Commit Graph

1121484 Commits

Author SHA1 Message Date
Dan Williams
4d8e4ea5bb cxl/region: Disallow region granularity != window granularity
The endpoint decode granularity must be <= the window granularity
otherwise capacity in the endpoints is lost in the decode. Consider an
attempt to have a region granularity of 512 with 4 devices within a
window that maps 2 host bridges at a granularity of 256 bytes:

HPA	DPA Offset	HB	Port	EP
0x0	0x0		0	0	0
0x100	0x0		1	0	2
0x200	0x100		0	0	0
0x300	0x100		1	0	2
0x400	0x200		0	1	1
0x500	0x200		1	1	3
0x600	0x300		0	1	1
0x700	0x300		1	1	3
0x800	0x400		0	0	0
0x900	0x400		1	0	2
0xA00	0x500		0	0	0
0xB00	0x500		1	0	2

Notice how endpoint0 maps HPA 0x0 and 0x200 correctly, but then at HPA
0x800 it results in DPA 0x200-0x400 on being skipped.

Fix this by restricing the region granularity to be equal to the window
granularity resulting in the following for a x4 region under a x2 window
at a granularity of 256.

HPA	DPA Offset	HB	Port	EP
0x0	0x0		0	0	0
0x100	0x0		1	0	2
0x200	0x0		0	1	1
0x300	0x0		1	1	3
0x400	0x100		0	0	0
0x500	0x100		1	0	2
0x600	0x100		0	1	1
0x700	0x100		1	1	3

Not that it ever made practical sense to support region granularity >
window granularity. The window rotates host bridges causing endpoints to
never see a consecutive stream of requests at the desired granularity
without breaks to issue cycles to the other host bridge.

Fixes: 80d10a6cee ("cxl/region: Add interleave geometry attributes")
Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Link: https://lore.kernel.org/r/165973127171.1526540.9923273539049172976.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 16:10:04 -07:00
Dan Williams
298d44d04b cxl/region: Fix x1 interleave to greater than x1 interleave routing
In cases where the decode fans out as it traverses downstream, the
interleave granularity needs to increment to identify the port selector
bits out of the remaining address bits. For example, recall that with an
x2 parent port intereleave (IW == 1), the downstream decode for children
of those ports will either see address bit IG+8 always set, or address
bit IG+8 always clear. So if the child port needs to select a downstream
port it can only use address bits starting at IG+9 (where IG and IW are
the CXL encoded values for interleave granularity (ilog2(ig) - 8) and
ways (ilog2(iw))).

When the parent port interleave is x1 no such masking occurs and the
child port can maintain the granularity that was routed to the parent
port.

Reported-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Link: https://lore.kernel.org/r/165973126583.1526540.657948655360009242.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 16:10:03 -07:00
Dan Williams
910bc55da8 cxl/region: Move HPA setup to cxl_region_attach()
A recent bug fix added the setup of the endpoint decoder interleave
geometry settings to cxl_region_attach(). Move the HPA setup there as
well to keep all endpoint decoder parameter setting in a central
location.

For symmetry, move endpoint HPA teardown to cxl_region_detach(), and for
switches move HPA setup / teardown to cxl_port_{setup,reset}_targets().

Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Link: https://lore.kernel.org/r/165973126020.1526540.14701949254436069807.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 16:10:03 -07:00
Linus Torvalds
74cae210a3 MTD core changes:
* Dynamic partition support
 * Fix deadlock in sm_ftl
 * Various refcount fixes in maps, partitions and parser code
 * Integer overflow fixes in mtdchar
 * Support for Sercomm partitions
 
 NAND driver changes:
 * Clockrate fix for arasan
 * Add ATO25D1GA support
 * Double free fix for meson driver
 * Fix probe/remove methods in cafe NAND
 * Support unprotected spare data pages in qcom_nandc
 
 SPI NOR core changes:
 * move SECT_4K_PMC flag out of the core as it's a vendor specific flag
 * s/addr_width/addr_nbytes: address width means the number of IO lines
 used for the address, whereas in the code it is used as the number of
 address bytes.
 * do not change nor->addr_nbytes at SFDP parsing time. At the SFDP parsing
 time we should not change members of struct spi_nor, but instead fill
 members of struct spi_nor_flash_parameters which could later on be used
 by the callers.
 * track flash's internal address mode so that we can use 4B opcodes
 together with opcodes that don't have a 4B opcode correspondent.
 
 SPI NOR manufacturer drivers changes:
 * esmt: Rename "f25l32qa" flash name to "f25l32qa-2s".
 * micron-st: Skip FSR reading if SPI controller does not support it to
 allow flashes that support FSR to work even when attached to such SPI
 controllers.
 * spansion: Add s25hl-t/s25hs-t IDs and fixups.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmLthF4ACgkQZvlZhesY
 u8FCkQ//QNJE67mHMWakQRAgjrJ7S8XAbr3BhWLAo/jKxWq0dp+UmPbR+ioia9bv
 wCgrKhHySdsHfyIsuSe+6oSfs0cqGxOo9o8ldW0fygcgX015/FQu72KEDuIQssl8
 fK2x9IPiwB9a4gwJq8K8DdIrmQtzi4pu3L+xjylrhlJ+7P7pcjGsUSY8kIuW0FI9
 1MD8SawOdtoch8STORnRop9XgPbFMJGx3/Oa7eUm9l6YDbKdtO+b2PJELfReXaHy
 zSTtvG+uP7SOSG7vEVgap76GaXrOklmsiPN62dp+Rk20aqU6DzpGFTdlG8TMMrMc
 x3CG4SyRbtCrb9UhZf5V/LMWMVZrRyuXUxTdNmFCAnTjONXq0UG6HEb4lrOxc7s7
 Az286Ycc2DXCwDrqa50LWAw2nP8JKoRQiMU4Q/9f1UIpIpA7wSrwwtzX/q5LqbEd
 H+q6UOClw92nJZcimLbdyjo9Pauj8Cus76nuasSxSVIC1sWMKg2Y/vOnCgD8SQMj
 ISqO/3A7Dr2xUvKJmM7H3sfyyUWehnYjD/nNc1TOjWzOxAQOlOpMdY8+5I/9Pc0Y
 q9NiCNFiBht14Fc/klWsg8xtNMpPAi7pua1F04meK6Z//9uUbiiN5el/snEQ1uCF
 8o3ILFVpCgHIv2kmjGBBwxzXA9W6V1z/qTundQHJoSRc9DS8VAQ=
 =eBd9
 -----END PGP SIGNATURE-----

Merge tag 'mtd/for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

Pull MTD updates from Richard Weinberger:
 "MTD core changes:

   - Dynamic partition support

   - Fix deadlock in sm_ftl

   - Various refcount fixes in maps, partitions and parser code

   - Integer overflow fixes in mtdchar

   - Support for Sercomm partitions

  NAND driver changes:

   - Clockrate fix for arasan

   - Add ATO25D1GA support

   - Double free fix for meson driver

   - Fix probe/remove methods in cafe NAND

   - Support unprotected spare data pages in qcom_nandc

  SPI NOR core changes:

   - move SECT_4K_PMC flag out of the core as it's a vendor specific
     flag

   - s/addr_width/addr_nbytes/g: address width means the number of IO
     lines used for the address, whereas in the code it is used as the
     number of address bytes.

   - do not change nor->addr_nbytes at SFDP parsing time. At the SFDP
     parsing time we should not change members of struct spi_nor, but
     instead fill members of struct spi_nor_flash_parameters which could
     later on be used by the callers.

   - track flash's internal address mode so that we can use 4B opcodes
     together with opcodes that don't have a 4B opcode correspondent.

  SPI NOR manufacturer drivers changes:

   - esmt: Rename "f25l32qa" flash name to "f25l32qa-2s".

   - micron-st: Skip FSR reading if SPI controller does not support it
     to allow flashes that support FSR to work even when attached to
     such SPI controllers.

   - spansion: Add s25hl-t/s25hs-t IDs and fixups"

* tag 'mtd/for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (53 commits)
  mtd: core: check partition before dereference
  mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}()
  mtd: spi-nor: spansion: Add s25hl-t/s25hs-t IDs and fixups
  mtd: spi-nor: spansion: Add local function to discover page size
  mtd: spi-nor: core: Track flash's internal address mode
  mtd: spi-nor: core: Return error code from set_4byte_addr_mode()
  mtd: spi-nor: Do not change nor->addr_nbytes at SFDP parsing time
  mtd: spi-nor: core: Shrink the storage size of the flash_info's addr_nbytes
  mtd: spi-nor: s/addr_width/addr_nbytes
  mtd: spi-nor: esmt: Use correct name of f25l32qa
  mtd: spi-nor: micron-st: Skip FSR reading if SPI controller does not support it
  MAINTAINERS: Use my kernel.org email
  mtd: rawnand: arasan: Fix clock rate in NV-DDR
  mtd: rawnand: arasan: Update NAND bus clock instead of system clock
  mtd: core: introduce of support for dynamic partitions
  dt-bindings: mtd: partitions: add additional example for qcom,smem-part
  dt-bindings: mtd: partitions: support label/name only partition
  mtd: spi-nor: move SECT_4K_PMC special handling
  mtd: dataflash: Add SPI ID table
  mtd: hyperbus: rpc-if: Fix RPM imbalance in probe error path
  ...
2022-08-05 14:13:45 -07:00
Linus Torvalds
79b7e67bb9 This pull request contains the following changes for UML:
- KASAN support for x86_64
 - noreboot command line option, just like qemu's -no-reboot
 - Various fixes and cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmLteZYACgkQZvlZhesY
 u8F8bRAA2806QUzysg3Nj1AKPiTOj47TuluGu4SXytB0usQgYK/n3Fxr36ULJAOJ
 3qZWf2fsAkBLvgX9Sw2QFGfulrpfKnLeTdBXSEbWYWhZ0ZoaEJztKmtfH02kRDOW
 POedQT5FXMDVjGQdLC7Ycp+WyjaUwrccZ+KRkGWmlr7vNFlxcTlEqBb13mgLdjkY
 ep8X+SgmAcdvWBd/os+nNn9Al6TbFd4XQCok82DtNrv0ggwXnVPov/ArvZvvn2Oj
 F028X77180rbrGV+ZnDkV1KSv/ccT5EFebJkfEEcYVjre8o0QoPQmh2tFqXN0d83
 2WpIOb1+mQL0VClpC4hKbScpIB5tw8vIHsUT+ifloIgY/puhezx6aWm0TKSA+aTM
 WitJl1Nf4uNu1rqkBkn9o3VK8CYokTALQIRexHCzvZ70CSxmFbR7EVRSTf7Rr690
 Oq7StHagfuTJpddh0wQwaMorIH4s0/bpPoA6m4OhwlppnCpY0Hfl3+AKluNRUtH6
 lPeQwfxhd/LKqYW0COElEnReDLzer82kUx/keVyxVINqxpm6YTHVtOgtMCEuVNXg
 GbS8PFCW2mIP8Is6HJavZYCzG8vnz3wZ9GENujanwLemiIJfINDauybu+nNsE5pO
 7v12vWeZ0x2HGM/cFxODrpp4xAkdq8BBLap8/aXB8uJFagmYyhs=
 =f3Bh
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml

Pull UML updates from Richard Weinberger:

 - KASAN support for x86_64

 - noreboot command line option, just like qemu's -no-reboot

 - Various fixes and cleanups

* tag 'for-linus-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml:
  um: include sys/types.h for size_t
  um: Replace to_phys() and to_virt() with less generic function names
  um: Add missing apply_returns()
  um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
  um: include linux/stddef.h for __always_inline
  UML: add support for KASAN under x86_64
  mm: Add PAGE_ALIGN_DOWN macro
  um: random: Don't initialise hwrng struct with zero
  um: remove unused mm_copy_segments
  um: remove unused variable
  um: Remove straying parenthesis
  um: x86: print RIP with symbol
  arch: um: Fix build for statically linked UML w/ constructors
  x86/um: Kconfig: Fix indentation
  um/drivers: Kconfig: Fix indentation
  um: Kconfig: Fix indentation
2022-08-05 14:03:11 -07:00
Linus Torvalds
4d5398a3ec OpenRISC fixes for 5.20-rc1/6.0
In this cycle we add PCI support to OpenRISC used in our new QEMU virt
 platform.  The base of this series is a merge of Bjorn's PCI headers
 cleanup branch and 5.16-rc6.  The patches from the PCI branch are needed
 for the series to work.
 
 The main updates from me include:
  - Kconfig updates to support OpenRISC PCI (just config now after the
    PCI cleanups I did on Bjorn's branch)
  - A new defconfig for the qemu virt platform.
  - Also there is one MAINTAINERS update.  As I was working on the PCI
    series we kept getting bounces from Richard's old email address. I
    added this here; I am not sure how these are usually handled when
    the maintainer doesn't queue it themselves.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmLtfRwACgkQw7McLV5m
 J+Tf0w//dJaiBa4kYysJ78vlH69ZGjaJMJfomF5HQVhF0sF5h5yUAaYqNHgItRwG
 76vewFESEJZ+fwxfLWdOKkCqQSkCG5bJkE5SCLViu9B4Cu+lbUZyzX2CwpcZz6ab
 rYnSolteMC4oL1MUFWXt1yP9ZUiTmAKN86uTfO+2ufax5WE/B0hS7m830bIOyqdZ
 qFnr1Mv0ujqUx1Oz8PDsy6jjV5AVBZP8zcEVGX+n9n3RpB8kUD9Zl+Rs3/AgfXdx
 aoOCcAS0hfYGfzkx6gGKtAiKwRicXNKYTPkGZagrKHppuv6jTAjE9v8W7VRCYdD5
 JlmeVRjw8Zl4ALVzJINXlejymzZmNz3D3ajFkTm4AkHh/F0yq1hOPGY4Jr7s8hj/
 vioK2i3GWxfbN5sUZkKxKT3BCAGkAoNZMGsXHjURhIIvJ8Yrjp4DtwLdcLn6btgr
 KyVlUGteD4TLK4Uib+tQKmYpv/6uGa6LFSIEoYhcq2URvJsCzLOvXdpdYtj/90jA
 LezVX2Csu9uilYmXSqkNeTn3kGBEJpHlbI4N8oQ6stBBllpiwsOOSxoGQiiARbeO
 Af3GjzFG71aEKkF5ktBijpecdGZys/bpTwA1AELY8C3h9ekzBg8LtEigCyXRurNF
 Pnpj2JJvkG4q5moH+DQmQC4109NeZ+7ysnlZEoPyRFx9oUQu6ng=
 =t80+
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of github.com:openrisc/linux

Pull OpenRISC updates from Stafford Horne:
 "In this cycle we add PCI support to OpenRISC used in our new QEMU virt
  platform.

  The main updates from me include:

   - Kconfig updates to support OpenRISC PCI (just config now after the
     PCI cleanups I did on Bjorn's branch)

   - A new defconfig for the qemu virt platform.

   - Also there is one MAINTAINERS update. As I was working on the PCI
     series we kept getting bounces from Richard's old email address. I
     added this here; I am not sure how these are usually handled when
     the maintainer doesn't queue it themselves"

* tag 'for-linus' of github.com:openrisc/linux:
  openrisc: io: Define iounmap argument as volatile
  MAINTAINERS: Update Richard Henderson's address
  openrisc: Add virt defconfig
  openrisc: Add pci bus support
2022-08-05 13:59:38 -07:00
Linus Torvalds
9e2f402336 - SGX2 ISA support which makes enclave memory management much more
dynamic.  For instance, enclaves can now change enclave page
    permissions on the fly.
  - Removal of an unused structure member
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmLq2M8ACgkQaDWVMHDJ
 krCbAw/+J4nHXxZNMQQX1c8CYJ7XHIr+YtsqNFYwH58rJJstHO/YwQf+mesVOeeu
 08BYn+T5cdAbShKcxdkowPB17S6w/WzACtUfVhaoRQC7Md40cBiyc45UiC2e1u9g
 W3Osk5+fTVcSYA9WiizPntIQkjVs9e7hcNKjTyVPnSw8W8mFCLg+ZiPb7YvKERTO
 o8Wi2+zzX1BGDNOyBEqvnstz9uXDbCbFUTYX6zToBUk+Y1ZPXHwuHgNTtrAqGYaL
 qyi0O2zoWnfOUmplzjJ/1aPmzPJDPgDNImC+gjTpYXGmg05Ryds+VZAc64IIjqYn
 K+/5674PZFdsp5/YfctubdsQm0l0xen94sccAacd7KfsVurcHs3E2bdQPDw0htxv
 svCX0Sai/qv52tPNzw+n9EJRcQsiwd9Pn0rWwx2i8hQcgMFiwCus6DBKhU7uh2Jp
 oTwlspqJy2NHu9bici78tmsOio9CORjrh1WOfWX+yHEux4dtQAl889Gw5qzId6V1
 Bh1MgoAu/pQ78feo96f3h5yOultOtpbTGyXEC8t4MTSpIVgZ2NzfUxe4RhOCBnhA
 kdftVNfZLGOzwBbgFy0gYTe/ukt1DkP4BNHQilf2I+bUP/kZFlN8wfxBipWzr0bs
 Skrz4+brBIaTdGoFgzhgt3g5YH16DSasmy/HCkIeV7eaAHFRLoE=
 =Y7YA
 -----END PGP SIGNATURE-----

Merge tag 'x86_sgx_for_v6.0-2022-08-03.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 SGX updates from Dave Hansen:
 "A set of x86/sgx changes focused on implementing the "SGX2" features,
  plus a minor cleanup:

   - SGX2 ISA support which makes enclave memory management much more
     dynamic. For instance, enclaves can now change enclave page
     permissions on the fly.

   - Removal of an unused structure member"

* tag 'x86_sgx_for_v6.0-2022-08-03.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (32 commits)
  x86/sgx: Drop 'page_index' from sgx_backing
  selftests/sgx: Page removal stress test
  selftests/sgx: Test reclaiming of untouched page
  selftests/sgx: Test invalid access to removed enclave page
  selftests/sgx: Test faulty enclave behavior
  selftests/sgx: Test complete changing of page type flow
  selftests/sgx: Introduce TCS initialization enclave operation
  selftests/sgx: Introduce dynamic entry point
  selftests/sgx: Test two different SGX2 EAUG flows
  selftests/sgx: Add test for TCS page permission changes
  selftests/sgx: Add test for EPCM permission changes
  Documentation/x86: Introduce enclave runtime management section
  x86/sgx: Free up EPC pages directly to support large page ranges
  x86/sgx: Support complete page removal
  x86/sgx: Support modifying SGX page type
  x86/sgx: Tighten accessible memory range after enclave initialization
  x86/sgx: Support adding of pages to an initialized enclave
  x86/sgx: Support restricting of enclave page permissions
  x86/sgx: Support VA page allocation without reclaiming
  x86/sgx: Export sgx_encl_page_alloc()
  ...
2022-08-05 10:47:40 -07:00
Linus Torvalds
3bd6e5854b asm-generic: updates for 6.0
There are three independent sets of changes:
 
  - Sai Prakash Ranjan adds tracing support to the asm-generic
    version of the MMIO accessors, which is intended to help
    understand problems with device drivers and has been part
    of Qualcomm's vendor kernels for many years.
 
  - A patch from Sebastian Siewior to rework the handling of
    IRQ stacks in softirqs across architectures, which is
    needed for enabling PREEMPT_RT.
 
  - The last patch to remove the CONFIG_VIRT_TO_BUS option and
    some of the code behind that, after the last users of this
    old interface made it in through the netdev, scsi, media and
    staging trees.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmLqPPEACgkQmmx57+YA
 GNlUbQ/+NpIsiA0JUrCGtySt8KrLHdA2dH9lJOR5/iuxfphscPFfWtpcPvcXQWmt
 a8u7wyI8SHW1ku4U0Y5sO0dBSldDnoIqJ5t4X5d7YNU9yVtEtucqQhZf+GkrPlVD
 1HkRu05B7y0k2BMn7BLhSvkpafs3f1lNGXjs8oFBdOF1/zwp/GjcrfCK7KFzqjwU
 dYrX0SOFlKFd4BZC75VfK+XcKg4LtwIOmJraRRl7alz2Q5Oop2hgjgZxXDPf//vn
 SPOhXJN/97i1FUpY2TkfHVH1NxbPfjCV4pUnjmLG0Y4NSy9UQ/ZcXHcywIdeuhfa
 0LySOIsAqBeccpYYYdg2ubiMDZOXkBfANu/sB9o/EhoHfB4svrbPRDhBIQZMFXJr
 MJYu+IYce2rvydA/nydo4q++pxR8v1ES1ZIo8bDux+q1CI/zbpQV+f98kPVRA0M7
 ajc+5GTIqNIsvHzzadq7eYxcj5Bi8Li2JA9sVkAQ+6iq1TVyeYayMc9eYwONlmqw
 MD+PFYc651pKtXZCfkLXPIKSwS0uPqBndAibuVhpZ0hxWaCBBdKvY9mrWcPxt0kA
 tMR8lrosbbrV2K48BFdWTOHvCs2FhHQxPGVPZ/iWuxTA0hHZ9tUlaEkSX+VM57IU
 KCYQLdWzT8J9vrgqSbgYKlb6pSPz6FIjTfut6NZMmshIbavHV/Q=
 =aTR0
 -----END PGP SIGNATURE-----

Merge tag 'asm-generic-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull asm-generic updates from Arnd Bergmann:
 "There are three independent sets of changes:

   - Sai Prakash Ranjan adds tracing support to the asm-generic version
     of the MMIO accessors, which is intended to help understand
     problems with device drivers and has been part of Qualcomm's vendor
     kernels for many years

   - A patch from Sebastian Siewior to rework the handling of IRQ stacks
     in softirqs across architectures, which is needed for enabling
     PREEMPT_RT

   - The last patch to remove the CONFIG_VIRT_TO_BUS option and some of
     the code behind that, after the last users of this old interface
     made it in through the netdev, scsi, media and staging trees"

* tag 'asm-generic-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  uapi: asm-generic: fcntl: Fix typo 'the the' in comment
  arch/*/: remove CONFIG_VIRT_TO_BUS
  soc: qcom: geni: Disable MMIO tracing for GENI SE
  serial: qcom_geni_serial: Disable MMIO tracing for geni serial
  asm-generic/io: Add logging support for MMIO accessors
  KVM: arm64: Add a flag to disable MMIO trace for nVHE KVM
  lib: Add register read/write tracing support
  drm/meson: Fix overflow implicit truncation warnings
  irqchip/tegra: Fix overflow implicit truncation warnings
  coresight: etm4x: Use asm-generic IO memory barriers
  arm64: io: Use asm-generic high level MMIO accessors
  arch/*: Disable softirq stacks on PREEMPT_RT.
2022-08-05 10:07:23 -07:00
Linus Torvalds
fad235ed43 ARM: SoC: late updates for 6.0
These updates came in after I had already tagged the branches,
 but they still seem appropriate for 6.0 and most of them were
 part of linux-next through other trees.
 
  - The reset controller tree adds one new driver for the TI TPS380x
    power management chip and a few minor changes in other drivers
 
  - Apple M1 now has a DT entry for the NVMe controller after the
    driver was merged, and has a new mailing list in the MAINTAINERS
    file.
 
  - Fixes for USB on the Socionext Uniphier platforms and the
    network controller on Intel Cyclone5.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmLs7esACgkQmmx57+YA
 GNkiTA/7B/8Io3T4sKQ7uB2PEDTU+nYdmzVRZ7vnBSukFA7RGJ7YXFBxjJmEA0Fv
 VWt1lGVr8AKcgL3nmFP5D+HSiCdv9g+fZsI/Sm49RRoTzPhI9J2LcsbSiZsRw9M6
 62czssi6JQ2yJdwhJEWMmz5WPOAeO8WYhkck/g4Mq8KZm7Eue+bNNEf7J/EmOD7L
 v8RTikf1xy5P+YJZFnJI95jCNGvLNVK7DxRd1pqsDucVqHiRPj9iK8+E3UtZ2Vsj
 qy57mXpTpuihF9dkn80aLbEda5+wELeuKFnCooG20Exo1AnRyczYDPxQZ5xUqAij
 4T/qSmFmoeKO5NzM7uRLM/o4gKfvR/fqI/MNP9icgN+5tRrDG4oYeH3vpuUdeyAI
 SYGfBFKdwPyqSFUdlP7DHyUCoKy4k7AeoQnpdjCAOMZCmgDT8c/cSVKnhIwNigys
 jLBtmNp14NntoSVc3U/mdo7Ta1OeG/kxGuMGEjPvh2j5hu6oZthzTCHNbFh44u+m
 CgSv9DXVhWKufDYMXs4MvYQYlEZQdVDXk2OyaXuZR8S6ndG04VHk/lTuE/b+nAHI
 A1+0zqTcq9qegnIL8t8HmQhOmcGgeVU7hveWn8qnCUklvIutdzmQB8FwUAoN5tIa
 TLKKkb5cmrMaLbPIauupt9PsQbgfWn1K0fq272zG0GgbC2sODfM=
 =Oxxy
 -----END PGP SIGNATURE-----

Merge tag 'arm-late-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull more ARM SoC updates from Arnd Bergmann:
 "These updates came in after I had already tagged the branches, but
  they still seem appropriate for 6.0 and most of them were part of
  linux-next through other trees.

   - The reset controller tree adds one new driver for the TI TPS380x
     power management chip and a few minor changes in other drivers

   - Apple M1 now has a DT entry for the NVMe controller after the
     driver was merged, and has a new mailing list in the MAINTAINERS
     file.

   - Fixes for USB on the Socionext Uniphier platforms and the network
     controller on Intel Cyclone5"

* tag 'arm-late-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC
  ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC
  arm64: dts: apple: t8103: Add ANS2 NVMe nodes
  reset: tps380x: Fix spelling mistake "Voltags" -> "Voltage"
  reset: tps380x: Add TPS380x device driver supprt
  dt-bindings: reset: Add TPS380x documentation
  dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G2UL USBPHY Control bindings
  ARM: dts: add EMAC AXI settings for Cyclone5
  reset: reset-simple should depends on HAS_IOMEM
  Revert "reset: microchip-sparx5: allow building as a module"
  reset: a10sr: allow building under COMPILE_TEST
  reset: allow building of reset simple driver if expert config selected
  reset: microchip-sparx5: allow building as a module
  arm64: dts: apple: Re-parent ANS2 power domains
  MAINTAINERS: add ARM/APPLE MACHINE mailing list
2022-08-05 10:02:33 -07:00
Linus Torvalds
8db4a0291b parisc architecture fixes and updates for kernel v5.20-rc1:
One real bugfix to change the io_pgetevents_time64() syscall to use the compat
 implementation when running in compat mode, otherwise the signed int32
 parameters min_nr and nr will be incorrectly handled as unsigned int64 values.
 
 Other than that just small cleanups:
 * hardware database housekeeping and proper /proc/iomem output
 * add proper function exit code if probe functions fail
 * drop stale variables (pa_swapper_pg_lock)
 * drop unneccessary zero-initializations
 * typo fixes in comments
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCYu07ZwAKCRD3ErUQojoP
 XxlBAQDqaNvhiTfiyXD14B6DVoW4BK8anI/JFEbzD91oi8zGdAD9FktmLk5BLsY7
 iMc4SCr79IM29AUdcbqC6mK2zNJ2uQA=
 =lshT
 -----END PGP SIGNATURE-----

Merge tag 'for-5.20/parisc-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux

Pull parisc updates from Helge Deller:
 "One real bugfix to change the io_pgetevents_time64() syscall to use
  the compat implementation when running in compat mode, otherwise the
  signed int32 parameters min_nr and nr will be incorrectly handled as
  unsigned int64 values.

  Other than that just small cleanups:

   - hardware database housekeeping and proper /proc/iomem output

   - add proper function exit code if probe functions fail

   - drop stale variables (pa_swapper_pg_lock)

   - drop unneccessary zero-initializations

   - typo fixes in comments"

* tag 'for-5.20/parisc-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  Input: gscps2 - check return value of ioremap() in gscps2_probe()
  parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode
  parisc: Drop zero variable initialisations in mm/init.c
  parisc: Do not initialise statics to 0
  parisc: Check the return value of ioremap() in lba_driver_probe()
  parisc: Drop pa_swapper_pg_lock spinlock
  parisc: Fix comment typo in fault.c
  parisc: Fix device names in /proc/iomem
  parisc: Clean up names in hardware database
2022-08-05 09:58:58 -07:00
Linus Torvalds
98586bd6dc Microblaze patches for 5.20-rc1
- Trivial comment fix
 - Remove HANDLE_DOMAIN_IRQ selection
 -----BEGIN PGP SIGNATURE-----
 
 iF0EABECAB0WIQQbPNTMvXmYlBPRwx7KSWXLKUoMIQUCYuzX9QAKCRDKSWXLKUoM
 IZjdAKCc0n8M64ze3KdL+Qm4i6oML7a0aACgkXIME7uysGmz2v4dtcdJzG7mp9Y=
 =nvpM
 -----END PGP SIGNATURE-----

Merge tag 'microblaze-v5.20' of git://git.monstr.eu/linux-2.6-microblaze

Pull microblaze updates from Michal Simek:

 - Trivial comment fix

 - Remove HANDLE_DOMAIN_IRQ selection

* tag 'microblaze-v5.20' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: Fix some typos in comment
  arch: microblaze: Remove unused "select HANDLE_DOMAIN_IRQ"
2022-08-05 09:56:51 -07:00
Linus Torvalds
a1b02751d6 Sane printk changes for 5.20
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmLrn3IACgkQUqAMR0iA
 lPK7pBAAkcfykKgtRxvE65q06GsClGJMVM6wDe0iG0m71gRItz46Yly5HbuwaAwx
 6DEQOlMnndjr8syznl/SoiIiAQcDGjzG8ZVcYw6JH4um03mk6uQw6YuKwxO8kieC
 2/ZdFOVsHfui6lVXGxizi8UzT+oemXax5JsukOD5MsEOPAv+rw6vg5hrSiIFoQaO
 /nU8BeulfuZrnhz47xiNNxQWi7J3F0JVF4NlwK+avOhVw7kUgZcmsojQHopvQOxU
 e2HuByZ/9TkbNoQX/0ZX8aZ75XbebCfX9o39J4bLAUe4eqzOHDTEKg29BoXogSk4
 NVjNVuVljmwcExox70Esst8Ckir2/DE7I5nKZ0/G+9JNoHKoHaG3rkZ3hqf5Q/Vh
 eahwRxab/NguUAZawk3NWpZ6B6dql8H6G+UhG0nsSTbUCLy5o02ynfai52TIhzb1
 EPFVRSBWefiPHFtC86yyXE/3iZvgpJk72jXoVLEvBXHAGxkAD3UbaV+5PgYgFwNh
 TZO9u7tEe6Z67Cs3GZ7YfYPraULh5JmRkFgZMs04ycBRO9oQWdlaaR/UzZJ/P1TF
 IY8sYXDBFLeXGtDB65UMPlHymDm3Bcu0C7YSPa1rxuqlmsmDvYY/nxnDC/TOPYnp
 /jeRuoZ2IpuUL2XIHmIZQ6v8mYTetFkQMqC9qxZSCw3wqjW6Mwk=
 =PJYM
 -----END PGP SIGNATURE-----

Merge tag 'printk-for-5.20-sane' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux

Pull printk updates from Petr Mladek:

 - Allow reading kernel log in gdb even on 32 bits systems

 - More granular check of the buffer usage in printf selftest

 - Clang warning fix

* tag 'printk-for-5.20-sane' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  lib/test_printf.c: fix clang -Wformat warnings
  scripts/gdb: fix 'lx-dmesg' on 32 bits arch
  lib/test_printf.c: split write-beyond-buffer check in two
2022-08-05 09:54:36 -07:00
Zheyu Ma
6ba592fa01 video: fbdev: s3fb: Check the size of screen before memset_io()
In the function s3fb_set_par(), the value of 'screen_size' is
calculated by the user input. If the user provides the improper value,
the value of 'screen_size' may larger than 'info->screen_size', which
may cause the following bug:

[   54.083733] BUG: unable to handle page fault for address: ffffc90003000000
[   54.083742] #PF: supervisor write access in kernel mode
[   54.083744] #PF: error_code(0x0002) - not-present page
[   54.083760] RIP: 0010:memset_orig+0x33/0xb0
[   54.083782] Call Trace:
[   54.083788]  s3fb_set_par+0x1ec6/0x4040
[   54.083806]  fb_set_var+0x604/0xeb0
[   54.083836]  do_fb_ioctl+0x234/0x670

Fix the this by checking the value of 'screen_size' before memset_io().

Fixes: a268422de8 ("fbdev driver for S3 Trio/Virge")
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-08-05 18:44:59 +02:00
Zheyu Ma
96b550971c video: fbdev: arkfb: Check the size of screen before memset_io()
In the function arkfb_set_par(), the value of 'screen_size' is
calculated by the user input. If the user provides the improper value,
the value of 'screen_size' may larger than 'info->screen_size', which
may cause the following bug:

[  659.399066] BUG: unable to handle page fault for address: ffffc90003000000
[  659.399077] #PF: supervisor write access in kernel mode
[  659.399079] #PF: error_code(0x0002) - not-present page
[  659.399094] RIP: 0010:memset_orig+0x33/0xb0
[  659.399116] Call Trace:
[  659.399122]  arkfb_set_par+0x143f/0x24c0
[  659.399130]  fb_set_var+0x604/0xeb0
[  659.399161]  do_fb_ioctl+0x234/0x670
[  659.399189]  fb_ioctl+0xdd/0x130

Fix the this by checking the value of 'screen_size' before memset_io().

Fixes: 681e14730c ("arkfb: new framebuffer driver for ARK Logic cards")
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-08-05 18:44:15 +02:00
Zheyu Ma
ec0754c602 video: fbdev: vt8623fb: Check the size of screen before memset_io()
In the function vt8623fb_set_par(), the value of 'screen_size' is
calculated by the user input. If the user provides the improper value,
the value of 'screen_size' may larger than 'info->screen_size', which
may cause the following bug:

[  583.339036] BUG: unable to handle page fault for address: ffffc90005000000
[  583.339049] #PF: supervisor write access in kernel mode
[  583.339052] #PF: error_code(0x0002) - not-present page
[  583.339074] RIP: 0010:memset_orig+0x33/0xb0
[  583.339110] Call Trace:
[  583.339118]  vt8623fb_set_par+0x11cd/0x21e0
[  583.339146]  fb_set_var+0x604/0xeb0
[  583.339181]  do_fb_ioctl+0x234/0x670
[  583.339209]  fb_ioctl+0xdd/0x130

Fix the this by checking the value of 'screen_size' before memset_io().

Fixes: 558b7bd86c ("vt8623fb: new framebuffer driver for VIA VT8623")
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-08-05 18:44:14 +02:00
Jiri Olsa
62d468e5e1 bpf: Cleanup ftrace hash in bpf_trampoline_put
We need to release possible hash from trampoline fops object
before removing it, otherwise we leak it.

Fixes: 00963a2e75 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20220802135651.1794015-1-jolsa@kernel.org
2022-08-05 09:43:58 -07:00
Linus Torvalds
965a9d75e3 Tracing updates for 5.20 / 6.0
- Runtime verification infrastructure
   This is the biggest change for this pull request. It introduces the
   runtime verification that is necessary for running Linux on safety
   critical systems. It allows for deterministic automata models to be
   inserted into the kernel that will attach to tracepoints, where the
   information on these tracepoints will move the model from state to state.
   If a state is encountered that does not belong to the model, it will then
   activate a given reactor, that could just inform the user or even panic
   the kernel (for which safety critical systems will detect and can recover
   from).
 
 - Two monitor models are also added: Wakeup In Preemptive (WIP - not to be
   confused with "work in progress"), and Wakeup While Not Running (WWNR).
 
 - Added __vstring() helper to the TRACE_EVENT() macro to replace several
   vsnprintf() usages that were all doing it wrong.
 
 - eprobes now can have their event autogenerated when the event name is left
   off.
 
 - The rest is various cleanups and fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCYu0yzRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qj4HAP4tQtV55rjj4DQ5XIXmtI3/64PmyRSJ
 +y4DEXi1UvEUCQD/QAuQfWoT/7gh35ltkfeS4t3ockzy14rrkP5drZigiQA=
 =kEtM
 -----END PGP SIGNATURE-----

Merge tag 'trace-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull tracing updates from Steven Rostedt:

 - Runtime verification infrastructure

   This is the biggest change here. It introduces the runtime
   verification that is necessary for running Linux on safety critical
   systems.

   It allows for deterministic automata models to be inserted into the
   kernel that will attach to tracepoints, where the information on
   these tracepoints will move the model from state to state.

   If a state is encountered that does not belong to the model, it will
   then activate a given reactor, that could just inform the user or
   even panic the kernel (for which safety critical systems will detect
   and can recover from).

 - Two monitor models are also added: Wakeup In Preemptive (WIP - not to
   be confused with "work in progress"), and Wakeup While Not Running
   (WWNR).

 - Added __vstring() helper to the TRACE_EVENT() macro to replace
   several vsnprintf() usages that were all doing it wrong.

 - eprobes now can have their event autogenerated when the event name is
   left off.

 - The rest is various cleanups and fixes.

* tag 'trace-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (50 commits)
  rv: Unlock on error path in rv_unregister_reactor()
  tracing: Use alignof__(struct {type b;}) instead of offsetof()
  tracing/eprobe: Show syntax error logs in error_log file
  scripts/tracing: Fix typo 'the the' in comment
  tracepoints: It is CONFIG_TRACEPOINTS not CONFIG_TRACEPOINT
  tracing: Use free_trace_buffer() in allocate_trace_buffers()
  tracing: Use a struct alignof to determine trace event field alignment
  rv/reactor: Add the panic reactor
  rv/reactor: Add the printk reactor
  rv/monitor: Add the wwnr monitor
  rv/monitor: Add the wip monitor
  rv/monitor: Add the wip monitor skeleton created by dot2k
  Documentation/rv: Add deterministic automata instrumentation documentation
  Documentation/rv: Add deterministic automata monitor synthesis documentation
  tools/rv: Add dot2k
  Documentation/rv: Add deterministic automaton documentation
  tools/rv: Add dot2c
  Documentation/rv: Add a basic documentation
  rv/include: Add instrumentation helper functions
  rv/include: Add deterministic automata monitor definition via C macros
  ...
2022-08-05 09:41:12 -07:00
Andreas Gruenbacher
446279168e Merge part of branch 'for-next.instantiate' into for-next 2022-08-05 18:37:03 +02:00
Linus Torvalds
29b1d469f3 Real Time Analysis Tool updates for 5.20 / 6.0
Changes to RTLA:
 
  - Fix a double free
 
  - Define syscall numbers for RISCV
 
  - Fix Makefile when called from -C tools
 
  - Use calloc() to check for memory allocation failures
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCYuqJ+RQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qiicAQDXrtf1iZrtDMscgqNEUB5pbRmbL387
 R8aWnoexYJ1+KAD/Q7cFFUIDLjsKNZiLT1AgfCPY6c0llKL7kaYQYBWbBwY=
 =3bf4
 -----END PGP SIGNATURE-----

Merge tag 'trace-rtla-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull real time analysis tool (rtla) updates from Steven Rostedt:

 - Fix a double free

 - Define syscall numbers for RISCV

 - Fix Makefile when called from -C tools

 - Use calloc() to check for memory allocation failures

* tag 'trace-rtla-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  rtla: Define syscall numbers for riscv
  rtla: Fix double free
  rtla: Fix Makefile when called from -C tools/
  rtla/utils: Use calloc and check the potential memory allocation failure
2022-08-05 09:35:46 -07:00
Steve French
0d168a58fc cifs: update internal module number
To 2.38

Signed-off-by: Steve French <stfrench@microsoft.com>
2022-08-05 11:24:17 -05:00
Steve French
ea75a78c07 cifs: alloc_mid function should be marked as static
It is only used in transport.c.

Signed-off-by: Steve French <stfrench@microsoft.com>
2022-08-05 11:24:12 -05:00
Enzo Matsumiya
f5fd3f2889 cifs: remove "cifs_" prefix from init/destroy mids functions
Rename generic mid functions to same style, i.e. without "cifs_"
prefix.

cifs_{init,destroy}_mids() -> {init,destroy}_mids()

Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-08-05 11:24:08 -05:00
Enzo Matsumiya
70f08f914a cifs: remove useless DeleteMidQEntry()
DeleteMidQEntry() was just a proxy for cifs_mid_q_entry_release().

- remove DeleteMidQEntry()
- rename cifs_mid_q_entry_release() to release_mid()
- rename kref_put() callback _cifs_mid_q_entry_release to __release_mid
- rename AllocMidQEntry() to alloc_mid()
- rename cifs_delete_mid() to delete_mid()

Update callers to use new names.

Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-08-05 11:24:06 -05:00
Steve French
fb157ed226 cifs: when insecure legacy is disabled shrink amount of SMB1 code
Currently much of the smb1 code is built even when
CONFIG_CIFS_ALLOW_INSECURE_LEGACY is disabled.

Move cifssmb.c to only be compiled when insecure legacy is disabled,
and move various SMB1/CIFS helper functions to that ifdef.  Some
functions that were not SMB1/CIFS specific needed to be moved out of
cifssmb.c

This shrinks cifs.ko by more than 10% which is good - but also will
help with the eventual movement of the legacy code to a distinct
module.  Follow on patches can shrink the number of ifdefs by
code restructuring where smb1 code is wedged in functions that
should be calling dialect specific helper functions instead,
and also by moving some functions from file.c/dir.c/inode.c into
smb1 specific c files.

Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-08-05 11:24:03 -05:00
Dan Williams
2901c8bded cxl/region: Fix decoder interleave programming
Jonathan notes:

"Curiously interleave ways = 1 for the EPs which is obviously wrong"

...while testing the latest CXL development branch on QEMU.

It turns out the region creation process failed to program the endpoint
decoders. This was missed because the default settings of x1 at 4K
intereleave still results in the region appearing to function. Jonathan
caught the bug by reverse mapping the translations that need to happen
for the QEMU support.

Link: https://lore.kernel.org/r/62e95fdf9f6e2_30440294e4@dwillia2-xfh.jf.intel.com.notmuch
Fixes: 384e624bb2 ("cxl/region: Attach endpoint decoders")
Reported-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/165951146336.967013.11160153960900111443.stgit@dwillia2-xfh.jf.intel.com
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:19 -07:00
Bagas Sanjaya
8732947b75 Documentation: cxl: remove dangling kernel-doc reference
Sphinx reported kernel-doc failure warning, pointing to non-existent
drivers/cxl/region.h (which doesn't also exist throughout repo history):

WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 2.4.4 -no-doc-sections ./drivers/cxl/region.h' failed with return code 1

Above cause error message to be displayed on htmldocs output.

Delete the reference.

Fixes: 779dd20cfb ("cxl/region: Add region creation support")
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/20220804075448.98241-4-bagasdotme@gmail.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:02 -07:00
Bagas Sanjaya
038e6eb803 cxl/region: describe targets and nr_targets members of cxl_region_params
Sphinx reported undescribed parameters in cxl_region_params struct:

./drivers/cxl/cxl.h:376: warning: Function parameter or member 'targets' not described in 'cxl_region_params'
./drivers/cxl/cxl.h:376: warning: Function parameter or member 'nr_targets' not described in 'cxl_region_params'

Describe these members.

Fixes: b9686e8c8e ("cxl/region: Enable the assignment of endpoint decoders to regions")
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/20220804075448.98241-3-bagasdotme@gmail.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:02 -07:00
Bagas Sanjaya
f13da0d9c3 cxl/regions: add padding for cxl_rr_ep_add nested lists
Sphinx reported indentation warnings:

Documentation/driver-api/cxl/memory-devices:457: ./drivers/cxl/core/region.c:732: WARNING: Unexpected indentation.
Documentation/driver-api/cxl/memory-devices:457: ./drivers/cxl/core/region.c:733: WARNING: Block quote ends without a blank line; unexpected unindent.
Documentation/driver-api/cxl/memory-devices:457: ./drivers/cxl/core/region.c:735: WARNING: Unexpected indentation.

These warnings above are due to missing blank line padding in the nested list
in kernel-doc comment for cxl_rr_ep_add().

Add the paddings to fix the warnings.

Fixes: 384e624bb2 ("cxl/region: Attach endpoint decoders")
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/20220804075448.98241-2-bagasdotme@gmail.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:02 -07:00
Dan Carpenter
9fd2cf4d6f cxl/region: Fix IS_ERR() vs NULL check
The nvdimm_pmem_region_create() function returns NULL on error.  It does
not return error pointers.

Fixes: 04ad63f086 ("cxl/region: Introduce cxl_pmem_region objects")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/Yuo65lq2WtfdGJ0X@kili
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:02 -07:00
Dan Williams
e29a8995d6 cxl/region: Fix region reference target accounting
Dan reports:

    The error handling in cxl_port_attach_region() looks like it might
    have a similar bug.  The cxl_rr->nr_targets++; might want a --.

    That function is more complicated.

Indeed cxl_rr->nr_targets leaks when cxl_rr_ep_add() fails, but that
flow is not clear. Fix the bug and the clarity by separating the 'new'
region-reference case from the 'extend' region-reference case. This also
moves the host-physical-address (HPA) validation, that the HPA of a new
region being accounted to the port is greater than the HPA of all other
regions associated with the port, to alloc_region_ref().

Introduce @nr_targets_inc to track when the error exit path needs to
clean up cxl_rr->nr_targets.

Fixes: 384e624bb2 ("cxl/region: Attach endpoint decoders")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Link: http://lore.kernel.org/r/165939482134.252363.1915691883146696327.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:02 -07:00
Dan Williams
69c9961387 cxl/region: Fix region commit uninitialized variable warning
0day robot reports:

drivers/cxl/core/region.c:196 cxl_region_decode_commit() error: uninitialized symbol 'rc'.

The re-checking of loop termination conditions to determine "success"
makes it hard to see that @rc is initialized in all cases. Remove those
to make it explicit that @rc reflects a commit error and that the rest
of logic is concerned with unwinding committed decoders.

This change potentially results in cxl_region_decode_reset() being
called with @count == 0 where it was not called before, but
cxl_region_decode_reset() treats that as a nop.

Fixes: 176baefb2e ("cxl/hdm: Commit decoder state to hardware")
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: http://lore.kernel.org/r/165951148105.967013.14191992449932268431.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:02 -07:00
Dan Williams
8d42854257 cxl/region: Fix port setup uninitialized variable warnings
0day robot reports:

drivers/cxl/core/region.c:1068 cxl_port_setup_targets() error: uninitialized symbol 'eiw'.
drivers/cxl/core/region.c:1068 cxl_port_setup_targets() error: uninitialized symbol 'peig'.
drivers/cxl/core/region.c:1068 cxl_port_setup_targets() error: uninitialized symbol 'peiw'.

...which are all valid reports. Add debug statement to consume the,
albeit unexpected, errors.

Fixes: 27b3f8d138 ("cxl/region: Program target lists")
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/165951147487.967013.929590444907251028.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2022-08-05 08:41:02 -07:00
Dylan Yudaken
d1f6222c49 io_uring: fix io_recvmsg_prep_multishot sparse warnings
Fix casts missing the __user parts. This seemed to only cause errors on
the alpha build, or if checked with sparse, but it was definitely an
oversight.

Reported-by: kernel test robot <lkp@intel.com>
Fixes: 9bb66906f2 ("io_uring: support multishot in recvmsg")
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220805115450.3921352-1-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-08-05 08:41:18 -06:00
Colin Ian King
666d3b612f ALSA: ice1712: remove redundant assignment to new
The variable new is initialized with a value but it is never read. It is
being re-assigned a new value in every case path in the following switch
statement. The assignment is redundant and can be removed.

Cleans up clang scan build warning:
sound/pci/ice1712/quartet.c:569:8: warning: Although the value stored
to 'new' is used in the enclosing expression, the value is never actually
read from 'new' [deadcode.DeadStores]

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://lore.kernel.org/r/20220805120439.2341600-1-colin.i.king@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-08-05 15:06:36 +02:00
Fengnan Chang
01fc4b9a6e f2fs: use onstack pages instead of pvec
Since pvec have 15 pages, it not a multiple of 4, when write compressed
pages, write in 64K as a unit, it will call pagevec_lookup_range_tag
agagin, sometimes this will take a lot of time.
Use onstack pages instead of pvec to mitigate this problem.

Signed-off-by: Fengnan Chang <fengnanchang@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:20:55 -07:00
Fengnan Chang
4f8219f8aa f2fs: intorduce f2fs_all_cluster_page_ready
When write total cluster, all pages is uptodate, there is not need to call
f2fs_prepare_compress_overwrite, intorduce f2fs_all_cluster_page_ready
to avoid this.

Signed-off-by: Fengnan Chang <changfengnan@vivo.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:20:28 -07:00
Chao Yu
e53f864347 f2fs: clean up f2fs_abort_atomic_write()
f2fs_abort_atomic_write() has checked whether current inode is
atomic_write one or not, it's redundant to check in its caller,
remove it for cleanup.

Signed-off-by: Chao Yu <chao.yu@oppo.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:20:02 -07:00
Daeho Jeong
bff139b49d f2fs: handle decompress only post processing in softirq
Now decompression is being handled in workqueue and it makes read I/O
latency non-deterministic, because of the non-deterministic scheduling
nature of workqueues. So, I made it handled in softirq context only if
possible, not in low memory devices, since this modification will
maintain decompresion related memory a little longer.

Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:18:31 -07:00
Jaewook Kim
90be48bd9d f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED
If a file has FI_COMPRESS_RELEASED, all writes for it should not be
allowed. However, as of now, in case of compress_mode=user, writes
triggered by IOCTLs like F2FS_IOC_DE/COMPRESS_FILE are allowed unexpectly,
which could crash that file.
To fix it, let's do not allow F2FS_IOC_DE/COMPRESS_IOCTL if a file already
has FI_COMPRESS_RELEASED flag.

This is the reproduction process:
1.  $ touch ./file
2.  $ chattr +c ./file
3.  $ dd if=/dev/random of=./file bs=4096 count=30 conv=notrunc
4.  $ dd if=/dev/zero of=./file bs=4096 count=34 seek=30 conv=notrunc
5.  $ sync
6.  $ do_compress ./file      ; call F2FS_IOC_COMPRESS_FILE
7.  $ get_compr_blocks ./file ; call F2FS_IOC_GET_COMPRESS_BLOCKS
8.  $ release ./file          ; call F2FS_IOC_RELEASE_COMPRESS_BLOCKS
9.  $ do_compress ./file      ; call F2FS_IOC_COMPRESS_FILE again
10. $ get_compr_blocks ./file ; call F2FS_IOC_GET_COMPRESS_BLOCKS again

This reproduction process is tested in 128kb cluster size.
You can find compr_blocks has a negative value.

Fixes: 5fdb322ff2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE")

Signed-off-by: Junbeom Yeom <junbeom.yeom@samsung.com>
Signed-off-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Youngjin Gil <youngjin.gil@samsung.com>
Signed-off-by: Jaewook Kim <jw5454.kim@samsung.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:18:08 -07:00
Jaegeuk Kim
912f0d6580 f2fs: do not set compression bit if kernel doesn't support
If kernel doesn't have CONFIG_F2FS_FS_COMPRESSION, a file having FS_COMPR_FL via
ioctl(FS_IOC_SETFLAGS) is unaccessible due to f2fs_is_compress_backend_ready().
Let's avoid it.

Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:18:08 -07:00
Eunhee Rho
dbf8e63f48 f2fs: remove device type check for direct IO
To ensure serialized IOs, f2fs allows only LFS mode for zoned
device. Remove redundant check for direct IO.

Signed-off-by: Eunhee Rho <eunhee83.rho@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:18:08 -07:00
Ye Bin
4a2c5b7994 f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data
There is issue as follows when test f2fs atomic write:
F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
F2FS-fs (loop0): invalid crc_offset: 0
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix.
==================================================================
BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0
Read of size 8 at addr 0000000000000028 by task rep/1990

CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266
Call Trace:
 <TASK>
 dump_stack_lvl+0x6e/0x91
 print_report.cold+0x49a/0x6bb
 kasan_report+0xa8/0x130
 f2fs_get_dnode_of_data+0xac/0x16d0
 f2fs_do_write_data_page+0x2a5/0x1030
 move_data_page+0x3c5/0xdf0
 do_garbage_collect+0x2015/0x36c0
 f2fs_gc+0x554/0x1d30
 f2fs_balance_fs+0x7f5/0xda0
 f2fs_write_single_data_page+0xb66/0xdc0
 f2fs_write_cache_pages+0x716/0x1420
 f2fs_write_data_pages+0x84f/0x9a0
 do_writepages+0x130/0x3a0
 filemap_fdatawrite_wbc+0x87/0xa0
 file_write_and_wait_range+0x157/0x1c0
 f2fs_do_sync_file+0x206/0x12d0
 f2fs_sync_file+0x99/0xc0
 vfs_fsync_range+0x75/0x140
 f2fs_file_write_iter+0xd7b/0x1850
 vfs_write+0x645/0x780
 ksys_write+0xf1/0x1e0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

As 3db1de0e58 commit changed atomic write way which new a cow_inode for
atomic write file, and also mark cow_inode as FI_ATOMIC_FILE.
When f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode
which is NULL. Then will trigger null-ptr-deref.
To solve above issue, introduce FI_COW_FILE flag for COW inode.

Fiexes: 3db1de0e582c("f2fs: change the current atomic write way")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:18:08 -07:00
Daeho Jeong
23339e5752 f2fs: revive F2FS_IOC_ABORT_VOLATILE_WRITE
F2FS_IOC_ABORT_VOLATILE_WRITE was used to abort a atomic write before.
However it was removed accidentally. So revive it by changing the name,
since volatile write had gone.

Signed-off-by: Daeho Jeong <daehojeong@google.com>
Fiexes: 7bc155fec5b3("f2fs: kill volatile write support")
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-08-05 04:17:57 -07:00
Arnd Bergmann
1630eee2d4
Merge branch 'arm/fixes' into arm/late
Two bugfixes that came in to update the MAINTAINERS file
and fix an issue with USB on the uniphier platform.

* arm/fixes:
  arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC
  ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC
  MAINTAINERS: add ARM/APPLE MACHINE mailing list
2022-08-05 11:33:33 +02:00
Cezar Bulinaru
2e64fe4624 selftests: add few test cases for tap driver
Few test cases related to the fix for 924a9bc362a5:
"net: check if protocol extracted by virtio_net_hdr_set_proto is correct"

Need test for the case when a non-standard packet (GSO without NEEDS_CSUM)
sent to the tap device causes a BUG check in the tap driver.

Signed-off-by: Cezar Bulinaru <cbulinaru@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-08-05 08:59:15 +01:00
Cezar Bulinaru
4f61f133f3 net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null
Fixes a NULL pointer derefence bug triggered from tap driver.
When tap_get_user calls virtio_net_hdr_to_skb the skb->dev is null
(in tap.c skb->dev is set after the call to virtio_net_hdr_to_skb)
virtio_net_hdr_to_skb calls dev_parse_header_protocol which
needs skb->dev field to be valid.

The line that trigers the bug is in dev_parse_header_protocol
(dev is at offset 0x10 from skb and is stored in RAX register)
  if (!dev->header_ops || !dev->header_ops->parse_protocol)
  22e1:   mov    0x10(%rbx),%rax
  22e5:	  mov    0x230(%rax),%rax

Setting skb->dev before the call in tap.c fixes the issue.

BUG: kernel NULL pointer dereference, address: 0000000000000230
RIP: 0010:virtio_net_hdr_to_skb.constprop.0+0x335/0x410 [tap]
Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb b7 48 8b 43 10 <48> 8b 80 30 02 00 00 48 85 c0 74 55 48 8b 40 28 48 85 c0 74 4c 48
RSP: 0018:ffffc90005c27c38 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888298f25300 RCX: 0000000000000010
RDX: 0000000000000005 RSI: ffffc90005c27cb6 RDI: ffff888298f25300
RBP: ffffc90005c27c80 R08: 00000000ffffffea R09: 00000000000007e8
R10: ffff88858ec77458 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000014 R14: ffffc90005c27e08 R15: ffffc90005c27cb6
FS:  0000000000000000(0000) GS:ffff88858ec40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000230 CR3: 0000000281408006 CR4: 00000000003706e0
Call Trace:
 tap_get_user+0x3f1/0x540 [tap]
 tap_sendmsg+0x56/0x362 [tap]
 ? get_tx_bufs+0xc2/0x1e0 [vhost_net]
 handle_tx_copy+0x114/0x670 [vhost_net]
 handle_tx+0xb0/0xe0 [vhost_net]
 handle_tx_kick+0x15/0x20 [vhost_net]
 vhost_worker+0x7b/0xc0 [vhost]
 ? vhost_vring_call_reset+0x40/0x40 [vhost]
 kthread+0xfa/0x120
 ? kthread_complete_and_exit+0x20/0x20
 ret_from_fork+0x1f/0x30

Fixes: 924a9bc362 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
Signed-off-by: Cezar Bulinaru <cbulinaru@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-08-05 08:56:35 +01:00
Meng Tang
f882c4bef9 ALSA: hda/realtek: Add quirk for another Asus K42JZ model
There is another Asus K42JZ model with the PCI SSID 1043:1313
that requires the quirk ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE.
Add the corresponding entry to the quirk table.

Signed-off-by: Meng Tang <tangmeng@uniontech.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220805074534.20003-1-tangmeng@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-08-05 09:54:16 +02:00
David S. Miller
9f05f9ade2 Merge branch 'mptcp-fixes'
Mat Martineau says:

====================
mptcp: Fixes for mptcp cleanup/close and a selftest

Patch 1 fixes an issue with leaking subflow sockets if there's a failure
in a CGROUP_INET_SOCK_CREATE eBPF program.

Patch 2 fixes a syzkaller-detected race at MPTCP socket close.

Patch 3 is a fix for one mode of the mptcp_connect.sh selftest.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2022-08-05 08:51:29 +01:00
Florian Westphal
df9e03aec3 selftests: mptcp: make sendfile selftest work
When the selftest got added, sendfile() on mptcp sockets returned
-EOPNOTSUPP, so running 'mptcp_connect.sh -m sendfile' failed
immediately.

This is no longer the case, but the script fails anyway due to timeout.
Let the receiver know once the sender has sent all data, just like
with '-m mmap' mode.

v2: need to respect cfg_wait too, as pm_userspace.sh relied
on -m sendfile to keep the connection open (Mat Martineau)

Fixes: 048d19d444 ("mptcp: add basic kselftest for mptcp")
Reported-by: Xiumei Mu <xmu@redhat.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-08-05 08:51:29 +01:00
Paolo Abeni
c886d70286 mptcp: do not queue data on closed subflows
Dipanjan reported a syzbot splat at close time:

WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153
inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153
Modules linked in: uio_ivshmem(OE) uio(E)
CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G           OE
5.19.0-rc6-g2eae0556bb9d #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: events mptcp_worker
RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153
Code: 21 02 00 00 41 8b 9c 24 28 02 00 00 e9 07 ff ff ff e8 34 4d 91
f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f> 0b
e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d
RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00
RDX: 0000000000000000 RSI: ffff8881326f3b00 RDI: 0000000000000002
RBP: ffff888179662674 R08: ffffffff87e983a0 R09: 0000000000000000
R10: 0000000000000005 R11: 00000000000004ea R12: ffff888179662400
R13: ffff888179662428 R14: 0000000000000001 R15: ffff88817e38e258
FS:  0000000000000000(0000) GS:ffff8881f5f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007bc0 CR3: 0000000179592000 CR4: 0000000000150ee0
Call Trace:
 <TASK>
 __sk_destruct+0x4f/0x8e0 net/core/sock.c:2067
 sk_destruct+0xbd/0xe0 net/core/sock.c:2112
 __sk_free+0xef/0x3d0 net/core/sock.c:2123
 sk_free+0x78/0xa0 net/core/sock.c:2134
 sock_put include/net/sock.h:1927 [inline]
 __mptcp_close_ssk+0x50f/0x780 net/mptcp/protocol.c:2351
 __mptcp_destroy_sock+0x332/0x760 net/mptcp/protocol.c:2828
 mptcp_worker+0x5d2/0xc90 net/mptcp/protocol.c:2586
 process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289
 worker_thread+0x623/0x1070 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>

The root cause of the problem is that an mptcp-level (re)transmit can
race with mptcp_close() and the packet scheduler checks the subflow
state before acquiring the socket lock: we can try to (re)transmit on
an already closed ssk.

Fix the issue checking again the subflow socket status under the
subflow socket lock protection. Additionally add the missing check
for the fallback-to-tcp case.

Fixes: d5f49190de ("mptcp: allow picking different xmit subflows")
Reported-by: Dipanjan Das <mail.dipanjan.das@gmail.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-08-05 08:51:28 +01:00