Uladzislau Rezki
3751416eeb
UPSTREAM: scsi/scsi_error: Use call_rcu_hurry() instead of call_rcu()
...
Earlier commits in this series allow battery-powered systems to build
their kernels with the default-disabled CONFIG_RCU_LAZY=y Kconfig option.
This Kconfig option causes call_rcu() to delay its callbacks in order
to batch them. This means that a given RCU grace period covers more
callbacks, thus reducing the number of grace periods, in turn reducing
the amount of energy consumed, which increases battery lifetime which
can be a very good thing. This is not a subtle effect: In some important
use cases, the battery lifetime is increased by more than 10%.
This CONFIG_RCU_LAZY=y option is available only for CPUs that offload
callbacks, for example, CPUs mentioned in the rcu_nocbs kernel boot
parameter passed to kernels built with CONFIG_RCU_NOCB_CPU=y.
Delaying callbacks is normally not a problem because most callbacks do
nothing but free memory. If the system is short on memory, a shrinker
will kick all currently queued lazy callbacks out of their laziness,
thus freeing their memory in short order. Similarly, the rcu_barrier()
function, which blocks until all currently queued callbacks are invoked,
will also kick lazy callbacks, thus enabling rcu_barrier() to complete
in a timely manner.
However, there are some cases where laziness is not a good option.
For example, synchronize_rcu() invokes call_rcu(), and blocks until
the newly queued callback is invoked. It would not be a good for
synchronize_rcu() to block for ten seconds, even on an idle system.
Therefore, synchronize_rcu() invokes call_rcu_hurry() instead of
call_rcu(). The arrival of a non-lazy call_rcu_hurry() callback on a
given CPU kicks any lazy callbacks that might be already queued on that
CPU. After all, if there is going to be a grace period, all callbacks
might as well get full benefit from it.
Yes, this could be done the other way around by creating a
call_rcu_lazy(), but earlier experience with this approach and
feedback at the 2022 Linux Plumbers Conference shifted the approach
to call_rcu() being lazy with call_rcu_hurry() for the few places
where laziness is inappropriate.
And another call_rcu() instance that cannot be lazy is the one in the
scsi_eh_scmd_add() function. Leaving this instance lazy results in
unacceptably slow boot times.
Therefore, make scsi_eh_scmd_add() use call_rcu_hurry() in order to
revert to the old behavior.
[ paulmck: Apply s/call_rcu_flush/call_rcu_hurry/ feedback from Tejun Heo. ]
Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Uladzislau Rezki <urezki@gmail.com >
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com >
Cc: <linux-scsi@vger.kernel.org >
Reviewed-by: Bart Van Assche <bvanassche@acm.org >
Acked-by: Martin K. Petersen <martin.petersen@oracle.com >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit 54d87b0a0cjoelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909036
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Reviewed-by: Sean Paul <sean@poorly.run >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I95bba865e582b0a12b1c09ba1f0bd4f897401c07
2024-01-19 00:10:44 +00:00
Joel Fernandes (Google)
52193e9489
UPSTREAM: rcu/rcutorture: Use call_rcu_hurry() where needed
...
call_rcu() changes to save power will change the behavior of rcutorture
tests. Use the call_rcu_hurry() API instead which reverts to the old
behavior.
[ paulmck: Apply s/call_rcu_flush/call_rcu_hurry/ feedback from Tejun Heo. ]
Reported-by: Paul E. McKenney <paulmck@kernel.org >
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit 405d8e91f0joelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909035
Reviewed-by: Sean Paul <sean@poorly.run >
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I8008990dfe7e64f511aada006e736b15cdd0d61e
2024-01-19 00:10:44 +00:00
Joel Fernandes (Google)
83f8ba569f
UPSTREAM: rcu/rcuscale: Use call_rcu_hurry() for async reader test
...
rcuscale uses call_rcu() to queue async readers. With recent changes to
save power, the test will have fewer async readers in flight. Use the
call_rcu_hurry() API instead to revert to the old behavior.
[ paulmck: Apply s/call_rcu_flush/call_rcu_hurry/ feedback from Tejun Heo. ]
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit 723df859d8joelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909034
Reviewed-by: Sean Paul <sean@poorly.run >
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I680dacb44e81e210e2e4455f28e50b9b516222a8
2024-01-19 00:10:44 +00:00
Joel Fernandes (Google)
9b625f4978
UPSTREAM: rcu/sync: Use call_rcu_hurry() instead of call_rcu
...
call_rcu() changes to save power will slow down rcu sync. Use the
call_rcu_hurry() API instead which reverts to the old behavior.
[ paulmck: Apply s/call_rcu_flush/call_rcu_hurry/ feedback from Tejun Heo. ]
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit 7651d6b250joelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909033
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Reviewed-by: Sean Paul <sean@poorly.run >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I5123ba52f47676305dbcfa1233bf3b41f140766c
2024-01-19 00:10:44 +00:00
Vineeth Pillai
c570c8fea3
BACKPORT: rcu: Shrinker for lazy rcu
...
The shrinker is used to speed up the free'ing of memory potentially held
by RCU lazy callbacks. RCU kernel module test cases show this to be
effective. Test is introduced in a later patch.
Signed-off-by: Vineeth Pillai <vineeth@bitbyteword.org >
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit c945b4da7ajoelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909032
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I6a73a9dae79ff35feca37abe2663e55a0f46dda8
2024-01-19 00:10:44 +00:00
Joel Fernandes (Google)
4957579439
UPSTREAM: rcu: Refactor code a bit in rcu_nocb_do_flush_bypass()
...
This consolidates the code a bit and makes it cleaner. Functionally it
is the same.
Reported-by: Paul E. McKenney <paulmck@kernel.org >
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Reviewed-by: Frederic Weisbecker <frederic@kernel.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit 3d222a0c0cjoelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909031
Reviewed-by: Sean Paul <sean@poorly.run >
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I8422c7138edd6a476fc46374beefdf46dd76b8b0
2024-01-19 00:10:44 +00:00
Joel Fernandes (Google)
66a832fe38
UPSTREAM: rcu: Make call_rcu() lazy to save power
...
Implement timer-based RCU callback batching (also known as lazy
callbacks). With this we save about 5-10% of power consumed due
to RCU requests that happen when system is lightly loaded or idle.
By default, all async callbacks (queued via call_rcu) are marked
lazy. An alternate API call_rcu_hurry() is provided for the few users,
for example synchronize_rcu(), that need the old behavior.
The batch is flushed whenever a certain amount of time has passed, or
the batch on a particular CPU grows too big. Also memory pressure will
flush it in a future patch.
To handle several corner cases automagically (such as rcu_barrier() and
hotplug), we re-use bypass lists which were originally introduced to
address lock contention, to handle lazy CBs as well. The bypass list
length has the lazy CB length included in it. A separate lazy CB length
counter is also introduced to keep track of the number of lazy CBs.
[ paulmck: Fix formatting of inline call_rcu_lazy() definition. ]
[ paulmck: Apply Zqiang feedback. ]
[ paulmck: Apply s/call_rcu_flush/call_rcu_hurry/ feedback from Tejun Heo. ]
Suggested-by: Paul McKenney <paulmck@kernel.org >
Acked-by: Frederic Weisbecker <frederic@kernel.org >
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit 3cb278e73bjoelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909030
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I557d5af2a5d317bd66e9ec55ed40822bb5c54390
2024-01-19 00:10:44 +00:00
Frederic Weisbecker
4fb09fb4f7
UPSTREAM: rcu: Fix missing nocb gp wake on rcu_barrier()
...
In preparation for RCU lazy changes, wake up the RCU nocb gp thread if
needed after an entrain. This change prevents the RCU barrier callback
from waiting in the queue for several seconds before the lazy callbacks
in front of it are serviced.
Reported-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Frederic Weisbecker <frederic@kernel.org >
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit b8f7aca3f0joelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909029
Reviewed-by: Sean Paul <sean@poorly.run >
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: Ib55c5886764b74df22531eca35f076ef7acc08dd
2024-01-19 00:10:44 +00:00
Joel Fernandes (Google)
64c59ad2c3
UPSTREAM: rcu: Fix late wakeup when flush of bypass cblist happens
...
When the bypass cblist gets too big or its timeout has occurred, it is
flushed into the main cblist. However, the bypass timer is still running
and the behavior is that it would eventually expire and wake the GP
thread.
Since we are going to use the bypass cblist for lazy CBs, do the wakeup
soon as the flush for "too big or too long" bypass list happens.
Otherwise, long delays can happen for callbacks which get promoted from
lazy to non-lazy.
This is a good thing to do anyway (regardless of future lazy patches),
since it makes the behavior consistent with behavior of other code paths
where flushing into the ->cblist makes the GP kthread into a
non-sleeping state quickly.
[ Frederic Weisbecker: Changes to avoid unnecessary GP-thread wakeups plus
comment changes. ]
Reviewed-by: Frederic Weisbecker <frederic@kernel.org >
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org >
Signed-off-by: Paul E. McKenney <paulmck@kernel.org >
(cherry picked from commit b50606f35fjoelaf@google.com >
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/4909028
Reviewed-by: Vineeth Pillai <vineethrp@google.com >
Reviewed-by: Sean Paul <sean@poorly.run >
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: If8da96d7ba6ed90a2a70f7d56f7bb03af44fd649
2024-01-19 00:10:44 +00:00
Vamsidhar reddy Gaddam
0799ace265
ANDROID: Update the ABI symbol list
...
Adding the following symbols:
- dma_buf_map_attachment_unlocked
- dma_buf_unmap_attachment_unlocked
- register_kretprobe
- unregister_kretprobe
Bug: 315267052
Change-Id: I676d5634d8e7903a12bfa2c036ce938272382aef
Signed-off-by: Vamsidhar reddy Gaddam <gvamsi@google.com >
2024-01-18 23:58:21 +00:00
dae.seo
65db2f8ed3
ANDROID: GKI: add GKI symbol list for Exynosauto SoC
...
This patch adds GKI symbol list for Exynosauto Soc.
We need to add 1 function(flush_signals) symbol to send buffer
to other domains.
1 function symbol(s) added
'void flush_signals(struct task_struct*)'
Bug: 320368458
Signed-off-by: Daehyun Seo <dae.seo@samsung.com >
Change-Id: I66a9264b70dc24f30029b413077363996b3339cd
2024-01-18 23:42:51 +00:00
Yabin Cui
cfe8cce4e8
UPSTREAM: coresight: tmc: Don't enable TMC when it's not ready.
...
If TMC ETR is enabled without being ready, in later use we may
see AXI bus errors caused by accessing invalid addresses.
Bug: 256184860
Change-Id: I9c0b8c7af63a2e2e7469a8537bc721ec6ae6679c
Signed-off-by: Yabin Cui <yabinc@google.com >
[ Tweak error message ]
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com >
Link: https://lore.kernel.org/r/20230127231001.1920947-1-yabinc@google.com
(cherry picked from commit 669c461423
2024-01-17 15:07:33 -08:00
Pablo Neira Ayuso
899194d7e9
UPSTREAM: netfilter: nf_tables: bail out on mismatching dynset and set expressions
...
[ Upstream commit 3701cd390fd731ee7ae8b8006246c8db82c72bea ]
If dynset expressions provided by userspace is larger than the declared
set expressions, then bail out.
Bug: 316085841
Fixes: 48b0ae046ehdthky0@gmail.com >
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org >
Signed-off-by: Sasha Levin <sashal@kernel.org >
(cherry picked from commit cf5f113c41joneslee@google.com >
Change-Id: I4bd3f7e9148d4bc12bbc67ecdd605c2957eb8010
2024-01-17 16:48:40 +00:00
songfeng
e6712ed4f0
ANDROID: ABI: Update oplus symbol list
...
5 function symbol(s) added
'int __traceiter_android_vh_binder_has_special_work_ilocked(void*, struct binder_thread*, bool, bool*)'
'int __traceiter_android_vh_binder_ioctl_end(void*, struct task_struct*, unsigned int, unsigned long, struct binder_thread*, struct binder_proc*, int*)'
'int __traceiter_android_vh_binder_looper_exited(void*, struct binder_thread*, struct binder_proc*)'
'int __traceiter_android_vh_binder_spawn_new_thread(void*, struct binder_thread*, struct binder_proc*, bool*)'
'int __traceiter_android_vh_binder_select_special_worklist(void*, struct list_head**, struct binder_thread*, struct binder_proc*, int, bool*)'
5 variable symbol(s) added
'struct tracepoint __tracepoint_android_vh_binder_has_special_work_ilocked'
'struct tracepoint __tracepoint_android_vh_binder_ioctl_end'
'struct tracepoint __tracepoint_android_vh_binder_looper_exited'
'struct tracepoint __tracepoint_android_vh_binder_spawn_new_thread'
'struct tracepoint __tracepoint_android_vh_binder_select_special_worklist'
Bug: 318782978
Change-Id: I0598a329a4d4c455450c9d47973103f04f9e3790
Signed-off-by: songfeng <songfeng@oppo.com >
2024-01-17 02:22:48 +00:00
songfeng
24bb8fc82e
ANDROID: vendor_hooks: add hooks in driver/android/binder.c
...
Add hooks to support oem's binder feature of improving certain
scenarios sched priority by moving these scenarios' work to
a fixed binder thread.
Add the following new vendor hooks to drivers/android/binder.c:
1 trace_android_vh_binder_spawn_new_thread
in our os, some binder_transaction will be marked as vip flag,
it can be named vip transaction, the binder_work within the vip
transaction can be named vip work.
here will force a thread (named vip thread) to be spawned and
skip the normal conditions to spawn a thread. vip thread will
just select vip transaction to process.
2 trace_android_vh_binder_ioctl_end
in our os, in binder_proc, about binder threads,special thread
(called vip thread) will work for special binder_transaction
(called vip transaction).
here will expand one ioctl cmd for binder driver, it will
set the max count about special thread (called vip thread) in
binder_proc, and if it has vip thread in the binder_proc.
3 trace_android_vh_binder_looper_exited
while BC_REGISTER_LOOPER cmd, will set special thread as vip
thread. the flag saved in binder_thread:looper
here will unset the vip flag saved in binder_thread,
while BC_EXIT_LOOPER cmd, if the thread is vip thread(reference
above about vip thread)
4 trace_android_vh_binder_has_special_work_ilocked
for special binder thread(called vip thread), it will deal with
special binder_work (called vip work) within special transaction
(call vip transaction),
here, if the thread is vip thread, it will check the vip work if
exist or not.
5 trace_android_vh_binder_select_special_worklist
for special binder thread(called vip thread), it will select the
worklist for special binder_work(called vip work) within special
binder_transaction(called vip transaction)
here, it will make sure the selected worklist, the head of it is
vip work within vip transaction
Bug: 318782978
Change-Id: I8e544d9be2644a6144a9cfbd477e087d46b0073f
Signed-off-by: songfeng <songfeng@oppo.com >
2024-01-17 02:22:48 +00:00
Norihiko Hama
55930b39ca
ANDROID: GKI: Update honda symbol list for xt_LOG
...
9 function symbol(s) added
'int nf_log_buf_add(struct nf_log_buf*, const char*, ...)'
'void nf_log_buf_close(struct nf_log_buf*)'
'struct nf_log_buf* nf_log_buf_open()'
'int nf_log_register(u_int8_t, struct nf_logger*)'
'int nf_log_set(struct net*, u_int8_t, const struct nf_logger*)'
'void nf_log_unregister(struct nf_logger*)'
'void nf_log_unset(struct net*, const struct nf_logger*)'
'int nf_logger_find_get(int, enum nf_log_type)'
'void nf_logger_put(int, enum nf_log_type)'
Bug: 319451108
Change-Id: I300644b6a9221874e29ff97bd2937361c353af03
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com >
2024-01-17 01:26:43 +00:00
Norihiko Hama
3160b69e20
ANDROID: GKI: Update honda symbol list for ebt filter
...
2 function symbol(s) added
'void arp_send(int, int, __be32, struct net_device*, __be32, const unsigned char*, const unsigned char*, const unsigned char*)'
'void nf_log_packet(struct net*, u_int8_t, unsigned int, const struct sk_buff*, const struct net_device*, const struct net_device*, const struct nf_loginfo*, const char*, ...)'
1 variable symbol(s) added
'int sysctl_nf_log_all_netns'
Bug: 319451108
Change-Id: I5194eb32b01d66db1744c17e45ff1e1451a9f350
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com >
2024-01-17 01:26:43 +00:00
Norihiko Hama
4dc7f98815
ANDROID: GKI: Update honda symbol list for ebtables
...
18 function symbol(s) added
'void __audit_log_nfcfg(const char*, u8, unsigned int, enum audit_nfcfgop, gfp_t)'
'int nf_register_sockopt(struct nf_sockopt_ops*)'
'void nf_unregister_sockopt(struct nf_sockopt_ops*)'
'void* vmalloc_node(unsigned long, int)'
'int xt_check_match(struct xt_mtchk_param*, unsigned int, u16, bool)'
'int xt_check_target(struct xt_tgchk_param*, unsigned int, u16, bool)'
'int xt_compat_add_offset(u_int8_t, unsigned int, int)'
'int xt_compat_calc_jump(u_int8_t, unsigned int)'
'void xt_compat_flush_offsets(u_int8_t)'
'int xt_compat_init_offsets(u8, unsigned int)'
'void xt_compat_lock(u_int8_t)'
'int xt_compat_match_offset(const struct xt_match*)'
'int xt_compat_target_offset(const struct xt_target*)'
'void xt_compat_unlock(u_int8_t)'
'int xt_data_to_user(void*, const void*, int, int, int)'
'struct xt_match* xt_find_match(u8, const char*, u8)'
'struct xt_match* xt_request_find_match(uint8_t, const char*, uint8_t)'
'struct xt_target* xt_request_find_target(u8, const char*, u8)'
1 variable symbol(s) added
'u32 audit_enabled'
Bug: 319451108
Change-Id: I5e8b449b63100da21939b7f74c8db1df0eae1947
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com >
2024-01-17 01:26:43 +00:00
Norihiko Hama
39a0823340
ANDROID: GKI: Update honda symbol list for net scheduler
...
31 function symbol(s) added
'int __skb_vlan_pop(struct sk_buff*, u16*)'
'struct flow_rule* flow_rule_alloc(unsigned int)'
'clock_t jiffies_to_clock_t(unsigned long)'
'int skb_eth_pop(struct sk_buff*)'
'int skb_eth_push(struct sk_buff*, const unsigned char*, const unsigned char*)'
'void skb_flow_dissect_ct(const struct sk_buff*, struct flow_dissector*, void*, u16*, size_t, bool, u16)'
'void skb_flow_dissect_hash(const struct sk_buff*, struct flow_dissector*, void*)'
'void skb_flow_dissect_meta(const struct sk_buff*, struct flow_dissector*, void*)'
'void skb_flow_dissect_tunnel_info(const struct sk_buff*, struct flow_dissector*, void*)'
'void skb_flow_dissector_init(struct flow_dissector*, const struct flow_dissector_key*, unsigned int)'
'int skb_vlan_pop(struct sk_buff*)'
'int skb_vlan_push(struct sk_buff*, __be16, u16)'
'int tc_setup_cb_add(struct tcf_block*, struct tcf_proto*, enum tc_setup_type, void*, bool, u32*, unsigned int*, bool)'
'int tc_setup_cb_call(struct tcf_block*, enum tc_setup_type, void*, bool, bool)'
'int tc_setup_cb_destroy(struct tcf_block*, struct tcf_proto*, enum tc_setup_type, void*, bool, u32*, unsigned int*, bool)'
'int tc_setup_cb_reoffload(struct tcf_block*, struct tcf_proto*, bool, flow_setup_cb_t*, enum tc_setup_type, void*, void*, u32*, unsigned int*)'
'int tcf_action_check_ctrlact(int, struct tcf_proto*, struct tcf_chain**, struct netlink_ext_ack*)'
'struct tcf_chain* tcf_action_set_ctrlact(struct tc_action*, int, struct tcf_chain*)'
'void tcf_action_update_stats(struct tc_action*, u64, u64, u64, bool)'
'void tcf_chain_put_by_act(struct tcf_chain*)'
'unsigned int tcf_exts_num_actions(struct tcf_exts*)'
'int tcf_exts_terse_dump(struct sk_buff*, struct tcf_exts*)'
'int tcf_generic_walker(struct tc_action_net*, struct sk_buff*, struct netlink_callback*, int, const struct tc_action_ops*, struct netlink_ext_ack*)'
'int tcf_idr_check_alloc(struct tc_action_net*, u32*, struct tc_action**, int)'
'void tcf_idr_cleanup(struct tc_action_net*, u32)'
'int tcf_idr_create_from_flags(struct tc_action_net*, u32, struct nlattr*, struct tc_action**, const struct tc_action_ops*, int, u32)'
'int tcf_idr_release(struct tc_action*, bool)'
'int tcf_idr_search(struct tc_action_net*, struct tc_action**, u32)'
'void tcf_idrinfo_destroy(const struct tc_action_ops*, struct tcf_idrinfo*)'
'int tcf_register_action(struct tc_action_ops*, struct pernet_operations*)'
'int tcf_unregister_action(struct tc_action_ops*, struct pernet_operations*)'
Bug: 319451108
Change-Id: I8cd204b87577972e35d29c0a992c8b6c0adefd58
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com >
2024-01-17 01:26:43 +00:00
Norihiko Hama
dd0098bdb4
ANDROID: GKI: Update honda symbol list for led-trigger
...
2 function symbol(s) added
'void led_blink_set_oneshot(struct led_classdev*, unsigned long*, unsigned long*, int)'
'void led_stop_software_blink(struct led_classdev*)'
Bug: 319451108
Change-Id: I25f44f730780d41dc68cfb8697844e12fb4ea189
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com >
2024-01-17 01:26:43 +00:00
Norihiko Hama
66a20ed4b8
ANDROID: GKI: Add initial symbol list for honda
...
Initial add for oem specific symbol list
2 function symbol(s) added
'void* devres_find(struct device*, dr_release_t, dr_match_t, void*)'
'bool input_device_enabled(struct input_dev*)'
Bug: 319451108
Change-Id: I09d922aa61b7c50ad6a6c8e22f8798f0bc786832
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com >
2024-01-17 01:26:43 +00:00
Lianjun Huang
28dbe4d613
ANDROID: GKI: add symbols to ABI
...
After demand paging is captured during APP launch,
we can do it in advance before next launch.
Add the symbols for it here.
INFO: 4 function symbol(s) added
'unsigned int filemap_get_folios(struct address_space*, unsigned long*, unsigned long, struct folio_batch*)'
'unsigned int find_get_pages_range_tag(struct address_space*, unsigned long*, unsigned long, xa_mark_t, unsigned int, struct page**)'
'void page_cache_async_ra(struct readahead_control*, struct folio*, unsigned long)'
'void page_cache_sync_ra(struct readahead_control*, unsigned long)'
Bug: 315913896
Signed-off-by: Lianjun Huang <huanglianjun@xiaomi.com >
Signed-off-by: Lianjun Huang <huanglianjun@xiaomi.corp-partner.google.com >
Change-Id: I3f42c39c6432303e69f1fbae56fabf620381d8c5
2024-01-16 22:07:39 +00:00
Uttkarsh Aggarwal
97100e867e
FROMGIT: usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
...
Current implementation blocks the running operations when Plug-out and
Plug-In is performed continuously, process gets stuck in
dwc3_thread_interrupt().
Code Flow:
CPU1
->Gadget_start
->dwc3_interrupt
->dwc3_thread_interrupt
->dwc3_process_event_buf
->dwc3_process_event_entry
->dwc3_endpoint_interrupt
->dwc3_ep0_interrupt
->dwc3_ep0_inspect_setup
->dwc3_ep0_stall_and_restart
By this time if pending_list is not empty, it will get the next request
on the given list and calls dwc3_gadget_giveback which will unmap request
and call its complete() callback to notify upper layers that it has
completed. Currently dwc3_gadget_giveback status is set to -ECONNRESET,
whereas it should be -ESHUTDOWN based on condition if not dwc->connected
is true.
Cc: <stable@vger.kernel.org >
Fixes: d742220b35quic_uaggarwa@quicinc.com >
Link: https://lore.kernel.org/r/20231222094704.20276-1-quic_uaggarwa@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
Bug: 320413810
(cherry picked from commit e9d40b215e38480fd94c66b06d79045717a59e9c
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)
Change-Id: I7f0afebbcfa88b6b4e622a708b9838dd461661fc
Signed-off-by: Sriram Dash <quic_sriramd@quicinc.com >
2024-01-16 19:39:36 +00:00
Frank Wang
36248a15a7
FROMGIT: usb: dwc3: set pm runtime active before resume common
...
For device mode, if PM runtime autosuspend feature enabled, the
runtime power status of dwc3 may be suspended when run dwc3_resume(),
and dwc3 gadget would not be configured in dwc3_gadget_run_stop().
It would cause gadget connected failed if USB cable has been plugged
before PM resume. So move forward pm_runtime_set_active() to fix it.
Bug: 300024866
Change-Id: I53d07c7bfb86d4ae8d60e07096dff0fd68e30eff
Signed-off-by: Frank Wang <frank.wang@rock-chips.com >
Link: https://lore.kernel.org/r/20231206065939.16958-1-frank.wang@rock-chips.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
(cherry picked from commit 68c26fe58182f5af56bfa577d1cc0c949740baab https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
2024-01-16 19:39:12 +00:00
Qian-Hao Huang
df1cdb0a70
ANDROID: Update the pixel symbol list
...
These symbols are needed as part of an upgrade to v6.1:
- add_uevent_var
- aes_encrypt
- aes_expandkey
- alloc_skb_with_frags
- cpufreq_quick_get_max
- cpuidle_governor_latency_req
- cpu_topology
- crypto_shash_final
- datagram_poll
- debugfs_create_blob
- dev_pm_qos_add_notifier
- dev_pm_qos_add_request
- dev_pm_qos_remove_notifier
- dev_pm_qos_remove_request
- dma_direct_alloc
- dma_direct_free
- dma_get_sgtable_attrs
- firmware_request_nowarn
- idr_alloc_cyclic
- in_egroup_p
- init_user_ns
- iov_iter_revert
- __ipv6_addr_type
- kernel_bind
- kernel_connect
- kernel_getsockname
- kernel_recvmsg
- kernel_sendmsg
- kmem_cache_create_usercopy
- ksize
- lock_sock_nested
- mempool_alloc
- mempool_alloc_slab
- mempool_create
- mempool_destroy
- mempool_free
- mempool_free_slab
- napi_gro_flush
- netif_tx_lock
- netif_tx_unlock
- ns_capable_noaudit
- param_get_string
- param_set_copystring
- param_set_int
- pci_disable_msi
- pcie_capability_read_word
- pci_iomap
- pci_iounmap
- pci_irq_vector
- pci_release_region
- pci_request_region
- pm_system_wakeup
- proto_register
- proto_unregister
- radix_tree_iter_delete
- radix_tree_next_chunk
- _raw_read_lock_irq
- _raw_read_unlock_irq
- _raw_write_lock_bh
- _raw_write_unlock_bh
- refcount_dec_not_one
- register_netevent_notifier
- regulator_set_load
- release_sock
- seq_vprintf
- sk_alloc
- skb_coalesce_rx_frag
- skb_copy_datagram_iter
- skb_free_datagram
- __skb_pad
- skb_recv_datagram
- skb_set_owner_w
- skb_store_bits
- sk_free
- sock_alloc_send_pskb
- sock_create_kern
- sock_gettstamp
- sock_init_data
- sock_no_accept
- sock_no_listen
- sock_no_mmap
- sock_no_sendpage
- sock_no_shutdown
- sock_no_socketpair
- sock_queue_rcv_skb_reason
- sock_register
- sock_setsockopt
- sock_unregister
- strchrnul
- unregister_netevent_notifier
- vscnprintf
- wait_for_completion_killable
- wireless_send_event
- __xa_insert
- xa_store
Bug: 303533633
Bug: 308924989
Change-Id: Ifbc09d5025f1bd3416f136fabd344ef2452390a8
Signed-off-by: Qian-Hao Huang <qhhuang@google.com >
2024-01-15 16:11:44 +00:00
Stephen Boyd
66cd99ccdb
BACKPORT: UPSTREAM: phy: qcom-qmp: Introduce Kconfig symbols for discrete drivers
...
Introduce a config option for each QMP PHY driver now that the QMP PHY
mega-driver has been split up into different modules. This allows kernel
configurators to limit the binary size of the kernel by only compiling
in the QMP PHY driver that they need.
Leave the old config QCOM_QMP in place and make it into a menuconfig so
that 'make olddefconfig' continues to work. Furthermore, set the default
of the new Kconfig symbols to be QCOM_QMP so that the transition is
smooth.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org >
Reviewed-by: Johan Hovold <johan+linaro@kernel.org >
Signed-off-by: Stephen Boyd <swboyd@chromium.org >
Link: https://lore.kernel.org/all/20230202215330.2152726-1-swboyd@chromium.org/
Bug: 319064658
Change-Id: I633e6e1bbc3e79292bfde927e46f84219f0178ae
(cherry picked from commit d1abd69534quic_kuruva@quicinc.com >
2024-01-12 22:16:42 +00:00
Lianjun Huang
a70d3b7bdd
ANDROID: GKI: add symbols of vendor hooks to ABI for swapping in ahead
...
Add symbols of vendor hooks to capture demand paging during APP launch,
so we can do it in advance in next launch.
INFO: 1 function symbol(s) added
'int __traceiter_android_vh_read_pages(void*, struct readahead_control*)'
1 variable symbol(s) added
'struct tracepoint __tracepoint_android_vh_read_pages'
Bug: 315913896
Signed-off-by: Lianjun Huang <huanglianjun@xiaomi.com >
Signed-off-by: Lianjun Huang <huanglianjun@xiaomi.corp-partner.google.com >
Change-Id: Ibb1e31b6912f7b6b92b76727f7e5043897434def
2024-01-12 18:47:42 +00:00
Lianjun Huang
d4db0d5d08
ANDROID: GKI: add vendor hooks for swapping in ahead
...
Add vendor hooks to capture demand paging during APP launch,
so we can do it in advance in next launch.
Bug: 315913896
Signed-off-by: Lianjun Huang <huanglianjun@xiaomi.com >
Signed-off-by: Lianjun Huang <huanglianjun@xiaomi.corp-partner.google.com >
Change-Id: I2698fefd347745fb4ff84b111caedbb3bb365ce3
2024-01-12 18:47:42 +00:00
Nikita Ioffe
fd40c1d901
ANDROID: add 16k targets for Microdroid kernel
...
Bug: 317201718
Test: tools/bazel run //common:kernel_aarch64_microdroid_16k_dist
Change-Id: I542f07d1d0b4f2b6a3c4c58185eee16b2b7f1667
Signed-off-by: Nikita Ioffe <ioffe@google.com >
2024-01-12 09:14:09 +00:00
Kalesh Singh
82bf9e7625
FROMGIT: BACKPORT: mm/cma: fix placement of trace_cma_alloc_start/finish
...
The current placement of trace_cma_alloc_start/finish misses the fail
cases: !cma || !cma->count || !cma->bitmap.
trace_cma_alloc_finish is also not emitted for the failure case
where bitmap_count > bitmap_maxno.
Fix these missed cases by moving the start event before the failure
checks and moving the finish event to the out label.
Link: https://lkml.kernel.org/r/20240110012234.3793639-1-kaleshsingh@google.com
Fixes: 7bc1aec5e2kaleshsingh@google.com >
Cc: Minchan Kim <minchan@kernel.org >
Cc: Liam Mark <lmark@codeaurora.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
(cherry picked from commit 3b08ab9a811caebe1327f25f51557f95200d94bf https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable)
Bug: 315897033
[ Remove ret arg from trace_cma_alloc_finish - Kalesh Singh ]
Signed-off-by: Kalesh Singh <kaleshsingh@google.com >
2024-01-11 17:56:51 +00:00
Vinayak Yadawad
800cac4b33
FROMGIT: wifi: nl80211: Extend del pmksa support for SAE and OWE security
...
Current handling of del pmksa with SSID is limited to FILS
security. In the current change the del pmksa support is extended
to SAE/OWE security offloads as well. For OWE/SAE offloads, the
PMK is generated and cached at driver/FW, so user app needs the
capability to request cache deletion based on SSID for drivers
supporting SAE/OWE offload.
Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com >
Link: https://msgid.link/ecdae726459e0944c377a6a6f6cb2c34d2e057d0.1701262123.git.vinayak.yadawad@broadcom.com
[drop whitespace-damaged rdev_ops pointer completely, enabling tracing]
Signed-off-by: Johannes Berg <johannes.berg@intel.com >
Bug: 301410304
(cherry picked from commit aa0887c4f18e280f8c2aa6964af602bd16c37f54
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main)
Change-Id: Ia665b9760279eb77347e79c97d177cba3beaa107
Signed-off-by: Paul Chen <chenpaul@google.com >
2024-01-11 05:46:54 +00:00
liangjlee
a41a4ee370
ANDROID: Update the ABI symbol list
...
Adding the following symbols:
- dump_tasks
Bug: 316372318
Change-Id: Iddaed980a227d8beb966cf0fae24947f5bf8b473
Signed-off-by: liangjlee <liangjlee@google.com >
2024-01-10 23:50:22 +00:00
liangjlee
0801d8a89d
ANDROID: mm: export dump_tasks symbol.
...
Export dump_tasks to dump per-task memory status when ramdump.
Bug: 316372318
Change-Id: Ie0dd1a4c7ada280dc0c7696781b4b9a5e2a100ab
Signed-off-by: liangjlee <liangjlee@google.com >
2024-01-10 23:50:22 +00:00
Bart Van Assche
7c91752f5d
FROMLIST: scsi: ufs: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
...
Calling ufshcd_hba_exit() from a function that is called asynchronously
from ufshcd_init() is wrong because this triggers multiple race
conditions. Instead of calling ufshcd_hba_exit(), log an error message.
Reported-by: Daniel Mentz <danielmentz@google.com >
Closes: https://b.corp.google.com/issues/310401362
Fixes: 1d337ec2f3bvanassche@acm.org >
Bug: 310401362
Link: https://lore.kernel.org/linux-scsi/20231218225229.2542156-3-bvanassche@acm.org/
Signed-off-by: Bart Van Assche <bvanassche@google.com >
2024-01-10 23:15:00 +00:00
Bart Van Assche
28154afe74
FROMLIST: scsi: ufs: Simplify power management during async scan
...
ufshcd_init() calls pm_runtime_get_sync() before it calls
async_schedule(). ufshcd_async_scan() calls pm_runtime_put_sync()
directly or indirectly from ufshcd_add_lus(). Simplify
ufshcd_async_scan() by always calling pm_runtime_put_sync() from
ufshcd_async_scan().
Cc: stable@vger.kernel.org
Change-Id: I4b6ede95360c665594963fff0962742728064fb0
Signed-off-by: Bart Van Assche <bvanassche@acm.org >
Bug: 310401362
Link: https://lore.kernel.org/linux-scsi/20231218225229.2542156-2-bvanassche@acm.org/
Signed-off-by: Bart Van Assche <bvanassche@google.com >
2024-01-10 23:14:57 +00:00
Aran Dalton
febcf1429f
ANDROID: gki_defconfig: Set CONFIG_IDLE_INJECT and CONFIG_CPU_IDLE_THERMAL into y
...
Under certain circumstances a SoC can reach a critical temperaturelimit
and is unable to stabilize the temperature around a temperaturecontrol.
The system may ask for a specific power budget butbecause of the OPP
density, we can only choose an OPP with a powerbudget lower than the
requested one and under-utilize the CPU, thuslosing performance. In
other words, one OPP under-utilizes the CPUwith a power less than the
requested power budget and the next OPPexceeds the power budget. The
cpu idle cooling can solve this problem.
Bug: 299411923
Signed-off-by: Aran Dalton <arda@allwinnertech.com >
Change-Id: I1c17b340617e88be075097dc47f30ce94be2a4d7
2024-01-10 00:12:51 +00:00
Norihiko Hama
bc4d82ee40
ANDROID: KMI workaround for CONFIG_NETFILTER_FAMILY_BRIDGE
...
Enabling CONFIG_NETFILTER_FAMILY_BRIDGE causes the new element,
hooks_bridge[] to be added to netns_nf. Since the KMI is frozen
this could not be added.
The only instantiation of struct netns_nf is as an embedded field
of struct net. So instead of adding the field to struct netns_nf,
a new "struct ext_net" is added that contains struct net and
the new hooks_bridge[] field. An accessor function,
get_nf_hooks_bridge() is added to get a pointer to the new
field.
There is a global init_net of type struct net which must be special
cased since it is not a member of a struct ext_net. All other
instances of struct net are allocated via net_alloc() which now
allocates a struct ext_net.
Since CONFIG_NETFILTER_FAMILY_BRIDGE is a hidden config that is
needed for vendor modules, it is enabled via init/Kconfig.gki.
Bug: 316040984
Fixes: 0145780bfc78 ("fix KASAN-related kernel crash by KMI W/A for NETFILTER_FAMILY_BRIDGE")
Change-Id: I2c7384e3df9b88f12464dc0138986fed12ca626a
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com >
2024-01-09 23:37:43 +00:00
Pavankumar Kondeti
227b55a7a3
ANDROID: dma-buf: don't re-purpose kobject as work_struct
...
The commit 5aec776ef8quic_pkondeti@quicinc.com >
(cherry picked from commit ce18af9b5dtjmercier@google.com >
2024-01-09 17:43:59 +00:00
Dezhi Huang
c1b1201d39
BACKPORT: FROMLIST: dma-buf: Move sysfs work out of DMA-BUF export path
...
We have identified an animation lag issue on our Android 14-6.1 product
which seems to be caused by contention in the rwsem lock during the
dmabuf request process. It appears that other processes are holding
sysfs read locks, resulting in the blocking of dmabuf sysfs node
creation. We encountered an issue in android14-6.1 that is similar to
the problem described in [1]. So we cherry-pick this commit to
android14-6.1.
[1] https://android-review.googlesource.com/c/kernel/common/+/2111974
Bug: 311282169
Bug: 206979019
Link: https://lore.kernel.org/lkml/CABdmKX2dNYhgOYdrrJU6-jt6F=LjCidbKhR6t4F7yaa0SPr+-A@mail.gmail.com/T/
Signed-off-by: Dezhi Huang <huangdezhi@hihonor.com >
Conflicts:
include/linux/dma-buf.h
1. The android14-6.1 KMI is frozen, and the modification to struct
dma_buf_sysfs_entry in the original patch triggers ABI check
failures. Instead of an anonymous union, use the existing struct
kobject directly as a work_struct with type punning.
Signed-off-by: T.J. Mercier <tjmercier@google.com >
Change-Id: Ic0386849b6b248b0a72215633fc1a50782455bac
2024-01-09 17:43:59 +00:00
Greg Kroah-Hartman
0177cfb2a2
Merge tag 'android14-6.1.68_r00' into branch 'android14-6.1'
...
This merges the changes up to 6.1.68 LTS into the android14-6.1 branch.
Included in here are the following commits:
* 8968561242c077094653e0690152b8c9b484c69dba6f5fb465f38b4e99e2d9ef7b05cccf70d62acee6d55cf4939c322aaf28189c2a8293b4e440cf60d52a5178cb8d18a015852b9b2d28a96d6314c3dbbe297475ca358bd5f43618b02e434369540c108d2467f4f8cb0553d5290874799b43d8d59dafa9eb638a6cbacef434703fb8a8027753abc909ce57d0b12ccef705f48430635b9ce109b7488e25331ea5bee9affd3716da1f84f5c8bf22e0d087509778714ccb34d431af6b1f1156a3049c9a3030289057efc67c553b4dee9efcdc76a945568638f549f837b9458affed0641c5dd545e613eaee4451705927a104b716fcacd06dec254c5b0c195a8258a3d746c7e5656634ce0f9e9e156db8479f5ca8bdf4aa7e84d07ad456e1c40421e0cf3ebb09d58df066dcd87b9d78789ba21672976c28e0b80e6af0d766b29f614920f84a6e818847b6bbac428285eabbdd750866166398d1856e1d4f02a68ff566a8d766d50aa9656c2adea3191515d971cd24132cc3a3a686cc4de09574a6db80ff5e6958919bcd50a3bd61c1c6d5c7e6a71d7785615c251f814b00b5009166e0d6c685b20fd56ca2ef33d663db04c00f018323907e9cc85c344e99dd8d2558e726ec4dcc915ea0675fe3b328b23707c8adc1141ae5cbb43c57c3dbfe5a5e2f98bba38f7a0f2f57f51b5515c25be770fcfc90c86a5325a055f68bc7b20033c796895b45255ded034a38c1e766f8b41bdcc22282b5acd5812ac3b0ab84d8cc87d18bc5b79df6dfc2d811d3122143a0e5a8dd0e20b41188de9839f1ff56298ab0a929e8375ebcb4e19d32358e532083baaba7908c11b7e26d219269741c3439857e2fe59a022a8697ed498095c03095a6440233c32bcf07be574c34d9dd976c4353910ccbf251e464850454a8774a6333166c76d1daa9ae3dffc945bfe4e0b0b0afd4e149d005ea01e1c9561b4385fd29433b2b5ca94561207c8229c02af39b80173008b807fe47a63521ed03176160c2296f8654b70c9704c26190bfbfd94239225a4566b6b9e78d6c69be8f66ea8d54470adfc90773de0730c8baa37bfd2689aea4f217cc7f6a687559196c364c78c57e3ce3c5acb59a92719900fc91685ac1b9fc81912fc0d33871b6675fd86e541ba6eb3a77a2c0cbb97b1ed7e211b671a41ffc4dc8d034da8253c3237969529d82b366a646f1e9c19ef91309a57d11ef4d3dd284cd311bb0823990da73759e73556ecb5068f5580de965ca5f565044d1da3f5de10b5e2b202821db536601d0576b9ea6f5434535312848a124b9e78cde700ceb0e09d243a51d5f999317eb8ec27ae220870f19b549046665bef18209382dbbcc2abaa409bbc655e1862c6d82bac875ee3a09e6025052bbf75b5016ce38ea2b4ba9b2af1386be00292321d13e7cddbb41bdb46c77f3dc539451364975d5f2ae944affaea1ec49b4a744f59f96234bf6b1e1d37f16c6a6c7e21ea574927fcadf0ecebf0b3b839fb6300bc8b2cf49311a0ff38402b83234622ee0ddb2a10ce6301008332cb6c63442a4d4d016cd73627218b01195be438d32160320e0a95166859862b8692ee2c2247698f39d297a23787b3168b681aeeda418aaed5b81dd3788f6e9d195514bda6395a63ca1a4ec4508db9b57eebfb805bc8d96fed10c3d86fea1c8f75ee927545ddda9c21feaf558f8d04278ff452b751686ce2db25d16cf5c649ce79149b2fe12a7ed2e4c2d08b1d088be59c4ac2d98aaef2d5b3e5662b8870845d5bcfb1ca334e6378c2c3e974e9c412dd4c1bf34e999af7cf249ceee95ce01249a839fd91b48f1094445d9583f89fef77109aff7c51b4c89b34eef3307a6525c8e8c1105c0c55061c3230a491c7be357f211677757a105de27532912ee8694fc9c61c0286742a963f9fe447c4853f26d9b2570ad7d59e79cf2ae6494d2acfff57303793cd2ded79a1fdf4c241d7852a0ac7c78a4aa6645e4b693bc23b9eaca8e6bc42fae659419ebcc00b48970ce1fc98ea26994da15569969d4c721c18a62ca58bb382b5e603ed6f5a9fc94b7cfc3884a8859a3a9f1e6ef7f13c72a67c18704733ed892f0cc5cf436c89c608842963cebccbe801181fd67dc57d2faae81bda9f55393ff4b130213465654af4c8ba911edc6ceab9ec6446e121f6d73d3a9a9c256fdef67fd8ef2ebc8b758cd2fc10e26287ceaa8521db0b69e46d74820f740660fed17ca56406cce4b2157836a2ab1775bee186ee16988743c6114c845966ecd1cd8b812171018e72ef87bb8efc7b2fe26792b9eca53d451c5a6172d9be7a1297c15cb712da5a657b34fe4fccb016fff70b0b6fd8f9ba5dd0d9c736af32a8c37aca3dd5366f3648f14241b51f3ec4d39575105dd83db613e8ef65c174043c8e0306dc96fde8fcb964a0a39112f4971589fa9bacc1d5415f644b1f354d162ba505591c0d171ed904f4245d9ddbf4b5b597f3c85dd7eb37615b8384d8c5cc9164978bce614b383d0151cef2a5c6f1c2369366ce581f8631594a5f00e59381ff65123a14f4fd7bdf5bb7b408fdfcdf9697153a4396c34ae3c85e738bdcaa7c03e9c3d6b09cb24d42b52b548893404c5607a415d4f4dff37111fbc666a9acc2d336140ae9611e8404eaa315288b0e485f12eb573fa2b708f7f3e69ced27f5dd22af558b8ee45f48b3ee0134f9cf17836e8025fd07063481ff381173d114dd574bcc07bb3676b088b63997703eb19994a0ae698ba573b334bee784313dd0377c4c7e978e9a64996584a6e4754584c9d30dbccfbdb367274206f46d3f7dfa5147447f5eae858539f11604e584b232a9c8d2b3bc8c7f790ea5bc40a01e106f08fc9e81c1a131e1ff253d8a7ce2ee18dcea2ba90988487f809afd71493204f1bc13cb9d6ac30d748b04ff8a51079e1e0887eac88cfbb18a2132941b452fa74d29fc6460508dce4c55be085568d774eb10fb5c134ca551ffa1a379c52aac58842ab6c1237b965dce07a48e54a91d3e454d0cdd7c07e94f204f9457636a49e973f40de1dc4542861ee1d0f68bc01793dc461e80ddcf21e7ec4ba3d62f32b9fb9a67f0cc1368faaf075d06b3e795a56654eb2f435be2eeab07ddd018a06f2eebddc424aedb0f3e5f93fe04ef31a3e33166c3af556dcb2605c2f7164cb037862565f3249e9e2107aedba6f08cef70ff9b65a716fcda24b1a7fd0335502594bdaa1697fb6013f3645257ad8dfb1b16f0419f74b261e41bb61fb790a5d4be493a002d2473dd5e9fcba176e082326473424fc463819ebb3c14eca3e0b55dea997639c10041c269083c526dd7540a6122b72ce5e6fa9ac60ff5617a21c7105d29fa8deef592e71a57e35d922975d5c85cf4ba1a9eef3ecfcb1e7c177a048a90acb3fd9db79e677fc3780f31f6ff62df683b6a73248cdc6b8b818fce427169e841a59ac1a807a4418990db4c1d5ec415f113d9008b08ab0793d242f63e3b70d45c7e1d1cc275d16c6a39080bba9302fd93fc3423d55cf1c7f81e971f026218f8b2a2828720e785584e0ac2d14682b38bd370cc3c68620ef4604d500044164645d3bcd5eaa4e4ba7a0fcc2cf28ffa7c9cc3cba0d43e0f7c9ad4c7f065209379924ac9569bfd285bdf34ca329eb44db68c558817597d49d0ff613f34828baf819d96ac07ae5691e15695b50ca24c3e72a90e7eb440b6914f421651b334f13ddb2fa5ec1ea1fb221665d9f61324e32e9cba563a8e03f133de6ca501ad3b93096d29aee642ae995a2768b9de20412ca3567fc465d26555d699e2d2afcde812ddf7ab9dee22185f3617ad59cb7859194f3135e2dded3cc4f3cae166cc2bf5479a120a049ea5df729072f5a918b4e6526e403a3f100cc63a13e2d49647143f450c6c2c63b9d7f7db98de08095231eb11904d259683bcc754a6f5c395e747c3c6cd222fc61ee866ef947addf42b7c8dd150294818567c6f64952c9222b7dc8d837850d36aa3cab6be4b0d6ddb64efd8e6d19c75bf9a8b0ee02b9c6a8351dcd20a4a07d425242e4542aa75698387c94d73482aaa72f98e76941a16877080a3493291d3ecf3ea2c6e85b6783645be98ef0224ee53938c4c7318b7d27cbfeffe0b2a20f7454ad98f313ef994468117381882fc0cf7577b6be3199b3facca420ac4f9f0ea9e4726164fa9a0b1e10facbd2508a98c345fb0fc14428c834a800c582b38f0dbe8cf2641099cf0f3328af99275f65d774e0fbf31881a2c7a2f35b772e415e174db59e63be5b0e230805e3b2141c75b2352c64cd91fd028c938968c63e943cea5410927976fa9177e218114a241689ef19bf0732c646a1fc94de1c1b16ea57d6cbb5e307366dd56d43244947635fa173bdbe399b8bee4f891fe4cb064f617a1d8f675ea55db76caa7d1a04a521917cfba4aeb4b91ba060fc5fcba7ff9ca56cdfab3f9b592a9e60ab53cd69f7f2feab701e2d93cfd1b991ba64898e8ae37f8637414a28de149fb68040318a169810c6a15d97104d179189eec14b11892a61a1efaed5f4794b6b16a19554aa901f84846731bceae93d76aab3e13b35c00768b3e901e83edbc42a28ec8322d55d82e092cf47c6fba7207f5b8c47183a177b9425dc440293d61c5ba504276bd42849c732a67ca4312af02d24ac0f8b8fb7d58278cc71d7749fd2dbeaf0095a55919d7dbf71ec65b9156415ee813da0cb2a9ba69df8d02b6fb3c11f6aadd1f3a6ad749e92fa178e2cd1fb3a9c59e6586b5f8e48a1552e90807ab6615a909297e3ffcaff8be2cad72d02adae38a06894666b083aaf5db65335aef1ab8dcbbd0c4e2ccedd4d153fc16c1ad329a8d1d60a647f27a74e64d23dc65472bd4787432b17bc21f0b5e729d4e8be39f669107c11a52493851d844d7c7b0ce54b1ff95007583a82bd79cbf7932afa9bb7cebc86481d6957635deb80aaff5f7c92de3bf6cb469227b1d24e222a54e4ee3b3a0ffa70cb0d59dcbf304de7852cd51ba576f9557a5c9161767bb7c6b46084582442fd24d7bdabc0ee84d146badf18e1a7c3d2e1daac90c719743b91df291fa7abd3c5c6e2076cad88c68af2af6a50b796d365013f826980cb567e72788984ec47933331b265af1521fe0b4af493dde68c55fc098fd62c65e799f14107cbeb50aaf807756c68535657f6c1b3d89a22806f880377017e8350033fb1a555316fa59e273d0bc9ab0a179813cd5939b70fc7d70d0725232dafc9ac0e8e009b900fc2c412ce896690f5f5674516995df256e8332523b132fabc3289b24faa2740b09d4f579d350f35a907c5b978a8ce40c8eda600e4048cf4615a57a54a8bc6edd5ea504c90c7bf7b170997012d887624b1f9ba556f2ef550a40c609e28093dd759e459970363e1c6a6c926ae7960d2a0946537b4597de979982ebaa42a7cb9257e44ff9c22be24c47ac9c2e4a81d3d0fc4cb9d2b5046b25322652d199dd3410b70235b7441453ff6680d55abaff8370a0d89f4c391dc2e9a27fdce59ce4e87a8e784d01f9bbc56df79d680c2e40b9a33e0f75c1a40dfb0f3c97937b554499c42877e34f55d4929d665418948a0a98f663d79a497503c6ec5b9223a56fec573670dae8ad0104afdb612631b77ccdce2dc42b3ea8bdef69e434a1cb830c11c9c0cd12535b97a6650e78c4bb1c9a59071e5f00e9db883a3db2215852a2b57325bc87768cfc3a19543ec606c43ab6acca43d813129debbb41b80b85f49428e71534187bc7b82fb298584582826d53668c43b4843bf39df5350c6f78acc36089bc3bbf06efb83df98bd319587e6308d68fa280d1a9d85670128f7ee2070589b5974b0c891fecefb092baddcc2c7146c541fa664e9b3ec84db0310063d42dbafb0081f4277cb5622d563aa7529d976cd3e34a12fb7d1aa1e8e68204479d344a92f9c2807e2a490dfbf6510b8ffe3cb07f4a2c2967db68ac51fe414d36c117e129327d80a95acc209900376cc743612c22e92889d92e4fc54c731e98fe6086258bd5f980e9a57d8803da01fe7082b1fb53f8225c3c65679d2ab67e713629765f7ec7b7d3f2103c66dcf539c2ec94a876d12296eea254ee1ddc5c26aae372e7c96f46051620531a3db75fb8a2ee20568d06f6825a7a6a3aba305517a1a7a8c49dc69b1c0aca7f6380621de364f55cebb4f258fd94ab7c9947693bfbdf451e76f9e17bce0ab4dda701d0d889b7bc12a5b03f56d37c7371b41a174ae0a3b8b9793c9c038b184ebff68e1f41a853209f4a67d8071666451eabdd1f47ef257517c00b8409ee076d0f8dabe79ab4bc030af7a204f9f3cb339148f7869d4f7441cd4a43be67d6bfc019c713ccbd1281a2d7e501045e386a4d6f838979ed70dabf7039825fd39e3249c0639ee7fbc08085888045e82d634fdb50e4e1ad35673ced6e018fe916ff8a3f884277f9695b3cfe1c7b863b8bcd2ed67a40dddae6fd974706a1286345fc968818d503984e24dbc9095c743b6b21a227280806a6afe11e03a269591c4eb1bc39cd7d804f52f1cda3c5ddfb4251dab39375ea7f26071bbc5a66ec67c83dd5599befdd79855516cb6e231665cc6f16e02976cfe27c2668ac550711e0076cb0495d36cef064fddecfce1e26b41d47d1abb44198a7a6ef63cdeb20ee7d0e60e4ffce58f479b526b534a3f090155dfd999ac0c05365ee6b91411df1ed6c4e59437f033e30ad52f21e3d3dd998f78cc7c26d0ef5980a7fd5e59ee89579e6cf47abd7d88eb1f933cc7f2ed86ddeb1736354a7693baca82d35ac8075ae8a716eb7f8cce6785b847a22e6fa51f9f4a6bdf9002bd3c874fe6efb2d181a6806f27ed3a8efb9de1000adbac37c09504c373d559a5d5dc0f4144d0d4f13eab0e8242ba2e20b0a7f9238f307eb93dbe12cec6774fd56785a3a08bafb12b629aa804deca1ed7f07ef8417c890a8879857f811e5f23859748e93aa88170c4795de8c04dc44e3fdb05e989aeb40443bde2a4c380f0a1de22ad909a40861c57bb986e3294cccd8bb55130d02e39b84448f3c5c7f926a0c824b77ad12d2087a7d44dcf6d33e2d81896fe10642126913ab3aa429c8f20c4b0c01c8a235583302c167c93f6b7feafde787367bc3d9fef0af2250fafaf5a2f337658e5189db6db0af76d43c3e49745429ecbb1be0cf8e811feccde2dbd97efb91501bf0ef883cae4653225f41d97268ce087867e1d926945f2e4f1389465723e01a404795c4cd952d43c003a0a34f044109f7d1a8389a4aa5e3426d3c7c72e65c1aa21bb660420f44104fa6426ac6e00bc30e28fa550a494589403a341e88414e64025d2ac47096c3a183048b072ab6c45671bed3c0934747e2f8ace6403e782836c72e8d008b2a93c5af19ebfc6a9da01934548045808be15d30fedc2032b15fef3360db638be503e334565da99afba39489606620279eae81af9278e998884d9dbfdf5dcc3ed322a85214d546d0674a1c4eff65fb82b3b4ace87a3c24ce1942dc48f42fab90bcde3c0b681ba45a521f6b687bf0cb8f402cfa9dc32c45350e54712c80c4f0d2341e79f8ae2d68194e1abc05621888b248ccaabfffebe76e504d37df40b1a671a41d604a303129823385632de8581255403add06f92fd833de53a27044a96796d2ae28868bba7b8d88df172a18dd6532a836efc21ea540ca0aea357df1c2f6df1c4a9efadd1f30d68f7d022726e3cc1c2772c1e4df931fb4cb6c38995f0a37614109cdaa544dc4a0b3b2cc2de1809bb19ae6070f0cdac823ffba5d77e2338802f26a440d0ed72c5868092c2f1fb3f80e2b0882405b8d3ea0938d20252d96a588f440c4d2ffd85ee306a7365e2b101c2d257c5c25f89c0051d4d3cd1830e77e3ee94836b94e5efae5cc598e35aff536261ca7bc1b084bb26ec7ed6f505a013ce2be4ab86ac56aed37b66d88d4b1bb72c23b30712acedc5372d860416236aa0a050c654789d93f9477ff34a56b9709c6d759100a75d56bf64a559f2d0d30931f1f76378a8bae614d615d49d5342dafca8a777b28d7396ec51b1375de6a664114a7e73b2852ec0669f4e850efcf2b586ce1064febca9ae9262b12aebbd3c2fd48179ce3c46ce78de01b3400d626e301a70d365fe12f45d97463c1f3254187a64a065cb7ae3f8ae187386465e65a8b2da764c22bbc5dd1344de3a08ff0544bec18d7507f3e1d754b5d42b452960a36f0004fe59c6269f5d1cee323e56c0568d1e889ef4136151909915293c3697fb94e3e36aa50d5784f834ad03463f637309b0a1dab4a8edbb558160321c5c3f95f7807c269cbbf178c8b9cdce53a017c3c1a20c1222351c03529bc8e02850a8620933c3c21f99a5adbdf870d47d2d77530a1d4b78391977142bed989f071e3e7830b0d9fb52165fb2635ac69585da49ad6c1c15b09f45c598790316bebd303ad3017a17ad6c3444894e831ebf431edbfe9bde05fb75ee2d9d7cdd260b2208af676c698abcb12f319df6cfab66f23107989bee7a802447c6f17be2700b25a2f2470977ae4dbe29411dbe2c621ca008c537ab62e3415e833591265b3eed11110803cc77a3a9eab5008dbed0ba37e7b31ae7876daf90656fbf698567c9d84ff86d69b2e8e4a77ba250f2840dabfec80ad4585afe80b58ee9f9b2ec53acafa191b270eb733b53e4e000daf3950736464a76a87b333ba9951b2309eb7ed4aa0c28e1a6594d7678edd2dfdc6f6a505276a7a2d5a0884aabd18c83bff4bb7f9c8cbae3cbb6fe32f79ab92f9c7c7ddfc91bb3e1b768e857ac3dd6d75eb00c64c23727596c7aac8d89ef46975487378415da0d3204c0fddf15dbcda2c30ed9986046618e7a740d3f3412122a2eefda9e32cd386b08b4a618391525926b0886d2afa9f7eb1fcefddf3a1495c4c58d6d022e4ea9c48ebeab0ed65e5a9890e8b8cde8ebb5e232f220563cc3d5d3437495846b1116671d259b90b8633efcc87c73eac38c5faf2a97737e9384e1e8851b5135a35fc1c0091b95e3b4a11602cadc9ff0312a156f9a7b3b33c48a365ae4f6ec84059b5e26fd381bfcb01837e0f7a641bc52f9236d2ea641684909df36a5b845b57bb20a245df93fa5786f9f7f660df65cb115b6688144f93c622039a050740664a358b795b100bb044ecb51a434e87376143dfee73f937c59eb275fec67c799bc32255b01c5a849d2b588faefa28949c72c166dd51b69a194064fab1ad0a147dd8ac13acfb66e879507bd10140916e4138a02c8929f365f4c32ba943c6d98d8346ed39df4169fc9b6c668e2f33024251bab2eded5f52614f46c177c03262ff5826b1b2750de1c9b066f692a6fbf025e30aa7b24c0638d0d1c44238930ec7679d72254c2b08e6b680f21f14ded0f1534487cc3e86f467d358a9d4a1ea6719b30a8790bede8b4b51c9efc3efe4e58ab834e4018b11ecba508c3353fe877fc75d2c629ba752001fae817d3e719c01f281651e66d20bd3466ce4f4a5623b3d3008d790dfeeddf96fa712a5f2364ea6904cdc97d417952d5aad29756f928663eafbb6b34933ddb0510a1364ec1f788e35fdea32c9cdbe387f5bb254be0e0123e0e5300447c572c04f416730a429d6542846de539282c1d531aa0913a45130bb7fcce3258b4eac2cf4449b0f8a9dfd1f38ead73fe9b4b72567da359f699f3918cada8f70a841eb4f6df4c9dee03d57f6ac6414a1a7beb37ec224d980baf191abec4186c79c1352d54f1d4e8a4b575d00fec769b9fd7241c2627c324c31b0e0f6952655a6908c628005acced163ab1dce40c9e659aa39697fea0e0473093519cee444bec9cb90fe0ec655ad652c0b40c310a54974b0078d69b47443c462bf4ef8ab65424d61730bbbbe16fbd8b28fe4c4b7b119c585664ad23faaa476a7ad43f588b82055c242865873915d26b4578687563e8b2b755a1a58277212f5250feed7925845448613a7f5558ec22efcdbef13c3e70048aca1a9e57037758610516fec9bc89a019dc02f41d576f96854aa107ff0034b0aa1e83a20c21bff1c99d91723f6cadf2cc87f2cf177a579d20806cb1e6cbacf8c749a62733bbae160dc7e39dfef8cdee81e2a2df4f74f1869638a14f174c8d2c6c833f1e28d9d99acb6a1c3657e5fa7ffbb01fe9a52080d6edcd63d39e7f92353f647622fd88f56329285fea3a2dbbb6090c9a55d53ad5caad0760c267045675fc97d823a1071f45752f1ebe045b6a921eb7ae9ed63b812b316961c859abdd7e4ce5ce29a5075570a3ed0dab9dd326133f63d4dfebcad3d32563853bf3b8a4e34fe1bc194e184a8a7354d90641c972cb67482a93c65a4ee1d783be53b02dbd1cd7bca0af538681c8a2c239424a0a4567067c3cf08147156b19ce4df8000bd4d382ba65d8e939c21f6a46907e1f6a2431e7e8b5e7275e432673edcffa09307f5f59ab92433493b1cf912054a2fb84f5214e1512ff1ecc2eaa8319f0e8cdddf010697918ec0d9d289b78c0bb1573512e0914e5a05d80bc19142ec7393fe633065fabd179c3d276fa8f0ab9b09221a68d440112c6451d6659570bee6788b9c79c0ecf534a513e84e1f3457e9df5ee37bf22a6fc637c655d794cef349b9165ead405dbaf049b372db2b8d3065fa2cdd2c7ec9e9eacc87f4db148092aed623b2974b20e4569afdedde0d912daab4d496b6638c086babbbf8bcf883e244a9519099e3add2eeda1df691ec5a5402322c517736a315c923c1f2638e31fb80a28fefd4ae85b88380990979a9f7e65c03d5a556a0df8d54f030271d482565df3520695711e257d0639f60def94eb9a895ff590b8019ffa9b251d11cfd1f30d7dbdbe380fb8e1608b0753ef5ef4cd994502fdc0f8d381adabbc5c96f82feffabdd0a99ccf8d79b25e5d28830faa63666058d76a44d2684523aeeeaff996d61ddcd7b19dc5f88421f47413c3418a5868420fe4dd2db4677b350316250b759394fcccbe1a36206a6bbb0e44b27263858124ea07d24402875eb26fa974c54357fcafa0afcc9d4a19a995e11b201b19fc6625b784489c8033c0d510149fbc18378e5588fb39171d323072a4d85f1ce6cbc672508590e3953b5779f6b391b0497306abdead67b5a2b97cb8f1dd1b757e7696b78062f16c4dd1db0724a0160c3e7a00d862aa98181fbfb99ac5d9c6a11a05b211f71c1c02efe67c5814d6c1845cb9f43481c0d086d885c208ac2689502434e3522b95d206a77d40cf7ee2cc623122e0c0e125f495fa6#1485 on Zen4-based CPUs
| * 386398949755b51187d2ac2d5e70fb7aac2f2c00f041091756a61d905a860fb82afee55bab104963f17e00fb0cff42d244b37d4ff34b6cb166ce5275e93a7677f08ab33ae244a6bd5e165392426b1f5f187939163b88a204cc0cfecb419c62fb9895ab951edbf4b2853571910368ea9ae69b0ec5bfe67d9ff049b10aff721dbbabf1fe158194081e3b981a258e7dfe9c2a0796c5342455027c1d99853dda54ba684accd26df05befe5c4e4f2611f07ab8075d3a404753d5ae289be6ad344a698195f3a0d86ad068c50bce6a05130ca523f28e1f1e3cc5b5bfc5a28b572ae13954630a8354602469bef8129217efe32a46f6fa8061f3f9295ad7fcfe535ee6953c6dc71bf789d125c0e881050b25b6f901f8448e173d9a2e5e52c81a9e35f9d0edff261b595ede93979a9e5723de09684de82cb81ea966c18c386fd37157830a9171b791cc2a8b85e47e3e225f67d498f7bb2b77baacc508dd38276d65cf78611606c764a250b3492307bbbbb94988fba279de3353ad7db2aa53213b64cb09845570f44423e353746b878efb86ac71abbd684418750f4eaaa30d0020958c9468fcdf7da9dabc918831a12a820a992fd72ac955687aa3ca497342f321af8af21c9119a1c8f6c7b833aade96e0cf175665385f2060a3a59b67d7b1bfcd58a224acaadc4d740ad38fd36728fff74bdc838b0cee281c4ebf5841ac1506cf335d9e8db8b5581gregkh@google.com >
2024-01-09 16:57:00 +00:00
Pablo Neira Ayuso
928b3b5dde
UPSTREAM: netfilter: nf_tables: skip set commit for deleted/destroyed sets
...
commit 7315dc1e122c85ffdfc8defffbb8f8b616c2eb1a upstream.
NFT_MSG_DELSET deactivates all elements in the set, skip
set->ops->commit() to avoid the unnecessary clone (for the pipapo case)
as well as the sync GC cycle, which could deactivate again expired
elements in such set.
Bug: 318548348
Fixes: 5f68718b34kevinrich1337@gmail.com >
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
(cherry picked from commit 0105571f80joneslee@google.com >
Change-Id: Ie733688e27d9568d797fc1bc477261883b7dc8c1
2024-01-09 16:21:20 +00:00
Quentin Perret
031f804149
ANDROID: KVM: arm64: Avoid BUG-ing from the host abort path
...
Under certain circumstances __get_fault_info() may resolve the faulting
address using the AT instruction. Given that this is being done outside
of the host lock critical section, it is racy and the resolution via AT
may fail. We currently BUG() in this situation, which is obviously less
than ideal. Moving the address resolution to the critical section may
have a performance impact, so let's keep it where it is, but bail out
and return to the host to try a second time.
Bug: 311830307
Change-Id: I26d61b04a4ccf040bd31802abb3c6b998ff4a48b
Signed-off-by: Quentin Perret <qperret@google.com >
2024-01-09 16:00:03 +00:00
Jia-Shiuan Chen
c5dc4b4b3d
ANDROID: Update the ABI symbol list
...
Adding the following symbols:
- dma_fence_array_ops
Bug: 319196045
Change-Id: Id65c62e0aedd65c9c72d71c8e39f7fae1e1de740
Signed-off-by: Jia-Shiuan Chen <chenjs@google.com >
2024-01-09 12:33:54 +00:00
Zhengchao Shao
5070b3b594
UPSTREAM: ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
...
[ Upstream commit e2b706c691905fe78468c361aaabc719d0a496f1 ]
When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
do
ifconfig br0 up
ifconfig br0 down
done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"
The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80
Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
Call Trace:
<TASK>
igmp_heard_query (net/ipv4/igmp.c:1068)
igmp_rcv (net/ipv4/igmp.c:1132)
ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
ip_local_deliver_finish (net/ipv4/ip_input.c:234)
__netif_receive_skb_one_core (net/core/dev.c:5529)
netif_receive_skb_internal (net/core/dev.c:5729)
netif_receive_skb (net/core/dev.c:5788)
br_handle_frame_finish (net/bridge/br_input.c:216)
nf_hook_bridge_pre (net/bridge/br_input.c:294)
__netif_receive_skb_core (net/core/dev.c:5423)
__netif_receive_skb_list_core (net/core/dev.c:5606)
__netif_receive_skb_list (net/core/dev.c:5674)
netif_receive_skb_list_internal (net/core/dev.c:5764)
napi_gro_receive (net/core/gro.c:609)
e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
__napi_poll (net/core/dev.c:6533)
net_rx_action (net/core/dev.c:6735)
__do_softirq (kernel/softirq.c:554)
run_ksoftirqd (kernel/softirq.c:913)
smpboot_thread_fn (kernel/smpboot.c:164)
kthread (kernel/kthread.c:388)
ret_from_fork (arch/x86/kernel/process.c:153)
ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
</TASK>
The root causes are as follows:
Thread A Thread B
... netif_receive_skb
br_dev_stop ...
br_multicast_leave_snoopers ...
__ip_mc_dec_group ...
__igmp_group_dropped igmp_rcv
igmp_stop_timer igmp_heard_query //ref = 1
ip_ma_put igmp_mod_timer
refcount_dec_and_test igmp_start_timer //ref = 0
... refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.
Bug: 316932391
Fixes: 1da177e4c3shaozhengchao@huawei.com >
Reviewed-by: Eric Dumazet <edumazet@google.com >
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com >
Signed-off-by: David S. Miller <davem@davemloft.net >
Signed-off-by: Sasha Levin <sashal@kernel.org >
(cherry picked from commit 94445d9583joneslee@google.com >
Change-Id: I277be2304e564994e05b981ccd6cd8cbb9dc85be
2024-01-09 12:23:52 +00:00
Sagi Grimberg
02aa72665c
UPSTREAM: nvmet-tcp: Fix a possible UAF in queue intialization setup
...
commit d920abd1e7stable@vger.kernel.org
Reported-by: Alon Zahavi <zahavi.alon@gmail.com >
Tested-by: Alon Zahavi <zahavi.alon@gmail.com >
Signed-off-by: Sagi Grimberg <sagi@grimberg.me >
Reviewed-by: Christoph Hellwig <hch@lst.de >
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com >
Signed-off-by: Keith Busch <kbusch@kernel.org >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
(cherry picked from commit e985d78bdcf37f7ef73666a43b0d2407715f00d3)
Signed-off-by: Lee Jones <joneslee@google.com >
Change-Id: Ifd7ec8294182a6bf6d8c261aeda5d989e909f7ff
2024-01-09 11:42:31 +00:00
Wesley Cheng
d6554d1262
FROMGIT: usb: dwc3: gadget: Handle EP0 request dequeuing properly
...
Current EP0 dequeue path will share the same as other EPs. However, there
are some special considerations that need to be made for EP0 transfers:
- EP0 transfers never transition into the started_list
- EP0 only has one active request at a time
In case there is a vendor specific control message for a function over USB
FFS, then there is no guarantee on the timeline which the DATA/STATUS stage
is responded to. While this occurs, any attempt to end transfers on
non-control EPs will end up having the DWC3_EP_DELAY_STOP flag set, and
defer issuing of the end transfer command. If the USB FFS application
decides to timeout the control transfer, or if USB FFS AIO path exits, the
USB FFS driver will issue a call to usb_ep_dequeue() for the ep0 request.
In case of the AIO exit path, the AIO FS blocks until all pending USB
requests utilizing the AIO path is completed. However, since the dequeue
of ep0 req does not happen properly, all non-control EPs with the
DWC3_EP_DELAY_STOP flag set will not be handled, and the AIO exit path will
be stuck waiting for the USB FFS data endpoints to receive a completion
callback.
Fix is to utilize dwc3_ep0_reset_state() in the dequeue API to ensure EP0
is brought back to the SETUP state, and ensures that any deferred end
transfer commands are handled. This also will end any active transfers
on EP0, compared to the previous implementation which directly called
giveback only.
Fixes: fcd2def663Thinh.Nguyen@synopsys.com >
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com >
Bug: 318577849
Change-Id: Ic00684db4b502f1aab128f7e49f22510dda24f60
(cherry picked from commit 730e12fbec53ab59dd807d981a204258a4cfb29a https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing)
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com >
2024-01-08 18:03:53 +00:00
Zhipeng Wang
29544d4157
ANDROID: ABI: Update symbol list for imx
...
1 function symbol(s) added
'bool iio_trigger_using_own(struct iio_dev*)'
Bug: 318788290
Change-Id: I5b17b2380f7087dabf51f4ed207e9ea4cab1ba38
Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com >
2024-01-08 17:50:38 +00:00
Jens Axboe
02f444ba07
UPSTREAM: io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
...
commit 7644b1a1c9stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de >
Signed-off-by: Jens Axboe <axboe@kernel.dk >
Signed-off-by: Sasha Levin <sashal@kernel.org >
(cherry picked from commit 9236d2ea64joneslee@google.com >
Change-Id: I044e0285d4535440606ff593230b873e3145db91
2024-01-08 17:33:38 +00:00
Jiri Olsa
ec46fe0ac7
UPSTREAM: bpf: Fix prog_array_map_poke_run map poke update
...
commit 4b7de801606e504e69689df71475d27e35336fb3 upstream.
Lee pointed out issue found by syscaller [0] hitting BUG in prog array
map poke update in prog_array_map_poke_run function due to error value
returned from bpf_arch_text_poke function.
There's race window where bpf_arch_text_poke can fail due to missing
bpf program kallsym symbols, which is accounted for with check for
-EINVAL in that BUG_ON call.
The problem is that in such case we won't update the tail call jump
and cause imbalance for the next tail call update check which will
fail with -EBUSY in bpf_arch_text_poke.
I'm hitting following race during the program load:
CPU 0 CPU 1
bpf_prog_load
bpf_check
do_misc_fixups
prog_array_map_poke_track
map_update_elem
bpf_fd_array_map_update_elem
prog_array_map_poke_run
bpf_arch_text_poke returns -EINVAL
bpf_prog_kallsyms_add
After bpf_arch_text_poke (CPU 1) fails to update the tail call jump, the next
poke update fails on expected jump instruction check in bpf_arch_text_poke
with -EBUSY and triggers the BUG_ON in prog_array_map_poke_run.
Similar race exists on the program unload.
Fixing this by moving the update to bpf_arch_poke_desc_update function which
makes sure we call __bpf_arch_text_poke that skips the bpf address check.
Each architecture has slightly different approach wrt looking up bpf address
in bpf_arch_text_poke, so instead of splitting the function or adding new
'checkip' argument in previous version, it seems best to move the whole
map_poke_run update as arch specific code.
[0] https://syzkaller.appspot.com/bug?extid=97a4fe20470e9bc30810
Bug: 309551558
Fixes: ebf7d1f508syzbot+97a4fe20470e9bc30810@syzkaller.appspotmail.com
Signed-off-by: Jiri Olsa <jolsa@kernel.org >
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net >
Acked-by: Yonghong Song <yonghong.song@linux.dev >
Cc: Lee Jones <lee@kernel.org >
Cc: Maciej Fijalkowski <maciej.fijalkowski@intel.com >
Link: https://lore.kernel.org/bpf/20231206083041.1306660-2-jolsa@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
(cherry picked from commit 57a6b0a464joneslee@google.com >
Change-Id: I251c3da579e5d48cd7de4043913fd42d0671d6b5
2024-01-08 17:00:17 +00:00
Mathias Nyman
98b0e4cf09
BACKPORT: xhci: track port suspend state correctly in unsuccessful resume cases
...
xhci-hub.c tracks suspended ports in a suspended_port bitfield.
This is checked when responding to a Get_Status(PORT) request to see if a
port in running U0 state was recently resumed, and adds the required
USB_PORT_STAT_C_SUSPEND change bit in those cases.
The suspended_port bit was left uncleared if a device is disconnected
during suspend. The bit remained set even when a new device was connected
and enumerated. The set bit resulted in a incorrect Get_Status(PORT)
response with a bogus USB_PORT_STAT_C_SUSPEND change
bit set once the new device reached U0 link state.
USB_PORT_STAT_C_SUSPEND change bit is only used for USB2 ports, but
xhci-hub keeps track of both USB2 and USB3 suspended ports.
Cc: stable@vger.kernel.org
Reported-by: Wesley Cheng <quic_wcheng@quicinc.com >
Closes: https://lore.kernel.org/linux-usb/d68aa806-b26a-0e43-42fb-b8067325e967@quicinc.com/
Fixes: 1d5810b692quic_wcheng@quicinc.com >
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com >
Link: https://lore.kernel.org/r/20230915143108.1532163-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
Bug: 200589374
(cherry picked from commit d7cdfc319bhttps://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
[wcheng: modified change to remove dependency on updated resume timestamp tracking]
Change-Id: Icccc1778a1f193b4b4c03532d291db88772bd454
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com >
2024-01-08 14:02:10 +00:00
Uladzislau Rezki