[Deepin-Kernel-SIG] [linux 6.6-y] [Upstream] Update kernel base to 6.6.120-part1 #1418
+929
−530
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideUpdates the 6.6 tree to include a large batch of stable backports, notably refactoring Renesas CPG/MSSR clock/reset plumbing, fixing async error propagation and callback ordering in crypto authenc, tightening RCU nulls-list helpers and inet ehash insertion to avoid races, correcting various driver- and arch-specific bugs (USB serial, HID, SPI, NAND, ntfs3/ext4/jbd2, KVM SVM, xfrm state/tunnel handling, scheduler yield, etc.), and adding a few new device IDs and quirks. Updated class diagram for Renesas CPG/MSSR pub-priv clock infrastructureclassDiagram
class cpg_mssr_pub {
+void__iomem* base0
+raw_notifier_head notifiers
+spinlock_t rmw_lock
+clk** clks
}
class cpg_mssr_priv {
+cpg_mssr_pub pub
+reset_controller_dev rcdev
+device* dev
+clk_reg_layout reg_layout
+device_node* np
+unsigned_int num_core_clks
+unsigned_int num_mod_clks
+unsigned_int last_dt_core_clk
+const_u16* status_regs
+const_u16* control_regs
+const_u16* reset_regs
+const_u16* reset_clear_regs
+cpg_mssr_clk smstpcr_saved[8]
+clk* clks[]
+int __init cpg_mssr_common_init(device* dev,cpg_mssr_info* info,device_node* np)
+int cpg_mstp_clock_endisable(clk_hw* hw,bool enable)
+int cpg_mstp_clock_is_enabled(clk_hw* hw)
+int cpg_mssr_reset(reset_controller_dev* rcdev,unsigned_long id)
+int cpg_mssr_assert(reset_controller_dev* rcdev,unsigned_long id)
+int cpg_mssr_deassert(reset_controller_dev* rcdev,unsigned_long id)
+int cpg_mssr_status(reset_controller_dev* rcdev,unsigned_long id)
+int cpg_mssr_suspend_noirq(device* dev)
+int cpg_mssr_resume_noirq(device* dev)
}
class cpg_mssr_info {
+unsigned_int num_total_core_clks
+unsigned_int num_hw_mod_clks
+unsigned_int last_dt_core_clk
+clk_reg_layout reg_layout
+clk*(*cpg_clk_register)(device* dev,const_cpg_core_clk* core,const_cpg_mssr_info* info,cpg_mssr_pub* pub)
}
class cpg_core_clk {
+const_char* name
+unsigned_int id
+unsigned_int parent
+unsigned_int type
+unsigned_int div
+unsigned_int mult
+unsigned_int offset
}
class rcar_gen2_cpg {
+clk* rcar_gen2_cpg_clk_register(device* dev,const_cpg_core_clk* core,const_cpg_mssr_info* info,cpg_mssr_pub* pub)
}
class rcar_gen3_cpg {
+clk* rcar_gen3_cpg_clk_register(device* dev,const_cpg_core_clk* core,const_cpg_mssr_info* info,cpg_mssr_pub* pub)
}
class rcar_gen4_cpg {
+clk* rcar_gen4_cpg_clk_register(device* dev,const_cpg_core_clk* core,const_cpg_mssr_info* info,cpg_mssr_pub* pub)
}
class r7s9210_cpg {
+clk* rza2_cpg_clk_register(device* dev,const_cpg_core_clk* core,const_cpg_mssr_info* info,cpg_mssr_pub* pub)
}
class r8a77970_cpg {
+clk* r8a77970_cpg_clk_register(device* dev,const_cpg_core_clk* core,const_cpg_mssr_info* info,cpg_mssr_pub* pub)
}
cpg_mssr_priv --> cpg_mssr_pub : has_pub
cpg_mssr_priv --> cpg_mssr_info : uses_for_init
cpg_mssr_info --> cpg_core_clk : describes
rcar_gen2_cpg ..> cpg_mssr_pub : uses
rcar_gen3_cpg ..> cpg_mssr_pub : uses
rcar_gen4_cpg ..> cpg_mssr_pub : uses
r7s9210_cpg ..> cpg_mssr_pub : uses
r8a77970_cpg ..> cpg_mssr_pub : uses
rcar_gen2_cpg ..> cpg_mssr_info : conforms_to
rcar_gen3_cpg ..> cpg_mssr_info : conforms_to
rcar_gen4_cpg ..> cpg_mssr_info : conforms_to
r7s9210_cpg ..> cpg_mssr_info : conforms_to
r8a77970_cpg ..> cpg_mssr_info : conforms_to
cpg_mssr_priv o--> clk : owns_clks
cpg_mssr_pub o--> clk : publishes_clks
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
deepin-ci-robot
requested review from
Avenger-285714,
Ink-Paper,
MingcongBai,
hello666888999 and
myml
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 6 issues, and left some high level feedback:
- In vmwgfx_page_dirty.c,
vmw_bo_dirty_release()now useskref_put(&dirty->ref_count, (void *)kvfree), butkvfreedoes not have thevoid (*)(struct kref *)signature expected bykref_put; consider adding a small wrapper that doescontainer_of()on thekrefand callskvfree()on the enclosingvmw_bo_dirty. - In fs/bfs/inode.c, the new error path uses
printf()directly in kernel code; this should be replaced with an appropriatepr_*()(orpr_warn()/pr_err()) logging helper instead of stdio-style printing. - In rxe_srq_from_attr() (drivers/infiniband/sw/rxe/rxe_srq.c), the error path after a failed
rxe_queue_init()now returns directly without cleaning up the partially initialized queue, whereas the previous code calledrxe_queue_cleanup(); please restore appropriate cleanup to avoid leaking resources on failure.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In vmwgfx_page_dirty.c, `vmw_bo_dirty_release()` now uses `kref_put(&dirty->ref_count, (void *)kvfree)`, but `kvfree` does not have the `void (*)(struct kref *)` signature expected by `kref_put`; consider adding a small wrapper that does `container_of()` on the `kref` and calls `kvfree()` on the enclosing `vmw_bo_dirty`.
- In fs/bfs/inode.c, the new error path uses `printf()` directly in kernel code; this should be replaced with an appropriate `pr_*()` (or `pr_warn()`/`pr_err()`) logging helper instead of stdio-style printing.
- In rxe_srq_from_attr() (drivers/infiniband/sw/rxe/rxe_srq.c), the error path after a failed `rxe_queue_init()` now returns directly without cleaning up the partially initialized queue, whereas the previous code called `rxe_queue_cleanup()`; please restore appropriate cleanup to avoid leaking resources on failure.
## Individual Comments
### Comment 1
<location> `crypto/authenc.c:138` </location>
<code_context>
+ * Used when the ahash request was invoked in the async callback context
+ * of the previous skcipher request. Eat any EINPROGRESS notifications.
+ */
+static void authenc_geniv_ahash_done2(void *data, int err)
+{
+ struct aead_request *req = data;
</code_context>
<issue_to_address>
**issue (bug_risk):** New async paths risk double-completing AEAD requests when the ahash/skcipher completes synchronously.
Because `authenc_geniv_ahash_done2()` and `authenc_decrypt_tail_done()` both call `authenc_request_complete()`, the new flow can complete the same `aead_request` twice when the ahash/skcipher runs synchronously.
In `crypto_authenc_encrypt_done()`, if `crypto_authenc_genicv()` uses a sync ahash, `crypto_ahash_digest()` will run to completion and invoke `authenc_geniv_ahash_done2()`, which calls `authenc_request_complete()`. Control then returns to `crypto_authenc_encrypt_done()`, which calls `authenc_request_complete()` again, causing double completion. The decrypt path has the same issue: `authenc_verify_ahash_done()` always calls `authenc_request_complete()`, and `authenc_decrypt_tail_done()` also does so when the skcipher completes.
The outer sites (`crypto_authenc_encrypt_done()` and `authenc_verify_ahash_done()`) should avoid calling `authenc_request_complete()` for the `*_MAY_SLEEP` paths and rely on the async callbacks instead. Alternatively, adjust `crypto_authenc_genicv()` / `crypto_authenc_decrypt_tail()` so they either return a distinct status or only trigger the callback for async engines, but the current behavior is unsafe for sync completions.
</issue_to_address>
### Comment 2
<location> `fs/bfs/inode.c:85` </location>
<code_context>
+ readb(priv->pub.base0 + priv->control_regs[reg]);
+ barrier_data(priv->pub.base0 + priv->control_regs[reg]);
+
} else {
- value = readl(priv->base + priv->control_regs[reg]);
+ value = readl(priv->pub.base0 + priv->control_regs[reg]);
</code_context>
<issue_to_address>
**issue (bug_risk):** Using printf() in kernel code is incorrect and this error path likely needs to use a kernel logging helper.
Replace the `printf()` call with an appropriate kernel logging API such as `pr_warn()`, `pr_err()`, or a filesystem-specific helper, and consider rate limiting. Also double-check whether any additional cleanup (e.g., on `inode`) is required before branching to the `error` label, based on what that path does.
</issue_to_address>
### Comment 3
<location> `crypto/authenc.c:42` </location>
<code_context>
static void authenc_request_complete(struct aead_request *req, int err)
{
- if (err != -EINPROGRESS)
+ if (err != -EINPROGRESS && err != -EBUSY)
aead_request_complete(req, err);
}
</code_context>
<issue_to_address>
**issue (complexity):** Consider encoding the nested async state in the request context and using a single completion helper to avoid multiple callbacks, masks, and duplicated branching logic.
You can collapse most of the new branching by pushing the “nested async” concept into the request context and using a single completion path, instead of threading `mask` and multiple callbacks everywhere.
### 1. Unify `authenc_geniv_ahash_done` / `authenc_geniv_ahash_done2`
Add a small flag to the request context to indicate whether we’re running in the nested async callback context, and a helper to pick the correct completion function:
```c
struct authenc_request_ctx {
struct scatterlist src[2];
struct scatterlist dst[2];
bool nested; /* true when called from an inner async callback */
char tail[];
};
static void authenc_complete(struct aead_request *req, int err)
{
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
if (areq_ctx->nested)
authenc_request_complete(req, err); /* eats EINPROGRESS/EBUSY */
else
aead_request_complete(req, err);
}
```
Then you only need a single ahash completion callback:
```c
static void authenc_geniv_ahash_done(void *data, int err)
{
struct aead_request *req = data;
if (!err)
authenc_geniv_ahash_finish(req);
authenc_complete(req, err);
}
```
### 2. Drop `authenc_geniv_ahash_done2` and the `mask` parameter
With the `nested` flag, you no longer need two callbacks or a bitmask to choose them. Let `crypto_authenc_genicv()` take a boolean and compute flags locally:
```c
static int crypto_authenc_genicv(struct aead_request *req, bool nested)
{
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
struct aead_instance *inst = aead_alg_instance(authenc);
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
struct crypto_ahash *auth = ctx->auth;
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
unsigned int flags = aead_request_flags(req);
u8 *hash = areq_ctx->tail;
int err;
if (nested)
flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
areq_ctx->nested = nested;
hash = (u8 *)ALIGN((unsigned long)hash + crypto_ahash_alignmask(auth),
crypto_ahash_alignmask(auth) + 1);
ahash_request_set_tfm(ahreq, auth);
ahash_request_set_crypt(ahreq, req->dst, hash,
req->assoclen + req->cryptlen);
ahash_request_set_callback(ahreq, flags,
authenc_geniv_ahash_done, req);
err = crypto_ahash_digest(ahreq);
if (err)
return err;
scatterwalk_map_and_copy(hash, req->dst, req->assoclen + req->cryptlen,
crypto_aead_authsize(authenc), 1);
return 0;
}
```
Call sites then just pass `nested = true/false` instead of masks:
```c
/* encrypt path: top-level */
static void crypto_authenc_encrypt_done(void *data, int err)
{
struct aead_request *areq = data;
if (err) {
aead_request_complete(areq, err);
return;
}
err = crypto_authenc_genicv(areq, true); /* nested */
authenc_request_complete(areq, err);
}
/* direct (non-nested) use */
return crypto_authenc_genicv(req, false);
```
### 3. Apply the same pattern to decrypt tail
You can do the same for `crypto_authenc_decrypt_tail()` and `authenc_decrypt_tail_done`, eliminating the `mask` argument and conditional callback/data selection:
```c
static void authenc_decrypt_tail_done(void *data, int err)
{
struct aead_request *req = data;
authenc_complete(req, err);
}
static int crypto_authenc_decrypt_tail(struct aead_request *req, bool nested)
{
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
struct aead_instance *inst = aead_alg_instance(authenc);
struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
struct skcipher_request *skreq = (void *)(areq_ctx->tail + ictx->reqoff);
unsigned int authsize = crypto_aead_authsize(authenc);
unsigned int flags = aead_request_flags(req);
u8 *ihash = ahreq->result + authsize;
struct scatterlist *src, *dst;
if (nested) {
flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
areq_ctx->nested = true;
}
scatterwalk_map_and_copy(ihash, req->src, ahreq->nbytes, authsize, 0);
if (crypto_memneq(ihash, ahreq->result, authsize))
return -EBADMSG;
src = scatterwalk_ffwd(areq_ctx->src, req->src, req->assoclen);
dst = (req->src != req->dst)
? scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen)
: src;
skcipher_request_set_tfm(skreq, ctx->enc);
skcipher_request_set_callback(skreq, flags,
nested ? authenc_decrypt_tail_done
: req->base.complete,
nested ? req : req->base.data);
skcipher_request_set_crypt(skreq, src, dst,
req->cryptlen - authsize, req->iv);
return crypto_skcipher_decrypt(skreq);
}
```
And the ahash verify callback becomes:
```c
static void authenc_verify_ahash_done(void *data, int err)
{
struct aead_request *req = data;
if (err) {
aead_request_complete(req, err);
return;
}
err = crypto_authenc_decrypt_tail(req, true); /* nested */
authenc_request_complete(req, err);
}
```
This keeps all the async semantics you added, but:
* removes the second ahash callback,
* removes the `mask` plumbing and bit-twiddling in call sites,
* centralizes the “nested vs top-level” decision in a simple `nested` flag and `authenc_complete()` helper, which should make the control flow much easier to follow.
</issue_to_address>
### Comment 4
<location> `drivers/comedi/drivers/c6xdigio.c:287` </location>
<code_context>
+
+static bool c6xdigio_pnp_registered = false;
+
+static int __init c6xdigio_module_init(void)
+{
+ int ret;
</code_context>
<issue_to_address>
**issue (complexity):** Consider extracting the PnP registration/unregistration logic into small helper functions so that the module init/exit functions remain simple and boilerplate-like.
You can keep the new module-level registration semantics but reduce the mental overhead by isolating the PnP handling into small helpers and keeping `c6xdigio_module_init/exit` almost boilerplate.
For example:
```c
static bool c6xdigio_pnp_registered;
static void c6xdigio_pnp_try_register(void)
{
#if IS_ENABLED(CONFIG_PNP)
int ret;
ret = pnp_register_driver(&c6xdigio_pnp_driver);
if (ret) {
pr_warn("failed to register pnp driver - err %d\n", ret);
return; /* ignore error */
}
c6xdigio_pnp_registered = true;
#endif
}
static void c6xdigio_pnp_unregister(void)
{
#if IS_ENABLED(CONFIG_PNP)
if (c6xdigio_pnp_registered)
pnp_unregister_driver(&c6xdigio_pnp_driver);
#endif
}
```
Then `module_init/exit` become much easier to reason about:
```c
static int __init c6xdigio_module_init(void)
{
int ret;
ret = comedi_driver_register(&c6xdigio_driver);
if (ret)
return ret;
c6xdigio_pnp_try_register();
return 0;
}
module_init(c6xdigio_module_init);
static void __exit c6xdigio_module_exit(void)
{
c6xdigio_pnp_unregister();
comedi_driver_unregister(&c6xdigio_driver);
}
module_exit(c6xdigio_module_exit);
```
This keeps the new behavior (PnP registered once at module load, unregistered at module exit, comedi before PnP on init and after PnP on exit) but removes the interleaving of policy details from the init/exit path and makes the ordering and responsibilities clearer for future readers.
</issue_to_address>
### Comment 5
<location> `security/smack/smack_lsm.c:3690` </location>
<code_context>
struct smack_known *skp;
- struct smack_known_list_elem *sklep;
- int rc;
+ char *labelstr;
+ int rc = 0;
</code_context>
<issue_to_address>
**issue (complexity):** Consider simplifying smack_setprocattr() by importing the label once into a smack_known struct and doing all validation and permission checks directly on it to avoid extra parsing and control-flow indirection.
You can keep the new semantics (string-based relabel checks and web/star filtering) but avoid double parsing and the indirect `rc`/`goto free_labelstr` path by doing all validation on the `struct smack_known *` once it’s imported.
Concretely:
- Call `smk_import_entry()` once up front.
- Use `skp->smk_known` for string comparisons with the relabel list.
- Keep the web/star restriction but check against `skp` or `skp->smk_known` directly.
- Return directly on permission failures instead of using `rc` + common tail.
For example, the core of `smack_setprocattr()` can be simplified to:
```c
skp = smk_import_entry(value, size);
if (IS_ERR(skp))
return PTR_ERR(skp);
/* No process is ever allowed the web ("@") label and the star ("*") label */
if (skp->smk_known[1] == '\0') { /* '@', '*' */
const char c = skp->smk_known[0];
if (c == *smack_known_web.smk_known ||
c == *smack_known_star.smk_known)
return -EPERM;
}
if (!smack_privileged(CAP_MAC_ADMIN)) {
const struct smack_known_list_elem *sklep;
list_for_each_entry(sklep, &tsp->smk_relabel, list) {
if (strcmp(sklep->smk_label->smk_known,
skp->smk_known) == 0)
goto allowed;
}
return -EPERM;
}
allowed:
new = prepare_creds();
if (!new)
return -ENOMEM;
tsp = smack_cred(new);
tsp->smk_task = skp;
```
This preserves the new string-based relabel permissions and label filtering, but:
- eliminates the temporary `labelstr` allocation and `smk_parse_smack()` call,
- avoids parsing the label twice,
- and makes the permission/error control flow more linear and easier to follow.
</issue_to_address>
### Comment 6
<location> `kernel/trace/ftrace.c:1940` </location>
<code_context>
static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
struct ftrace_hash *old_hash,
- struct ftrace_hash *new_hash)
+ struct ftrace_hash *new_hash,
+ bool update_target)
{
</code_context>
<issue_to_address>
**issue (complexity):** Consider introducing an internal helper that hides the `update_target` flag behind two purpose-specific wrappers so call sites clearly express whether they are changing filters or direct targets without boolean plumbing.
You can keep the new behavior but localize the `update_target` complexity and make the call sites clearer by hiding the boolean behind two purpose-specific helpers.
### 1. Split the public API from the “mode” flag
Instead of exposing `bool update_target` at all callers, turn the current function into an internal helper and reintroduce the original, simpler API for ipmodify, plus a dedicated helper for direct target updates.
```c
/* New internal helper with the full behavior and flag */
static int __ftrace_hash_update_ipmodify_internal(struct ftrace_ops *ops,
struct ftrace_hash *old_hash,
struct ftrace_hash *new_hash,
bool update_target)
{
/* ... move current __ftrace_hash_update_ipmodify body here ... */
}
```
Then reintroduce the original ipmodify API without the boolean:
```c
/* For ipmodify filter changes (previous semantics) */
static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
struct ftrace_hash *old_hash,
struct ftrace_hash *new_hash)
{
return __ftrace_hash_update_ipmodify_internal(ops, old_hash, new_hash, false);
}
```
And a dedicated helper for the direct-target path:
```c
/* For modifying the direct call target while keeping the same filter set */
static int __ftrace_hash_update_direct_target(struct ftrace_ops *ops,
struct ftrace_hash *hash)
{
return __ftrace_hash_update_ipmodify_internal(ops, hash, hash, true);
}
```
### 2. Make callers explicit
With those helpers, the ipmodify users stay as they were, and don’t need to know about `update_target`:
```c
return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash);
/* ... */
__ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH);
/* ... */
return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash);
```
And the direct-modify path reads more self-descriptively:
```c
err = __ftrace_hash_update_direct_target(ops, hash);
if (err)
goto out;
```
### 3. Keep the invariants local to the internal helper
The `update_target`-dependent logic, including:
```c
if (!update_target && (in_old == in_new))
continue;
FTRACE_WARN_ON(!update_target && (rec->flags & FTRACE_FL_DIRECT));
```
remains inside `__ftrace_hash_update_ipmodify_internal()`, but call sites now encode their intent via the helper name rather than a boolean argument. This preserves your current behavior while reducing the cognitive load for future reviewers by keeping:
- ipmodify filter changes,
- direct target changes,
as clearly separated code paths at the call site, with the boolean distinction hidden inside a single, well-documented internal function.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| * Used when the ahash request was invoked in the async callback context | ||
| * of the previous skcipher request. Eat any EINPROGRESS notifications. | ||
| */ | ||
| static void authenc_geniv_ahash_done2(void *data, int err) |
There was a problem hiding this comment.
issue (bug_risk): New async paths risk double-completing AEAD requests when the ahash/skcipher completes synchronously.
Because authenc_geniv_ahash_done2() and authenc_decrypt_tail_done() both call authenc_request_complete(), the new flow can complete the same aead_request twice when the ahash/skcipher runs synchronously.
In crypto_authenc_encrypt_done(), if crypto_authenc_genicv() uses a sync ahash, crypto_ahash_digest() will run to completion and invoke authenc_geniv_ahash_done2(), which calls authenc_request_complete(). Control then returns to crypto_authenc_encrypt_done(), which calls authenc_request_complete() again, causing double completion. The decrypt path has the same issue: authenc_verify_ahash_done() always calls authenc_request_complete(), and authenc_decrypt_tail_done() also does so when the skcipher completes.
The outer sites (crypto_authenc_encrypt_done() and authenc_verify_ahash_done()) should avoid calling authenc_request_complete() for the *_MAY_SLEEP paths and rely on the async callbacks instead. Alternatively, adjust crypto_authenc_genicv() / crypto_authenc_decrypt_tail() so they either return a distinct status or only trigger the callback for async engines, but the current behavior is unsafe for sync completions.
There was a problem hiding this comment.
Pull request overview
This pull request backports 100 upstream commits from Linux kernel v6.6.120 (part 1 of 8). The changes include various bug fixes, hardware support additions, and security improvements across multiple subsystems including networking (xfrm, sctp, inet), filesystems (ext4, ntfs3, bfs, jbd2), drivers (USB, GPIO, SPI, clock), and architecture-specific code (x86 KVM, s390, LoongArch, ARM64).
Changes:
- Bug fixes for memory leaks, race conditions, and null pointer dereferences
- Security improvements (smack, xfrm state management, authenc crypto)
- Hardware support additions (USB devices, HID devices, wireless adapters)
- Driver fixes and improvements across multiple subsystems
Reviewed changes
Copilot reviewed 108 out of 108 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| fs/bfs/inode.c | File type reconstruction from disk with vtype validation |
| security/smack/smack_lsm.c | Fix unprivileged task label creation vulnerability |
| net/xfrm/xfrm_state.c | Simplify and fix xfrm state deletion and synchronization |
| fs/ntfs3/fsntfs.c | Fix uninitialized memory in buffer handling |
| drivers/usb/serial/* | Fix TIOCMB* ioctl implementations and device ID additions |
| kernel/task_work.c | Fix NMI race condition in task work |
| crypto/authenc.c | Fix EINPROGRESS handling in authenc |
| Multiple driver files | Various bug fixes and hardware support additions |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+87
to
+88
| printf("Unknown vtype=%u %s:%08lx\n", | ||
| le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino); |
There was a problem hiding this comment.
The function call printf() is used instead of the kernel-appropriate pr_err() or similar logging function. The kernel does not have printf() available.
Comment on lines
+3728
to
+3735
| free_labelstr: | ||
| kfree(labelstr); | ||
| if (rc) | ||
| return -EPERM; | ||
|
|
||
| skp = smk_import_entry(value, size); | ||
| if (IS_ERR(skp)) | ||
| return PTR_ERR(skp); |
There was a problem hiding this comment.
The variable 'labelstr' is freed before it's used in smk_import_entry(). The code should call smk_import_entry() before freeing labelstr, or the free should be moved to after smk_import_entry().
[ Upstream commit b441cf3 ] The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a280 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete. We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state. Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped. A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked. Fixes: 9d4139c ("netns xfrm: per-netns xfrm_state_all list") Signed-off-by: Sabrina Dubroca <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit d0e0d1097118461463b76562c7ebaabaa5b90b13) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 2a198bb ] This reverts commit f75a280. With all states (whether user or kern) removed from the hashtables during deletion, there's no need for synchronous destruction of states. xfrm6_tunnel states still need to have been destroyed (which will be the case when its last user is deleted (not destroyed)) so that xfrm6_tunnel_free_spi removes it from the per-netns hashtable before the netns is destroyed. This has the benefit of skipping one synchronize_rcu per state (in __xfrm_state_destroy(sync=true)) when we exit a netns. Signed-off-by: Sabrina Dubroca <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 88ed2012b8c72f2edc9782d42940c7dccdab25b6) Signed-off-by: Wentao Guan <[email protected]>
…hat were never added [ Upstream commit 10deb69 ] In commit b441cf3 ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists. In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel. There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved. At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3 (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work). Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=999eb23467f83f9bf9bf Fixes: b441cf3 ("xfrm: delete x->tunnel as we delete x") Signed-off-by: Sabrina Dubroca <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 763e5c351206c1e4d910db4a1159053f6263689c) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 42e4256 ] While reverting commit f75a280 ("xfrm: destroy xfrm_state synchronously on net exit path"), I incorrectly changed xfrm_state_flush's "proto" argument back to IPSEC_PROTO_ANY. This reverts some of the changes in commit dbb2483 ("xfrm: clean up xfrm protocol checks"), and leads to some states not being removed when we exit the netns. Pass 0 instead of IPSEC_PROTO_ANY from both xfrm_state_fini xfrm6_tunnel_net_exit, so that xfrm_state_flush deletes all states. Fixes: 2a198bb ("Revert "xfrm: destroy xfrm_state synchronously on net exit path"") Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=6641a61fe0e2e89ae8c5 Tested-by: [email protected] Signed-off-by: Sabrina Dubroca <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: Steffen Klassert <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 25f34fd5214458829d491b97ff26a8d2570774fc) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit ccc35ff ] Use extended classdev registration to generate generic device names from color and function enums instead of reading only the label from the device tree. Signed-off-by: Stefan Kalscheuer <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Lee Jones <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 732fe5cbd6ad58cd37a746c7b57018fb0c9dc083) Signed-off-by: Wentao Guan <[email protected]>
…ainer commit ba2457109d5b47a90fe565b39524f7225fc23e60 upstream. Sasha has also maintaining stable branch in conjunction with Greg since cb5d219 ("MAINTAINERS: Add Sasha as a stable branch maintainer"). Mention him in 2.Process.rst. Cc: [email protected] Signed-off-by: Bagas Sanjaya <[email protected]> Reviewed-by: Randy Dunlap <[email protected]> Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> Message-ID: <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 46c73ff89d73de579632c905e5b8f512ea8ee0f8) Signed-off-by: Wentao Guan <[email protected]>
…em corrupted commit 986835bf4d11032bba4ab8414d18fce038c61bb4 upstream. There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0 Call Trace: <TASK> __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data. In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue. Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON. Fixes: 470decc ("[PATCH] jbd2: initial copy of files from jbd") Signed-off-by: Ye Bin <[email protected]> Reviewed-by: Jan Kara <[email protected]> Message-ID: <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Cc: [email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit b4f8eabf6d991bd41fabcdf9302c4b3eab590cf4) Signed-off-by: Wentao Guan <[email protected]>
commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b upstream. The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c461 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue. Reported-by: [email protected] Link: https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8 Cc: [email protected] Signed-off-by: Deepanshu Kartikey <[email protected]> Message-ID: <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 1687a055a555347b002f406676a1aaae4668f242) Signed-off-by: Wentao Guan <[email protected]>
commit 1fab1fa091f5aa97265648b53ea031deedd26235 upstream.
ipc_msg_send_request() waits for a generic netlink reply using an
ipc_msg_table_entry on the stack. The generic netlink handler
(handle_generic_event()/handle_response()) fills entry->response under
ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free
entry->response without holding the same lock.
Under high concurrency this allows a race where handle_response() is
copying data into entry->response while ipc_msg_send_request() has just
freed it, leading to a slab-use-after-free reported by KASAN in
handle_generic_event():
BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]
Write of size 12 at addr ffff888198ee6e20 by task pool/109349
...
Freed by task:
kvfree
ipc_msg_send_request [ksmbd]
ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]
Fix by:
- Taking ipc_msg_table_lock in ipc_msg_send_request() while validating
entry->response, freeing it when invalid, and removing the entry from
ipc_msg_table.
- Returning the final entry->response pointer to the caller only after
the hash entry is removed under the lock.
- Returning NULL in the error path, preserving the original API
semantics.
This makes all accesses to entry->response consistent with
handle_response(), which already updates and fills the response buffer
under ipc_msg_table_lock, and closes the race that allowed the UAF.
Cc: [email protected]
Reported-by: Qianchang Zhao <[email protected]>
Reported-by: Zhitong Liu <[email protected]>
Signed-off-by: Qianchang Zhao <[email protected]>
Acked-by: Namjae Jeon <[email protected]>
Signed-off-by: Steve French <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit 708a620b471a14466f1f52c90bf3f65ebdb31460)
Signed-off-by: Wentao Guan <[email protected]>
commit c14ecb555c3ee80eeb030a4e46d00e679537f03a upstream. KCSAN reports: BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1: do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0: do_raw_write_lock+0x88/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork value changed: 0xffffffff -> 0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111 Commit 1a365e8 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete. >From do_raw_write_lock() only debug_write_lock_after() part has been converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now. Fixes: 1a365e8 ("locking/spinlock/debug: Fix various data races") Reported-by: Adrian Freihofer <[email protected]> Signed-off-by: Alexander Sverdlin <[email protected]> Signed-off-by: Boqun Feng <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Reviewed-by: Paul E. McKenney <[email protected]> Acked-by: Waiman Long <[email protected]> Cc: [email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 39d2ef113416f1a4205b03fb0aa2e428d1412c77) Signed-off-by: Wentao Guan <[email protected]>
commit 0cd8feea8777f8d9b9a862b89c688b049a5c8475 upstream. Fix a race between inline data destruction and block mapping. The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks(). Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert. kernel BUG at fs/ext4/indirect.c:546! EXT4-fs (loop2): unmounting filesystem. invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546 Call Trace: <TASK> ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:2271 [inline] do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10f/0x170 fs/splice.c:950 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Fixes: c755e25 ("ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()") Cc: [email protected] # v4.11+ Signed-off-by: Alexey Nepomnyashih <[email protected]> Message-ID: <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 144c48da33a01d92995aeccd8208eb47d2a8e659) Signed-off-by: Wentao Guan <[email protected]>
commit a51f025b5038abd3d22eed2ede4cd46793d89565 upstream. Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its pointer to &struct comedi_async as intended. Thus, any such dereferencing of &s->async->cmd will lead to general protection fault and kernel crash. Mitigate this problem by removing a call to pcl818_ai_cancel() from pcl818_detach() altogether. This way, if the subdevice setups its support for async commands, everything async-related will be handled via subdevice's own ->cancel() function in comedi_device_detach_locked() even before pcl818_detach(). If no support for asynchronous commands is provided, there is no need to cancel anything either. [1] Syzbot crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762 ... Call Trace: <TASK> pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline] comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] ... Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=fce5d9d5bd067d6fbe9b Fixes: 00aba6e ("staging: comedi: pcl818: remove 'neverending_ai' from private data") Cc: stable <[email protected]> Signed-off-by: Nikita Zhandarovich <[email protected]> Reviewed-by: Ian Abbott <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 88d99ca5adbd01ff088f5fb2ddeba5755e085e52) Signed-off-by: Wentao Guan <[email protected]>
commit 4da3768e1820cf15cced390242d8789aed34f54d upstream. When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the instruction if the code stream is changed (e.g. by a different vCPU) between when the CPU executes the instruction and when KVM decodes the instruction to get the next RIP. As effectively predicted by commit 6ef88d6 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction"), failure to verify that the correct INTn instruction was decoded can effectively clobber guest state due to decoding the wrong instruction and thus specifying the wrong next RIP. The bug most often manifests as "Oops: int3" panics on static branch checks in Linux guests. Enabling or disabling a static branch in Linux uses the kernel's "text poke" code patching mechanism. To modify code while other CPUs may be executing that code, Linux (temporarily) replaces the first byte of the original instruction with an int3 (opcode 0xcc), then patches in the new code stream except for the first byte, and finally replaces the int3 with the first byte of the new code stream. If a CPU hits the int3, i.e. executes the code while it's being modified, then the guest kernel must look up the RIP to determine how to handle the #BP, e.g. by emulating the new instruction. If the RIP is incorrect, then this lookup fails and the guest kernel panics. The bug reproduces almost instantly by hacking the guest kernel to repeatedly check a static branch[1] while running a drgn script[2] on the host to constantly swap out the memory containing the guest's TSS. [1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a [2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b Fixes: 6ef88d6 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction") Cc: [email protected] Co-developed-by: Sean Christopherson <[email protected]> Signed-off-by: Omar Sandoval <[email protected]> Link: https://patch.msgid.link/1cc6dcdf36e3add7ee7c8d90ad58414eeb6c3d34.1762278762.git.osandov@fb.com Signed-off-by: Sean Christopherson <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 152289a51107ef45bbfe9b4aeeaa584a503042b5) Signed-off-by: Wentao Guan <[email protected]>
commit 7970b4969c4c99bcdaf105f9f39c6d2021f6d244 upstream. T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are three serial ports to be enumerated: Modem, NMEA and Diag. test evidence as below: T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e123 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXBAAGHA-IDP _SN:39A8D3E4 S: SerialNumber=39a8d3e4 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms 0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag Signed-off-by: Slark Xiao <[email protected]> Cc: [email protected] Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 85e8739c5ce78d664cac7cc55d91c95fcb0e0c33) Signed-off-by: Wentao Guan <[email protected]>
commit c908039a29aa70870871f4848125b3d743f929bf upstream. Add the following Telit Cinterion new compositions: 0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c5 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10cb Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: [email protected] Signed-off-by: Fabio Porcedda <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 63d6bf5b19bfb0bc480bfbbb7fef26300e008080) Signed-off-by: Wentao Guan <[email protected]>
commit 072f2c49572547f4b0776fe2da6b8f61e4b34699 upstream. Move Telit 0x10c7 composition right after 0x10c6 composition and before 0x10c8 composition. Signed-off-by: Fabio Porcedda <[email protected]> Cc: [email protected] Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 510db76553c987dff33c2730debac317eaa16fe0) Signed-off-by: Wentao Guan <[email protected]>
commit 4e31a5d0a9ee672f708fc993c1d5520643f769fd upstream. Some FTDI devices have the first port reserved for JTAG and have been using a dedicated quirk to prevent binding to it. As can be inferred directly or indirectly from the commit messages, almost all of these devices are dual port devices which means that the more recently added macro for matching on interface number can be used instead (and some such devices do so already). This avoids probing interfaces that will never be bound and cleans up the match table somewhat. Note that the JTAG quirk is kept for quad port devices, which would otherwise require three match entries. Cc: [email protected] Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 53a633786718578ff4f12a1d9737192da093d531) Signed-off-by: Wentao Guan <[email protected]>
commit 0e5a99e0e5f50353b86939ff6e424800d769c818 upstream. Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI). Those cards are identified with different DeviceIds. Those cards integrating standard UARTs work the same way as PCI/PCIe models already supported in the serial driver. Signed-off-by: Magne Bruno <[email protected]> Link: https://patch.msgid.link/[email protected] Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 5a8c2136dc5ea62ab284f6c5b5a016f978a5ea24) Signed-off-by: Wentao Guan <[email protected]>
commit b6e0b3016187446ddef9edac03cd9d544ac63f11 upstream. Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask. Fix this long-standing regression dating back to 2003 when the tiocmset() callback was introduced. Fixes: 1da177e ("Linux-2.6.12-rc2") Cc: [email protected] Reviewed-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit cae7aa183ca4bbf700168cbd59ba539d69268875) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit d949b8d12d6e8fa119bca10d3157cd42e810f6f7 ] The SDHC1 interface is not used on the imx8mm-venice-gw72xx. Remove the unused pinctrl_usdhc1 iomux node. Fixes: 6f30b27 ("arm64: dts: imx8mm: Add Gateworks i.MX 8M Mini Development Kits") Signed-off-by: Tim Harvey <[email protected]> Reviewed-by: Peng Fan <[email protected]> Signed-off-by: Shawn Guo <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit e2060f8513b5241b7318b1ace863e1e1e9190cd0) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit effe98060f70eb96e142f656e750d6af275ceac3 ] UART1 and UART3 go to a connector for use on a baseboard and as such are defined in the baseboard device-trees. Remove them from the gw702x SOM device-tree. Fixes: 0d5b288 ("arm64: dts: freescale: Add imx8mp-venice-gw7905-2x") Signed-off-by: Tim Harvey <[email protected]> Reviewed-by: Peng Fan <[email protected]> Signed-off-by: Shawn Guo <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 5db023188615944daebe73c398da9b15a8f2cc38) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 9db04b310ef99b546e4240c55842e81b06b78579 ] SDHC1 on the GW702x SOM routes to a connector for use on a baseboard and as such are defined in the baseboard device-trees. Remove it from the gw702x SOM device-tree. Fixes: 0d5b288 ("arm64: dts: freescale: Add imx8mp-venice-gw7905-2x") Signed-off-by: Tim Harvey <[email protected]> Reviewed-by: Peng Fan <[email protected]> Signed-off-by: Shawn Guo <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 631786221875346cfd6d30b24f182e92838d0a6f) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit d312742f686582e6457070bcfd24bee8acfdf213 ] Since the reliance on ARM-specific struct pci_sys_data was removed, this driver can be compile-tested on other architectures. While at it, make the help text a bit more generic, as some members of the R-Car Gen2 family have a different number of internal PCI controllers. Fixes: 4a95756 ("PCI: rcar-gen2: Convert to use modern host bridge probe functions") Suggested-by: Ilpo Jarvinen <[email protected]> Signed-off-by: Geert Uytterhoeven <[email protected]> Signed-off-by: Manivannan Sadhasivam <[email protected]> [bhelgaas: add rcar-gen2 to subject] Signed-off-by: Bjorn Helgaas <[email protected]> Reviewed-by: Ilpo Järvinen <[email protected]> Link: https://patch.msgid.link/00f75d6732eacce93f04ffaeedc415d2db714cd6.1759480426.git.geert+renesas@glider.be Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 433e72bf0f4ec45406796451741476ea09abbc0e) Signed-off-by: Wentao Guan <[email protected]>
…probe [ Upstream commit d48fb15e6ad142e0577428a8c5028136e10c7b3d ] devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: d57801c ("uio: uio_fsl_elbc_gpcm: use device-managed allocators") Signed-off-by: Li Qiang <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 285dadbb3cb0316f2d094b02b67e4a7cf54b0acf) Signed-off-by: Wentao Guan <[email protected]>
…to other [ Upstream commit a76ce61d7225934b0a52c8172a8cd944002a8c6f ] When a consumer turns on/off a power domain dependent on another power domain in hardware, the parent power domain shall be turned on/off by the power domain provider as well, and to get it the power domain hardware hierarchy shall be described in the CAMCC driver. Establish the power domain hierarchy with a Titan GDSC set as a parent of all other GDSC power domains provided by the SM6350 camera clock controller to enforce a correct sequence of enabling and disabling power domains by the consumers, this fixes the CAMCC as a supplier of power domains to CAMSS IP and its driver. Fixes: 80f5451 ("clk: qcom: Add camera clock controller driver for SM6350") Reviewed-by: Konrad Dybcio <[email protected]> Reviewed-by: Imran Shaik <[email protected]> Reviewed-by: Bryan O'Donoghue <[email protected]> Signed-off-by: Vladimir Zapolskiy <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Bjorn Andersson <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 77197835a735f73f8cb264d5ca2c83fb677ad5e2) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit ab0e13141d679fdffdd3463a272c5c1b10be1794 ] The 'Agera' PLLs (with clk_agera_pll_configure) do not take some of the parameters that are provided in the vendor driver. Instead the upstream configuration should provide the final user_ctl value that is written to the USER_CTL register. Fix the config so that the PLL is configured correctly, and fixes CAMCC_MCLK* being stuck off. Fixes: 80f5451 ("clk: qcom: Add camera clock controller driver for SM6350") Suggested-by: Taniya Das <[email protected]> Signed-off-by: Luca Weiss <[email protected]> Reviewed-by: Abel Vesa <[email protected]> Reviewed-by: Taniya Das <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Bjorn Andersson <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 4a1535593fffe29e32ae1949bc452ce22620f9ac) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit df0845cf447ae1556c3440b8b155de0926cbaa56 ] Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc. Fixes: 7901c1a ("KEYS: Implement binary asymmetric key ID handling") Signed-off-by: Thorsten Blum <[email protected]> Reviewed-by: Lukas Wunner <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit e7066160f5b4187ad9869b712fa7a35d3d5be6b9 ] When the new qos valus setting fails, restore to the original qos values. Fixes: 72b010d ("crypto: hisilicon/qm - supports writing QoS int the host") Signed-off-by: nieweiqiang <[email protected]> Signed-off-by: Chenghai Huang <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 9484379c88e1404e52879e9c459c672c61905af3) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 4a013ca2d490c73c40588d62712ffaa432046a04 ] In ath11k_wmi_send_peer_assoc_cmd(), peer's transmit MCS is sent to firmware as receive MCS while peer's receive MCS sent as transmit MCS, which goes against firmwire's definition. While connecting to a misbehaved AP that advertises 0xffff (meaning not supported) for 160 MHz transmit MCS map, firmware crashes due to 0xffff is assigned to he_mcs->rx_mcs_set field. Ext Tag: HE Capabilities [...] Supported HE-MCS and NSS Set [...] Rx and Tx MCS Maps 160 MHz [...] Tx HE-MCS Map 160 MHz: 0xffff Swap the assignment to fix this issue. As the HE rate control mask is meant to limit our own transmit MCS, it needs to go via he_mcs->rx_mcs_set field. With the aforementioned swapping done, change is needed as well to apply it to the peer's receive MCS. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 61fe43e ("ath11k: add support for setting fixed HE rate/gi/ltf") Signed-off-by: Baochen Qiang <[email protected]> Reviewed-by: Vasanthakumar Thiagarajan <[email protected]> Link: https://patch.msgid.link/20251017-ath11k-mcs-assignment-v1-2-da40825c1783@oss.qualcomm.com Signed-off-by: Jeff Johnson <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 4304bd7a334e981f189b9973056a58f84cc2b482) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 07a75d08cfa1b883a6e1256666e5f0617ee99231 ] In case SCLP CPU detection does not work a fallback mechanism using SIGP is in place. Since a cleanup this does not work correctly anymore: new CPUs are only considered if their type matches the boot CPU. Before the cleanup the information if a CPU type should be considered was also part of a structure generated by the fallback mechanism and indicated that a CPU type should not be considered when adding CPUs. Since the rework a global SCLP state is used instead. If the global SCLP state indicates that the CPU type should be considered and the fallback mechanism is used, there may be a mismatch with CPU types if CPUs are added. This can lead to a system with only a single CPU even tough there are many more CPUs. Address this by simply copying the boot cpu type into the generated data structure from the fallback mechanism. Reported-by: Alexander Egorenkov <[email protected]> Fixes: d08d943 ("s390/smp: cleanup core vs. cpu in the SCLP interface") Reviewed-by: Mete Durlu <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 772ded5a84e0a414e13203d6b28f65659b7cbe74) Signed-off-by: Wentao Guan <[email protected]>
…ailable [ Upstream commit 020d5dc57874e58d3ebae398f3fe258f029e3d06 ] If no AP instructions are available the AP bus module leaks registered debug feature files. Change function call order to fix this. Fixes: cccd85b ("s390/zcrypt: Rework debug feature invocations.") Reviewed-by: Harald Freudenberger <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit bb04d3610f0803f7c2cb0b9a9ee38c02908ec3f2) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 76546090b1726118cd6fb3db7159fc2a3fdda8a0 ] Update the memory region listed in the k3-am62p.dtsi for the BXS-4-64 GPU to match the Main Memory Map described in the TRM [1]. [1] https://www.ti.com/lit/ug/spruj83b/spruj83b.pdf Fixes: 29075cc ("arm64: dts: ti: Introduce AM62P5 family of SoCs") Signed-off-by: Randolph Sapp <[email protected]> Reviewed-by: Michael Walle <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Vignesh Raghavendra <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit abdbffb6a0878bc36aee4627ec2a651274783b90) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit ee67247843a2b62d1473cfa4df300e69b5190ccf ] imx_scu_enable_general_irq_channel() calls of_parse_phandle_with_args(), but does not release the OF node reference. Add a of_node_put() call to release the reference. Fixes: 851826c ("firmware: imx: enable imx scu general irq function") Reviewed-by: Frank Li <[email protected]> Signed-off-by: Peng Fan <[email protected]> Signed-off-by: Shawn Guo <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit a649992b7eb33f84c052a786f1f3c543363c61f4) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit d7ec7d34237498fab7a6afed8da4b7139b0e387c ] The previous GPIO numbers were wrong. Update them to the correct ones and fix the label. Fixes: 288ef8a ("arm64: dts: sdm845: add oneplus6/6t devices") Signed-off-by: Gergo Koteles <[email protected]> Signed-off-by: David Heidelberg <[email protected]> Reviewed-by: Konrad Dybcio <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Bjorn Andersson <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 32d9c68af13344caa16652433f9ee8bd063edba1) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit ea5df88aeca112aac69e6c32e3dd1433a113b0c9 ] The PTP initialization is two-step. First part are the function vsc8584_ptp_probe_once() and vsc8584_ptp_probe() at probe time which initialize the locks, queues, creates the PTP device. The second part is the function vsc8584_ptp_init() at config_init() time which initialize PTP in the HW. For VSC8574 and VSC8572, the PTP initialization is incomplete. It is missing the first part but it makes the second part. Meaning that the ptp_clock_register() is never called. There is no crash without the first part when enabling PTP but this is unexpected because some PHys have PTP functionality exposed by the driver and some don't even though they share the same PTP clock PTP. Fixes: 774626f ("net: phy: mscc: Add PTP support for 2 more VSC PHYs") Reviewed-by: Maxime Chevallier <[email protected]> Signed-off-by: Horatiu Vultur <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 85ede044f43d98ee6a53872afbeab2220b8773f3) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 622e8838a29845316668ec2e7648428878df7f9a ] SCTP_DBG_OBJCNT_INC() is called only when sctp_init_sock() returns 0 after successfully allocating sctp_sk(sk)->ep. OTOH, SCTP_DBG_OBJCNT_DEC() is called in sctp_close(). The code seems to expect that the socket is always exposed to userspace once SCTP_DBG_OBJCNT_INC() is incremented, but there is a path where the assumption is not true. In sctp_accept(), sctp_sock_migrate() could fail after sctp_init_sock(). Then, sk_common_release() does not call inet_release() nor sctp_close(). Instead, it calls sk->sk_prot->destroy(). Let's move SCTP_DBG_OBJCNT_DEC() from sctp_close() to sctp_destroy_sock(). Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima <[email protected]> Acked-by: Xin Long <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 8f2602a83f669e5a955f59a4caa832896b9018b8) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 503a5e4690ae14c18570141bc0dcf7501a8419b0 ] A NULL pointer dereference can occur in rxe_srq_chk_attr() when ibv_modify_srq() is invoked twice in succession under certain error conditions. The first call may fail in rxe_queue_resize(), which leads rxe_srq_from_attr() to set srq->rq.queue = NULL. The second call then triggers a crash (null deref) when accessing srq->rq.queue->buf->index_mask. Call Trace: <TASK> rxe_modify_srq+0x170/0x480 [rdma_rxe] ? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe] ? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs] ? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs] ib_uverbs_modify_srq+0x204/0x290 [ib_uverbs] ? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs] ? tryinc_node_nr_active+0xe6/0x150 ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs] ? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs] ? __pfx___raw_spin_lock_irqsave+0x10/0x10 ? __pfx_do_vfs_ioctl+0x10/0x10 ? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0 ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 ib_uverbs_ioctl+0x13e/0x220 [ib_uverbs] ? __pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs] __x64_sys_ioctl+0x138/0x1c0 do_syscall_64+0x82/0x250 ? fdget_pos+0x58/0x4c0 ? ksys_write+0xf3/0x1c0 ? __pfx_ksys_write+0x10/0x10 ? do_syscall_64+0xc8/0x250 ? __pfx_vm_mmap_pgoff+0x10/0x10 ? fget+0x173/0x230 ? fput+0x2a/0x80 ? ksys_mmap_pgoff+0x224/0x4c0 ? do_syscall_64+0xc8/0x250 ? do_user_addr_fault+0x37b/0xfe0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 8700e3e ("Soft RoCE driver") Tested-by: Liu Yi <[email protected]> Signed-off-by: Zhu Yanjun <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 58aca869babd48cb9c3d6ee9e1452c4b9f5266a6) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 00df14f34615630f92f97c9d6790bd9d25c4242d ]
'bus-width' is defined for the corresponding vin input port already.
No need to declare it in the output port again. Fixes:
arch/arm/boot/dts/renesas/r8a7793-gose.dtb: composite-in@20 (adi,adv7180cp): ports:port@3:endpoint: Unevaluated properties are not allowed ('bus-width' was unexpected)
from schema $id: http://devicetree.org/schemas/media/i2c/adi,adv7180.yaml#
Signed-off-by: Wolfram Sang <[email protected]>
Reviewed-by: Geert Uytterhoeven <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Geert Uytterhoeven <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
(cherry picked from commit eb8ac04f1036b687e1414410a4c3bf8df8ff5c9c)
Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit ca7fffb6e92a7c93604ea2bae0e1c89b20750937 ]
The 'ethernet-ports' node in the SoC DTSI handles them already. Fixes:
arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dtb: switch@44050000 (renesas,r9a06g032-a5psw): Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected)
from schema $id: http://devicetree.org/schemas/net/dsa/renesas,rzn1-a5psw.yaml#
Fixes: 5b6d7c3 ("ARM: dts: r9a06g032-rzn1d400-db: Add switch description")
Signed-off-by: Wolfram Sang <[email protected]>
Reviewed-by: Geert Uytterhoeven <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Geert Uytterhoeven <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
(cherry picked from commit 4a493d02ff463ce9d088dcf4ca1bd07ba300e9cb)
Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit fbd72cb463fdea3a0c900dd5d6e813cdebc3a73c ] This reverts commit e6a30d0. This change resulted in the 8bit ECC layouts having the incorrect amount of read/write chunks, the last spare bytes chunk would always be missed. Fixes: e6a30d0 ("mtd: rawnand: marvell: fix layouts") Signed-off-by: Aryan Srivastava <[email protected]> Signed-off-by: Miquel Raynal <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 9ce7cbd355ae1793cf33d8050f2fbbe6bf88a69e) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit 050553c683f21eebd7d1020df9b2ec852e2a9e4e ] Due to the custom handling and layouts of certain nand controllers this validity check will always fail for certain layouts. The check inherently depends on even chunk sizing and this is not always the case. Modify the check to only print a warning, instead of failing to init the attached NAND. This allows various 8 bit and 12 ECC strength layouts to be used. Fixes: 68c18da ("mtd: rawnand: marvell: add missing layouts") Signed-off-by: Aryan Srivastava <[email protected]> Signed-off-by: Miquel Raynal <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 4e6526697dcb92f89afe7e0aa7a1c4a5acb65308) Signed-off-by: Wentao Guan <[email protected]>
…d remove [ Upstream commit cdf44f1add4ec9ee80569d5a43e6e9bba0d74c7a ] The driver calls gpiod_get_optional() in the probe function but never calls gpiod_put() in the remove function or in the probe error path. This leads to a GPIO descriptor resource leak. The lpc32xx_mlc.c driver in the same directory handles this correctly by calling gpiod_put() on both paths. Add gpiod_put() in the remove function and in the probe error path to fix the resource leak. Fixes: 6b923db ("mtd: rawnand: lpc32xx_slc: switch to using gpiod API") Signed-off-by: Haotian Zhang <[email protected]> Signed-off-by: Miquel Raynal <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 1d733fcbfe61c41a8a0f42342bdf59c963965814) Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit ef1ea98c8fffe227e5319215d84a53fa2a4bcebc ]
__schedule()
// disable irqs
<NMI>
task_work_add(current, work, TWA_NMI_CURRENT);
</NMI>
// current = next;
// enable irqs
<IRQ>
task_work_set_notify_irq()
test_and_set_tsk_thread_flag(current,
TIF_NOTIFY_RESUME); // wrong task!
</IRQ>
// original task skips task work on its next return to user (or exit!)
Fixes: 466e4d8 ("task_work: Add TWA_NMI_CURRENT as an additional notify mode.")
Reported-by: Josh Poimboeuf <[email protected]>
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
Reviewed-by: Steven Rostedt (Google) <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
(cherry picked from commit b2a39b1a3cde5e49b5b646ae3829d683cd51b69b)
Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit ced37e9ceae50e4cb6cd058963bd315ec9afa651 ]
When triggering a stack dump via sysrq (echo t > /proc/sysrq-trigger),
KASAN may report false-positive out-of-bounds access:
BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
Call Trace:
dump_stack_lvl
print_address_description.constprop.0
print_report
__show_regs
show_trace_log_lvl
sched_show_task
show_state_filter
sysrq_handle_showstate
__handle_sysrq
write_sysrq_trigger
proc_reg_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe
The issue occurs as follows:
Task A (walk other tasks' stacks) Task B (running)
1. echo t > /proc/sysrq-trigger
show_trace_log_lvl
regs = unwind_get_entry_regs()
show_regs_if_on_stack(regs)
2. The stack value pointed by
`regs` keeps changing, and
so are the tags in its
KASAN shadow region.
__show_regs(regs)
regs->ax, regs->bx, ...
3. hit KASAN redzones, OOB
When task A walks task B's stack without suspending it, the continuous changes
in task B's stack (and corresponding KASAN shadow tags) may cause task A to
hit KASAN redzones when accessing obsolete values on the stack, resulting in
false positive reports.
Simply stopping the task before unwinding is not a viable fix, as it would
alter the state intended to inspect. This is especially true for diagnosing
misbehaving tasks (e.g., in a hard lockup), where stopping might fail or hide
the root cause by changing the call stack.
Therefore, fix this by disabling KASAN checks during asynchronous stack
unwinding, which is identified when the unwinding task does not match the
current task (task != current).
[ bp: Align arguments on function's opening brace. ]
Fixes: 3b3fa11 ("x86/dumpstack: Print any pt_regs found on the stack")
Signed-off-by: Tengda Wu <[email protected]>
Signed-off-by: Borislav Petkov (AMD) <[email protected]>
Reviewed-by: Andrey Ryabinin <[email protected]>
Acked-by: Josh Poimboeuf <[email protected]>
Link: https://patch.msgid.link/all/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
(cherry picked from commit 2d3e5c1e76e9a9e9267b3038964cb589bf050db5)
Signed-off-by: Wentao Guan <[email protected]>
[ Upstream commit c485ca3aff2442adea4c08ceb5183e671ebed22a ] There is no errno variable when NOLIBC_IGNORE_ERRNO is defined. As such, simply print the message with "unknown error" rather than the integer value of errno. Fixes: acab7bc ("tools/nolibc/stdio: add perror() to report the errno value") Signed-off-by: Benjamin Berg <[email protected]> Signed-off-by: Thomas Weißschuh <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 6135d225cca7dc04031145207cd1c39d7117cd4e) Signed-off-by: Wentao Guan <[email protected]>
Commit 863a320 ("LoongArch: Mask all interrupts during kexec/kdump") is backported to LTS branches, but they lack a generic machine_kexec_mask_interrupts() implementation, so add an arch-specific one. Signed-off-by: Tianyang Zhang <[email protected]> Signed-off-by: Huacai Chen <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 95eb965ce0a6ff8345653963cfde311a38b43691) Signed-off-by: Wentao Guan <[email protected]>
opsiff
force-pushed
the
linux-stable-update-6.6.120-p1
branch
from
e7af19b to
2c25383
Compare
deepin pr auto review这是一个包含大量Linux内核代码修改的diff文件。我将从语法逻辑、代码质量、代码性能和代码安全四个方面进行审查。 代码审查意见1. 语法逻辑审查优点：
改进建议：
2. 代码质量审查优点：
改进建议：
3. 代码性能审查优点：
改进建议：
4. 代码安全审查优点：
改进建议：
总结这次代码修改总体上提高了Linux内核的稳定性和安全性，特别是在以下几个方面：
建议在未来的修改中：
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Due to github limit, submit part 1/8 of v6.6.120.
git log --oneline v6.6.119..v6.6.120~638 | wc
100 867 7155
Changelog v2:
Add the commit in v6.6.120 to fix build failed in LoongArch.
And rebase to now linux-6.6.y,so #1395 merged berfore.
LoongArch: Add machine_kexec_mask_interrupts() implementation
Alexander Sverdlin (1):
locking/spinlock/debug: Fix data-race in do_raw_write_lock
Alexey Nepomnyashih (1):
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
Alvaro Gamez Machado (1):
spi: xilinx: increase number of retries before declaring stall
Antheas Kapenekakis (2):
platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
April Grimoire (1):
HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
Armin Wolf (1):
platform/x86: acer-wmi: Ignore backlight event
Aryan Srivastava (2):
Revert "mtd: rawnand: marvell: fix layouts"
mtd: nand: relax ECC parameter validation check
Bagas Sanjaya (1):
Documentation: process: Also mention Sasha Levin as stable tree
maintainer
Baochen Qiang (1):
wifi: ath11k: fix peer HE MCS assignment
Benjamin Berg (1):
tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
Claudiu Beznea (3):
clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable()
clk: renesas: rzg2l: Remove critical area
clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R()
Deepanshu Kartikey (1):
ext4: refresh inline data size before write operations
Dylan Hatch (1):
objtool: Fix standalone --hacks=jump_label
Fabio Porcedda (2):
USB: serial: option: add Telit Cinterion FE910C04 new compositions
USB: serial: option: move Telit 0x10c7 composition in the right place
Fernand Sieber (1):
sched/fair: Forfeit vruntime on yield
Francesco Lavra (1):
iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
Geert Uytterhoeven (2):
clk: renesas: Use str_on_off() helper
PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
Gergo Koteles (1):
arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
Guido Günther (1):
drm/panel: visionox-rm69299: Don't clear all mode flags
Haotian Zhang (1):
mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and
remove
Heiko Carstens (2):
s390/smp: Fix fallback CPU detection
s390/ap: Don't leak debug feature files if AP instructions are not
available
Herbert Xu (1):
crypto: authenc - Correctly pass EINPROGRESS back up to the caller
Horatiu Vultur (1):
phy: mscc: Fix PTP for VSC8574 and VSC8572
Huacai Chen (1):
LoongArch: Mask all interrupts during kexec/kdump
Ian Abbott (1):
comedi: c6xdigio: Fix invalid PNP driver unregistration
Ian Forbes (1):
drm/vmwgfx: Use kref in vmw_bo_dirty
Janusz Krzysztofik (1):
drm/vgem-fence: Fix potential deadlock on release
Jia Ston (1):
platform/x86: huawei-wmi: add keys for HONOR models
Johan Hovold (8):
USB: serial: ftdi_sio: match on interface number for jtag
USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
irqchip/irq-bcm7038-l1: Fix section mismatch
irqchip/irq-bcm7120-l2: Fix section mismatch
irqchip/irq-brcmstb-l2: Fix section mismatch
irqchip/imx-mu-msi: Fix section mismatch
irqchip/qcom-irq-combiner: Fix section mismatch
Josh Poimboeuf (1):
objtool: Fix weak symbol detection
Keith Busch (1):
nvme: fix admin request_queue lifetime
Konstantin Andreev (1):
smack: fix bug: unprivileged task can create labels
Kuniyuki Iwashima (1):
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
Li Qiang (1):
uio: uio_fsl_elbc_gpcm:: Add null pointer check to
uio_fsl_elbc_gpcm_probe
Linus Torvalds (1):
samples: work around glibc redefining some of our defines wrong
Luca Weiss (1):
clk: qcom: camcc-sm6350: Fix PLL config of PLL2
Lushih Hsieh (1):
ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
Magne Bruno (1):
serial: add support of CPCI cards
Mainak Sen (1):
gpu: host1x: Fix race in syncpt alloc/free
Marek Vasut (2):
clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle
callback
clk: renesas: cpg-mssr: Read back reset registers to assure values
latched
Mario Limonciello (AMD) (1):
HID: hid-input: Extend Elan ignore battery quirk to USB
Mavroudis Chatzilazaridis (1):
HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
Max Chou (1):
Bluetooth: btrtl: Avoid loading the config file on security chips
Naoki Ueki (1):
HID: elecom: Add support for ELECOM M-XT3URBK (018F)
Navaneeth K (3):
staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
Nikita Zhandarovich (3):
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
comedi: multiq3: sanitize config options in multiq3_attach()
comedi: check device's attached status in compat ioctls
Omar Sandoval (1):
KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
Peng Fan (1):
firmware: imx: scu-irq: fix OF node leak in
Peter Zijlstra (1):
task_work: Fix NMI race condition
Praveen Talari (1):
pinctrl: qcom: msm: Fix deadlock in pinmux configuration
Qianchang Zhao (1):
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
Randolph Sapp (1):
arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
Raphael Pinsonneault-Thibeault (1):
ntfs3: fix uninit memory after failed mi_read in mi_format_new
Robin Gong (1):
spi: imx: keep dma request disabled before dma transfer setup
Sabrina Dubroca (4):
xfrm: delete x->tunnel as we delete x
Revert "xfrm: destroy xfrm_state synchronously on net exit path"
xfrm: also call xfrm_state_delete_tunnel at destroy time for states
that were never added
xfrm: flush all states in xfrm_state_fini
Seungjin Bae (1):
USB: Fix descriptor count when handling invalid MBIM extended
descriptor
Sidharth Seela (1):
ntfs3: Fix uninit buffer allocated by __getname()
Slark Xiao (1):
USB: serial: option: add Foxconn T99W760
Song Liu (1):
ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
Stefan Kalscheuer (1):
leds: spi-byte: Use devm_led_classdev_register_ext()
Tengda Wu (1):
x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
Tetsuo Handa (1):
bfs: Reconstruct file type when loading from disk
Thierry Bultel (1):
clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
Thorsten Blum (1):
crypto: asymmetric_keys - prevent overflow in
asymmetric_key_generate_id
Tim Harvey (4):
arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate
usdhc1 props
arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
arm64: dts: imx8mp-venice-gw702x: remove off-board uart
arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
Vladimir Zapolskiy (1):
clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent
to other
Wolfram Sang (2):
ARM: dts: renesas: gose: Remove superfluous port property
ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells
properties
Xuanqiang Luo (2):
rculist: Add hlist_nulls_replace_rcu() and
hlist_nulls_replace_init_rcu()
inet: Avoid ehash lookup race in inet_ehash_insert()
Ye Bin (1):
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file
system corrupted
Yiqi Sun (1):
smb: fix invalid username check in smb3_fs_context_parse_param()
Zenm Chen (1):
wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
Zhu Yanjun (1):
RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
nieweiqiang (1):
crypto: hisilicon/qm - restore original qos values
Documentation/process/2.Process.rst | 6 +-
arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 -
.../dts/renesas/r9a06g032-rzn1d400-db.dts | 2 -
.../dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 --
.../dts/freescale/imx8mp-venice-gw702x.dtsi | 51 ------
.../dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 --
.../boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 +-
arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +-
arch/loongarch/kernel/machine_kexec.c | 2 +
arch/s390/kernel/smp.c | 1 +
arch/x86/include/asm/kvm_host.h | 9 ++
arch/x86/kernel/dumpstack.c | 23 ++-
arch/x86/kvm/svm/svm.c | 24 +--
arch/x86/kvm/x86.c | 21 +++
crypto/asymmetric_keys/asymmetric_type.c | 14 +-
crypto/authenc.c | 75 ++++++---
drivers/bluetooth/btrtl.c | 24 +--
drivers/clk/qcom/camcc-sm6350.c | 13 +-
drivers/clk/renesas/r7s9210-cpg-mssr.c | 7 +-
drivers/clk/renesas/r8a77970-cpg-mssr.c | 8 +-
drivers/clk/renesas/rcar-gen2-cpg.c | 5 +-
drivers/clk/renesas/rcar-gen2-cpg.h | 3 +-
drivers/clk/renesas/rcar-gen3-cpg.c | 6 +-
drivers/clk/renesas/rcar-gen3-cpg.h | 3 +-
drivers/clk/renesas/rcar-gen4-cpg.c | 6 +-
drivers/clk/renesas/rcar-gen4-cpg.h | 3 +-
drivers/clk/renesas/renesas-cpg-mssr.c | 150 +++++++++---------
drivers/clk/renesas/renesas-cpg-mssr.h | 20 ++-
drivers/clk/renesas/rzg2l-cpg.c | 15 +-
drivers/comedi/comedi_fops.c | 42 ++++-
drivers/comedi/drivers/c6xdigio.c | 46 ++++--
drivers/comedi/drivers/multiq3.c | 9 ++
drivers/comedi/drivers/pcl818.c | 5 +-
drivers/crypto/hisilicon/qm.c | 14 +-
drivers/firmware/imx/imx-scu-irq.c | 4 +-
.../gpu/drm/panel/panel-visionox-rm69299.c | 2 +-
drivers/gpu/drm/vgem/vgem_fence.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +-
drivers/gpu/host1x/syncpt.c | 4 +-
drivers/hid/hid-apple.c | 1 +
drivers/hid/hid-elecom.c | 6 +-
drivers/hid/hid-ids.h | 3 +-
drivers/hid/hid-input.c | 5 +-
drivers/hid/hid-logitech-hidpp.c | 9 +-
drivers/hid/hid-quirks.c | 3 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +-
drivers/infiniband/sw/rxe/rxe_srq.c | 7 +-
drivers/irqchip/irq-bcm7038-l1.c | 8 +-
drivers/irqchip/irq-bcm7120-l2.c | 17 +-
drivers/irqchip/irq-brcmstb-l2.c | 12 +-
drivers/irqchip/irq-imx-mu-msi.c | 14 +-
drivers/irqchip/qcom-irq-combiner.c | 2 +-
drivers/leds/leds-spi-byte.c | 11 +-
drivers/mtd/nand/raw/lpc32xx_slc.c | 2 +
drivers/mtd/nand/raw/marvell_nand.c | 13 +-
drivers/mtd/nand/raw/nand_base.c | 13 +-
drivers/net/phy/mscc/mscc_main.c | 6 +-
drivers/net/wireless/ath/ath11k/mac.c | 4 +-
drivers/net/wireless/ath/ath11k/wmi.c | 7 +-
.../net/wireless/realtek/rtw88/rtw8822cu.c | 2 +
drivers/nvme/host/core.c | 3 +-
drivers/pci/controller/Kconfig | 7 +-
drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
drivers/platform/x86/acer-wmi.c | 4 +
drivers/platform/x86/amd/pmc/pmc-quirks.c | 25 +++
drivers/platform/x86/huawei-wmi.c | 4 +
drivers/s390/crypto/ap_bus.c | 8 +-
drivers/spi/spi-imx.c | 15 +-
drivers/spi/spi-xilinx.c | 2 +-
.../staging/rtl8723bs/core/rtw_ieee80211.c | 14 +-
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 13 +-
drivers/tty/serial/8250/8250_pci.c | 37 +++++
drivers/uio/uio_fsl_elbc_gpcm.c | 7 +
drivers/usb/core/message.c | 2 +-
drivers/usb/serial/belkin_sa.c | 28 ++--
drivers/usb/serial/ftdi_sio.c | 72 +++------
drivers/usb/serial/kobil_sct.c | 18 +--
drivers/usb/serial/option.c | 22 ++-
fs/bfs/inode.c | 19 ++-
fs/ext4/inline.c | 14 +-
fs/jbd2/transaction.c | 19 ++-
fs/ntfs3/fsntfs.c | 9 +-
fs/ntfs3/inode.c | 1 +
fs/smb/client/fs_context.c | 2 +-
fs/smb/server/transport_ipc.c | 7 +-
include/linux/rculist_nulls.h | 59 +++++++
include/net/sock.h | 13 ++
include/net/xfrm.h | 13 +-
kernel/locking/spinlock_debug.c | 4 +-
kernel/sched/fair.c | 14 +-
kernel/task_work.c | 8 +-
kernel/trace/ftrace.c | 40 +++--
net/ipv4/inet_hashtables.c | 8 +-
net/ipv4/ipcomp.c | 2 +
net/ipv6/ipcomp6.c | 2 +
net/ipv6/xfrm6_tunnel.c | 2 +-
net/key/af_key.c | 2 +-
net/sctp/socket.c | 5 +-
net/xfrm/xfrm_ipcomp.c | 1 -
net/xfrm/xfrm_state.c | 41 ++---
net/xfrm/xfrm_user.c | 2 +-
samples/vfs/test-statx.c | 6 +
samples/watch_queue/watch_test.c | 6 +
security/smack/smack_lsm.c | 41 +++--
sound/usb/quirks.c | 6 +
tools/include/nolibc/stdio.h | 4 +
tools/objtool/check.c | 3 +-
tools/objtool/elf.c | 8 +-
108 files changed, 920 insertions(+), 531 deletions(-)