This partially reverts commit 2e77a46f0d.
Reason for revert: ipa3_mdt_load_ipa_fws is not present in this kernel,
this is a bad cherrypick resolution by qcom.
Change-Id: I218978168a6c3fe9f6139a6688be1cb4c0f96b94
"LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
asoc: codec: avoid out of bound write to map array
asoc: codec: avoid out of bound write to map array
asoc: Fixed OOB issue in qcs405
asoc: codec: wcd934x: enable auto recovery when port overflows
Change-Id: I51a30fe905251b6f66e733bae43fdcd3b0a7e787
"LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0:
qcacld-3.0: Fix the possible OOB write in country IE unpack
qcacld-3.0: Correcting the TSInfo structure size according to the Spec
Release 2.0.8.34Y
qcacld-3.0: Correcting the TSInfo structure size according to the Spec
Release 2.0.8.34X
qcacld-3.0: Remove use-after-free of frame in tx mgmt send
Release 2.0.8.34W
qcacld-3.0: Fix the possible OOB write in country IE unpack
Release 2.0.8.34V
qcacld-3.0: Enhance the RSNXE inter-op logic
Release 2.0.8.34U
qcacld-3.0: Set sar safety req resp event before unsolited work stop
Release 2.0.8.34T
qcacld-3.0: Update connect request crypto parameters
qcacld-3.0: Enable CFG80211_MULTI_AKM_CONNECT_SUPPORT from kernelv6.0
qcacld-3.0: Update wiphy max_num_akms_connect variable
Change-Id: I79d549c4c8c2f38dc18509f91f12befc15bb19c6
"LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
msm: eva: Validating the SFR buffer size before accessing
msm: eva: Copy back the validated size to avoid security issue
msm: npu: Fix use after free issue
USB: dwc3: gadget: Add stop transfer request for isoc transfers
arm64: defconfig: Enable uvc for QCM6490 IOT target
firmware: qcom_scm: do not clear dump mode from shutdown
msm: virtio_npu: Fix use-after-free issue in unmap_buf
msm: virtio_npu: Fix use-after-free issue in virt_npu_map_buf
i2c: i2c-master-msm-geni: add null pointer check in event call back
firmware: qcom_scm: handle echo b > /proc/sysrq-trigger
scripts: mod: replace with a safe function
msm: ep_pcie: Disable hot reset and ignore linkdown
coresight-tmc: Replace deprecated function
USB: dwc3: gadget: Queue data for 16 micro frames ahead in future
power: reset: Disable support of dynamic download mode (ramdump)
Conflicts:
arch/arm64/boot/dts/vendor/bindings/sound/rt5645.txt
Change-Id: I57c063465c2804c77c5a6f62acb6c7987a38bc7f
https://source.android.com/docs/security/bulletin/2025-02-01
CVE-2024-53104
CVE-2025-0088
* tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common: (449 commits)
ANDROID: gki - change networking configuration
ANDROID: kernelci build-break for 64-bit riscv clang builds (5.4 only)
Revert "BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics"
Revert "ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER"
ANDROID: GKI: add Trimble symbol list
UPSTREAM: selinux: ignore unknown extended permissions
ANDROID: ABI: Update allowed list for galaxy
Revert "netfilter: Replace zero-length array with flexible-array member"
Revert "tracing: Constify string literal data member in struct trace_event_call"
Revert "skb_expand_head() adjust skb->truesize incorrectly"
Linux 5.4.289
ftrace: use preempt_enable/disable notrace macros to avoid double fault
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
drm: adv7511: Drop dsi single lane support
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
sky2: Add device ID 11ab:4373 for Marvell 88E8075
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
RDMA/uverbs: Prevent integer overflow issue
modpost: fix the missed iteration for the max bit in do_input()
modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
...
Conflicts:
arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml
arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt
drivers/rpmsg/qcom_glink_native.c
drivers/soc/qcom/socinfo.c
Change-Id: I60727e0cdd974fda5ca71f938bc2f984a8bbf19a
When STACKPROTECTOR_PER_TASK is enabled, __stack_chk_guard is not
exported which breaks external modules due to missing symbols.
Change-Id: I633dcdd3343f63f6af34aab87e98cc81c6c56fe2
- Proper Handling in case of invalid pinctrl index
- Removing dead code and unused variables
- Change to dereference s_ctrl only after proper
NULL Dereference Check.
CRs-Fixed: 3875406
Change-Id: I8e2c717b22efff2a7d6503d38c048e30eff230da
Signed-off-by: Swami Reddy Reddy <quic_swamired@quicinc.com>
Make the following configuration changes:
CONFIG_NET_CLS_MATCHALL=y
CONFIG_NET_ACT_POLICE=y
CONFIG_NET_ACT_BPF=y
CONFIG_USB_RTL8150=y
CONFIG_USB_NET_CDC_EEM=y
CONFIG_USB_NET_CDC_NCM=y
CONFIG_USB_NET_AQC111=y
Note: 4 of these are already enabled in android12-5.4,
and the remaining 3 will be enabled as well in
https://android-review.googlesource.com/c/kernel/common/+/3470489
Test: TreeHugger
Bug: 377436524
Bug: 391669319
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1737c1e18a072cac9dd50e4d21b52b220c2ec40c
No 64-bit riscv builds were working with clang (found via kernelci) for our 5.4 kernels:
ld.lld: error: arch/riscv/built-in.a(kernel/signal.o):(function do_notify_resume: .text+0x30c): relocation R_RISCV_PCREL_HI20 out of range: 33554406 is not in [-524288, 524287]; references '__vdso_rt_sigreturn'
>>> referenced by signal.c
>>> defined in arch/riscv/built-in.a(kernel/vdso/vdso-syms.o)
There are two ANDROID-specific patches that added global variables that
must be reverted to fix the build:
f06e9ec979 ("BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics")
3818981c3332 ("ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER")
Also, CONFIG_INIT_STACK_ALL_PATTERN must be disabled to avoid the
relocation issues.
These issues all seem to be fixed in 5.10 and later kernels.
Bug: 393656515
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I0a5395a9767b94ec2291c9ef7e9a69f1f4665730
This reverts commit 6dea6a501418e1561d48f141d288866d71684372.
Reason for revert: Prevents device from entering deep sleep (possibly
improper port).
NOTE: dwc3_msm_role_allowed was added in a later change, specifically
"usb: dwc3: dwc3-msm-core: Reject incompatible role/mode request", but
it is necessary to modify it here due to that change's dependency
on dr_mode being present where it is no longer available
after this revert (it is available elsewhere).
Issue: https://gitlab.com/LineageOS/issues/android/-/issues/8226
Issue: calyxos#2970
Change-Id: I03e9b7960d62999e019464b538a2642644e7fc6c
To avoid any OOB write or other security issues, it's good to
validate the buffer size before accessing it.
Change-Id: Ibfdef21293c9385119cfb6338ef36e20c0fc1f2f
Signed-off-by: Pulkit Singh Tak <quic_ptak@quicinc.com>
(cherry picked from commit 8ee6cd6bef)
As we are reading the packet from a shared queue, there is a
possibility to corrupt the packet->size data of shared queue by
malicious FW after validating it in the kernel driver.
Change-Id: I9bff8f2daa64054eada37de54fe3fa837d57b22a
Signed-off-by: Aniruddh Sharma <quic_anirshar@quicinc.com>
Signed-off-by: Madhu Ananthula <quic_mananthu@quicinc.com>
(cherry picked from commit bb8a45801d)
Block USB enumeration from the get-go by blocking role switches away from
USB_ROLE_NONE when usb_data_enabled is false.
Change-Id: I0eff78e56e4a3b64262f220a085cfec5910baf30
Signed-off-by: Sultan Alsawaf <sultan@osomprivacy.com>
If USB controller is configured to work in a specific mode, reject
any compatible role/mode request. For example, if device mode is
only allowed, switching to host mode/role is not allowed. The current
code allows this and it results in accessing invalid dwc host structures.
Change-Id: I5e4d905c8240ad228f48b40fe36298029d8770e1
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
To avoid dependencies for the DWC3 core device to be present during
dwc3_msm_probe(), read out the dr_mode property from the DT node directly.
Since this property can not dynamically change, it will be the same per
compile time setting.
Change-Id: I3b56bde13af141ea01f06ea5b81e44bc034bf7b1
Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 upstream.
When evaluating extended permissions, ignore unknown permissions instead
of calling BUG(). This commit ensures that future permissions can be
added without interfering with older kernels.
Cc: stable@vger.kernel.org
Fixes: fa1aa143ac ("selinux: extended permissions for ioctls")
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
Change-Id: I1689d8c5084a24c1a34ef3d15d71f8cfa4122447
This reverts commit 9857e028d4 which is
commit 6daf14140129d30207ed6a0a69851fa6a3636bda upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I72ea16907de19ad38a993363ae45bab25f67d57a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 30080cdde6 which is
commit 452f4b31e3f70a52b97890888eeb9eaa9a87139a upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Ib63a284c6a02575a89f533f77da910de420989a7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
https://source.android.com/docs/security/bulletin/2025-01-01
* tag 'ASB-2025-01-05_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: ALSA: usb-audio: Fix a DMA to stack memory bug
UPSTREAM: ALSA: usb-audio: Fix out of bounds reads when finding clock sources
UPSTREAM: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Reapply "UPSTREAM: unicode: Don't special case ignorable code points"
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Change-Id: Ibfa7592f50072262205201b39dd2e37a1ee3c289
This reverts commit 43e7958cf7 which is
commit 7f678def99d29c520418607509bb19c7fc96a6db upstream.
It breaks the Android kernel build and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I21417bd6cf13432836618e2c0be84c79a9998b60
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmd/v80ACgkQONu9yGCS
aT6efw//UHOD4GORAmNhbC5i1A7+anJJpafHEDDb3f7yYpPsAeZMo3wS1zXesoIl
1x3aSBAUW6651gpO7FMQx16VMl9gtF2LRYtQomVvyqIi53a2XvZUGdmhnZBaXfNz
F7EX4bn3/wKtYfEC0buDCBzFZUzsLLnkwpiIwzMWymZsHS/lMvu9F+Ap240gy3MG
60ikjLpWbkrmfgJVHHKn+xeTUp8ikqDsx9JW+VYAqBENUr6+ZKZxKgo8SNh+Z+3n
xk39Rq/hzXyMtsQR7s8+3QSCJoh6VYhl7l6yvGYZ+BW8BKpqDl4lcKxiNUPUFjXL
mSk9AISKMUnBiPKQmhK0Yewns8aX0qIdLpZiUoSg+Ul+hlBf1bD//0AvJZ7A8kT0
I7s8OiemcrVMTW0m9HzY6XAgXhF9TutbrHTBn8IjDunQGz6Rz1pBsk7ka6boHf9K
6Cxb/VcsB3OsZGzVc7wULCVki5PWSRbQ4AklmCSlLnbMC8saVTkvH5cd0b6CeCB9
HJzZC4N77nUHUpRLz9ybu+bZFlJAwsXLrz84c50oU8RYSOPwIWOYsJgOmEpy1gbx
THGLBhs6xCdzOUB4deRS9MXcVDzLvVo5qcT7XAnVABz2XULfEPN1aD2ZbBsxQoxU
KIkmryxsohsLkomIxzSZHRTHptHCL+qtAPkDb0OgRkINlBb3Gbw=
=5mLz
-----END PGP SIGNATURE-----
Merge 5.4.289 into android11-5.4-lts
Changes in 5.4.289
net: sched: fix ordering of qlen adjustment
usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled
PCI/AER: Disable AER service on suspend
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
PCI: Add ACS quirk for Broadcom BCM5760X NIC
i2c: pnx: Fix timeout in wait functions
drm/i915: Fix memory leak by correcting cache object name in error handler
erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
erofs: fix incorrect symlink detection in fast symlink
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
ionic: use ee->offset when returning sprom data
net: hinic: Fix cleanup in create_rxqs/txqs()
net: ethernet: bgmac-platform: fix an OF node reference leak
netfilter: ipset: Fix for recursive locking warning
mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
chelsio/chtls: prevent potential integer overflow on 32bit
i2c: riic: Always round-up when calculating bus period
efivarfs: Fix error on non-existent file
USB: serial: option: add TCL IK512 MBIM & ECM
USB: serial: option: add MeiG Smart SLM770A
USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
USB: serial: option: add MediaTek T7XX compositions
USB: serial: option: add Telit FE910C04 rmnet compositions
sh: clk: Fix clk_enable() to return 0 on NULL clk
zram: refuse to use zero sized block device as backing device
btrfs: tree-checker: reject inline extent items with 0 ref count
NFS/pnfs: Fix a live lock between recalled layouts and layoutget
of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
nilfs2: prevent use of deleted inode
udmabuf: also check for F_SEAL_FUTURE_WRITE
of: Fix error path in of_parse_phandle_with_args_map()
of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
bpf: Check negative offsets in __bpf_skb_min_len()
nfsd: restore callback functionality for NFSv4.0
mtd: diskonchip: Cast an operand to prevent potential overflow
phy: core: Fix an OF node refcount leakage in _of_phy_get()
phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
phy: core: Fix that API devm_phy_put() fails to release the phy
phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
dmaengine: mv_xor: fix child node refcount handling in early exit
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
mtd: rawnand: fix double free in atmel_pmecc_create_user()
tracing/kprobe: Make trace_kprobe's module callback called after jump_label update
scsi: qla1280: Fix hw revision numbering for ISP1020/1040
scsi: megaraid_sas: Fix for a potential deadlock
regmap: Use correct format specifier for logging range errors
platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time
virtio-blk: don't keep queue frozen during system suspend
epoll: Add synchronous wakeup support for ep_poll_callback
MIPS: Probe toolchain support of -msym32
skbuff: introduce skb_expand_head()
ipv6: use skb_expand_head in ip6_finish_output2
ipv6: use skb_expand_head in ip6_xmit
ipv6: fix possible UAF in ip6_finish_output2()
bpf: fix recursive lock when verdict program return SK_PASS
tracing: Constify string literal data member in struct trace_event_call
btrfs: avoid monopolizing a core when activating a swap file
skb_expand_head() adjust skb->truesize incorrectly
ipv6: prevent possible UAF in ip6_xmit()
selinux: ignore unknown extended permissions
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
IB/mlx5: Introduce and use mlx5_core_is_vf()
net/mlx5: Make API mlx5_core_is_ecpf accept const pointer
RDMA/mlx5: Enforce same type port association for multiport RoCE
RDMA/bnxt_re: Add check for path mtu in modify_qp
RDMA/bnxt_re: Fix reporting hw_ver in query_device
RDMA/bnxt_re: Fix max_qp_wrs reported
drm: bridge: adv7511: Enable SPDIF DAI
drm/bridge: adv7511_audio: Update Audio InfoFrame properly
netrom: check buffer length before accessing it
netfilter: Replace zero-length array with flexible-array member
netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
net: llc: reset skb->transport_header
ALSA: usb-audio: US16x08: Initialize array before use
af_packet: fix vlan_get_tci() vs MSG_PEEK
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
ila: serialize calls to nf_register_net_hooks()
wifi: mac80211: wake the queues in case of failure in resume
sound: usb: format: don't warn that raw DSD is unsupported
bpf: fix potential error return
net: usb: qmi_wwan: add Telit FE910C04 compositions
irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
ARC: build: Try to guess GCC variant of cross compiler
modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
modpost: fix the missed iteration for the max bit in do_input()
RDMA/uverbs: Prevent integer overflow issue
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
sky2: Add device ID 11ab:4373 for Marvell 88E8075
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
drm: adv7511: Drop dsi single lane support
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
ftrace: use preempt_enable/disable notrace macros to avoid double fault
Linux 5.4.289
Change-Id: I2fe8ada5386224ce16b22d4e1eff016656be40f3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Since the backport commit eea46baf14 ("ftrace: Fix possible
use-after-free issue in ftrace_location()") on linux-5.4.y branch, the
old ftrace_int3_handler()->ftrace_location() path has included
rcu_read_lock(), which has mcount location inside and leads to potential
double fault.
Replace rcu_read_lock/unlock with preempt_enable/disable notrace macros
so that the mcount location does not appear on the int3 handler path.
This fix is specific to linux-5.4.y branch, the only branch still using
ftrace_int3_handler with commit e60b613df8b6 ("ftrace: Fix possible
use-after-free issue in ftrace_location()") backported. It also avoids
the need to backport the code conversion to text_poke() on this branch.
Reported-by: Koichiro Den <koichiro.den@canonical.com>
Closes: https://lore.kernel.org/all/74gjhwxupvozwop7ndhrh7t5qeckomt7yqvkkbm5j2tlx6dkfk@rgv7sijvry2k
Fixes: eea46baf14 ("ftrace: Fix possible use-after-free issue in ftrace_location()") # linux-5.4.y
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6aaced5abd32e2a57cd94fd64f824514d0361da8 upstream.
The task sometimes continues looping in throttle_direct_reclaim() because
allow_direct_reclaim(pgdat) keeps returning false.
#0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac
#1 [ffff80002cb6f900] __schedule at ffff800008abbd1c
#2 [ffff80002cb6f990] schedule at ffff800008abc50c
#3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550
#4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68
#5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660
#6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98
#7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8
#8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974
#9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4
At this point, the pgdat contains the following two zones:
NODE: 4 ZONE: 0 ADDR: ffff00817fffe540 NAME: "DMA32"
SIZE: 20480 MIN/LOW/HIGH: 11/28/45
VM_STAT:
NR_FREE_PAGES: 359
NR_ZONE_INACTIVE_ANON: 18813
NR_ZONE_ACTIVE_ANON: 0
NR_ZONE_INACTIVE_FILE: 50
NR_ZONE_ACTIVE_FILE: 0
NR_ZONE_UNEVICTABLE: 0
NR_ZONE_WRITE_PENDING: 0
NR_MLOCK: 0
NR_BOUNCE: 0
NR_ZSPAGES: 0
NR_FREE_CMA_PAGES: 0
NODE: 4 ZONE: 1 ADDR: ffff00817fffec00 NAME: "Normal"
SIZE: 8454144 PRESENT: 98304 MIN/LOW/HIGH: 68/166/264
VM_STAT:
NR_FREE_PAGES: 146
NR_ZONE_INACTIVE_ANON: 94668
NR_ZONE_ACTIVE_ANON: 3
NR_ZONE_INACTIVE_FILE: 735
NR_ZONE_ACTIVE_FILE: 78
NR_ZONE_UNEVICTABLE: 0
NR_ZONE_WRITE_PENDING: 0
NR_MLOCK: 0
NR_BOUNCE: 0
NR_ZSPAGES: 0
NR_FREE_CMA_PAGES: 0
In allow_direct_reclaim(), while processing ZONE_DMA32, the sum of
inactive/active file-backed pages calculated in zone_reclaimable_pages()
based on the result of zone_page_state_snapshot() is zero.
Additionally, since this system lacks swap, the calculation of inactive/
active anonymous pages is skipped.
crash> p nr_swap_pages
nr_swap_pages = $1937 = {
counter = 0
}
As a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on to
the processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 having
free pages significantly exceeding the high watermark.
The problem is that the pgdat->kswapd_failures hasn't been incremented.
crash> px ((struct pglist_data *) 0xffff00817fffe540)->kswapd_failures
$1935 = 0x0
This is because the node deemed balanced. The node balancing logic in
balance_pgdat() evaluates all zones collectively. If one or more zones
(e.g., ZONE_DMA32) have enough free pages to meet their watermarks, the
entire node is deemed balanced. This causes balance_pgdat() to exit early
before incrementing the kswapd_failures, as it considers the overall
memory state acceptable, even though some zones (like ZONE_NORMAL) remain
under significant pressure.
The patch ensures that zone_reclaimable_pages() includes free pages
(NR_FREE_PAGES) in its calculation when no other reclaimable pages are
available (e.g., file-backed or anonymous pages). This change prevents
zones like ZONE_DMA32, which have sufficient free pages, from being
mistakenly deemed unreclaimable. By doing so, the patch ensures proper
node balancing, avoids masking pressure on other zones like ZONE_NORMAL,
and prevents infinite loops in throttle_direct_reclaim() caused by
allow_direct_reclaim(pgdat) repeatedly returning false.
The kernel hangs due to a task stuck in throttle_direct_reclaim(), caused
by a node being incorrectly deemed balanced despite pressure in certain
zones, such as ZONE_NORMAL. This issue arises from
zone_reclaimable_pages() returning 0 for zones without reclaimable file-
backed or anonymous pages, causing zones like ZONE_DMA32 with sufficient
free pages to be skipped.
The lack of swap or reclaimable pages results in ZONE_DMA32 being ignored
during reclaim, masking pressure in other zones. Consequently,
pgdat->kswapd_failures remains 0 in balance_pgdat(), preventing fallback
mechanisms in allow_direct_reclaim() from being triggered, leading to an
infinite loop in throttle_direct_reclaim().
This patch modifies zone_reclaimable_pages() to account for free pages
(NR_FREE_PAGES) when no other reclaimable pages exist. This ensures zones
with sufficient free pages are not skipped, enabling proper balancing and
reclaim behavior.
[akpm@linux-foundation.org: coding-style cleanups]
Link: https://lkml.kernel.org/r/20241130164346.436469-1-snishika@redhat.com
Link: https://lkml.kernel.org/r/20241130161236.433747-2-snishika@redhat.com
Fixes: 5a1c84b404 ("mm: remove reclaim and compaction retry approximations")
Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4e86729d1ff329815a6e8a920cb554a1d4cb5b8d upstream.
While by default max_autoclose equals to INT_MAX / HZ, one may set
net.sctp.max_autoclose to UINT_MAX. There is code in
sctp_association_init() that can consequently trigger overflow.
Cc: stable@vger.kernel.org
Fixes: 9f70f46bd4 ("sctp: properly latch and use autoclose value from sock to association")
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20241219162114.2863827-1-kniv@yandex-team.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 03c8d0af2e409e15c16130b185e12b5efba0a6b9 upstream.
A Marvell 88E8075 ethernet controller has this device ID instead of
11ab:4370 and works fine with the sky2 driver.
Signed-off-by: Pascal Hambourg <pascal@plouf.fr.eu.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/10165a62-99fb-4be6-8c64-84afd6234085@plouf.fr.eu.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a37eecb705f33726f1fb7cd2a67e514a15dfe693 upstream.
If a device uses MCP23xxx IO expander to receive IRQs, the following
bug can happen:
BUG: sleeping function called from invalid context
at kernel/locking/mutex.c:283
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ...
preempt_count: 1, expected: 0
...
Call Trace:
...
__might_resched+0x104/0x10e
__might_sleep+0x3e/0x62
mutex_lock+0x20/0x4c
regmap_lock_mutex+0x10/0x18
regmap_update_bits_base+0x2c/0x66
mcp23s08_irq_set_type+0x1ae/0x1d6
__irq_set_trigger+0x56/0x172
__setup_irq+0x1e6/0x646
request_threaded_irq+0xb6/0x160
...
We observed the problem while experimenting with a touchscreen driver which
used MCP23017 IO expander (I2C).
The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from
concurrent accesses, which is the default for regmaps without .fast_io,
.disable_locking, etc.
mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter
locks the mutex.
However, __setup_irq() locks desc->lock spinlock before calling these
functions. As a result, the system tries to lock the mutex whole holding
the spinlock.
It seems, the internal regmap locks are not needed in this driver at all.
mcp->lock seems to protect the regmap from concurrent accesses already,
except, probably, in mcp_pinconf_get/set.
mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under
chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes
mcp->lock and enables regmap caching, so that the potentially slow I2C
accesses are deferred until chip_bus_unlock().
The accesses to the regmap from mcp23s08_probe_one() do not need additional
locking.
In all remaining places where the regmap is accessed, except
mcp_pinconf_get/set(), the driver already takes mcp->lock.
This patch adds locking in mcp_pinconf_get/set() and disables internal
locking in the regmap config. Among other things, it fixes the sleeping
in atomic context described above.
Fixes: 8f38910ba4 ("pinctrl: mcp23s08: switch to regmap caching")
Cc: stable@vger.kernel.org
Signed-off-by: Evgenii Shatokhin <e.shatokhin@yadro.com>
Link: https://lore.kernel.org/20241209074659.1442898-1-e.shatokhin@yadro.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d0257e089d1bbd35c69b6c97ff73e3690ab149a9 upstream.
In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32
values that come from the user so the multiplication can lead to integer
wrapping. Then we pass the result to uverbs_request_next_ptr() which also
could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)"
multiplication can also overflow on 32bit systems although it's fine on
64bit systems.
This patch does two things. First, I've re-arranged the condition in
uverbs_request_next_ptr() so that the use controlled variable "len" is on
one side of the comparison by itself without any math. Then I've modified
all the callers to use size_mul() for the multiplications.
Fixes: 67cdb40ca4 ("[IB] uverbs: Implement more commands")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/b8765ab3-c2da-4611-aae0-ddd6ba173d23@stanley.mountain
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit bf36b4bf1b9a7a0015610e2f038ee84ddb085de2 ]
This loop should iterate over the range from 'min' to 'max' inclusively.
The last interation is missed.
Fixes: 1d8f430c15 ("[PATCH] Input: add modalias support")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 77dc55a978e69625f9718460012e5ef0172dc4de ]
When building a 64-bit kernel on a 32-bit build host, incorrect
input MODULE_ALIAS() entries may be generated.
For example, when compiling a 64-bit kernel with CONFIG_INPUT_MOUSEDEV=m
on a 64-bit build machine, you will get the correct output:
$ grep MODULE_ALIAS drivers/input/mousedev.mod.c
MODULE_ALIAS("input:b*v*p*e*-e*1,*2,*k*110,*r*0,*1,*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*2,*k*r*8,*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*3,*k*14A,*r*a*0,*1,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*3,*k*145,*r*a*0,*1,*18,*1C,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*3,*k*110,*r*a*0,*1,*m*l*s*f*w*");
However, building the same kernel on a 32-bit machine results in
incorrect output:
$ grep MODULE_ALIAS drivers/input/mousedev.mod.c
MODULE_ALIAS("input:b*v*p*e*-e*1,*2,*k*110,*130,*r*0,*1,*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*2,*k*r*8,*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*3,*k*14A,*16A,*r*a*0,*1,*20,*21,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*3,*k*145,*165,*r*a*0,*1,*18,*1C,*20,*21,*38,*3C,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*3,*k*110,*130,*r*a*0,*1,*20,*21,*m*l*s*f*w*");
A similar issue occurs with CONFIG_INPUT_JOYDEV=m. On a 64-bit build
machine, the output is:
$ grep MODULE_ALIAS drivers/input/joydev.mod.c
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*0,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*2,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*8,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*6,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*k*120,*r*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*k*130,*r*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*k*2C0,*r*a*m*l*s*f*w*");
However, on a 32-bit machine, the output is incorrect:
$ grep MODULE_ALIAS drivers/input/joydev.mod.c
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*0,*20,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*2,*22,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*8,*28,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*3,*k*r*a*6,*26,*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*k*11F,*13F,*r*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*k*11F,*13F,*r*a*m*l*s*f*w*");
MODULE_ALIAS("input:b*v*p*e*-e*1,*k*2C0,*2E0,*r*a*m*l*s*f*w*");
When building a 64-bit kernel, BITS_PER_LONG is defined as 64. However,
on a 32-bit build machine, the constant 1L is a signed 32-bit value.
Left-shifting it beyond 32 bits causes wraparound, and shifting by 31
or 63 bits makes it a negative value.
The fix in commit e0e9263271 ("[PATCH] PATCH: 1 line 2.6.18 bugfix:
modpost-64bit-fix.patch") is incorrect; it only addresses cases where
a 64-bit kernel is built on a 64-bit build machine, overlooking cases
on a 32-bit build machine.
Using 1ULL ensures a 64-bit width on both 32-bit and 64-bit machines,
avoiding the wraparound issue.
Fixes: e0e9263271 ("[PATCH] PATCH: 1 line 2.6.18 bugfix: modpost-64bit-fix.patch")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Stable-dep-of: bf36b4bf1b9a ("modpost: fix the missed iteration for the max bit in do_input()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
