2022-07-11 10:39:26

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 000/230] 5.15.54-rc1 review

This is the start of the stable review cycle for the 5.15.54 release.
There are 230 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.54-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 5.15.54-rc1

Hangbin Liu <[email protected]>
selftests/net: fix section name when using xdp_dummy.o

Dave Jiang <[email protected]>
dmaengine: idxd: force wq context cleanup on device disable path

Miaoqian Lin <[email protected]>
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate

Caleb Connolly <[email protected]>
dmaengine: qcom: bam_dma: fix runtime PM underflow

Miaoqian Lin <[email protected]>
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate

Michael Walle <[email protected]>
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly

Christophe JAILLET <[email protected]>
dmaengine: lgm: Fix an error handling path in intel_ldma_probe()

Dmitry Osipenko <[email protected]>
dmaengine: pl330: Fix lockdep warning about non-static key

Linus Torvalds <[email protected]>
ida: don't use BUG_ON() for debugging

Samuel Holland <[email protected]>
dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo

AngeloGioacchino Del Regno <[email protected]>
Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL"

Naoya Horiguchi <[email protected]>
Revert "mm/memory-failure.c: fix race with changing page compound again"

Shuah Khan <[email protected]>
misc: rtsx_usb: set return value in rsp_buf alloc err path

Shuah Khan <[email protected]>
misc: rtsx_usb: use separate command and response buffers

Shuah Khan <[email protected]>
misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer

Peter Robinson <[email protected]>
dmaengine: imx-sdma: Allow imx8m for imx7 FW revs

Satish Nagireddy <[email protected]>
i2c: cadence: Unregister the clk notifier in error path

Heiner Kallweit <[email protected]>
r8169: fix accessing unset transport header

Vladimir Oltean <[email protected]>
selftests: forwarding: fix error message in learning_test

Vladimir Oltean <[email protected]>
selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT

Vladimir Oltean <[email protected]>
selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT

Rick Lindsley <[email protected]>
ibmvnic: Properly dispose of all skbs during a failover.

Fabrice Gasnier <[email protected]>
ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15

Amelie Delaunay <[email protected]>
ARM: dts: stm32: use usbphyc ck_usbo_48m as USBH OHCI clock on stm32mp151

Norbert Zulinski <[email protected]>
i40e: Fix VF's MAC Address change on VM

Lukasz Cieplicki <[email protected]>
i40e: Fix dropped jumbo frames statistics

Jean Delvare <[email protected]>
i2c: piix4: Fix a memory leak in the EFCH MMIO support

Ivan Malov <[email protected]>
xsk: Clear page contiguity bit when unmapping pool

Mihai Sain <[email protected]>
ARM: at91: fix soc detection for SAM9X60 SiPs

Eugen Hristev <[email protected]>
ARM: dts: at91: sama5d2_icp: fix eeprom compatibles

Eugen Hristev <[email protected]>
ARM: dts: at91: sam9x60ek: fix eeprom compatible and size

Claudiu Beznea <[email protected]>
ARM: at91: pm: use proper compatibles for sama7g5's rtc and rtt

Claudiu Beznea <[email protected]>
ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt

Claudiu Beznea <[email protected]>
ARM: at91: pm: use proper compatible for sama5d2's rtc

Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo

Andrei Lalaev <[email protected]>
pinctrl: sunxi: sunxi_pconf_set: use correct offset

Peng Fan <[email protected]>
arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings

Peng Fan <[email protected]>
arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings

Peng Fan <[email protected]>
arm64: dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings

Peng Fan <[email protected]>
arm64: dts: imx8mp-evk: correct I2C3 pad settings

Peng Fan <[email protected]>
arm64: dts: imx8mp-evk: correct I2C1 pad settings

Peng Fan <[email protected]>
arm64: dts: imx8mp-evk: correct eqos pad settings

Peng Fan <[email protected]>
arm64: dts: imx8mp-evk: correct vbus pad settings

Peng Fan <[email protected]>
arm64: dts: imx8mp-evk: correct gpio-led pad settings

Sherry Sun <[email protected]>
arm64: dts: imx8mp-evk: correct the uart2 pinctl value

Peng Fan <[email protected]>
arm64: dts: imx8mp-evk: correct mmc pad settings

Fabio Estevam <[email protected]>
ARM: mxs_defconfig: Enable the framebuffer

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm845: use dispcc AHB clock for mdss node

Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8994: Fix CPU6/7 reg values

Pierre-Louis Bossart <[email protected]>
ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect

Charles Keepax <[email protected]>
ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver

Charles Keepax <[email protected]>
ASoC: rt711: Add endianness flag in snd_soc_component_driver

Samuel Holland <[email protected]>
pinctrl: sunxi: a83t: Fix NAND function name for some pins

Miaoqian Lin <[email protected]>
ARM: meson: Fix refcount leak in meson_smp_prepare_cpus

[email protected] <[email protected]>
tty: n_gsm: fix encoding of command/response bit

Tom Rix <[email protected]>
btrfs: fix use of uninitialized variable at rm device ioctl

Ye Guojin <[email protected]>
virtio-blk: modify the value type of num in virtio_queue_rq()

Dan Carpenter <[email protected]>
btrfs: fix error pointer dereference in btrfs_ioctl_rm_dev_v2()

Hui Wang <[email protected]>
Revert "serial: sc16is7xx: Clear RS485 bits in the shutdown"

Eric Sandeen <[email protected]>
xfs: remove incorrect ASSERT in xfs_rename

Jimmy Assarsson <[email protected]>
can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits

Jimmy Assarsson <[email protected]>
can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression

Jimmy Assarsson <[email protected]>
can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info

Christian Marangi <[email protected]>
net: dsa: qca8k: reset cpu port on MTU change

Jason A. Donenfeld <[email protected]>
powerpc/powernv: delay rng platform device creation until later in boot

Hsin-Yi Wang <[email protected]>
video: of_display_timing.h: include errno.h

Dan Williams <[email protected]>
memregion: Fix memregion_free() fallback definition

Rafael J. Wysocki <[email protected]>
PM: runtime: Redefine pm_runtime_release_supplier()

Helge Deller <[email protected]>
fbcon: Prevent that screen size is smaller than font size

Helge Deller <[email protected]>
fbcon: Disallow setting font bigger than screen size

Helge Deller <[email protected]>
fbmem: Check virtual screen sizes in fb_set_var()

Guiling Deng <[email protected]>
fbdev: fbmem: Fix logo center image dx issue

Yian Chen <[email protected]>
iommu/vt-d: Fix PCI bus rescan device hot add

Alexey Dobriyan <[email protected]>
module: fix [e_shstrndx].sh_size=0 OOB access

Shuah Khan <[email protected]>
module: change to print useful messages from elf_validity_check()

Bryan O'Donoghue <[email protected]>
dt-bindings: soc: qcom: smd-rpm: Fix missing MSM8936 compatible

Vladimir Lypak <[email protected]>
dt-bindings: soc: qcom: smd-rpm: Add compatible for MSM8953 SoC

David Howells <[email protected]>
rxrpc: Fix locking issue

Mark Rutland <[email protected]>
irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling

Pavel Begunkov <[email protected]>
io_uring: avoid io-wq -EAGAIN looping for !IOPOLL

Sean Wang <[email protected]>
Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event

Niels Dossche <[email protected]>
Bluetooth: protect le accept and resolv lists with hdev->lock

Rex-BC Chen <[email protected]>
drm/mediatek: Add vblank register/unregister callback functions

Chun-Kuang Hu <[email protected]>
drm/mediatek: Add cmdq_handle in mtk_crtc

Chun-Kuang Hu <[email protected]>
drm/mediatek: Detect CMDQ execution timeout

Chun-Kuang Hu <[email protected]>
drm/mediatek: Remove the pointer of struct cmdq_client

Chun-Kuang Hu <[email protected]>
drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb

Thomas Hellström <[email protected]>
drm/i915: Fix a race between vma / object destruction and unbinding

Richard Gong <[email protected]>
drm/amdgpu: vi: disable ASPM on Intel Alder Lake based systems

Mario Limonciello <[email protected]>
drm/amd: Refactor `amdgpu_aspm` to be evaluated per device

Alex Deucher <[email protected]>
drm/amdgpu: drop flags check for CHIP_IP_DISCOVERY

Lukas Fink <[email protected]>
drm/amdgpu: Fix rejecting Tahiti GPUs

Alex Deucher <[email protected]>
drm/amdgpu: bind to any 0x1002 PCI diplay class device

Daniel Starke <[email protected]>
tty: n_gsm: fix invalid gsmtty_write_room() result

AngeloGioacchino Del Regno <[email protected]>
serial: 8250_mtk: Make sure to select the right FEATURE_SEL

Michael Ellerman <[email protected]>
powerpc/vdso: Fix incorrect CFI in gettimeofday.S

Christophe Leroy <[email protected]>
powerpc/vdso: Move cvdso_call macro into gettimeofday.S

Christophe Leroy <[email protected]>
powerpc/vdso: Remove cvdso_call_time macro

Daniel Starke <[email protected]>
tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output()

Daniel Starke <[email protected]>
tty: n_gsm: fix invalid use of MSC in advanced option

Naoya Horiguchi <[email protected]>
mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb()

Miaohe Lin <[email protected]>
mm/memory-failure.c: fix race with changing page compound again

luofei <[email protected]>
mm/hwpoison: avoid the impact of hwpoison_filter() return value on mce handler

Naoya Horiguchi <[email protected]>
mm/hwpoison: mf_mutex for soft offline and unpoison

Sean Christopherson <[email protected]>
KVM: Initialize debugfs_dentry when a VM is created to avoid NULL deref

Naohiro Aota <[email protected]>
btrfs: zoned: use dedicated lock for data relocation

Johannes Thumshirn <[email protected]>
btrfs: zoned: encapsulate inode locking for zoned relocation

Daniel Starke <[email protected]>
tty: n_gsm: fix missing update of modem controls after DLCI open

Maurizio Avogadro <[email protected]>
ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX.

Johannes Schickel <[email protected]>
ALSA: usb-audio: add mapping for MSI MPG X570S Carbon Max Wifi.

Daniel Starke <[email protected]>
tty: n_gsm: fix frame reception handling

Zhenguo Zhao <[email protected]>
tty: n_gsm: Save dlci address open status when config requester

Zhenguo Zhao <[email protected]>
tty: n_gsm: Modify CR,PF bit when config requester

Oliver Upton <[email protected]>
KVM: Don't create VM debugfs files outside of the VM directory

tiancyin <[email protected]>
drm/amd/vcn: fix an error msg on vcn 3.0

Xiaomeng Tong <[email protected]>
ASoC: rt5682: fix an incorrect NULL check on list iterator

Jack Yu <[email protected]>
ASoC: rt5682: move clk related code to rt5682_i2c_probe

Tadeusz Struk <[email protected]>
uapi/linux/stddef.h: Add include guards

Kees Cook <[email protected]>
stddef: Introduce DECLARE_FLEX_ARRAY() helper

Paul Davey <[email protected]>
bus: mhi: Fix pm_state conversion to string

Kees Cook <[email protected]>
bus: mhi: core: Use correctly sized arguments for bit field

Hui Wang <[email protected]>
serial: sc16is7xx: Clear RS485 bits in the shutdown

Nicholas Piggin <[email protected]>
powerpc/tm: Fix more userspace r13 corruption

Nicholas Piggin <[email protected]>
powerpc: flexible GPR range save/restore macros

Christophe Leroy <[email protected]>
powerpc/32: Don't use lmw/stmw for saving/restoring non volatile regs

Arun Easi <[email protected]>
scsi: qla2xxx: Fix loss of NVMe namespaces after driver reload test

Claudio Imbrenda <[email protected]>
KVM: s390x: fix SCK locking

Dongliang Mu <[email protected]>
btrfs: don't access possibly stale fs_info data in device_list_add

Paolo Bonzini <[email protected]>
KVM: use __vcalloc for very large allocations

Paolo Bonzini <[email protected]>
mm: vmalloc: introduce array allocation functions

Kees Cook <[email protected]>
Compiler Attributes: add __alloc_size() for better bounds checking

Tudor Ambarus <[email protected]>
mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set

Sebastian Andrzej Siewior <[email protected]>
batman-adv: Use netif_rx().

Haibo Chen <[email protected]>
iio: accel: mma8452: use the correct logic to get mma8452_data

Palmer Dabbelt <[email protected]>
riscv/mm: Add XIP_FIXUP for riscv_pfn_base

Chuck Lever <[email protected]>
NFSD: COMMIT operations must not return NFS?ERR_INVAL

Chuck Lever <[email protected]>
NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id)

CHANDAN VURDIGERE NATARAJ <[email protected]>
drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw

Michael Strauss <[email protected]>
drm/amd/display: Set min dcfclk if pipe count is 0

Xiaomeng Tong <[email protected]>
drbd: fix an invalid memory access caused by incorrect use of list iterator

Wu Bo <[email protected]>
drbd: Fix double free problem in drbd_create_device

Luis Chamberlain <[email protected]>
drbd: add error handling support for add_disk()

Qu Wenruo <[email protected]>
btrfs: remove device item and update super block in the same transaction

Josef Bacik <[email protected]>
btrfs: use btrfs_get_dev_args_from_path in dev removal ioctls

Josef Bacik <[email protected]>
btrfs: add a btrfs_get_dev_args_from_path helper

Josef Bacik <[email protected]>
btrfs: handle device lookup with btrfs_dev_lookup_args

Eli Cohen <[email protected]>
vdpa/mlx5: Avoid processing works if workqueue was destroyed

Andreas Gruenbacher <[email protected]>
gfs2: Fix gfs2_file_buffered_write endless loop workaround

Arun Easi <[email protected]>
scsi: qla2xxx: Fix crash during module load unload test

Quinn Tran <[email protected]>
scsi: qla2xxx: edif: Replace list_for_each_safe with list_for_each_entry_safe

Quinn Tran <[email protected]>
scsi: qla2xxx: Fix laggy FC remote port session recovery

Manish Rangankar <[email protected]>
scsi: qla2xxx: Move heartbeat handling from DPC thread to workqueue

Sean Christopherson <[email protected]>
KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook

Sean Christopherson <[email protected]>
KVM: x86/mmu: Use yield-safe TDP MMU root iter in MMU notifier unmapping

Lad Prabhakar <[email protected]>
clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3

Dan Williams <[email protected]>
cxl/port: Hold port reference until decoder release

Lorenzo Bianconi <[email protected]>
mt76: mt7921: do not always disable fw runtime-pm

Sean Wang <[email protected]>
mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error

Johan Hovold <[email protected]>
media: davinci: vpif: fix use-after-free on driver unbind

Kees Cook <[email protected]>
media: omap3isp: Use struct_group() for memcpy() region

Kees Cook <[email protected]>
stddef: Introduce struct_group() helper macro

Tejun Heo <[email protected]>
block: fix rq-qos breakage from skipping rq_qos_done_bio()

Jens Axboe <[email protected]>
block: only mark bio as tracked if it really is tracked

Pavel Begunkov <[email protected]>
block: use bdev_get_queue() in bio.c

Jens Axboe <[email protected]>
io_uring: ensure that fsnotify is always called

Max Gurtovoy <[email protected]>
virtio-blk: avoid preallocating big SGL for data

Sukadev Bhattiprolu <[email protected]>
ibmvnic: Allow queueing resets during probe

Sukadev Bhattiprolu <[email protected]>
ibmvnic: clear fop when retrying probe

Sukadev Bhattiprolu <[email protected]>
ibmvnic: init init_done_rc earlier

Alexander Egorenkov <[email protected]>
s390/setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE

Alexander Gordeev <[email protected]>
s390/setup: use physical pointers for memblock_reserve()

Alexander Gordeev <[email protected]>
s390/boot: allocate amode31 section in decompressor

Florian Westphal <[email protected]>
netfilter: nft_payload: don't allow th access for fragments

Pablo Neira Ayuso <[email protected]>
netfilter: nft_payload: support for inner header matching / mangling

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: convert pktinfo->tprot_set to flags field

Peter Ujfalusi <[email protected]>
ASoC: rt5682: Fix deadlock on resume

Derek Fang <[email protected]>
ASoC: rt5682: Re-detect the combo jack after resuming

Derek Fang <[email protected]>
ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend

Roi Dayan <[email protected]>
net/mlx5e: TC, Reject rules with forward and drop actions

Roi Dayan <[email protected]>
net/mlx5e: TC, Reject rules with drop and modify hdr action

Roi Dayan <[email protected]>
net/mlx5e: Split actions_match_supported() into a sub function

Roi Dayan <[email protected]>
net/mlx5e: Check action fwd/drop flag exists also for nic flows

Palmer Dabbelt <[email protected]>
RISC-V: defconfigs: Set CONFIG_FB=y, for FB console

Heinrich Schuchardt <[email protected]>
riscv: defconfig: enable DRM_NOUVEAU

Hou Tao <[email protected]>
bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC

Lorenzo Bianconi <[email protected]>
mt76: mt7921: fix a possible race enabling/disabling runtime-pm

Lorenzo Bianconi <[email protected]>
mt76: mt7921: introduce mt7921_mcu_set_beacon_filter utility routine

Lorenzo Bianconi <[email protected]>
mt76: mt7921: get rid of mt7921_mac_set_beacon_filter

Hans de Goede <[email protected]>
platform/x86: wmi: Fix driver->notify() vs ->probe() race

Hans de Goede <[email protected]>
platform/x86: wmi: Replace read_takes_no_args with a flags field

Barnabás PÅ‘cze <[email protected]>
platform/x86: wmi: introduce helper to convert driver to WMI driver

Shai Malin <[email protected]>
qed: Improve the stack space of filter_config()

Seevalamuthu Mariappan <[email protected]>
ath11k: add hw_param for wakeup_mhi

Andrew Gabbasov <[email protected]>
memory: renesas-rpc-if: Avoid unaligned bus access for HyperFlash

Sean Young <[email protected]>
media: ir_toy: prevent device from hanging during transmit

Lukas Wunner <[email protected]>
PCI: pciehp: Ignore Link Down/Up caused by error-induced Hot Reset

Lukas Wunner <[email protected]>
PCI/portdrv: Rename pm_iter() to pcie_port_device_iter()

Ville Syrjälä <[email protected]>
drm/i915: Replace the unconditional clflush with drm_clflush_virt_range()

Thomas Hellström <[email protected]>
drm/i915/gt: Register the migrate contexts with their engines

Matthew Brost <[email protected]>
drm/i915: Disable bonding on gen12+ platforms

Filipe Manana <[email protected]>
btrfs: fix deadlock between chunk allocation and chunk btree modifications

Michel Dänzer <[email protected]>
dma-buf/poll: Get a file reference for outstanding fence callbacks

Hans de Goede <[email protected]>
Input: goodix - try not to touch the reset-pin on x86/ACPI devices

Hans de Goede <[email protected]>
Input: goodix - refactor reset handling

Hans de Goede <[email protected]>
Input: goodix - add a goodix.h header file

Hans de Goede <[email protected]>
Input: goodix - change goodix_i2c_write() len parameter type to int

Tang Bin <[email protected]>
Input: cpcap-pwrbutton - handle errors from platform_get_irq()

Filipe Manana <[email protected]>
btrfs: fix warning when freeing leaf after subvolume creation failure

Filipe Manana <[email protected]>
btrfs: fix invalid delayed ref after subvolume creation failure

Nikolay Borisov <[email protected]>
btrfs: add additional parameters to btrfs_init_tree_ref/btrfs_init_data_ref

Nikolay Borisov <[email protected]>
btrfs: rename btrfs_alloc_chunk to btrfs_create_chunk

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: stricter validation of element data

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: release elements in clone from abort path

Duoming Zhou <[email protected]>
net: rose: fix UAF bug caused by rose_t0timer_expiry

Oliver Neukum <[email protected]>
usbnet: fix memory leak in error case

Daniel Borkmann <[email protected]>
bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals

Daniel Borkmann <[email protected]>
bpf: Fix incorrect verifier simulation around jmp32's jeq/jne

Thomas Kopp <[email protected]>
can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register

Thomas Kopp <[email protected]>
can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd

Marc Kleine-Budde <[email protected]>
can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits

Marc Kleine-Budde <[email protected]>
can: m_can: m_can_chip_config(): actually enable internal timestamping

Rhett Aultman <[email protected]>
can: gs_usb: gs_usb_open/close(): fix memory leak

Liang He <[email protected]>
can: grcan: grcan_probe(): remove extra of_node_get()

Oliver Hartkopp <[email protected]>
can: bcm: use call_rcu() instead of costly synchronize_rcu()

Takashi Iwai <[email protected]>
ALSA: cs46xx: Fix missing snd_card_free() call at probe error

Tim Crawford <[email protected]>
ALSA: hda/realtek: Add quirk for Clevo L140PU

Takashi Iwai <[email protected]>
ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD

Po-Hsu Lin <[email protected]>
Revert "selftests/bpf: Add test for bpf_timer overwriting crash"

Liu Shixin <[email protected]>
mm/filemap: fix UAF in find_lock_entries

Jann Horn <[email protected]>
mm/slub: add missing TID updates on slab deactivation


-------------

Diffstat:

.../bindings/dma/allwinner,sun50i-a64-dma.yaml | 2 +-
.../devicetree/bindings/soc/qcom/qcom,smd-rpm.yaml | 3 +
MAINTAINERS | 3 +-
Makefile | 19 +-
arch/arm/boot/dts/at91-sam9x60ek.dts | 3 +-
arch/arm/boot/dts/at91-sama5d2_icp.dts | 6 +-
arch/arm/boot/dts/stm32mp151.dtsi | 4 +-
arch/arm/configs/mxs_defconfig | 1 +
arch/arm/mach-at91/pm.c | 10 +-
arch/arm/mach-meson/platsmp.c | 2 +
arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 54 ++--
.../dts/freescale/imx8mp-phyboard-pollux-rdk.dts | 48 ++--
.../boot/dts/qcom/msm8992-bullhead-rev-101.dts | 2 +-
arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts | 2 +-
arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +-
arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
arch/arm64/net/bpf_jit_comp.c | 5 +-
arch/powerpc/boot/crt0.S | 31 +--
arch/powerpc/crypto/md5-asm.S | 10 +-
arch/powerpc/crypto/sha1-powerpc-asm.S | 6 +-
arch/powerpc/include/asm/ppc_asm.h | 43 +--
arch/powerpc/include/asm/vdso/gettimeofday.h | 69 +----
arch/powerpc/kernel/entry_32.S | 23 +-
arch/powerpc/kernel/exceptions-64e.S | 14 +-
arch/powerpc/kernel/exceptions-64s.S | 6 +-
arch/powerpc/kernel/head_32.h | 3 +-
arch/powerpc/kernel/head_booke.h | 3 +-
arch/powerpc/kernel/interrupt_64.S | 34 +--
arch/powerpc/kernel/optprobes_head.S | 4 +-
arch/powerpc/kernel/tm.S | 38 +--
arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 15 +-
arch/powerpc/kernel/vdso32/gettimeofday.S | 51 +++-
arch/powerpc/kvm/book3s_hv_rmhandlers.S | 5 +-
arch/powerpc/kvm/book3s_hv_uvmem.c | 2 +-
arch/powerpc/lib/test_emulate_step_exec_instr.S | 8 +-
arch/powerpc/platforms/powernv/rng.c | 16 +-
arch/riscv/configs/defconfig | 8 +-
arch/riscv/configs/rv32_defconfig | 1 +
arch/riscv/mm/init.c | 1 +
arch/s390/boot/compressed/decompressor.h | 1 +
arch/s390/boot/startup.c | 8 +
arch/s390/kernel/entry.h | 1 +
arch/s390/kernel/setup.c | 31 +--
arch/s390/kernel/vmlinux.lds.S | 1 +
arch/s390/kvm/kvm-s390.c | 19 +-
arch/s390/kvm/kvm-s390.h | 4 +-
arch/s390/kvm/priv.c | 15 +-
arch/x86/kernel/cpu/mce/core.c | 8 +-
arch/x86/kvm/mmu/page_track.c | 4 +-
arch/x86/kvm/mmu/tdp_mmu.c | 9 +-
arch/x86/kvm/x86.c | 4 +-
block/bio.c | 11 +-
block/blk-iolatency.c | 2 +-
block/blk-rq-qos.h | 23 +-
drivers/base/core.c | 3 +-
drivers/base/memory.c | 2 +
drivers/base/power/runtime.c | 20 +-
drivers/block/Kconfig | 1 +
drivers/block/drbd/drbd_main.c | 8 +-
drivers/block/virtio_blk.c | 158 +++++++----
drivers/bluetooth/btmtksdio.c | 3 +-
drivers/bus/mhi/core/init.c | 9 +-
drivers/bus/mhi/core/internal.h | 2 +-
drivers/clk/renesas/r9a07g044-cpg.c | 4 +-
drivers/cxl/core/bus.c | 4 +
drivers/dma-buf/dma-buf.c | 19 +-
drivers/dma/at_xdmac.c | 5 +
drivers/dma/idxd/device.c | 5 +-
drivers/dma/imx-sdma.c | 2 +-
drivers/dma/lgm/lgm-dma.c | 3 +-
drivers/dma/pl330.c | 2 +-
drivers/dma/qcom/bam_dma.c | 39 +--
drivers/dma/ti/dma-crossbar.c | 5 +
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 25 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 10 +
drivers/gpu/drm/amd/amdgpu/cik.c | 2 +-
drivers/gpu/drm/amd/amdgpu/nv.c | 2 +-
drivers/gpu/drm/amd/amdgpu/si.c | 2 +-
drivers/gpu/drm/amd/amdgpu/soc15.c | 2 +-
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 2 +-
drivers/gpu/drm/amd/amdgpu/vi.c | 17 +-
.../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 2 +-
.../gpu/drm/amd/display/dc/dcn30/dcn30_resource.h | 7 +
.../gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 65 ++++-
.../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 2 +-
drivers/gpu/drm/i915/gem/i915_gem_context.c | 7 +
drivers/gpu/drm/i915/gem/i915_gem_object.c | 6 +
drivers/gpu/drm/i915/gt/intel_context_types.h | 8 +
drivers/gpu/drm/i915/gt/intel_engine_cs.c | 4 +
drivers/gpu/drm/i915/gt/intel_engine_pm.c | 23 ++
drivers/gpu/drm/i915/gt/intel_engine_pm.h | 2 +
drivers/gpu/drm/i915/gt/intel_engine_types.h | 7 +
.../gpu/drm/i915/gt/intel_execlists_submission.c | 2 +
drivers/gpu/drm/i915/gt/intel_ring_submission.c | 5 +-
drivers/gpu/drm/i915/gt/mock_engine.c | 2 +
drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 12 +-
drivers/gpu/drm/mediatek/mtk_disp_drv.h | 16 +-
drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 22 +-
drivers/gpu/drm/mediatek/mtk_disp_rdma.c | 20 +-
drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 133 +++++++--
drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 4 +
drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 29 +-
drivers/i2c/busses/i2c-cadence.c | 1 +
drivers/i2c/busses/i2c-piix4.c | 16 +-
drivers/iio/accel/mma8452.c | 4 +-
drivers/input/misc/cpcap-pwrbutton.c | 6 +-
drivers/input/touchscreen/goodix.c | 150 +++++-----
drivers/input/touchscreen/goodix.h | 75 +++++
drivers/iommu/intel/dmar.c | 2 +-
drivers/irqchip/irq-gic-v3.c | 3 +
drivers/media/platform/davinci/vpif.c | 97 +++++--
drivers/media/platform/omap3isp/ispstat.c | 5 +-
drivers/media/rc/ir_toy.c | 2 +-
drivers/memory/renesas-rpc-if.c | 48 +++-
drivers/misc/cardreader/rtsx_usb.c | 27 +-
drivers/mtd/spi-nor/core.c | 3 +-
drivers/net/can/grcan.c | 1 -
drivers/net/can/m_can/m_can.c | 8 +-
drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c | 22 +-
drivers/net/can/usb/gs_usb.c | 23 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 25 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 286 ++++++++++---------
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 119 ++++----
drivers/net/dsa/qca8k.c | 23 +-
drivers/net/ethernet/ibm/ibmvnic.c | 147 +++++++++-
drivers/net/ethernet/ibm/ibmvnic.h | 1 +
drivers/net/ethernet/intel/i40e/i40e.h | 16 ++
drivers/net/ethernet/intel/i40e/i40e_main.c | 73 +++++
drivers/net/ethernet/intel/i40e/i40e_register.h | 13 +
drivers/net/ethernet/intel/i40e/i40e_type.h | 1 +
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 +
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 88 +++---
drivers/net/ethernet/qlogic/qed/qed_l2.c | 23 +-
drivers/net/ethernet/qlogic/qede/qede_filter.c | 47 ++--
drivers/net/ethernet/realtek/r8169_main.c | 10 +-
drivers/net/usb/usbnet.c | 17 +-
drivers/net/wireless/ath/ath11k/core.c | 5 +
drivers/net/wireless/ath/ath11k/hw.h | 1 +
drivers/net/wireless/ath/ath11k/pci.c | 12 +-
.../net/wireless/mediatek/mt76/mt76_connac_mac.c | 3 -
.../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +-
.../net/wireless/mediatek/mt76/mt7921/debugfs.c | 31 ++-
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 28 --
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 33 +--
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 47 ++--
drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 11 +-
drivers/pci/hotplug/pciehp.h | 2 +
drivers/pci/hotplug/pciehp_core.c | 2 +
drivers/pci/hotplug/pciehp_hpc.c | 26 ++
drivers/pci/pcie/portdrv.h | 3 +
drivers/pci/pcie/portdrv_core.c | 20 +-
drivers/pci/pcie/portdrv_pci.c | 3 +
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +-
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 +
drivers/platform/x86/wmi.c | 39 +--
drivers/scsi/qla2xxx/qla_def.h | 5 +-
drivers/scsi/qla2xxx/qla_edif.c | 39 +--
drivers/scsi/qla2xxx/qla_edif.h | 1 -
drivers/scsi/qla2xxx/qla_init.c | 2 +
drivers/scsi/qla2xxx/qla_nvme.c | 27 +-
drivers/scsi/qla2xxx/qla_os.c | 102 ++++---
drivers/soc/atmel/soc.c | 12 +-
drivers/tty/n_gsm.c | 263 ++++++++++++++---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 +-
drivers/video/fbdev/core/fbcon.c | 33 +++
drivers/video/fbdev/core/fbmem.c | 16 +-
fs/btrfs/block-group.c | 152 ++++++----
fs/btrfs/block-group.h | 2 +
fs/btrfs/ctree.c | 17 +-
fs/btrfs/ctree.h | 8 +-
fs/btrfs/delayed-ref.h | 5 +-
fs/btrfs/dev-replace.c | 16 +-
fs/btrfs/disk-io.c | 1 +
fs/btrfs/extent-tree.c | 28 +-
fs/btrfs/extent_io.c | 8 +-
fs/btrfs/file.c | 13 +-
fs/btrfs/free-space-tree.c | 4 +-
fs/btrfs/inode.c | 3 +-
fs/btrfs/ioctl.c | 96 ++++---
fs/btrfs/qgroup.c | 3 +-
fs/btrfs/relocation.c | 25 +-
fs/btrfs/scrub.c | 6 +-
fs/btrfs/tree-log.c | 2 +-
fs/btrfs/volumes.c | 310 +++++++++++++--------
fs/btrfs/volumes.h | 28 +-
fs/btrfs/zoned.c | 2 +-
fs/btrfs/zoned.h | 17 ++
fs/gfs2/file.c | 1 +
fs/io_uring.c | 10 +-
fs/nfsd/nfs3proc.c | 6 -
fs/nfsd/vfs.c | 64 +++--
fs/nfsd/vfs.h | 4 +-
fs/seq_file.c | 32 +++
fs/xfs/xfs_inode.c | 1 -
include/linux/blk_types.h | 3 +-
include/linux/compiler-gcc.h | 8 +
include/linux/compiler_attributes.h | 10 +
include/linux/compiler_types.h | 12 +
include/linux/fbcon.h | 4 +
include/linux/hugetlb.h | 6 +
include/linux/list.h | 10 +
include/linux/memregion.h | 2 +-
include/linux/mm.h | 8 +
include/linux/pm_runtime.h | 5 +-
include/linux/qed/qed_eth_if.h | 21 +-
include/linux/rtsx_usb.h | 2 -
include/linux/seq_file.h | 4 +
include/linux/stddef.h | 61 ++++
include/linux/vmalloc.h | 5 +
include/net/netfilter/nf_tables.h | 10 +-
include/net/netfilter/nf_tables_ipv4.h | 7 +-
include/net/netfilter/nf_tables_ipv6.h | 6 +-
include/uapi/linux/netfilter/nf_tables.h | 2 +
include/uapi/linux/omap3isp.h | 21 +-
include/uapi/linux/stddef.h | 41 +++
include/video/of_display_timing.h | 2 +
kernel/bpf/verifier.c | 113 ++++----
kernel/module.c | 79 ++++--
lib/idr.c | 3 +-
mm/filemap.c | 12 +-
mm/hugetlb.c | 10 +
mm/hwpoison-inject.c | 3 +-
mm/madvise.c | 2 +
mm/memory-failure.c | 205 ++++++++------
mm/slub.c | 2 +
mm/util.c | 50 ++++
net/batman-adv/bridge_loop_avoidance.c | 2 +-
net/bluetooth/hci_event.c | 12 +
net/can/bcm.c | 18 +-
net/netfilter/nf_tables_api.c | 9 +-
net/netfilter/nf_tables_core.c | 2 +-
net/netfilter/nf_tables_trace.c | 4 +-
net/netfilter/nft_exthdr.c | 2 +-
net/netfilter/nft_meta.c | 2 +-
net/netfilter/nft_payload.c | 63 ++++-
net/netfilter/nft_set_pipapo.c | 48 +++-
net/rose/rose_route.c | 4 +-
net/rxrpc/ar-internal.h | 2 +-
net/rxrpc/call_accept.c | 6 +-
net/rxrpc/call_object.c | 18 +-
net/rxrpc/net_ns.c | 2 +-
net/rxrpc/proc.c | 10 +-
net/xdp/xsk_buff_pool.c | 1 +
scripts/checkpatch.pl | 3 +-
scripts/kernel-doc | 9 +
sound/pci/cs46xx/cs46xx.c | 22 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/rt5682-i2c.c | 36 ++-
sound/soc/codecs/rt5682.c | 125 ++++-----
sound/soc/codecs/rt5682.h | 4 +-
sound/soc/codecs/rt700.c | 16 +-
sound/soc/codecs/rt711-sdca.c | 27 +-
sound/soc/codecs/rt711.c | 25 +-
sound/usb/mixer_maps.c | 16 ++
sound/usb/quirks.c | 4 +
.../testing/selftests/bpf/prog_tests/timer_crash.c | 32 ---
tools/testing/selftests/bpf/progs/timer_crash.c | 54 ----
tools/testing/selftests/net/forwarding/lib.sh | 6 +-
tools/testing/selftests/net/udpgro.sh | 2 +-
tools/testing/selftests/net/udpgro_bench.sh | 2 +-
tools/testing/selftests/net/udpgro_fwd.sh | 2 +-
tools/testing/selftests/net/veth.sh | 6 +-
virt/kvm/kvm_main.c | 14 +-
265 files changed, 3774 insertions(+), 2044 deletions(-)



2022-07-11 10:39:38

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 201/230] ARM: dts: at91: sama5d2_icp: fix eeprom compatibles

From: Eugen Hristev <[email protected]>

[ Upstream commit 416ce193d73a734ded6d09fe141017b38af1c567 ]

The eeprom memories on the board are microchip 24aa025e48, which are 2 Kbits
and are compatible with at24c02 not at24c32.

Fixes: 68a95ef72cefe ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP")
Signed-off-by: Eugen Hristev <[email protected]>
Reviewed-by: Claudiu Beznea <[email protected]>
Signed-off-by: Claudiu Beznea <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/boot/dts/at91-sama5d2_icp.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at91-sama5d2_icp.dts
index e06b58724ca8..fd1a288f686b 100644
--- a/arch/arm/boot/dts/at91-sama5d2_icp.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts
@@ -323,21 +323,21 @@
status = "okay";

eeprom@50 {
- compatible = "atmel,24c32";
+ compatible = "atmel,24c02";
reg = <0x50>;
pagesize = <16>;
status = "okay";
};

eeprom@52 {
- compatible = "atmel,24c32";
+ compatible = "atmel,24c02";
reg = <0x52>;
pagesize = <16>;
status = "disabled";
};

eeprom@53 {
- compatible = "atmel,24c32";
+ compatible = "atmel,24c02";
reg = <0x53>;
pagesize = <16>;
status = "disabled";
--
2.35.1



2022-07-11 10:39:55

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 112/230] stddef: Introduce DECLARE_FLEX_ARRAY() helper

From: Kees Cook <[email protected]>

[ Upstream commit 3080ea5553cc909b000d1f1d964a9041962f2c5b ]

There are many places where kernel code wants to have several different
typed trailing flexible arrays. This would normally be done with multiple
flexible arrays in a union, but since GCC and Clang don't (on the surface)
allow this, there have been many open-coded workarounds, usually involving
neighboring 0-element arrays at the end of a structure. For example,
instead of something like this:

struct thing {
...
union {
struct type1 foo[];
struct type2 bar[];
};
};

code works around the compiler with:

struct thing {
...
struct type1 foo[0];
struct type2 bar[];
};

Another case is when a flexible array is wanted as the single member
within a struct (which itself is usually in a union). For example, this
would be worked around as:

union many {
...
struct {
struct type3 baz[0];
};
};

These kinds of work-arounds cause problems with size checks against such
zero-element arrays (for example when building with -Warray-bounds and
-Wzero-length-bounds, and with the coming FORTIFY_SOURCE improvements),
so they must all be converted to "real" flexible arrays, avoiding warnings
like this:

fs/hpfs/anode.c: In function 'hpfs_add_sector_to_btree':
fs/hpfs/anode.c:209:27: warning: array subscript 0 is outside the bounds of an interior zero-length array 'struct bplus_internal_node[0]' [-Wzero-length-bounds]
209 | anode->btree.u.internal[0].down = cpu_to_le32(a);
| ~~~~~~~~~~~~~~~~~~~~~~~^~~
In file included from fs/hpfs/hpfs_fn.h:26,
from fs/hpfs/anode.c:10:
fs/hpfs/hpfs.h:412:32: note: while referencing 'internal'
412 | struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
| ^~~~~~~~

drivers/net/can/usb/etas_es58x/es58x_fd.c: In function 'es58x_fd_tx_can_msg':
drivers/net/can/usb/etas_es58x/es58x_fd.c:360:35: warning: array subscript 65535 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[]'} [-Wzero-length-bounds]
360 | tx_can_msg = (typeof(tx_can_msg))&es58x_fd_urb_cmd->raw_msg[msg_len];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from drivers/net/can/usb/etas_es58x/es58x_core.h:22,
from drivers/net/can/usb/etas_es58x/es58x_fd.c:17:
drivers/net/can/usb/etas_es58x/es58x_fd.h:231:6: note: while referencing 'raw_msg'
231 | u8 raw_msg[0];
| ^~~~~~~

However, it _is_ entirely possible to have one or more flexible arrays
in a struct or union: it just has to be in another struct. And since it
cannot be alone in a struct, such a struct must have at least 1 other
named member -- but that member can be zero sized. Wrap all this nonsense
into the new DECLARE_FLEX_ARRAY() in support of having flexible arrays
in unions (or alone in a struct).

As with struct_group(), since this is needed in UAPI headers as well,
implement the core there, with a non-UAPI wrapper.

Additionally update kernel-doc to understand its existence.

https://github.com/KSPP/linux/issues/137

Cc: Arnd Bergmann <[email protected]>
Cc: "Gustavo A. R. Silva" <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
include/linux/stddef.h | 13 +++++++++++++
include/uapi/linux/stddef.h | 16 ++++++++++++++++
scripts/kernel-doc | 2 ++
3 files changed, 31 insertions(+)

diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 938216f8ab7e..31fdbb784c24 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -84,4 +84,17 @@ enum {
#define struct_group_tagged(TAG, NAME, MEMBERS...) \
__struct_group(TAG, NAME, /* no attrs */, MEMBERS)

+/**
+ * DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ __DECLARE_FLEX_ARRAY(TYPE, NAME)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index 610204f7c275..3021ea25a284 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -25,3 +25,19 @@
struct { MEMBERS } ATTRS; \
struct TAG { MEMBERS } ATTRS NAME; \
}
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 38aa799a776c..5d54b57ff90c 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1263,6 +1263,8 @@ sub dump_struct($$) {
$members =~ s/DECLARE_KFIFO\s*\($args,\s*$args,\s*$args\)/$2 \*$1/gos;
# replace DECLARE_KFIFO_PTR
$members =~ s/DECLARE_KFIFO_PTR\s*\($args,\s*$args\)/$2 \*$1/gos;
+ # replace DECLARE_FLEX_ARRAY
+ $members =~ s/(?:__)?DECLARE_FLEX_ARRAY\s*\($args,\s*$args\)/$1 $2\[\]/gos;
my $declaration = $members;

# Split nested struct/union elements as newer ones
--
2.35.1



2022-07-11 10:39:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 040/230] platform/x86: wmi: introduce helper to convert driver to WMI driver

From: Barnabás PÅ‘cze <[email protected]>

[ Upstream commit e7b2e33449e22fdbaa0247d96f31543affe6163d ]

Introduce a helper function which wraps the appropriate
`container_of()` macro invocation to convert
a `struct device_driver` to `struct wmi_driver`.

Signed-off-by: Barnabás PÅ‘cze <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Hans de Goede <[email protected]>
Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/platform/x86/wmi.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 1b65bb61ce88..9aeb1a009097 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -676,6 +676,11 @@ static struct wmi_device *dev_to_wdev(struct device *dev)
return container_of(dev, struct wmi_device, dev);
}

+static inline struct wmi_driver *drv_to_wdrv(struct device_driver *drv)
+{
+ return container_of(drv, struct wmi_driver, driver);
+}
+
/*
* sysfs interface
*/
@@ -794,8 +799,7 @@ static void wmi_dev_release(struct device *dev)

static int wmi_dev_match(struct device *dev, struct device_driver *driver)
{
- struct wmi_driver *wmi_driver =
- container_of(driver, struct wmi_driver, driver);
+ struct wmi_driver *wmi_driver = drv_to_wdrv(driver);
struct wmi_block *wblock = dev_to_wblock(dev);
const struct wmi_device_id *id = wmi_driver->id_table;

@@ -892,8 +896,7 @@ static long wmi_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
}

/* let the driver do any filtering and do the call */
- wdriver = container_of(wblock->dev.dev.driver,
- struct wmi_driver, driver);
+ wdriver = drv_to_wdrv(wblock->dev.dev.driver);
if (!try_module_get(wdriver->driver.owner)) {
ret = -EBUSY;
goto out_ioctl;
@@ -926,8 +929,7 @@ static const struct file_operations wmi_fops = {
static int wmi_dev_probe(struct device *dev)
{
struct wmi_block *wblock = dev_to_wblock(dev);
- struct wmi_driver *wdriver =
- container_of(dev->driver, struct wmi_driver, driver);
+ struct wmi_driver *wdriver = drv_to_wdrv(dev->driver);
int ret = 0;
char *buf;

@@ -990,8 +992,7 @@ static int wmi_dev_probe(struct device *dev)
static void wmi_dev_remove(struct device *dev)
{
struct wmi_block *wblock = dev_to_wblock(dev);
- struct wmi_driver *wdriver =
- container_of(dev->driver, struct wmi_driver, driver);
+ struct wmi_driver *wdriver = drv_to_wdrv(dev->driver);

if (wdriver->filter_callback) {
misc_deregister(&wblock->char_dev);
@@ -1296,15 +1297,12 @@ static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,

/* If a driver is bound, then notify the driver. */
if (wblock->dev.dev.driver) {
- struct wmi_driver *driver;
+ struct wmi_driver *driver = drv_to_wdrv(wblock->dev.dev.driver);
struct acpi_object_list input;
union acpi_object params[1];
struct acpi_buffer evdata = { ACPI_ALLOCATE_BUFFER, NULL };
acpi_status status;

- driver = container_of(wblock->dev.dev.driver,
- struct wmi_driver, driver);
-
input.count = 1;
input.pointer = params;
params[0].type = ACPI_TYPE_INTEGER;
--
2.35.1



2022-07-11 10:39:59

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 105/230] scsi: qla2xxx: Fix loss of NVMe namespaces after driver reload test

From: Arun Easi <[email protected]>

[ Upstream commit db212f2eb3fb7f546366777e93c8f54614d39269 ]

Driver registration of localport can race when it happens at the remote
port discovery time. Fix this by calling the registration under a mutex.

Link: https://lore.kernel.org/r/[email protected]
Fixes: e84067d74301 ("scsi: qla2xxx: Add FC-NVMe F/W initialization and transport registration")
Cc: [email protected]
Reported-by: Marco Patalano <[email protected]>
Tested-by: Marco Patalano <[email protected]>
Reviewed-by: Himanshu Madhani <[email protected]>
Signed-off-by: Arun Easi <[email protected]>
Signed-off-by: Nilesh Javali <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/scsi/qla2xxx/qla_nvme.c | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 42b29f4fd937..1bf3ab10846a 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -775,7 +775,6 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)
ha = vha->hw;
tmpl = &qla_nvme_fc_transport;

- WARN_ON(vha->nvme_local_port);

qla_nvme_fc_transport.max_hw_queues =
min((uint8_t)(qla_nvme_fc_transport.max_hw_queues),
@@ -786,13 +785,25 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)
pinfo.port_role = FC_PORT_ROLE_NVME_INITIATOR;
pinfo.port_id = vha->d_id.b24;

- ql_log(ql_log_info, vha, 0xffff,
- "register_localport: host-traddr=nn-0x%llx:pn-0x%llx on portID:%x\n",
- pinfo.node_name, pinfo.port_name, pinfo.port_id);
- qla_nvme_fc_transport.dma_boundary = vha->host->dma_boundary;
-
- ret = nvme_fc_register_localport(&pinfo, tmpl,
- get_device(&ha->pdev->dev), &vha->nvme_local_port);
+ mutex_lock(&ha->vport_lock);
+ /*
+ * Check again for nvme_local_port to see if any other thread raced
+ * with this one and finished registration.
+ */
+ if (!vha->nvme_local_port) {
+ ql_log(ql_log_info, vha, 0xffff,
+ "register_localport: host-traddr=nn-0x%llx:pn-0x%llx on portID:%x\n",
+ pinfo.node_name, pinfo.port_name, pinfo.port_id);
+ qla_nvme_fc_transport.dma_boundary = vha->host->dma_boundary;
+
+ ret = nvme_fc_register_localport(&pinfo, tmpl,
+ get_device(&ha->pdev->dev),
+ &vha->nvme_local_port);
+ mutex_unlock(&ha->vport_lock);
+ } else {
+ mutex_unlock(&ha->vport_lock);
+ return 0;
+ }
if (ret) {
ql_log(ql_log_warn, vha, 0xffff,
"register_localport failed: ret=%x\n", ret);
--
2.35.1



2022-07-11 10:40:03

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 077/230] KVM: x86/mmu: Use yield-safe TDP MMU root iter in MMU notifier unmapping

From: Sean Christopherson <[email protected]>

[ Upstream commit 7533377215b6ee432c06c5855f6be5d66e694e46 ]

Use the yield-safe variant of the TDP MMU iterator when handling an
unmapping event from the MMU notifier, as most occurences of the event
allow yielding.

Fixes: e1eed5847b09 ("KVM: x86/mmu: Allow yielding during MMU notifier unmap/zap, if possible")
Cc: [email protected]
Signed-off-by: Sean Christopherson <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/x86/kvm/mmu/tdp_mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
index 853780eb033b..6195f0d219ae 100644
--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -1100,7 +1100,7 @@ bool kvm_tdp_mmu_unmap_gfn_range(struct kvm *kvm, struct kvm_gfn_range *range,
{
struct kvm_mmu_page *root;

- for_each_tdp_mmu_root(kvm, root, range->slot->as_id)
+ for_each_tdp_mmu_root_yield_safe(kvm, root, range->slot->as_id, false)
flush = zap_gfn_range(kvm, root, range->start, range->end,
range->may_block, flush, false);

--
2.35.1



2022-07-11 10:40:05

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 148/230] drm/mediatek: Add vblank register/unregister callback functions

From: Rex-BC Chen <[email protected]>

[ Upstream commit b74d921b900b6ce38c6247c0a1c86be9f3746493 ]

We encountered a kernel panic issue that callback data will be NULL when
it's using in ovl irq handler. There is a timing issue between
mtk_disp_ovl_irq_handler() and mtk_ovl_disable_vblank().

To resolve this issue, we use the flow to register/unregister vblank cb:
- Register callback function and callback data when crtc creates.
- Unregister callback function and callback data when crtc destroies.

With this solution, we can assure callback data will not be NULL when
vblank is disable.

Link: https://patchwork.kernel.org/project/linux-mediatek/patch/[email protected]/
Fixes: 9b0704988b15 ("drm/mediatek: Register vblank callback function")
Signed-off-by: Rex-BC Chen <[email protected]>
Reviewed-by: jason-jh.lin <[email protected]>
Signed-off-by: Chun-Kuang Hu <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/mediatek/mtk_disp_drv.h | 16 +++++++-----
drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 22 ++++++++++++----
drivers/gpu/drm/mediatek/mtk_disp_rdma.c | 20 +++++++++-----
drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 14 +++++++++-
drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 4 +++
drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 29 ++++++++++++++++-----
6 files changed, 80 insertions(+), 25 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_disp_drv.h b/drivers/gpu/drm/mediatek/mtk_disp_drv.h
index 86c3068894b1..974462831133 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_drv.h
+++ b/drivers/gpu/drm/mediatek/mtk_disp_drv.h
@@ -76,9 +76,11 @@ void mtk_ovl_layer_off(struct device *dev, unsigned int idx,
void mtk_ovl_start(struct device *dev);
void mtk_ovl_stop(struct device *dev);
unsigned int mtk_ovl_supported_rotations(struct device *dev);
-void mtk_ovl_enable_vblank(struct device *dev,
- void (*vblank_cb)(void *),
- void *vblank_cb_data);
+void mtk_ovl_register_vblank_cb(struct device *dev,
+ void (*vblank_cb)(void *),
+ void *vblank_cb_data);
+void mtk_ovl_unregister_vblank_cb(struct device *dev);
+void mtk_ovl_enable_vblank(struct device *dev);
void mtk_ovl_disable_vblank(struct device *dev);

void mtk_rdma_bypass_shadow(struct device *dev);
@@ -93,9 +95,11 @@ void mtk_rdma_layer_config(struct device *dev, unsigned int idx,
struct cmdq_pkt *cmdq_pkt);
void mtk_rdma_start(struct device *dev);
void mtk_rdma_stop(struct device *dev);
-void mtk_rdma_enable_vblank(struct device *dev,
- void (*vblank_cb)(void *),
- void *vblank_cb_data);
+void mtk_rdma_register_vblank_cb(struct device *dev,
+ void (*vblank_cb)(void *),
+ void *vblank_cb_data);
+void mtk_rdma_unregister_vblank_cb(struct device *dev);
+void mtk_rdma_enable_vblank(struct device *dev);
void mtk_rdma_disable_vblank(struct device *dev);

#endif
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
index 5326989d5206..411cf0f21661 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -96,14 +96,28 @@ static irqreturn_t mtk_disp_ovl_irq_handler(int irq, void *dev_id)
return IRQ_HANDLED;
}

-void mtk_ovl_enable_vblank(struct device *dev,
- void (*vblank_cb)(void *),
- void *vblank_cb_data)
+void mtk_ovl_register_vblank_cb(struct device *dev,
+ void (*vblank_cb)(void *),
+ void *vblank_cb_data)
{
struct mtk_disp_ovl *ovl = dev_get_drvdata(dev);

ovl->vblank_cb = vblank_cb;
ovl->vblank_cb_data = vblank_cb_data;
+}
+
+void mtk_ovl_unregister_vblank_cb(struct device *dev)
+{
+ struct mtk_disp_ovl *ovl = dev_get_drvdata(dev);
+
+ ovl->vblank_cb = NULL;
+ ovl->vblank_cb_data = NULL;
+}
+
+void mtk_ovl_enable_vblank(struct device *dev)
+{
+ struct mtk_disp_ovl *ovl = dev_get_drvdata(dev);
+
writel(0x0, ovl->regs + DISP_REG_OVL_INTSTA);
writel_relaxed(OVL_FME_CPL_INT, ovl->regs + DISP_REG_OVL_INTEN);
}
@@ -112,8 +126,6 @@ void mtk_ovl_disable_vblank(struct device *dev)
{
struct mtk_disp_ovl *ovl = dev_get_drvdata(dev);

- ovl->vblank_cb = NULL;
- ovl->vblank_cb_data = NULL;
writel_relaxed(0x0, ovl->regs + DISP_REG_OVL_INTEN);
}

diff --git a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c b/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
index 75d7f45579e2..a6a6cb5f75af 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
@@ -94,24 +94,32 @@ static void rdma_update_bits(struct device *dev, unsigned int reg,
writel(tmp, rdma->regs + reg);
}

-void mtk_rdma_enable_vblank(struct device *dev,
- void (*vblank_cb)(void *),
- void *vblank_cb_data)
+void mtk_rdma_register_vblank_cb(struct device *dev,
+ void (*vblank_cb)(void *),
+ void *vblank_cb_data)
{
struct mtk_disp_rdma *rdma = dev_get_drvdata(dev);

rdma->vblank_cb = vblank_cb;
rdma->vblank_cb_data = vblank_cb_data;
- rdma_update_bits(dev, DISP_REG_RDMA_INT_ENABLE, RDMA_FRAME_END_INT,
- RDMA_FRAME_END_INT);
}

-void mtk_rdma_disable_vblank(struct device *dev)
+void mtk_rdma_unregister_vblank_cb(struct device *dev)
{
struct mtk_disp_rdma *rdma = dev_get_drvdata(dev);

rdma->vblank_cb = NULL;
rdma->vblank_cb_data = NULL;
+}
+
+void mtk_rdma_enable_vblank(struct device *dev)
+{
+ rdma_update_bits(dev, DISP_REG_RDMA_INT_ENABLE, RDMA_FRAME_END_INT,
+ RDMA_FRAME_END_INT);
+}
+
+void mtk_rdma_disable_vblank(struct device *dev)
+{
rdma_update_bits(dev, DISP_REG_RDMA_INT_ENABLE, RDMA_FRAME_END_INT, 0);
}

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index ffa54b416ca7..34bb6c713a90 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -152,11 +152,20 @@ static void mtk_drm_cmdq_pkt_destroy(struct cmdq_pkt *pkt)
static void mtk_drm_crtc_destroy(struct drm_crtc *crtc)
{
struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
+ int i;

mtk_mutex_put(mtk_crtc->mutex);
#if IS_REACHABLE(CONFIG_MTK_CMDQ)
mtk_drm_cmdq_pkt_destroy(&mtk_crtc->cmdq_handle);
#endif
+
+ for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) {
+ struct mtk_ddp_comp *comp;
+
+ comp = mtk_crtc->ddp_comp[i];
+ mtk_ddp_comp_unregister_vblank_cb(comp);
+ }
+
drm_crtc_cleanup(crtc);
}

@@ -570,7 +579,7 @@ static int mtk_drm_crtc_enable_vblank(struct drm_crtc *crtc)
struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];

- mtk_ddp_comp_enable_vblank(comp, mtk_crtc_ddp_irq, &mtk_crtc->base);
+ mtk_ddp_comp_enable_vblank(comp);

return 0;
}
@@ -870,6 +879,9 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
if (comp->funcs->ctm_set)
has_ctm = true;
}
+
+ mtk_ddp_comp_register_vblank_cb(comp, mtk_crtc_ddp_irq,
+ &mtk_crtc->base);
}

for (i = 0; i < mtk_crtc->ddp_comp_nr; i++)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
index 99cbf44463e4..22d23668b484 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
@@ -276,6 +276,8 @@ static const struct mtk_ddp_comp_funcs ddp_ovl = {
.config = mtk_ovl_config,
.start = mtk_ovl_start,
.stop = mtk_ovl_stop,
+ .register_vblank_cb = mtk_ovl_register_vblank_cb,
+ .unregister_vblank_cb = mtk_ovl_unregister_vblank_cb,
.enable_vblank = mtk_ovl_enable_vblank,
.disable_vblank = mtk_ovl_disable_vblank,
.supported_rotations = mtk_ovl_supported_rotations,
@@ -292,6 +294,8 @@ static const struct mtk_ddp_comp_funcs ddp_rdma = {
.config = mtk_rdma_config,
.start = mtk_rdma_start,
.stop = mtk_rdma_stop,
+ .register_vblank_cb = mtk_rdma_register_vblank_cb,
+ .unregister_vblank_cb = mtk_rdma_unregister_vblank_cb,
.enable_vblank = mtk_rdma_enable_vblank,
.disable_vblank = mtk_rdma_disable_vblank,
.layer_nr = mtk_rdma_layer_nr,
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
index bb914d976cf5..25cb50f2391f 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
@@ -47,9 +47,11 @@ struct mtk_ddp_comp_funcs {
unsigned int bpc, struct cmdq_pkt *cmdq_pkt);
void (*start)(struct device *dev);
void (*stop)(struct device *dev);
- void (*enable_vblank)(struct device *dev,
- void (*vblank_cb)(void *),
- void *vblank_cb_data);
+ void (*register_vblank_cb)(struct device *dev,
+ void (*vblank_cb)(void *),
+ void *vblank_cb_data);
+ void (*unregister_vblank_cb)(struct device *dev);
+ void (*enable_vblank)(struct device *dev);
void (*disable_vblank)(struct device *dev);
unsigned int (*supported_rotations)(struct device *dev);
unsigned int (*layer_nr)(struct device *dev);
@@ -110,12 +112,25 @@ static inline void mtk_ddp_comp_stop(struct mtk_ddp_comp *comp)
comp->funcs->stop(comp->dev);
}

-static inline void mtk_ddp_comp_enable_vblank(struct mtk_ddp_comp *comp,
- void (*vblank_cb)(void *),
- void *vblank_cb_data)
+static inline void mtk_ddp_comp_register_vblank_cb(struct mtk_ddp_comp *comp,
+ void (*vblank_cb)(void *),
+ void *vblank_cb_data)
+{
+ if (comp->funcs && comp->funcs->register_vblank_cb)
+ comp->funcs->register_vblank_cb(comp->dev, vblank_cb,
+ vblank_cb_data);
+}
+
+static inline void mtk_ddp_comp_unregister_vblank_cb(struct mtk_ddp_comp *comp)
+{
+ if (comp->funcs && comp->funcs->unregister_vblank_cb)
+ comp->funcs->unregister_vblank_cb(comp->dev);
+}
+
+static inline void mtk_ddp_comp_enable_vblank(struct mtk_ddp_comp *comp)
{
if (comp->funcs && comp->funcs->enable_vblank)
- comp->funcs->enable_vblank(comp->dev, vblank_cb, vblank_cb_data);
+ comp->funcs->enable_vblank(comp->dev);
}

static inline void mtk_ddp_comp_disable_vblank(struct mtk_ddp_comp *comp)
--
2.35.1



2022-07-11 10:40:14

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 004/230] ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD

From: Takashi Iwai <[email protected]>

commit ae8b1631561a3634cc09d0c62bbdd938eade05ec upstream.

Both Behringer UMC 202 HD and 404 HD need explicit quirks to enable
the implicit feedback mode and start the playback stream primarily.
The former seems fixing the stuttering and the latter is required for
a playback-only case.

Note that the "clock source 41 is not valid" error message still
appears even after this fix, but it should be only once at probe.
The reason of the error is still unknown, but this seems to be mostly
harmless as it's a one-off error and the driver retires the clock
setup and it succeeds afterwards.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215934
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/usb/quirks.c | 4 ++++
1 file changed, 4 insertions(+)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1842,6 +1842,10 @@ static const struct usb_audio_quirk_flag
QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */
QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x1397, 0x0508, /* Behringer UMC204HD */
+ QUIRK_FLAG_PLAYBACK_FIRST | QUIRK_FLAG_GENERIC_IMPLICIT_FB),
+ DEVICE_FLG(0x1397, 0x0509, /* Behringer UMC404HD */
+ QUIRK_FLAG_PLAYBACK_FIRST | QUIRK_FLAG_GENERIC_IMPLICIT_FB),
DEVICE_FLG(0x13e5, 0x0001, /* Serato Phono */
QUIRK_FLAG_IGNORE_CTL_ERROR),
DEVICE_FLG(0x154e, 0x1002, /* Denon DCD-1500RE */


2022-07-11 10:40:17

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 226/230] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate

From: Miaoqian Lin <[email protected]>

commit c132fe78ad7b4ce8b5d49a501a15c29d08eeb23a upstream.

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not needed anymore.

Add missing of_node_put() in to fix this.

Fixes: ec9bfa1e1a79 ("dmaengine: ti-dma-crossbar: dra7: Use bitops instead of idr")
Signed-off-by: Miaoqian Lin <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/dma/ti/dma-crossbar.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/dma/ti/dma-crossbar.c
+++ b/drivers/dma/ti/dma-crossbar.c
@@ -268,6 +268,7 @@ static void *ti_dra7_xbar_route_allocate
mutex_unlock(&xbar->mutex);
dev_err(&pdev->dev, "Run out of free DMA requests\n");
kfree(map);
+ of_node_put(dma_spec->np);
return ERR_PTR(-ENOMEM);
}
set_bit(map->xbar_out, xbar->dma_inuse);


2022-07-11 10:40:20

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 018/230] netfilter: nft_set_pipapo: release elements in clone from abort path

From: Pablo Neira Ayuso <[email protected]>

commit 9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e upstream.

New elements that reside in the clone are not released in case that the
transaction is aborted.

[16302.231754] ------------[ cut here ]------------
[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]
[...]
[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155
[...]
[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]
[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 <0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05
[...]
[16302.231917] Call Trace:
[16302.231919] <TASK>
[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]
[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]
[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]
[16302.231952] ? __nla_validate_parse+0x48/0x190
[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]
[16302.231963] netlink_unicast+0x211/0x340
[16302.231969] netlink_sendmsg+0x21e/0x460

Add nft_set_pipapo_match_destroy() helper function to release the
elements in the lookup tables.

Stefano Brivio says: "We additionally look for elements pointers in the
cloned matching data if priv->dirty is set, because that means that
cloned data might point to additional elements we did not commit to the
working copy yet (such as the abort path case, but perhaps not limited
to it)."

Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reviewed-by: Stefano Brivio <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/netfilter/nft_set_pipapo.c | 48 ++++++++++++++++++++++++++++-------------
1 file changed, 33 insertions(+), 15 deletions(-)

--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -2125,6 +2125,32 @@ out_scratch:
}

/**
+ * nft_set_pipapo_match_destroy() - Destroy elements from key mapping array
+ * @set: nftables API set representation
+ * @m: matching data pointing to key mapping array
+ */
+static void nft_set_pipapo_match_destroy(const struct nft_set *set,
+ struct nft_pipapo_match *m)
+{
+ struct nft_pipapo_field *f;
+ int i, r;
+
+ for (i = 0, f = m->f; i < m->field_count - 1; i++, f++)
+ ;
+
+ for (r = 0; r < f->rules; r++) {
+ struct nft_pipapo_elem *e;
+
+ if (r < f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)
+ continue;
+
+ e = f->mt[r].e;
+
+ nft_set_elem_destroy(set, e, true);
+ }
+}
+
+/**
* nft_pipapo_destroy() - Free private data for set and all committed elements
* @set: nftables API set representation
*/
@@ -2132,26 +2158,13 @@ static void nft_pipapo_destroy(const str
{
struct nft_pipapo *priv = nft_set_priv(set);
struct nft_pipapo_match *m;
- struct nft_pipapo_field *f;
- int i, r, cpu;
+ int cpu;

m = rcu_dereference_protected(priv->match, true);
if (m) {
rcu_barrier();

- for (i = 0, f = m->f; i < m->field_count - 1; i++, f++)
- ;
-
- for (r = 0; r < f->rules; r++) {
- struct nft_pipapo_elem *e;
-
- if (r < f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)
- continue;
-
- e = f->mt[r].e;
-
- nft_set_elem_destroy(set, e, true);
- }
+ nft_set_pipapo_match_destroy(set, m);

#ifdef NFT_PIPAPO_ALIGN
free_percpu(m->scratch_aligned);
@@ -2165,6 +2178,11 @@ static void nft_pipapo_destroy(const str
}

if (priv->clone) {
+ m = priv->clone;
+
+ if (priv->dirty)
+ nft_set_pipapo_match_destroy(set, m);
+
#ifdef NFT_PIPAPO_ALIGN
free_percpu(priv->clone->scratch_aligned);
#endif


2022-07-11 10:40:25

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 160/230] fbmem: Check virtual screen sizes in fb_set_var()

From: Helge Deller <[email protected]>

commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 upstream.

Verify that the fbdev or drm driver correctly adjusted the virtual
screen sizes. On failure report the failing driver and reject the screen
size change.

Signed-off-by: Helge Deller <[email protected]>
Reviewed-by: Geert Uytterhoeven <[email protected]>
Cc: [email protected] # v5.4+
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/video/fbdev/core/fbmem.c | 10 ++++++++++
1 file changed, 10 insertions(+)

--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1020,6 +1020,16 @@ fb_set_var(struct fb_info *info, struct
if (ret)
return ret;

+ /* verify that virtual resolution >= physical resolution */
+ if (var->xres_virtual < var->xres ||
+ var->yres_virtual < var->yres) {
+ pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n",
+ info->fix.id,
+ var->xres_virtual, var->yres_virtual,
+ var->xres, var->yres);
+ return -EINVAL;
+ }
+
if ((var->activate & FB_ACTIVATE_MASK) != FB_ACTIVATE_NOW)
return 0;



2022-07-11 10:40:25

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 069/230] block: fix rq-qos breakage from skipping rq_qos_done_bio()

From: Tejun Heo <[email protected]>

[ Upstream commit aa1b46dcdc7baaf5fec0be25782ef24b26aa209e ]

a647a524a467 ("block: don't call rq_qos_ops->done_bio if the bio isn't
tracked") made bio_endio() skip rq_qos_done_bio() if BIO_TRACKED is not set.
While this fixed a potential oops, it also broke blk-iocost by skipping the
done_bio callback for merged bios.

Before, whether a bio goes through rq_qos_throttle() or rq_qos_merge(),
rq_qos_done_bio() would be called on the bio on completion with BIO_TRACKED
distinguishing the former from the latter. rq_qos_done_bio() is not called
for bios which wenth through rq_qos_merge(). This royally confuses
blk-iocost as the merged bios never finish and are considered perpetually
in-flight.

One reliably reproducible failure mode is an intermediate cgroup geting
stuck active preventing its children from being activated due to the
leaf-only rule, leading to loss of control. The following is from
resctl-bench protection scenario which emulates isolating a web server like
workload from a memory bomb run on an iocost configuration which should
yield a reasonable level of protection.

# cat /sys/block/nvme2n1/device/model
Samsung SSD 970 PRO 512GB
# cat /sys/fs/cgroup/io.cost.model
259:0 ctrl=user model=linear rbps=834913556 rseqiops=93622 rrandiops=102913 wbps=618985353 wseqiops=72325 wrandiops=71025
# cat /sys/fs/cgroup/io.cost.qos
259:0 enable=1 ctrl=user rpct=95.00 rlat=18776 wpct=95.00 wlat=8897 min=60.00 max=100.00
# resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1
...
Memory Hog Summary
==================

IO Latency: R p50=242u:336u/2.5m p90=794u:1.4m/7.5m p99=2.7m:8.0m/62.5m max=8.0m:36.4m/350m
W p50=221u:323u/1.5m p90=709u:1.2m/5.5m p99=1.5m:2.5m/9.5m max=6.9m:35.9m/350m

Isolation and Request Latency Impact Distributions:

min p01 p05 p10 p25 p50 p75 p90 p95 p99 max mean stdev
isol% 15.90 15.90 15.90 40.05 57.24 59.07 60.01 74.63 74.63 90.35 90.35 58.12 15.82
lat-imp% 0 0 0 0 0 4.55 14.68 15.54 233.5 548.1 548.1 53.88 143.6

Result: isol=58.12:15.82% lat_imp=53.88%:143.6 work_csv=100.0% missing=3.96%

The isolation result of 58.12% is close to what this device would show
without any IO control.

Fix it by introducing a new flag BIO_QOS_MERGED to mark merged bios and
calling rq_qos_done_bio() on them too. For consistency and clarity, rename
BIO_TRACKED to BIO_QOS_THROTTLED. The flag checks are moved into
rq_qos_done_bio() so that it's next to the code paths that set the flags.

With the patch applied, the above same benchmark shows:

# resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1
...
Memory Hog Summary
==================

IO Latency: R p50=123u:84.4u/985u p90=322u:256u/2.5m p99=1.6m:1.4m/9.5m max=11.1m:36.0m/350m
W p50=429u:274u/995u p90=1.7m:1.3m/4.5m p99=3.4m:2.7m/11.5m max=7.9m:5.9m/26.5m

Isolation and Request Latency Impact Distributions:

min p01 p05 p10 p25 p50 p75 p90 p95 p99 max mean stdev
isol% 84.91 84.91 89.51 90.73 92.31 94.49 96.36 98.04 98.71 100.0 100.0 94.42 2.81
lat-imp% 0 0 0 0 0 2.81 5.73 11.11 13.92 17.53 22.61 4.10 4.68

Result: isol=94.42:2.81% lat_imp=4.10%:4.68 work_csv=58.34% missing=0%

Signed-off-by: Tejun Heo <[email protected]>
Fixes: a647a524a467 ("block: don't call rq_qos_ops->done_bio if the bio isn't tracked")
Cc: [email protected] # v5.15+
Cc: Ming Lei <[email protected]>
Cc: Yu Kuai <[email protected]>
Reviewed-by: Ming Lei <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jens Axboe <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
block/bio.c | 3 +--
block/blk-iolatency.c | 2 +-
block/blk-rq-qos.h | 20 +++++++++++---------
include/linux/blk_types.h | 3 ++-
4 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/block/bio.c b/block/bio.c
index 365bb6362669..b8a8bfba714f 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1470,8 +1470,7 @@ void bio_endio(struct bio *bio)
if (!bio_integrity_endio(bio))
return;

- if (bio->bi_bdev && bio_flagged(bio, BIO_TRACKED))
- rq_qos_done_bio(bdev_get_queue(bio->bi_bdev), bio);
+ rq_qos_done_bio(bio);

if (bio->bi_bdev && bio_flagged(bio, BIO_TRACE_COMPLETION)) {
trace_block_bio_complete(bdev_get_queue(bio->bi_bdev), bio);
diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index ce3847499d85..d85f30a85ee7 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -601,7 +601,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
int inflight = 0;

blkg = bio->bi_blkg;
- if (!blkg || !bio_flagged(bio, BIO_TRACKED))
+ if (!blkg || !bio_flagged(bio, BIO_QOS_THROTTLED))
return;

iolat = blkg_to_lat(bio->bi_blkg);
diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h
index 3cfbc8668cba..68267007da1c 100644
--- a/block/blk-rq-qos.h
+++ b/block/blk-rq-qos.h
@@ -177,20 +177,20 @@ static inline void rq_qos_requeue(struct request_queue *q, struct request *rq)
__rq_qos_requeue(q->rq_qos, rq);
}

-static inline void rq_qos_done_bio(struct request_queue *q, struct bio *bio)
+static inline void rq_qos_done_bio(struct bio *bio)
{
- if (q->rq_qos)
- __rq_qos_done_bio(q->rq_qos, bio);
+ if (bio->bi_bdev && (bio_flagged(bio, BIO_QOS_THROTTLED) ||
+ bio_flagged(bio, BIO_QOS_MERGED))) {
+ struct request_queue *q = bdev_get_queue(bio->bi_bdev);
+ if (q->rq_qos)
+ __rq_qos_done_bio(q->rq_qos, bio);
+ }
}

static inline void rq_qos_throttle(struct request_queue *q, struct bio *bio)
{
- /*
- * BIO_TRACKED lets controllers know that a bio went through the
- * normal rq_qos path.
- */
if (q->rq_qos) {
- bio_set_flag(bio, BIO_TRACKED);
+ bio_set_flag(bio, BIO_QOS_THROTTLED);
__rq_qos_throttle(q->rq_qos, bio);
}
}
@@ -205,8 +205,10 @@ static inline void rq_qos_track(struct request_queue *q, struct request *rq,
static inline void rq_qos_merge(struct request_queue *q, struct request *rq,
struct bio *bio)
{
- if (q->rq_qos)
+ if (q->rq_qos) {
+ bio_set_flag(bio, BIO_QOS_MERGED);
__rq_qos_merge(q->rq_qos, rq, bio);
+ }
}

static inline void rq_qos_queue_depth_changed(struct request_queue *q)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 17c92c0f15b2..36ce3d0fb9f3 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -294,7 +294,8 @@ enum {
BIO_TRACE_COMPLETION, /* bio_endio() should trace the final completion
* of this bio. */
BIO_CGROUP_ACCT, /* has been accounted to a cgroup */
- BIO_TRACKED, /* set if bio goes through the rq_qos path */
+ BIO_QOS_THROTTLED, /* bio went through rq_qos throttle path */
+ BIO_QOS_MERGED, /* but went through rq_qos merge path */
BIO_REMAPPED,
BIO_ZONE_WRITE_LOCKED, /* Owns a zoned device zone write lock */
BIO_PERCPU_CACHE, /* can participate in per-cpu alloc cache */
--
2.35.1



2022-07-11 10:40:37

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 136/230] serial: 8250_mtk: Make sure to select the right FEATURE_SEL

From: AngeloGioacchino Del Regno <[email protected]>

[ Upstream commit 6f81fdded0d024c7d4084d434764f30bca1cd6b1 ]

Set the FEATURE_SEL at probe time to make sure that BIT(0) is enabled:
this guarantees that when the port is configured as AP UART, the
right register layout is interpreted by the UART IP.

Signed-off-by: AngeloGioacchino Del Regno <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/tty/serial/8250/8250_mtk.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index de48a58460f4..de57f47635cd 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -57,6 +57,9 @@
#define MTK_UART_XON1 40 /* I/O: Xon character 1 */
#define MTK_UART_XOFF1 42 /* I/O: Xoff character 1 */

+#define MTK_UART_FEATURE_SEL 39 /* Feature Selection register */
+#define MTK_UART_FEAT_NEWRMAP BIT(0) /* Use new register map */
+
#ifdef CONFIG_SERIAL_8250_DMA
enum dma_rx_status {
DMA_RX_START = 0,
@@ -572,6 +575,10 @@ static int mtk8250_probe(struct platform_device *pdev)
uart.dma = data->dma;
#endif

+ /* Set AP UART new register map */
+ writel(MTK_UART_FEAT_NEWRMAP, uart.port.membase +
+ (MTK_UART_FEATURE_SEL << uart.port.regshift));
+
/* Disable Rate Fix function */
writel(0x0, uart.port.membase +
(MTK_UART_RATE_FIX << uart.port.regshift));
--
2.35.1



2022-07-11 10:40:38

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 031/230] drm/i915: Disable bonding on gen12+ platforms

From: Matthew Brost <[email protected]>

[ Upstream commit ce7e75c7ef1bf8ea3d947da8c674d2f40fd7d734 ]

Disable bonding on gen12+ platforms aside from ones already supported by
the i915 - TGL, RKL, and ADL-S.

Signed-off-by: Matthew Brost <[email protected]>
Reviewed-by: John Harrison <[email protected]>
Acked-by: Daniel Vetter <[email protected]>
Signed-off-by: Matt Roper <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/i915/gem/i915_gem_context.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c
index ee0c0b712522..ba2e037a82e4 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
@@ -442,6 +442,13 @@ set_proto_ctx_engines_bond(struct i915_user_extension __user *base, void *data)
u16 idx, num_bonds;
int err, n;

+ if (GRAPHICS_VER(i915) >= 12 && !IS_TIGERLAKE(i915) &&
+ !IS_ROCKETLAKE(i915) && !IS_ALDERLAKE_S(i915)) {
+ drm_dbg(&i915->drm,
+ "Bonding on gen12+ aside from TGL, RKL, and ADL_S not supported\n");
+ return -ENODEV;
+ }
+
if (get_user(idx, &ext->virtual_index))
return -EFAULT;

--
2.35.1



2022-07-11 10:40:39

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 049/230] net/mlx5e: Check action fwd/drop flag exists also for nic flows

From: Roi Dayan <[email protected]>

[ Upstream commit 6b50cf45b6a0e99f3cab848a72ecca8da56b7460 ]

The driver should add offloaded rules with either a fwd or drop action.
The check existed in parsing fdb flows but not when parsing nic flows.
Move the test into actions_match_supported() which is called for
checking nic flows and fdb flows.

Signed-off-by: Roi Dayan <[email protected]>
Reviewed-by: Maor Dickman <[email protected]>
Signed-off-by: Saeed Mahameed <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3aa8d0b83d10..fe52db591121 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -3305,6 +3305,12 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
ct_flow = flow_flag_test(flow, CT) && !ct_clear;
actions = flow->attr->action;

+ if (!(actions &
+ (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) {
+ NL_SET_ERR_MSG_MOD(extack, "Rule must have at least one forward/drop action");
+ return false;
+ }
+
if (mlx5e_is_eswitch_flow(flow)) {
if (flow->attr->esw_attr->split_count && ct_flow &&
!MLX5_CAP_GEN(flow->attr->esw_attr->in_mdev, reg_c_preserve)) {
@@ -4207,13 +4213,6 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
attr->action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
}

- if (!(attr->action &
- (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) {
- NL_SET_ERR_MSG_MOD(extack,
- "Rule must have at least one forward/drop action");
- return -EOPNOTSUPP;
- }
-
if (esw_attr->split_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
NL_SET_ERR_MSG_MOD(extack,
"current firmware doesn't support split rule for port mirroring");
--
2.35.1



2022-07-11 10:40:41

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 087/230] btrfs: use btrfs_get_dev_args_from_path in dev removal ioctls

From: Josef Bacik <[email protected]>

[ Upstream commit 1a15eb724aaef8656f8cc01d9355797cfe7c618e ]

For device removal and replace we call btrfs_find_device_by_devspec,
which if we give it a device path and nothing else will call
btrfs_get_dev_args_from_path, which opens the block device and reads the
super block and then looks up our device based on that.

However at this point we're holding the sb write "lock", so reading the
block device pulls in the dependency of ->open_mutex, which produces the
following lockdep splat

======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc2+ #405 Not tainted
------------------------------------------------------
losetup/11576 is trying to acquire lock:
ffff9bbe8cded938 ((wq_completion)loop0){+.+.}-{0:0}, at: flush_workqueue+0x67/0x5e0

but task is already holding lock:
ffff9bbe88e4fc68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #4 (&lo->lo_mutex){+.+.}-{3:3}:
__mutex_lock+0x7d/0x750
lo_open+0x28/0x60 [loop]
blkdev_get_whole+0x25/0xf0
blkdev_get_by_dev.part.0+0x168/0x3c0
blkdev_open+0xd2/0xe0
do_dentry_open+0x161/0x390
path_openat+0x3cc/0xa20
do_filp_open+0x96/0x120
do_sys_openat2+0x7b/0x130
__x64_sys_openat+0x46/0x70
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #3 (&disk->open_mutex){+.+.}-{3:3}:
__mutex_lock+0x7d/0x750
blkdev_get_by_dev.part.0+0x56/0x3c0
blkdev_get_by_path+0x98/0xa0
btrfs_get_bdev_and_sb+0x1b/0xb0
btrfs_find_device_by_devspec+0x12b/0x1c0
btrfs_rm_device+0x127/0x610
btrfs_ioctl+0x2a31/0x2e70
__x64_sys_ioctl+0x80/0xb0
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #2 (sb_writers#12){.+.+}-{0:0}:
lo_write_bvec+0xc2/0x240 [loop]
loop_process_work+0x238/0xd00 [loop]
process_one_work+0x26b/0x560
worker_thread+0x55/0x3c0
kthread+0x140/0x160
ret_from_fork+0x1f/0x30

-> #1 ((work_completion)(&lo->rootcg_work)){+.+.}-{0:0}:
process_one_work+0x245/0x560
worker_thread+0x55/0x3c0
kthread+0x140/0x160
ret_from_fork+0x1f/0x30

-> #0 ((wq_completion)loop0){+.+.}-{0:0}:
__lock_acquire+0x10ea/0x1d90
lock_acquire+0xb5/0x2b0
flush_workqueue+0x91/0x5e0
drain_workqueue+0xa0/0x110
destroy_workqueue+0x36/0x250
__loop_clr_fd+0x9a/0x660 [loop]
block_ioctl+0x3f/0x50
__x64_sys_ioctl+0x80/0xb0
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae

other info that might help us debug this:

Chain exists of:
(wq_completion)loop0 --> &disk->open_mutex --> &lo->lo_mutex

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&lo->lo_mutex);
lock(&disk->open_mutex);
lock(&lo->lo_mutex);
lock((wq_completion)loop0);

*** DEADLOCK ***

1 lock held by losetup/11576:
#0: ffff9bbe88e4fc68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop]

stack backtrace:
CPU: 0 PID: 11576 Comm: losetup Not tainted 5.14.0-rc2+ #405
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
Call Trace:
dump_stack_lvl+0x57/0x72
check_noncircular+0xcf/0xf0
? stack_trace_save+0x3b/0x50
__lock_acquire+0x10ea/0x1d90
lock_acquire+0xb5/0x2b0
? flush_workqueue+0x67/0x5e0
? lockdep_init_map_type+0x47/0x220
flush_workqueue+0x91/0x5e0
? flush_workqueue+0x67/0x5e0
? verify_cpu+0xf0/0x100
drain_workqueue+0xa0/0x110
destroy_workqueue+0x36/0x250
__loop_clr_fd+0x9a/0x660 [loop]
? blkdev_ioctl+0x8d/0x2a0
block_ioctl+0x3f/0x50
__x64_sys_ioctl+0x80/0xb0
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f31b02404cb

Instead what we want to do is populate our device lookup args before we
grab any locks, and then pass these args into btrfs_rm_device(). From
there we can find the device and do the appropriate removal.

Suggested-by: Anand Jain <[email protected]>
Reviewed-by: Anand Jain <[email protected]>
Signed-off-by: Josef Bacik <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/btrfs/ioctl.c | 67 +++++++++++++++++++++++++++-------------------
fs/btrfs/volumes.c | 15 +++++------
fs/btrfs/volumes.h | 2 +-
3 files changed, 48 insertions(+), 36 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 4951a2ab88dd..4317720a29e8 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3218,6 +3218,7 @@ static long btrfs_ioctl_add_dev(struct btrfs_fs_info *fs_info, void __user *arg)

static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
{
+ BTRFS_DEV_LOOKUP_ARGS(args);
struct inode *inode = file_inode(file);
struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
struct btrfs_ioctl_vol_args_v2 *vol_args;
@@ -3229,35 +3230,39 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
if (!capable(CAP_SYS_ADMIN))
return -EPERM;

- ret = mnt_want_write_file(file);
- if (ret)
- return ret;
-
vol_args = memdup_user(arg, sizeof(*vol_args));
if (IS_ERR(vol_args)) {
ret = PTR_ERR(vol_args);
- goto err_drop;
+ goto out;
}

if (vol_args->flags & ~BTRFS_DEVICE_REMOVE_ARGS_MASK) {
ret = -EOPNOTSUPP;
goto out;
}
+
vol_args->name[BTRFS_SUBVOL_NAME_MAX] = '\0';
- if (!(vol_args->flags & BTRFS_DEVICE_SPEC_BY_ID) &&
- strcmp("cancel", vol_args->name) == 0)
+ if (vol_args->flags & BTRFS_DEVICE_SPEC_BY_ID) {
+ args.devid = vol_args->devid;
+ } else if (!strcmp("cancel", vol_args->name)) {
cancel = true;
+ } else {
+ ret = btrfs_get_dev_args_from_path(fs_info, &args, vol_args->name);
+ if (ret)
+ goto out;
+ }
+
+ ret = mnt_want_write_file(file);
+ if (ret)
+ goto out;

ret = exclop_start_or_cancel_reloc(fs_info, BTRFS_EXCLOP_DEV_REMOVE,
cancel);
if (ret)
- goto out;
- /* Exclusive operation is now claimed */
+ goto err_drop;

- if (vol_args->flags & BTRFS_DEVICE_SPEC_BY_ID)
- ret = btrfs_rm_device(fs_info, NULL, vol_args->devid, &bdev, &mode);
- else
- ret = btrfs_rm_device(fs_info, vol_args->name, 0, &bdev, &mode);
+ /* Exclusive operation is now claimed */
+ ret = btrfs_rm_device(fs_info, &args, &bdev, &mode);

btrfs_exclop_finish(fs_info);

@@ -3269,17 +3274,19 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
btrfs_info(fs_info, "device deleted: %s",
vol_args->name);
}
-out:
- kfree(vol_args);
err_drop:
mnt_drop_write_file(file);
if (bdev)
blkdev_put(bdev, mode);
+out:
+ btrfs_put_dev_args_from_path(&args);
+ kfree(vol_args);
return ret;
}

static long btrfs_ioctl_rm_dev(struct file *file, void __user *arg)
{
+ BTRFS_DEV_LOOKUP_ARGS(args);
struct inode *inode = file_inode(file);
struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
struct btrfs_ioctl_vol_args *vol_args;
@@ -3291,32 +3298,38 @@ static long btrfs_ioctl_rm_dev(struct file *file, void __user *arg)
if (!capable(CAP_SYS_ADMIN))
return -EPERM;

- ret = mnt_want_write_file(file);
- if (ret)
- return ret;
-
vol_args = memdup_user(arg, sizeof(*vol_args));
- if (IS_ERR(vol_args)) {
- ret = PTR_ERR(vol_args);
- goto out_drop_write;
- }
+ if (IS_ERR(vol_args))
+ return PTR_ERR(vol_args);
+
vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
- cancel = (strcmp("cancel", vol_args->name) == 0);
+ if (!strcmp("cancel", vol_args->name)) {
+ cancel = true;
+ } else {
+ ret = btrfs_get_dev_args_from_path(fs_info, &args, vol_args->name);
+ if (ret)
+ goto out;
+ }
+
+ ret = mnt_want_write_file(file);
+ if (ret)
+ goto out;

ret = exclop_start_or_cancel_reloc(fs_info, BTRFS_EXCLOP_DEV_REMOVE,
cancel);
if (ret == 0) {
- ret = btrfs_rm_device(fs_info, vol_args->name, 0, &bdev, &mode);
+ ret = btrfs_rm_device(fs_info, &args, &bdev, &mode);
if (!ret)
btrfs_info(fs_info, "disk deleted %s", vol_args->name);
btrfs_exclop_finish(fs_info);
}

- kfree(vol_args);
-out_drop_write:
mnt_drop_write_file(file);
if (bdev)
blkdev_put(bdev, mode);
+out:
+ btrfs_put_dev_args_from_path(&args);
+ kfree(vol_args);
return ret;
}

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 8d09e6d442b2..3bd68f1b79e6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2120,8 +2120,9 @@ void btrfs_scratch_superblocks(struct btrfs_fs_info *fs_info,
update_dev_time(device_path);
}

-int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,
- u64 devid, struct block_device **bdev, fmode_t *mode)
+int btrfs_rm_device(struct btrfs_fs_info *fs_info,
+ struct btrfs_dev_lookup_args *args,
+ struct block_device **bdev, fmode_t *mode)
{
struct btrfs_device *device;
struct btrfs_fs_devices *cur_devices;
@@ -2140,14 +2141,12 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,
if (ret)
goto out;

- device = btrfs_find_device_by_devspec(fs_info, devid, device_path);
-
- if (IS_ERR(device)) {
- if (PTR_ERR(device) == -ENOENT &&
- device_path && strcmp(device_path, "missing") == 0)
+ device = btrfs_find_device(fs_info->fs_devices, args);
+ if (!device) {
+ if (args->missing)
ret = BTRFS_ERROR_DEV_MISSING_NOT_FOUND;
else
- ret = PTR_ERR(device);
+ ret = -ENOENT;
goto out;
}

diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index d1df03f77e29..30288b728bbb 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -496,7 +496,7 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info,
void btrfs_put_dev_args_from_path(struct btrfs_dev_lookup_args *args);
void btrfs_free_device(struct btrfs_device *device);
int btrfs_rm_device(struct btrfs_fs_info *fs_info,
- const char *device_path, u64 devid,
+ struct btrfs_dev_lookup_args *args,
struct block_device **bdev, fmode_t *mode);
void __exit btrfs_cleanup_fs_uuids(void);
int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len);
--
2.35.1



2022-07-11 10:40:46

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 197/230] ARM: at91: pm: use proper compatible for sama5d2s rtc

From: Claudiu Beznea <[email protected]>

[ Upstream commit ddc980da8043779119acaca106c6d9b445c9b65b ]

Use proper compatible strings for SAMA5D2's RTC IPs. This is necessary
for configuring wakeup sources for ULP1 PM mode.

Fixes: d7484f5c6b3b ("ARM: at91: pm: configure wakeup sources for ULP1 mode")
Signed-off-by: Claudiu Beznea <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/mach-at91/pm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 8711d6824c1f..cde99c9d0b2e 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -146,7 +146,7 @@ static const struct wakeup_source_info ws_info[] = {

static const struct of_device_id sama5d2_ws_ids[] = {
{ .compatible = "atmel,sama5d2-gem", .data = &ws_info[0] },
- { .compatible = "atmel,at91rm9200-rtc", .data = &ws_info[1] },
+ { .compatible = "atmel,sama5d2-rtc", .data = &ws_info[1] },
{ .compatible = "atmel,sama5d3-udc", .data = &ws_info[2] },
{ .compatible = "atmel,at91rm9200-ohci", .data = &ws_info[2] },
{ .compatible = "usb-ohci", .data = &ws_info[2] },
--
2.35.1



2022-07-11 10:40:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 208/230] ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15

From: Fabrice Gasnier <[email protected]>

[ Upstream commit 1d0c1aadf1fd9f3de95d1532b3651e8634546e71 ]

The USBH composed of EHCI and OHCI controllers needs the PHY clock to be
initialized first, before enabling (gating) them. The reverse is also
required when going to suspend.
So, add USBPHY clock as 1st entry in both controllers, so the USBPHY PLL
gets enabled 1st upon controller init. Upon suspend/resume, this also makes
the clock to be disabled/re-enabled in the correct order.
This fixes some IRQ storm conditions seen when going to low-power, due to
PHY PLL being disabled before all clocks are cleanly gated.

Fixes: 949a0c0dec85 ("ARM: dts: stm32: add USB Host (USBH) support to stm32mp157c")
Fixes: db7be2cb87ae ("ARM: dts: stm32: use usbphyc ck_usbo_48m as USBH OHCI clock on stm32mp151")
Signed-off-by: Fabrice Gasnier <[email protected]>
Signed-off-by: Alexandre Torgue <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/boot/dts/stm32mp151.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp151.dtsi b/arch/arm/boot/dts/stm32mp151.dtsi
index f693a7d24247..a9b65b3bfda5 100644
--- a/arch/arm/boot/dts/stm32mp151.dtsi
+++ b/arch/arm/boot/dts/stm32mp151.dtsi
@@ -1452,7 +1452,7 @@
usbh_ohci: usb@5800c000 {
compatible = "generic-ohci";
reg = <0x5800c000 0x1000>;
- clocks = <&rcc USBH>, <&usbphyc>;
+ clocks = <&usbphyc>, <&rcc USBH>;
resets = <&rcc USBH_R>;
interrupts = <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
status = "disabled";
@@ -1461,7 +1461,7 @@
usbh_ehci: usb@5800d000 {
compatible = "generic-ehci";
reg = <0x5800d000 0x1000>;
- clocks = <&rcc USBH>;
+ clocks = <&usbphyc>, <&rcc USBH>;
resets = <&rcc USBH_R>;
interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
companion = <&usbh_ohci>;
--
2.35.1



2022-07-11 10:40:59

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 219/230] Revert "mm/memory-failure.c: fix race with changing page compound again"

From: Naoya Horiguchi <[email protected]>

commit 2ba2b008a8bf5fd268a43d03ba79e0ad464d6836 upstream.

Reverts commit 888af2701db7 ("mm/memory-failure.c: fix race with changing
page compound again") because now we fetch the page refcount under
hugetlb_lock in try_memory_failure_hugetlb() so that the race check is no
longer necessary.

Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Naoya Horiguchi <[email protected]>
Suggested-by: Miaohe Lin <[email protected]>
Reviewed-by: Miaohe Lin <[email protected]>
Reviewed-by: Mike Kravetz <[email protected]>
Cc: Miaohe Lin <[email protected]>
Cc: Yang Shi <[email protected]>
Cc: Dan Carpenter <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
include/linux/mm.h | 1 -
include/ras/ras_event.h | 1 -
mm/memory-failure.c | 11 -----------
3 files changed, 13 deletions(-)

--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -3175,7 +3175,6 @@ enum mf_action_page_type {
MF_MSG_BUDDY_2ND,
MF_MSG_DAX,
MF_MSG_UNSPLIT_THP,
- MF_MSG_DIFFERENT_PAGE_SIZE,
MF_MSG_UNKNOWN,
};

--- a/include/ras/ras_event.h
+++ b/include/ras/ras_event.h
@@ -376,7 +376,6 @@ TRACE_EVENT(aer_event,
EM ( MF_MSG_BUDDY_2ND, "free buddy page (2nd try)" ) \
EM ( MF_MSG_DAX, "dax page" ) \
EM ( MF_MSG_UNSPLIT_THP, "unsplit thp" ) \
- EM ( MF_MSG_DIFFERENT_PAGE_SIZE, "different page size" ) \
EMe ( MF_MSG_UNKNOWN, "unknown page" )

/*
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -741,7 +741,6 @@ static const char * const action_page_ty
[MF_MSG_BUDDY_2ND] = "free buddy page (2nd try)",
[MF_MSG_DAX] = "dax page",
[MF_MSG_UNSPLIT_THP] = "unsplit thp",
- [MF_MSG_DIFFERENT_PAGE_SIZE] = "different page size",
[MF_MSG_UNKNOWN] = "unknown page",
};

@@ -1526,16 +1525,6 @@ retry:
return res == MF_RECOVERED ? 0 : -EBUSY;
}

- /*
- * The page could have changed compound pages due to race window.
- * If this happens just bail out.
- */
- if (!PageHuge(p) || compound_head(p) != head) {
- action_result(pfn, MF_MSG_DIFFERENT_PAGE_SIZE, MF_IGNORED);
- res = -EBUSY;
- goto out;
- }
-
page_flags = head->flags;

/*


2022-07-11 10:41:20

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 061/230] s390/setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE

From: Alexander Egorenkov <[email protected]>

[ Upstream commit 6b4b54c7ca347bcb4aa7a3cc01aa16e84ac7fbe4 ]

We need to preserve the values at OLDMEM_BASE and OLDMEM_SIZE which are
used by zgetdump in case when kdump crashes. In that case zgetdump will
attempt to read OLDMEM_BASE and OLDMEM_SIZE in order to find out where
the memory range [0 - OLDMEM_SIZE] belonging to the production kernel is.

Fixes: f1a546947431 ("s390/setup: don't reserve memory that occupied decompressor's head")
Cc: [email protected] # 5.15+
Signed-off-by: Alexander Egorenkov <[email protected]>
Acked-by: Vasily Gorbik <[email protected]>
Signed-off-by: Vasily Gorbik <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/s390/kernel/setup.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 2ebde341d057..36c1f31dfd66 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -798,6 +798,8 @@ static void __init check_initrd(void)
static void __init reserve_kernel(void)
{
memblock_reserve(0, STARTUP_NORMAL_OFFSET);
+ memblock_reserve(OLDMEM_BASE, sizeof(unsigned long));
+ memblock_reserve(OLDMEM_SIZE, sizeof(unsigned long));
memblock_reserve(__amode31_base, __eamode31 - __samode31);
memblock_reserve(__pa(sclp_early_sccb), EXT_SCCB_READ_SCP);
memblock_reserve(__pa(_stext), _end - _stext);
--
2.35.1



2022-07-11 10:41:20

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 057/230] netfilter: nft_payload: support for inner header matching / mangling

From: Pablo Neira Ayuso <[email protected]>

[ Upstream commit c46b38dc8743535e686b911d253a844f0bd50ead ]

Allow to match and mangle on inner headers / payload data after the
transport header. There is a new field in the pktinfo structure that
stores the inner header offset which is calculated only when requested.
Only TCP and UDP supported at this stage.

Signed-off-by: Pablo Neira Ayuso <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
include/net/netfilter/nf_tables.h | 2 +
include/uapi/linux/netfilter/nf_tables.h | 2 +
net/netfilter/nft_payload.c | 56 +++++++++++++++++++++++-
3 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index d005f87691da..bcfee89012a1 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -23,6 +23,7 @@ struct module;

enum {
NFT_PKTINFO_L4PROTO = (1 << 0),
+ NFT_PKTINFO_INNER = (1 << 1),
};

struct nft_pktinfo {
@@ -32,6 +33,7 @@ struct nft_pktinfo {
u8 tprot;
u16 fragoff;
unsigned int thoff;
+ unsigned int inneroff;
};

static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index e94d1fa554cb..07871c8a0601 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -753,11 +753,13 @@ enum nft_dynset_attributes {
* @NFT_PAYLOAD_LL_HEADER: link layer header
* @NFT_PAYLOAD_NETWORK_HEADER: network header
* @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
+ * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
*/
enum nft_payload_bases {
NFT_PAYLOAD_LL_HEADER,
NFT_PAYLOAD_NETWORK_HEADER,
NFT_PAYLOAD_TRANSPORT_HEADER,
+ NFT_PAYLOAD_INNER_HEADER,
};

/**
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index c3ccfff54a35..ee359a4a60f5 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -22,6 +22,7 @@
#include <linux/icmpv6.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
+#include <linux/ip.h>
#include <net/sctp/checksum.h>

static bool nft_payload_rebuild_vlan_hdr(const struct sk_buff *skb, int mac_off,
@@ -79,6 +80,45 @@ nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len)
return skb_copy_bits(skb, offset + mac_off, dst_u8, len) == 0;
}

+static int __nft_payload_inner_offset(struct nft_pktinfo *pkt)
+{
+ unsigned int thoff = nft_thoff(pkt);
+
+ if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
+ return -1;
+
+ switch (pkt->tprot) {
+ case IPPROTO_UDP:
+ pkt->inneroff = thoff + sizeof(struct udphdr);
+ break;
+ case IPPROTO_TCP: {
+ struct tcphdr *th, _tcph;
+
+ th = skb_header_pointer(pkt->skb, thoff, sizeof(_tcph), &_tcph);
+ if (!th)
+ return -1;
+
+ pkt->inneroff = thoff + __tcp_hdrlen(th);
+ }
+ break;
+ default:
+ return -1;
+ }
+
+ pkt->flags |= NFT_PKTINFO_INNER;
+
+ return 0;
+}
+
+static int nft_payload_inner_offset(const struct nft_pktinfo *pkt)
+{
+ if (!(pkt->flags & NFT_PKTINFO_INNER) &&
+ __nft_payload_inner_offset((struct nft_pktinfo *)pkt) < 0)
+ return -1;
+
+ return pkt->inneroff;
+}
+
void nft_payload_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
@@ -112,6 +152,11 @@ void nft_payload_eval(const struct nft_expr *expr,
goto err;
offset = nft_thoff(pkt);
break;
+ case NFT_PAYLOAD_INNER_HEADER:
+ offset = nft_payload_inner_offset(pkt);
+ if (offset < 0)
+ goto err;
+ break;
default:
BUG();
}
@@ -617,6 +662,11 @@ static void nft_payload_set_eval(const struct nft_expr *expr,
goto err;
offset = nft_thoff(pkt);
break;
+ case NFT_PAYLOAD_INNER_HEADER:
+ offset = nft_payload_inner_offset(pkt);
+ if (offset < 0)
+ goto err;
+ break;
default:
BUG();
}
@@ -625,7 +675,8 @@ static void nft_payload_set_eval(const struct nft_expr *expr,
offset += priv->offset;

if ((priv->csum_type == NFT_PAYLOAD_CSUM_INET || priv->csum_flags) &&
- (priv->base != NFT_PAYLOAD_TRANSPORT_HEADER ||
+ ((priv->base != NFT_PAYLOAD_TRANSPORT_HEADER &&
+ priv->base != NFT_PAYLOAD_INNER_HEADER) ||
skb->ip_summed != CHECKSUM_PARTIAL)) {
fsum = skb_checksum(skb, offset, priv->len, 0);
tsum = csum_partial(src, priv->len, 0);
@@ -744,6 +795,7 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
case NFT_PAYLOAD_LL_HEADER:
case NFT_PAYLOAD_NETWORK_HEADER:
case NFT_PAYLOAD_TRANSPORT_HEADER:
+ case NFT_PAYLOAD_INNER_HEADER:
break;
default:
return ERR_PTR(-EOPNOTSUPP);
@@ -762,7 +814,7 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));

if (len <= 4 && is_power_of_2(len) && IS_ALIGNED(offset, len) &&
- base != NFT_PAYLOAD_LL_HEADER)
+ base != NFT_PAYLOAD_LL_HEADER && base != NFT_PAYLOAD_INNER_HEADER)
return &nft_payload_fast_ops;
else
return &nft_payload_ops;
--
2.35.1



2022-07-11 10:41:21

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 163/230] PM: runtime: Redefine pm_runtime_release_supplier()

From: Rafael J. Wysocki <[email protected]>

commit 07358194badf73e267289b40b761f5dc56928eab upstream.

Instead of passing an extra bool argument to pm_runtime_release_supplier(),
make its callers take care of triggering a runtime-suspend of the
supplier device as needed.

No expected functional impact.

Suggested-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
Reviewed-by: Greg Kroah-Hartman <[email protected]>
Cc: 5.1+ <[email protected]> # 5.1+
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/base/core.c | 3 ++-
drivers/base/power/runtime.c | 20 +++++++++-----------
include/linux/pm_runtime.h | 5 ++---
3 files changed, 13 insertions(+), 15 deletions(-)

--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -485,7 +485,8 @@ static void device_link_release_fn(struc
/* Ensure that all references to the link object have been dropped. */
device_link_synchronize_removal();

- pm_runtime_release_supplier(link, true);
+ pm_runtime_release_supplier(link);
+ pm_request_idle(link->supplier);

put_device(link->consumer);
put_device(link->supplier);
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -308,13 +308,10 @@ static int rpm_get_suppliers(struct devi
/**
* pm_runtime_release_supplier - Drop references to device link's supplier.
* @link: Target device link.
- * @check_idle: Whether or not to check if the supplier device is idle.
*
- * Drop all runtime PM references associated with @link to its supplier device
- * and if @check_idle is set, check if that device is idle (and so it can be
- * suspended).
+ * Drop all runtime PM references associated with @link to its supplier device.
*/
-void pm_runtime_release_supplier(struct device_link *link, bool check_idle)
+void pm_runtime_release_supplier(struct device_link *link)
{
struct device *supplier = link->supplier;

@@ -327,9 +324,6 @@ void pm_runtime_release_supplier(struct
while (refcount_dec_not_one(&link->rpm_active) &&
atomic_read(&supplier->power.usage_count) > 0)
pm_runtime_put_noidle(supplier);
-
- if (check_idle)
- pm_request_idle(supplier);
}

static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend)
@@ -337,8 +331,11 @@ static void __rpm_put_suppliers(struct d
struct device_link *link;

list_for_each_entry_rcu(link, &dev->links.suppliers, c_node,
- device_links_read_lock_held())
- pm_runtime_release_supplier(link, try_to_suspend);
+ device_links_read_lock_held()) {
+ pm_runtime_release_supplier(link);
+ if (try_to_suspend)
+ pm_request_idle(link->supplier);
+ }
}

static void rpm_put_suppliers(struct device *dev)
@@ -1791,7 +1788,8 @@ void pm_runtime_drop_link(struct device_
return;

pm_runtime_drop_link_count(link->consumer);
- pm_runtime_release_supplier(link, true);
+ pm_runtime_release_supplier(link);
+ pm_request_idle(link->supplier);
}

static bool pm_runtime_need_not_resume(struct device *dev)
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -58,7 +58,7 @@ extern void pm_runtime_get_suppliers(str
extern void pm_runtime_put_suppliers(struct device *dev);
extern void pm_runtime_new_link(struct device *dev);
extern void pm_runtime_drop_link(struct device_link *link);
-extern void pm_runtime_release_supplier(struct device_link *link, bool check_idle);
+extern void pm_runtime_release_supplier(struct device_link *link);

extern int devm_pm_runtime_enable(struct device *dev);

@@ -284,8 +284,7 @@ static inline void pm_runtime_get_suppli
static inline void pm_runtime_put_suppliers(struct device *dev) {}
static inline void pm_runtime_new_link(struct device *dev) {}
static inline void pm_runtime_drop_link(struct device_link *link) {}
-static inline void pm_runtime_release_supplier(struct device_link *link,
- bool check_idle) {}
+static inline void pm_runtime_release_supplier(struct device_link *link) {}

#endif /* !CONFIG_PM */



2022-07-11 10:41:24

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 199/230] ARM: at91: pm: use proper compatibles for sama7g5s rtc and rtt

From: Claudiu Beznea <[email protected]>

[ Upstream commit 1c40169b35ad58906814d53a517ac92db3d20d5f ]

Use proper compatible strings for SAMA7G5's RTC and RTT IPs. These are
necessary for configuring wakeup sources for ULP1 PM mode.

Fixes: 6501330f9f5e ("ARM: at91: pm: add pm support for SAMA7G5")
Signed-off-by: Claudiu Beznea <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/mach-at91/pm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index cbad3609b783..ed1050404ef0 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -168,13 +168,13 @@ static const struct of_device_id sam9x60_ws_ids[] = {
};

static const struct of_device_id sama7g5_ws_ids[] = {
- { .compatible = "atmel,at91sam9x5-rtc", .data = &ws_info[1] },
+ { .compatible = "microchip,sama7g5-rtc", .data = &ws_info[1] },
{ .compatible = "microchip,sama7g5-ohci", .data = &ws_info[2] },
{ .compatible = "usb-ohci", .data = &ws_info[2] },
{ .compatible = "atmel,at91sam9g45-ehci", .data = &ws_info[2] },
{ .compatible = "usb-ehci", .data = &ws_info[2] },
{ .compatible = "microchip,sama7g5-sdhci", .data = &ws_info[3] },
- { .compatible = "atmel,at91sam9260-rtt", .data = &ws_info[4] },
+ { .compatible = "microchip,sama7g5-rtt", .data = &ws_info[4] },
{ /* sentinel */ }
};

--
2.35.1



2022-07-11 10:41:26

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 044/230] mt76: mt7921: introduce mt7921_mcu_set_beacon_filter utility routine

From: Lorenzo Bianconi <[email protected]>

[ Upstream commit 890809ca1986e63d29dd1591090af67b655ed89c ]

Introduce mt7921_mcu_set_beacon_filter utility routine in order to
remove duplicated code for hw beacon filtering.
Move mt7921_pm_interface_iter in debugfs since it is just used there.
Make the following routine static:
- mt7921_pm_interface_iter
- mt7921_mcu_uni_bss_bcnft
- mt7921_mcu_set_bss_pm

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
.../wireless/mediatek/mt76/mt7921/debugfs.c | 20 +++++---
.../net/wireless/mediatek/mt76/mt7921/main.c | 33 +------------
.../net/wireless/mediatek/mt76/mt7921/mcu.c | 47 ++++++++++---------
.../wireless/mediatek/mt76/mt7921/mt7921.h | 8 ++--
4 files changed, 45 insertions(+), 63 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
index 8d5e261cd10f..82fb2585f413 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
@@ -262,30 +262,38 @@ mt7921_txpwr(struct seq_file *s, void *data)
return 0;
}

+static void
+mt7921_pm_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
+{
+ struct mt7921_dev *dev = priv;
+
+ mt7921_mcu_set_beacon_filter(dev, vif, dev->pm.enable);
+}
+
static int
mt7921_pm_set(void *data, u64 val)
{
struct mt7921_dev *dev = data;
struct mt76_connac_pm *pm = &dev->pm;
- struct mt76_phy *mphy = dev->phy.mt76;
-
- if (val == pm->enable)
- return 0;

mt7921_mutex_acquire(dev);

+ if (val == pm->enable)
+ goto out;
+
if (!pm->enable) {
pm->stats.last_wake_event = jiffies;
pm->stats.last_doze_event = jiffies;
}
pm->enable = val;

- ieee80211_iterate_active_interfaces(mphy->hw,
+ ieee80211_iterate_active_interfaces(mt76_hw(dev),
IEEE80211_IFACE_ITER_RESUME_ALL,
- mt7921_pm_interface_iter, mphy->priv);
+ mt7921_pm_interface_iter, dev);

mt76_connac_mcu_set_deep_sleep(&dev->mt76, pm->ds_enable);

+out:
mt7921_mutex_release(dev);

return 0;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index 30252f408ddc..13a7ae3d8351 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -528,36 +528,6 @@ static void mt7921_configure_filter(struct ieee80211_hw *hw,
mt7921_mutex_release(dev);
}

-static int
-mt7921_bss_bcnft_apply(struct mt7921_dev *dev, struct ieee80211_vif *vif,
- bool assoc)
-{
- int ret;
-
- if (!dev->pm.enable)
- return 0;
-
- if (assoc) {
- ret = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
- if (ret)
- return ret;
-
- vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
- mt76_set(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
-
- return 0;
- }
-
- ret = mt7921_mcu_set_bss_pm(dev, vif, false);
- if (ret)
- return ret;
-
- vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
- mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
-
- return 0;
-}
-
static void mt7921_bss_info_changed(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
struct ieee80211_bss_conf *info,
@@ -587,7 +557,8 @@ static void mt7921_bss_info_changed(struct ieee80211_hw *hw,
if (changed & BSS_CHANGED_ASSOC) {
mt7921_mcu_sta_update(dev, NULL, vif, true,
MT76_STA_INFO_STATE_ASSOC);
- mt7921_bss_bcnft_apply(dev, vif, info->assoc);
+ if (dev->pm.enable)
+ mt7921_mcu_set_beacon_filter(dev, vif, info->assoc);
}

if (changed & BSS_CHANGED_ARP_FILTER) {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 4119f8efd896..dabc0de2ec65 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1205,8 +1205,9 @@ int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif)
&ps_req, sizeof(ps_req), true);
}

-int mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
- bool enable)
+static int
+mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
+ bool enable)
{
struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
struct {
@@ -1240,8 +1241,9 @@ int mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
&bcnft_req, sizeof(bcnft_req), true);
}

-int mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
- bool enable)
+static int
+mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
+ bool enable)
{
struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
struct {
@@ -1390,31 +1392,34 @@ int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev)
return err;
}

-void
-mt7921_pm_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
+int mt7921_mcu_set_beacon_filter(struct mt7921_dev *dev,
+ struct ieee80211_vif *vif,
+ bool enable)
{
- struct mt7921_phy *phy = priv;
- struct mt7921_dev *dev = phy->dev;
struct ieee80211_hw *hw = mt76_hw(dev);
- int ret;
-
- if (dev->pm.enable)
- ret = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
- else
- ret = mt7921_mcu_set_bss_pm(dev, vif, false);
+ int err;

- if (ret)
- return;
+ if (enable) {
+ err = mt7921_mcu_uni_bss_bcnft(dev, vif, true);
+ if (err)
+ return err;

- if (dev->pm.enable) {
vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
ieee80211_hw_set(hw, CONNECTION_MONITOR);
mt76_set(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
- } else {
- vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
- __clear_bit(IEEE80211_HW_CONNECTION_MONITOR, hw->flags);
- mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
+
+ return 0;
}
+
+ err = mt7921_mcu_set_bss_pm(dev, vif, false);
+ if (err)
+ return err;
+
+ vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
+ __clear_bit(IEEE80211_HW_CONNECTION_MONITOR, hw->flags);
+ mt76_clear(dev, MT_WF_RFCR(0), MT_WF_RFCR_DROP_OTHER_BEACON);
+
+ return 0;
}

int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
index 1aafd8723b3a..32d4f2cab94e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
@@ -363,6 +363,9 @@ void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
void mt7921_update_channel(struct mt76_phy *mphy);
int mt7921_init_debugfs(struct mt7921_dev *dev);

+int mt7921_mcu_set_beacon_filter(struct mt7921_dev *dev,
+ struct ieee80211_vif *vif,
+ bool enable);
int mt7921_mcu_uni_tx_ba(struct mt7921_dev *dev,
struct ieee80211_ampdu_params *params,
bool enable);
@@ -371,17 +374,12 @@ int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
bool enable);
void mt7921_scan_work(struct work_struct *work);
int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif);
-int mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
- bool enable);
-int mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
- bool enable);
int __mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev);
int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev);
int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev);
void mt7921_pm_wake_work(struct work_struct *work);
void mt7921_pm_power_save_work(struct work_struct *work);
bool mt7921_wait_for_mcu_init(struct mt7921_dev *dev);
-void mt7921_pm_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif);
void mt7921_coredump_work(struct work_struct *work);
int mt7921_wfsys_reset(struct mt7921_dev *dev);
int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr);
--
2.35.1



2022-07-11 10:41:31

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 137/230] tty: n_gsm: fix invalid gsmtty_write_room() result

From: Daniel Starke <[email protected]>

[ Upstream commit 9361ebfbb79fd1bc8594a487c01ad52cdaa391ea ]

gsmtty_write() does not prevent the user to use the full fifo size of 4096
bytes as allocated in gsm_dlci_alloc(). However, gsmtty_write_room() tries
to limit the return value by 'TX_SIZE' and returns a negative value if the
fifo has more than 'TX_SIZE' bytes stored. This is obviously wrong as
'TX_SIZE' is defined as 512.
Define 'TX_SIZE' to the fifo size and use it accordingly for allocation to
keep the current behavior. Return the correct remaining size of the fifo in
gsmtty_write_room() via kfifo_avail().

Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Cc: [email protected]
Signed-off-by: Daniel Starke <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/tty/n_gsm.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index fd4a86111a6e..4a430f6ca170 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -137,6 +137,7 @@ struct gsm_dlci {
int retries;
/* Uplink tty if active */
struct tty_port port; /* The tty bound to this DLCI if there is one */
+#define TX_SIZE 4096 /* Must be power of 2. */
struct kfifo fifo; /* Queue fifo for the DLCI */
int adaption; /* Adaption layer in use */
int prev_adaption;
@@ -1758,7 +1759,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
return NULL;
spin_lock_init(&dlci->lock);
mutex_init(&dlci->mutex);
- if (kfifo_alloc(&dlci->fifo, 4096, GFP_KERNEL) < 0) {
+ if (kfifo_alloc(&dlci->fifo, TX_SIZE, GFP_KERNEL) < 0) {
kfree(dlci);
return NULL;
}
@@ -3035,8 +3036,6 @@ static struct tty_ldisc_ops tty_ldisc_packet = {
* Virtual tty side
*/

-#define TX_SIZE 512
-
/**
* gsm_modem_upd_via_data - send modem bits via convergence layer
* @dlci: channel
@@ -3274,7 +3273,7 @@ static unsigned int gsmtty_write_room(struct tty_struct *tty)
struct gsm_dlci *dlci = tty->driver_data;
if (dlci->state == DLCI_CLOSED)
return 0;
- return TX_SIZE - kfifo_len(&dlci->fifo);
+ return kfifo_avail(&dlci->fifo);
}

static unsigned int gsmtty_chars_in_buffer(struct tty_struct *tty)
--
2.35.1



2022-07-11 10:41:31

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 043/230] mt76: mt7921: get rid of mt7921_mac_set_beacon_filter

From: Lorenzo Bianconi <[email protected]>

[ Upstream commit b30363102a4122f6eed37927b64a2c7ac70b8859 ]

Remove mt7921_mac_set_beacon_filter routine since it is no longer used.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
.../net/wireless/mediatek/mt76/mt7921/mac.c | 28 -------------------
.../wireless/mediatek/mt76/mt7921/mt7921.h | 3 --
2 files changed, 31 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
index bef8d4a76ed9..426e7a32bdc8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
@@ -1573,34 +1573,6 @@ void mt7921_pm_power_save_work(struct work_struct *work)
queue_delayed_work(dev->mt76.wq, &dev->pm.ps_work, delta);
}

-int mt7921_mac_set_beacon_filter(struct mt7921_phy *phy,
- struct ieee80211_vif *vif,
- bool enable)
-{
- struct mt7921_dev *dev = phy->dev;
- bool ext_phy = phy != &dev->phy;
- int err;
-
- if (!dev->pm.enable)
- return -EOPNOTSUPP;
-
- err = mt7921_mcu_set_bss_pm(dev, vif, enable);
- if (err)
- return err;
-
- if (enable) {
- vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
- mt76_set(dev, MT_WF_RFCR(ext_phy),
- MT_WF_RFCR_DROP_OTHER_BEACON);
- } else {
- vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
- mt76_clear(dev, MT_WF_RFCR(ext_phy),
- MT_WF_RFCR_DROP_OTHER_BEACON);
- }
-
- return 0;
-}
-
void mt7921_coredump_work(struct work_struct *work)
{
struct mt7921_dev *dev;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
index 2d8bd6bfc820..1aafd8723b3a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
@@ -381,9 +381,6 @@ int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev);
void mt7921_pm_wake_work(struct work_struct *work);
void mt7921_pm_power_save_work(struct work_struct *work);
bool mt7921_wait_for_mcu_init(struct mt7921_dev *dev);
-int mt7921_mac_set_beacon_filter(struct mt7921_phy *phy,
- struct ieee80211_vif *vif,
- bool enable);
void mt7921_pm_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif);
void mt7921_coredump_work(struct work_struct *work);
int mt7921_wfsys_reset(struct mt7921_dev *dev);
--
2.35.1



2022-07-11 10:41:32

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 159/230] fbdev: fbmem: Fix logo center image dx issue

From: Guiling Deng <[email protected]>

commit 955f04766d4e6eb94bf3baa539e096808c74ebfb upstream.

Image.dx gets wrong value because of missing '()'.

If xres == logo->width and n == 1, image.dx = -16.

Signed-off-by: Guiling Deng <[email protected]>
Fixes: 3d8b1933eb1c ("fbdev: fbmem: add config option to center the bootup logo")
Cc: [email protected] # v5.0+
Signed-off-by: Helge Deller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/video/fbdev/core/fbmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -514,7 +514,7 @@ static int fb_show_logo_line(struct fb_i

while (n && (n * (logo->width + 8) - 8 > xres))
--n;
- image.dx = (xres - n * (logo->width + 8) - 8) / 2;
+ image.dx = (xres - (n * (logo->width + 8) - 8)) / 2;
image.dy = y ?: (yres - logo->height) / 2;
} else {
image.dx = 0;


2022-07-11 10:41:39

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 216/230] misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer

From: Shuah Khan <[email protected]>

commit eb7f8e28420372787933eec079735c35034bda7d upstream.

rtsx_usb driver allocates coherent dma buffer for urb transfers.
This buffer is passed to usb_bulk_msg() and usb core tries to
map already mapped buffer running into a dma mapping error.

xhci_hcd 0000:01:00.0: rejecting DMA map of vmalloc memory
WARNING: CPU: 1 PID: 279 at include/linux/dma-mapping.h:326 usb_ hcd_map_urb_for_dma+0x7d6/0x820

...

xhci_map_urb_for_dma+0x291/0x4e0
usb_hcd_submit_urb+0x199/0x12b0
...
usb_submit_urb+0x3b8/0x9e0
usb_start_wait_urb+0xe3/0x2d0
usb_bulk_msg+0x115/0x240
rtsx_usb_transfer_data+0x185/0x1a8 [rtsx_usb]
rtsx_usb_send_cmd+0xbb/0x123 [rtsx_usb]
rtsx_usb_write_register+0x12c/0x143 [rtsx_usb]
rtsx_usb_probe+0x226/0x4b2 [rtsx_usb]

Fix it to use kmalloc() to get DMA-able memory region instead.

Signed-off-by: Shuah Khan <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/667d627d502e1ba9ff4f9b94966df3299d2d3c0d.1656642167.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/misc/cardreader/rtsx_usb.c | 13 +++++++------
include/linux/rtsx_usb.h | 1 -
2 files changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/misc/cardreader/rtsx_usb.c
+++ b/drivers/misc/cardreader/rtsx_usb.c
@@ -631,8 +631,7 @@ static int rtsx_usb_probe(struct usb_int

ucr->pusb_dev = usb_dev;

- ucr->iobuf = usb_alloc_coherent(ucr->pusb_dev, IOBUF_SIZE,
- GFP_KERNEL, &ucr->iobuf_dma);
+ ucr->iobuf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
if (!ucr->iobuf)
return -ENOMEM;

@@ -668,8 +667,9 @@ static int rtsx_usb_probe(struct usb_int

out_init_fail:
usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
+ kfree(ucr->iobuf);
+ ucr->iobuf = NULL;
+ ucr->cmd_buf = ucr->rsp_buf = NULL;
return ret;
}

@@ -682,8 +682,9 @@ static void rtsx_usb_disconnect(struct u
mfd_remove_devices(&intf->dev);

usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
+ kfree(ucr->iobuf);
+ ucr->iobuf = NULL;
+ ucr->cmd_buf = ucr->rsp_buf = NULL;
}

#ifdef CONFIG_PM
--- a/include/linux/rtsx_usb.h
+++ b/include/linux/rtsx_usb.h
@@ -55,7 +55,6 @@ struct rtsx_ucr {
struct usb_interface *pusb_intf;
struct usb_sg_request current_sg;
unsigned char *iobuf;
- dma_addr_t iobuf_dma;

struct timer_list sg_timer;
struct mutex dev_mutex;


2022-07-11 10:41:42

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 211/230] selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT

From: Vladimir Oltean <[email protected]>

[ Upstream commit 1a635d3e1c80626237fdae47a5545b6655d8d81c ]

The first host interface has by default no interest in receiving packets
MAC DA de:ad:be:ef:13:37, so it might drop them before they hit the tc
filter and this might confuse the selftest.

Enable promiscuous mode such that the filter properly counts received
packets.

Fixes: d4deb01467ec ("selftests: forwarding: Add a test for FDB learning")
Signed-off-by: Vladimir Oltean <[email protected]>
Reviewed-by: Ido Schimmel <[email protected]>
Tested-by: Ido Schimmel <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
tools/testing/selftests/net/forwarding/lib.sh | 2 ++
1 file changed, 2 insertions(+)

diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
index 8a9c55fe841a..0db6ea8d7e05 100644
--- a/tools/testing/selftests/net/forwarding/lib.sh
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -1149,6 +1149,7 @@ learning_test()
# FDB entry was installed.
bridge link set dev $br_port1 flood off

+ ip link set $host1_if promisc on
tc qdisc add dev $host1_if ingress
tc filter add dev $host1_if ingress protocol ip pref 1 handle 101 \
flower dst_mac $mac action drop
@@ -1198,6 +1199,7 @@ learning_test()

tc filter del dev $host1_if ingress protocol ip pref 1 handle 101 flower
tc qdisc del dev $host1_if ingress
+ ip link set $host1_if promisc off

bridge link set dev $br_port1 flood on

--
2.35.1



2022-07-11 10:41:49

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 184/230] ARM: mxs_defconfig: Enable the framebuffer

From: Fabio Estevam <[email protected]>

[ Upstream commit b10ef5f2ddb3a5a22ac0936c8d91a50ac5e55e77 ]

Currently, when booting Linux on a imx28-evk board there is
no display activity.

Enable CONFIG_FB which is nowadays required for CONFIG_DRM_PANEL_LVDS,
CONFIG_DRM_PANEL_SIMPLE, CONFIG_DRM_PANEL_SEIKO_43WVF1G,
CONFIG_FB_MODE_HELPERS, CONFIG_BACKLIGHT_PWM, CONFIG_BACKLIGHT_GPIO,
CONFIG_FRAMEBUFFER_CONSOLE, CONFIG_LOGO, CONFIG_FONTS, CONFIG_FONT_8x8
and CONFIG_FONT_8x16.

Based on commit c54467482ffd ("ARM: imx_v6_v7_defconfig: enable fb").

Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB")
Signed-off-by: Fabio Estevam <[email protected]>
Signed-off-by: Shawn Guo <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/configs/mxs_defconfig | 1 +
1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/mxs_defconfig b/arch/arm/configs/mxs_defconfig
index ca32446b187f..f53086ddc48b 100644
--- a/arch/arm/configs/mxs_defconfig
+++ b/arch/arm/configs/mxs_defconfig
@@ -93,6 +93,7 @@ CONFIG_REGULATOR_FIXED_VOLTAGE=y
CONFIG_DRM=y
CONFIG_DRM_PANEL_SEIKO_43WVF1G=y
CONFIG_DRM_MXSFB=y
+CONFIG_FB=y
CONFIG_FB_MODE_HELPERS=y
CONFIG_LCD_CLASS_DEVICE=y
CONFIG_BACKLIGHT_CLASS_DEVICE=y
--
2.35.1



2022-07-11 10:41:53

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 210/230] selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT

From: Vladimir Oltean <[email protected]>

[ Upstream commit b8e629b05f5d23f9649c901bef09fab8b0c2e4b9 ]

As mentioned in the blamed commit, flood_unicast_test() works by
checking the match count on a tc filter placed on the receiving
interface.

But the second host interface (host2_if) has no interest in receiving a
packet with MAC DA de:ad:be:ef:13:37, so its RX filter drops it even
before the ingress tc filter gets to be executed. So we will incorrectly
get the message "Packet was not flooded when should", when in fact, the
packet was flooded as expected but dropped due to an unrelated reason,
at some other layer on the receiving side.

Force h2 to accept this packet by temporarily placing it in promiscuous
mode. Alternatively we could either deliver to its MAC address or use
tcpdump_start, but this has the fewest complications.

This fixes the "flooding" test from bridge_vlan_aware.sh and
bridge_vlan_unaware.sh, which calls flood_test from the lib.

Fixes: 236dd50bf67a ("selftests: forwarding: Add a test for flooded traffic")
Signed-off-by: Vladimir Oltean <[email protected]>
Reviewed-by: Ido Schimmel <[email protected]>
Tested-by: Ido Schimmel <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
tools/testing/selftests/net/forwarding/lib.sh | 2 ++
1 file changed, 2 insertions(+)

diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
index 92087d423bcf..8a9c55fe841a 100644
--- a/tools/testing/selftests/net/forwarding/lib.sh
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -1215,6 +1215,7 @@ flood_test_do()

# Add an ACL on `host2_if` which will tell us whether the packet
# was flooded to it or not.
+ ip link set $host2_if promisc on
tc qdisc add dev $host2_if ingress
tc filter add dev $host2_if ingress protocol ip pref 1 handle 101 \
flower dst_mac $mac action drop
@@ -1232,6 +1233,7 @@ flood_test_do()

tc filter del dev $host2_if ingress protocol ip pref 1 handle 101 flower
tc qdisc del dev $host2_if ingress
+ ip link set $host2_if promisc off

return $err
}
--
2.35.1



2022-07-11 10:42:18

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 177/230] ARM: meson: Fix refcount leak in meson_smp_prepare_cpus

From: Miaoqian Lin <[email protected]>

[ Upstream commit 34d2cd3fccced12b958b8848e3eff0ee4296764c ]

of_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.

Fixes: d850f3e5d296 ("ARM: meson: Add SMP bringup code for Meson8 and Meson8b")
Signed-off-by: Miaoqian Lin <[email protected]>
Reviewed-by: Martin Blumenstingl <[email protected]>
Signed-off-by: Neil Armstrong <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/mach-meson/platsmp.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/arch/arm/mach-meson/platsmp.c b/arch/arm/mach-meson/platsmp.c
index 4b8ad728bb42..32ac60b89fdc 100644
--- a/arch/arm/mach-meson/platsmp.c
+++ b/arch/arm/mach-meson/platsmp.c
@@ -71,6 +71,7 @@ static void __init meson_smp_prepare_cpus(const char *scu_compatible,
}

sram_base = of_iomap(node, 0);
+ of_node_put(node);
if (!sram_base) {
pr_err("Couldn't map SRAM registers\n");
return;
@@ -91,6 +92,7 @@ static void __init meson_smp_prepare_cpus(const char *scu_compatible,
}

scu_base = of_iomap(node, 0);
+ of_node_put(node);
if (!scu_base) {
pr_err("Couldn't map SCU registers\n");
return;
--
2.35.1



2022-07-11 10:42:34

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 125/230] btrfs: zoned: use dedicated lock for data relocation

From: Naohiro Aota <[email protected]>

[ Upstream commit 5f0addf7b89085f8e0a2593faa419d6111612b9b ]

Currently, we use btrfs_inode_{lock,unlock}() to grant an exclusive
writeback of the relocation data inode in
btrfs_zoned_data_reloc_{lock,unlock}(). However, that can cause a deadlock
in the following path.

Thread A takes btrfs_inode_lock() and waits for metadata reservation by
e.g, waiting for writeback:

prealloc_file_extent_cluster()
- btrfs_inode_lock(&inode->vfs_inode, 0);
- btrfs_prealloc_file_range()
...
- btrfs_replace_file_extents()
- btrfs_start_transaction
...
- btrfs_reserve_metadata_bytes()

Thread B (e.g, doing a writeback work) needs to wait for the inode lock to
continue writeback process:

do_writepages
- btrfs_writepages
- extent_writpages
- btrfs_zoned_data_reloc_lock(BTRFS_I(inode));
- btrfs_inode_lock()

The deadlock is caused by relying on the vfs_inode's lock. By using it, we
introduced unnecessary exclusion of writeback and
btrfs_prealloc_file_range(). Also, the lock at this point is useless as we
don't have any dirty pages in the inode yet.

Introduce fs_info->zoned_data_reloc_io_lock and use it for the exclusive
writeback.

Fixes: 35156d852762 ("btrfs: zoned: only allow one process to add pages to a relocation inode")
CC: [email protected] # 5.16.x: 869f4cdc73f9: btrfs: zoned: encapsulate inode locking for zoned relocation
CC: [email protected] # 5.16.x
CC: [email protected] # 5.17
Cc: Johannes Thumshirn <[email protected]>
Reviewed-by: Johannes Thumshirn <[email protected]>
Signed-off-by: Naohiro Aota <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/btrfs/ctree.h | 1 +
fs/btrfs/disk-io.c | 1 +
fs/btrfs/zoned.h | 4 ++--
3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index cc72d8981c47..d1838de0b39c 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1027,6 +1027,7 @@ struct btrfs_fs_info {
*/
spinlock_t relocation_bg_lock;
u64 data_reloc_bg;
+ struct mutex zoned_data_reloc_io_lock;

#ifdef CONFIG_BTRFS_FS_REF_VERIFY
spinlock_t ref_verify_lock;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 233d894f6feb..909d19656316 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2914,6 +2914,7 @@ void btrfs_init_fs_info(struct btrfs_fs_info *fs_info)
mutex_init(&fs_info->reloc_mutex);
mutex_init(&fs_info->delalloc_root_mutex);
mutex_init(&fs_info->zoned_meta_io_lock);
+ mutex_init(&fs_info->zoned_data_reloc_io_lock);
seqlock_init(&fs_info->profiles_lock);

INIT_LIST_HEAD(&fs_info->dirty_cowonly_roots);
diff --git a/fs/btrfs/zoned.h b/fs/btrfs/zoned.h
index d680c3ee918a..3a826f7c2040 100644
--- a/fs/btrfs/zoned.h
+++ b/fs/btrfs/zoned.h
@@ -330,7 +330,7 @@ static inline void btrfs_zoned_data_reloc_lock(struct btrfs_inode *inode)
struct btrfs_root *root = inode->root;

if (btrfs_is_data_reloc_root(root) && btrfs_is_zoned(root->fs_info))
- btrfs_inode_lock(&inode->vfs_inode, 0);
+ mutex_lock(&root->fs_info->zoned_data_reloc_io_lock);
}

static inline void btrfs_zoned_data_reloc_unlock(struct btrfs_inode *inode)
@@ -338,7 +338,7 @@ static inline void btrfs_zoned_data_reloc_unlock(struct btrfs_inode *inode)
struct btrfs_root *root = inode->root;

if (btrfs_is_data_reloc_root(root) && btrfs_is_zoned(root->fs_info))
- btrfs_inode_unlock(&inode->vfs_inode, 0);
+ mutex_unlock(&root->fs_info->zoned_data_reloc_io_lock);
}

#endif
--
2.35.1



2022-07-11 10:42:45

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 213/230] r8169: fix accessing unset transport header

From: Heiner Kallweit <[email protected]>

[ Upstream commit faa4e04e5e140a6d02260289a8fba8fd8d7a3003 ]

66e4c8d95008 ("net: warn if transport header was not set") added
a check that triggers a warning in r8169, see [0].

The commit referenced in the Fixes tag refers to the change from
which the patch applies cleanly, there's nothing wrong with this
commit. It seems the actual issue (not bug, because the warning
is harmless here) was introduced with bdfa4ed68187
("r8169: use Giant Send").

[0] https://bugzilla.kernel.org/show_bug.cgi?id=216157

Fixes: 8d520b4de3ed ("r8169: work around RTL8125 UDP hw bug")
Reported-by: Erhard F. <[email protected]>
Tested-by: Erhard F. <[email protected]>
Signed-off-by: Heiner Kallweit <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/realtek/r8169_main.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 2918947dd57c..2af4c76bcf02 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4177,7 +4177,6 @@ static void rtl8169_tso_csum_v1(struct sk_buff *skb, u32 *opts)
static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp,
struct sk_buff *skb, u32 *opts)
{
- u32 transport_offset = (u32)skb_transport_offset(skb);
struct skb_shared_info *shinfo = skb_shinfo(skb);
u32 mss = shinfo->gso_size;

@@ -4194,7 +4193,7 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp,
WARN_ON_ONCE(1);
}

- opts[0] |= transport_offset << GTTCPHO_SHIFT;
+ opts[0] |= skb_transport_offset(skb) << GTTCPHO_SHIFT;
opts[1] |= mss << TD1_MSS_SHIFT;
} else if (skb->ip_summed == CHECKSUM_PARTIAL) {
u8 ip_protocol;
@@ -4222,7 +4221,7 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp,
else
WARN_ON_ONCE(1);

- opts[1] |= transport_offset << TCPHO_SHIFT;
+ opts[1] |= skb_transport_offset(skb) << TCPHO_SHIFT;
} else {
unsigned int padto = rtl_quirk_packet_padto(tp, skb);

@@ -4389,14 +4388,13 @@ static netdev_features_t rtl8169_features_check(struct sk_buff *skb,
struct net_device *dev,
netdev_features_t features)
{
- int transport_offset = skb_transport_offset(skb);
struct rtl8169_private *tp = netdev_priv(dev);

if (skb_is_gso(skb)) {
if (tp->mac_version == RTL_GIGA_MAC_VER_34)
features = rtl8168evl_fix_tso(skb, features);

- if (transport_offset > GTTCPHO_MAX &&
+ if (skb_transport_offset(skb) > GTTCPHO_MAX &&
rtl_chip_supports_csum_v2(tp))
features &= ~NETIF_F_ALL_TSO;
} else if (skb->ip_summed == CHECKSUM_PARTIAL) {
@@ -4407,7 +4405,7 @@ static netdev_features_t rtl8169_features_check(struct sk_buff *skb,
if (rtl_quirk_packet_padto(tp, skb))
features &= ~NETIF_F_CSUM_MASK;

- if (transport_offset > TCPHO_MAX &&
+ if (skb_transport_offset(skb) > TCPHO_MAX &&
rtl_chip_supports_csum_v2(tp))
features &= ~NETIF_F_CSUM_MASK;
}
--
2.35.1



2022-07-11 10:52:07

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 204/230] i2c: piix4: Fix a memory leak in the EFCH MMIO support

From: Jean Delvare <[email protected]>

[ Upstream commit 8ad59b397f86a4d8014966fdc0552095a0c4fb2b ]

The recently added support for EFCH MMIO regions introduced a memory
leak in that code path. The leak is caused by the fact that
release_resource() merely removes the resource from the tree but does
not free its memory. We need to call release_mem_region() instead,
which does free the memory. As a nice side effect, this brings back
some symmetry between the legacy and MMIO paths.

Signed-off-by: Jean Delvare <[email protected]>
Reported-by: Yi Zhang <[email protected]>
Tested-by: Yi Zhang <[email protected]>
Reviewed-by: Terry Bowman <[email protected]>
Tested-by: Terry Bowman <[email protected]>
Fixes: 7c148722d074 ("i2c: piix4: Add EFCH MMIO support to region request and release")
Signed-off-by: Wolfram Sang <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/i2c/busses/i2c-piix4.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index ac8e7d60672a..39cb1b7bb865 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -161,7 +161,6 @@ static const char *piix4_aux_port_name_sb800 = " port 1";

struct sb800_mmio_cfg {
void __iomem *addr;
- struct resource *res;
bool use_mmio;
};

@@ -179,13 +178,11 @@ static int piix4_sb800_region_request(struct device *dev,
struct sb800_mmio_cfg *mmio_cfg)
{
if (mmio_cfg->use_mmio) {
- struct resource *res;
void __iomem *addr;

- res = request_mem_region_muxed(SB800_PIIX4_FCH_PM_ADDR,
- SB800_PIIX4_FCH_PM_SIZE,
- "sb800_piix4_smb");
- if (!res) {
+ if (!request_mem_region_muxed(SB800_PIIX4_FCH_PM_ADDR,
+ SB800_PIIX4_FCH_PM_SIZE,
+ "sb800_piix4_smb")) {
dev_err(dev,
"SMBus base address memory region 0x%x already in use.\n",
SB800_PIIX4_FCH_PM_ADDR);
@@ -195,12 +192,12 @@ static int piix4_sb800_region_request(struct device *dev,
addr = ioremap(SB800_PIIX4_FCH_PM_ADDR,
SB800_PIIX4_FCH_PM_SIZE);
if (!addr) {
- release_resource(res);
+ release_mem_region(SB800_PIIX4_FCH_PM_ADDR,
+ SB800_PIIX4_FCH_PM_SIZE);
dev_err(dev, "SMBus base address mapping failed.\n");
return -ENOMEM;
}

- mmio_cfg->res = res;
mmio_cfg->addr = addr;

return 0;
@@ -222,7 +219,8 @@ static void piix4_sb800_region_release(struct device *dev,
{
if (mmio_cfg->use_mmio) {
iounmap(mmio_cfg->addr);
- release_resource(mmio_cfg->res);
+ release_mem_region(SB800_PIIX4_FCH_PM_ADDR,
+ SB800_PIIX4_FCH_PM_SIZE);
return;
}

--
2.35.1



2022-07-11 10:53:51

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.15 229/230] dmaengine: idxd: force wq context cleanup on device disable path

From: Dave Jiang <[email protected]>

commit 44c4237cf3436bda2b185ff728123651ad133f69 upstream.

Testing shown that when a wq mode is setup to be dedicated and then torn
down and reconfigured to shared, the wq configured end up being dedicated
anyays. The root cause is when idxd_device_wqs_clear_state() gets called
during idxd_driver removal, idxd_wq_disable_cleanup() does not get called
vs when the wq driver is removed first. The check of wq state being
"enabled" causes the cleanup to be bypassed. However, idxd_driver->remove()
releases all wq drivers. So the wqs goes to "disabled" state and will never
be "enabled". By that point, the driver has no idea if the wq was
previously configured or clean. So force call idxd_wq_disable_cleanup() on
all wqs always to make sure everything gets cleaned up.

Reported-by: Tony Zhu <[email protected]>
Tested-by: Tony Zhu <[email protected]>
Fixes: 0dcfe41e9a4c ("dmanegine: idxd: cleanup all device related bits after disabling device")
Signed-off-by: Dave Jiang <[email protected]>
Co-developed-by: Fenghua Yu <[email protected]>
Signed-off-by: Fenghua Yu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/dma/idxd/device.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -720,10 +720,7 @@ static void idxd_device_wqs_clear_state(
for (i = 0; i < idxd->max_wqs; i++) {
struct idxd_wq *wq = idxd->wqs[i];

- if (wq->state == IDXD_WQ_ENABLED) {
- idxd_wq_disable_cleanup(wq);
- wq->state = IDXD_WQ_DISABLED;
- }
+ idxd_wq_disable_cleanup(wq);
idxd_wq_device_reset_cleanup(wq);
}
}


2022-07-11 13:01:26

by Jon Hunter

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/230] 5.15.54-rc1 review

Hi Greg,

On 11/07/2022 10:04, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.54 release.
> There are 230 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.54-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:

...

> Mark Rutland <[email protected]>
> irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling


The above change is missing a semi-colon and so is causing the following
build error ...

drivers/irqchip/irq-gic-v3.c: In function 'gic_handle_nmi':
drivers/irqchip/irq-gic-v3.c:666:2: error: expected ';' before 'err'
err = handle_domain_nmi(gic_data.domain, irqnr, regs);
^~~

> Hou Tao <[email protected]>
> bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC

And the above commit is generating the following build error ...

arch/arm64/net/bpf_jit_comp.c: In function 'build_insn':
arch/arm64/net/bpf_jit_comp.c:791:7: error: implicit declaration of
function 'bpf_pseudo_func' [-Werror=implicit-function-declaration]
if (bpf_pseudo_func(insn))
^~~~~~~~~~~~~~~

These are seen with ARM64 builds.

Cheers
Jon

--
nvpublic

2022-07-11 15:21:22

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/230] 5.15.54-rc1 review

On Mon, 11 Jul 2022 at 18:14, Jon Hunter <[email protected]> wrote:
>
> Hi Greg,
>
> On 11/07/2022 10:04, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.15.54 release.
> > There are 230 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.54-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
> > -------------
> > Pseudo-Shortlog of commits:
>
> ...
>
> > Mark Rutland <[email protected]>
> > irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
>
>
> The above change is missing a semi-colon and so is causing the following
> build error ...
>
> drivers/irqchip/irq-gic-v3.c: In function 'gic_handle_nmi':
> drivers/irqchip/irq-gic-v3.c:666:2: error: expected ';' before 'err'
> err = handle_domain_nmi(gic_data.domain, irqnr, regs);
> ^~~
>
> > Hou Tao <[email protected]>
> > bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC
>
> And the above commit is generating the following build error ...
>
> arch/arm64/net/bpf_jit_comp.c: In function 'build_insn':
> arch/arm64/net/bpf_jit_comp.c:791:7: error: implicit declaration of
> function 'bpf_pseudo_func' [-Werror=implicit-function-declaration]
> if (bpf_pseudo_func(insn))
> ^~~~~~~~~~~~~~~
>
> These are seen with ARM64 builds.

I have also noticed these failures on arm64 and arm.

Reported-by: Linux Kernel Functional Testing <[email protected]>

- Naresh

>
> Cheers
> Jon
>
> --
> nvpublic

2022-07-11 15:23:31

by Greg Kroah-Hartman

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/230] 5.15.54-rc1 review

On Mon, Jul 11, 2022 at 01:43:59PM +0100, Jon Hunter wrote:
> Hi Greg,
>
> On 11/07/2022 10:04, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.15.54 release.
> > There are 230 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.54-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
> > -------------
> > Pseudo-Shortlog of commits:
>
> ...
>
> > Mark Rutland <[email protected]>
> > irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
>
>
> The above change is missing a semi-colon and so is causing the following
> build error ...
>
> drivers/irqchip/irq-gic-v3.c: In function 'gic_handle_nmi':
> drivers/irqchip/irq-gic-v3.c:666:2: error: expected ';' before 'err'
> err = handle_domain_nmi(gic_data.domain, irqnr, regs);
> ^~~

Ah, the original also didn't have the ; I'll go find the fix commit for
this...

>
> > Hou Tao <[email protected]>
> > bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC
>
> And the above commit is generating the following build error ...
>
> arch/arm64/net/bpf_jit_comp.c: In function 'build_insn':
> arch/arm64/net/bpf_jit_comp.c:791:7: error: implicit declaration of function
> 'bpf_pseudo_func' [-Werror=implicit-function-declaration]
> if (bpf_pseudo_func(insn))
> ^~~~~~~~~~~~~~~

Thanks, will figure this one out and do a -rc2 release.

greg k-h

2022-07-12 03:31:43

by Bagas Sanjaya

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/230] 5.15.54-rc1 review

On Mon, Jul 11, 2022 at 11:04:16AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.54 release.
> There are 230 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>

Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0).

On powerpc build (ps3_defconfig, GCC 12.1.0), I found errors on gettimeofday
vdso:

VDSOSYM include/generated/vdso32-offsets.h
LDS arch/powerpc/kernel/vdso64/vdso64.lds
AS arch/powerpc/kernel/vdso64/sigtramp.o
AS arch/powerpc/kernel/vdso64/gettimeofday.o
AS arch/powerpc/kernel/vdso64/datapage.o
arch/powerpc/kernel/vdso64/gettimeofday.S: Assembler messages:
arch/powerpc/kernel/vdso64/gettimeofday.S:25: Error: unrecognized opcode: `cvdso_call'
arch/powerpc/kernel/vdso64/gettimeofday.S:36: Error: unrecognized opcode: `cvdso_call'
arch/powerpc/kernel/vdso64/gettimeofday.S:47: Error: unrecognized opcode: `cvdso_call'
arch/powerpc/kernel/vdso64/gettimeofday.S:57: Error: unrecognized opcode: `cvdso_call_time'
make[1]: *** [scripts/Makefile.build:390: arch/powerpc/kernel/vdso64/gettimeofday.o] Error 1

Thanks.

Tested-by: Bagas Sanjaya <[email protected]>
Reported-by: Bagas Sanjaya <[email protected]>

--
An old man doll... just what I always wanted! - Clara

2022-07-12 08:44:24

by Bagas Sanjaya

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/230] 5.15.54-rc1 review

On 7/12/22 10:26, Bagas Sanjaya wrote:
> On Mon, Jul 11, 2022 at 11:04:16AM +0200, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 5.15.54 release.
>> There are 230 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>
> Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0).
>
> On powerpc build (ps3_defconfig, GCC 12.1.0), I found errors on gettimeofday
> vdso:
>
> VDSOSYM include/generated/vdso32-offsets.h
> LDS arch/powerpc/kernel/vdso64/vdso64.lds
> AS arch/powerpc/kernel/vdso64/sigtramp.o
> AS arch/powerpc/kernel/vdso64/gettimeofday.o
> AS arch/powerpc/kernel/vdso64/datapage.o
> arch/powerpc/kernel/vdso64/gettimeofday.S: Assembler messages:
> arch/powerpc/kernel/vdso64/gettimeofday.S:25: Error: unrecognized opcode: `cvdso_call'
> arch/powerpc/kernel/vdso64/gettimeofday.S:36: Error: unrecognized opcode: `cvdso_call'
> arch/powerpc/kernel/vdso64/gettimeofday.S:47: Error: unrecognized opcode: `cvdso_call'
> arch/powerpc/kernel/vdso64/gettimeofday.S:57: Error: unrecognized opcode: `cvdso_call_time'
> make[1]: *** [scripts/Makefile.build:390: arch/powerpc/kernel/vdso64/gettimeofday.o] Error 1
>
> Thanks.
>
> Tested-by: Bagas Sanjaya <[email protected]>
> Reported-by: Bagas Sanjaya <[email protected]>
>

Oops, wrong -rc replied. I tested for -rc2 instead.

I will test -rc3 soon.

--
An old man doll... just what I always wanted! - Clara

2023-01-12 22:26:09

by dann frazier

[permalink] [raw]
Subject: Re: [PATCH 5.15 049/230] net/mlx5e: Check action fwd/drop flag exists also for nic flows

On Mon, Jul 11, 2022 at 11:05:05AM +0200, Greg Kroah-Hartman wrote:
> From: Roi Dayan <[email protected]>
>
> [ Upstream commit 6b50cf45b6a0e99f3cab848a72ecca8da56b7460 ]
>
> The driver should add offloaded rules with either a fwd or drop action.
> The check existed in parsing fdb flows but not when parsing nic flows.
> Move the test into actions_match_supported() which is called for
> checking nic flows and fdb flows.
>
> Signed-off-by: Roi Dayan <[email protected]>
> Reviewed-by: Maor Dickman <[email protected]>
> Signed-off-by: Saeed Mahameed <[email protected]>
> Signed-off-by: Sasha Levin <[email protected]>

hey Sasha,

A contact at Nvidia tells me that this has caused a regression w/
OVN HW offload. To fix that, commit 7f8770c7 ("net/mlx5e: Set action
fwd flag when parsing tc action goto") is also required.

I'm not really sure what flagged this patch for stable, so I don't
know whether to suggest it be reverted, or that additonal patch be
applied. Roi - what's your thought?

-dann

> ---
> drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 13 ++++++-------
> 1 file changed, 6 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 3aa8d0b83d10..fe52db591121 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -3305,6 +3305,12 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
> ct_flow = flow_flag_test(flow, CT) && !ct_clear;
> actions = flow->attr->action;
>
> + if (!(actions &
> + (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) {
> + NL_SET_ERR_MSG_MOD(extack, "Rule must have at least one forward/drop action");
> + return false;
> + }
> +
> if (mlx5e_is_eswitch_flow(flow)) {
> if (flow->attr->esw_attr->split_count && ct_flow &&
> !MLX5_CAP_GEN(flow->attr->esw_attr->in_mdev, reg_c_preserve)) {
> @@ -4207,13 +4213,6 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
> attr->action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
> }
>
> - if (!(attr->action &
> - (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) {
> - NL_SET_ERR_MSG_MOD(extack,
> - "Rule must have at least one forward/drop action");
> - return -EOPNOTSUPP;
> - }
> -
> if (esw_attr->split_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
> NL_SET_ERR_MSG_MOD(extack,
> "current firmware doesn't support split rule for port mirroring");

2023-01-14 14:58:09

by Greg Kroah-Hartman

[permalink] [raw]
Subject: Re: [PATCH 5.15 049/230] net/mlx5e: Check action fwd/drop flag exists also for nic flows

On Thu, Jan 12, 2023 at 03:07:59PM -0700, dann frazier wrote:
> On Mon, Jul 11, 2022 at 11:05:05AM +0200, Greg Kroah-Hartman wrote:
> > From: Roi Dayan <[email protected]>
> >
> > [ Upstream commit 6b50cf45b6a0e99f3cab848a72ecca8da56b7460 ]
> >
> > The driver should add offloaded rules with either a fwd or drop action.
> > The check existed in parsing fdb flows but not when parsing nic flows.
> > Move the test into actions_match_supported() which is called for
> > checking nic flows and fdb flows.
> >
> > Signed-off-by: Roi Dayan <[email protected]>
> > Reviewed-by: Maor Dickman <[email protected]>
> > Signed-off-by: Saeed Mahameed <[email protected]>
> > Signed-off-by: Sasha Levin <[email protected]>
>
> hey Sasha,
>
> A contact at Nvidia tells me that this has caused a regression w/
> OVN HW offload. To fix that, commit 7f8770c7 ("net/mlx5e: Set action
> fwd flag when parsing tc action goto") is also required.
>
> I'm not really sure what flagged this patch for stable, so I don't
> know whether to suggest it be reverted, or that additonal patch be
> applied. Roi - what's your thought?

I've queued up the additional change now, thanks.

greg k-h

2023-01-15 08:23:02

by Roi Dayan

[permalink] [raw]
Subject: Re: [PATCH 5.15 049/230] net/mlx5e: Check action fwd/drop flag exists also for nic flows



On 14/01/2023 15:49, Greg Kroah-Hartman wrote:
> On Thu, Jan 12, 2023 at 03:07:59PM -0700, dann frazier wrote:
>> On Mon, Jul 11, 2022 at 11:05:05AM +0200, Greg Kroah-Hartman wrote:
>>> From: Roi Dayan <[email protected]>
>>>
>>> [ Upstream commit 6b50cf45b6a0e99f3cab848a72ecca8da56b7460 ]
>>>
>>> The driver should add offloaded rules with either a fwd or drop action.
>>> The check existed in parsing fdb flows but not when parsing nic flows.
>>> Move the test into actions_match_supported() which is called for
>>> checking nic flows and fdb flows.
>>>
>>> Signed-off-by: Roi Dayan <[email protected]>
>>> Reviewed-by: Maor Dickman <[email protected]>
>>> Signed-off-by: Saeed Mahameed <[email protected]>
>>> Signed-off-by: Sasha Levin <[email protected]>
>>
>> hey Sasha,
>>
>> A contact at Nvidia tells me that this has caused a regression w/
>> OVN HW offload. To fix that, commit 7f8770c7 ("net/mlx5e: Set action
>> fwd flag when parsing tc action goto") is also required.
>>
>> I'm not really sure what flagged this patch for stable, so I don't
>> know whether to suggest it be reverted, or that additonal patch be
>> applied. Roi - what's your thought?
>
> I've queued up the additional change now, thanks.
>
> greg k-h


right. thanks.
I'm also not sure why the first commit added to stable but
it caused checking the fwd flag earlier in the code and
the missing commit added the fwd flag earlier.
Both commits were in the same series when submitted.