summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-08-22vrf: Remove unnecessary RCU-bh critical sectionIdo Schimmel
dev_queue_xmit_nit() already uses rcu_read_lock() / rcu_read_unlock() and nothing suggests that softIRQs should be disabled around it. Therefore, remove the rcu_read_lock_bh() / rcu_read_unlock_bh() surrounding it. Tested using [1] with lockdep enabled. [1] #!/bin/bash ip link add name vrf1 up type vrf table 100 ip link add name veth0 type veth peer name veth1 ip link set dev veth1 master vrf1 ip link set dev veth0 up ip link set dev veth1 up ip address add 192.0.2.1/24 dev veth0 ip address add 192.0.2.2/24 dev veth1 ip rule add pref 32765 table local ip rule del pref 0 tcpdump -i vrf1 -c 20 -w /dev/null & sleep 10 ping -i 0.1 -c 10 -q 192.0.2.2 Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/r/20230821142339.1889961-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-22vxlan: vnifilter: Use GFP_KERNEL instead of GFP_ATOMICIdo Schimmel
The function is not called from an atomic context so use GFP_KERNEL instead of GFP_ATOMIC. The allocation of the per-CPU stats is already performed with GFP_KERNEL. Tested using test_vxlan_vnifiltering.sh with CONFIG_DEBUG_ATOMIC_SLEEP. Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://lore.kernel.org/r/20230821141923.1889776-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-22Merge tag 'nfs-for-6.5-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfsLinus Torvalds
Pull NFS client fixes from Trond Myklebust: - fix a use after free in nfs_direct_join_group() (Cc: stable) - fix sysfs server name memory leak - fix lock recovery hang in NFSv4.0 - fix page free in the error path for nfs42_proc_getxattr() and __nfs4_get_acl_uncached() - SUNRPC/rdma: fix receive buffer dma-mapping after a server disconnect * tag 'nfs-for-6.5-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: xprtrdma: Remap Receive buffers after a reconnect NFSv4: fix out path in __nfs4_get_acl_uncached NFSv4.2: fix error handling in nfs42_proc_getxattr NFS: Fix sysfs server name memory leak NFS: Fix a use after free in nfs_direct_join_group() NFSv4: Fix dropped lock for racing OPEN and delegation return
2023-08-22Merge tag 'selinux-pr-20230821' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "A small fix for a potential problem when cleaning up after a failed SELinux policy load (list next pointer not being properly initialized to NULL early enough)" * tag 'selinux-pr-20230821' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: set next pointer before attaching to list
2023-08-22net: ethernet: ti: Remove unused declarationsYue Haibing
Commit e8609e69470f ("net: ethernet: ti: am65-cpsw: Convert to PHYLINK") removed am65_cpsw_nuss_adjust_link() but not its declaration. Commit 84640e27f230 ("net: netcp: Add Keystone NetCP core ethernet driver") declared but never implemented netcp_device_find_module(). Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Reviewed-by: Simon Horman <horms@kernel.org> Acked-by: Roger Quadros <rogerq@kernel.org> Link: https://lore.kernel.org/r/20230821134029.40084-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-22net: microchip: Remove unused declarationsYue Haibing
Commit 264a9c5c9dff ("net: sparx5: Remove unused GLAG handling in PGID") removed sparx5_pgid_alloc_glag() but not its declaration. Commit 27d293cceee5 ("net: microchip: sparx5: Add support for rule count by cookie") removed vcap_rule_iter() but not its declaration. Commit 8beef08f4618 ("net: microchip: sparx5: Adding initial VCAP API support") declared but never implemented vcap_api_set_client(). Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20230821135556.43224-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-22ionic: Remove unused declarationsYue Haibing
Commit fbfb8031533c ("ionic: Add hardware init and device commands") declared but never implemented ionic_q_rewind()/ionic_set_dma_mask(). Commit 969f84394604 ("ionic: sync the filters in the work task") declared but never implemented ionic_rx_filters_need_sync(). Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Reviewed-by: Brett Creeley <brett.creeley@amd.com> Acked-by: Shannon Nelson <shannon.nelson@amd.com> Link: https://lore.kernel.org/r/20230821134717.51936-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-22net: mscc: ocelot: Remove unused declarationsYue Haibing
Commit 6c30384eb1de ("net: mscc: ocelot: register devlink ports") declared but never implemented ocelot_devlink_init() and ocelot_devlink_teardown(). Commit 2096805497e2 ("net: mscc: ocelot: automatically detect VCAP constants") declared but never implemented ocelot_detect_vcap_constants(). Commit 403ffc2c34de ("net: mscc: ocelot: add support for preemptible traffic classes") declared but never implemented ocelot_port_update_preemptible_tcs(). Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://lore.kernel.org/r/20230821130218.19096-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-22net: dsa: microchip: Remove unused declarationsYue Haibing
Commit 91a98917a883 ("net: dsa: microchip: move switch chip_id detection to ksz_common") removed ksz8_switch_detect() but not its declaration. Commit 6ec23aaaac43 ("net: dsa: microchip: move ksz_dev_ops to ksz_common.c") declared but never implemented other functions. Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Link: https://lore.kernel.org/r/20230821125501.19624-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-08-22selftests/bpf: Add a failure test for bpf_kptr_xchg() with local kptrYonghong Song
For a bpf_kptr_xchg() with local kptr, if the map value kptr type and allocated local obj type does not match, with the previous patch, the below verifier error message will be logged: R2 is of type <allocated local obj type> but <map value kptr type> is expected Without the previous patch, the test will have unexpected success. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20230822050058.2887354-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-22bpf: Fix a bpf_kptr_xchg() issue with local kptrYonghong Song
When reviewing local percpu kptr support, Alexei discovered a bug wherea bpf_kptr_xchg() may succeed even if the map value kptr type and locally allocated obj type do not match ([1]). Missed struct btf_id comparison is the reason for the bug. This patch added such struct btf_id comparison and will flag verification failure if types do not match. [1] https://lore.kernel.org/bpf/20230819002907.io3iphmnuk43xblu@macbook-pro-8.dhcp.thefacebook.com/#t Reported-by: Alexei Starovoitov <ast@kernel.org> Fixes: 738c96d5e2e3 ("bpf: Allow local kptrs to be exchanged via bpf_kptr_xchg") Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20230822050053.2886960-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-22dt-bindings: regulator: qcom,rpmh-regulator: allow i, j, l, m & n as RPMh ↵Neil Armstrong
resource name suffix Add "i", "j", "l", "m" and "n" to the allowed subffix list as they can be used as RPMh resource name suffixes on new platforms. Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Link: https://lore.kernel.org/r/20230822-topic-sm8x50-upstream-rpmh-regulator-suffix-v2-1-136b315085a4@linaro.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-08-22drm/i915/dgfx: Enable d3cold at s2idleAnshuman Gupta
System wide suspend already has support for lmem save/restore during suspend therefore enabling d3cold for s2idle and keepng it disable for runtime PM.(Refer below commit for d3cold runtime PM disable justification) 'commit 66eb93e71a7a ("drm/i915/dgfx: Keep PCI autosuspend control 'on' by default on all dGPU")' It will reduce the DG2 Card power consumption to ~0 Watt for s2idle power KPI. v2: - Added "Cc: stable@vger.kernel.org". Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8755 Cc: stable@vger.kernel.org Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Anshuman Gupta <anshuman.gupta@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Tested-by: Aaron Ma <aaron.ma@canonical.com> Tested-by: Jianshui Yu <Jianshui.yu@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230816125216.1722002-1-anshuman.gupta@intel.com (cherry picked from commit 2643e6d1f2a5e51877be24042d53cf956589be10) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2023-08-22wifi: ath9k: Remove unused declarationsYue Haibing
Commit b57ba3b2f7b0 ("ath9k: move ath9k_reload_chainmask_settings to common") removed the implementation ath9k_reload_chainmask_settings() but not the declaration. Also commit 978f78bf7137 ("ath9k_hw: Move bt_stomp to hw from common.") left behind ath9k_cmn_btcoex_bt_stomp() declaration. Signed-off-by: Yue Haibing <yuehaibing@huawei.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230810145222.34364-1-yuehaibing@huawei.com
2023-08-22wifi: ath9k: Remove unnecessary ternary operatorsRuan Jinjie
Ther are a little ternary operators, the true or false judgement of which is unnecessary in C language semantics. Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230731124455.2039184-1-ruanjinjie@huawei.com
2023-08-22wifi: ath9k: consistently use kstrtoX_from_user() functionsDmitry Antipov
Use 'kstrtoul_from_user()' and 'kstrtobool_from_user()' where appropriate and thus avoid some code duplication. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230726185046.188225-1-dmantipov@yandex.ru
2023-08-22wifi: ath9k: fix parameter check in ath9k_init_debug()Minjie Du
Make IS_ERR() judge the debugfs_create_dir() function return in ath9k_init_debug() Signed-off-by: Minjie Du <duminjie@vivo.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230712114740.13226-1-duminjie@vivo.com
2023-08-22wifi: ath9k: protect WMI command response buffer replacement with a lockFedor Pchelkin
If ath9k_wmi_cmd() has exited with a timeout, it is possible that during next ath9k_wmi_cmd() call the wmi_rsp callback for previous wmi command writes to new wmi->cmd_rsp_buf and makes a completion. This results in an invalid ath9k_wmi_cmd() return value. Move the replacement of WMI command response buffer and length under wmi_lock. Note that last_seq_id value is updated there, too. Thus, the buffer cannot be written to by a belated wmi_rsp callback because that path is properly rejected by the last_seq_id check. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230425192607.18015-2-pchelkin@ispras.ru
2023-08-22wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rxFedor Pchelkin
Currently, the synchronization between ath9k_wmi_cmd() and ath9k_wmi_ctrl_rx() is exposed to a race condition which, although being rather unlikely, can lead to invalid behaviour of ath9k_wmi_cmd(). Consider the following scenario: CPU0 CPU1 ath9k_wmi_cmd(...) mutex_lock(&wmi->op_mutex) ath9k_wmi_cmd_issue(...) wait_for_completion_timeout(...) --- timeout --- /* the callback is being processed * before last_seq_id became zero */ ath9k_wmi_ctrl_rx(...) spin_lock_irqsave(...) /* wmi->last_seq_id check here * doesn't detect timeout yet */ spin_unlock_irqrestore(...) /* last_seq_id is zeroed to * indicate there was a timeout */ wmi->last_seq_id = 0 mutex_unlock(&wmi->op_mutex) return -ETIMEDOUT ath9k_wmi_cmd(...) mutex_lock(&wmi->op_mutex) /* the buffer is replaced with * another one */ wmi->cmd_rsp_buf = rsp_buf wmi->cmd_rsp_len = rsp_len ath9k_wmi_cmd_issue(...) spin_lock_irqsave(...) spin_unlock_irqrestore(...) wait_for_completion_timeout(...) /* the continuation of the * callback left after the first * ath9k_wmi_cmd call */ ath9k_wmi_rsp_callback(...) /* copying data designated * to already timeouted * WMI command into an * inappropriate wmi_cmd_buf */ memcpy(...) complete(&wmi->cmd_wait) /* awakened by the bogus callback * => invalid return result */ mutex_unlock(&wmi->op_mutex) return 0 To fix this, update last_seq_id on timeout path inside ath9k_wmi_cmd() under the wmi_lock. Move ath9k_wmi_rsp_callback() under wmi_lock inside ath9k_wmi_ctrl_rx() so that the wmi->cmd_wait can be completed only for initially designated wmi_cmd call, otherwise the path would be rejected with last_seq_id check. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230425192607.18015-1-pchelkin@ispras.ru
2023-08-22wifi: ath5k: Remove redundant dev_err()Ruan Jinjie
There is no need to call the dev_err() function directly to print a custom message when handling an error from platform_get_irq() function as it is going to display an appropriate error message in case of a failure. Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230726171235.2475625-1-ruanjinjie@huawei.com
2023-08-22netfilter: nf_tables: allow loop termination for pending fatal signalFlorian Westphal
abort early so task can exit faster if a fatal signal is pending, no need to continue validation in that case. Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: xtables: refactor deprecated strncpyJustin Stitt
Prefer `strscpy_pad` as it's a more robust interface whilst maintaing zero-padding behavior. There may have existed a bug here due to both `tbl->repl.name` and `info->name` having a size of 32 as defined below: | #define XT_TABLE_MAXNAMELEN 32 This may lead to buffer overreads in some situations -- `strscpy` solves this by guaranteeing NUL-termination of the dest buffer. Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: x_tables: refactor deprecated strncpyJustin Stitt
Prefer `strscpy_pad` to `strncpy`. Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: nft_meta: refactor deprecated strncpyJustin Stitt
Prefer `strscpy_pad` to `strncpy`. Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: nft_osf: refactor deprecated strncpyJustin Stitt
Use `strscpy_pad` over `strncpy` for NUL-terminated strings. We can also drop the + 1 from `NFT_OSF_MAXGENRELEN + 1` since `strscpy` will guarantee NUL-termination. Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: nf_tables: refactor deprecated strncpyJustin Stitt
Prefer `strscpy_pad` over `strncpy`. Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: nf_tables: refactor deprecated strncpyJustin Stitt
Prefer `strscpy_pad` over `strncpy`. Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: ipset: refactor deprecated strncpyJustin Stitt
Use `strscpy_pad` instead of `strncpy`. Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: ebtables: replace zero-length array membersGONG, Ruiqi
As suggested by Kees[1], replace the old-style 0-element array members of multiple structs in ebtables.h with modern C99 flexible array. [1]: https://lore.kernel.org/all/5E8E0F9C-EE3F-4B0D-B827-DC47397E2A4A@kernel.org/ [ fw@strlen.de: keep struct ebt_entry_target as-is, causes compiler warning: "variable sized type 'struct ebt_entry_target' not at the end of a struct or class is a GNU extension" ] Link: https://github.com/KSPP/linux/issues/21 Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22netfilter: ebtables: fix fortify warnings in size_entry_mwt()GONG, Ruiqi
When compiling with gcc 13 and CONFIG_FORTIFY_SOURCE=y, the following warning appears: In function ‘fortify_memcpy_chk’, inlined from ‘size_entry_mwt’ at net/bridge/netfilter/ebtables.c:2118:2: ./include/linux/fortify-string.h:592:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The compiler is complaining: memcpy(&offsets[1], &entry->watchers_offset, sizeof(offsets) - sizeof(offsets[0])); where memcpy reads beyong &entry->watchers_offset to copy {watchers,target,next}_offset altogether into offsets[]. Silence the warning by wrapping these three up via struct_group(). Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Florian Westphal <fw@strlen.de>
2023-08-22bonding: update port speed when getting bond speedHangbin Liu
Andrew reported a bonding issue that if we put an active-back bond on top of a 802.3ad bond interface. When the 802.3ad bond's speed/duplex changed dynamically. The upper bonding interface's speed/duplex can't be changed at the same time, which will show incorrect speed. Fix it by updating the port speed when calling ethtool. Reported-by: Andrew Schorr <ajschorr@alumni.princeton.edu> Closes: https://lore.kernel.org/netdev/ZEt3hvyREPVdbesO@Laptop-X1/ Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com> Link: https://lore.kernel.org/r/20230821101008.797482-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2023-08-22spi: at91-usart: Use PTR_ERR_OR_ZERO() to simplify codeJinjie Ruan
Return PTR_ERR_OR_ZERO() instead of return 0 or PTR_ERR() to simplify code. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://lore.kernel.org/r/20230822124643.987079-1-ruanjinjie@huawei.com Signed-off-by: Mark Brown <broonie@kernel.org>
2023-08-22affs: rename local toupper() to fn() to avoid confusionAndy Shevchenko
A compiler may see the collision with the toupper() defined in ctype.h: fs/affs/namei.c:159:19: warning: unused variable 'toupper' [-Wunused-variable] 159 | toupper_t toupper = affs_get_toupper(sb); To prevent this from happening, rename toupper local variable to fn. Initially this had been introduced by 24579a881513 ("v2.4.3.5 -> v2.4.3.6") in the history.git by history group. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2023-08-22affs: remove writepage implementationMatthew Wilcox (Oracle)
If the filesystem implements migrate_folio and writepages, there is no need for a writepage implementation. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2023-08-22btrfs: zoned: skip splitting and logical rewriting on pre-alloc writeNaohiro Aota
When doing a relocation, there is a chance that at the time of btrfs_reloc_clone_csums(), there is no checksum for the corresponding region. In this case, btrfs_finish_ordered_zoned()'s sum points to an invalid item and so ordered_extent's logical is set to some invalid value. Then, btrfs_lookup_block_group() in btrfs_zone_finish_endio() failed to find a block group and will hit an assert or a null pointer dereference as following. This can be reprodcued by running btrfs/028 several times (e.g, 4 to 16 times) with a null_blk setup. The device's zone size and capacity is set to 32 MB and the storage size is set to 5 GB on my setup. KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 6 PID: 3105720 Comm: kworker/u16:13 Tainted: G W 6.5.0-rc6-kts+ #1 Hardware name: Supermicro Super Server/X10SRL-F, BIOS 2.0 12/17/2015 Workqueue: btrfs-endio-write btrfs_work_helper [btrfs] RIP: 0010:btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs] Code: 41 54 49 89 fc 55 48 89 f5 53 e8 57 7d fc ff 48 8d b8 88 00 00 00 48 89 c3 48 b8 00 00 00 00 00 > 3c 02 00 0f 85 02 01 00 00 f6 83 88 00 00 00 01 0f 84 a8 00 00 RSP: 0018:ffff88833cf87b08 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000011 RSI: 0000000000000004 RDI: 0000000000000088 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed102877b827 R10: ffff888143bdc13b R11: ffff888125b1cbc0 R12: ffff888143bdc000 R13: 0000000000007000 R14: ffff888125b1cba8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88881e500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3ed85223d5 CR3: 00000001519b4005 CR4: 00000000001706e0 Call Trace: <TASK> ? die_addr+0x3c/0xa0 ? exc_general_protection+0x148/0x220 ? asm_exc_general_protection+0x22/0x30 ? btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs] ? btrfs_zone_finish_endio.part.0+0x19/0x160 [btrfs] btrfs_finish_one_ordered+0x7b8/0x1de0 [btrfs] ? rcu_is_watching+0x11/0xb0 ? lock_release+0x47a/0x620 ? btrfs_finish_ordered_zoned+0x59b/0x800 [btrfs] ? __pfx_btrfs_finish_one_ordered+0x10/0x10 [btrfs] ? btrfs_finish_ordered_zoned+0x358/0x800 [btrfs] ? __smp_call_single_queue+0x124/0x350 ? rcu_is_watching+0x11/0xb0 btrfs_work_helper+0x19f/0xc60 [btrfs] ? __pfx_try_to_wake_up+0x10/0x10 ? _raw_spin_unlock_irq+0x24/0x50 ? rcu_is_watching+0x11/0xb0 process_one_work+0x8c1/0x1430 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? _raw_spin_lock_irq+0x52/0x60 worker_thread+0x100/0x12c0 ? __kthread_parkme+0xc1/0x1f0 ? __pfx_worker_thread+0x10/0x10 kthread+0x2ea/0x3c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> On the zoned mode, writing to pre-allocated region means data relocation write. Such write always uses WRITE command so there is no need of splitting and rewriting logical address. Thus, we can just skip the function for the case. Fixes: cbfce4c7fbde ("btrfs: optimize the logical to physical mapping for zoned writes") Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com> Signed-off-by: David Sterba <dsterba@suse.com>
2023-08-22wifi: mac80211: check S1G action frame sizeJohannes Berg
Before checking the action code, check that it even exists in the frame. Reported-by: syzbot+be9c824e6f269d608288@syzkaller.appspotmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22super: use higher-level helper for {freeze,thaw}Christian Brauner
It's not necessary to use low-level locking helpers here. Use the higher-level locking helpers and log if the superblock is dying. Since the caller is assumed to already hold an active reference it isn't possible to observe a dying superblock. Suggested-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org>
2023-08-22wifi: iwlmei: don't send nic info with invalid mac addressAvraham Stern
In case the SAP connection is established before the interface is added, the mac address is still not set. Don't send the nic info SAP message in this case since it will result in sending an invalid mac address. The nic info message will be sent with a valid mac address when the interface is added. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230822103048.a49436bed387.I0ca88d72456e6e9f939bbc2e0c52ffb173fbc97e@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlmei: send driver down SAP message only if wiamt is enabledAvraham Stern
When wiamt is disabled the driver up SAP message is not sent, so there is no need to send the driver down message as well. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230822103048.100f41b84656.I583d3e18ea65793f53aa710af13e47f8af82b53d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlmei: send HOST_GOES_DOWN message even if wiamt is disabledAvraham Stern
The HOST_GOES_DOWN message should be sent even if wiamt is disabled. Otherwise wiamt may still use the shared memory (e.g. if enabled later) while it's no longer valid. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230822103048.2baad50eb1c3.If7b7c1dc2d6bfc6bacf7f6c72972f19714d9d973@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlmei: don't send SAP messages if AMT is disabledAvraham Stern
SAP messages should not be sent when AMT is disabled. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230822103048.db16b55c27c1.I48834c14f5af8d31792f5048b3023509cba191dd@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: pcie: avoid a warning in case prepare card failedAvraham Stern
In case CSME holds the NIC and SAP connection is already established, iwl_pcie_prepare_card_hw() during iwl_pci_probe() will fail (which is fine since CSME will release the nic later when asked with a SAP message). In this case tring to grab nic access to read the crf ids will fail with a warning. Avoid the warning by only trying to read the crf ids in case prepare card succeeded. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230822103048.9b026fa7b97e.I12bea7e6eef54eeeaf916b68d71583e92ff310fd@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: remove memory check for LMAC error addressMukesh Sisodiya
LMAC error table address was checked against UMAC error table minimum address defined. Because of that, the LMAC error table was not read, since both addresses belong to different ranges. As addresses are updated from FW alive message and should be correct, this check is not needed. Still keep the check for address 0 to avoid NULL address read. Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.08ab1497904d.I270d4c5bcc23c5ecd0b7db475501032c450852ad@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: mvm: support flush on AP interfacesJohannes Berg
Support TX flush on AP interfaces so that we will do a proper flush for frames on the queue before keys are removed. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.f4b749b91ec2.Ia8381bd4f7d47592e74387c564739798a01c4049@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: mvm: enable HE TX/RX <242 tone RU on new RFsJohannes Berg
Two new RFs were added in the code, but we forgot to add them to the list here that enables HE TX/RX 1024 QAM less than 242 tone RU. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.ddb090c86c8c.Ic630aa579e3dc52069758d8698069480d555eefe@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: add Razer to ppag approved listGregory Greenman
Add a new vendor (Razer) to PPAG approved list. Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.f586a86fa644.I97408afb20bd7c46fcff8c3561ead8ed9c60b37e@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: pcie: point invalid TFDs to invalid dataJohannes Berg
There are occasionally bugs which cause the device to try to use a TFD that it wasn't supposed to, and these are very hard to diagnose. Fill all unused TFDs with a debug command that immediately causes an error to be detected in these cases. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.10a9af1ca91f.Ifc790d62c52b4bc9a74c9581610af498509f5759@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: queue: move iwl_txq_gen2_set_tb() upJohannes Berg
We need this earlier in the file next, move it up to have an easier to read change, since this moves other things in the diff git generates by default. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.c6d798b600bb.I9b891ee3d3dc67822a28e44941409f5b7cb637cf@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: pcie: move gen1 TB handling to headerJohannes Berg
We will need this in another place soon in reclaim and init, so add this function to the queue header file instead. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.52b6f66de219.Ic8403fd098c187fac067977808c0129d96514c91@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-08-22wifi: iwlwifi: remove 'def_rx_queue' struct memberJohannes Berg
This is only ever initialized to zero, use a new define for the default RX queue instead. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230816104355.e0c6fa57c162.I907bbb428cf99725f06a348c8dbce5d3dd877136@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
generated by cgit (git 2.34.1) at 2025-09-14 20:45:03 +0000