /* just ignore the rest. */ + break; + } + /* TODO: Clear table on exit! */ - oe = Add2Ptr(oatbl, le16_to_cpu(ane->off)); + oe = Add2Ptr(oatbl, t16); t16 = le16_to_cpu(ane->name_bytes); + off += t16 + sizeof(*ane); + if (off > attr_names_bytes) { + /* just ignore the rest. */ + break; + } oe->name_len = t16 / sizeof(short); oe->ptr = ane->name; oe->is_attr_name = 2; - ane = Add2Ptr(ane, - sizeof(struct ATTR_NAME_ENTRY) + t16); } } -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] fix tick broadcast issue
by Yu Liao 30 Jul '24

30 Jul '24

Yu Liao (2): Revert "tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled" tick/broadcast: Make takeover of broadcast hrtimer reliable kernel/time/tick-broadcast-hrtimer.c | 13 ------------- kernel/time/tick-broadcast.c | 23 +++++++++++++++++++++++ 2 files changed, 23 insertions(+), 13 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/4] BMA: Fix DMA reset problem and change the version number
by Li Nan 30 Jul '24

30 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 87e97edb9d08052dcb1df91827fb9dd9edecf612
by kernel test robot 30 Jul '24

30 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 87e97edb9d08052dcb1df91827fb9dd9edecf612 !10227 MIPS: smp: fill in sibling and core maps earlier elapsed time: 727m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240729 gcc-14.1.0 arm64 randconfig-002-20240729 gcc-14.1.0 arm64 randconfig-003-20240729 gcc-14.1.0 arm64 randconfig-004-20240729 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240729 clang-18 x86_64 buildonly-randconfig-002-20240729 gcc-13 x86_64 buildonly-randconfig-003-20240729 gcc-10 x86_64 buildonly-randconfig-004-20240729 gcc-10 x86_64 buildonly-randconfig-005-20240729 gcc-10 x86_64 buildonly-randconfig-006-20240729 gcc-10 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240729 gcc-13 x86_64 randconfig-002-20240729 clang-18 x86_64 randconfig-003-20240729 clang-18 x86_64 randconfig-004-20240729 clang-18 x86_64 randconfig-005-20240729 clang-18 x86_64 randconfig-006-20240729 clang-18 x86_64 randconfig-011-20240729 gcc-8 x86_64 randconfig-012-20240729 gcc-8 x86_64 randconfig-013-20240729 gcc-13 x86_64 randconfig-014-20240729 clang-18 x86_64 randconfig-015-20240729 gcc-13 x86_64 randconfig-016-20240729 clang-18 x86_64 randconfig-071-20240729 gcc-13 x86_64 randconfig-072-20240729 gcc-13 x86_64 randconfig-073-20240729 clang-18 x86_64 randconfig-074-20240729 gcc-8 x86_64 randconfig-075-20240729 gcc-12 x86_64 randconfig-076-20240729 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS fbff37d503211903d1acab770e4b9ee263d9d49f
by kernel test robot 29 Jul '24

29 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: fbff37d503211903d1acab770e4b9ee263d9d49f !9904 ext4: improve buffered write with more than one blocks_per_folio Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240729 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-004-20240729 | `-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240729 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 729m configs tested: 40 configs skipped: 134 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240729 clang-17 arm64 randconfig-002-20240729 clang-20 arm64 randconfig-003-20240729 gcc-14.1.0 arm64 randconfig-004-20240729 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240729 gcc-14.1.0 loongarch randconfig-002-20240729 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240729 clang-18 x86_64 buildonly-randconfig-002-20240729 gcc-13 x86_64 buildonly-randconfig-003-20240729 gcc-10 x86_64 buildonly-randconfig-004-20240729 gcc-10 x86_64 buildonly-randconfig-005-20240729 gcc-10 x86_64 buildonly-randconfig-006-20240729 gcc-10 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240729 gcc-13 x86_64 randconfig-002-20240729 clang-18 x86_64 randconfig-003-20240729 clang-18 x86_64 randconfig-004-20240729 clang-18 x86_64 randconfig-005-20240729 clang-18 x86_64 randconfig-006-20240729 clang-18 x86_64 randconfig-011-20240729 gcc-8 x86_64 randconfig-012-20240729 gcc-8 x86_64 randconfig-013-20240729 gcc-13 x86_64 randconfig-014-20240729 clang-18 x86_64 randconfig-015-20240729 gcc-13 x86_64 randconfig-016-20240729 clang-18 x86_64 randconfig-071-20240729 gcc-13 x86_64 randconfig-072-20240729 gcc-13 x86_64 randconfig-073-20240729 clang-18 x86_64 randconfig-074-20240729 gcc-8 x86_64 randconfig-075-20240729 gcc-12 x86_64 randconfig-076-20240729 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] iommu/arm-smmu-v3: Reducing the CMD_SYNC times
by Zhang Zekun 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9G9TI ---------------------------------------- Benifiting from the hardware same address blocking mechanism. We only need to send the CMD_SYNC when creating pte entry other than lvl 3, this can reduce the amounts of CMD_SYNC times sent to avoiding the errata. Detecting the hardware ability by read the SMMU_USER_CONFIG1. Fixes: 46f0c5798ba5 ("iommu/arm-smmu-v3: Enable iotlb_sync_map according to SMMU_IIDR") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 52 +++++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 ++ drivers/iommu/io-pgtable-arm.c | 5 ++ 3 files changed, 60 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 16217647fd67..6fa7b0b3e90c 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2203,6 +2203,14 @@ static void arm_smmu_tlb_inv_page_nosync(struct iommu_iotlb_gather *gather, static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + struct arm_smmu_domain *smmu_domain = cookie; + + if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { + arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); + return; + } +#endif arm_smmu_tlb_inv_range_domain(iova, size, granule, false, cookie); } @@ -2736,6 +2744,9 @@ static int arm_smmu_iotlb_sync_map(struct iommu_domain *domain, if (!(smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_MAP)) return 0; + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + return 0; + granule_size = 1 << __ffs(smmu_domain->domain.pgsize_bitmap); /* Add a SYNC command to sync io-pgtale to avoid errors in pgtable prefetch*/ @@ -4241,6 +4252,45 @@ static void arm_smmu_get_httu(struct arm_smmu_device *smmu, u32 reg) fw_features); } +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +static void hisi_smmu_check_errata(struct arm_smmu_device *smmu) +{ + u32 reg, i; + + if (!(smmu->options & ARM_SMMU_OPT_SYNC_MAP)) + return; + + smmu->options |= ARM_SMMU_OPT_SYNC_MAP; + + reg = readl_relaxed(smmu->base + ARM_SMMU_USER_CFG1); + reg = reg & GENMASK(15, 0); + for (i = 0; i < 8; i++) { + unsigned long val; + + val = (reg >> 2 * i) & GENMASK(1, 0); + switch (PAGE_SIZE) { + case SZ_4K: + if (!val) + return; + break; + case SZ_16K: + if (!val || val == 0x1) + return; + break; + case SZ_64K: + if (!val || val == 0x1 || val == 0x3) + return; + break; + default: + return; + } + } + smmu->options |= ARM_SMMU_OPT_SYNC_BATCH; +} +#else +static void hisi_smmu_check_errata(struct arm_smmu_device *smmu) {} +#endif + static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) { u32 reg; @@ -4455,6 +4505,8 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) smmu->oas = 48; } + hisi_smmu_check_errata(smmu); + if (arm_smmu_ops.pgsize_bitmap == -1UL) arm_smmu_ops.pgsize_bitmap = smmu->pgsize_bitmap; else diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 859d21729882..bc34d5a6aab9 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -139,6 +139,8 @@ #define ARM_SMMU_GERROR_IRQ_CFG1 0x70 #define ARM_SMMU_GERROR_IRQ_CFG2 0x74 +#define ARM_SMMU_USER_CFG1 0xe04 + #define ARM_SMMU_IDR6 0x190 #define IDR6_LOG2NUMP GENMASK(27, 24) #define IDR6_LOG2NUMQ GENMASK(19, 16) @@ -708,6 +710,7 @@ struct arm_smmu_device { #define ARM_SMMU_OPT_MSIPOLL (1 << 2) #define ARM_SMMU_OPT_CMDQ_FORCE_SYNC (1 << 3) #define ARM_SMMU_OPT_SYNC_MAP (1 << 4) +#define ARM_SMMU_OPT_SYNC_BATCH (1 << 5) u32 options; #ifdef CONFIG_ARM_SMMU_V3_ECMDQ diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index 79aa11d88c56..fb54baed3f49 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -407,6 +407,11 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, pte = arm_lpae_install_table(cptep, ptep, 0, data); if (pte) __arm_lpae_free_pages(cptep, tblsz, cfg, data->iop.cookie); + +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + if (lvl <= 2) + io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); +#endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { __arm_lpae_sync_pte(ptep, 1, cfg); } -- 2.17.1

2 1

[PATCH OLK-5.10 0/3] xfs: fix tail alignment
by Long Li 29 Jul '24

29 Jul '24

This patch set fix maxlen fallback to availble len, it cause tail is no alignment. Dave Chinner (3): xfs: only allow minlen allocations when near ENOSPC xfs: always tail align maxlen allocations xfs: align args->minlen for forced allocation alignment fs/xfs/libxfs/xfs_alloc.c | 31 +++++++++++++++++++------------ fs/xfs/libxfs/xfs_bmap.c | 28 +++++++++++++++++++++------- 2 files changed, 40 insertions(+), 19 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS v2] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/jbd2/journal.c [Since disk deletion does not call ext4_shutdown, abort the journal when the jbd2 sb_buffer is unmapped to avoid a dead loop.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- fs/jbd2/journal.c | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b35f0b63baf0..ab6c0b9c5336 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -96,8 +96,11 @@ void __jbd2_log_wait_for_space(journal_t *journal) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 4462b6ec32b7..bf83e1c64aa4 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1431,6 +1431,8 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) /* Buffer got discarded which means block device got invalidated */ if (!buffer_mapped(bh)) { unlock_buffer(bh); + if (!is_journal_aborted(journal)) + jbd2_journal_abort(journal, -EIO); return -EIO; } -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/jbd2/journal.c [Since disk deletion does not call ext4_shutdown, abort the journal when the jbd2 sb_buffer is unmapped to avoid a dead loop.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- fs/jbd2/journal.c | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 13506e2ae3e8..9bbd9c69ba64 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1619,6 +1619,8 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) /* Buffer got discarded which means block device got invalidated */ if (!buffer_mapped(bh)) { unlock_buffer(bh); + if (!is_journal_aborted(journal)) + jbd2_journal_abort(journal, -EIO); return -EIO; } -- 2.31.1

2 1

[PATCH OLK-5.10 v2] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/jbd2/journal.c [Since disk deletion does not call ext4_shutdown, abort the journal when the jbd2 sb_buffer is unmapped to avoid a dead loop.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- fs/jbd2/journal.c | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 6e2848b10aaf..7775ad53b291 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1621,6 +1621,8 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) /* Buffer got discarded which means block device got invalidated */ if (!buffer_mapped(bh)) { unlock_buffer(bh); + if (!is_journal_aborted(journal)) + jbd2_journal_abort(journal, -EIO); return -EIO; } -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
by Zhang Changzhong 29 Jul '24

29 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> mainline inclusion from mainline-v6.9 commit be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAEF52 CVE: CVE-2024-41011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP when it updates VRAM. However, on systems with >4K pages, we end up exposing PAGE_SIZE of MMIO space. Fixes: d8e408a82704 ("drm/amdkfd: Expose HDP registers to user space") Reviewed-by: Felix Kuehling <felix.kuehling(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_chardev.c [Commit 73fa13b6a511 ("drm/amdkfd: CRIU Implement KFD restore ioctl") is not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 2a99edf..4155010 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1304,7 +1304,7 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, goto err_unlock; } offset = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); - if (!offset) { + if (!offset || (PAGE_SIZE > 4096)) { err = -ENOMEM; goto err_unlock; } @@ -1962,6 +1962,9 @@ static int kfd_mmio_mmap(struct kfd_dev *dev, struct kfd_process *process, if (vma->vm_end - vma->vm_start != PAGE_SIZE) return -EINVAL; + if (PAGE_SIZE > 4096) + return -EINVAL; + address = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); vma->vm_flags |= VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE | -- 2.9.5

2 1

[PATCH OLK-5.10 0/2] fix tick broadcast issue
by Yu Liao 29 Jul '24

29 Jul '24

Yu Liao (2): Revert "tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled" tick/broadcast: Make takeover of broadcast hrtimer reliable kernel/time/tick-broadcast-hrtimer.c | 14 -------------- kernel/time/tick-broadcast.c | 23 +++++++++++++++++++++++ 2 files changed, 23 insertions(+), 14 deletions(-) -- 2.33.0

2 3

[PATCH OLK-5.10] drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
by Zhang Changzhong 29 Jul '24

29 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> mainline inclusion from mainline-v6.9 commit be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAEF52 CVE: CVE-2024-41011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP when it updates VRAM. However, on systems with >4K pages, we end up exposing PAGE_SIZE of MMIO space. Fixes: d8e408a82704 ("drm/amdkfd: Expose HDP registers to user space") Reviewed-by: Felix Kuehling <felix.kuehling(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_chardev.c [Commit 73fa13b6a511 ("drm/amdkfd: CRIU Implement KFD restore ioctl") is not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 2a99edf..4155010 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1304,7 +1304,7 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, goto err_unlock; } offset = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); - if (!offset) { + if (!offset || (PAGE_SIZE > 4096)) { err = -ENOMEM; goto err_unlock; } @@ -1962,6 +1962,9 @@ static int kfd_mmio_mmap(struct kfd_dev *dev, struct kfd_process *process, if (vma->vm_end - vma->vm_start != PAGE_SIZE) return -EINVAL; + if (PAGE_SIZE > 4096) + return -EINVAL; + address = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); vma->vm_flags |= VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE | -- 2.9.5

2 1

[PATCH OLK-6.6 000/717] Backport 6.6.33
by Wang Hai 29 Jul '24

29 Jul '24

Backport 6.6.33 Aapo Vienamo (1): mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() Aaron Conole (1): openvswitch: Set the skbuff pkt_type for proper pmtud support. Abdelrahman Morsy (1): HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled Adrian Hunter (5): x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS perf record: Fix debug message placement for test consumption perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) mmc: sdhci: Add support for "Tuning Error" interrupts Al Viro (1): parisc: add missing export of __cmpxchg_u8() Aleksandr Aprelkov (1): sunrpc: removed redundant procp check Aleksandr Burakov (1): media: ngene: Add dvb_ca_en50221_init return value check Aleksandr Mishin (3): thermal/drivers/tsens: Fix null pointer dereference ASoC: kirkwood: Fix potential NULL dereference drm: vc4: Fix possible null pointer dereference Alex Deucher (1): Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices" Alexander Aring (1): dlm: fix user space lock decision to copy lvb Alexander Egorenkov (2): s390/ipl: Fix incorrect initialization of len fields in nvme reipl block s390/ipl: Fix incorrect initialization of nvme dump block Alexander Lobakin (1): bitops: add missing prototype check Alexander Potapenko (1): kmsan: do not wipe out origin when doing partial unpoisoning Alexander Shishkin (1): intel_th: pci: Add Meteor Lake-S CPU support Alexandre Mergnat (1): clk: mediatek: mt8365-mm: fix DPI0 parent Alison Schofield (1): cxl/trace: Correct DPA field masks for general_media & dram events Aloka Dixit (1): wifi: ath12k: use correct flag field for 320 MHz channels Alvin Lee (1): drm/amd/display: Remove pixle rate limit for subvp Andi Shyti (1): drm/i915/gt: Fix CCS id's calculation for CCS mode setting Andrea Mayer (1): ipv6: sr: fix missing sk_buff release in seg6_input_core Andreas Gruenbacher (10): gfs2: Don't forget to complete delayed withdraw gfs2: Fix "ignore unlock failures after withdraw" gfs2: Get rid of gfs2_alloc_blocks generation parameter gfs2: Convert gfs2_internal_read to folios gfs2: Rename gfs2_lookup_{ simple => meta } gfs2: Mark withdraws as unlikely gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn gfs2: finish_xmote cleanup gfs2: do_xmote fixes kthread: add kthread_stop_put Andrew Halaney (8): scsi: ufs: qcom: Perform read back after writing reset bit scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US scsi: ufs: qcom: Perform read back after writing unipro mode scsi: ufs: qcom: Perform read back after writing CGC enable scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H scsi: ufs: core: Perform read back after disabling interrupts scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL Andrey Konovalov (1): kasan, fortify: properly rename memintrinsics Andrii Nakryiko (1): bpf: prevent r10 register from being marked as precise Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11. Andy Shevchenko (6): ACPI: LPSS: Advertise number of chip selects via property iio: core: Leave private pointer NULL when no private data supplied serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Fix bitwise types usb: fotg210: Add missing kernel doc description spi: Don't mark message DMA mapped when no transfer in it is Anna Schumaker (1): NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS Anshuman Khandual (1): coresight: etm4x: Fix unbalanced pm_runtime_enable() Anton Protopopov (1): bpf: Pack struct bpf_fib_lookup Ard Biesheuvel (3): x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 x86/purgatory: Switch to the position-independent small code model x86/efistub: Omit physical KASLR when memory reservations exist Armin Wolf (1): ACPI: Fix Generic Initiator Affinity _OSC bit Arnaldo Carvalho de Melo (1): perf probe: Add missing libgen.h header needed for using basename() Arnd Bergmann (17): nilfs2: fix out-of-range warning crypto: ccp - drop platform ifdef checks enetc: avoid truncating error message qed: avoid truncating work queue length mlx5: avoid truncating error message mlx5: stop warning for 64KB pages wifi: carl9170: re-fix fortified-memset warning ACPI: disable -Wstringop-truncation fbdev: shmobile: fix snprintf truncation powerpc/fsl-soc: hide unused const variable fbdev: sisfb: hide unused variables media: rcar-vin: work around -Wenum-compare-conditional warning firmware: dmi-id: add a release callback function greybus: arche-ctrl: move device table to its right location module: don't ignore sysfs_create_link() failures Input: ims-pcu - fix printf string overflow drm/i915/guc: avoid FIELD_PREP warning Arun T (2): ASoC: Intel: common: add ACPI matching tables for Arrow Lake ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions Baochen Qiang (2): wifi: ath10k: poll service ready message before failing wifi: ath11k: don't force enable power save on non-running vdevs Bart Van Assche (1): scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search() Basavaraj Natikar (1): HID: amd_sfh: Handle "no sensors" in PM operations Beau Belgrave (3): tracing/user_events: Allow events to persist for perfmon_capable users tracing/user_events: Prepare find/delete for same name events tracing/user_events: Fix non-spaced field matching Benjamin Coddington (1): NFSv4: Fixup smatch warning for ambiguous return Benjamin Gray (1): selftests/powerpc/dexcr: Add -no-pie to hashchk tests Benjamin Poirier (1): selftests: net: List helper scripts in TEST_FILES Makefile variable Bibo Mao (1): LoongArch: Lately init pmu after smp is online Binbin Zhou (3): dt-bindings: thermal: loongson,ls2k-thermal: Fix binding check issues dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition Bitterblue Smith (4): wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path Bjorn Andersson (1): soc: qcom: pmic_glink: Make client-lock non-sleeping Bjorn Helgaas (1): x86/pci: Skip early E820 check for ECAM region Bob Pearson (2): RDMA/rxe: Allow good work requests to be executed RDMA/rxe: Fix incorrect rxe_put in error path Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Brennan Xavier McManus (1): tools/nolibc/stdlib: fix memory error in realloc() Bui Quang Minh (1): scsi: bfa: Ensure the copied buf is NUL terminated Carolina Jubran (1): net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion Catalin Popescu (1): clk: rs9: fix wrong default value for clock amplitude Cezary Rojewski (5): ASoC: Intel: Disable route checks for Skylake boards ASoC: Intel: avs: ssm4567: Do not ignore route checks ASoC: Intel: avs: Fix ASRC module initialization ASoC: Intel: avs: Fix potential integer overflow ASoC: Intel: avs: Test result of avs_get_module_entry() Chandramohan Akula (2): RDMA/bnxt_re: Refactor the queue index update RDMA/bnxt_re: Remove roundup_pow_of_two depth for all hardware queue resources Chao Yu (14): f2fs: fix to wait on page writeback in __clone_blkaddrs() f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file() f2fs: fix to relocate check condition in f2fs_fallocate() f2fs: fix to check pinfile flag in f2fs_move_file_range() f2fs: support printk_ratelimited() in f2fs_printk() f2fs: compress: fix to update i_compr_blocks correctly f2fs: introduce get_available_block_count() for cleanup f2fs: compress: fix error path of inc_valid_block_count() f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock f2fs: fix to release node block count in error path of f2fs_new_node_page() f2fs: fix to add missing iput() in gc_data_segment() f2fs: use f2fs_{err,info}_ratelimited() for cleanup f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() Charles Keepax (1): ASoC: cs42l43: Only restrict 44.1kHz for the ASP Chen Ni (3): HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors dmaengine: idma64: Add check for dma_set_max_seg_size watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() Chengming Zhou (1): mm/ksm: fix ksm_pages_scanned accounting Chris Lew (1): net: qrtr: ns: Fix module refcnt Chris Wulff (1): usb: gadget: u_audio: Clear uac pointer when freed. Christian Brauner (1): i915: make inject_virtual_interrupt() void Christian Hewitt (1): drm/meson: vclk: fix calculation of 59.94 fractional rates Christoffer Sandberg (1): ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx Christophe JAILLET (3): VMCI: Fix an error handling path in vmci_guest_probe_device() ppdev: Remove usage of the deprecated ida_simple_xx() API i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() Chuck Lever (2): SUNRPC: Fix gss_free_in_token_pages() SUNRPC: Fix loop termination condition in gss_free_in_token_pages() Chun-Kuang Hu (1): soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE Clément Léger (1): selftests: sud_test: return correct emulated syscall value on RISC-V Daeho Jeong (3): f2fs: separate f2fs_gc_range() to use GC for a range f2fs: support file pinning for zoned devices f2fs: write missing last sum blk of file pinning section Dan Aloni (2): sunrpc: fix NFSACL RPC retry on soft mount rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL Dan Carpenter (5): nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists() wifi: mwl8k: initialize cmd->addr[] properly Bluetooth: qca: Fix error code in qca_read_fw_build_info() ext4: fix potential unnitialized variable stm class: Fix a double free in stm_register_device() Daniel Borkmann (1): vxlan: Fix regression when dropping packets due to invalid src addresses Daniel J Blueman (1): x86/tsc: Trust initial offset in architectural TSC-adjust MSRs Daniel Starke (1): tty: n_gsm: fix missing receive state reset after mode switch Daniel Thompson (4): kdb: Use format-strings rather than '\0' injection in kdb_read() kdb: Fix console handling when editing and tab-completing commands kdb: Merge identical case statements in kdb_read() kdb: Use format-specifiers rather than memset() for padding in kdb_read() Daniele Palmas (1): net: usb: qmi_wwan: add Telit FN920C04 compositions Danila Tikhonov (1): pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs Dave Airlie (3): nouveau: add an ioctl to return vram bar size. nouveau: add an ioctl to report vram usage nouveau: report byte usage in VRAM usage. David Arinzon (1): net: ena: Reduce lines with longer column width boundary David E. Box (3): tools/arch/x86/intel_sdsi: Fix maximum meter bundle length tools/arch/x86/intel_sdsi: Fix meter_show display tools/arch/x86/intel_sdsi: Fix meter_certificate decoding David Hildenbrand (2): mm/userfaultfd: Do not place zeropages when zeropages are disallowed s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests Derek Fang (2): ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating ASoC: dt-bindings: rt5645: add cbj sleeve gpio property Derek Foreman (1): drm/etnaviv: fix tx clock gating on some GC7000 variants Detlev Casanova (1): drm/rockchip: vop2: Do not divide height twice for YUV Dev Jain (1): selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages Dhananjay Ugwekar (1): cpufreq: amd-pstate: Fix the inconsistency in max frequency units Dmitry Baryshkov (13): soc: qcom: pmic_glink: don't traverse clients list without a lock soc: qcom: pmic_glink: notify clients about the current state wifi: ath10k: populate board data for WCN3990 drm/msm/dp: allow voltage swing / pre emphasis of 3 drm/mipi-dsi: use correct return type for the DSC functions clk: qcom: dispcc-sm8450: fix DisplayPort clocks clk: qcom: dispcc-sm6350: fix DisplayPort clocks clk: qcom: dispcc-sm8550: fix DisplayPort clocks usb: typec: ucsi: always register a link to USB PD device usb: typec: ucsi: simplify partner's PD caps registration dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x wifi: ath10k: fix QCOM_RPROC_COMMON dependency Dmitry Torokhov (1): Input: try trimming too long modalias strings Dongliang Mu (1): media: flexcop-usb: fix sanity check of bNumEndpoints Doug Berger (1): serial: 8250_bcm7271: use default_mux_rate if possible Douglas Anderson (3): drm/dp: Don't attempt AUX transfers when eDP panels are not powered drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected Duoming Zhou (3): wifi: brcmfmac: pcie: handle randbuf allocation failure lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure um: Fix return value in ubd_init() Edward Liaw (1): selftests/kcmp: remove unused open mode Eric Biggers (5): KEYS: asymmetric: Add missing dependency on CRYPTO_SIG crypto: x86/nh-avx2 - add missing vzeroupper crypto: x86/sha256-avx2 - add missing vzeroupper crypto: x86/sha512-avx2 - add missing vzeroupper fsverity: use register_sysctl_init() to avoid kmemleak warning Eric Dumazet (8): tcp: avoid premature drops in tcp_add_backlog() net: give more chances to rcu in netdev_wait_allrefs_any() usb: aqc111: stop lying about skb->truesize net: usb: sr9700: stop lying about skb->truesize net: usb: smsc95xx: stop lying about skb->truesize af_packet: do not call packet_read_pending() from tpacket_destruct_skb() netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() net: fix __dst_negative_advice() race Eric Garver (1): netfilter: nft_fib: allow from forward/input without iif selector Eric Sandeen (1): openpromfs: finish conversion to the new mount API Eugen Hristev (1): media: mediatek: vcodec: fix possible unbalanced PM counter Fabio Estevam (4): media: dt-bindings: ovti,ov2680: Fix the power supply names media: ov2680: Clear the 'ret' variable on success media: ov2680: Allow probing if link-frequencies is absent media: ov2680: Do not fail if data-lanes property is absent Fedor Pchelkin (3): dma-mapping: benchmark: fix up kthread-related error handling dma-mapping: benchmark: fix node id validation dma-mapping: benchmark: handle NUMA_NO_NODE correctly Felix Fietkau (2): wifi: mt76: mt7603: fix tx queue of loopback packets wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset Felix Kuehling (1): drm/amdgpu: Update BO eviction priorities Fenglin Wu (1): Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation Filipe Manana (1): btrfs: fix leak of qgroup extent records after transaction abort Finn Thain (1): m68k: mac: Fix reboot hang on Mac IIci Florian Fainelli (1): net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled Florian Westphal (1): netfilter: tproxy: bail out if IP has been disabled on the device Frank Li (5): i3c: add actual_len in i3c_priv_xfer i3c: master: svc: rename read_len as actual_len i3c: master: svc: return actual transfer data len i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame i3c: master: svc: fix invalidate IBI type and miss call client IBI handler Frank van der Linden (2): mm/cma: drop incorrect alignment check in cma_init_reserved_mem mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid Friedrich Vock (1): bpf: Fix potential integer overflow in resolve_btfids Gabor Juhos (2): clk: qcom: clk-alpha-pll: remove invalid Stromer register offset clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs Gabriel Krisman Bertazi (2): io-wq: write next_work before dropping acct_lock udp: Avoid call to compute_score on multiple sites Gal Pressman (2): net/mlx5: Fix MTMP register capability offset in MCAM register net/mlx5e: Fix UDP GSO for encapsulated packets Gao Xiang (1): erofs: avoid allocating DEFLATE streams before mounting Geert Uytterhoeven (5): sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() printk: Let no_printk() use _printk() dev_printk: Add and use dev_no_printk() clk: renesas: r8a779a0: Fix CANFD parent clock dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties Geliang Tang (3): selftests/bpf: Fix umount cgroup2 error in test_sockmap selftests/bpf: Fix a fd leak in error paths in open_netns selftests: mptcp: add ms units for tc-netem delay Gerald Loacker (3): drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel Gerd Hoffmann (1): KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID Guenter Roeck (3): mm/slub, kunit: Use inverted data to corrupt kmem cache Revert "sh: Handle calling csum_partial with misaligned data" hwmon: (shtc1) Fix property misspelling Guixiong Wei (1): x86/boot: Ignore relocations in .notes sections in walk_relocs() too Hailong.Liu (1): mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL Hangbin Liu (3): ipv6: sr: add missing seg6_local_exit ipv6: sr: fix incorrect unregister order ipv6: sr: fix invalid unregister error path Hannah Peuckmann (1): riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware Hannes Reinecke (1): nvme-tcp: add definitions for TLS cipher suites Hans Verkuil (6): media: cec: cec-adap: always cancel work in cec_transmit_msg_fh media: cec: cec-api: add locking in cec_release() media: cec: core: avoid recursive cec_claim_log_addrs media: cec: core: avoid confusing "transmit timed out" message media: mc: mark the media devnode as registered from the, start media: v4l2-core: hold videodev_lock until dev reg, finishes Hans de Goede (8): ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too iio: accel: mxc4005: Reset chip on probe() and resume() platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit() mmc: core: Add mmc_gpiod_set_cd_config() function mmc: sdhci-acpi: Sort DMI quirks alphabetically mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on Asus T100TA Harald Freudenberger (2): s390/cpacf: Split and rework cpacf query functions s390/cpacf: Make use of invalid opcode produce a link error Hariprasad Kelam (1): Octeontx2-pf: Free send queue buffers incase of leaf to inner He Zhe (1): perf bench internals inject-build-id: Fix trap divide when collecting just one DSO Hechao Li (1): tcp: increase the default TCP scaling ratio Heiko Carstens (1): s390/vdso: Use standard stack frame layout Heiner Kallweit (1): Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already" Helen Koike (2): drm/ci: uprev mesa version: fix container build & crosvm drm/ci: add subset-1-gfx to LAVA_TAGS and adjust shards Helge Deller (2): parisc: Define HAVE_ARCH_HUGETLB_UNMAPPED_AREA parisc: Define sigset_t in parisc uapi header Henry Wang (1): drivers/xen: Improve the late XenStore init protocol Herve Codina (1): net: lan966x: remove debugfs directory in probe() error path Himanshu Madhani (1): scsi: qla2xxx: Fix debugfs output for fw_resource_count Horatiu Vultur (3): net: micrel: Fix receiving the timestamp in the frame for lan8841 net: lan966x: Remove ptp traps in case the ptp is not enabled. net: micrel: Fix lan8841_config_intr after getting out of sleep mode Hsin-Te Yuan (2): drm/bridge: anx7625: Update audio status while detecting ASoC: mediatek: mt8192: fix register configuration for tdm Huacai Chen (1): LoongArch: Fix callchain parse error with kernel tracepoint events again Huai-Yuan Liu (1): ppdev: Add an error check in register_device Hugo Villeneuve (3): serial: sc16is7xx: add proper sched.h include for sched_set_fifo() serial: sc16is7xx: replace hardcoded divisor value with BIT() macro serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler INAGAKI Hiroshi (1): block: fix and simplify blkdevparts= cmdline parsing Ian Rogers (14): perf record: Delete session after stopping sideband thread perf record: Lazy load kernel symbols perf machine thread: Remove exited threads by default perf bench uprobe: Remove lib64 from libc.so.6 binary path perf docs: Document bpf event modifier perf ui browser: Don't save pointer to stack memory perf ui browser: Avoid SEGV on title perf report: Avoid SEGV in report__setup_sample_type() perf thread: Fixes to thread__new() related to initializing comm perf maps: Move symbol maps functions to maps.c libsubcmd: Fix parse-options memory leak perf stat: Don't display metric header for non-leader uncore events perf tools: Use pmus to describe type from attribute perf tools: Add/use PMU reverse lookup from config to name Igor Artemiev (1): wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class Ilpo Järvinen (2): PCI: Wait for Link Training==0 before starting Link retrain EDAC/igen6: Convert PCIBIOS_* return codes to errnos Ilya Leoshkevich (1): s390/bpf: Emit a barrier for BPF_FETCH instructions Irui Wang (1): media: mediatek: vcodec: add encoder power management helper functions Jack Yu (4): ASoC: rt722-sdca: modify channel number to support 4 channels ASoC: rt722-sdca: add headset microphone vrefo setting ASoC: rt715: add vendor clear control register ASoC: rt715-sdca: volume step modification Jacob Keller (2): Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI" ice: fix accounting if a VLAN already exists Jaegeuk Kim (3): f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC f2fs: kill heap-based allocation f2fs: deprecate io_bits Jaewon Kim (1): clk: samsung: exynosautov9: fix wrong pll clock id value Jagan Teki (1): drm/bridge: Fix improper bridge init order with pre_enable_prev_first Jakub Kicinski (2): selftests: net: add missing config for amt.sh selftests: net: move amt to socat for better compatibility James Clark (6): perf tests: Make "test data symbol" more robust on Neoverse N1 perf tests: Apply attributes to all events in object code reading test perf test shell arm_coresight: Increase buffer size for Coresight basic tests perf symbols: Fix ownership of string in dso__load_vmlinux() perf test: Add a test for strcmp_cpuid_str() expression perf pmu: Move pmu__find_core_pmu() to pmus.c Jan Beulich (1): tpm_tis: Do *not* flush uninitialized work Jan Kara (2): ext4: avoid excessive credit estimate in ext4_tmpfile() udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb() Jason Gunthorpe (1): IB/mlx5: Use __iowrite64_copy() for write combining stores Jens Axboe (1): io_uring: use the right type for work_llist empty check Jens Remus (1): s390/vdso: Generate unwind information for C modules Jiaxun Yang (2): LoongArch: Add all CPUs enabled by fdt to NUMA node 0 LoongArch: Override higher address bits in JUMP_VIRT_ADDR Jing Zhang (1): perf pmu: "Compat" supports regular expression matching identifiers Jiri Olsa (1): libbpf: Fix error message in attach_kprobe_multi Johan Hovold (4): dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references arm64: dts: qcom: qcs404: fix bluetooth device address arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP HID: i2c-hid: elan: fix reset suspend current leakage Johannes Berg (8): wifi: mac80211: don't use rate mask for scanning wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() wifi: iwlwifi: mvm: allocate STA links only for active links wifi: iwlwifi: mvm: select STA mask only for active links wifi: iwlwifi: reconfigure TLC during HW restart wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask wifi: iwlwifi: mvm: init vif works only once um: vector: fix bpfflash parameter evaluation John Hubbard (2): selftests/binderfs: use the Makefile's rules, not Make's implicit rules selftests/resctrl: fix clang build failure: use LOCAL_HDRS John Kacur (1): rtla/timerlat: Fix histogram report when a cpu count is 0 Jonathan Cameron (1): iio: adc: stm32: Fixing err code to not indicate success Jorge Ramirez-Ortiz (1): mmc: core: Do not force a retune before RPMB switch Joshua Ashton (1): drm/amd/display: Set color_mgmt_changed to true on unsuspend Judith Mendez (6): mmc: sdhci_am654: Add tuning algorithm for delay chain mmc: sdhci_am654: Write ITAPDLY for DDR52 timing mmc: sdhci_am654: Add OTAP/ITAP delay enable mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock mmc: sdhci_am654: Fix ITAPDLY for HS400 timing watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin Juergen Gross (3): x86/pat: Introduce lookup_address_in_pgd_attr() x86/pat: Restructure _lookup_address_cpa() x86/pat: Fix W^X violation false-positives when running as Xen PV guest KaiLong Wang (1): f2fs: Clean up errors in segment.h Karthikeyan Ramasubramanian (1): platform/chrome: cros_ec: Handle events during suspend after resume completion Kees Cook (1): lkdtm: Disable CFI checking for perms functions Keith Busch (1): nvme-multipath: fix io accounting on failover Konrad Dybcio (1): interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment Konstantin Komarov (4): fs/ntfs3: Remove max link count info display during driver init fs/ntfs3: Taking DOS names into account during link counting fs/ntfs3: Fix case when index is reused during tree transformation fs/ntfs3: Break dir enumeration if directory contents error Krzysztof Kozlowski (7): regulator: qcom-refgen: fix module autoloading regulator: vqmmc-ipq4019: fix module autoloading dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios arm64: tegra: Correct Tegra132 I2C alias ARM: dts: samsung: smdkv310: fix keypad no-autorepeat ARM: dts: samsung: smdk4412: fix keypad no-autorepeat ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat Kuniyuki Iwashima (3): af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. af_unix: Annotate data-race around unix_sk(sk)->addr. af_unix: Read sk->sk_hash under bindlock during bind(). Kuppuswamy Sathyanarayanan (2): PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 Lad Prabhakar (1): clk: renesas: r9a07g043: Add clock and reset entry for PLIC Lancelot SIX (1): drm/amdkfd: Flush the process wq before creating a kfd_process Lang Yu (1): drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms Larysa Zaremba (1): ice: Interpret .set_channels() input differently Laurent Pinchart (4): firmware: raspberrypi: Use correct device for DMA mappings media: v4l2-subdev: Fix stream handling for crop API media: v4l2-subdev: Document and enforce .s_stream() requirements media: vsp1: Remove unbalanced .s_stream(0) calls Le Ma (1): drm/amdgpu: init microcode chip name from ip versions Leo Ma (1): drm/amd/display: Fix DC mode screen flickering on DCN321 Leon Romanovsky (1): RDMA/IPoIB: Fix format truncation compilation errors Li Ma (1): drm/amdgpu/atomfirmware: add intergrated info v2.3 table Li Zhijian (1): cxl/region: Fix cxlr_pmem leaks Lijo Lazar (1): drm/amd/pm: Restore config space after reset Linus Torvalds (2): x86/mm: Remove broken vsyscall emulation code from the page fault code epoll: be better about file lifetimes Linus Walleij (1): net: ethernet: cortina: Locking fixes Lorenzo Bianconi (1): wifi: mt76: mt7915: workaround too long expansion sparse warnings Luca Ceresoli (2): iio: accel: mxc4005: allow module autoloading via OF compatible Revert "drm/bridge: ti-sn65dsi83: Fix enable error path" Lucas Karpinski (1): selftests/net: synchronize udpgro tests' tx and rx connection Luke D. Jones (1): ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp MD Danish Anwar (1): net: ti: icssg-prueth: Fix start counter for ft1 filter Maher Sanalla (2): net/mlx5: Reload only IB representors upon lag disable/enable net/mlx5: Lag, do bond only if slaves agree on roce state Marc Dionne (1): afs: Don't cross .backup mountpoint from backup volume Marc Gonzalez (1): clk: qcom: mmcc-msm8998: fix venus clock issue Marc Zyngier (3): KVM: arm64: Fix AArch32 register narrowing on userspace write KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode KVM: arm64: AArch32: Fix spurious trapping of conditional instructions Marek Szyprowski (1): Input: cyapa - add missing input core locking to suspend/resume functions Marek Vasut (2): drm/lcdif: Do not disable clocks on already suspended hardware drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector Marijn Suijten (2): drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk drm/msm/dpu: Always flush the slave INTF on the CTL Mario Limonciello (2): drm/amd/display: Enable colorspace property for MST connectors drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms Martin K. Petersen (1): scsi: core: Handle devices which return an unusually large VPD page count Martin Kaiser (1): nfs: keep server info for remounts Masahiro Yamada (2): x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y kconfig: fix comparison to constant symbols, 'm', 'n' Masami Hiramatsu (Google) (1): selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly Mathieu Othacehe (1): net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 Matthew Bystrin (1): riscv: stacktrace: fixed walk_stackframe() Matthew Mirvish (1): bcache: fix variable length array abuse in btree_iter Matthew Wilcox (Oracle) (1): udf: Convert udf_expand_file_adinicb() to use a folio Matthias Schiffer (2): net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches Matthieu Baerts (NGI0) (4): mptcp: SO_KEEPALIVE: fix getsockopt support selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky selftests: mptcp: join: mark 'fail' tests as flaky mptcp: fix full TCP keep-alive support Matti Vaittinen (5): regulator: irq_helpers: duplicate IRQ name watchdog: bd9576: Drop "always-running" property regulator: bd71828: Don't overwrite runtime voltages regulator: pickable ranges: don't always cache vsel regulator: tps6287x: Force writing VSEL bit Maulik Shah (1): soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request Maurizio Lombardi (2): nvmet-auth: return the error code to the nvmet_auth_host_hash() callers nvmet-auth: replace pr_debug() with pr_err() to report an error. Max Krummenacher (1): arm64: dts: ti: verdin-am62: Set memory size to 2gb Maxim Korotkov (1): mtd: rawnand: hynix: fixed typo Maxime Ripard (3): ARM: configs: sunxi: Enable DRM_DW_HDMI drm/sun4i: hdmi: Convert encoder to atomic drm/sun4i: hdmi: Move mode_set into enable Meenakshikumar Somasundaram (1): drm/amd/display: Allocate zero bw after bw alloc enable Michael Ellerman (1): selftests/mm: fix build warnings on ppc64 Michael Schmitz (1): m68k: Fix spinlock race in kernel thread creation Michael Walle (1): drm/bridge: tc358775: fix support for jeida-18 and jeida-24 Michal Schmidt (2): selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Michal Simek (2): microblaze: Remove gcc flag for non existing early_printk.c file microblaze: Remove early printk call from cpuinfo-static.c Mickaël Salaün (1): kunit: Fix kthread reference Miguel Ojeda (1): kheaders: use `command -v` to test for existence of `cpio` Mike Gilbert (1): sparc: move struct termio to asm/termios.h Miklos Szeredi (1): ovl: remove upper umask handling from ovl_create_upper() Ming Lei (2): io_uring: fail NOP if non-zero op flags is passed in blk-cgroup: fix list corruption from resetting io stat Mohamed Ahmed (1): drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations Mukesh Ojha (1): firmware: qcom: scm: Fix __scm and waitq completion variable initialization Mukul Joshi (2): drm/amdkfd: Add VRAM accounting for SVM migration drm/amdgpu: Fix VRAM memory accounting Namhyung Kim (8): perf annotate: Get rid of duplicate --group option item perf annotate: Split branch stack cycles information out of 'struct annotation_line' perf annotate: Introduce global annotation_options perf report: Convert to the global annotation_options perf top: Convert to the global annotation_options perf annotate: Use global annotation_options perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline() perf/arm-dmc620: Fix lockdep assert in ->event_init() Namjae Jeon (2): ksmbd: avoid to send duplicate oplock break notifications ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() Nandor Kracser (1): ksmbd: ignore trailing slashes in share paths Nathan Chancellor (2): media: mxl5xx: Move xpt structures off stack kbuild: Remove support for Clang's ThinLTO caching Nathan Lynch (1): powerpc/pseries/lparcfg: drop error message from guest name lookup Neha Malcom Francis (1): regulator: tps6594-regulator: Correct multi-phase configuration Neil Armstrong (2): phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy drm/meson: gate px_clk when setting rate Nikita Zhandarovich (1): wifi: ar5523: enable proper endpoint verification Nikolay Aleksandrov (1): selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval Nilay Shroff (2): nvme: find numa distance only if controller has valid numa id nvme: cancel pending I/O if nvme controller is in terminal state Nuno Sa (10): iio: adc: ad9467: use spi_get_device_match_data() iio: adc: ad9467: use chip_info variables instead of array iio: adc: adi-axi-adc: convert to regmap iio: buffer-dmaengine: export buffer alloc and free functions iio: add the IIO backend framework iio: adc: ad9467: convert to backend framework iio: adc: adi-axi-adc: move to backend framework iio: adc: adi-axi-adc: only error out in major version mismatch dt-bindings: adc: axi-adc: update bindings for backend framework dt-bindings: adc: axi-adc: add clocks property Nícolas F. R. A. Prado (9): drm/bridge: anx7625: Don't log an error when DSI host can't be found drm/bridge: icn6211: Don't log an error when DSI host can't be found drm/bridge: lt8912b: Don't log an error when DSI host can't be found drm/bridge: lt9611: Don't log an error when DSI host can't be found drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found drm/bridge: tc358775: Don't log an error when DSI host can't be found drm/bridge: dpc3433: Don't log an error when DSI host can't be found drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found clk: mediatek: pllfh: Don't log error for missing fhctl node Oleg Nesterov (1): sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU Olga Kornievskaia (1): pNFS/filelayout: fixup pNfs allocation modes Oliver Upton (1): KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF Or Har-Toov (2): RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent RDMA/mlx5: Adding remote atomic access flag to updatable flags Oswald Buddenhagen (1): ALSA: emu10k1: make E-MU FPGA writes potentially more reliable Pablo Neira Ayuso (2): netfilter: nft_payload: restore vlan q-in-q match support netfilter: nft_payload: skbuff vlan metadata mangle support Paolo Abeni (6): selftests: net: add more missing kernel config net: relax socket state check at accept time. mptcp: avoid some duplicate code in socket option handling mptcp: cleanup SOL_TCP handling selftests: net: included needed helper in the install targets selftests: net: more strict check in net_helper Parthiban Veerasooran (1): net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM Peter Colberg (2): fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor Peter Oberparleiter (1): s390/cio: fix tracepoint subchannel type field Peter Ujfalusi (4): ASoC: SOF: Intel: mtl: Correct rom_status_reg ASoC: SOF: Intel: lnl: Correct rom_status_reg ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed ASoC: SOF: Intel: mtl: Implement firmware boot state check Pierre-Louis Bossart (4): ASoC: da7219-aad: fix usage of device_get_named_child_node() ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions soundwire: cadence: fix invalid PDI offset Pin-yen Lin (1): serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup Ping-Ke Shih (2): wifi: rtw89: correct aSIFSTime for 6GHz band wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command Portia Stephens (1): cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations Pratyush Yadav (1): media: cadence: csi2rx: configure DPHY before starting source stream Prike Liang (1): drm/amdgpu: Fix the ring buffer size for queue VM flush Puranjay Mohan (3): bpf, x86: Fix PROBE_MEM runtime load check riscv, bpf: make some atomic operations fully ordered powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH Rafał Miłecki (1): dt-bindings: pinctrl: mediatek: mt7622: fix array properties Rahul Rameshbabu (2): net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules net/mlx5e: Fix IPsec tunnel mode offload feature check Randy Dunlap (4): fbdev: sh7760fb: allow modular build counter: linux/counter.h: fix Excess kernel-doc description warning extcon: max8997: select IRQ_DOMAIN instead of depending on it media: sunxi: a83-mips-csi2: also select GENERIC_PHY Ranjani Sridharan (1): ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3 Ricardo Ribalda (2): media: radio-shark2: Avoid led_names truncations media: uvcvideo: Add quirk for Logitech Rally Bar Richard Fitzgerald (4): ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() ASoC: cs35l56: Fix to ensure ASP1 registers match cache ALSA: hda: cs35l56: Initialize all ASP1 registers ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance Richard Kinder (1): wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field Rob Herring (1): dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node Roberto Sassu (1): um: Add winch to winch_handlers before registering winch IRQ Roded Zats (1): enic: Validate length of nl attributes in enic_set_vf_port Rodrigo Siqueira (1): drm/amd/display: Add VCO speed parameter for DCN31 FPU Roger Pau Monne (1): xen/x86: add extra pages to unpopulated-alloc if available Romain Gantois (1): net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe() Russell King (Oracle) (1): net: sfp-bus: fix SFP mode detect from bitrate Ryosuke Yasuoka (2): nfc: nci: Fix uninit-value in nci_rx_work nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() Sagi Grimberg (3): nvmet-tcp: fix possible memory leak when tearing down a controller nvmet: fix nvme status code when namespace is disabled nvmet: fix ns enable/disable possible hang Sahil Siddiq (1): bpftool: Mount bpffs on provided dir instead of parent dir Sai Pavan Boddu (1): i2c: cadence: Avoid fifo clear after start Sakari Ailus (3): media: ipu3-cio2: Request IRQ earlier media: v4l: Don't turn on privacy LED if streamon fails media: v4l: async: Don't set notifier's V4L2 device if registering fails Sam Ravnborg (1): sparc64: Fix number of online CPUs Samasth Norway Ananda (1): perf daemon: Fix file leak in daemon_session__control Sean Christopherson (1): cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n Sean Young (1): pwm: Rename pwm_apply_state() to pwm_apply_might_sleep() Sebastian Urban (1): Bluetooth: compute LE flow credits based on recvbuf space Selvin Xavier (3): RDMA/bnxt_re: Update the HW interface definitions RDMA/bnxt_re: Adds MSN table capability for Gen P7 adapters RDMA/bnxt_re: Fix the sparse warnings Sergey Matyukevich (1): riscv: prevent pt_regs corruption for secondary idle threads Sergey Shtylyov (2): ata: pata_legacy: make legacy_exit() work again nfs: fix undefined behavior in nfs_block_bits() Shay Agroskin (1): net: ena: Fix redundant device NUMA node override Shay Drory (1): net/mlx5: Enable 4 ports multiport E-switch Shenghao Ding (3): ASoC: tas2781: Fix a warning reported by robot kernel test ASoC: tas2552: Add TX path for capturing AUDIO-OUT data ASoC: tas2781: Fix wrong loading calibrated data sequence Shengyu Qu (1): riscv: dts: starfive: Remove PMIC interrupt info for Visionfive 2 board Shrikanth Hegde (2): sched/fair: Add EAS checks before updating root_domain::overutilized powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp Shuah Khan (1): tools/latency-collector: Fix -Wformat-security compile warns Souradeep Chakrabarti (1): net: mana: Fix the extra HZ in mana_hwc_send_request Srinivas Pandruvada (3): platform/x86: ISST: Add Grand Ridge to HPM CPU list platform/x86/intel/tpmi: Handle error from tpmi_process_info() platform/x86/intel-uncore-freq: Don't present root domain on error Srinivasan Shanmugam (2): drm/amd/display: Fix potential index out of bounds in color transformation function drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() Stefan Berger (1): crypto: ecdsa - Fix module auto-load on add-key Stefan Binding (1): ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config Steven Rostedt (1): ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value Steven Rostedt (Google) (7): eventfs: Do not differentiate the toplevel events directory eventfs: Create eventfs_root_inode to store dentry eventfs/tracing: Add callback for release of an eventfs_inode eventfs: Free all of the eventfs_inode after RCU eventfs: Have "events" directory get permissions from its parent eventfs: Keep the directories from having the same inode number as files tracefs: Clear EVENT_INODE flag in tracefs_drop_inode() Su Hui (1): wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() Sumanth Korikkar (1): s390/vdso64: filter out munaligned-symbols flag for vdso Sung Joon Kim (1): drm/amd/display: Disable seamless boot on 128b/132b encoding Suzuki K Poulose (4): coresight: etm4x: Do not hardcode IOMEM access for register restore coresight: etm4x: Do not save/restore Data trace control registers coresight: etm4x: Safe access for TRCQCLTR coresight: etm4x: Fix access to resource selector registers Sven Schnelle (1): s390/boot: Remove alt_stfle_fac_list from decompressor Swapnil Patel (1): drm/amd/display: Add dtbclk access to dcn315 Taehee Yoo (1): selftests: net: kill smcrouted in the cleanup logic in amt.sh Takashi Iwai (9): ALSA: jack: Use guard() for locking ALSA: core: Remove debugfs at disconnection ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion ALSA: seq: Fix yet another spot for system message conversion ALSA: seq: ump: Fix swapped song position pointer data ALSA: ump: Don't clear bank selection after sending a program change ALSA: ump: Don't accept an invalid UMP protocol number ALSA: seq: Fix incorrect UMP type for system messages Thomas Haemmerle (1): iio: pressure: dps310: support negative temperature values Thomas Richter (1): perf stat: Do not fail on metrics on s390 z/VM systems Thomas Weißschuh (2): misc/pvpanic: deduplicate common code misc/pvpanic-pci: register attributes via pci_driver Thomas Zimmermann (2): fbdev: Provide I/O-memory helpers as module drm/fbdev-generic: Do not set physical framebuffer address Thorsten Blum (1): net: smc91x: Fix m68k kernel compilation for ColdFire CPU Tianchen Ding (1): selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted without nsdelegate Tiwei Bie (3): um: Fix the -Wmissing-prototypes warning for __switch_mm um: Fix the -Wmissing-prototypes warning for get_thread_reg um: Fix the declaration of kasan_map_memory Tony Lindgren (2): drm/omapdrm: Fix console by implementing fb_dirty drm/omapdrm: Fix console with deferred ops Tristram Ha (1): net: dsa: microchip: fix RGMII error in KSZ DSA driver Tyler Hicks (Microsoft) (1): proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation Uros Bizjak (1): locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() Uwe Kleine-König (5): pwm: sti: Prepare removing pwm_chip from driver data pwm: sti: Simplify probe function using devm functions media: i2c: et8ek8: Don't strip remove function when driver is builtin leds: pwm: Disable PWM when going to suspend spi: stm32: Don't warn about spurious interrupts Valentin Obst (1): selftests: default to host arch for LLVM builds Vicki Pfau (1): Input: xpad - add support for ASUS ROG RAIKIRI Vidya Sagar (1): PCI: tegra194: Fix probe path for Endpoint mode Vignesh Raghavendra (1): mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel Vignesh Raman (1): drm/ci: update device type for volteer devices Ville Syrjälä (1): drm/edid: Parse topology block for all DispID structure v1.x Viresh Kumar (1): cpufreq: exit() callback is optional Vitalii Bursov (1): sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level Vitaly Chikunov (1): crypto: ecrdsa - Fix module auto-load on add_key Vladimir Oltean (2): net/sched: taprio: make q->picos_per_byte available to fill_sched_entry() net/sched: taprio: extend minimum interval restriction to entire cycle too Waiman Long (1): blk-cgroup: Properly propagate the iostat update up the hierarchy Wei Fang (1): net: fec: avoid lock evasion when reading pps_enable Wenjing Liu (1): drm/amd/display: Revert Remove pixle rate limit for subvp Wojciech Macek (1): drm/mediatek: dp: Fix mtk_dp_aux_transfer return value Wolfram Sang (2): dt-bindings: PCI: rcar-pci-host: Add optional regulators serial: sh-sci: protect invalidating RXDMA on shutdown Wu Bo (1): f2fs: fix block migration when section is not aligned to pow2 Xianwei Zhao (1): arm64: dts: meson: fix S4 power-controller node Xiaolei Wang (1): net:fec: Add fec_enet_deinit() Xingui Yang (1): scsi: libsas: Fix the failure of adding phy with zero-address to port Xu Yang (1): filemap: add helper mapping_max_folio_size() Yang Jihong (4): perf evlist: Add evlist__findnew_tracking_event() helper perf record: Move setting tracking events before record__init_thread_masks() perf evlist: Add perf_evlist__go_system_wide() helper perf sched timehist: Fix -g/--call-graph option failure Yang Li (1): rv: Update rv_en(dis)able_monitor doc to match kernel-doc Yang Xiwen (1): arm64: dts: hi3798cv200: fix the size of GICR Yong Zhi (1): ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails Yonghong Song (1): bpftool: Fix missing pids during link show Yu Kuai (1): md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Yuanyuan Zhong (1): mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again Yue Haibing (1): ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Yuri Karpov (1): scsi: hpsa: Fix allocation size for Scsi_Host private data Zenghui Yu (2): irqchip/alpine-msi: Fix off-by-one in allocation error path irqchip/loongson-pch-msi: Fix off-by-one on allocation error path Zhang Yi (1): ext4: remove the redundant folio_wait_stable() Zhipeng Lu (1): media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries Zhu Yanjun (3): null_blk: Fix missing mutex_destroy() at module removal RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() Zqiang (1): softirq: Fix suspicious RCU usage in __do_softirq() end.to.start (1): ASoC: acp: Support microphone from device Acer 315-24p gaoxingwang (1): net: ipv6: fix wrong start position when receive hop-by-hop fragment xu xin (1): net/ipv6: Fix route deleting failure when metric equals 0 .../admin-guide/kernel-parameters.txt | 3 + .../bindings/iio/adc/adi,axi-adc.yaml | 13 +- .../bindings/media/i2c/ovti,ov2680.yaml | 18 +- .../bindings/pci/rcar-pci-host.yaml | 14 + .../bindings/pci/rockchip,rk3399-pcie.yaml | 1 + .../phy/qcom,sc8280xp-qmp-ufs-phy.yaml | 16 +- .../bindings/phy/qcom,usb-snps-femto-v2.yaml | 4 +- .../pinctrl/mediatek,mt7622-pinctrl.yaml | 92 ++-- .../devicetree/bindings/soc/rockchip/grf.yaml | 1 + .../devicetree/bindings/sound/rt5645.txt | 6 + .../spmi/hisilicon,hisi-spmi-controller.yaml | 4 +- .../thermal/loongson,ls2k-thermal.yaml | 34 +- Documentation/driver-api/pwm.rst | 8 +- Documentation/filesystems/f2fs.rst | 6 +- MAINTAINERS | 10 +- Makefile | 5 +- .../boot/dts/samsung/exynos4210-smdkv310.dts | 2 +- .../boot/dts/samsung/exynos4412-origen.dts | 2 +- .../boot/dts/samsung/exynos4412-smdk4412.dts | 2 +- arch/arm/configs/sunxi_defconfig | 1 + arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 13 +- .../arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 2 +- .../arm64/boot/dts/nvidia/tegra132-norrin.dts | 4 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcs404-evb.dtsi | 2 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- arch/arm64/kvm/guest.c | 3 +- arch/arm64/kvm/hyp/aarch32.c | 18 +- arch/loongarch/include/asm/numa.h | 1 + arch/loongarch/include/asm/perf_event.h | 3 +- arch/loongarch/include/asm/stackframe.h | 2 +- arch/loongarch/kernel/perf_event.c | 2 +- arch/loongarch/kernel/smp.c | 5 +- arch/m68k/kernel/entry.S | 4 +- arch/m68k/mac/misc.c | 36 +- arch/microblaze/kernel/Makefile | 1 - arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 +- arch/parisc/include/asm/page.h | 1 + arch/parisc/include/asm/signal.h | 12 - arch/parisc/include/uapi/asm/signal.h | 10 + arch/parisc/kernel/parisc_ksyms.c | 1 + arch/powerpc/include/asm/hvcall.h | 2 +- arch/powerpc/net/bpf_jit_comp32.c | 12 + arch/powerpc/net/bpf_jit_comp64.c | 12 + arch/powerpc/platforms/pseries/lpar.c | 6 +- arch/powerpc/platforms/pseries/lparcfg.c | 10 +- arch/powerpc/sysdev/fsl_msi.c | 2 + .../jh7110-starfive-visionfive-2.dtsi | 41 -- arch/riscv/kernel/cpu_ops_sbi.c | 2 +- arch/riscv/kernel/cpu_ops_spinwait.c | 3 +- arch/riscv/kernel/stacktrace.c | 20 +- arch/riscv/net/bpf_jit_comp64.c | 20 +- arch/s390/boot/startup.c | 1 - arch/s390/include/asm/cpacf.h | 109 ++++- arch/s390/include/asm/gmap.h | 2 +- arch/s390/include/asm/mmu.h | 5 + arch/s390/include/asm/mmu_context.h | 1 + arch/s390/include/asm/pgtable.h | 16 +- arch/s390/kernel/ipl.c | 10 +- arch/s390/kernel/setup.c | 2 +- arch/s390/kernel/vdso32/Makefile | 4 +- arch/s390/kernel/vdso64/Makefile | 5 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/s390/mm/gmap.c | 165 +++++-- arch/s390/net/bpf_jit_comp.c | 8 +- arch/sh/kernel/kprobes.c | 7 +- arch/sh/lib/checksum.S | 67 +-- arch/sparc/include/asm/smp_64.h | 2 - arch/sparc/include/uapi/asm/termbits.h | 10 - arch/sparc/include/uapi/asm/termios.h | 9 + arch/sparc/kernel/prom_64.c | 4 +- arch/sparc/kernel/setup_64.c | 1 - arch/sparc/kernel/smp_64.c | 14 - arch/um/drivers/line.c | 14 +- arch/um/drivers/ubd_kern.c | 4 +- arch/um/drivers/vector_kern.c | 2 +- arch/um/include/asm/kasan.h | 1 - arch/um/include/asm/mmu.h | 2 - arch/um/include/asm/processor-generic.h | 1 - arch/um/include/shared/kern_util.h | 2 + arch/um/include/shared/skas/mm_id.h | 2 + arch/um/os-Linux/mem.c | 1 + arch/x86/Kconfig | 8 +- arch/x86/Kconfig.debug | 5 +- arch/x86/boot/compressed/head_64.S | 5 + arch/x86/crypto/nh-avx2-x86_64.S | 1 + arch/x86/crypto/sha256-avx2-asm.S | 1 + arch/x86/crypto/sha512-avx2-asm.S | 1 + arch/x86/entry/vsyscall/vsyscall_64.c | 28 +- arch/x86/include/asm/cmpxchg_64.h | 2 +- arch/x86/include/asm/pgtable_types.h | 2 + arch/x86/include/asm/processor.h | 1 - arch/x86/kernel/tsc_sync.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/lib/x86-opcode-map.txt | 10 +- arch/x86/mm/fault.c | 33 +- arch/x86/mm/pat/set_memory.c | 68 ++- arch/x86/net/bpf_jit_comp.c | 57 ++- arch/x86/pci/mmconfig-shared.c | 40 +- arch/x86/purgatory/Makefile | 3 +- arch/x86/tools/relocs.c | 9 + arch/x86/um/shared/sysdep/archsetjmp.h | 7 + arch/x86/xen/enlighten.c | 33 ++ block/blk-cgroup.c | 77 +++- block/partitions/cmdline.c | 49 +- crypto/asymmetric_keys/Kconfig | 1 + crypto/ecdsa.c | 3 + crypto/ecrdsa.c | 1 + drivers/accel/ivpu/ivpu_job.c | 3 +- drivers/acpi/acpi_lpss.c | 1 + drivers/acpi/acpica/Makefile | 1 + drivers/acpi/resource.c | 12 + drivers/ata/pata_legacy.c | 8 +- drivers/base/base.h | 9 +- drivers/base/bus.c | 9 +- drivers/base/module.c | 42 +- drivers/block/null_blk/main.c | 3 + drivers/bluetooth/btqca.c | 4 +- drivers/char/ppdev.c | 21 +- drivers/char/tpm/tpm_tis_core.c | 3 +- drivers/clk/clk-renesas-pcie.c | 10 +- drivers/clk/mediatek/clk-mt8365-mm.c | 2 +- drivers/clk/mediatek/clk-pllfh.c | 2 +- drivers/clk/qcom/clk-alpha-pll.c | 3 +- drivers/clk/qcom/dispcc-sm6350.c | 11 +- drivers/clk/qcom/dispcc-sm8450.c | 20 +- drivers/clk/qcom/dispcc-sm8550.c | 20 +- drivers/clk/qcom/mmcc-msm8998.c | 8 + drivers/clk/renesas/r8a779a0-cpg-mssr.c | 2 +- drivers/clk/renesas/r9a07g043-cpg.c | 9 + drivers/clk/samsung/clk-exynosautov9.c | 8 +- drivers/cpufreq/amd-pstate.c | 2 +- drivers/cpufreq/brcmstb-avs-cpufreq.c | 5 +- drivers/cpufreq/cpufreq.c | 11 +- drivers/crypto/ccp/sp-platform.c | 14 +- drivers/cxl/core/region.c | 1 + drivers/cxl/core/trace.h | 4 +- drivers/dma-buf/st-dma-fence-chain.c | 12 +- drivers/dma-buf/st-dma-fence.c | 4 +- drivers/dma/idma64.c | 4 +- drivers/edac/igen6_edac.c | 4 +- drivers/extcon/Kconfig | 3 +- drivers/firmware/dmi-id.c | 7 +- drivers/firmware/efi/libstub/x86-stub.c | 28 +- drivers/firmware/qcom_scm.c | 10 +- drivers/firmware/raspberrypi.c | 7 +- drivers/fpga/dfl-pci.c | 3 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 +- .../gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 8 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 16 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 + .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 + .../display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 15 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 + .../amd/display/dc/dcn10/dcn10_cm_common.c | 5 + .../drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 2 + .../dc/link/protocols/link_dp_dpia_bw.c | 10 +- drivers/gpu/drm/amd/include/atomfirmware.h | 43 ++ .../drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 20 +- .../drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 25 ++ drivers/gpu/drm/bridge/analogix/anx7625.c | 15 +- drivers/gpu/drm/bridge/chipone-icn6211.c | 6 +- drivers/gpu/drm/bridge/lontium-lt8912b.c | 6 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 6 +- drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 6 +- drivers/gpu/drm/bridge/tc358775.c | 27 +- drivers/gpu/drm/bridge/ti-dlpc3433.c | 17 +- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 - drivers/gpu/drm/ci/build.yml | 1 + drivers/gpu/drm/ci/gitlab-ci.yml | 22 +- drivers/gpu/drm/ci/image-tags.yml | 2 +- drivers/gpu/drm/ci/lava-submit.sh | 2 +- drivers/gpu/drm/ci/test.yml | 27 +- drivers/gpu/drm/display/drm_dp_helper.c | 35 ++ drivers/gpu/drm/drm_bridge.c | 10 +- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/drm_fbdev_generic.c | 1 - drivers/gpu/drm/drm_mipi_dsi.c | 6 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 4 +- .../gpu/drm/i915/display/intel_backlight.c | 6 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 + drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 2 +- drivers/gpu/drm/i915/gt/intel_gt_types.h | 8 + drivers/gpu/drm/i915/gt/selftest_migrate.c | 4 +- drivers/gpu/drm/i915/gt/uc/abi/guc_klvs_abi.h | 6 +- drivers/gpu/drm/i915/gvt/interrupt.c | 13 +- drivers/gpu/drm/mediatek/mtk_dp.c | 2 +- drivers/gpu/drm/meson/meson_dw_mipi_dsi.c | 7 + drivers/gpu/drm/meson/meson_vclk.c | 6 +- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 - drivers/gpu/drm/msm/dp/dp_aux.c | 20 + drivers/gpu/drm/msm/dp/dp_aux.h | 1 + drivers/gpu/drm/msm/dp/dp_ctrl.c | 6 +- drivers/gpu/drm/msm/dp/dp_display.c | 4 + drivers/gpu/drm/msm/dp/dp_link.c | 22 +- drivers/gpu/drm/msm/dp/dp_link.h | 14 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 10 +- drivers/gpu/drm/mxsfb/lcdif_drv.c | 6 +- drivers/gpu/drm/nouveau/nouveau_abi16.c | 12 + drivers/gpu/drm/nouveau/nouveau_bo.c | 44 +- drivers/gpu/drm/omapdrm/Kconfig | 2 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 40 +- drivers/gpu/drm/panel/panel-edp.c | 3 + drivers/gpu/drm/panel/panel-novatek-nt35950.c | 6 +- .../gpu/drm/panel/panel-samsung-atna33xc20.c | 24 +- drivers/gpu/drm/panel/panel-simple.c | 3 + .../gpu/drm/panel/panel-sitronix-st7789v.c | 16 +- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 22 +- drivers/gpu/drm/solomon/ssd130x.c | 2 +- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 47 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 2 + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 10 + drivers/hid/hid-mcp2221.c | 2 + drivers/hid/i2c-hid/i2c-hid-of-elan.c | 59 ++- drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 + drivers/hwmon/intel-m10-bmc-hwmon.c | 2 +- drivers/hwmon/pwm-fan.c | 8 +- drivers/hwmon/shtc1.c | 2 +- .../coresight/coresight-etm4x-core.c | 29 +- drivers/hwtracing/coresight/coresight-etm4x.h | 31 +- drivers/hwtracing/intel_th/pci.c | 5 + drivers/hwtracing/stm/core.c | 11 +- drivers/i2c/busses/i2c-cadence.c | 1 + drivers/i2c/busses/i2c-synquacer.c | 20 +- drivers/i3c/master/svc-i3c-master.c | 52 ++- drivers/iio/Kconfig | 9 + drivers/iio/Makefile | 1 + drivers/iio/accel/mxc4005.c | 76 ++++ drivers/iio/adc/Kconfig | 6 +- drivers/iio/adc/ad9467.c | 310 ++++++++----- drivers/iio/adc/adi-axi-adc.c | 408 +++++------------ drivers/iio/adc/stm32-adc.c | 1 + .../buffer/industrialio-buffer-dmaengine.c | 8 +- drivers/iio/industrialio-backend.c | 418 ++++++++++++++++++ drivers/iio/industrialio-core.c | 6 +- drivers/iio/pressure/dps310.c | 11 +- drivers/infiniband/core/cma.c | 4 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 57 ++- drivers/infiniband/hw/bnxt_re/ib_verbs.h | 7 + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 208 +++++---- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 34 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 19 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 4 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.h | 46 +- drivers/infiniband/hw/bnxt_re/roce_hsi.h | 67 ++- drivers/infiniband/hw/mlx5/mem.c | 8 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- drivers/infiniband/hw/mlx5/mr.c | 3 +- drivers/infiniband/sw/rxe/rxe_net.c | 12 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 6 +- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 +- drivers/input/input.c | 104 ++++- drivers/input/joystick/xpad.c | 2 + drivers/input/misc/da7280.c | 4 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/misc/pm8xxx-vibrator.c | 7 +- drivers/input/misc/pwm-beeper.c | 4 +- drivers/input/misc/pwm-vibra.c | 8 +- drivers/input/mouse/cyapa.c | 12 +- drivers/interconnect/qcom/qcm2290.c | 2 +- drivers/irqchip/irq-alpine-msi.c | 2 +- drivers/irqchip/irq-loongson-pch-msi.c | 2 +- drivers/leds/leds-pwm.c | 10 +- drivers/leds/rgb/leds-pwm-multicolor.c | 4 +- drivers/md/bcache/bset.c | 44 +- drivers/md/bcache/bset.h | 28 +- drivers/md/bcache/btree.c | 40 +- drivers/md/bcache/super.c | 5 +- drivers/md/bcache/sysfs.c | 2 +- drivers/md/bcache/writeback.c | 10 +- drivers/md/raid5.c | 15 +- drivers/media/cec/core/cec-adap.c | 24 +- drivers/media/cec/core/cec-api.c | 5 +- drivers/media/dvb-frontends/mxl5xx.c | 22 +- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 +- drivers/media/i2c/ov2680.c | 13 +- drivers/media/mc/mc-devnode.c | 5 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 10 +- drivers/media/pci/ngene/ngene-core.c | 4 +- drivers/media/platform/cadence/cdns-csi2rx.c | 26 +- .../mediatek/vcodec/encoder/mtk_vcodec_enc.c | 21 +- .../vcodec/encoder/mtk_vcodec_enc_pm.c | 20 + .../vcodec/encoder/mtk_vcodec_enc_pm.h | 3 +- .../mediatek/vcodec/encoder/venc_drv_if.c | 11 +- .../platform/renesas/rcar-vin/rcar-vin.h | 2 +- .../media/platform/renesas/vsp1/vsp1_pipe.c | 2 +- .../media/platform/renesas/vsp1/vsp1_rpf.c | 10 +- .../media/platform/renesas/vsp1/vsp1_rwpf.c | 8 +- .../media/platform/renesas/vsp1/vsp1_rwpf.h | 4 +- .../media/platform/renesas/vsp1/vsp1_wpf.c | 29 +- .../sunxi/sun8i-a83t-mipi-csi2/Kconfig | 1 + drivers/media/radio/radio-shark2.c | 2 +- drivers/media/rc/ir-rx51.c | 4 +- drivers/media/rc/pwm-ir-tx.c | 4 +- drivers/media/usb/b2c2/flexcop-usb.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 31 ++ drivers/media/usb/uvc/uvcvideo.h | 1 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-dev.c | 3 + drivers/media/v4l2-core/v4l2-subdev.c | 39 +- drivers/misc/lkdtm/Makefile | 2 +- drivers/misc/lkdtm/perms.c | 2 +- drivers/misc/pvpanic/pvpanic-mmio.c | 58 +-- drivers/misc/pvpanic/pvpanic-pci.c | 60 +-- drivers/misc/pvpanic/pvpanic.c | 76 +++- drivers/misc/pvpanic/pvpanic.h | 10 +- drivers/misc/vmw_vmci/vmci_guest.c | 10 +- drivers/mmc/core/host.c | 3 +- drivers/mmc/core/slot-gpio.c | 20 + drivers/mmc/host/sdhci-acpi.c | 61 ++- drivers/mmc/host/sdhci.c | 10 +- drivers/mmc/host/sdhci.h | 3 +- drivers/mmc/host/sdhci_am654.c | 205 ++++++--- drivers/mtd/mtdcore.c | 6 +- drivers/mtd/nand/raw/nand_hynix.c | 2 +- drivers/net/Makefile | 4 +- drivers/net/dsa/microchip/ksz_common.c | 2 +- drivers/net/dsa/mv88e6xxx/chip.c | 50 ++- drivers/net/dsa/mv88e6xxx/chip.h | 6 + drivers/net/dsa/mv88e6xxx/global1.c | 89 ++++ drivers/net/dsa/mv88e6xxx/global1.h | 2 + drivers/net/ethernet/amazon/ena/ena_com.c | 326 +++++--------- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 49 +- drivers/net/ethernet/amazon/ena/ena_eth_com.h | 15 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 32 +- drivers/net/ethernet/cisco/enic/enic_main.c | 12 + drivers/net/ethernet/cortina/gemini.c | 12 +- drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 10 + drivers/net/ethernet/freescale/fec_ptp.c | 14 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 19 +- .../net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 11 +- drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 3 - drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 56 +-- .../net/ethernet/marvell/octeontx2/nic/qos.c | 4 + .../mellanox/mlx5/core/en/xsk/setup.c | 6 +- .../mellanox/mlx5/core/en_accel/en_accel.h | 8 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 3 +- .../mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 17 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_tx.c | 6 +- .../ethernet/mellanox/mlx5/core/esw/bridge.c | 2 +- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 4 +- .../mellanox/mlx5/core/eswitch_offloads.c | 28 +- .../net/ethernet/mellanox/mlx5/core/lag/lag.c | 18 +- .../ethernet/mellanox/mlx5/core/lag/mpesw.c | 18 +- .../ethernet/microchip/lan966x/lan966x_main.c | 12 +- .../net/ethernet/microsoft/mana/hw_channel.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 9 +- drivers/net/ethernet/realtek/r8169_main.c | 6 +- drivers/net/ethernet/smsc/smc91x.h | 4 +- .../net/ethernet/ti/icssg/icssg_classifier.c | 2 +- drivers/net/ethernet/ti/icssg/icssg_prueth.c | 14 +- drivers/net/ipvlan/ipvlan_core.c | 4 +- drivers/net/phy/micrel.c | 14 +- drivers/net/phy/sfp-bus.c | 8 +- drivers/net/usb/aqc111.c | 8 +- drivers/net/usb/qmi_wwan.c | 3 + drivers/net/usb/smsc95xx.c | 26 +- drivers/net/usb/sr9700.c | 10 +- drivers/net/vxlan/vxlan_core.c | 4 - drivers/net/wireless/ath/ar5523/ar5523.c | 14 + drivers/net/wireless/ath/ath10k/Kconfig | 1 + drivers/net/wireless/ath/ath10k/core.c | 3 + drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- drivers/net/wireless/ath/ath10k/hw.h | 1 + drivers/net/wireless/ath/ath10k/targaddrs.h | 3 + drivers/net/wireless/ath/ath10k/wmi.c | 26 +- drivers/net/wireless/ath/ath11k/mac.c | 9 +- drivers/net/wireless/ath/ath12k/wmi.c | 2 +- drivers/net/wireless/ath/carl9170/tx.c | 3 +- .../broadcom/brcm80211/brcmfmac/pcie.c | 15 +- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 19 +- .../wireless/intel/iwlwifi/mvm/mld-mac80211.c | 9 +- .../net/wireless/intel/iwlwifi/mvm/mld-sta.c | 19 +- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 + drivers/net/wireless/marvell/mwl8k.c | 2 +- .../net/wireless/mediatek/mt76/mt7603/dma.c | 46 +- .../net/wireless/mediatek/mt76/mt7603/mac.c | 1 + .../wireless/mediatek/mt76/mt7915/debugfs.c | 6 +- .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 25 +- .../wireless/realtek/rtlwifi/rtl8192de/phy.c | 4 +- .../wireless/realtek/rtlwifi/rtl8192de/trx.c | 21 +- .../wireless/realtek/rtlwifi/rtl8192de/trx.h | 79 +--- drivers/net/wireless/realtek/rtw89/mac80211.c | 2 +- drivers/net/wireless/realtek/rtw89/pci.c | 3 +- drivers/net/xen-netback/interface.c | 3 +- drivers/nvme/host/core.c | 23 +- drivers/nvme/host/multipath.c | 6 +- drivers/nvme/host/nvme.h | 22 + drivers/nvme/host/pci.c | 8 +- drivers/nvme/target/auth.c | 8 +- drivers/nvme/target/configfs.c | 20 + drivers/nvme/target/core.c | 5 +- drivers/nvme/target/nvmet.h | 1 + drivers/nvme/target/tcp.c | 11 +- drivers/pci/controller/dwc/pcie-tegra194.c | 3 + drivers/pci/pci.c | 2 +- drivers/pci/pcie/edr.c | 28 +- drivers/perf/arm_dmc620_pmu.c | 9 +- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 2 - drivers/pinctrl/qcom/pinctrl-sm7150.c | 20 +- drivers/platform/chrome/cros_ec.c | 16 +- .../intel/speed_select_if/isst_if_common.c | 1 + drivers/platform/x86/intel/tpmi.c | 7 +- .../uncore-frequency/uncore-frequency-tpmi.c | 7 + drivers/platform/x86/lenovo-yogabook.c | 2 +- drivers/platform/x86/thinkpad_acpi.c | 5 +- drivers/pwm/core.c | 18 +- drivers/pwm/pwm-sti.c | 46 +- drivers/pwm/pwm-twl-led.c | 2 +- drivers/pwm/pwm-vt8500.c | 2 +- drivers/pwm/sysfs.c | 10 +- drivers/regulator/bd71828-regulator.c | 58 +-- drivers/regulator/helpers.c | 43 +- drivers/regulator/irq_helpers.c | 3 + drivers/regulator/pwm-regulator.c | 4 +- drivers/regulator/qcom-refgen-regulator.c | 1 + drivers/regulator/tps6287x-regulator.c | 1 + drivers/regulator/tps6594-regulator.c | 16 +- drivers/regulator/vqmmc-ipq4019-regulator.c | 1 + drivers/s390/cio/trace.h | 2 +- drivers/scsi/bfa/bfad_debugfs.c | 4 +- drivers/scsi/hpsa.c | 2 +- drivers/scsi/libsas/sas_expander.c | 3 +- drivers/scsi/qla2xxx/qla_dfs.c | 2 +- drivers/scsi/scsi.c | 7 + drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +- drivers/soc/qcom/cmd-db.c | 32 +- drivers/soc/qcom/pmic_glink.c | 26 +- drivers/soc/qcom/rpmh-rsc.c | 3 +- drivers/soundwire/cadence_master.c | 2 +- drivers/spi/spi-stm32.c | 2 +- drivers/spi/spi.c | 4 + drivers/staging/greybus/arche-apb-ctrl.c | 1 + drivers/staging/greybus/arche-platform.c | 9 +- drivers/staging/media/atomisp/pci/sh_css.c | 1 + drivers/thermal/qcom/tsens.c | 2 +- drivers/tty/n_gsm.c | 133 ++++-- drivers/tty/serial/8250/8250_bcm7271.c | 101 +++-- drivers/tty/serial/8250/8250_mtk.c | 8 +- drivers/tty/serial/max3100.c | 9 +- drivers/tty/serial/sc16is7xx.c | 27 +- drivers/tty/serial/sh-sci.c | 5 + drivers/ufs/core/ufs-mcq.c | 3 +- drivers/ufs/core/ufshcd.c | 6 +- drivers/ufs/host/cdns-pltfrm.c | 2 +- drivers/ufs/host/ufs-qcom.c | 7 +- drivers/ufs/host/ufs-qcom.h | 12 +- drivers/usb/fotg210/fotg210-core.c | 1 + drivers/usb/gadget/function/u_audio.c | 2 + drivers/usb/typec/ucsi/ucsi.c | 18 +- drivers/usb/usbip/usbip_common.h | 6 - drivers/video/backlight/lm3630a_bl.c | 2 +- drivers/video/backlight/lp855x_bl.c | 2 +- drivers/video/backlight/pwm_bl.c | 12 +- drivers/video/fbdev/Kconfig | 4 +- drivers/video/fbdev/core/Kconfig | 12 + drivers/video/fbdev/core/Makefile | 3 +- drivers/video/fbdev/core/fb_io_fops.c | 3 + drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 +- drivers/video/fbdev/sis/init301.c | 3 +- drivers/video/fbdev/ssd1307fb.c | 2 +- drivers/watchdog/bd9576_wdt.c | 12 +- drivers/watchdog/rti_wdt.c | 34 +- drivers/watchdog/sa1100_wdt.c | 5 +- drivers/xen/xenbus/xenbus_probe.c | 36 +- fs/afs/mntpt.c | 5 + fs/btrfs/disk-io.c | 10 +- fs/dlm/ast.c | 14 + fs/dlm/dlm_internal.h | 1 + fs/dlm/user.c | 15 +- fs/erofs/decompressor_deflate.c | 55 +-- fs/eventpoll.c | 38 +- fs/ext4/inode.c | 3 - fs/ext4/mballoc.c | 1 + fs/ext4/namei.c | 2 +- fs/f2fs/checkpoint.c | 10 +- fs/f2fs/compress.c | 64 ++- fs/f2fs/data.c | 146 ++---- fs/f2fs/debug.c | 6 +- fs/f2fs/dir.c | 5 +- fs/f2fs/f2fs.h | 165 +++---- fs/f2fs/file.c | 123 +++--- fs/f2fs/gc.c | 117 ++--- fs/f2fs/inode.c | 6 + fs/f2fs/node.c | 6 +- fs/f2fs/node.h | 4 +- fs/f2fs/recovery.c | 2 +- fs/f2fs/segment.c | 244 +++++----- fs/f2fs/segment.h | 66 ++- fs/f2fs/super.c | 116 +---- fs/f2fs/sysfs.c | 6 +- fs/gfs2/aops.c | 36 +- fs/gfs2/bmap.c | 4 +- fs/gfs2/dir.c | 2 +- fs/gfs2/file.c | 2 +- fs/gfs2/glock.c | 61 ++- fs/gfs2/glops.c | 5 +- fs/gfs2/inode.c | 15 +- fs/gfs2/inode.h | 6 +- fs/gfs2/lock_dlm.c | 8 +- fs/gfs2/log.c | 21 +- fs/gfs2/meta_io.c | 9 +- fs/gfs2/ops_fstype.c | 27 +- fs/gfs2/quota.c | 8 +- fs/gfs2/recovery.c | 2 +- fs/gfs2/rgrp.c | 12 +- fs/gfs2/rgrp.h | 2 +- fs/gfs2/super.c | 10 +- fs/gfs2/sys.c | 2 +- fs/gfs2/trans.c | 2 +- fs/gfs2/util.c | 5 +- fs/gfs2/util.h | 15 +- fs/gfs2/xattr.c | 6 +- fs/nfs/filelayout/filelayout.c | 4 +- fs/nfs/fs_context.c | 9 +- fs/nfs/internal.h | 4 +- fs/nfs/nfs4proc.c | 2 +- fs/nfs/nfs4state.c | 12 +- fs/nilfs2/ioctl.c | 2 +- fs/ntfs3/dir.c | 1 + fs/ntfs3/index.c | 6 + fs/ntfs3/inode.c | 7 +- fs/ntfs3/record.c | 11 +- fs/ntfs3/super.c | 2 - fs/openpromfs/inode.c | 8 +- fs/overlayfs/dir.c | 3 - fs/proc/fd.c | 42 +- fs/proc/task_mmu.c | 9 +- fs/smb/server/mgmt/share_config.c | 6 +- fs/smb/server/oplock.c | 21 +- fs/smb/server/smb2pdu.c | 4 +- fs/tracefs/event_inode.c | 162 +++++-- fs/tracefs/inode.c | 33 +- fs/tracefs/internal.h | 9 +- fs/udf/inode.c | 27 +- fs/verity/init.c | 7 +- include/drm/display/drm_dp_helper.h | 6 + include/drm/drm_displayid.h | 1 - include/drm/drm_mipi_dsi.h | 6 +- include/linux/acpi.h | 2 +- include/linux/bitops.h | 1 + include/linux/counter.h | 1 - include/linux/cpu.h | 11 + include/linux/dev_printk.h | 25 +- include/linux/f2fs_fs.h | 6 - include/linux/fb.h | 4 + include/linux/fortify-string.h | 22 +- include/linux/i3c/device.h | 2 + include/linux/ieee80211.h | 2 +- include/linux/iio/adc/adi-axi-adc.h | 68 --- include/linux/iio/backend.h | 72 +++ include/linux/iio/buffer-dmaengine.h | 3 + include/linux/kthread.h | 1 + include/linux/mlx5/mlx5_ifc.h | 4 +- include/linux/mmc/slot-gpio.h | 1 + include/linux/nvme-tcp.h | 6 + include/linux/pagemap.h | 34 +- include/linux/printk.h | 2 +- include/linux/pwm.h | 28 +- include/linux/regulator/driver.h | 3 + include/linux/tracefs.h | 3 + include/media/cec.h | 1 + include/media/v4l2-subdev.h | 4 +- include/net/bluetooth/l2cap.h | 11 +- include/net/dst_ops.h | 2 +- include/net/mac80211.h | 3 + include/net/sock.h | 13 +- include/net/tcp.h | 5 +- include/soc/qcom/cmd-db.h | 10 +- include/sound/cs35l56.h | 1 + include/sound/soc-acpi-intel-match.h | 2 + include/sound/tas2781-dsp.h | 7 +- include/trace/events/asoc.h | 2 + include/uapi/drm/nouveau_drm.h | 21 + include/uapi/linux/bpf.h | 2 +- include/uapi/linux/user_events.h | 11 +- include/uapi/rdma/bnxt_re-abi.h | 10 + io_uring/io-wq.c | 13 +- io_uring/io_uring.h | 2 +- io_uring/nop.c | 2 + kernel/bpf/verifier.c | 6 +- kernel/cgroup/cpuset.c | 2 +- kernel/cpu.c | 14 +- kernel/debug/kdb/kdb_io.c | 78 ++-- kernel/dma/map_benchmark.c | 22 +- kernel/gen_kheaders.sh | 7 +- kernel/irq/manage.c | 15 +- kernel/kthread.c | 18 + kernel/sched/fair.c | 53 ++- kernel/sched/isolation.c | 7 +- kernel/sched/topology.c | 2 +- kernel/smpboot.c | 3 +- kernel/softirq.c | 12 +- kernel/trace/rv/rv.c | 2 + kernel/trace/trace_events.c | 12 + kernel/trace/trace_events_user.c | 213 ++++++--- lib/kunit/try-catch.c | 9 +- lib/slub_kunit.c | 2 +- lib/test_hmm.c | 8 +- mm/cma.c | 4 - mm/damon/core.c | 3 +- mm/hugetlb.c | 6 +- mm/kmsan/core.c | 15 +- mm/ksm.c | 6 +- mm/userfaultfd.c | 35 ++ mm/vmalloc.c | 5 +- net/bluetooth/l2cap_core.c | 56 ++- net/bluetooth/l2cap_sock.c | 91 +++- net/core/dev.c | 3 +- net/core/pktgen.c | 3 +- net/ipv4/af_inet.c | 4 +- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 + net/ipv4/route.c | 22 +- net/ipv4/tcp_ipv4.c | 13 +- net/ipv4/udp.c | 21 +- net/ipv6/reassembly.c | 2 +- net/ipv6/route.c | 34 +- net/ipv6/seg6.c | 5 +- net/ipv6/seg6_iptunnel.c | 11 +- net/ipv6/udp.c | 20 +- net/mac80211/mlme.c | 3 +- net/mac80211/rate.c | 6 +- net/mac80211/scan.c | 1 + net/mac80211/tx.c | 13 +- net/mptcp/protocol.h | 3 + net/mptcp/sockopt.c | 123 ++++-- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_fib.c | 8 +- net/netfilter/nft_payload.c | 95 +++- net/nfc/nci/core.c | 18 +- net/openvswitch/actions.c | 6 + net/packet/af_packet.c | 3 +- net/qrtr/ns.c | 27 ++ net/sched/sch_taprio.c | 14 +- net/sunrpc/auth_gss/svcauth_gss.c | 12 +- net/sunrpc/clnt.c | 1 + net/sunrpc/svc.c | 2 - net/sunrpc/xprtrdma/verbs.c | 6 +- net/unix/af_unix.c | 47 +- net/wireless/trace.h | 4 +- net/xfrm/xfrm_policy.c | 11 +- scripts/kconfig/symbol.c | 6 +- sound/core/init.c | 9 +- sound/core/jack.c | 46 +- sound/core/seq/seq_ump_convert.c | 48 +- sound/core/ump.c | 7 + sound/core/ump_convert.c | 1 - sound/hda/intel-dsp-config.c | 27 +- sound/pci/emu10k1/io.c | 1 + sound/pci/hda/cs35l56_hda.c | 26 +- sound/pci/hda/patch_realtek.c | 5 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/cs35l41.c | 26 +- sound/soc/codecs/cs35l56-shared.c | 41 ++ sound/soc/codecs/cs35l56.c | 21 + sound/soc/codecs/cs42l43.c | 5 +- sound/soc/codecs/da7219-aad.c | 6 +- sound/soc/codecs/rt5645.c | 25 ++ sound/soc/codecs/rt715-sdca.c | 8 +- sound/soc/codecs/rt715-sdw.c | 1 + sound/soc/codecs/rt722-sdca.c | 27 +- sound/soc/codecs/rt722-sdca.h | 3 + sound/soc/codecs/tas2552.c | 15 +- sound/soc/codecs/tas2781-fmwlib.c | 109 ++--- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/intel/avs/boards/ssm4567.c | 1 - sound/soc/intel/avs/cldma.c | 2 +- sound/soc/intel/avs/path.c | 1 + sound/soc/intel/avs/probes.c | 14 +- sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 + sound/soc/intel/boards/bxt_rt298.c | 1 + sound/soc/intel/boards/bytcr_rt5640.c | 14 +- sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 + sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 + sound/soc/intel/boards/kbl_da7219_max98927.c | 4 + sound/soc/intel/boards/kbl_rt5660.c | 1 + sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 + .../intel/boards/kbl_rt5663_rt5514_max98927.c | 1 + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 + .../soc/intel/boards/skl_nau88l25_max98357a.c | 1 + sound/soc/intel/boards/skl_rt286.c | 1 + sound/soc/intel/common/Makefile | 1 + .../intel/common/soc-acpi-intel-arl-match.c | 51 +++ sound/soc/kirkwood/kirkwood-dma.c | 3 + sound/soc/mediatek/mt8192/mt8192-dai-tdm.c | 4 +- sound/soc/sof/intel/hda.h | 1 + sound/soc/sof/intel/lnl.c | 3 +- sound/soc/sof/intel/lnl.h | 15 + sound/soc/sof/intel/mtl.c | 83 +++- sound/soc/sof/intel/mtl.h | 4 +- sound/soc/sof/intel/pci-mtl.c | 31 ++ sound/soc/sof/ipc3-pcm.c | 1 + sound/soc/sof/pcm.c | 13 +- sound/soc/sof/sof-audio.h | 2 + tools/arch/x86/intel_sdsi/intel_sdsi.c | 48 +- tools/arch/x86/lib/x86-opcode-map.txt | 10 +- tools/bpf/bpftool/common.c | 96 +++- tools/bpf/bpftool/iter.c | 2 +- tools/bpf/bpftool/main.h | 3 +- tools/bpf/bpftool/prog.c | 5 +- tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 4 +- tools/bpf/bpftool/struct_ops.c | 2 +- tools/bpf/resolve_btfids/main.c | 2 +- tools/include/nolibc/stdlib.h | 2 +- tools/include/uapi/linux/bpf.h | 2 +- tools/lib/bpf/libbpf.c | 2 +- tools/lib/perf/evlist.c | 9 + tools/lib/perf/include/internal/evlist.h | 2 + tools/lib/subcmd/parse-options.c | 8 +- tools/perf/Documentation/perf-list.txt | 1 + tools/perf/arch/arm64/util/pmu.c | 6 +- tools/perf/bench/inject-buildid.c | 2 +- tools/perf/bench/uprobe.c | 2 +- tools/perf/builtin-annotate.c | 46 +- tools/perf/builtin-daemon.c | 4 +- tools/perf/builtin-inject.c | 6 + tools/perf/builtin-record.c | 74 ++-- tools/perf/builtin-report.c | 42 +- tools/perf/builtin-sched.c | 7 +- tools/perf/builtin-top.c | 44 +- .../arch/s390/cf_z16/transaction.json | 28 +- tools/perf/tests/attr/system-wide-dummy | 14 +- tools/perf/tests/attr/test-record-C0 | 4 +- tools/perf/tests/code-reading.c | 10 +- tools/perf/tests/expr.c | 31 +- tools/perf/tests/shell/test_arm_coresight.sh | 2 +- tools/perf/tests/workloads/datasym.c | 16 + tools/perf/ui/browser.c | 6 +- tools/perf/ui/browser.h | 2 +- tools/perf/ui/browsers/annotate.c | 8 +- tools/perf/ui/gtk/annotate.c | 6 +- tools/perf/ui/gtk/gtk.h | 2 - tools/perf/util/annotate.c | 190 ++++---- tools/perf/util/annotate.h | 32 +- tools/perf/util/event.c | 4 +- tools/perf/util/evlist.c | 18 + tools/perf/util/evlist.h | 1 + tools/perf/util/expr.c | 2 +- .../util/intel-pt-decoder/intel-pt-decoder.c | 2 + tools/perf/util/intel-pt.c | 2 + tools/perf/util/machine.c | 10 +- tools/perf/util/maps.c | 238 ++++++++++ tools/perf/util/maps.h | 12 + tools/perf/util/perf_event_attr_fprintf.c | 26 +- tools/perf/util/pmu.c | 48 +- tools/perf/util/pmu.h | 4 +- tools/perf/util/pmus.c | 20 +- tools/perf/util/probe-event.c | 1 + tools/perf/util/python.c | 10 + tools/perf/util/session.c | 5 + tools/perf/util/stat-display.c | 3 + tools/perf/util/symbol.c | 259 +---------- tools/perf/util/symbol.h | 1 - tools/perf/util/symbol_conf.h | 4 +- tools/perf/util/thread.c | 14 +- tools/perf/util/thread.h | 14 + tools/perf/util/top.h | 1 - tools/testing/selftests/bpf/network_helpers.c | 2 + .../bpf/prog_tests/xdp_do_redirect.c | 4 +- tools/testing/selftests/bpf/test_sockmap.c | 2 +- tools/testing/selftests/cgroup/cgroup_util.c | 8 +- tools/testing/selftests/cgroup/cgroup_util.h | 2 +- tools/testing/selftests/cgroup/test_core.c | 7 +- tools/testing/selftests/cgroup/test_cpu.c | 2 +- tools/testing/selftests/cgroup/test_cpuset.c | 2 +- tools/testing/selftests/cgroup/test_freezer.c | 2 +- tools/testing/selftests/cgroup/test_kill.c | 2 +- tools/testing/selftests/cgroup/test_kmem.c | 2 +- .../selftests/cgroup/test_memcontrol.c | 2 +- tools/testing/selftests/cgroup/test_zswap.c | 2 +- .../selftests/filesystems/binderfs/Makefile | 2 - .../test.d/dynevent/add_remove_btfarg.tc | 2 +- tools/testing/selftests/kcmp/kcmp_test.c | 2 +- .../testing/selftests/kvm/aarch64/vgic_init.c | 50 +++ tools/testing/selftests/lib.mk | 12 +- tools/testing/selftests/mm/compaction_test.c | 2 + tools/testing/selftests/mm/gup_test.c | 1 + tools/testing/selftests/mm/uffd-common.h | 1 + tools/testing/selftests/net/Makefile | 4 +- tools/testing/selftests/net/amt.sh | 20 +- tools/testing/selftests/net/config | 7 +- .../selftests/net/forwarding/bridge_igmp.sh | 6 +- .../selftests/net/forwarding/bridge_mld.sh | 6 +- .../testing/selftests/net/mptcp/mptcp_join.sh | 8 +- .../selftests/net/mptcp/simult_flows.sh | 10 +- tools/testing/selftests/net/net_helper.sh | 25 ++ tools/testing/selftests/net/udpgro.sh | 13 +- tools/testing/selftests/net/udpgro_bench.sh | 5 +- tools/testing/selftests/net/udpgro_frglist.sh | 5 +- .../testing/selftests/powerpc/dexcr/Makefile | 2 +- tools/testing/selftests/resctrl/Makefile | 4 +- .../syscall_user_dispatch/sud_test.c | 14 + .../tc-testing/tc-tests/qdiscs/taprio.json | 44 ++ tools/tracing/latency/latency-collector.c | 8 +- tools/tracing/rtla/src/timerlat_hist.c | 60 ++- 809 files changed, 8694 insertions(+), 5399 deletions(-) create mode 100644 drivers/iio/industrialio-backend.c delete mode 100644 include/linux/iio/adc/adi-axi-adc.h create mode 100644 include/linux/iio/backend.h create mode 100644 sound/soc/intel/common/soc-acpi-intel-arl-match.c create mode 100644 sound/soc/sof/intel/lnl.h create mode 100644 tools/testing/selftests/net/net_helper.sh -- 2.17.1

1 717

[PATCH openEuler-22.03-LTS-SP1] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEDJI -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 8fc9a4e911e3..766d4a33b174 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH OLK-5.10] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEDJI -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 8fc9a4e911e3..766d4a33b174 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH v2 openEuler-1.0-LTS] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEDJI -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 137bf0cee897..d7bae7a804c4 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH OLK-6.6] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index 118699fff2f9..27a8931647ea 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -86,8 +86,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEAGS -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 137bf0cee897..d7bae7a804c4 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH OLK-5.10] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b35f0b63baf0..ab6c0b9c5336 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -96,8 +96,11 @@ void __jbd2_log_wait_for_space(journal_t *journal) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-40976
by Jinjiang Tu 29 Jul '24

29 Jul '24

fix CVE-2024-40976. Erico Nunes (2): drm/lima: add mask irq callback to gp and pp drm/lima: mask irqs in timeout path before hard reset drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 6 files changed, 49 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-40976
by Jinjiang Tu 29 Jul '24

29 Jul '24

fix CVE-2024-40976. Erico Nunes (2): drm/lima: add mask irq callback to gp and pp drm/lima: mask irqs in timeout path before hard reset drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 6 files changed, 49 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] bpf: Fix null-pointer-deref in resolve_prog_type()
by Tengda Wu 29 Jul '24

29 Jul '24

This patchset is going to fix null-pointer-deref in resolve_prog_type() for BPF_PROG_TYPE_EXT. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. In last version we fix it by forcing `attach_prog_fd` non-empty at load time, which leads to libbpf_probe_prog_types() api broken. Currently, we fix it by just adding null check for EXT prog in resolve_prog_type() as the old way did. For the sake of safety, we compared the full test logs of selftest before and after applying these changes, and the results show that the two test logs were consistent. Tengda Wu (2): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() include/linux/bpf_verifier.h | 2 +- tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/2] bpf: Fix null-pointer-deref in resolve_prog_type()
by Tengda Wu 29 Jul '24

29 Jul '24

This patchset is going to fix null-pointer-deref in resolve_prog_type() for BPF_PROG_TYPE_EXT. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. In last version we fix it by forcing `attach_prog_fd` non-empty at load time, which leads to libbpf_probe_prog_types() api broken. Currently, we fix it by just adding null check for EXT prog in resolve_prog_type() as the old way did. For the sake of safety, we compared the full test logs of selftest before and after applying these changes, and the results show that the two test logs were consistent. Tengda Wu (2): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() include/linux/bpf_verifier.h | 2 +- tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 94b5eff0cd3a..16ca5e91f3aa 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -107,8 +107,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -461,7 +461,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -479,13 +479,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -618,8 +618,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 58b36e019f9e..4bfecfb16246 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH OLK-5.10] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6a90d33e6f6a..fe01c63c9153 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -105,8 +105,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -459,7 +459,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -477,13 +477,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -560,8 +560,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 824047c395ff..2e3417d2676c 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6a90d33e6f6a..fe01c63c9153 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -105,8 +105,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -459,7 +459,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -477,13 +477,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -560,8 +560,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 824047c395ff..2e3417d2676c 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH OLK-6.6] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index f8fda9cf583e..296cdfea7c2a 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -36,7 +36,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -44,7 +44,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; @@ -173,8 +173,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -529,7 +529,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, blk_opf_t opf) { @@ -540,13 +540,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, blk_opf_t opf) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((opf & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((opf & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((opf & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -623,8 +623,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-27010
by Zhengchao Shao 29 Jul '24

29 Jul '24

Fix CVE-2024-27010 Eric Dumazet (1): net/sched: Fix mirred deadlock on device recursion Johannes Berg (1): net/sched: initialize noop_qdisc owner Zhengchao Shao (1): net/sched: fix kabi change in struct Qdisc include/net/sch_generic.h | 2 +- net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 2 ++ 3 files changed, 9 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 6

[PATCH 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

1 2

[PATCH openEuler-1.0-LTS] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 18b587cf9db8..296052020afa 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -585,6 +585,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index ecdd9e83f2f4..fd66b13438bc 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -592,6 +592,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH OLK-5.10] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index a3e9dd348500..ec55f306ab2a 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -592,6 +592,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] drm/radeon: fix UBSAN warning in kv_dpm.c
by Kaixiong Yu 29 Jul '24

29 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v4.19.317 commit 07e8f15fa16695cf4c90e89854e59af4a760055b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR1V CVE: CVE-2024-40988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream. Adds bounds check for sumo_vid_mapping_entry. Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c index 1e4975f3374c..b9eb7e2d3352 100644 --- a/drivers/gpu/drm/radeon/sumo_dpm.c +++ b/drivers/gpu/drm/radeon/sumo_dpm.c @@ -1620,6 +1620,8 @@ void sumo_construct_vid_mapping_table(struct radeon_device *rdev, for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) { if (table[i].ulSupportedSCLK != 0) { + if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES) + continue; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit = -- 2.25.1

2 1

[PATCH OLK-5.10 00/12] mm: numa-affinity: support THP migration
by Nanyong Sun 29 Jul '24

29 Jul '24

1. Backport the patch series: mm: thp: use generic THP migration for NUMA hinting fault 2. Support THP migration in numa-affinity 3. Some minor optimizations Aneesh Kumar K.V (1): mm/migrate: fix NR_ISOLATED corruption on 64-bit Nanyong Sun (3): mm: fix KABI broken in struct vm_fault mm: numa-affinity: support THP migration mm: numa-affinity: delete the duplicate numa_migrate_prep Yang Shi (7): mm: memory: add orig_pmd to struct vm_fault mm: memory: make numa_migrate_prep() non-static mm: thp: refactor NUMA fault handling mm: migrate: account THP NUMA migration counters correctly mm: migrate: don't split THP for misplaced NUMA page mm: migrate: check mapcount for THP instead of refcount mm: thp: skip make PMD PROT_NONE if THP migration is not supported Ze Zuo (1): mm: numa-affinity: backport some migrate policy from AutoNuma include/linux/huge_mm.h | 9 +- include/linux/migrate.h | 23 ----- include/linux/mm.h | 8 +- mm/huge_memory.c | 157 +++++++++++------------------- mm/internal.h | 21 +--- mm/mem_sampling.c | 89 ++++++++++++++--- mm/memory.c | 31 +++--- mm/migrate.c | 205 +++++++++------------------------------- 8 files changed, 202 insertions(+), 341 deletions(-) -- 2.25.1

3 14

[PATCH v2 OLK-5.10 00/13] mm: numa-affinity: support THP migration
by Nanyong Sun 28 Jul '24

28 Jul '24

1. Backport the patch series: mm: thp: use generic THP migration for NUMA hinting fault 2. Support THP migration in numa-affinity 3. Some minor optimizations change from v1: backport one more "bugfix" patch(the last one) to avoid CI failed. Aneesh Kumar K.V (1): mm/migrate: fix NR_ISOLATED corruption on 64-bit Huang Ying (1): mm,do_huge_pmd_numa_page: remove unnecessary TLB flushing code Nanyong Sun (3): mm: fix KABI broken in struct vm_fault mm: numa-affinity: support THP migration mm: numa-affinity: delete the duplicate numa_migrate_prep Yang Shi (7): mm: memory: add orig_pmd to struct vm_fault mm: memory: make numa_migrate_prep() non-static mm: thp: refactor NUMA fault handling mm: migrate: account THP NUMA migration counters correctly mm: migrate: don't split THP for misplaced NUMA page mm: migrate: check mapcount for THP instead of refcount mm: thp: skip make PMD PROT_NONE if THP migration is not supported Ze Zuo (1): mm: numa-affinity: backport some migrate policy from AutoNuma include/linux/huge_mm.h | 9 +- include/linux/migrate.h | 23 ----- include/linux/mm.h | 8 +- mm/huge_memory.c | 167 +++++++++----------------------- mm/internal.h | 21 +--- mm/mem_sampling.c | 89 ++++++++++++++--- mm/memory.c | 31 +++--- mm/migrate.c | 205 +++++++++------------------------------- 8 files changed, 194 insertions(+), 359 deletions(-) -- 2.25.1

2 14

[openeuler:openEuler-1.0-LTS 11557/23376] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_gro.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Jul '24

28 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0e54270d90f09583500ef61f20ffb02efafa8031 commit: 98cbed17790cdb1565119733aa422bab3b955d46 [11557/23376] net: hns3: place cae gro implementations in an independent file config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240728/202407281559.WpczUOhm-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240728/202407281559.WpczUOhm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407281559.WpczUOhm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_gro.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0