1. 03 Sep, 2024 2 commits
  2. 02 Sep, 2024 2 commits
  3. 27 Aug, 2024 2 commits
  4. 26 Aug, 2024 11 commits
  5. 22 Aug, 2024 1 commit
    • Baochen Qiang's avatar
      wifi: ath11k: fix NULL pointer dereference in ath11k_mac_get_eirp_power() · 9abf1999
      Baochen Qiang authored
      Commit 39dc8b8e ("wifi: mac80211: pass parsed TPE data to drivers") breaks
      ath11k, leading to kernel crash:
      
      BUG: kernel NULL pointer dereference, address: 0000000000000018
      RIP: 0010:ath11k_mac_get_eirp_power.isra.0+0x5b/0x80 [ath11k]
      Call Trace:
       <TASK>
       ath11k_mac_fill_reg_tpc_info+0x3d6/0x800 [ath11k]
       ath11k_mac_vdev_start_restart+0x412/0x4d0 [ath11k]
       ath11k_mac_op_sta_state+0x7bc/0xbb0 [ath11k]
       drv_sta_state+0xf1/0x5f0 [mac80211]
       sta_info_insert_rcu+0x28d/0x530 [mac80211]
       sta_info_insert+0xf/0x20 [mac80211]
       ieee80211_prep_connection+0x3b4/0x4c0 [mac80211]
       ieee80211_mgd_auth+0x363/0x600 [mac80211]
      
      The issue scenario is, AP advertises power spectral density (PSD) values in its
      transmit power envelope (TPE) IE and supports 160 MHz bandwidth in 6 GHz. When
      connecting to this AP, in ath11k_mac_parse_tx_pwr_env(), the local variable
      psd is true and then reg_tpc_info.num_pwr_levels is set to 8 due to 160 MHz
      bandwidth. Note here ath11k fails to set reg_tpc_info.is_psd_power as TRUE due
      to above commit. Then in ath11k_mac_fill_reg_tpc_info(), for each of the 8
      power levels, for a PSD channel, ath11k_mac_get_psd_channel() is expected to
      be called to get required information. However due to invalid
      reg_tpc_info.is_psd_power, it is ath11k_mac_get_eirp_power() that gets called
      and passed with pwr_lvl_idx as one of the arguments. Note this function
      implicitly requires pwr_lvl_idx to be no more than 3. So when pwr_lvl_idx is
      larger than that ath11k_mac_get_seg_freq() returns invalid center frequency,
      with which as the input ieee80211_get_channel() returns NULL, then kernel
      crashes due to NULL pointer dereference.
      
      Fix it by setting reg_tpc_info.is_psd_power properly.
      
      Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
      
      Fixes: 39dc8b8e ("wifi: mac80211: pass parsed TPE data to drivers")
      Reported-by: default avatarMikko Tiihonen <mikko.tiihonen@iki.fi>
      Tested-by: default avatarMikko Tiihonen <mikko.tiihonen@iki.fi>
      Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219131Signed-off-by: default avatarBaochen Qiang <quic_bqiang@quicinc.com>
      Acked-by: default avatarJeff Johnson <quic_jjohnson@quicinc.com>
      Signed-off-by: default avatarKalle Valo <quic_kvalo@quicinc.com>
      Link: https://patch.msgid.link/20240813083808.9224-1-quic_bqiang@quicinc.com
      9abf1999
  6. 16 Aug, 2024 1 commit
  7. 13 Aug, 2024 3 commits
  8. 10 Aug, 2024 1 commit
  9. 07 Aug, 2024 1 commit
  10. 05 Aug, 2024 1 commit
    • Baochen Qiang's avatar
      wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850 · 38055789
      Baochen Qiang authored
      In transmit path, it is likely that the iova is not aligned to PCIe TLP
      max payload size, which is 128 for WCN7850. Normally in such cases hardware
      is expected to split the packet into several parts in a manner such that
      they, other than the first one, have aligned iova. However due to hardware
      limitations, WCN7850 does not behave like that properly with some specific
      unaligned iova in transmit path. This easily results in target hang in a
      KPI transmit test: packet send/receive failure, WMI command send timeout
      etc. Also fatal error seen in PCIe level:
      
      	...
      	Capabilities: ...
      		...
      		DevSta: ... FatalErr+ ...
      		...
      	...
      
      Work around this by manually moving/reallocating payload buffer such that
      we can map it to a 128 bytes aligned iova. The moving requires sufficient
      head room or tail room in skb: for the former we can do ourselves a favor
      by asking some extra bytes when registering with mac80211, while for the
      latter we can do nothing.
      
      Moving/reallocating buffer consumes additional CPU cycles, but the good news
      is that an aligned iova increases PCIe efficiency. In my tests on some X86
      platforms the KPI results are almost consistent.
      
      Since this is seen only with WCN7850, add a new hardware parameter to
      differentiate from others.
      
      Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
      Signed-off-by: default avatarBaochen Qiang <quic_bqiang@quicinc.com>
      Cc: <stable@vger.kernel.org>
      Tested-by: default avatarMark Pearson <mpearson-lenovo@squebb.ca>
      Signed-off-by: default avatarKalle Valo <quic_kvalo@quicinc.com>
      Link: https://patch.msgid.link/20240715023814.20242-1-quic_bqiang@quicinc.com
      38055789
  11. 04 Aug, 2024 11 commits
    • Linus Torvalds's avatar
      Linux 6.11-rc2 · de9c2c66
      Linus Torvalds authored
      de9c2c66
    • Tetsuo Handa's avatar
      profiling: remove profile=sleep support · b88f5538
      Tetsuo Handa authored
      The kernel sleep profile is no longer working due to a recursive locking
      bug introduced by commit 42a20f86 ("sched: Add wrapper for get_wchan()
      to keep task blocked")
      
      Booting with the 'profile=sleep' kernel command line option added or
      executing
      
        # echo -n sleep > /sys/kernel/profiling
      
      after boot causes the system to lock up.
      
      Lockdep reports
      
        kthreadd/3 is trying to acquire lock:
        ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: get_wchan+0x32/0x70
      
        but task is already holding lock:
        ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: try_to_wake_up+0x53/0x370
      
      with the call trace being
      
         lock_acquire+0xc8/0x2f0
         get_wchan+0x32/0x70
         __update_stats_enqueue_sleeper+0x151/0x430
         enqueue_entity+0x4b0/0x520
         enqueue_task_fair+0x92/0x6b0
         ttwu_do_activate+0x73/0x140
         try_to_wake_up+0x213/0x370
         swake_up_locked+0x20/0x50
         complete+0x2f/0x40
         kthread+0xfb/0x180
      
      However, since nobody noticed this regression for more than two years,
      let's remove 'profile=sleep' support based on the assumption that nobody
      needs this functionality.
      
      Fixes: 42a20f86 ("sched: Add wrapper for get_wchan() to keep task blocked")
      Cc: stable@vger.kernel.org # v5.16+
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b88f5538
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · a5dbd76a
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
      
       - Prevent a deadlock on cpu_hotplug_lock in the aperf/mperf driver.
      
         A recent change in the ACPI code which consolidated code pathes moved
         the invocation of init_freq_invariance_cppc() to be moved to a CPU
         hotplug handler. The first invocation on AMD CPUs ends up enabling a
         static branch which dead locks because the static branch enable tries
         to acquire cpu_hotplug_lock but that lock is already held write by
         the hotplug machinery.
      
         Use static_branch_enable_cpuslocked() instead and take the hotplug
         lock read for the Intel code path which is invoked from the
         architecture code outside of the CPU hotplug operations.
      
       - Fix the number of reserved bits in the sev_config structure bit field
         so that the bitfield does not exceed 64 bit.
      
       - Add missing Zen5 model numbers
      
       - Fix the alignment assumptions of pti_clone_pgtable() and
         clone_entry_text() on 32-bit:
      
         The code assumes PMD aligned code sections, but on 32-bit the kernel
         entry text is not PMD aligned. So depending on the code size and
         location, which is configuration and compiler dependent, entry text
         can cross a PMD boundary. As the start is not PMD aligned adding PMD
         size to the start address is larger than the end address which
         results in partially mapped entry code for user space. That causes
         endless recursion on the first entry from userspace (usually #PF).
      
         Cure this by aligning the start address in the addition so it ends up
         at the next PMD start address.
      
         clone_entry_text() enforces PMD mapping, but on 32-bit the tail might
         eventually be PTE mapped, which causes a map fail because the PMD for
         the tail is not a large page mapping. Use PTI_LEVEL_KERNEL_IMAGE for
         the clone() invocation which resolves to PTE on 32-bit and PMD on
         64-bit.
      
       - Zero the 8-byte case for get_user() on range check failure on 32-bit
      
         The recend consolidation of the 8-byte get_user() case broke the
         zeroing in the failure case again. Establish it by clearing ECX
         before the range check and not afterwards as that obvioulsy can't be
         reached when the range check fails
      
      * tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
        x86/mm: Fix pti_clone_entry_text() for i386
        x86/mm: Fix pti_clone_pgtable() alignment assumption
        x86/setup: Parse the builtin command line before merging
        x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
        x86/sev: Fix __reserved field in sev_config
        x86/aperfmperf: Fix deadlock on cpu_hotplug_lock
      a5dbd76a
    • Linus Torvalds's avatar
      Merge tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 61ca6c78
      Linus Torvalds authored
      Pull timer fixes from Thomas Gleixner:
       "Two fixes for the timer/clocksource code:
      
         - The recent fix to make the take over of the broadcast timer more
           reliable retrieves a per CPU pointer in preemptible context.
      
           This went unnoticed in testing as some compilers hoist the access
           into the non-preemotible section where the pointer is actually
           used, but obviously compilers can rightfully invoke it where the
           code put it.
      
           Move it into the non-preemptible section right to the actual usage
           side to cure it.
      
         - The clocksource watchdog is supposed to emit a warning when the
           retry count is greater than one and the number of retries reaches
           the limit.
      
           The condition is backwards and warns always when the count is
           greater than one. Fixup the condition to prevent spamming dmesg"
      
      * tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
        tick/broadcast: Move per CPU pointer access into the atomic section
      61ca6c78
    • Linus Torvalds's avatar
      Merge tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 6cc82dc2
      Linus Torvalds authored
      Pull scheduler fixes from Thomas Gleixner:
      
       - When stime is larger than rtime due to accounting imprecision, then
         utime = rtime - stime becomes negative. As this is unsigned math, the
         result becomes a huge positive number.
      
         Cure it by resetting stime to rtime in that case, so utime becomes 0.
      
       - Restore consistent state when sched_cpu_deactivate() fails.
      
         When offlining a CPU fails in sched_cpu_deactivate() after the SMT
         present counter has been decremented, then the function aborts but
         fails to increment the SMT present counter and leaves it imbalanced.
         Consecutive operations cause it to underflow. Add the missing fixup
         for the error path.
      
         For SMT accounting the runqueue needs to marked online again in the
         error exit path to restore consistent state.
      
      * tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate()
        sched/core: Introduce sched_set_rq_on/offline() helper
        sched/smt: Fix unbalance sched_smt_present dec/inc
        sched/smt: Introduce sched_smt_present_inc/dec() helper
        sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
      6cc82dc2
    • Linus Torvalds's avatar
      Merge tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 1ddeb0ef
      Linus Torvalds authored
      Pull x86 perf fixes from Thomas Gleixner:
      
       - Move the smp_processor_id() invocation back into the non-preemtible
         region, so that the result is valid to use
      
       - Add the missing package C2 residency counters for Sierra Forest CPUs
         to make the newly added support actually useful
      
      * tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86: Fix smp_processor_id()-in-preemptible warnings
        perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest
      1ddeb0ef
    • Linus Torvalds's avatar
      Merge tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 953f7764
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "A couple of fixes for interrupt chip drivers:
      
         - Make sure to skip the clear register space in the MBIGEN driver
           when calculating the node register index. Otherwise the clear
           register is clobbered and the wrong node registers are accessed.
      
         - Fix a signed/unsigned confusion in the loongarch CPU driver which
           converts an error code to a huge "valid" interrupt number.
      
         - Convert the mesion GPIO interrupt controller lock to a raw spinlock
           so it works on RT.
      
         - Add a missing static to a internal function in the pic32 EVIC
           driver"
      
      * tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/mbigen: Fix mbigen node address layout
        irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
        irqchip/irq-pic32-evic: Add missing 'static' to internal function
        irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()
      953f7764
    • Linus Torvalds's avatar
      Merge tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 3bc70ad1
      Linus Torvalds authored
      Pull locking fixes from Thomas Gleixner:
       "Two fixes for locking and jump labels:
      
         - Ensure that the atomic_cmpxchg() conditions are correct and
           evaluating to true on any non-zero value except 1. The missing
           check of the return value leads to inconsisted state of the jump
           label counter.
      
         - Add a missing type conversion in the paravirt spinlock code which
           makes loongson build again"
      
      * tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        jump_label: Fix the fix, brown paper bags galore
        locking/pvqspinlock: Correct the type of "old" variable in pv_kick_node()
      3bc70ad1
    • Rob Herring (Arm)'s avatar
      arm: dts: arm: versatile-ab: Fix duplicate clock node name · ff588380
      Rob Herring (Arm) authored
      Commit 04f08ef2 ("arm/arm64: dts: arm: Use generic clock and
      regulator nodenames") renamed nodes and created 2 "clock-24000000" nodes
      (at different paths).
      
      The kernel can't handle these duplicate names even though they are at
      different paths.  Fix this by renaming one of the nodes to "clock-pclk".
      
      This name is aligned with other Arm boards (those didn't have a known
      frequency to use in the node name).
      
      Fixes: 04f08ef2 ("arm/arm64: dts: arm: Use generic clock and regulator nodenames")
      Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarRob Herring (Arm) <robh@kernel.org>
      Tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Tested-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ff588380
    • Linus Torvalds's avatar
      Merge tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 3f3f6d61
      Linus Torvalds authored
      Pull smb client fixes from Steve French:
      
       - two reparse point fixes
      
       - minor cleanup
      
       - additional trace point (to help debug a recent problem)
      
      * tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: update internal version number
        smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
        smb3: add dynamic tracepoints for shutdown ioctl
        cifs: Remove cifs_aio_ctx
        smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
      3f3f6d61
    • Linus Torvalds's avatar
      Merge tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 3c41df42
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - two Kconfig fixes
      
       - one fix for the UVC driver addressing probing time detection of a UVC
         custom controls
      
       - one fix related to PDF generation
      
      * tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        media: v4l: Fix missing tabular column hint for Y14P format
        media: intel/ipu6: select AUXILIARY_BUS in Kconfig
        media: ipu-bridge: fix ipu6 Kconfig dependencies
        media: uvcvideo: Fix custom control mapping probing
      3c41df42
  12. 03 Aug, 2024 4 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · defaf1a2
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "One core change that reverts the double message print patch in sd.c
        (it was causing regressions on embedded systems).
      
        The rest are driver fixes in ufs, mpt3sas and mpi3mr"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ufs: exynos: Don't resume FMP when crypto support is disabled
        scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
        scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
        scsi: ufs: core: Do not set link to OFF state while waking up from hibernation
        scsi: Revert "scsi: sd: Do not repeat the starting disk message"
        scsi: ufs: core: Fix deadlock during RTC update
        scsi: ufs: core: Bypass quick recovery if force reset is needed
        scsi: ufs: core: Check LSDBS cap when !mcq
      defaf1a2
    • Linus Torvalds's avatar
      Merge tag 'xfs-6.11-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · d3426a6e
      Linus Torvalds authored
      Pull xfs fixes from Chandan Babu:
      
       - Fix memory leak when corruption is detected during scrubbing parent
         pointers
      
       - Allow SECURE namespace xattrs to use reserved block pool to in order
         to prevent ENOSPC
      
       - Save stack space by passing tracepoint's char array to file_path()
         instead of another stack variable
      
       - Remove unused parameter in macro XFS_DQUOT_LOGRES
      
       - Replace comma with semicolon in a couple of places
      
      * tag 'xfs-6.11-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: convert comma to semicolon
        xfs: convert comma to semicolon
        xfs: remove unused parameter in macro XFS_DQUOT_LOGRES
        xfs: fix file_path handling in tracepoints
        xfs: allow SECURE namespace xattrs to use reserved block pool
        xfs: fix a memory leak
      d3426a6e
    • Linus Torvalds's avatar
      Merge tag 'parisc-for-6.11-rc2' of... · 1dd950f2
      Linus Torvalds authored
      Merge tag 'parisc-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
      
      Pull parisc architecture fixes from Helge Deller:
      
       - fix unaligned memory accesses when calling BPF functions
      
       - adjust memory size constants to fix possible DMA corruptions
      
      * tag 'parisc-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: fix a possible DMA corruption
        parisc: fix unaligned accesses in BPF
      1dd950f2
    • Linus Torvalds's avatar
      runtime constants: deal with old decrepit linkers · b6547e54
      Linus Torvalds authored
      The runtime constants linker script depended on documented linker
      behavior [1]:
      
       "If an output section’s name is the same as the input section’s name
        and is representable as a C identifier, then the linker will
        automatically PROVIDE two symbols: __start_SECNAME and __stop_SECNAME,
        where SECNAME is the name of the section. These indicate the start
        address and end address of the output section respectively"
      
      to just automatically define the symbol names for the bounds of the
      runtime constant arrays.
      
      It turns out that this isn't actually something we can rely on, with old
      linkers not generating these automatic symbols.  It looks to have been
      introduced in binutils-2.29 back in 2017, and we still support building
      with versions all the way back to binutils-2.25 (from 2015).
      
      And yes, Oleg actually seems to be using such ancient versions of
      binutils.
      
      So instead of depending on the implicit symbols from "section names
      match and are representable C identifiers", just do this all manually.
      It's not like it causes us any extra pain, we already have to do that
      for all the other sections that we use that often have special
      characters in them.
      Reported-and-tested-by: default avatarOleg Nesterov <oleg@redhat.com>
      Link: https://sourceware.org/binutils/docs/ld/Input-Section-Example.html [1]
      Link: https://lore.kernel.org/all/20240802114518.GA20924@redhat.com/Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b6547e54