···76764. prctl() enabling7777--------------------78787979-:c:macro:`PR_SET_INDIR_BR_LP_STATUS` / :c:macro:`PR_GET_INDIR_BR_LP_STATUS` /8080-:c:macro:`PR_LOCK_INDIR_BR_LP_STATUS` are three prctls added to manage indirect8181-branch tracking. These prctls are architecture-agnostic and return -EINVAL if8282-the underlying functionality is not supported.7979+Per-task indirect branch tracking state can be monitored and8080+controlled via the :c:macro:`PR_GET_CFI` and :c:macro:`PR_SET_CFI`8181+``prctl()` arguments (respectively), by supplying8282+:c:macro:`PR_CFI_BRANCH_LANDING_PADS` as the second argument. These8383+are architecture-agnostic, and will return -EINVAL if the underlying8484+functionality is not supported.83858484-* prctl(PR_SET_INDIR_BR_LP_STATUS, unsigned long arg)8686+* prctl(:c:macro:`PR_SET_CFI`, :c:macro:`PR_CFI_BRANCH_LANDING_PADS`, unsigned long arg)85878686-If arg1 is :c:macro:`PR_INDIR_BR_LP_ENABLE` and if CPU supports8787-``zicfilp`` then the kernel will enable indirect branch tracking for the8888-task. The dynamic loader can issue this :c:macro:`prctl` once it has8888+arg is a bitmask.8989+9090+If :c:macro:`PR_CFI_ENABLE` is set in arg, and the CPU supports9191+``zicfilp``, then the kernel will enable indirect branch tracking for9292+the task. The dynamic loader can issue this ``prctl()`` once it has8993determined that all the objects loaded in the address space support9090-indirect branch tracking. Additionally, if there is a `dlopen` to an9191-object which wasn't compiled with ``zicfilp``, the dynamic loader can9292-issue this prctl with arg1 set to 0 (i.e. :c:macro:`PR_INDIR_BR_LP_ENABLE`9393-cleared).9494+indirect branch tracking.94959595-* prctl(PR_GET_INDIR_BR_LP_STATUS, unsigned long * arg)9696+Indirect branch tracking state can also be locked once enabled. This9797+prevents the task from subsequently disabling it. This is done by9898+setting the bit :c:macro:`PR_CFI_LOCK` in arg. Either indirect branch9999+tracking must already be enabled for the task, or the bit100100+:c:macro:`PR_CFI_ENABLE` must also be set in arg. This is intended101101+for environments that wish to run with a strict security posture that102102+do not wish to load objects without ``zicfilp`` support.961039797-Returns the current status of indirect branch tracking. If enabled9898-it'll return :c:macro:`PR_INDIR_BR_LP_ENABLE`104104+Indirect branch tracking can also be disabled for the task, assuming105105+that it has not previously been enabled and locked. If there is a106106+``dlopen()`` to an object which wasn't compiled with ``zicfilp``, the107107+dynamic loader can issue this ``prctl()`` with arg set to108108+:c:macro:`PR_CFI_DISABLE`. Disabling indirect branch tracking for the109109+task is not possible if it has previously been enabled and locked.99110100100-* prctl(PR_LOCK_INDIR_BR_LP_STATUS, unsigned long arg)101111102102-Locks the current status of indirect branch tracking on the task. User103103-space may want to run with a strict security posture and wouldn't want104104-loading of objects without ``zicfilp`` support in them, to disallow105105-disabling of indirect branch tracking. In this case, user space can106106-use this prctl to lock the current settings.112112+* prctl(:c:macro:`PR_GET_CFI`, :c:macro:`PR_CFI_BRANCH_LANDING_PADS`, unsigned long * arg)113113+114114+Returns the current status of indirect branch tracking into a bitmask115115+stored into the memory location pointed to by arg. The bitmask will116116+have the :c:macro:`PR_CFI_ENABLE` bit set if indirect branch tracking117117+is currently enabled for the task, and if it is locked, will118118+additionally have the :c:macro:`PR_CFI_LOCK` bit set. If indirect119119+branch tracking is currently disabled for the task, the120120+:c:macro:`PR_CFI_DISABLE` bit will be set.121121+1071221081235. violations related to indirect branch tracking109124--------------------------------------------------
···160160 * clear shadow stack state on exec.161161 * libc will set it later via prctl.162162 */163163+ set_shstk_lock(current, false);163164 set_shstk_status(current, false);164165 set_shstk_base(current, 0, 0);165166 set_active_shstk(current, 0);···168167 * disable indirect branch tracking on exec.169168 * libc will enable it later via prctl.170169 */170170+ set_indir_lp_lock(current, false);171171 set_indir_lp_status(current, false);172172173173#ifdef CONFIG_64BIT
+11-11
arch/riscv/kernel/ptrace.c
···303303 regs = task_pt_regs(target);304304305305 if (is_indir_lp_enabled(target)) {306306- user_cfi.cfi_status.cfi_state |= PTRACE_CFI_LP_EN_STATE;306306+ user_cfi.cfi_status.cfi_state |= PTRACE_CFI_BRANCH_LANDING_PAD_EN_STATE;307307 user_cfi.cfi_status.cfi_state |= is_indir_lp_locked(target) ?308308- PTRACE_CFI_LP_LOCK_STATE : 0;308308+ PTRACE_CFI_BRANCH_LANDING_PAD_LOCK_STATE : 0;309309 user_cfi.cfi_status.cfi_state |= (regs->status & SR_ELP) ?310310- PTRACE_CFI_ELP_STATE : 0;310310+ PTRACE_CFI_BRANCH_EXPECTED_LANDING_PAD_STATE : 0;311311 }312312313313 if (is_shstk_enabled(target)) {314314- user_cfi.cfi_status.cfi_state |= (PTRACE_CFI_SS_EN_STATE |315315- PTRACE_CFI_SS_PTR_STATE);314314+ user_cfi.cfi_status.cfi_state |= (PTRACE_CFI_SHADOW_STACK_EN_STATE |315315+ PTRACE_CFI_SHADOW_STACK_PTR_STATE);316316 user_cfi.cfi_status.cfi_state |= is_shstk_locked(target) ?317317- PTRACE_CFI_SS_LOCK_STATE : 0;317317+ PTRACE_CFI_SHADOW_STACK_LOCK_STATE : 0;318318 user_cfi.shstk_ptr = get_active_shstk(target);319319 }320320···349349 * rsvd field should be set to zero so that if those fields are needed in future350350 */351351 if ((user_cfi.cfi_status.cfi_state &352352- (PTRACE_CFI_LP_EN_STATE | PTRACE_CFI_LP_LOCK_STATE |353353- PTRACE_CFI_SS_EN_STATE | PTRACE_CFI_SS_LOCK_STATE)) ||354354- (user_cfi.cfi_status.cfi_state & PRACE_CFI_STATE_INVALID_MASK))352352+ (PTRACE_CFI_BRANCH_LANDING_PAD_EN_STATE | PTRACE_CFI_BRANCH_LANDING_PAD_LOCK_STATE |353353+ PTRACE_CFI_SHADOW_STACK_EN_STATE | PTRACE_CFI_SHADOW_STACK_LOCK_STATE)) ||354354+ (user_cfi.cfi_status.cfi_state & PTRACE_CFI_STATE_INVALID_MASK))355355 return -EINVAL;356356357357 /* If lpad is enabled on target and ptrace requests to set / clear elp, do that */358358 if (is_indir_lp_enabled(target)) {359359 if (user_cfi.cfi_status.cfi_state &360360- PTRACE_CFI_ELP_STATE) /* set elp state */360360+ PTRACE_CFI_BRANCH_EXPECTED_LANDING_PAD_STATE) /* set elp state */361361 regs->status |= SR_ELP;362362 else363363 regs->status &= ~SR_ELP; /* clear elp state */···365365366366 /* If shadow stack enabled on target, set new shadow stack pointer */367367 if (is_shstk_enabled(target) &&368368- (user_cfi.cfi_status.cfi_state & PTRACE_CFI_SS_PTR_STATE))368368+ (user_cfi.cfi_status.cfi_state & PTRACE_CFI_SHADOW_STACK_PTR_STATE))369369 set_active_shstk(target, user_cfi.shstk_ptr);370370371371 return 0;
+19-20
arch/riscv/kernel/usercfi.c
···7474 csr_write(CSR_ENVCFG, task->thread.envcfg);7575}76767777-void set_shstk_lock(struct task_struct *task)7777+void set_shstk_lock(struct task_struct *task, bool lock)7878{7979- task->thread_info.user_cfi_state.ubcfi_locked = 1;7979+ task->thread_info.user_cfi_state.ubcfi_locked = lock;8080}81818282bool is_indir_lp_enabled(struct task_struct *task)···104104 csr_write(CSR_ENVCFG, task->thread.envcfg);105105}106106107107-void set_indir_lp_lock(struct task_struct *task)107107+void set_indir_lp_lock(struct task_struct *task, bool lock)108108{109109- task->thread_info.user_cfi_state.ufcfi_locked = 1;109109+ task->thread_info.user_cfi_state.ufcfi_locked = lock;110110}111111/*112112 * If size is 0, then to be compatible with regular stack we want it to be as big as···452452 !is_shstk_enabled(task) || arg != 0)453453 return -EINVAL;454454455455- set_shstk_lock(task);455455+ set_shstk_lock(task, true);456456457457 return 0;458458}459459460460-int arch_get_indir_br_lp_status(struct task_struct *t, unsigned long __user *status)460460+int arch_prctl_get_branch_landing_pad_state(struct task_struct *t,461461+ unsigned long __user *state)461462{462463 unsigned long fcfi_status = 0;463464464465 if (!is_user_lpad_enabled())465466 return -EINVAL;466467467467- /* indirect branch tracking is enabled on the task or not */468468- fcfi_status |= (is_indir_lp_enabled(t) ? PR_INDIR_BR_LP_ENABLE : 0);468468+ fcfi_status = (is_indir_lp_enabled(t) ? PR_CFI_ENABLE : PR_CFI_DISABLE);469469+ fcfi_status |= (is_indir_lp_locked(t) ? PR_CFI_LOCK : 0);469470470470- return copy_to_user(status, &fcfi_status, sizeof(fcfi_status)) ? -EFAULT : 0;471471+ return copy_to_user(state, &fcfi_status, sizeof(fcfi_status)) ? -EFAULT : 0;471472}472473473473-int arch_set_indir_br_lp_status(struct task_struct *t, unsigned long status)474474+int arch_prctl_set_branch_landing_pad_state(struct task_struct *t, unsigned long state)474475{475475- bool enable_indir_lp = false;476476-477476 if (!is_user_lpad_enabled())478477 return -EINVAL;479478···480481 if (is_indir_lp_locked(t))481482 return -EINVAL;482483483483- /* Reject unknown flags */484484- if (status & ~PR_INDIR_BR_LP_ENABLE)484484+ if (!(state & (PR_CFI_ENABLE | PR_CFI_DISABLE)))485485 return -EINVAL;486486487487- enable_indir_lp = (status & PR_INDIR_BR_LP_ENABLE);488488- set_indir_lp_status(t, enable_indir_lp);487487+ if (state & PR_CFI_ENABLE && state & PR_CFI_DISABLE)488488+ return -EINVAL;489489+490490+ set_indir_lp_status(t, !!(state & PR_CFI_ENABLE));489491490492 return 0;491493}492494493493-int arch_lock_indir_br_lp_status(struct task_struct *task,494494- unsigned long arg)495495+int arch_prctl_lock_branch_landing_pad_state(struct task_struct *task)495496{496497 /*497498 * If indirect branch tracking is not supported or not enabled on task,498499 * nothing to lock here499500 */500501 if (!is_user_lpad_enabled() ||501501- !is_indir_lp_enabled(task) || arg != 0)502502+ !is_indir_lp_enabled(task))502503 return -EINVAL;503504504504- set_indir_lp_lock(task);505505+ set_indir_lp_lock(task, true);505506506507 return 0;507508}
+5-4
arch/s390/kvm/gaccess.c
···14491449 pgste_set_unlock(ptep_h, pgste);14501450 if (rc)14511451 return rc;14521452- if (!sg->parent)14521452+ if (sg->invalidated)14531453 return -EAGAIN;1454145414551455 newpte = _pte(f->pfn, 0, !p, 0);···1479147914801480 do {14811481 /* _gmap_crstep_xchg_atomic() could have unshadowed this shadow gmap */14821482- if (!sg->parent)14821482+ if (sg->invalidated)14831483 return -EAGAIN;14841484 oldcrste = READ_ONCE(*host);14851485 newcrste = _crste_fc1(f->pfn, oldcrste.h.tt, f->writable, !p);···14921492 if (!newcrste.h.p && !f->writable)14931493 return -EOPNOTSUPP;14941494 } while (!_gmap_crstep_xchg_atomic(sg->parent, host, oldcrste, newcrste, f->gfn, false));14951495- if (!sg->parent)14951495+ if (sg->invalidated)14961496 return -EAGAIN;1497149714981498 newcrste = _crste_fc1(f->pfn, oldcrste.h.tt, 0, !p);···15451545 entries[i].pfn, i + 1, entries[i].writable);15461546 if (rc)15471547 return rc;15481548- if (!sg->parent)15481548+ if (sg->invalidated)15491549 return -EAGAIN;15501550 }15511551···16011601 scoped_guard(spinlock, &parent->children_lock) {16021602 if (READ_ONCE(sg->parent) != parent)16031603 return -EAGAIN;16041604+ sg->invalidated = false;16041605 rc = _gaccess_do_shadow(vcpu->arch.mc, sg, saddr, walk);16051606 }16061607 if (rc == -ENOMEM)
+3
arch/s390/kvm/gmap.c
···181181182182 list_del(&child->list);183183 child->parent = NULL;184184+ child->invalidated = true;184185}185186186187/**···10701069 if (level > TABLE_TYPE_PAGE_TABLE)10711070 align = 1UL << (11 * level + _SEGMENT_SHIFT);10721071 kvm_s390_vsie_gmap_notifier(sg, ALIGN_DOWN(gaddr, align), ALIGN(gaddr + 1, align));10721072+ sg->invalidated = true;10731073 if (dat_entry_walk(NULL, r_gfn, sg->asce, 0, level, &crstep, &ptep))10741074 return;10751075 if (ptep) {···11761174 scoped_guard(spinlock, &parent->children_lock) {11771175 if (READ_ONCE(sg->parent) != parent)11781176 return -EAGAIN;11771177+ sg->invalidated = false;11791178 for (i = 0; i < CRST_TABLE_PAGES; i++) {11801179 if (!context->f[i].valid)11811180 continue;
+1
arch/s390/kvm/gmap.h
···6060struct gmap {6161 unsigned long flags;6262 unsigned char edat_level;6363+ bool invalidated;6364 struct kvm *kvm;6465 union asce asce;6566 struct list_head list;
+1
arch/x86/events/intel/uncore.c
···6767 return bus ? pci_domain_nr(bus) : -EINVAL;6868}69697070+/* Note: This API can only be used when NUMA information is available. */7071int uncore_device_to_die(struct pci_dev *dev)7172{7273 int node = pcibus_to_node(dev->bus);
+11-6
arch/x86/events/intel/uncore_discovery.c
···264264 struct uncore_unit_discovery unit;265265 void __iomem *io_addr;266266 unsigned long size;267267+ int ret = 0;267268 int i;268269269270 size = UNCORE_DISCOVERY_GLOBAL_MAP_SIZE;···274273275274 /* Read Global Discovery State */276275 memcpy_fromio(&global, io_addr, sizeof(struct uncore_global_discovery));276276+ iounmap(io_addr);277277+277278 if (uncore_discovery_invalid_unit(global)) {278279 pr_info("Invalid Global Discovery State: 0x%llx 0x%llx 0x%llx\n",279280 global.table1, global.ctl, global.table3);280280- iounmap(io_addr);281281 return -EINVAL;282282 }283283- iounmap(io_addr);284283285284 size = (1 + global.max_units) * global.stride * 8;286285 io_addr = ioremap(addr, size);287286 if (!io_addr)288287 return -ENOMEM;289288290290- if (domain->global_init && domain->global_init(global.ctl))291291- return -ENODEV;289289+ if (domain->global_init && domain->global_init(global.ctl)) {290290+ ret = -ENODEV;291291+ goto out;292292+ }292293293294 /* Parsing Unit Discovery State */294295 for (i = 0; i < global.max_units; i++) {···310307 }311308312309 *parsed = true;310310+311311+out:313312 iounmap(io_addr);314314- return 0;313313+ return ret;315314}316315317316static int parse_discovery_table(struct uncore_discovery_domain *domain,···371366 (val & UNCORE_DISCOVERY_DVSEC2_BIR_MASK) * UNCORE_DISCOVERY_BIR_STEP;372367373368 die = get_device_die_id(dev);374374- if (die < 0)369369+ if ((die < 0) || (die >= uncore_max_dies()))375370 continue;376371377372 parse_discovery_table(domain, dev, die, bar_offset, &parsed);
···351351 need_to_check_vma = PAGE_ALIGN(*ssp) == *ssp;352352353353 if (need_to_check_vma)354354- mmap_read_lock_killable(current->mm);354354+ if (mmap_read_lock_killable(current->mm))355355+ return -EINTR;355356356357 err = get_shstk_data(&token_addr, (unsigned long __user *)*ssp);357358 if (unlikely(err))
+4-2
crypto/af_alg.c
···705705 * Assumption: caller created af_alg_count_tsgl(len)706706 * SG entries in dst.707707 */708708- if (dst) {709709- /* reassign page to dst after offset */708708+ if (dst && plen) {709709+ /* reassign page to dst */710710 get_page(page);711711 sg_set_page(dst + j, page, plen, sg[i].offset);712712 j++;···1229122912301230 seglen = min_t(size_t, (maxsize - len),12311231 msg_data_left(msg));12321232+ /* Never pin more pages than the remaining RX accounting budget. */12331233+ seglen = min_t(size_t, seglen, af_alg_rcvbuf(sk));1232123412331235 if (list_empty(&areq->rsgl_list)) {12341236 rsgl = &areq->first_rsgl;
+1-1
crypto/algif_aead.c
···144144 if (usedpages < outlen) {145145 size_t less = outlen - usedpages;146146147147- if (used < less) {147147+ if (used < less + (ctx->enc ? 0 : as)) {148148 err = -EINVAL;149149 goto free;150150 }
+5
crypto/algif_skcipher.c
···130130 * full block size buffers.131131 */132132 if (ctx->more || len < ctx->used) {133133+ if (len < bs) {134134+ err = -EINVAL;135135+ goto free;136136+ }137137+133138 len -= len % bs;134139 cflags |= CRYPTO_SKCIPHER_REQ_NOTFINAL;135140 }
+4-4
crypto/asymmetric_keys/x509_cert_parser.c
···609609 * 0x04 is where keyCertSign lands in this bit string610610 * 0x80 is where digitalSignature lands in this bit string611611 */612612- if (v[0] != ASN1_BTS)613613- return -EBADMSG;614612 if (vlen < 4)613613+ return -EBADMSG;614614+ if (v[0] != ASN1_BTS)615615 return -EBADMSG;616616 if (v[2] >= 8)617617 return -EBADMSG;···645645 * (Expect 0xFF if the CA is TRUE)646646 * vlen should match the entire extension size647647 */648648- if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))649649- return -EBADMSG;650648 if (vlen < 2)649649+ return -EBADMSG;650650+ if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))651651 return -EBADMSG;652652 if (v[1] != vlen - 2)653653 return -EBADMSG;
+1
drivers/accel/ethosu/Kconfig
···44 tristate "Arm Ethos-U65/U85 NPU"55 depends on HAS_IOMEM66 depends on DRM_ACCEL77+ depends on ARM || ARM64 || COMPILE_TEST78 select DRM_GEM_DMA_HELPER89 select DRM_SCHED910 select GENERIC_ALLOCATOR
+14
drivers/ata/ahci.c
···6868 /* board IDs for specific chipsets in alphabetical order */6969 board_ahci_al,7070 board_ahci_avn,7171+ board_ahci_jmb585,7172 board_ahci_mcp65,7273 board_ahci_mcp77,7374 board_ahci_mcp89,···212211 .pio_mask = ATA_PIO4,213212 .udma_mask = ATA_UDMA6,214213 .port_ops = &ahci_avn_ops,214214+ },215215+ /* JMicron JMB582/585: 64-bit DMA is broken, force 32-bit */216216+ [board_ahci_jmb585] = {217217+ AHCI_HFLAGS (AHCI_HFLAG_IGN_IRQ_IF_ERR |218218+ AHCI_HFLAG_32BIT_ONLY),219219+ .flags = AHCI_FLAG_COMMON,220220+ .pio_mask = ATA_PIO4,221221+ .udma_mask = ATA_UDMA6,222222+ .port_ops = &ahci_ops,215223 },216224 [board_ahci_mcp65] = {217225 AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |···448438 { PCI_VDEVICE(INTEL, 0x02d7), board_ahci_pcs_quirk }, /* Comet Lake PCH RAID */449439 /* Elkhart Lake IDs 0x4b60 & 0x4b62 https://sata-io.org/product/8803 not tested yet */450440 { PCI_VDEVICE(INTEL, 0x4b63), board_ahci_pcs_quirk }, /* Elkhart Lake AHCI */441441+442442+ /* JMicron JMB582/585: force 32-bit DMA (broken 64-bit implementation) */443443+ { PCI_VDEVICE(JMICRON, 0x0582), board_ahci_jmb585 },444444+ { PCI_VDEVICE(JMICRON, 0x0585), board_ahci_jmb585 },451445452446 /* JMicron 360/1/3/5/6, match class to avoid IDE function */453447 { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
···369369 if (!mci->layers)370370 goto error;371371372372+ mci->dev.release = mci_release;373373+ device_initialize(&mci->dev);374374+372375 mci->pvt_info = kzalloc(sz_pvt, GFP_KERNEL);373376 if (!mci->pvt_info)374377 goto error;375375-376376- mci->dev.release = mci_release;377377- device_initialize(&mci->dev);378378379379 /* setup index and various internal pointers */380380 mci->mc_idx = mc_num;
+1-1
drivers/firmware/efi/efi-init.c
···6060 * x86 defines its own instance of sysfb_primary_display and uses6161 * it even without EFI, everything else can get them from here.6262 */6363-#if !defined(CONFIG_X86) && (defined(CONFIG_SYSFB) || defined(CONFIG_EFI_EARLYCON)) || defined(CONFIG_FIRMWARE_EDID)6363+#if !defined(CONFIG_X86) && (defined(CONFIG_SYSFB) || defined(CONFIG_EFI_EARLYCON) || defined(CONFIG_FIRMWARE_EDID))6464struct sysfb_display_info sysfb_primary_display __section(".data");6565EXPORT_SYMBOL_GPL(sysfb_primary_display);6666#endif
+6-4
drivers/firmware/microchip/mpfs-auto-update.c
···113113 * be added here.114114 */115115116116- priv->flash = mpfs_sys_controller_get_flash(priv->sys_controller);117117- if (!priv->flash)118118- return FW_UPLOAD_ERR_HW_ERROR;119119-120116 erase_size = round_up(erase_size, (u64)priv->flash->erasesize);121117122118 /*···422426 if (IS_ERR(priv->sys_controller))423427 return dev_err_probe(dev, PTR_ERR(priv->sys_controller),424428 "Could not register as a sub device of the system controller\n");429429+430430+ priv->flash = mpfs_sys_controller_get_flash(priv->sys_controller);431431+ if (IS_ERR_OR_NULL(priv->flash)) {432432+ dev_dbg(dev, "No flash connected to the system controller, auto-update not supported\n");433433+ return -ENODEV;434434+ }425435426436 priv->dev = dev;427437 platform_set_drvdata(pdev, priv);
···148148 /* Just in case everything has gone horribly wrong, give it a kick */149149 intel_engine_flush_submission(engine);150150151151- rq = engine->heartbeat.systole;152152- if (rq && i915_request_completed(rq)) {153153- i915_request_put(rq);154154- engine->heartbeat.systole = NULL;151151+ rq = xchg(&engine->heartbeat.systole, NULL);152152+ if (rq) {153153+ if (i915_request_completed(rq))154154+ i915_request_put(rq);155155+ else156156+ engine->heartbeat.systole = rq;155157 }156158157159 if (!intel_engine_pm_get_if_awake(engine))···234232unlock:235233 mutex_unlock(&ce->timeline->mutex);236234out:237237- if (!engine->i915->params.enable_hangcheck || !next_heartbeat(engine))238238- i915_request_put(fetch_and_zero(&engine->heartbeat.systole));235235+ if (!engine->i915->params.enable_hangcheck || !next_heartbeat(engine)) {236236+ rq = xchg(&engine->heartbeat.systole, NULL);237237+ if (rq)238238+ i915_request_put(rq);239239+ }239240 intel_engine_pm_put(engine);240241}241242···252247253248void intel_engine_park_heartbeat(struct intel_engine_cs *engine)254249{255255- if (cancel_delayed_work(&engine->heartbeat.work))256256- i915_request_put(fetch_and_zero(&engine->heartbeat.systole));250250+ if (cancel_delayed_work(&engine->heartbeat.work)) {251251+ struct i915_request *rq;252252+253253+ rq = xchg(&engine->heartbeat.systole, NULL);254254+ if (rq)255255+ i915_request_put(rq);256256+ }257257}258258259259void intel_gt_unpark_heartbeats(struct intel_gt *gt)
+3
drivers/gpu/drm/vc4/vc4_bo.c
···738738 return -EINVAL;739739 }740740741741+ mutex_lock(&bo->madv_lock);741742 if (bo->madv != VC4_MADV_WILLNEED) {742743 DRM_DEBUG("mmapping of %s BO not allowed\n",743744 bo->madv == VC4_MADV_DONTNEED ?744745 "purgeable" : "purged");746746+ mutex_unlock(&bo->madv_lock);745747 return -EINVAL;746748 }749749+ mutex_unlock(&bo->madv_lock);747750748751 return drm_gem_dma_mmap(&bo->base, vma);749752}
+11-8
drivers/gpu/drm/vc4/vc4_gem.c
···6262 for (i = 0; i < state->user_state.bo_count; i++)6363 drm_gem_object_put(state->bo[i]);64646565+ kfree(state->bo);6566 kfree(state);6667}6768···171170 spin_lock_irqsave(&vc4->job_lock, irqflags);172171 exec[0] = vc4_first_bin_job(vc4);173172 exec[1] = vc4_first_render_job(vc4);174174- if (!exec[0] && !exec[1]) {175175- spin_unlock_irqrestore(&vc4->job_lock, irqflags);176176- return;177177- }173173+ if (!exec[0] && !exec[1])174174+ goto err_free_state;178175179176 /* Get the bos from both binner and renderer into hang state. */180177 state->bo_count = 0;···189190 kernel_state->bo = kzalloc_objs(*kernel_state->bo, state->bo_count,190191 GFP_ATOMIC);191192192192- if (!kernel_state->bo) {193193- spin_unlock_irqrestore(&vc4->job_lock, irqflags);194194- return;195195- }193193+ if (!kernel_state->bo)194194+ goto err_free_state;196195197196 k = 0;198197 for (i = 0; i < 2; i++) {···282285 vc4->hang_state = kernel_state;283286 spin_unlock_irqrestore(&vc4->job_lock, irqflags);284287 }288288+289289+ return;290290+291291+err_free_state:292292+ spin_unlock_irqrestore(&vc4->job_lock, irqflags);293293+ kfree(kernel_state);285294}286295287296static void
+1
drivers/gpu/drm/vc4/vc4_v3d.c
···481481482482 pm_runtime_use_autosuspend(dev);483483 pm_runtime_set_autosuspend_delay(dev, 40); /* a little over 2 frames. */484484+ pm_runtime_put_autosuspend(dev);484485485486 return 0;486487
···12271227 case 0x1bc: map_key_clear(KEY_MESSENGER); break;12281228 case 0x1bd: map_key_clear(KEY_INFO); break;12291229 case 0x1cb: map_key_clear(KEY_ASSISTANT); break;12301230+ case 0x1cc: map_key_clear(KEY_ACTION_ON_SELECTION); break;12311231+ case 0x1cd: map_key_clear(KEY_CONTEXTUAL_INSERT); break;12321232+ case 0x1ce: map_key_clear(KEY_CONTEXTUAL_QUERY); break;12301233 case 0x201: map_key_clear(KEY_NEW); break;12311234 case 0x202: map_key_clear(KEY_OPEN); break;12321235 case 0x203: map_key_clear(KEY_CLOSE); break;
···2525#include <linux/module.h>2626#include <linux/init.h>2727#include <linux/fs.h>2828+#include <linux/lockdep.h>2829#include <linux/miscdevice.h>2930#include <linux/overflow.h>3131+#include <linux/spinlock.h>3032#include <linux/input/mt.h>3133#include "../input-compat.h"3234···5957 struct input_dev *dev;6058 struct mutex mutex;6159 enum uinput_state state;6060+ spinlock_t state_lock;6261 wait_queue_head_t waitq;6362 unsigned char ready;6463 unsigned char head;···7774{7875 struct uinput_device *udev = input_get_drvdata(dev);7976 struct timespec64 ts;7777+7878+ lockdep_assert_held(&dev->event_lock);80798180 ktime_get_ts64(&ts);8281···151146static int uinput_request_send(struct uinput_device *udev,152147 struct uinput_request *request)153148{154154- int retval;149149+ unsigned long flags;150150+ int retval = 0;155151156156- retval = mutex_lock_interruptible(&udev->mutex);157157- if (retval)158158- return retval;152152+ spin_lock(&udev->state_lock);159153160154 if (udev->state != UIST_CREATED) {161155 retval = -ENODEV;162156 goto out;163157 }164158165165- init_completion(&request->done);166166-167159 /*168160 * Tell our userspace application about this new request169161 * by queueing an input event.170162 */163163+ spin_lock_irqsave(&udev->dev->event_lock, flags);171164 uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);165165+ spin_unlock_irqrestore(&udev->dev->event_lock, flags);172166173167 out:174174- mutex_unlock(&udev->mutex);168168+ spin_unlock(&udev->state_lock);175169 return retval;176170}177171···178174 struct uinput_request *request)179175{180176 int retval;177177+178178+ /*179179+ * Initialize completion before allocating the request slot.180180+ * Once the slot is allocated, uinput_flush_requests() may181181+ * complete it at any time, so it must be initialized first.182182+ */183183+ init_completion(&request->done);181184182185 retval = uinput_request_reserve_slot(udev, request);183186 if (retval)···300289 struct input_dev *dev = udev->dev;301290 enum uinput_state old_state = udev->state;302291292292+ /*293293+ * Update state under state_lock so that concurrent294294+ * uinput_request_send() sees the state change before we295295+ * flush pending requests and tear down the device.296296+ */297297+ spin_lock(&udev->state_lock);303298 udev->state = UIST_NEW_DEVICE;299299+ spin_unlock(&udev->state_lock);304300305301 if (dev) {306302 name = dev->name;···384366 if (error)385367 goto fail2;386368369369+ spin_lock(&udev->state_lock);387370 udev->state = UIST_CREATED;371371+ spin_unlock(&udev->state_lock);388372389373 return 0;390374···404384 return -ENOMEM;405385406386 mutex_init(&newdev->mutex);387387+ spin_lock_init(&newdev->state_lock);407388 spin_lock_init(&newdev->requests_lock);408389 init_waitqueue_head(&newdev->requests_waitq);409390 init_waitqueue_head(&newdev->waitq);
+6
drivers/iommu/iommu.c
···2717271727182718 pr_debug("unmapped: iova 0x%lx size 0x%zx\n",27192719 iova, unmapped_page);27202720+ /*27212721+ * If the driver itself isn't using the gather, make sure27222722+ * it looks non-empty so iotlb_sync will still be called.27232723+ */27242724+ if (iotlb_gather->start >= iotlb_gather->end)27252725+ iommu_iotlb_gather_add_range(iotlb_gather, iova, size);2720272627212727 iova += unmapped_page;27222728 unmapped += unmapped_page;
+12-7
drivers/mmc/host/vub300.c
···369369static void vub300_delete(struct kref *kref)370370{ /* kref callback - softirq */371371 struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref);372372+ struct mmc_host *mmc = vub300->mmc;373373+372374 usb_free_urb(vub300->command_out_urb);373375 vub300->command_out_urb = NULL;374376 usb_free_urb(vub300->command_res_urb);375377 vub300->command_res_urb = NULL;376378 usb_put_dev(vub300->udev);379379+ mmc_free_host(mmc);377380 /*378381 * and hence also frees vub300379382 * which is contained at the end of struct mmc···21152112 goto error1;21162113 }21172114 /* this also allocates memory for our VUB300 mmc host device */21182118- mmc = devm_mmc_alloc_host(&udev->dev, sizeof(*vub300));21152115+ mmc = mmc_alloc_host(sizeof(*vub300), &udev->dev);21192116 if (!mmc) {21202117 retval = -ENOMEM;21212118 dev_err(&udev->dev, "not enough memory for the mmc_host\n");···22722269 dev_err(&vub300->udev->dev,22732270 "Could not find two sets of bulk-in/out endpoint pairs\n");22742271 retval = -EINVAL;22752275- goto error4;22722272+ goto err_free_host;22762273 }22772274 retval =22782275 usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),···22812278 0x0000, 0x0000, &vub300->hc_info,22822279 sizeof(vub300->hc_info), 1000);22832280 if (retval < 0)22842284- goto error4;22812281+ goto err_free_host;22852282 retval =22862283 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),22872284 SET_ROM_WAIT_STATES,22882285 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,22892286 firmware_rom_wait_states, 0x0000, NULL, 0, 1000);22902287 if (retval < 0)22912291- goto error4;22882288+ goto err_free_host;22922289 dev_info(&vub300->udev->dev,22932290 "operating_mode = %s %s %d MHz %s %d byte USB packets\n",22942291 (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",···23032300 0x0000, 0x0000, &vub300->system_port_status,23042301 sizeof(vub300->system_port_status), 1000);23052302 if (retval < 0) {23062306- goto error4;23032303+ goto err_free_host;23072304 } else if (sizeof(vub300->system_port_status) == retval) {23082305 vub300->card_present =23092306 (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;···23112308 (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;23122309 } else {23132310 retval = -EINVAL;23142314- goto error4;23112311+ goto err_free_host;23152312 }23162313 usb_set_intfdata(interface, vub300);23172314 INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);···23412338 return 0;23422339error6:23432340 timer_delete_sync(&vub300->inactivity_timer);23412341+err_free_host:23422342+ mmc_free_host(mmc);23442343 /*23452344 * and hence also frees vub30023462345 * which is contained at the end of struct mmc···23702365 usb_set_intfdata(interface, NULL);23712366 /* prevent more I/O from starting */23722367 vub300->interface = NULL;23732373- kref_put(&vub300->kref, vub300_delete);23742368 mmc_remove_host(mmc);23692369+ kref_put(&vub300->kref, vub300_delete);23752370 pr_info("USB vub300 remote SDIO host controller[%d]"23762371 " now disconnected", ifnum);23772372 return;
+2-2
drivers/net/bonding/bond_sysfs.c
···808808 sysfs_attr_init(&bn->class_attr_bonding_masters.attr);809809810810 ret = netdev_class_create_file_ns(&bn->class_attr_bonding_masters,811811- bn->net);811811+ to_ns_common(bn->net));812812 /* Permit multiple loads of the module by ignoring failures to813813 * create the bonding_masters sysfs file. Bonding devices814814 * created by second or subsequent loads of the module will···835835/* Remove /sys/class/net/bonding_masters. */836836void __net_exit bond_destroy_sysfs(struct bond_net *bn)837837{838838- netdev_class_remove_file_ns(&bn->class_attr_bonding_masters, bn->net);838838+ netdev_class_remove_file_ns(&bn->class_attr_bonding_masters, to_ns_common(bn->net));839839}840840841841/* Initialize sysfs for each bond. This sets up and registers
···570570 DMA_TO_DEVICE);571571 if (dma_mapping_error(priv->device, dma_addr)) {572572 netdev_err(priv->dev, "%s: DMA mapping error\n", __func__);573573+ dev_kfree_skb_any(skb);573574 ret = NETDEV_TX_OK;574575 goto out;575576 }
+1-1
drivers/net/ethernet/freescale/Kconfig
···2828 depends on PTP_1588_CLOCK_OPTIONAL2929 select CRC323030 select PHYLIB3131- select FIXED_PHY if M52723131+ select FIXED_PHY3232 select PAGE_POOL3333 imply PAGE_POOL_STATS3434 imply NET_SELFTESTS
+7-1
drivers/net/ethernet/intel/e1000/e1000_ethtool.c
···496496 */497497 ret_val = e1000_read_eeprom(hw, first_word, 1,498498 &eeprom_buff[0]);499499+ if (ret_val)500500+ goto out;501501+499502 ptr++;500503 }501501- if (((eeprom->offset + eeprom->len) & 1) && (ret_val == 0)) {504504+ if ((eeprom->offset + eeprom->len) & 1) {502505 /* need read/modify/write of last changed EEPROM word503506 * only the first byte of the word is being modified504507 */505508 ret_val = e1000_read_eeprom(hw, last_word, 1,506509 &eeprom_buff[last_word - first_word]);510510+ if (ret_val)511511+ goto out;507512 }508513509514 /* Device's eeprom is always little-endian, word addressable */···527522 if ((ret_val == 0) && (first_word <= EEPROM_CHECKSUM_REG))528523 e1000_update_eeprom_checksum(hw);529524525525+out:530526 kfree(eeprom_buff);531527 return ret_val;532528}
+19-11
drivers/net/ethernet/intel/ice/ice_ptp.c
···12961296 if (pf->hw.reset_ongoing)12971297 return;1298129812991299- if (hw->mac_type == ICE_MAC_GENERIC_3K_E825) {12991299+ if (hw->mac_type == ICE_MAC_GENERIC_3K_E825 &&13001300+ test_bit(ICE_FLAG_DPLL, pf->flags)) {13001301 int pin, err;13011301-13021302- if (!test_bit(ICE_FLAG_DPLL, pf->flags))13031303- return;1304130213051303 mutex_lock(&pf->dplls.lock);13061304 for (pin = 0; pin < ICE_SYNCE_CLK_NUM; pin++) {···13121314 port_num,13131315 &active,13141316 clk_pin);13151315- if (WARN_ON_ONCE(err)) {13161316- mutex_unlock(&pf->dplls.lock);13171317- return;13171317+ if (err) {13181318+ dev_err_once(ice_pf_to_dev(pf),13191319+ "Failed to read SyncE bypass mux for pin %d, err %d\n",13201320+ pin, err);13211321+ break;13181322 }1319132313201324 err = ice_tspll_cfg_synce_ethdiv_e825c(hw, clk_pin);13211321- if (active && WARN_ON_ONCE(err)) {13221322- mutex_unlock(&pf->dplls.lock);13231323- return;13251325+ if (active && err) {13261326+ dev_err_once(ice_pf_to_dev(pf),13271327+ "Failed to configure SyncE ETH divider for pin %d, err %d\n",13281328+ pin, err);13291329+ break;13241330 }13251331 }13261332 mutex_unlock(&pf->dplls.lock);···30823080 struct ice_ptp *ctrl_ptp = ice_get_ctrl_ptp(pf);30833081 struct ice_ptp *ptp = &pf->ptp;3084308230853085- if (WARN_ON(!ctrl_ptp) || pf->hw.mac_type == ICE_MAC_UNKNOWN)30833083+ if (!ctrl_ptp) {30843084+ dev_info(ice_pf_to_dev(pf),30853085+ "PTP unavailable: no controlling PF\n");30863086+ return -EOPNOTSUPP;30873087+ }30883088+30893089+ if (pf->hw.mac_type == ICE_MAC_UNKNOWN)30863090 return -ENODEV;3087309130883092 INIT_LIST_HEAD(&ptp->port.list_node);
+11-9
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
···287287 return err;288288}289289290290-/* API for virtchnl "transaction" support ("xn" for short).291291- *292292- * We are reusing the completion lock to serialize the accesses to the293293- * transaction state for simplicity, but it could be its own separate synchro294294- * as well. For now, this API is only used from within a workqueue context;295295- * raw_spin_lock() is enough.296296- */290290+/* API for virtchnl "transaction" support ("xn" for short). */291291+297292/**298293 * idpf_vc_xn_lock - Request exclusive access to vc transaction299294 * @xn: struct idpf_vc_xn* to access300295 */301296#define idpf_vc_xn_lock(xn) \302302- raw_spin_lock(&(xn)->completed.wait.lock)297297+ spin_lock(&(xn)->lock)303298304299/**305300 * idpf_vc_xn_unlock - Release exclusive access to vc transaction306301 * @xn: struct idpf_vc_xn* to access307302 */308303#define idpf_vc_xn_unlock(xn) \309309- raw_spin_unlock(&(xn)->completed.wait.lock)304304+ spin_unlock(&(xn)->lock)310305311306/**312307 * idpf_vc_xn_release_bufs - Release reference to reply buffer(s) and···333338 xn->state = IDPF_VC_XN_IDLE;334339 xn->idx = i;335340 idpf_vc_xn_release_bufs(xn);341341+ spin_lock_init(&xn->lock);336342 init_completion(&xn->completed);337343 }338344···402406 struct idpf_vc_xn *xn)403407{404408 idpf_vc_xn_release_bufs(xn);409409+ spin_lock_bh(&vcxn_mngr->xn_bm_lock);405410 set_bit(xn->idx, vcxn_mngr->free_xn_bm);411411+ spin_unlock_bh(&vcxn_mngr->xn_bm_lock);406412}407413408414/**···615617 err = -ENXIO;616618 goto out_unlock;617619 case IDPF_VC_XN_ASYNC:620620+ /* Set reply_sz from the actual payload so that async_handler621621+ * can evaluate the response.622622+ */623623+ xn->reply_sz = ctlq_msg->data_len;618624 err = idpf_vc_xn_forward_async(adapter, xn, ctlq_msg);619625 idpf_vc_xn_unlock(xn);620626 return err;
+3-2
drivers/net/ethernet/intel/idpf/idpf_virtchnl.h
···4242 * struct idpf_vc_xn - Data structure representing virtchnl transactions4343 * @completed: virtchnl event loop uses that to signal when a reply is4444 * available, uses kernel completion API4545- * @state: virtchnl event loop stores the data below, protected by the4646- * completion's lock.4545+ * @lock: protects the transaction state fields below4646+ * @state: virtchnl event loop stores the data below, protected by @lock4747 * @reply_sz: Original size of reply, may be > reply_buf.iov_len; it will be4848 * truncated on its way to the receiver thread according to4949 * reply_buf.iov_len.···5858 */5959struct idpf_vc_xn {6060 struct completion completed;6161+ spinlock_t lock;6162 enum idpf_vc_xn_state state;6263 size_t reply_sz;6364 struct kvec reply;
+1-2
drivers/net/ethernet/intel/igb/igb_main.c
···2203220322042204 for (i = 0; i < adapter->num_q_vectors; i++) {22052205 if (adapter->q_vector[i]) {22062206- napi_synchronize(&adapter->q_vector[i]->napi);22072207- igb_set_queue_napi(adapter, i, NULL);22082206 napi_disable(&adapter->q_vector[i]->napi);22072207+ igb_set_queue_napi(adapter, i, NULL);22092208 }22102209 }22112210
···11551155 return ret_val;11561156}1157115711581158-void ixgbe_refresh_fw_version(struct ixgbe_adapter *adapter)11581158+int ixgbe_refresh_fw_version(struct ixgbe_adapter *adapter)11591159{11601160 struct ixgbe_hw *hw = &adapter->hw;11611161+ int err;1161116211621162- ixgbe_get_flash_data(hw);11631163+ err = ixgbe_get_flash_data(hw);11641164+ if (err)11651165+ return err;11661166+11631167 ixgbe_set_fw_version_e610(adapter);11681168+ return 0;11641169}1165117011661171static void ixgbe_get_drvinfo(struct net_device *netdev,11671172 struct ethtool_drvinfo *drvinfo)11681173{11691174 struct ixgbe_adapter *adapter = ixgbe_from_netdev(netdev);11701170-11711171- /* need to refresh info for e610 in case fw reloads in runtime */11721172- if (adapter->hw.mac.type == ixgbe_mac_e610)11731173- ixgbe_refresh_fw_version(adapter);1174117511751176 strscpy(drvinfo->driver, ixgbe_driver_name, sizeof(drvinfo->driver));11761177
+10
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
···62896289 if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED)62906290 msleep(2000);62916291 ixgbe_up(adapter);62926292+62936293+ /* E610 has no FW event to notify all PFs of an EMPR reset, so62946294+ * refresh the FW version here to pick up any new FW version after62956295+ * a hardware reset (e.g. EMPR triggered by another PF's devlink62966296+ * reload). ixgbe_refresh_fw_version() updates both hw->flash and62976297+ * adapter->eeprom_id so ethtool -i reports the correct string.62986298+ */62996299+ if (adapter->hw.mac.type == ixgbe_mac_e610)63006300+ (void)ixgbe_refresh_fw_version(adapter);63016301+62926302 clear_bit(__IXGBE_RESETTING, &adapter->state);62936303}62946304
···9191 pp_params.dma_dir = DMA_BIDIRECTIONAL;92929393 rx->page_pool = page_pool_create(&pp_params);9494+ if (unlikely(IS_ERR(rx->page_pool)))9595+ return PTR_ERR(rx->page_pool);94969597 for (int i = 0; i < lan966x->num_phys_ports; ++i) {9698 struct lan966x_port *port;···119117 return PTR_ERR(rx->page_pool);120118121119 err = fdma_alloc_coherent(lan966x->dev, fdma);122122- if (err)120120+ if (err) {121121+ page_pool_destroy(rx->page_pool);123122 return err;123123+ }124124125125 fdma_dcbs_init(fdma, FDMA_DCB_INFO_DATAL(fdma->db_size),126126 FDMA_DCB_STATUS_INTR);···812808813809static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)814810{811811+ struct page *(*old_pages)[FDMA_RX_DCB_MAX_DBS];815812 struct page_pool *page_pool;816813 struct fdma fdma_rx_old;817817- int err;814814+ int err, i, j;815815+816816+ old_pages = kmemdup(lan966x->rx.page, sizeof(lan966x->rx.page),817817+ GFP_KERNEL);818818+ if (!old_pages)819819+ return -ENOMEM;818820819821 /* Store these for later to free them */820822 memcpy(&fdma_rx_old, &lan966x->rx.fdma, sizeof(struct fdma));···831821 lan966x_fdma_stop_netdev(lan966x);832822833823 lan966x_fdma_rx_disable(&lan966x->rx);834834- lan966x_fdma_rx_free_pages(&lan966x->rx);835824 lan966x->rx.page_order = round_up(new_mtu, PAGE_SIZE) / PAGE_SIZE - 1;836825 lan966x->rx.max_mtu = new_mtu;837826 err = lan966x_fdma_rx_alloc(&lan966x->rx);838827 if (err)839828 goto restore;840829 lan966x_fdma_rx_start(&lan966x->rx);830830+831831+ for (i = 0; i < fdma_rx_old.n_dcbs; ++i)832832+ for (j = 0; j < fdma_rx_old.n_dbs; ++j)833833+ page_pool_put_full_page(page_pool,834834+ old_pages[i][j], false);841835842836 fdma_free_coherent(lan966x->dev, &fdma_rx_old);843837···850836 lan966x_fdma_wakeup_netdev(lan966x);851837 napi_enable(&lan966x->napi);852838853853- return err;839839+ kfree(old_pages);840840+ return 0;854841restore:855842 lan966x->rx.page_pool = page_pool;856843 memcpy(&lan966x->rx.fdma, &fdma_rx_old, sizeof(struct fdma));857844 lan966x_fdma_rx_start(&lan966x->rx);858845846846+ lan966x_fdma_wakeup_netdev(lan966x);847847+ napi_enable(&lan966x->napi);848848+849849+ kfree(old_pages);859850 return err;860851}861852···974955 err = lan966x_fdma_tx_alloc(&lan966x->tx);975956 if (err) {976957 fdma_free_coherent(lan966x->dev, &lan966x->rx.fdma);958958+ page_pool_destroy(lan966x->rx.page_pool);977959 return err;978960 }979961
+1-1
drivers/net/ethernet/qualcomm/qca_uart.c
···100100 if (!qca->rx_skb) {101101 netdev_dbg(netdev, "recv: out of RX resources\n");102102 n_stats->rx_errors++;103103- return i;103103+ return i + 1;104104 }105105 }106106 }
+6-5
drivers/net/ethernet/stmicro/stmmac/chain_mode.c
···2020 unsigned int nopaged_len = skb_headlen(skb);2121 struct stmmac_priv *priv = tx_q->priv_data;2222 unsigned int entry = tx_q->cur_tx;2323- unsigned int bmax, des2;2323+ unsigned int bmax, buf_len, des2;2424 unsigned int i = 1, len;2525 struct dma_desc *desc;2626···3131 else3232 bmax = BUF_SIZE_2KiB;33333434- len = nopaged_len - bmax;3434+ buf_len = min_t(unsigned int, nopaged_len, bmax);3535+ len = nopaged_len - buf_len;35363637 des2 = dma_map_single(priv->device, skb->data,3737- bmax, DMA_TO_DEVICE);3838+ buf_len, DMA_TO_DEVICE);3839 desc->des2 = cpu_to_le32(des2);3940 if (dma_mapping_error(priv->device, des2))4041 return -1;4142 tx_q->tx_skbuff_dma[entry].buf = des2;4242- tx_q->tx_skbuff_dma[entry].len = bmax;4343+ tx_q->tx_skbuff_dma[entry].len = buf_len;4344 /* do not close the descriptor and do not set own bit */4444- stmmac_prepare_tx_desc(priv, desc, 1, bmax, csum, STMMAC_CHAIN_MODE,4545+ stmmac_prepare_tx_desc(priv, desc, 1, buf_len, csum, STMMAC_CHAIN_MODE,4546 0, false, skb->len);46474748 while (len != 0) {
···66 */7788#include <linux/bits.h>99+#include <linux/delay.h>910#include <linux/dev_printk.h>1011#include <linux/io.h>1112#include <linux/iopoll.h>···334333 dev_warn(&pdev->dev, "failed to disable L1 state: %d\n", ret);335334336335 motorcomm_reset(priv);336336+337337+ /*338338+ * After system reset, the eFuse controller needs time to load339339+ * its internal data. Without this delay, eFuse reads return340340+ * all zeros, causing MAC address detection to fail.341341+ */342342+ usleep_range(2000, 5000);337343338344 ret = motorcomm_efuse_read_mac(&pdev->dev, priv, res.mac);339345 if (ret == -ENOENT) {
+17-2
drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c
···99#include "stmmac_platform.h"10101111static const char *const mgbe_clks[] = {1212- "rx-pcs", "tx", "tx-pcs", "mac-divider", "mac", "mgbe", "ptp-ref", "mac"1212+ "rx-pcs", "tx", "tx-pcs", "mac-divider", "mac", "mgbe", "ptp_ref", "mac"1313};14141515struct tegra_mgbe {···215215{216216 struct plat_stmmacenet_data *plat;217217 struct stmmac_resources res;218218+ bool use_legacy_ptp = false;218219 struct tegra_mgbe *mgbe;219220 int irq, err, i;220221 u32 value;···258257 if (!mgbe->clks)259258 return -ENOMEM;260259261261- for (i = 0; i < ARRAY_SIZE(mgbe_clks); i++)260260+ /* Older device-trees use 'ptp-ref' rather than 'ptp_ref'.261261+ * Fall back when the legacy name is present.262262+ */263263+ if (of_property_match_string(pdev->dev.of_node, "clock-names",264264+ "ptp-ref") >= 0)265265+ use_legacy_ptp = true;266266+267267+ for (i = 0; i < ARRAY_SIZE(mgbe_clks); i++) {262268 mgbe->clks[i].id = mgbe_clks[i];269269+270270+ if (use_legacy_ptp && !strcmp(mgbe_clks[i], "ptp_ref")) {271271+ dev_warn(mgbe->dev,272272+ "Device-tree update needed for PTP clock!\n");273273+ mgbe->clks[i].id = "ptp-ref";274274+ }275275+ }263276264277 err = devm_clk_bulk_get(mgbe->dev, ARRAY_SIZE(mgbe_clks), mgbe->clks);265278 if (err < 0)
···543543 SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,544544 sfp_fixup_ignore_tx_fault_and_los),545545546546+ // Hisense LXT-010S-H is a GPON ONT SFP (sold as LEOX LXT-010S-H) that547547+ // can operate at 2500base-X, but reports 1000BASE-LX / 1300MBd in its548548+ // EEPROM549549+ SFP_QUIRK("Hisense-Leox", "LXT-010S-H", sfp_quirk_2500basex,550550+ sfp_fixup_ignore_tx_fault),551551+552552+ // Hisense ZNID-GPON-2311NA can operate at 2500base-X, but reports553553+ // 1000BASE-LX / 1300MBd in its EEPROM554554+ SFP_QUIRK("Hisense", "ZNID-GPON-2311NA", sfp_quirk_2500basex,555555+ sfp_fixup_ignore_tx_fault),556556+557557+ // HSGQ HSGQ-XPON-Stick can operate at 2500base-X, but reports558558+ // 1000BASE-LX / 1300MBd in its EEPROM559559+ SFP_QUIRK("HSGQ", "HSGQ-XPON-Stick", sfp_quirk_2500basex,560560+ sfp_fixup_ignore_tx_fault),561561+546562 // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but547563 // incorrectly report 2500MBd NRZ in their EEPROM.548564 // Some 8330-265D modules have inverted LOS, while all of them report
+8-5
drivers/net/wan/lapbether.c
···446446static int lapbeth_device_event(struct notifier_block *this,447447 unsigned long event, void *ptr)448448{449449- struct lapbethdev *lapbeth;450449 struct net_device *dev = netdev_notifier_info_to_dev(ptr);450450+ struct lapbethdev *lapbeth;451451452452 if (dev_net(dev) != &init_net)453453 return NOTIFY_DONE;454454455455- if (!dev_is_ethdev(dev) && !lapbeth_get_x25_dev(dev))455455+ lapbeth = lapbeth_get_x25_dev(dev);456456+ if (!dev_is_ethdev(dev) && !lapbeth)456457 return NOTIFY_DONE;457458458459 switch (event) {459460 case NETDEV_UP:460461 /* New ethernet device -> new LAPB interface */461461- if (!lapbeth_get_x25_dev(dev))462462+ if (!lapbeth)462463 lapbeth_new_device(dev);463464 break;464465 case NETDEV_GOING_DOWN:465466 /* ethernet device closes -> close LAPB interface */466466- lapbeth = lapbeth_get_x25_dev(dev);467467 if (lapbeth)468468 dev_close(lapbeth->axdev);469469 break;470470 case NETDEV_UNREGISTER:471471 /* ethernet device disappears -> remove LAPB interface */472472- lapbeth = lapbeth_get_x25_dev(dev);473472 if (lapbeth)474473 lapbeth_free_device(lapbeth);475474 break;475475+ case NETDEV_PRE_TYPE_CHANGE:476476+ /* Our underlying device type must not change. */477477+ if (lapbeth)478478+ return NOTIFY_BAD;476479 }477480478481 return NOTIFY_DONE;
···483483 if (((desc_strtaddr + size - 1) & boundary) != (desc_strtaddr484484 & boundary)) {485485 *alignbits = dma_align_sizetobits(size);486486- dma_free_coherent(di->dmadev, size, va, *descpa);486486+ dma_free_coherent(di->dmadev, *alloced, va, *descpa);487487 va = dma_alloc_consistent(di, size, *alignbits,488488 alloced, descpa);489489 }
+1-1
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
···828828 if (retval)829829 goto exit_free_device;830830831831- rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,831831+ rt2x00dev->anchor = devm_kmalloc(&usb_intf->dev,832832 sizeof(struct usb_anchor),833833 GFP_KERNEL);834834 if (!rt2x00dev->anchor) {
+8-3
drivers/nfc/pn533/uart.c
···211211212212 timer_delete(&dev->cmd_timeout);213213 for (i = 0; i < count; i++) {214214+ if (!dev->recv_skb) {215215+ dev->recv_skb = alloc_skb(PN532_UART_SKB_BUFF_LEN,216216+ GFP_KERNEL);217217+ if (!dev->recv_skb)218218+ return i;219219+ }220220+214221 if (unlikely(!skb_tailroom(dev->recv_skb)))215222 skb_trim(dev->recv_skb, 0);216223···226219 continue;227220228221 pn533_recv_frame(dev->priv, dev->recv_skb, 0);229229- dev->recv_skb = alloc_skb(PN532_UART_SKB_BUFF_LEN, GFP_KERNEL);230230- if (!dev->recv_skb)231231- return 0;222222+ dev->recv_skb = NULL;232223 }233224234225 return i;
+7-3
drivers/nfc/s3fwrn5/uart.c
···5858 size_t i;59596060 for (i = 0; i < count; i++) {6161+ if (!phy->recv_skb) {6262+ phy->recv_skb = alloc_skb(NCI_SKB_BUFF_LEN, GFP_KERNEL);6363+ if (!phy->recv_skb)6464+ return i;6565+ }6666+6167 skb_put_u8(phy->recv_skb, *data++);62686369 if (phy->recv_skb->len < S3FWRN82_NCI_HEADER)···75697670 s3fwrn5_recv_frame(phy->common.ndev, phy->recv_skb,7771 phy->common.mode);7878- phy->recv_skb = alloc_skb(NCI_SKB_BUFF_LEN, GFP_KERNEL);7979- if (!phy->recv_skb)8080- return 0;7272+ phy->recv_skb = NULL;8173 }82748375 return i;
+9-3
drivers/pci/controller/pci-hyperv.c
···24852485 if (!hv_dev)24862486 continue;2487248724882488+ /*24892489+ * If the Hyper-V host doesn't provide a NUMA node for the24902490+ * device, default to node 0. With NUMA_NO_NODE the kernel24912491+ * may spread work across NUMA nodes, which degrades24922492+ * performance on Hyper-V.24932493+ */24942494+ set_dev_node(&dev->dev, 0);24952495+24882496 if (hv_dev->desc.flags & HV_PCI_DEVICE_FLAG_NUMA_AFFINITY &&24892497 hv_dev->desc.virtual_numa_node < num_possible_nodes())24902498 /*···37863778 hbus->bridge->domain_nr);37873779 if (!hbus->wq) {37883780 ret = -ENOMEM;37893789- goto free_dom;37813781+ goto free_bus;37903782 }3791378337923784 hdev->channel->next_request_id_callback = vmbus_next_request_id;···38823874 vmbus_close(hdev->channel);38833875destroy_wq:38843876 destroy_workqueue(hbus->wq);38853885-free_dom:38863886- pci_bus_release_emul_domain_nr(hbus->bridge->domain_nr);38873877free_bus:38883878 kfree(hbus);38893879 return ret;
+26-10
drivers/pinctrl/intel/pinctrl-intel.c
···5353#define PADOWN_MASK(p) (GENMASK(3, 0) << PADOWN_SHIFT(p))5454#define PADOWN_GPP(p) ((p) / 8)55555656-#define PWMC 0x2045757-5856/* Offset from pad_regs */5957#define PADCFG0 0x0006058#define PADCFG0_RXEVCFG_MASK GENMASK(26, 25)···203205 community = intel_get_community(pctrl, pin);204206 if (!community)205207 return false;206206- if (!community->padown_offset)208208+209209+ /* If padown_offset is not provided, assume host ownership */210210+ padown = community->regs + community->padown_offset;211211+ if (padown == community->regs)207212 return true;213213+214214+ /* New HW generations have extended PAD_OWN registers */215215+ if (community->features & PINCTRL_FEATURE_3BIT_PAD_OWN)216216+ return !(readl(padown + pin_to_padno(community, pin) * 4) & 7);208217209218 padgrp = intel_community_get_padgroup(community, pin);210219 if (!padgrp)···219214220215 gpp_offset = padgroup_offset(padgrp, pin);221216 gpp = PADOWN_GPP(gpp_offset);222222- offset = community->padown_offset + padgrp->padown_num * 4 + gpp * 4;223223- padown = community->regs + offset;217217+ offset = padgrp->padown_num * 4 + gpp * 4;224218225225- return !(readl(padown) & PADOWN_MASK(gpp_offset));219219+ return !(readl(padown + offset) & PADOWN_MASK(gpp_offset));226220}227221228222static bool intel_pad_acpi_mode(const struct intel_pinctrl *pctrl, unsigned int pin)···15531549}1554155015551551static int intel_pinctrl_probe_pwm(struct intel_pinctrl *pctrl,15561556- struct intel_community *community)15521552+ struct intel_community *community,15531553+ unsigned short capability_offset)15571554{15551555+ void __iomem *base = community->regs + capability_offset + 4;15581556 static const struct pwm_lpss_boardinfo info = {15591557 .clk_rate = 19200000,15601558 .npwm = 1,···15701564 if (!IS_REACHABLE(CONFIG_PWM_LPSS))15711565 return 0;1572156615731573- chip = devm_pwm_lpss_probe(pctrl->dev, community->regs + PWMC, &info);15671567+ chip = devm_pwm_lpss_probe(pctrl->dev, base, &info);15741568 return PTR_ERR_OR_ZERO(chip);15751569}15761570···1601159516021596 for (i = 0; i < pctrl->ncommunities; i++) {16031597 struct intel_community *community = &pctrl->communities[i];15981598+ unsigned short capability_offset[6];16041599 void __iomem *regs;16001600+ u32 revision;16051601 u32 offset;16061602 u32 value;16071603···16181610 value = readl(regs + REVID);16191611 if (value == ~0u)16201612 return -ENODEV;16211621- if (((value & REVID_MASK) >> REVID_SHIFT) >= 0x94) {16131613+16141614+ revision = (value & REVID_MASK) >> REVID_SHIFT;16151615+ if (revision >= 0x092) {16221616 community->features |= PINCTRL_FEATURE_DEBOUNCE;16231617 community->features |= PINCTRL_FEATURE_1K_PD;16241618 }16191619+ if (revision >= 0x110)16201620+ community->features |= PINCTRL_FEATURE_3BIT_PAD_OWN;1625162116261622 /* Determine community features based on the capabilities */16271623 offset = CAPLIST;···16341622 switch ((value & CAPLIST_ID_MASK) >> CAPLIST_ID_SHIFT) {16351623 case CAPLIST_ID_GPIO_HW_INFO:16361624 community->features |= PINCTRL_FEATURE_GPIO_HW_INFO;16251625+ capability_offset[CAPLIST_ID_GPIO_HW_INFO] = offset;16371626 break;16381627 case CAPLIST_ID_PWM:16391628 community->features |= PINCTRL_FEATURE_PWM;16291629+ capability_offset[CAPLIST_ID_PWM] = offset;16401630 break;16411631 case CAPLIST_ID_BLINK:16421632 community->features |= PINCTRL_FEATURE_BLINK;16331633+ capability_offset[CAPLIST_ID_BLINK] = offset;16431634 break;16441635 case CAPLIST_ID_EXP:16451636 community->features |= PINCTRL_FEATURE_EXP;16371637+ capability_offset[CAPLIST_ID_EXP] = offset;16461638 break;16471639 default:16481640 break;···16691653 if (ret)16701654 return ret;1671165516721672- ret = intel_pinctrl_probe_pwm(pctrl, community);16561656+ ret = intel_pinctrl_probe_pwm(pctrl, community, capability_offset[CAPLIST_ID_PWM]);16731657 if (ret)16741658 return ret;16751659 }
+1
drivers/pinctrl/intel/pinctrl-intel.h
···150150#define PINCTRL_FEATURE_PWM BIT(3)151151#define PINCTRL_FEATURE_BLINK BIT(4)152152#define PINCTRL_FEATURE_EXP BIT(5)153153+#define PINCTRL_FEATURE_3BIT_PAD_OWN BIT(6)153154154155#define __INTEL_COMMUNITY(b, s, e, g, n, gs, gn, soc) \155156 { \
+9
drivers/pinctrl/pinctrl-mcp23s08.c
···664664 if (mcp->irq && mcp->irq_controller) {665665 struct gpio_irq_chip *girq = &mcp->chip.irq;666666667667+ /*668668+ * Disable all pin interrupts, to prevent the interrupt handler from669669+ * calling nested handlers for any currently-enabled interrupts that670670+ * do not (yet) have an actual handler.671671+ */672672+ ret = mcp_write(mcp, MCP_GPINTEN, 0);673673+ if (ret < 0)674674+ return dev_err_probe(dev, ret, "can't disable interrupts\n");675675+667676 gpio_irq_chip_set_chip(girq, &mcp23s08_irq_chip);668677 /* This will let us handle the parent IRQ in the driver */669678 girq->parent_handler = NULL;
···36363737/* Supported SST hardware version by this driver */3838#define ISST_MAJOR_VERSION 03939-#define ISST_MINOR_VERSION 23939+#define ISST_MINOR_VERSION 340404141/*4242 * Used to indicate if value read from MMIO needs to get multiplied···14601460 j * SST_TF_RATIO_0_WIDTH, SST_TF_RATIO_0_WIDTH,14611461 SST_MUL_FACTOR_FREQ)14621462 }14631463+14641464+ memset(turbo_freq.bucket_core_counts, 0, sizeof(turbo_freq.bucket_core_counts));1463146514641466 if (feature_rev >= 2) {14651467 bool has_tf_info_8 = false;
···3939 unsigned int i;40404141 for (i = 0 ; i < ARRAY_SIZE(rev_table) ; ++i) {4242- if (rev_table[i].id == id)4242+ if ((rev_table[i].id & 0xff00ffff) == id)4343 return rev_table[i].name;4444 }4545
···381381{382382 struct spi_controller *ctlr = spi->controller;383383 struct zynq_qspi *qspi = spi_controller_get_devdata(ctlr);384384- int ret;385384386385 if (ctlr->busy)387386 return -EBUSY;388388-389389- ret = clk_enable(qspi->refclk);390390- if (ret)391391- return ret;392392-393393- ret = clk_enable(qspi->pclk);394394- if (ret) {395395- clk_disable(qspi->refclk);396396- return ret;397397- }398387399388 zynq_qspi_write(qspi, ZYNQ_QSPI_ENABLE_OFFSET,400389 ZYNQ_QSPI_ENABLE_ENABLE_MASK);···650661 goto remove_ctlr;651662 }652663653653- xqspi->pclk = devm_clk_get(&pdev->dev, "pclk");664664+ xqspi->pclk = devm_clk_get_enabled(&pdev->dev, "pclk");654665 if (IS_ERR(xqspi->pclk)) {655666 dev_err(&pdev->dev, "pclk clock not found.\n");656667 ret = PTR_ERR(xqspi->pclk);···659670660671 init_completion(&xqspi->data_completion);661672662662- xqspi->refclk = devm_clk_get(&pdev->dev, "ref_clk");673673+ xqspi->refclk = devm_clk_get_enabled(&pdev->dev, "ref_clk");663674 if (IS_ERR(xqspi->refclk)) {664675 dev_err(&pdev->dev, "ref_clk clock not found.\n");665676 ret = PTR_ERR(xqspi->refclk);666677 goto remove_ctlr;667678 }668679669669- ret = clk_prepare_enable(xqspi->pclk);670670- if (ret) {671671- dev_err(&pdev->dev, "Unable to enable APB clock.\n");672672- goto remove_ctlr;673673- }674674-675675- ret = clk_prepare_enable(xqspi->refclk);676676- if (ret) {677677- dev_err(&pdev->dev, "Unable to enable device clock.\n");678678- goto clk_dis_pclk;679679- }680680-681680 xqspi->irq = platform_get_irq(pdev, 0);682681 if (xqspi->irq < 0) {683682 ret = xqspi->irq;684684- goto clk_dis_all;683683+ goto remove_ctlr;685684 }686685 ret = devm_request_irq(&pdev->dev, xqspi->irq, zynq_qspi_irq,687686 0, pdev->name, xqspi);688687 if (ret != 0) {689688 ret = -ENXIO;690689 dev_err(&pdev->dev, "request_irq failed\n");691691- goto clk_dis_all;690690+ goto remove_ctlr;692691 }693692694693 ret = of_property_read_u32(np, "num-cs",···686709 } else if (num_cs > ZYNQ_QSPI_MAX_NUM_CS) {687710 ret = -EINVAL;688711 dev_err(&pdev->dev, "only 2 chip selects are available\n");689689- goto clk_dis_all;712712+ goto remove_ctlr;690713 } else {691714 ctlr->num_chipselect = num_cs;692715 }···705728 ret = devm_spi_register_controller(&pdev->dev, ctlr);706729 if (ret) {707730 dev_err(&pdev->dev, "devm_spi_register_controller failed\n");708708- goto clk_dis_all;731731+ goto remove_ctlr;709732 }710733711734 return ret;712735713713-clk_dis_all:714714- clk_disable_unprepare(xqspi->refclk);715715-clk_dis_pclk:716716- clk_disable_unprepare(xqspi->pclk);717736remove_ctlr:718737 spi_controller_put(ctlr);719738···731758 struct zynq_qspi *xqspi = platform_get_drvdata(pdev);732759733760 zynq_qspi_write(xqspi, ZYNQ_QSPI_ENABLE_OFFSET, 0);734734-735735- clk_disable_unprepare(xqspi->refclk);736736- clk_disable_unprepare(xqspi->pclk);737761}738762739763static const struct of_device_id zynq_qspi_of_match[] = {
+2-1
drivers/usb/typec/ucsi/ucsi.c
···4444 return;45454646 if (UCSI_CCI_CONNECTOR(cci)) {4747- if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)4747+ if (!ucsi->cap.num_connectors ||4848+ UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)4849 ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci));4950 else5051 dev_err(ucsi->dev, "bogus connector number in CCI: %lu\n",
+5
fs/cachefiles/namei.c
···810810 if (ret < 0)811811 goto error_unlock;812812813813+ /*814814+ * cachefiles_bury_object() expects 2 references to 'victim',815815+ * and drops one.816816+ */817817+ dget(victim);813818 ret = cachefiles_bury_object(cache, NULL, dir, victim,814819 FSCACHE_OBJECT_WAS_CULLED);815820 dput(victim);
+5-1
fs/eventpoll.c
···226226 */227227 refcount_t refcount;228228229229+ /* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */230230+ struct rcu_head rcu;231231+229232#ifdef CONFIG_NET_RX_BUSY_POLL230233 /* used to track busy poll napi_id */231234 unsigned int napi_id;···822819 mutex_destroy(&ep->mtx);823820 free_uid(ep->user);824821 wakeup_source_unregister(ep->ws);825825- kfree(ep);822822+ /* ep_get_upwards_depth_proc() may still hold epi->ep under RCU */823823+ kfree_rcu(ep, rcu);826824}827825828826/*
+48-20
fs/kernfs/dir.c
···1414#include <linux/slab.h>1515#include <linux/security.h>1616#include <linux/hash.h>1717+#include <linux/ns_common.h>17181819#include "kernfs-internal.h"1920···307306 return parent;308307}309308309309+/*310310+ * kernfs_ns_id - return the namespace id for a given namespace311311+ * @ns: namespace tag (may be NULL)312312+ *313313+ * Use the 64-bit namespace id instead of raw pointers for hashing314314+ * and comparison to avoid leaking kernel addresses to userspace.315315+ */316316+static u64 kernfs_ns_id(const struct ns_common *ns)317317+{318318+ return ns ? ns->ns_id : 0;319319+}320320+310321/**311322 * kernfs_name_hash - calculate hash of @ns + @name312323 * @name: Null terminated string to hash···326313 *327314 * Return: 31-bit hash of ns + name (so it fits in an off_t)328315 */329329-static unsigned int kernfs_name_hash(const char *name, const void *ns)316316+static unsigned int kernfs_name_hash(const char *name,317317+ const struct ns_common *ns)330318{331331- unsigned long hash = init_name_hash(ns);319319+ unsigned long hash = init_name_hash(kernfs_ns_id(ns));332320 unsigned int len = strlen(name);333321 while (len--)334322 hash = partial_name_hash(*name++, hash);···344330}345331346332static int kernfs_name_compare(unsigned int hash, const char *name,347347- const void *ns, const struct kernfs_node *kn)333333+ const struct ns_common *ns, const struct kernfs_node *kn)348334{335335+ u64 ns_id = kernfs_ns_id(ns);336336+ u64 kn_ns_id = kernfs_ns_id(kn->ns);337337+349338 if (hash < kn->hash)350339 return -1;351340 if (hash > kn->hash)352341 return 1;353353- if (ns < kn->ns)342342+ if (ns_id < kn_ns_id)354343 return -1;355355- if (ns > kn->ns)344344+ if (ns_id > kn_ns_id)356345 return 1;357346 return strcmp(name, kernfs_rcu_name(kn));358347}···873856 */874857static struct kernfs_node *kernfs_find_ns(struct kernfs_node *parent,875858 const unsigned char *name,876876- const void *ns)859859+ const struct ns_common *ns)877860{878861 struct rb_node *node = parent->dir.children.rb_node;879862 bool has_ns = kernfs_ns_enabled(parent);···906889907890static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,908891 const unsigned char *path,909909- const void *ns)892892+ const struct ns_common *ns)910893{911894 ssize_t len;912895 char *p, *name;···947930 * Return: pointer to the found kernfs_node on success, %NULL on failure.948931 */949932struct kernfs_node *kernfs_find_and_get_ns(struct kernfs_node *parent,950950- const char *name, const void *ns)933933+ const char *name,934934+ const struct ns_common *ns)951935{952936 struct kernfs_node *kn;953937 struct kernfs_root *root = kernfs_root(parent);···974956 * Return: pointer to the found kernfs_node on success, %NULL on failure.975957 */976958struct kernfs_node *kernfs_walk_and_get_ns(struct kernfs_node *parent,977977- const char *path, const void *ns)959959+ const char *path,960960+ const struct ns_common *ns)978961{979962 struct kernfs_node *kn;980963 struct kernfs_root *root = kernfs_root(parent);···10981079struct kernfs_node *kernfs_create_dir_ns(struct kernfs_node *parent,10991080 const char *name, umode_t mode,11001081 kuid_t uid, kgid_t gid,11011101- void *priv, const void *ns)10821082+ void *priv,10831083+ const struct ns_common *ns)11021084{11031085 struct kernfs_node *kn;11041086 int rc;···1219119912201200 /* The kernfs node has been moved to a different namespace */12211201 if (parent && kernfs_ns_enabled(parent) &&12221222- kernfs_info(dentry->d_sb)->ns != kn->ns)12021202+ kernfs_ns_id(kernfs_info(dentry->d_sb)->ns) != kernfs_ns_id(kn->ns))12231203 goto out_bad;1224120412251205 up_read(&root->kernfs_rwsem);···12411221 struct kernfs_node *kn;12421222 struct kernfs_root *root;12431223 struct inode *inode = NULL;12441244- const void *ns = NULL;12241224+ const struct ns_common *ns = NULL;1245122512461226 root = kernfs_root(parent);12471227 down_read(&root->kernfs_rwsem);···17221702 * Return: %0 on success, -ENOENT if such entry doesn't exist.17231703 */17241704int kernfs_remove_by_name_ns(struct kernfs_node *parent, const char *name,17251725- const void *ns)17051705+ const struct ns_common *ns)17261706{17271707 struct kernfs_node *kn;17281708 struct kernfs_root *root;···17611741 * Return: %0 on success, -errno on failure.17621742 */17631743int kernfs_rename_ns(struct kernfs_node *kn, struct kernfs_node *new_parent,17641764- const char *new_name, const void *new_ns)17441744+ const char *new_name, const struct ns_common *new_ns)17651745{17661746 struct kernfs_node *old_parent;17671747 struct kernfs_root *root;···17911771 old_name = kernfs_rcu_name(kn);17921772 if (!new_name)17931773 new_name = old_name;17941794- if ((old_parent == new_parent) && (kn->ns == new_ns) &&17741774+ if ((old_parent == new_parent) &&17751775+ (kernfs_ns_id(kn->ns) == kernfs_ns_id(new_ns)) &&17951776 (strcmp(old_name, new_name) == 0))17961777 goto out; /* nothing to rename */17971778···18531832 return 0;18541833}1855183418561856-static struct kernfs_node *kernfs_dir_pos(const void *ns,18351835+static struct kernfs_node *kernfs_dir_pos(const struct ns_common *ns,18571836 struct kernfs_node *parent, loff_t hash, struct kernfs_node *pos)18581837{18591838 if (pos) {···18661845 }18671846 if (!pos && (hash > 1) && (hash < INT_MAX)) {18681847 struct rb_node *node = parent->dir.children.rb_node;18481848+ u64 ns_id = kernfs_ns_id(ns);18691849 while (node) {18701850 pos = rb_to_kn(node);18711851···18741852 node = node->rb_left;18751853 else if (hash > pos->hash)18761854 node = node->rb_right;18551855+ else if (ns_id < kernfs_ns_id(pos->ns))18561856+ node = node->rb_left;18571857+ else if (ns_id > kernfs_ns_id(pos->ns))18581858+ node = node->rb_right;18771859 else18781860 break;18791861 }18801862 }18811863 /* Skip over entries which are dying/dead or in the wrong namespace */18821882- while (pos && (!kernfs_active(pos) || pos->ns != ns)) {18641864+ while (pos && (!kernfs_active(pos) ||18651865+ kernfs_ns_id(pos->ns) != kernfs_ns_id(ns))) {18831866 struct rb_node *node = rb_next(&pos->rb);18841867 if (!node)18851868 pos = NULL;···18941867 return pos;18951868}1896186918971897-static struct kernfs_node *kernfs_dir_next_pos(const void *ns,18701870+static struct kernfs_node *kernfs_dir_next_pos(const struct ns_common *ns,18981871 struct kernfs_node *parent, ino_t ino, struct kernfs_node *pos)18991872{19001873 pos = kernfs_dir_pos(ns, parent, ino, pos);···19051878 pos = NULL;19061879 else19071880 pos = rb_to_kn(node);19081908- } while (pos && (!kernfs_active(pos) || pos->ns != ns));18811881+ } while (pos && (!kernfs_active(pos) ||18821882+ kernfs_ns_id(pos->ns) != kernfs_ns_id(ns)));19091883 }19101884 return pos;19111885}···19171889 struct kernfs_node *parent = kernfs_dentry_node(dentry);19181890 struct kernfs_node *pos = file->private_data;19191891 struct kernfs_root *root;19201920- const void *ns = NULL;18921892+ const struct ns_common *ns = NULL;1921189319221894 if (!dir_emit_dots(file, ctx))19231895 return 0;
···9797 * instance. If multiple tags become necessary, make the following9898 * an array and compare kernfs_node tag against every entry.9999 */100100- const void *ns;100100+ const struct ns_common *ns;101101102102 /* anchored at kernfs_root->supers, protected by kernfs_rwsem */103103 struct list_head node;
+1-1
fs/kernfs/mount.c
···345345 *346346 * Return: the namespace tag associated with kernfs super_block @sb.347347 */348348-const void *kernfs_super_ns(struct super_block *sb)348348+const struct ns_common *kernfs_super_ns(struct super_block *sb)349349{350350 struct kernfs_super_info *info = kernfs_info(sb);351351
···8080 * @shift: nanoseconds to cycles divisor (power of two)8181 * @state_use_accessors:current state of the device, assigned by the core code8282 * @features: features8383+ * @next_event_forced: True if the last programming was a forced event8384 * @retries: number of forced programming retries8485 * @set_state_periodic: switch state to periodic8586 * @set_state_oneshot: switch state to oneshot···109108 u32 shift;110109 enum clock_event_state state_use_accessors;111110 unsigned int features;111111+ unsigned int next_event_forced;112112 unsigned long retries;113113114114 int (*set_state_periodic)(struct clock_event_device *);
+3-3
include/linux/cpu.h
···229229#define smt_mitigations SMT_MITIGATIONS_OFF230230#endif231231232232-int arch_get_indir_br_lp_status(struct task_struct *t, unsigned long __user *status);233233-int arch_set_indir_br_lp_status(struct task_struct *t, unsigned long status);234234-int arch_lock_indir_br_lp_status(struct task_struct *t, unsigned long status);232232+int arch_prctl_get_branch_landing_pad_state(struct task_struct *t, unsigned long __user *state);233233+int arch_prctl_set_branch_landing_pad_state(struct task_struct *t, unsigned long state);234234+int arch_prctl_lock_branch_landing_pad_state(struct task_struct *t);235235236236#endif /* _LINUX_CPU_H_ */
···3232 * recursion involves route lookups and full IP output, consuming much3333 * more stack per level, so a lower limit is needed.3434 */3535-#define IP_TUNNEL_RECURSION_LIMIT 43535+#define IP_TUNNEL_RECURSION_LIMIT 536363737/* Keep error state on tunnel for 30 sec */3838#define IPTUNNEL_ERR_TIMEO (30*HZ)
+4-4
include/net/net_namespace.h
···264264#define ipx_unregister_sysctl()265265#endif266266267267-#ifdef CONFIG_NET_NS268268-void __put_net(struct net *net);269269-270267static inline struct net *to_net_ns(struct ns_common *ns)271268{272269 return container_of(ns, struct net, ns);273270}271271+272272+#ifdef CONFIG_NET_NS273273+void __put_net(struct net *net);274274275275/* Try using get_net_track() instead */276276static inline struct net *get_net(struct net *net)···309309 return ns_ref_read(net) != 0;310310}311311312312-void net_drop_ns(void *);312312+void net_drop_ns(struct ns_common *);313313void net_passive_dec(struct net *net);314314315315#else
···397397# define PR_RSEQ_SLICE_EXT_ENABLE 0x01398398399399/*400400- * Get the current indirect branch tracking configuration for the current401401- * thread, this will be the value configured via PR_SET_INDIR_BR_LP_STATUS.400400+ * Get or set the control flow integrity (CFI) configuration for the401401+ * current thread.402402+ *403403+ * Some per-thread control flow integrity settings are not yet404404+ * controlled through this prctl(); see for example405405+ * PR_{GET,SET,LOCK}_SHADOW_STACK_STATUS402406 */403403-#define PR_GET_INDIR_BR_LP_STATUS 80404404-407407+#define PR_GET_CFI 80408408+#define PR_SET_CFI 81405409/*406406- * Set the indirect branch tracking configuration. PR_INDIR_BR_LP_ENABLE will407407- * enable cpu feature for user thread, to track all indirect branches and ensure408408- * they land on arch defined landing pad instruction.409409- * x86 - If enabled, an indirect branch must land on an ENDBRANCH instruction.410410- * arch64 - If enabled, an indirect branch must land on a BTI instruction.411411- * riscv - If enabled, an indirect branch must land on an lpad instruction.412412- * PR_INDIR_BR_LP_DISABLE will disable feature for user thread and indirect413413- * branches will no more be tracked by cpu to land on arch defined landing pad414414- * instruction.410410+ * Forward-edge CFI variants (excluding ARM64 BTI, which has its own411411+ * prctl()s).415412 */416416-#define PR_SET_INDIR_BR_LP_STATUS 81417417-# define PR_INDIR_BR_LP_ENABLE (1UL << 0)418418-419419-/*420420- * Prevent further changes to the specified indirect branch tracking421421- * configuration. All bits may be locked via this call, including422422- * undefined bits.423423- */424424-#define PR_LOCK_INDIR_BR_LP_STATUS 82413413+#define PR_CFI_BRANCH_LANDING_PADS 0414414+/* Return and control values for PR_{GET,SET}_CFI */415415+# define PR_CFI_ENABLE _BITUL(0)416416+# define PR_CFI_DISABLE _BITUL(1)417417+# define PR_CFI_LOCK _BITUL(2)425418426419#endif /* _LINUX_PRCTL_H */
···7676 */7777static void tick_broadcast_start_periodic(struct clock_event_device *bc)7878{7979- if (bc)7979+ if (bc) {8080+ bc->next_event_forced = 0;8081 tick_setup_periodic(bc, 1);8282+ }8183}82848385/*···405403 bool bc_local;406404407405 raw_spin_lock(&tick_broadcast_lock);406406+ tick_broadcast_device.evtdev->next_event_forced = 0;408407409408 /* Handle spurious interrupts gracefully */410409 if (clockevent_state_shutdown(tick_broadcast_device.evtdev)) {···699696700697 raw_spin_lock(&tick_broadcast_lock);701698 dev->next_event = KTIME_MAX;699699+ tick_broadcast_device.evtdev->next_event_forced = 0;702700 next_event = KTIME_MAX;703701 cpumask_clear(tmpmask);704702 now = ktime_get();···106710631068106410691065 bc->event_handler = tick_handle_oneshot_broadcast;10661066+ bc->next_event_forced = 0;10701067 bc->next_event = KTIME_MAX;1071106810721069 /*···11801175 }1181117611821177 /* This moves the broadcast assignment to this CPU: */11781178+ bc->next_event_forced = 0;11831179 clockevents_program_event(bc, bc->next_event, 1);11841180 }11851181 raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+1
kernel/time/tick-common.c
···110110 int cpu = smp_processor_id();111111 ktime_t next = dev->next_event;112112113113+ dev->next_event_forced = 0;113114 tick_periodic(cpu);114115115116 /*
+2-1
kernel/time/tick-sched.c
···345345 int val = atomic_read(dep);346346347347 if (likely(!tracepoint_enabled(tick_stop)))348348- return !val;348348+ return !!val;349349350350 if (val & TICK_DEP_MASK_POSIX_TIMER) {351351 trace_tick_stop(0, TICK_DEP_MASK_POSIX_TIMER);···15131513 struct tick_sched *ts = this_cpu_ptr(&tick_cpu_sched);1514151415151515 dev->next_event = KTIME_MAX;15161516+ dev->next_event_forced = 0;1516151715171518 if (likely(tick_nohz_handler(&ts->sched_timer) == HRTIMER_RESTART))15181519 tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+1-1
kernel/trace/trace_probe.c
···10681068{10691069 size_t len = strlen(str);1070107010711071- if (str[len - 1] != '"') {10711071+ if (!len || str[len - 1] != '"') {10721072 trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE);10731073 return -EINVAL;10741074 }
+13-1
kernel/workqueue.c
···18491849 raw_spin_lock_irq(&pwq->pool->lock);18501850 if (pwq->plugged) {18511851 pwq->plugged = false;18521852- if (pwq_activate_first_inactive(pwq, true))18521852+ if (pwq_activate_first_inactive(pwq, true)) {18531853+ /*18541854+ * While plugged, queueing skips activation which18551855+ * includes bumping the nr_active count and adding the18561856+ * pwq to nna->pending_pwqs if the count can't be18571857+ * obtained. We need to restore both for the pwq being18581858+ * unplugged. The first call activates the first18591859+ * inactive work item and the second, if there are more18601860+ * inactive, puts the pwq on pending_pwqs.18611861+ */18621862+ pwq_activate_first_inactive(pwq, false);18631863+18531864 kick_pool(pwq->pool);18651865+ }18541866 }18551867 raw_spin_unlock_irq(&pwq->pool->lock);18561868}
+4-4
lib/kobject.c
···2727 * and thus @kobj should have a namespace tag associated with it. Returns2828 * %NULL otherwise.2929 */3030-const void *kobject_namespace(const struct kobject *kobj)3030+const struct ns_common *kobject_namespace(const struct kobject *kobj)3131{3232 const struct kobj_ns_type_operations *ns_ops = kobj_ns_ops(kobj);3333···10831083 return may_mount;10841084}1085108510861086-void *kobj_ns_grab_current(enum kobj_ns_type type)10861086+struct ns_common *kobj_ns_grab_current(enum kobj_ns_type type)10871087{10881088- void *ns = NULL;10881088+ struct ns_common *ns = NULL;1089108910901090 spin_lock(&kobj_ns_type_lock);10911091 if (kobj_ns_type_is_valid(type) && kobj_ns_ops_tbl[type])···10961096}10971097EXPORT_SYMBOL_GPL(kobj_ns_grab_current);1098109810991099-void kobj_ns_drop(enum kobj_ns_type type, void *ns)10991099+void kobj_ns_drop(enum kobj_ns_type type, struct ns_common *ns)11001100{11011101 spin_lock(&kobj_ns_type_lock);11021102 if (kobj_ns_type_is_valid(type) &&
+8-5
lib/kobject_uevent.c
···238238239239 ops = kobj_ns_ops(kobj);240240 if (ops) {241241- const void *init_ns, *ns;241241+ const struct ns_common *init_ns, *ns;242242243243 ns = kobj->ktype->namespace(kobj);244244 init_ns = ops->initial_ns();···388388389389#ifdef CONFIG_NET390390 const struct kobj_ns_type_operations *ops;391391- const struct net *net = NULL;391391+ const struct ns_common *ns = NULL;392392393393 ops = kobj_ns_ops(kobj);394394 if (!ops && kobj->kset) {···404404 */405405 if (ops && ops->netlink_ns && kobj->ktype->namespace)406406 if (ops->type == KOBJ_NS_TYPE_NET)407407- net = kobj->ktype->namespace(kobj);407407+ ns = kobj->ktype->namespace(kobj);408408409409- if (!net)409409+ if (!ns)410410 ret = uevent_net_broadcast_untagged(env, action_string,411411 devpath);412412- else412412+ else {413413+ const struct net *net = container_of(ns, struct net, ns);414414+413415 ret = uevent_net_broadcast_tagged(net->uevent_sock->sk, env,414416 action_string, devpath);417417+ }415418#endif416419417420 return ret;
+7
mm/damon/stat.c
···245245{246246 int err;247247248248+ if (damon_stat_context) {249249+ if (damon_is_running(damon_stat_context))250250+ return -EAGAIN;251251+ damon_destroy_ctx(damon_stat_context);252252+ }253253+248254 damon_stat_context = damon_stat_build_ctx();249255 if (!damon_stat_context)250256 return -ENOMEM;···267261{268262 damon_stop(&damon_stat_context, 1);269263 damon_destroy_ctx(damon_stat_context);264264+ damon_stat_context = NULL;270265}271266272267static int damon_stat_enabled_store(
···38833883 unsigned int nr_pages = 0, folio_type;38843884 unsigned short mmap_miss = 0, mmap_miss_saved;3885388538863886+ /*38873887+ * Recalculate end_pgoff based on file_end before calling38883888+ * next_uptodate_folio() to avoid races with concurrent38893889+ * truncation.38903890+ */38913891+ file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;38923892+ end_pgoff = min(end_pgoff, file_end);38933893+38863894 rcu_read_lock();38873895 folio = next_uptodate_folio(&xas, mapping, end_pgoff);38883896 if (!folio)38893897 goto out;38903890-38913891- file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;38923892- end_pgoff = min(end_pgoff, file_end);3893389838943899 /*38953900 * Do not allow to map with PMD across i_size to preserve
+20
mm/memory_hotplug.c
···1209120912101210 if (node_arg.nid >= 0)12111211 node_set_state(nid, N_MEMORY);12121212+ /*12131213+ * Check whether we are adding normal memory to the node for the first12141214+ * time.12151215+ */12161216+ if (!node_state(nid, N_NORMAL_MEMORY) && zone_idx(zone) <= ZONE_NORMAL)12171217+ node_set_state(nid, N_NORMAL_MEMORY);12181218+12121219 if (need_zonelists_rebuild)12131220 build_all_zonelists(NULL);12141221···19151908 unsigned long flags;19161909 char *reason;19171910 int ret;19111911+ unsigned long normal_pages = 0;19121912+ enum zone_type zt;1918191319191914 /*19201915 * {on,off}lining is constrained to full memory sections (or more···20642055 /* reinitialise watermarks and update pcp limits */20652056 init_per_zone_wmark_min();2066205720582058+ /*20592059+ * Check whether this operation removes the last normal memory from20602060+ * the node. We do this before clearing N_MEMORY to avoid the possible20612061+ * transient "!N_MEMORY && N_NORMAL_MEMORY" state.20622062+ */20632063+ if (zone_idx(zone) <= ZONE_NORMAL) {20642064+ for (zt = 0; zt <= ZONE_NORMAL; zt++)20652065+ normal_pages += pgdat->node_zones[zt].present_pages;20662066+ if (!normal_pages)20672067+ node_clear_state(node, N_NORMAL_MEMORY);20682068+ }20672069 /*20682070 * Make sure to mark the node as memory-less before rebuilding the zone20692071 * list. Otherwise this node would still appear in the fallback lists.
+21
mm/page-writeback.c
···18581858 break;18591859 }1860186018611861+ /*18621862+ * Unconditionally start background writeback if it's not18631863+ * already in progress. We need to do this because the global18641864+ * dirty threshold check above (nr_dirty > gdtc->bg_thresh)18651865+ * doesn't account for these cases:18661866+ *18671867+ * a) strictlimit BDIs: throttling is calculated using per-wb18681868+ * thresholds. The per-wb threshold can be exceeded even when18691869+ * nr_dirty < gdtc->bg_thresh18701870+ *18711871+ * b) memcg-based throttling: memcg uses its own dirty count and18721872+ * thresholds and can trigger throttling even when global18731873+ * nr_dirty < gdtc->bg_thresh18741874+ *18751875+ * Writeback needs to be started else the writer stalls in the18761876+ * throttle loop waiting for dirty pages to be written back18771877+ * while no writeback is running.18781878+ */18791879+ if (unlikely(!writeback_in_progress(wb)))18801880+ wb_start_background_writeback(wb);18811881+18611882 mem_cgroup_flush_foreign(wb);1862188318631884 /*
+7
mm/vma.c
···27812781 if (map.charged)27822782 vm_unacct_memory(map.charged);27832783abort_munmap:27842784+ /*27852785+ * This indicates that .mmap_prepare has set a new file, differing from27862786+ * desc->vm_file. But since we're aborting the operation, only the27872787+ * original file will be cleaned up. Ensure we clean up both.27882788+ */27892789+ if (map.file_doesnt_need_get)27902790+ fput(map.file);27842791 vms_abort_munmap_vmas(&map.vms, &map.mas_detach);27852792 return error;27862793}
···540540 }541541}542542543543-void net_drop_ns(void *p)543543+void net_drop_ns(struct ns_common *ns)544544{545545- struct net *net = (struct net *)p;546546-547547- if (net)548548- net_passive_dec(net);545545+ if (ns)546546+ net_passive_dec(to_net_ns(ns));549547}550548551549struct net *copy_net_ns(u64 flags,
+1-1
net/core/netdev_rx_queue.c
···117117 struct netdev_rx_queue *rxq;118118 int ret;119119120120- if (!netdev_need_ops_lock(dev))120120+ if (!qops)121121 return -EOPNOTSUPP;122122123123 if (rxq_idx >= dev->real_num_rx_queues) {
+27-13
net/core/rtnetlink.c
···38943894 goto out;38953895}3896389638973897-static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,38973897+static struct net *rtnl_get_peer_net(struct sk_buff *skb,38983898+ const struct rtnl_link_ops *ops,38983899 struct nlattr *tbp[],38993900 struct nlattr *data[],39003901 struct netlink_ext_ack *extack)39013902{39023902- struct nlattr *tb[IFLA_MAX + 1];39033903+ struct nlattr *tb[IFLA_MAX + 1], **attrs;39043904+ struct net *net;39033905 int err;3904390639053905- if (!data || !data[ops->peer_type])39063906- return rtnl_link_get_net_ifla(tbp);39073907-39083908- err = rtnl_nla_parse_ifinfomsg(tb, data[ops->peer_type], extack);39093909- if (err < 0)39103910- return ERR_PTR(err);39113911-39123912- if (ops->validate) {39133913- err = ops->validate(tb, NULL, extack);39073907+ if (!data || !data[ops->peer_type]) {39083908+ attrs = tbp;39093909+ } else {39103910+ err = rtnl_nla_parse_ifinfomsg(tb, data[ops->peer_type], extack);39143911 if (err < 0)39153912 return ERR_PTR(err);39133913+39143914+ if (ops->validate) {39153915+ err = ops->validate(tb, NULL, extack);39163916+ if (err < 0)39173917+ return ERR_PTR(err);39183918+ }39193919+39203920+ attrs = tb;39163921 }3917392239183918- return rtnl_link_get_net_ifla(tb);39233923+ net = rtnl_link_get_net_ifla(attrs);39243924+ if (IS_ERR_OR_NULL(net))39253925+ return net;39263926+39273927+ if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {39283928+ put_net(net);39293929+ return ERR_PTR(-EPERM);39303930+ }39313931+39323932+ return net;39193933}3920393439213935static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,···40684054 }4069405540704056 if (ops->peer_type) {40714071- peer_net = rtnl_get_peer_net(ops, tb, data, extack);40574057+ peer_net = rtnl_get_peer_net(skb, ops, tb, data, extack);40724058 if (IS_ERR(peer_net)) {40734059 ret = PTR_ERR(peer_net);40744060 goto put_ops;
+1-4
net/core/skbuff.c
···1083108310841084static void skb_kfree_head(void *head, unsigned int end_offset)10851085{10861086- if (end_offset == SKB_SMALL_HEAD_HEADROOM)10871087- kmem_cache_free(net_hotdata.skb_small_head_cache, head);10881088- else10891089- kfree(head);10861086+ kfree(head);10901087}1091108810921089static void skb_free_head(struct sk_buff *skb)
···21652165 tcp_prot_override.psock_update_sk_prot = NULL;21662166#endif2167216721682168+ mptcp_diag_subflow_init(&subflow_ulp_ops);21692169+21702170+ if (tcp_register_ulp(&subflow_ulp_ops) != 0)21712171+ panic("MPTCP: failed to register subflows to ULP\n");21722172+}21732173+21682174#if IS_ENABLED(CONFIG_MPTCP_IPV6)21752175+void __init mptcp_subflow_v6_init(void)21762176+{21692177 /* In struct mptcp_subflow_request_sock, we assume the TCP request sock21702178 * structures for v4 and v6 have the same size. It should not changed in21712179 * the future but better to make sure to be warned if it is no longer···22122204 /* Disable sockmap processing for subflows */22132205 tcpv6_prot_override.psock_update_sk_prot = NULL;22142206#endif22152215-#endif22162216-22172217- mptcp_diag_subflow_init(&subflow_ulp_ops);22182218-22192219- if (tcp_register_ulp(&subflow_ulp_ops) != 0)22202220- panic("MPTCP: failed to register subflows to ULP\n");22212207}22082208+#endif
···7373 struct rfkill_event_ext ev;7474};75757676+/* Max rfkill events that can be "in-flight" for one data source */7777+#define MAX_RFKILL_EVENT 10007678struct rfkill_data {7779 struct list_head list;7880 struct list_head events;7981 struct mutex mtx;8082 wait_queue_head_t read_wait;8383+ u32 event_count;8184 bool input_handler;8285 u8 max_size;8386};···258255}259256#endif /* CONFIG_RFKILL_LEDS */260257261261-static void rfkill_fill_event(struct rfkill_event_ext *ev,262262- struct rfkill *rfkill,263263- enum rfkill_operation op)258258+static int rfkill_fill_event(struct rfkill_int_event *int_ev,259259+ struct rfkill *rfkill,260260+ struct rfkill_data *data,261261+ enum rfkill_operation op)264262{263263+ struct rfkill_event_ext *ev = &int_ev->ev;265264 unsigned long flags;266265267266 ev->idx = rfkill->idx;···276271 RFKILL_BLOCK_SW_PREV));277272 ev->hard_block_reasons = rfkill->hard_block_reasons;278273 spin_unlock_irqrestore(&rfkill->lock, flags);274274+275275+ scoped_guard(mutex, &data->mtx) {276276+ if (data->event_count++ > MAX_RFKILL_EVENT) {277277+ data->event_count--;278278+ return -ENOSPC;279279+ }280280+ list_add_tail(&int_ev->list, &data->events);281281+ }282282+ return 0;279283}280284281285static void rfkill_send_events(struct rfkill *rfkill, enum rfkill_operation op)···296282 ev = kzalloc_obj(*ev);297283 if (!ev)298284 continue;299299- rfkill_fill_event(&ev->ev, rfkill, op);300300- mutex_lock(&data->mtx);301301- list_add_tail(&ev->list, &data->events);302302- mutex_unlock(&data->mtx);285285+ if (rfkill_fill_event(ev, rfkill, data, op)) {286286+ kfree(ev);287287+ continue;288288+ }303289 wake_up_interruptible(&data->read_wait);304290 }305291}···12001186 if (!ev)12011187 goto free;12021188 rfkill_sync(rfkill);12031203- rfkill_fill_event(&ev->ev, rfkill, RFKILL_OP_ADD);12041204- mutex_lock(&data->mtx);12051205- list_add_tail(&ev->list, &data->events);12061206- mutex_unlock(&data->mtx);11891189+ if (rfkill_fill_event(ev, rfkill, data, RFKILL_OP_ADD))11901190+ kfree(ev);12071191 }12081192 list_add(&data->list, &rfkill_fds);12091193 mutex_unlock(&rfkill_global_mutex);···12711259 ret = -EFAULT;1272126012731261 list_del(&ev->list);12621262+ data->event_count--;12741263 kfree(ev);12751264 out:12761265 mutex_unlock(&data->mtx);
-6
net/rxrpc/af_rxrpc.c
···654654 goto success;655655656656 case RXRPC_SECURITY_KEY:657657- ret = -EINVAL;658658- if (rx->key)659659- goto error;660657 ret = -EISCONN;661658 if (rx->sk.sk_state != RXRPC_UNBOUND)662659 goto error;···661664 goto error;662665663666 case RXRPC_SECURITY_KEYRING:664664- ret = -EINVAL;665665- if (rx->key)666666- goto error;667667 ret = -EISCONN;668668 if (rx->sk.sk_state != RXRPC_UNBOUND)669669 goto error;
···654654 if (dead) {655655 ASSERTCMP(__rxrpc_call_state(call), ==, RXRPC_CALL_COMPLETE);656656657657- if (!list_empty(&call->link)) {658658- spin_lock(&rxnet->call_lock);659659- list_del_init(&call->link);660660- spin_unlock(&rxnet->call_lock);661661- }657657+ spin_lock(&rxnet->call_lock);658658+ list_del_rcu(&call->link);659659+ spin_unlock(&rxnet->call_lock);662660663661 rxrpc_cleanup_call(call);664662 }···692694 rxrpc_put_bundle(call->bundle, rxrpc_bundle_put_call);693695 rxrpc_put_peer(call->peer, rxrpc_peer_put_call);694696 rxrpc_put_local(call->local, rxrpc_local_put_call);697697+ key_put(call->key);695698 call_rcu(&call->rcu, rxrpc_rcu_free_call);696699}697700···729730 _enter("");730731731732 if (!list_empty(&rxnet->calls)) {733733+ int shown = 0;734734+732735 spin_lock(&rxnet->call_lock);733736734734- while (!list_empty(&rxnet->calls)) {735735- call = list_entry(rxnet->calls.next,736736- struct rxrpc_call, link);737737- _debug("Zapping call %p", call);738738-739739- rxrpc_see_call(call, rxrpc_call_see_zap);740740- list_del_init(&call->link);737737+ list_for_each_entry(call, &rxnet->calls, link) {738738+ rxrpc_see_call(call, rxrpc_call_see_still_live);741739742740 pr_err("Call %p still in use (%d,%s,%lx,%lx)!\n",743741 call, refcount_read(&call->ref),744742 rxrpc_call_states[__rxrpc_call_state(call)],745743 call->flags, call->events);746744747747- spin_unlock(&rxnet->call_lock);748748- cond_resched();749749- spin_lock(&rxnet->call_lock);745745+ if (++shown >= 10)746746+ break;750747 }751748752749 spin_unlock(&rxnet->call_lock);
+15-4
net/rxrpc/conn_event.c
···247247 struct sk_buff *skb)248248{249249 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);250250+ bool secured = false;250251 int ret;251252252253 if (conn->state == RXRPC_CONN_ABORTED)···263262 return ret;264263265264 case RXRPC_PACKET_TYPE_RESPONSE:265265+ spin_lock_irq(&conn->state_lock);266266+ if (conn->state != RXRPC_CONN_SERVICE_CHALLENGING) {267267+ spin_unlock_irq(&conn->state_lock);268268+ return 0;269269+ }270270+ spin_unlock_irq(&conn->state_lock);271271+266272 ret = conn->security->verify_response(conn, skb);267273 if (ret < 0)268274 return ret;···280272 return ret;281273282274 spin_lock_irq(&conn->state_lock);283283- if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING)275275+ if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) {284276 conn->state = RXRPC_CONN_SERVICE;277277+ secured = true;278278+ }285279 spin_unlock_irq(&conn->state_lock);286280287287- if (conn->state == RXRPC_CONN_SERVICE) {281281+ if (secured) {288282 /* Offload call state flipping to the I/O thread. As289283 * we've already received the packet, put it on the290284 * front of the queue.···567557 spin_lock_irq(&local->lock);568558 old = conn->tx_response;569559 if (old) {570570- struct rxrpc_skb_priv *osp = rxrpc_skb(skb);560560+ struct rxrpc_skb_priv *osp = rxrpc_skb(old);571561572562 /* Always go with the response to the most recent challenge. */573563 if (after(sp->resp.challenge_serial, osp->resp.challenge_serial))574574- conn->tx_response = old;564564+ conn->tx_response = skb;575565 else576566 old = skb;577567 } else {···579569 }580570 spin_unlock_irq(&local->lock);581571 rxrpc_poke_conn(conn, rxrpc_conn_get_poke_response);572572+ rxrpc_free_skb(old, rxrpc_skb_put_old_response);582573}
···746746 u32 port = msg_origport(hdr);747747 struct tipc_member *m, *pm;748748 u16 remitted, in_flight;749749+ u16 acked;749750750751 if (!grp)751752 return;···799798 case GRP_ACK_MSG:800799 if (!m)801800 return;802802- m->bc_acked = msg_grp_bc_acked(hdr);801801+ acked = msg_grp_bc_acked(hdr);802802+ if (less_eq(acked, m->bc_acked))803803+ return;804804+ m->bc_acked = acked;803805 if (--grp->bc_ackers)804806 return;805807 list_del_init(&m->small_win);
+10
net/tls/tls_sw.c
···584584 if (rc == -EBUSY) {585585 rc = tls_encrypt_async_wait(ctx);586586 rc = rc ?: -EINPROGRESS;587587+ /*588588+ * The async callback tls_encrypt_done() has already589589+ * decremented encrypt_pending and restored the sge on590590+ * both success and error. Skip the synchronous cleanup591591+ * below on error, just remove the record and return.592592+ */593593+ if (rc != -EINPROGRESS) {594594+ list_del(&rec->list);595595+ return rc;596596+ }587597 }588598 if (!rc || rc != -EINPROGRESS) {589599 atomic_dec(&ctx->encrypt_pending);
···397397# define PR_RSEQ_SLICE_EXT_ENABLE 0x01398398399399/*400400- * Get the current indirect branch tracking configuration for the current401401- * thread, this will be the value configured via PR_SET_INDIR_BR_LP_STATUS.400400+ * Get or set the control flow integrity (CFI) configuration for the401401+ * current thread.402402+ *403403+ * Some per-thread control flow integrity settings are not yet404404+ * controlled through this prctl(); see for example405405+ * PR_{GET,SET,LOCK}_SHADOW_STACK_STATUS402406 */403403-#define PR_GET_INDIR_BR_LP_STATUS 80404404-407407+#define PR_GET_CFI 80408408+#define PR_SET_CFI 81405409/*406406- * Set the indirect branch tracking configuration. PR_INDIR_BR_LP_ENABLE will407407- * enable cpu feature for user thread, to track all indirect branches and ensure408408- * they land on arch defined landing pad instruction.409409- * x86 - If enabled, an indirect branch must land on an ENDBRANCH instruction.410410- * arch64 - If enabled, an indirect branch must land on a BTI instruction.411411- * riscv - If enabled, an indirect branch must land on an lpad instruction.412412- * PR_INDIR_BR_LP_DISABLE will disable feature for user thread and indirect413413- * branches will no more be tracked by cpu to land on arch defined landing pad414414- * instruction.410410+ * Forward-edge CFI variants (excluding ARM64 BTI, which has its own411411+ * prctl()s).415412 */416416-#define PR_SET_INDIR_BR_LP_STATUS 81417417-# define PR_INDIR_BR_LP_ENABLE (1UL << 0)413413+#define PR_CFI_BRANCH_LANDING_PADS 0414414+/* Return and control values for PR_{GET,SET}_CFI */415415+# define PR_CFI_ENABLE _BITUL(0)416416+# define PR_CFI_DISABLE _BITUL(1)417417+# define PR_CFI_LOCK _BITUL(2)418418419419-/*420420- * Prevent further changes to the specified indirect branch tracking421421- * configuration. All bits may be locked via this call, including422422- * undefined bits.423423- */424424-#define PR_LOCK_INDIR_BR_LP_STATUS 82425419426420#endif /* _LINUX_PRCTL_H */
···179179 return xsk_socket__create(&xsk->xsk, ifobject->ifindex, 0, umem->umem, rxr, txr, &cfg);180180}181181182182-#define MAX_SKB_FRAGS_PATH "/proc/sys/net/core/max_skb_frags"183183-static unsigned int get_max_skb_frags(void)184184-{185185- unsigned int max_skb_frags = 0;186186- FILE *file;187187-188188- file = fopen(MAX_SKB_FRAGS_PATH, "r");189189- if (!file) {190190- ksft_print_msg("Error opening %s\n", MAX_SKB_FRAGS_PATH);191191- return 0;192192- }193193-194194- if (fscanf(file, "%u", &max_skb_frags) != 1)195195- ksft_print_msg("Error reading %s\n", MAX_SKB_FRAGS_PATH);196196-197197- fclose(file);198198- return max_skb_frags;199199-}200200-201182static int set_ring_size(struct ifobject *ifobj)202183{203184 int ret;···1959197819601979int testapp_stats_rx_dropped(struct test_spec *test)19611980{19811981+ u32 umem_tr = test->ifobj_tx->umem_tailroom;19821982+19621983 if (test->mode == TEST_MODE_ZC) {19631984 ksft_print_msg("Can not run RX_DROPPED test for ZC mode\n");19641985 return TEST_SKIP;19651986 }1966198719671967- if (pkt_stream_replace_half(test, MIN_PKT_SIZE * 4, 0))19881988+ if (pkt_stream_replace_half(test, (MIN_PKT_SIZE * 3) + umem_tr, 0))19681989 return TEST_FAILURE;19691990 test->ifobj_rx->umem->frame_headroom = test->ifobj_rx->umem->frame_size -19701970- XDP_PACKET_HEADROOM - MIN_PKT_SIZE * 3;19911991+ XDP_PACKET_HEADROOM - (MIN_PKT_SIZE * 2) - umem_tr;19711992 if (pkt_stream_receive_half(test))19721993 return TEST_FAILURE;19731994 test->ifobj_rx->validation_func = validate_rx_dropped;···22252242 if (test->mode == TEST_MODE_ZC) {22262243 max_frags = test->ifobj_tx->xdp_zc_max_segs;22272244 } else {22282228- max_frags = get_max_skb_frags();22292229- if (!max_frags) {22302230- ksft_print_msg("Can't get MAX_SKB_FRAGS from system, using default (17)\n");22312231- max_frags = 17;22322232- }22452245+ max_frags = test->ifobj_tx->max_skb_frags;22332246 max_frags += 1;22342247 }22352248···2530255125312552int testapp_adjust_tail_grow(struct test_spec *test)25322553{25542554+ if (test->mode == TEST_MODE_SKB)25552555+ return TEST_SKIP;25562556+25332557 /* Grow by 4 bytes for testing purpose */25342558 return testapp_adjust_tail(test, 4, MIN_PKT_SIZE * 2);25352559}2536256025372561int testapp_adjust_tail_grow_mb(struct test_spec *test)25382562{25632563+ u32 grow_size;25642564+25652565+ if (test->mode == TEST_MODE_SKB)25662566+ return TEST_SKIP;25672567+25682568+ /* worst case scenario is when underlying setup will work on 3k25692569+ * buffers, let us account for it; given that we will use 6k as25702570+ * pkt_len, expect that it will be broken down to 2 descs each25712571+ * with 3k payload;25722572+ *25732573+ * 4k is truesize, 3k payload, 256 HR, 320 TR;25742574+ */25752575+ grow_size = XSK_UMEM__MAX_FRAME_SIZE -25762576+ XSK_UMEM__LARGE_FRAME_SIZE -25772577+ XDP_PACKET_HEADROOM -25782578+ test->ifobj_tx->umem_tailroom;25392579 test->mtu = MAX_ETH_JUMBO_SIZE;25402540- /* Grow by (frag_size - last_frag_Size) - 1 to stay inside the last fragment */25412541- return testapp_adjust_tail(test, (XSK_UMEM__MAX_FRAME_SIZE / 2) - 1,25422542- XSK_UMEM__LARGE_FRAME_SIZE * 2);25802580+25812581+ return testapp_adjust_tail(test, grow_size, XSK_UMEM__LARGE_FRAME_SIZE * 2);25432582}2544258325452584int testapp_tx_queue_consumer(struct test_spec *test)
+23
tools/testing/selftests/bpf/prog_tests/test_xsk.h
···3131#define SOCK_RECONF_CTR 103232#define USLEEP_MAX 1000033333434+#define MAX_SKB_FRAGS_PATH "/proc/sys/net/core/max_skb_frags"3535+#define SMP_CACHE_BYTES_PATH "/sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size"3636+3437extern bool opt_verbose;3538#define print_verbose(x...) do { if (opt_verbose) ksft_print_msg(x); } while (0)3639···4643static inline u64 ceil_u64(u64 a, u64 b)4744{4845 return (a + b - 1) / b;4646+}4747+4848+static inline unsigned int read_procfs_val(const char *path)4949+{5050+ unsigned int read_val = 0;5151+ FILE *file;5252+5353+ file = fopen(path, "r");5454+ if (!file) {5555+ ksft_print_msg("Error opening %s\n", path);5656+ return 0;5757+ }5858+5959+ if (fscanf(file, "%u", &read_val) != 1)6060+ ksft_print_msg("Error reading %s\n", path);6161+6262+ fclose(file);6363+ return read_val;4964}50655166/* Simple test */···136115 int mtu;137116 u32 bind_flags;138117 u32 xdp_zc_max_segs;118118+ u32 umem_tailroom;119119+ u32 max_skb_frags;139120 bool tx_on;140121 bool rx_on;141122 bool use_poll;
+19
tools/testing/selftests/bpf/prog_tests/xsk.c
···62626363static void test_xsk(const struct test_spec *test_to_run, enum test_mode mode)6464{6565+ u32 max_frags, umem_tailroom, cache_line_size;6566 struct ifobject *ifobj_tx, *ifobj_rx;6667 struct test_spec test;6768 int ret;···8483 ifobj_tx->set_ring.default_tx = ifobj_tx->ring.tx_pending;8584 ifobj_tx->set_ring.default_rx = ifobj_tx->ring.rx_pending;8685 }8686+8787+ cache_line_size = read_procfs_val(SMP_CACHE_BYTES_PATH);8888+ if (!cache_line_size)8989+ cache_line_size = 64;9090+9191+ max_frags = read_procfs_val(MAX_SKB_FRAGS_PATH);9292+ if (!max_frags)9393+ max_frags = 17;9494+9595+ ifobj_tx->max_skb_frags = max_frags;9696+ ifobj_rx->max_skb_frags = max_frags;9797+9898+ /* 48 bytes is a part of skb_shared_info w/o frags array;9999+ * 16 bytes is sizeof(skb_frag_t)100100+ */101101+ umem_tailroom = ALIGN(48 + (max_frags * 16), cache_line_size);102102+ ifobj_tx->umem_tailroom = umem_tailroom;103103+ ifobj_rx->umem_tailroom = umem_tailroom;8710488105 if (!ASSERT_OK(init_iface(ifobj_rx, worker_testapp_validate_rx), "init RX"))89106 goto delete_rx;
+3-1
tools/testing/selftests/bpf/progs/xsk_xdp_progs.c
···26262727SEC("xdp.frags") int xsk_xdp_drop(struct xdp_md *xdp)2828{2929+ static unsigned int drop_idx;3030+2931 /* Drop every other packet */3030- if (idx++ % 2)3232+ if (drop_idx++ % 2)3133 return XDP_DROP;32343335 return bpf_redirect_map(&xsk, 0, XDP_DROP);
+23
tools/testing/selftests/bpf/xskxceiver.c
···8080#include <linux/mman.h>8181#include <linux/netdev.h>8282#include <linux/ethtool.h>8383+#include <linux/align.h>8384#include <arpa/inet.h>8485#include <net/if.h>8586#include <locale.h>···334333int main(int argc, char **argv)335334{336335 const size_t total_tests = ARRAY_SIZE(tests) + ARRAY_SIZE(ci_skip_tests);336336+ u32 cache_line_size, max_frags, umem_tailroom;337337 struct pkt_stream *rx_pkt_stream_default;338338 struct pkt_stream *tx_pkt_stream_default;339339 struct ifobject *ifobj_tx, *ifobj_rx;···355353 exit_with_error(ENOMEM);356354357355 setlocale(LC_ALL, "");356356+357357+ cache_line_size = read_procfs_val(SMP_CACHE_BYTES_PATH);358358+ if (!cache_line_size) {359359+ ksft_print_msg("Can't get SMP_CACHE_BYTES from system, using default (64)\n");360360+ cache_line_size = 64;361361+ }362362+363363+ max_frags = read_procfs_val(MAX_SKB_FRAGS_PATH);364364+ if (!max_frags) {365365+ ksft_print_msg("Can't get MAX_SKB_FRAGS from system, using default (17)\n");366366+ max_frags = 17;367367+ }368368+ ifobj_tx->max_skb_frags = max_frags;369369+ ifobj_rx->max_skb_frags = max_frags;370370+371371+ /* 48 bytes is a part of skb_shared_info w/o frags array;372372+ * 16 bytes is sizeof(skb_frag_t)373373+ */374374+ umem_tailroom = ALIGN(48 + (max_frags * 16), cache_line_size);375375+ ifobj_tx->umem_tailroom = umem_tailroom;376376+ ifobj_rx->umem_tailroom = umem_tailroom;358377359378 parse_command_line(ifobj_tx, ifobj_rx, argc, argv);360379
···414414 bridge vlan add vid 10 dev br1 self pvid untagged415415 ip link set dev $h1 master br1416416 ip link set dev br1 up417417+ setup_wait_dev $h1 0417418 bridge vlan add vid 10 dev $h1 master418419 bridge vlan global set vid 10 dev br1 mcast_snooping 1 mcast_querier 1419420 sleep 2
+44-6
tools/testing/selftests/net/netfilter/nf_queue.c
···1919 bool count_packets;2020 bool gso_enabled;2121 bool failopen;2222+ bool out_of_order;2323+ bool bogus_verdict;2224 int verbose;2325 unsigned int queue_num;2426 unsigned int timeout;···33313432static void help(const char *p)3533{3636- printf("Usage: %s [-c|-v [-vv] ] [-o] [-t timeout] [-q queue_num] [-Qdst_queue ] [ -d ms_delay ] [-G]\n", p);3434+ printf("Usage: %s [-c|-v [-vv] ] [-o] [-O] [-b] [-t timeout] [-q queue_num] [-Qdst_queue ] [ -d ms_delay ] [-G]\n", p);3735}38363937static int parse_attr_cb(const struct nlattr *attr, void *data)···277275 unsigned int buflen = 64 * 1024 + MNL_SOCKET_BUFFER_SIZE;278276 struct mnl_socket *nl;279277 struct nlmsghdr *nlh;278278+ uint32_t ooo_ids[16];280279 unsigned int portid;280280+ int ooo_count = 0;281281 char *buf;282282 int ret;283283···312308313309 ret = mnl_cb_run(buf, ret, 0, portid, queue_cb, NULL);314310 if (ret < 0) {311311+ /* bogus verdict mode will generate ENOENT error messages */312312+ if (opts.bogus_verdict && errno == ENOENT)313313+ continue;315314 perror("mnl_cb_run");316315 exit(EXIT_FAILURE);317316 }···323316 if (opts.delay_ms)324317 sleep_ms(opts.delay_ms);325318326326- nlh = nfq_build_verdict(buf, id, opts.queue_num, opts.verdict);327327- if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {328328- perror("mnl_socket_sendto");329329- exit(EXIT_FAILURE);319319+ if (opts.bogus_verdict) {320320+ for (int i = 0; i < 50; i++) {321321+ nlh = nfq_build_verdict(buf, id + 0x7FFFFFFF + i,322322+ opts.queue_num, opts.verdict);323323+ mnl_socket_sendto(nl, nlh, nlh->nlmsg_len);324324+ }325325+ }326326+327327+ if (opts.out_of_order) {328328+ ooo_ids[ooo_count] = id;329329+ if (ooo_count >= 15) {330330+ for (ooo_count; ooo_count >= 0; ooo_count--) {331331+ nlh = nfq_build_verdict(buf, ooo_ids[ooo_count],332332+ opts.queue_num, opts.verdict);333333+ if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {334334+ perror("mnl_socket_sendto");335335+ exit(EXIT_FAILURE);336336+ }337337+ }338338+ ooo_count = 0;339339+ } else {340340+ ooo_count++;341341+ }342342+ } else {343343+ nlh = nfq_build_verdict(buf, id, opts.queue_num, opts.verdict);344344+ if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {345345+ perror("mnl_socket_sendto");346346+ exit(EXIT_FAILURE);347347+ }330348 }331349 }332350···364332{365333 int c;366334367367- while ((c = getopt(argc, argv, "chvot:q:Q:d:G")) != -1) {335335+ while ((c = getopt(argc, argv, "chvoObt:q:Q:d:G")) != -1) {368336 switch (c) {369337 case 'c':370338 opts.count_packets = true;···406374 break;407375 case 'v':408376 opts.verbose++;377377+ break;378378+ case 'O':379379+ opts.out_of_order = true;380380+ break;381381+ case 'b':382382+ opts.bogus_verdict = true;409383 break;410384 }411385 }
···11+#!/bin/bash22+# SPDX-License-Identifier: GPL-2.033+#44+# author: Andrea Mayer <andrea.mayer@uniroma2.it>55+66+# This test verifies that the seg6 lwtunnel does not share the dst_cache77+# between the input (forwarding) and output (locally generated) paths.88+#99+# A shared dst_cache allows a forwarded packet to populate the cache and a1010+# subsequent locally generated packet to silently reuse that entry, bypassing1111+# its own route lookup. To expose this, the SID is made reachable only for1212+# forwarded traffic (via an ip rule matching iif) and blackholed for everything1313+# else. A local ping on ns_router must always hit the blackhole;1414+# if it succeeds after a forwarded packet has populated the1515+# cache, the bug is confirmed.1616+#1717+# Both forwarded and local packets are pinned to the same CPU with taskset,1818+# since dst_cache is per-cpu.1919+#2020+#2121+# +--------------------+ +--------------------+2222+# | ns_src | | ns_dst |2323+# | | | |2424+# | veth-s0 | | veth-d0 |2525+# | fd00::1/64 | | fd01::2/64 |2626+# +-------+------------+ +----------+---------+2727+# | |2828+# | +--------------------+ |2929+# | | ns_router | |3030+# | | | |3131+# +------------+ veth-r0 veth-r1 +--------------+3232+# | fd00::2 fd01::1 |3333+# +--------------------+3434+#3535+#3636+# ns_router: encap (main table)3737+# +---------+---------------------------------------+3838+# | dst | action |3939+# +---------+---------------------------------------+4040+# | cafe::1 | encap seg6 mode encap segs fc00::100 |4141+# +---------+---------------------------------------+4242+#4343+# ns_router: post-encap SID resolution4444+# +-------+------------+----------------------------+4545+# | table | dst | action |4646+# +-------+------------+----------------------------+4747+# | 100 | fc00::100 | via fd01::2 dev veth-r1 |4848+# +-------+------------+----------------------------+4949+# | main | fc00::100 | blackhole |5050+# +-------+------------+----------------------------+5151+#5252+# ns_router: ip rule5353+# +------------------+------------------------------+5454+# | match | action |5555+# +------------------+------------------------------+5656+# | iif veth-r0 | lookup 100 |5757+# +------------------+------------------------------+5858+#5959+# ns_dst: SRv6 decap (main table)6060+# +--------------+----------------------------------+6161+# | SID | action |6262+# +--------------+----------------------------------+6363+# | fc00::100 | End.DT6 table 255 (local) |6464+# +--------------+----------------------------------+6565+6666+source lib.sh6767+6868+readonly SID="fc00::100"6969+readonly DEST="cafe::1"7070+7171+readonly SRC_MAC="02:00:00:00:00:01"7272+readonly RTR_R0_MAC="02:00:00:00:00:02"7373+readonly RTR_R1_MAC="02:00:00:00:00:03"7474+readonly DST_MAC="02:00:00:00:00:04"7575+7676+cleanup()7777+{7878+ cleanup_ns "${NS_SRC}" "${NS_RTR}" "${NS_DST}"7979+}8080+8181+check_prerequisites()8282+{8383+ if ! command -v ip &>/dev/null; then8484+ echo "SKIP: ip tool not found"8585+ exit "${ksft_skip}"8686+ fi8787+8888+ if ! command -v ping &>/dev/null; then8989+ echo "SKIP: ping not found"9090+ exit "${ksft_skip}"9191+ fi9292+9393+ if ! command -v sysctl &>/dev/null; then9494+ echo "SKIP: sysctl not found"9595+ exit "${ksft_skip}"9696+ fi9797+9898+ if ! command -v taskset &>/dev/null; then9999+ echo "SKIP: taskset not found"100100+ exit "${ksft_skip}"101101+ fi102102+}103103+104104+setup()105105+{106106+ setup_ns NS_SRC NS_RTR NS_DST107107+108108+ ip link add veth-s0 netns "${NS_SRC}" type veth \109109+ peer name veth-r0 netns "${NS_RTR}"110110+ ip link add veth-r1 netns "${NS_RTR}" type veth \111111+ peer name veth-d0 netns "${NS_DST}"112112+113113+ ip -n "${NS_SRC}" link set veth-s0 address "${SRC_MAC}"114114+ ip -n "${NS_RTR}" link set veth-r0 address "${RTR_R0_MAC}"115115+ ip -n "${NS_RTR}" link set veth-r1 address "${RTR_R1_MAC}"116116+ ip -n "${NS_DST}" link set veth-d0 address "${DST_MAC}"117117+118118+ # ns_src119119+ ip -n "${NS_SRC}" link set veth-s0 up120120+ ip -n "${NS_SRC}" addr add fd00::1/64 dev veth-s0 nodad121121+ ip -n "${NS_SRC}" -6 route add "${DEST}"/128 via fd00::2122122+123123+ # ns_router124124+ ip -n "${NS_RTR}" link set veth-r0 up125125+ ip -n "${NS_RTR}" addr add fd00::2/64 dev veth-r0 nodad126126+ ip -n "${NS_RTR}" link set veth-r1 up127127+ ip -n "${NS_RTR}" addr add fd01::1/64 dev veth-r1 nodad128128+ ip netns exec "${NS_RTR}" sysctl -qw net.ipv6.conf.all.forwarding=1129129+130130+ ip -n "${NS_RTR}" -6 route add "${DEST}"/128 \131131+ encap seg6 mode encap segs "${SID}" dev veth-r0132132+ ip -n "${NS_RTR}" -6 route add "${SID}"/128 table 100 \133133+ via fd01::2 dev veth-r1134134+ ip -n "${NS_RTR}" -6 route add blackhole "${SID}"/128135135+ ip -n "${NS_RTR}" -6 rule add iif veth-r0 lookup 100136136+137137+ # ns_dst138138+ ip -n "${NS_DST}" link set veth-d0 up139139+ ip -n "${NS_DST}" addr add fd01::2/64 dev veth-d0 nodad140140+ ip -n "${NS_DST}" addr add "${DEST}"/128 dev lo nodad141141+ ip -n "${NS_DST}" -6 route add "${SID}"/128 \142142+ encap seg6local action End.DT6 table 255 dev veth-d0143143+ ip -n "${NS_DST}" -6 route add fd00::/64 via fd01::1144144+145145+ # static neighbors146146+ ip -n "${NS_SRC}" -6 neigh add fd00::2 dev veth-s0 \147147+ lladdr "${RTR_R0_MAC}" nud permanent148148+ ip -n "${NS_RTR}" -6 neigh add fd00::1 dev veth-r0 \149149+ lladdr "${SRC_MAC}" nud permanent150150+ ip -n "${NS_RTR}" -6 neigh add fd01::2 dev veth-r1 \151151+ lladdr "${DST_MAC}" nud permanent152152+ ip -n "${NS_DST}" -6 neigh add fd01::1 dev veth-d0 \153153+ lladdr "${RTR_R1_MAC}" nud permanent154154+}155155+156156+test_cache_isolation()157157+{158158+ RET=0159159+160160+ # local ping with empty cache: must fail (SID is blackholed)161161+ if ip netns exec "${NS_RTR}" taskset -c 0 \162162+ ping -c 1 -W 2 "${DEST}" &>/dev/null; then163163+ echo "SKIP: local ping succeeded, topology broken"164164+ exit "${ksft_skip}"165165+ fi166166+167167+ # forward from ns_src to populate the input cache168168+ if ! ip netns exec "${NS_SRC}" taskset -c 0 \169169+ ping -c 1 -W 2 "${DEST}" &>/dev/null; then170170+ echo "SKIP: forwarded ping failed, topology broken"171171+ exit "${ksft_skip}"172172+ fi173173+174174+ # local ping again: must still fail; if the output path reuses175175+ # the input cache, it bypasses the blackhole and the ping succeeds176176+ if ip netns exec "${NS_RTR}" taskset -c 0 \177177+ ping -c 1 -W 2 "${DEST}" &>/dev/null; then178178+ echo "FAIL: output path used dst cached by input path"179179+ RET="${ksft_fail}"180180+ else181181+ echo "PASS: output path dst_cache is independent"182182+ fi183183+184184+ return "${RET}"185185+}186186+187187+if [ "$(id -u)" -ne 0 ]; then188188+ echo "SKIP: Need root privileges"189189+ exit "${ksft_skip}"190190+fi191191+192192+trap cleanup EXIT193193+194194+check_prerequisites195195+setup196196+test_cache_isolation197197+exit "${RET}"
+7-6
tools/testing/selftests/riscv/cfi/cfitests.c
···9494 }95959696 switch (ptrace_test_num) {9797-#define CFI_ENABLE_MASK (PTRACE_CFI_LP_EN_STATE | \9898- PTRACE_CFI_SS_EN_STATE | \9999- PTRACE_CFI_SS_PTR_STATE)9797+#define CFI_ENABLE_MASK (PTRACE_CFI_BRANCH_LANDING_PAD_EN_STATE | \9898+ PTRACE_CFI_SHADOW_STACK_EN_STATE | \9999+ PTRACE_CFI_SHADOW_STACK_PTR_STATE)100100 case 0:101101 if ((cfi_reg.cfi_status.cfi_state & CFI_ENABLE_MASK) != CFI_ENABLE_MASK)102102 ksft_exit_fail_msg("%s: ptrace_getregset failed, %llu\n", __func__,···106106 __func__);107107 break;108108 case 1:109109- if (!(cfi_reg.cfi_status.cfi_state & PTRACE_CFI_ELP_STATE))109109+ if (!(cfi_reg.cfi_status.cfi_state &110110+ PTRACE_CFI_BRANCH_EXPECTED_LANDING_PAD_STATE))110111 ksft_exit_fail_msg("%s: elp must have been set\n", __func__);111112 /* clear elp state. not interested in anything else */112113 cfi_reg.cfi_status.cfi_state = 0;···146145 * pads for user mode except lighting up a bit in senvcfg via a prctl.147146 * Enable landing pad support throughout the execution of the test binary.148147 */149149- ret = my_syscall5(__NR_prctl, PR_GET_INDIR_BR_LP_STATUS, &lpad_status, 0, 0, 0);148148+ ret = my_syscall5(__NR_prctl, PR_GET_CFI, PR_CFI_BRANCH_LANDING_PADS, &lpad_status, 0, 0);150149 if (ret)151150 ksft_exit_fail_msg("Get landing pad status failed with %d\n", ret);152151153153- if (!(lpad_status & PR_INDIR_BR_LP_ENABLE))152152+ if (!(lpad_status & PR_CFI_ENABLE))154153 ksft_exit_fail_msg("Landing pad is not enabled, should be enabled via glibc\n");155154156155 ret = my_syscall5(__NR_prctl, PR_GET_SHADOW_STACK_STATUS, &ss_status, 0, 0, 0);
+6-2
tools/testing/vsock/util.c
···344344 ret = send(fd, buf + nwritten, len - nwritten, flags);345345 timeout_check("send");346346347347- if (ret == 0 || (ret < 0 && errno != EINTR))347347+ if (ret < 0 && errno == EINTR)348348+ continue;349349+ if (ret <= 0)348350 break;349351350352 nwritten += ret;···398396 ret = recv(fd, buf + nread, len - nread, flags);399397 timeout_check("recv");400398401401- if (ret == 0 || (ret < 0 && errno != EINTR))399399+ if (ret < 0 && errno == EINTR)400400+ continue;401401+ if (ret <= 0)402402 break;403403404404 nread += ret;