From: Sasha Levin Date: Sun, 13 Apr 2025 17:12:37 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.12.24~118 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6dd287e4704e4b3061aa09a63b937ecd610cb846;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/ata-pata_pxa-fix-potential-null-pointer-dereference-.patch b/queue-6.6/ata-pata_pxa-fix-potential-null-pointer-dereference-.patch new file mode 100644 index 00000000000..007b4612001 --- /dev/null +++ b/queue-6.6/ata-pata_pxa-fix-potential-null-pointer-dereference-.patch @@ -0,0 +1,47 @@ +From 82c62e00e51ff0c55d50567e4448d695c8b9cd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 14:14:38 +0800 +Subject: ata: pata_pxa: Fix potential NULL pointer dereference in + pxa_ata_probe() + +From: Henry Martin + +[ Upstream commit ad320e408a8c95a282ab9c05cdf0c9b95e317985 ] + +devm_ioremap() returns NULL on error. Currently, pxa_ata_probe() does +not check for this case, which can result in a NULL pointer dereference. + +Add NULL check after devm_ioremap() to prevent this issue. + +Fixes: 2dc6c6f15da9 ("[ARM] pata_pxa: DMA-capable PATA driver") +Signed-off-by: Henry Martin +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_pxa.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c +index 5275c6464f57f..821bcf20741ea 100644 +--- a/drivers/ata/pata_pxa.c ++++ b/drivers/ata/pata_pxa.c +@@ -223,10 +223,16 @@ static int pxa_ata_probe(struct platform_device *pdev) + + ap->ioaddr.cmd_addr = devm_ioremap(&pdev->dev, cmd_res->start, + resource_size(cmd_res)); ++ if (!ap->ioaddr.cmd_addr) ++ return -ENOMEM; + ap->ioaddr.ctl_addr = devm_ioremap(&pdev->dev, ctl_res->start, + resource_size(ctl_res)); ++ if (!ap->ioaddr.ctl_addr) ++ return -ENOMEM; + ap->ioaddr.bmdma_addr = devm_ioremap(&pdev->dev, dma_res->start, + resource_size(dma_res)); ++ if (!ap->ioaddr.bmdma_addr) ++ return -ENOMEM; + + /* + * Adjust register offsets +-- +2.39.5 + diff --git a/queue-6.6/ata-sata_sx4-add-error-handling-in-pdc20621_i2c_read.patch b/queue-6.6/ata-sata_sx4-add-error-handling-in-pdc20621_i2c_read.patch new file mode 100644 index 00000000000..89e5a24df4e --- /dev/null +++ b/queue-6.6/ata-sata_sx4-add-error-handling-in-pdc20621_i2c_read.patch @@ -0,0 +1,66 @@ +From f64d273ec358a5e0fb1853773de4069fdb0cd397 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 15:30:01 +0800 +Subject: ata: sata_sx4: Add error handling in pdc20621_i2c_read() + +From: Wentao Liang + +[ Upstream commit 8d46a27085039158eb5e253ab8a35a0e33b5e864 ] + +The function pdc20621_prog_dimm0() calls the function pdc20621_i2c_read() +but does not handle the error if the read fails. This could lead to +process with invalid data. A proper implementation can be found in +/source/drivers/ata/sata_sx4.c, pdc20621_prog_dimm_global(). As mentioned +in its commit: bb44e154e25125bef31fa956785e90fccd24610b, the variable spd0 +might be used uninitialized when pdc20621_i2c_read() fails. + +Add error handling to pdc20621_i2c_read(). If a read operation fails, +an error message is logged via dev_err(), and return a negative error +code. + +Add error handling to pdc20621_prog_dimm0() in pdc20621_dimm_init(), and +return a negative error code if pdc20621_prog_dimm0() fails. + +Fixes: 4447d3515616 ("libata: convert the remaining SATA drivers to new init model") +Signed-off-by: Wentao Liang +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_sx4.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c +index a482741eb181f..c3042eca6332d 100644 +--- a/drivers/ata/sata_sx4.c ++++ b/drivers/ata/sata_sx4.c +@@ -1117,9 +1117,14 @@ static int pdc20621_prog_dimm0(struct ata_host *host) + mmio += PDC_CHIP0_OFS; + + for (i = 0; i < ARRAY_SIZE(pdc_i2c_read_data); i++) +- pdc20621_i2c_read(host, PDC_DIMM0_SPD_DEV_ADDRESS, +- pdc_i2c_read_data[i].reg, +- &spd0[pdc_i2c_read_data[i].ofs]); ++ if (!pdc20621_i2c_read(host, PDC_DIMM0_SPD_DEV_ADDRESS, ++ pdc_i2c_read_data[i].reg, ++ &spd0[pdc_i2c_read_data[i].ofs])) { ++ dev_err(host->dev, ++ "Failed in i2c read at index %d: device=%#x, reg=%#x\n", ++ i, PDC_DIMM0_SPD_DEV_ADDRESS, pdc_i2c_read_data[i].reg); ++ return -EIO; ++ } + + data |= (spd0[4] - 8) | ((spd0[21] != 0) << 3) | ((spd0[3]-11) << 4); + data |= ((spd0[17] / 4) << 6) | ((spd0[5] / 2) << 7) | +@@ -1284,6 +1289,8 @@ static unsigned int pdc20621_dimm_init(struct ata_host *host) + + /* Programming DIMM0 Module Control Register (index_CID0:80h) */ + size = pdc20621_prog_dimm0(host); ++ if (size < 0) ++ return size; + dev_dbg(host->dev, "Local DIMM Size = %dMB\n", size); + + /* Programming DIMM Module Global Control Register (index_CID0:88h) */ +-- +2.39.5 + diff --git a/queue-6.6/codel-remove-sch-q.qlen-check-before-qdisc_tree_redu.patch b/queue-6.6/codel-remove-sch-q.qlen-check-before-qdisc_tree_redu.patch new file mode 100644 index 00000000000..6d1091ea79e --- /dev/null +++ b/queue-6.6/codel-remove-sch-q.qlen-check-before-qdisc_tree_redu.patch @@ -0,0 +1,63 @@ +From 2b98d2726ef520982e8ad583623d40a3c5b565c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Apr 2025 14:16:31 -0700 +Subject: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() + +From: Cong Wang + +[ Upstream commit 342debc12183b51773b3345ba267e9263bdfaaef ] + +After making all ->qlen_notify() callbacks idempotent, now it is safe to +remove the check of qlen!=0 from both fq_codel_dequeue() and +codel_qdisc_dequeue(). + +Reported-by: Gerrard Tai +Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") +Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") +Signed-off-by: Cong Wang +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250403211636.166257-1-xiyou.wangcong@gmail.com +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/sch_codel.c | 5 +---- + net/sched/sch_fq_codel.c | 6 ++---- + 2 files changed, 3 insertions(+), 8 deletions(-) + +diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c +index d7a4874543de5..5f2e068157456 100644 +--- a/net/sched/sch_codel.c ++++ b/net/sched/sch_codel.c +@@ -95,10 +95,7 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch) + &q->stats, qdisc_pkt_len, codel_get_enqueue_time, + drop_func, dequeue_func); + +- /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0, +- * or HTB crashes. Defer it for next round. +- */ +- if (q->stats.drop_count && sch->q.qlen) { ++ if (q->stats.drop_count) { + qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len); + q->stats.drop_count = 0; + q->stats.drop_len = 0; +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index 8c4fee0634366..9330923a624c0 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -314,10 +314,8 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch) + } + qdisc_bstats_update(sch, skb); + flow->deficit -= qdisc_pkt_len(skb); +- /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0, +- * or HTB crashes. Defer it for next round. +- */ +- if (q->cstats.drop_count && sch->q.qlen) { ++ ++ if (q->cstats.drop_count) { + qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, + q->cstats.drop_len); + q->cstats.drop_count = 0; +-- +2.39.5 + diff --git a/queue-6.6/drm-i915-dg2-wait-for-huc-load-completion-before-run.patch b/queue-6.6/drm-i915-dg2-wait-for-huc-load-completion-before-run.patch new file mode 100644 index 00000000000..b865dbc3afb --- /dev/null +++ b/queue-6.6/drm-i915-dg2-wait-for-huc-load-completion-before-run.patch @@ -0,0 +1,101 @@ +From 8274ddcae675895365b36dbcee151df46923c5cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 13:15:05 -0700 +Subject: drm/i915/dg2: wait for HuC load completion before running selftests + +From: Daniele Ceraolo Spurio + +[ Upstream commit c3015eb6e25a735ab77591573236169eab8e2e3a ] + +On DG2, submissions to VCS engines tied to a gem context are blocked +until the HuC is loaded. Since some selftests do use a gem context, +wait for the HuC load to complete before running the tests to avoid +contamination. + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10564 +Signed-off-by: Daniele Ceraolo Spurio +Cc: John Harrison +Reviewed-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20240410201505.894594-1-daniele.ceraolospurio@intel.com +Stable-dep-of: 9d3d9776bd3b ("drm/i915: Disable RPG during live selftest") +Signed-off-by: Sasha Levin +--- + .../gpu/drm/i915/selftests/i915_selftest.c | 36 ++++++++++++++++--- + 1 file changed, 32 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/selftests/i915_selftest.c b/drivers/gpu/drm/i915/selftests/i915_selftest.c +index ee79e0809a6dd..fee76c1d2f450 100644 +--- a/drivers/gpu/drm/i915/selftests/i915_selftest.c ++++ b/drivers/gpu/drm/i915/selftests/i915_selftest.c +@@ -154,6 +154,30 @@ __wait_gsc_proxy_completed(struct drm_i915_private *i915) + pr_warn(DRIVER_NAME "Timed out waiting for gsc_proxy_completion!\n"); + } + ++static void ++__wait_gsc_huc_load_completed(struct drm_i915_private *i915) ++{ ++ /* this only applies to DG2, so we only care about GT0 */ ++ struct intel_huc *huc = &to_gt(i915)->uc.huc; ++ bool need_to_wait = (IS_ENABLED(CONFIG_INTEL_MEI_PXP) && ++ intel_huc_wait_required(huc)); ++ /* ++ * The GSC and PXP mei bringup depends on the kernel boot ordering, so ++ * to account for the worst case scenario the HuC code waits for up to ++ * 10s for the GSC driver to load and then another 5s for the PXP ++ * component to bind before giving up, even though those steps normally ++ * complete in less than a second from the i915 load. We match that ++ * timeout here, but we expect to bail early due to the fence being ++ * signalled even in a failure case, as it is extremely unlikely that ++ * both components will use their full timeout. ++ */ ++ unsigned long timeout_ms = 15000; ++ ++ if (need_to_wait && ++ wait_for(i915_sw_fence_done(&huc->delayed_load.fence), timeout_ms)) ++ pr_warn(DRIVER_NAME "Timed out waiting for huc load via GSC!\n"); ++} ++ + static int __run_selftests(const char *name, + struct selftest *st, + unsigned int count, +@@ -228,14 +252,16 @@ int i915_mock_selftests(void) + + int i915_live_selftests(struct pci_dev *pdev) + { ++ struct drm_i915_private *i915 = pdev_to_i915(pdev); + int err; + + if (!i915_selftest.live) + return 0; + +- __wait_gsc_proxy_completed(pdev_to_i915(pdev)); ++ __wait_gsc_proxy_completed(i915); ++ __wait_gsc_huc_load_completed(i915); + +- err = run_selftests(live, pdev_to_i915(pdev)); ++ err = run_selftests(live, i915); + if (err) { + i915_selftest.live = err; + return err; +@@ -251,14 +277,16 @@ int i915_live_selftests(struct pci_dev *pdev) + + int i915_perf_selftests(struct pci_dev *pdev) + { ++ struct drm_i915_private *i915 = pdev_to_i915(pdev); + int err; + + if (!i915_selftest.perf) + return 0; + +- __wait_gsc_proxy_completed(pdev_to_i915(pdev)); ++ __wait_gsc_proxy_completed(i915); ++ __wait_gsc_huc_load_completed(i915); + +- err = run_selftests(perf, pdev_to_i915(pdev)); ++ err = run_selftests(perf, i915); + if (err) { + i915_selftest.perf = err; + return err; +-- +2.39.5 + diff --git a/queue-6.6/drm-i915-disable-rpg-during-live-selftest.patch b/queue-6.6/drm-i915-disable-rpg-during-live-selftest.patch new file mode 100644 index 00000000000..2d75fc97309 --- /dev/null +++ b/queue-6.6/drm-i915-disable-rpg-during-live-selftest.patch @@ -0,0 +1,110 @@ +From c1ec1511ee7bdd7893b2ff1c0093cf533f21ca2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 20:58:21 +0530 +Subject: drm/i915: Disable RPG during live selftest + +From: Badal Nilawar + +[ Upstream commit 9d3d9776bd3bd9c32d460dfe6c3363134de578bc ] + +The Forcewake timeout issue has been observed on Gen 12.0 and above. +To address this, disable Render Power-Gating (RPG) during live self-tests +for these generations. The temporary workaround 'drm/i915/mtl: do not +enable render power-gating on MTL' disables RPG globally, which is +unnecessary since the issues were only seen during self-tests. + +v2: take runtime pm wakeref + +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/9413 +Fixes: 25e7976db86b ("drm/i915/mtl: do not enable render power-gating on MTL") +Cc: Rodrigo Vivi +Cc: Andi Shyti +Cc: Andrzej Hajda +Signed-off-by: Badal Nilawar +Signed-off-by: Sk Anirban +Reviewed-by: Karthik Poosa +Signed-off-by: Anshuman Gupta +Link: https://patchwork.freedesktop.org/patch/msgid/20250310152821.2931678-1-sk.anirban@intel.com +(cherry picked from commit 0a4ae87706c6d15d14648e428c3a76351f823e48) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_rc6.c | 19 ++++--------------- + .../gpu/drm/i915/selftests/i915_selftest.c | 18 ++++++++++++++++++ + 2 files changed, 22 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_rc6.c b/drivers/gpu/drm/i915/gt/intel_rc6.c +index 483d557858816..3c7f4ed51bb05 100644 +--- a/drivers/gpu/drm/i915/gt/intel_rc6.c ++++ b/drivers/gpu/drm/i915/gt/intel_rc6.c +@@ -117,21 +117,10 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6) + GEN6_RC_CTL_RC6_ENABLE | + GEN6_RC_CTL_EI_MODE(1); + +- /* +- * BSpec 52698 - Render powergating must be off. +- * FIXME BSpec is outdated, disabling powergating for MTL is just +- * temporary wa and should be removed after fixing real cause +- * of forcewake timeouts. +- */ +- if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) +- pg_enable = +- GEN9_MEDIA_PG_ENABLE | +- GEN11_MEDIA_SAMPLER_PG_ENABLE; +- else +- pg_enable = +- GEN9_RENDER_PG_ENABLE | +- GEN9_MEDIA_PG_ENABLE | +- GEN11_MEDIA_SAMPLER_PG_ENABLE; ++ pg_enable = ++ GEN9_RENDER_PG_ENABLE | ++ GEN9_MEDIA_PG_ENABLE | ++ GEN11_MEDIA_SAMPLER_PG_ENABLE; + + if (GRAPHICS_VER(gt->i915) >= 12 && !IS_DG1(gt->i915)) { + for (i = 0; i < I915_MAX_VCS; i++) +diff --git a/drivers/gpu/drm/i915/selftests/i915_selftest.c b/drivers/gpu/drm/i915/selftests/i915_selftest.c +index fee76c1d2f450..889281819c5b1 100644 +--- a/drivers/gpu/drm/i915/selftests/i915_selftest.c ++++ b/drivers/gpu/drm/i915/selftests/i915_selftest.c +@@ -23,7 +23,9 @@ + + #include + ++#include "gt/intel_gt.h" + #include "gt/intel_gt_pm.h" ++#include "gt/intel_gt_regs.h" + #include "gt/uc/intel_gsc_fw.h" + + #include "i915_driver.h" +@@ -253,11 +255,27 @@ int i915_mock_selftests(void) + int i915_live_selftests(struct pci_dev *pdev) + { + struct drm_i915_private *i915 = pdev_to_i915(pdev); ++ struct intel_uncore *uncore = &i915->uncore; + int err; ++ u32 pg_enable; ++ intel_wakeref_t wakeref; + + if (!i915_selftest.live) + return 0; + ++ /* ++ * FIXME Disable render powergating, this is temporary wa and should be removed ++ * after fixing real cause of forcewake timeouts. ++ */ ++ with_intel_runtime_pm(uncore->rpm, wakeref) { ++ if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 00), IP_VER(12, 74))) { ++ pg_enable = intel_uncore_read(uncore, GEN9_PG_ENABLE); ++ if (pg_enable & GEN9_RENDER_PG_ENABLE) ++ intel_uncore_write_fw(uncore, GEN9_PG_ENABLE, ++ pg_enable & ~GEN9_RENDER_PG_ENABLE); ++ } ++ } ++ + __wait_gsc_proxy_completed(i915); + __wait_gsc_huc_load_completed(i915); + +-- +2.39.5 + diff --git a/queue-6.6/drm-i915-huc-fix-fence-not-released-on-early-probe-e.patch b/queue-6.6/drm-i915-huc-fix-fence-not-released-on-early-probe-e.patch new file mode 100644 index 00000000000..f926fc90afa --- /dev/null +++ b/queue-6.6/drm-i915-huc-fix-fence-not-released-on-early-probe-e.patch @@ -0,0 +1,142 @@ +From eb1d4a191897fe9c723790d9485e0e8181fadeb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 19:20:57 +0200 +Subject: drm/i915/huc: Fix fence not released on early probe errors + +From: Janusz Krzysztofik + +[ Upstream commit e3ea2eae70692a455e256787e4f54153fb739b90 ] + +HuC delayed loading fence, introduced with commit 27536e03271da +("drm/i915/huc: track delayed HuC load with a fence"), is registered with +object tracker early on driver probe but unregistered only from driver +remove, which is not called on early probe errors. Since its memory is +allocated under devres, then released anyway, it may happen to be +allocated again to the fence and reused on future driver probes, resulting +in kernel warnings that taint the kernel: + +<4> [309.731371] ------------[ cut here ]------------ +<3> [309.731373] ODEBUG: init destroyed (active state 0) object: ffff88813d7dd2e0 object type: i915_sw_fence hint: sw_fence_dummy_notify+0x0/0x20 [i915] +<4> [309.731575] WARNING: CPU: 2 PID: 3161 at lib/debugobjects.c:612 debug_print_object+0x93/0xf0 +... +<4> [309.731693] CPU: 2 UID: 0 PID: 3161 Comm: i915_module_loa Tainted: G U 6.14.0-CI_DRM_16362-gf0fd77956987+ #1 +... +<4> [309.731700] RIP: 0010:debug_print_object+0x93/0xf0 +... +<4> [309.731728] Call Trace: +<4> [309.731730] +... +<4> [309.731949] __debug_object_init+0x17b/0x1c0 +<4> [309.731957] debug_object_init+0x34/0x50 +<4> [309.732126] __i915_sw_fence_init+0x34/0x60 [i915] +<4> [309.732256] intel_huc_init_early+0x4b/0x1d0 [i915] +<4> [309.732468] intel_uc_init_early+0x61/0x680 [i915] +<4> [309.732667] intel_gt_common_init_early+0x105/0x130 [i915] +<4> [309.732804] intel_root_gt_init_early+0x63/0x80 [i915] +<4> [309.732938] i915_driver_probe+0x1fa/0xeb0 [i915] +<4> [309.733075] i915_pci_probe+0xe6/0x220 [i915] +<4> [309.733198] local_pci_probe+0x44/0xb0 +<4> [309.733203] pci_device_probe+0xf4/0x270 +<4> [309.733209] really_probe+0xee/0x3c0 +<4> [309.733215] __driver_probe_device+0x8c/0x180 +<4> [309.733219] driver_probe_device+0x24/0xd0 +<4> [309.733223] __driver_attach+0x10f/0x220 +<4> [309.733230] bus_for_each_dev+0x7d/0xe0 +<4> [309.733236] driver_attach+0x1e/0x30 +<4> [309.733239] bus_add_driver+0x151/0x290 +<4> [309.733244] driver_register+0x5e/0x130 +<4> [309.733247] __pci_register_driver+0x7d/0x90 +<4> [309.733251] i915_pci_register_driver+0x23/0x30 [i915] +<4> [309.733413] i915_init+0x34/0x120 [i915] +<4> [309.733655] do_one_initcall+0x62/0x3f0 +<4> [309.733667] do_init_module+0x97/0x2a0 +<4> [309.733671] load_module+0x25ff/0x2890 +<4> [309.733688] init_module_from_file+0x97/0xe0 +<4> [309.733701] idempotent_init_module+0x118/0x330 +<4> [309.733711] __x64_sys_finit_module+0x77/0x100 +<4> [309.733715] x64_sys_call+0x1f37/0x2650 +<4> [309.733719] do_syscall_64+0x91/0x180 +<4> [309.733763] entry_SYSCALL_64_after_hwframe+0x76/0x7e +<4> [309.733792] +... +<4> [309.733806] ---[ end trace 0000000000000000 ]--- + +That scenario is most easily reproducible with +igt@i915_module_load@reload-with-fault-injection. + +Fix the issue by moving the cleanup step to driver release path. + +Fixes: 27536e03271da ("drm/i915/huc: track delayed HuC load with a fence") +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13592 +Cc: Daniele Ceraolo Spurio +Cc: Alan Previn +Signed-off-by: Janusz Krzysztofik +Reviewed-by: Daniele Ceraolo Spurio +Reviewed-by: Krzysztof Karas +Signed-off-by: Daniele Ceraolo Spurio +Link: https://lore.kernel.org/r/20250402172057.209924-2-janusz.krzysztofik@linux.intel.com +(cherry picked from commit 795dbde92fe5c6996a02a5b579481de73035e7bf) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_huc.c | 11 +++++------ + drivers/gpu/drm/i915/gt/uc/intel_huc.h | 1 + + drivers/gpu/drm/i915/gt/uc/intel_uc.c | 1 + + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.c b/drivers/gpu/drm/i915/gt/uc/intel_huc.c +index ba9e07fc2b577..552662953e7a4 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_huc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.c +@@ -316,6 +316,11 @@ void intel_huc_init_early(struct intel_huc *huc) + } + } + ++void intel_huc_fini_late(struct intel_huc *huc) ++{ ++ delayed_huc_load_fini(huc); ++} ++ + #define HUC_LOAD_MODE_STRING(x) (x ? "GSC" : "legacy") + static int check_huc_loading_mode(struct intel_huc *huc) + { +@@ -413,12 +418,6 @@ int intel_huc_init(struct intel_huc *huc) + + void intel_huc_fini(struct intel_huc *huc) + { +- /* +- * the fence is initialized in init_early, so we need to clean it up +- * even if HuC loading is off. +- */ +- delayed_huc_load_fini(huc); +- + if (huc->heci_pkt) + i915_vma_unpin_and_release(&huc->heci_pkt, 0); + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_huc.h b/drivers/gpu/drm/i915/gt/uc/intel_huc.h +index ba5cb08e9e7bf..09aff3148f7dd 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_huc.h ++++ b/drivers/gpu/drm/i915/gt/uc/intel_huc.h +@@ -55,6 +55,7 @@ struct intel_huc { + + int intel_huc_sanitize(struct intel_huc *huc); + void intel_huc_init_early(struct intel_huc *huc); ++void intel_huc_fini_late(struct intel_huc *huc); + int intel_huc_init(struct intel_huc *huc); + void intel_huc_fini(struct intel_huc *huc); + void intel_huc_suspend(struct intel_huc *huc); +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.c b/drivers/gpu/drm/i915/gt/uc/intel_uc.c +index 98b103375b7ab..c29d187ddad1c 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_uc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.c +@@ -145,6 +145,7 @@ void intel_uc_init_late(struct intel_uc *uc) + + void intel_uc_driver_late_release(struct intel_uc *uc) + { ++ intel_huc_fini_late(&uc->huc); + } + + /** +-- +2.39.5 + diff --git a/queue-6.6/drm-i915-mocs-use-to_gt-instead-of-direct-i915-gt.patch b/queue-6.6/drm-i915-mocs-use-to_gt-instead-of-direct-i915-gt.patch new file mode 100644 index 00000000000..c411b780c06 --- /dev/null +++ b/queue-6.6/drm-i915-mocs-use-to_gt-instead-of-direct-i915-gt.patch @@ -0,0 +1,51 @@ +From c904f8eed11f214aed735f33652a43d99800e303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Oct 2023 11:47:02 +0300 +Subject: drm/i915/mocs: use to_gt() instead of direct &i915->gt +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +[ Upstream commit 5ed8c7bcf9a58372d3be3d9cd167e45497efaae2 ] + +Have to give up the const on i915 pointer, but it's not big of a deal +considering non-const i915 gets passed all over the place. + +Signed-off-by: Jani Nikula +Reviewed-by: Gustavo Sousa +Reviewed-by: Andi Shyti +Acked-by: Michał Winiarski +Link: https://patchwork.freedesktop.org/patch/msgid/63e644f056c7745eb0e8e165c990c392a38ec85c.1696236329.git.jani.nikula@intel.com +Stable-dep-of: 9d3d9776bd3b ("drm/i915: Disable RPG during live selftest") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_mocs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_mocs.c b/drivers/gpu/drm/i915/gt/intel_mocs.c +index 07269ff3be136..353f93baaca05 100644 +--- a/drivers/gpu/drm/i915/gt/intel_mocs.c ++++ b/drivers/gpu/drm/i915/gt/intel_mocs.c +@@ -487,7 +487,7 @@ static bool has_mocs(const struct drm_i915_private *i915) + return !IS_DGFX(i915); + } + +-static unsigned int get_mocs_settings(const struct drm_i915_private *i915, ++static unsigned int get_mocs_settings(struct drm_i915_private *i915, + struct drm_i915_mocs_table *table) + { + unsigned int flags; +@@ -495,7 +495,7 @@ static unsigned int get_mocs_settings(const struct drm_i915_private *i915, + memset(table, 0, sizeof(struct drm_i915_mocs_table)); + + table->unused_entries_index = I915_MOCS_PTE; +- if (IS_GFX_GT_IP_RANGE(&i915->gt0, IP_VER(12, 70), IP_VER(12, 71))) { ++ if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 71))) { + table->size = ARRAY_SIZE(mtl_mocs_table); + table->table = mtl_mocs_table; + table->n_entries = MTL_NUM_MOCS_ENTRIES; +-- +2.39.5 + diff --git a/queue-6.6/drm-i915-xelpg-extend-driver-code-of-xe_lpg-to-xe_lp.patch b/queue-6.6/drm-i915-xelpg-extend-driver-code-of-xe_lpg-to-xe_lp.patch new file mode 100644 index 00000000000..258d3606fc0 --- /dev/null +++ b/queue-6.6/drm-i915-xelpg-extend-driver-code-of-xe_lpg-to-xe_lp.patch @@ -0,0 +1,84 @@ +From d5edc800f60904c91dc12793b38bb80eb380290d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 17:57:37 +0530 +Subject: drm/i915/xelpg: Extend driver code of Xe_LPG to Xe_LPG+ + +From: Harish Chegondi + +[ Upstream commit 84bf82f4f8661930a134a1d86bde16f7d8bcd699 ] + +Xe_LPG+ (IP version 12.74) should take the same general code +paths as Xe_LPG (versions 12.70 and 12.71). + +Xe_LPG+'s workaround list will be handled by the next patch. + +Signed-off-by: Harish Chegondi +Signed-off-by: Haridhar Kalvala +Reviewed-by: Matt Roper +Signed-off-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20240108122738.14399-3-haridhar.kalvala@intel.com +Stable-dep-of: 9d3d9776bd3b ("drm/i915: Disable RPG during live selftest") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++- + drivers/gpu/drm/i915/gt/intel_mocs.c | 2 +- + drivers/gpu/drm/i915/gt/intel_rc6.c | 2 +- + drivers/gpu/drm/i915/i915_debugfs.c | 2 +- + 4 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +index d9bb352b8baab..0729ab5955171 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +@@ -1218,7 +1218,8 @@ static int intel_engine_init_tlb_invalidation(struct intel_engine_cs *engine) + num = ARRAY_SIZE(xelpmp_regs); + } + } else { +- if (GRAPHICS_VER_FULL(i915) == IP_VER(12, 71) || ++ if (GRAPHICS_VER_FULL(i915) == IP_VER(12, 74) || ++ GRAPHICS_VER_FULL(i915) == IP_VER(12, 71) || + GRAPHICS_VER_FULL(i915) == IP_VER(12, 70) || + GRAPHICS_VER_FULL(i915) == IP_VER(12, 50) || + GRAPHICS_VER_FULL(i915) == IP_VER(12, 55)) { +diff --git a/drivers/gpu/drm/i915/gt/intel_mocs.c b/drivers/gpu/drm/i915/gt/intel_mocs.c +index 353f93baaca05..25c1023eb5f9f 100644 +--- a/drivers/gpu/drm/i915/gt/intel_mocs.c ++++ b/drivers/gpu/drm/i915/gt/intel_mocs.c +@@ -495,7 +495,7 @@ static unsigned int get_mocs_settings(struct drm_i915_private *i915, + memset(table, 0, sizeof(struct drm_i915_mocs_table)); + + table->unused_entries_index = I915_MOCS_PTE; +- if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 71))) { ++ if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 74))) { + table->size = ARRAY_SIZE(mtl_mocs_table); + table->table = mtl_mocs_table; + table->n_entries = MTL_NUM_MOCS_ENTRIES; +diff --git a/drivers/gpu/drm/i915/gt/intel_rc6.c b/drivers/gpu/drm/i915/gt/intel_rc6.c +index 6e8c182b2559e..483d557858816 100644 +--- a/drivers/gpu/drm/i915/gt/intel_rc6.c ++++ b/drivers/gpu/drm/i915/gt/intel_rc6.c +@@ -123,7 +123,7 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6) + * temporary wa and should be removed after fixing real cause + * of forcewake timeouts. + */ +- if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 71))) ++ if (IS_GFX_GT_IP_RANGE(gt, IP_VER(12, 70), IP_VER(12, 74))) + pg_enable = + GEN9_MEDIA_PG_ENABLE | + GEN11_MEDIA_SAMPLER_PG_ENABLE; +diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c +index 7a90a2e32c9f1..1fde21d8bb59a 100644 +--- a/drivers/gpu/drm/i915/i915_debugfs.c ++++ b/drivers/gpu/drm/i915/i915_debugfs.c +@@ -144,7 +144,7 @@ static const char *i915_cache_level_str(struct drm_i915_gem_object *obj) + { + struct drm_i915_private *i915 = obj_to_i915(obj); + +- if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 71))) { ++ if (IS_GFX_GT_IP_RANGE(to_gt(i915), IP_VER(12, 70), IP_VER(12, 74))) { + switch (obj->pat_index) { + case 0: return " WB"; + case 1: return " WT"; +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-add-helper-to-create-mock-crtc.patch b/queue-6.6/drm-tests-add-helper-to-create-mock-crtc.patch new file mode 100644 index 00000000000..5895bf58bfe --- /dev/null +++ b/queue-6.6/drm-tests-add-helper-to-create-mock-crtc.patch @@ -0,0 +1,130 @@ +From 0c3efef51ff448a3fb6fb065e207d77f289525d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 19:13:50 +0100 +Subject: drm/tests: Add helper to create mock crtc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Ripard + +[ Upstream commit 51f90720381dea79208513d059e0eb426dee511e ] + +We're going to need a full-blown, functional, KMS device to test more +components of the atomic modesetting infrastructure. + +Let's add a new helper to create a dumb, mocked, CRTC. By default it +will create a CRTC relying only on the default helpers, but drivers are +free to deviate from that. + +Reviewed-by: Maíra Canal +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240222-kms-hdmi-connector-state-v7-4-8f4af575fce2@kernel.org +Stable-dep-of: 70f29ca3117a ("drm/tests: cmdline: Fix drm_display_mode memory leak") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_kunit_helpers.c | 62 +++++++++++++++++++++++ + include/drm/drm_kunit_helpers.h | 10 ++++ + 2 files changed, 72 insertions(+) + +diff --git a/drivers/gpu/drm/tests/drm_kunit_helpers.c b/drivers/gpu/drm/tests/drm_kunit_helpers.c +index e0778a7ec2608..ca513235b5e2a 100644 +--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c ++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c +@@ -321,5 +321,67 @@ drm_kunit_helper_create_primary_plane(struct kunit *test, + } + EXPORT_SYMBOL_GPL(drm_kunit_helper_create_primary_plane); + ++static const struct drm_crtc_helper_funcs default_crtc_helper_funcs = { ++}; ++ ++static const struct drm_crtc_funcs default_crtc_funcs = { ++ .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state, ++ .atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state, ++ .reset = drm_atomic_helper_crtc_reset, ++}; ++ ++/** ++ * drm_kunit_helper_create_crtc - Creates a mock CRTC for a KUnit test ++ * @test: The test context object ++ * @drm: The device to alloc the plane for ++ * @primary: Primary plane for CRTC ++ * @cursor: Cursor plane for CRTC. Optional. ++ * @funcs: Callbacks for the new plane. Optional. ++ * @helper_funcs: Helpers callbacks for the new plane. Optional. ++ * ++ * This allocates and initializes a mock struct &drm_crtc meant to be ++ * part of a mock device for a KUnit test. ++ * ++ * Resources will be cleaned up automatically. ++ * ++ * @funcs will default to the default helpers implementations. ++ * @helper_funcs will default to an empty implementation. ++ * ++ * Returns: ++ * A pointer to the new CRTC, or an ERR_PTR() otherwise. ++ */ ++struct drm_crtc * ++drm_kunit_helper_create_crtc(struct kunit *test, ++ struct drm_device *drm, ++ struct drm_plane *primary, ++ struct drm_plane *cursor, ++ const struct drm_crtc_funcs *funcs, ++ const struct drm_crtc_helper_funcs *helper_funcs) ++{ ++ struct drm_crtc *crtc; ++ int ret; ++ ++ if (!funcs) ++ funcs = &default_crtc_funcs; ++ ++ if (!helper_funcs) ++ helper_funcs = &default_crtc_helper_funcs; ++ ++ crtc = drmm_kzalloc(drm, sizeof(*crtc), GFP_KERNEL); ++ KUNIT_ASSERT_NOT_NULL(test, crtc); ++ ++ ret = drmm_crtc_init_with_planes(drm, crtc, ++ primary, ++ cursor, ++ funcs, ++ NULL); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ ++ drm_crtc_helper_add(crtc, helper_funcs); ++ ++ return crtc; ++} ++EXPORT_SYMBOL_GPL(drm_kunit_helper_create_crtc); ++ + MODULE_AUTHOR("Maxime Ripard "); + MODULE_LICENSE("GPL"); +diff --git a/include/drm/drm_kunit_helpers.h b/include/drm/drm_kunit_helpers.h +index 38667d624aa8c..6e99627edf458 100644 +--- a/include/drm/drm_kunit_helpers.h ++++ b/include/drm/drm_kunit_helpers.h +@@ -9,6 +9,8 @@ + + #include + ++struct drm_crtc_funcs; ++struct drm_crtc_helper_funcs; + struct drm_device; + struct drm_plane_funcs; + struct drm_plane_helper_funcs; +@@ -110,4 +112,12 @@ drm_kunit_helper_create_primary_plane(struct kunit *test, + unsigned int num_formats, + const uint64_t *modifiers); + ++struct drm_crtc * ++drm_kunit_helper_create_crtc(struct kunit *test, ++ struct drm_device *drm, ++ struct drm_plane *primary, ++ struct drm_plane *cursor, ++ const struct drm_crtc_funcs *funcs, ++ const struct drm_crtc_helper_funcs *helper_funcs); ++ + #endif // DRM_KUNIT_HELPERS_H_ +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-add-helper-to-create-mock-plane.patch b/queue-6.6/drm-tests-add-helper-to-create-mock-plane.patch new file mode 100644 index 00000000000..b730f6d1b1d --- /dev/null +++ b/queue-6.6/drm-tests-add-helper-to-create-mock-plane.patch @@ -0,0 +1,161 @@ +From bf867af166c5bc5c521cbec664349064a25bd668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 19:13:49 +0100 +Subject: drm/tests: Add helper to create mock plane +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Ripard + +[ Upstream commit 7a48da0febd5113d9de6f51592a09825ebd8415c ] + +We're going to need a full-blown, functional, KMS device to test more +components of the atomic modesetting infrastructure. + +Let's add a new helper to create a dumb, mocked, primary plane. By +default, it will create a linear XRGB8888 plane, using the default +helpers. + +Reviewed-by: Maíra Canal +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240222-kms-hdmi-connector-state-v7-3-8f4af575fce2@kernel.org +Stable-dep-of: 70f29ca3117a ("drm/tests: cmdline: Fix drm_display_mode memory leak") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_kunit_helpers.c | 85 +++++++++++++++++++++++ + include/drm/drm_kunit_helpers.h | 11 +++ + 2 files changed, 96 insertions(+) + +diff --git a/drivers/gpu/drm/tests/drm_kunit_helpers.c b/drivers/gpu/drm/tests/drm_kunit_helpers.c +index 272a3ba46d602..e0778a7ec2608 100644 +--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c ++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c +@@ -3,6 +3,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -236,5 +237,89 @@ drm_kunit_helper_atomic_state_alloc(struct kunit *test, + } + EXPORT_SYMBOL_GPL(drm_kunit_helper_atomic_state_alloc); + ++static const uint32_t default_plane_formats[] = { ++ DRM_FORMAT_XRGB8888, ++}; ++ ++static const uint64_t default_plane_modifiers[] = { ++ DRM_FORMAT_MOD_LINEAR, ++ DRM_FORMAT_MOD_INVALID ++}; ++ ++static const struct drm_plane_helper_funcs default_plane_helper_funcs = { ++}; ++ ++static const struct drm_plane_funcs default_plane_funcs = { ++ .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, ++ .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, ++ .reset = drm_atomic_helper_plane_reset, ++}; ++ ++/** ++ * drm_kunit_helper_create_primary_plane - Creates a mock primary plane for a KUnit test ++ * @test: The test context object ++ * @drm: The device to alloc the plane for ++ * @funcs: Callbacks for the new plane. Optional. ++ * @helper_funcs: Helpers callbacks for the new plane. Optional. ++ * @formats: array of supported formats (DRM_FORMAT\_\*). Optional. ++ * @num_formats: number of elements in @formats ++ * @modifiers: array of struct drm_format modifiers terminated by ++ * DRM_FORMAT_MOD_INVALID. Optional. ++ * ++ * This allocates and initializes a mock struct &drm_plane meant to be ++ * part of a mock device for a KUnit test. ++ * ++ * Resources will be cleaned up automatically. ++ * ++ * @funcs will default to the default helpers implementations. ++ * @helper_funcs will default to an empty implementation. @formats will ++ * default to XRGB8888 only. @modifiers will default to a linear ++ * modifier only. ++ * ++ * Returns: ++ * A pointer to the new plane, or an ERR_PTR() otherwise. ++ */ ++struct drm_plane * ++drm_kunit_helper_create_primary_plane(struct kunit *test, ++ struct drm_device *drm, ++ const struct drm_plane_funcs *funcs, ++ const struct drm_plane_helper_funcs *helper_funcs, ++ const uint32_t *formats, ++ unsigned int num_formats, ++ const uint64_t *modifiers) ++{ ++ struct drm_plane *plane; ++ ++ if (!funcs) ++ funcs = &default_plane_funcs; ++ ++ if (!helper_funcs) ++ helper_funcs = &default_plane_helper_funcs; ++ ++ if (!formats || !num_formats) { ++ formats = default_plane_formats; ++ num_formats = ARRAY_SIZE(default_plane_formats); ++ } ++ ++ if (!modifiers) ++ modifiers = default_plane_modifiers; ++ ++ plane = __drmm_universal_plane_alloc(drm, ++ sizeof(struct drm_plane), 0, ++ 0, ++ funcs, ++ formats, ++ num_formats, ++ default_plane_modifiers, ++ DRM_PLANE_TYPE_PRIMARY, ++ NULL); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, plane); ++ ++ drm_plane_helper_add(plane, helper_funcs); ++ ++ return plane; ++} ++EXPORT_SYMBOL_GPL(drm_kunit_helper_create_primary_plane); ++ + MODULE_AUTHOR("Maxime Ripard "); + MODULE_LICENSE("GPL"); +diff --git a/include/drm/drm_kunit_helpers.h b/include/drm/drm_kunit_helpers.h +index 3ae19892229db..38667d624aa8c 100644 +--- a/include/drm/drm_kunit_helpers.h ++++ b/include/drm/drm_kunit_helpers.h +@@ -10,6 +10,8 @@ + #include + + struct drm_device; ++struct drm_plane_funcs; ++struct drm_plane_helper_funcs; + struct kunit; + + struct device *drm_kunit_helper_alloc_device(struct kunit *test); +@@ -99,4 +101,13 @@ drm_kunit_helper_atomic_state_alloc(struct kunit *test, + struct drm_device *drm, + struct drm_modeset_acquire_ctx *ctx); + ++struct drm_plane * ++drm_kunit_helper_create_primary_plane(struct kunit *test, ++ struct drm_device *drm, ++ const struct drm_plane_funcs *funcs, ++ const struct drm_plane_helper_funcs *helper_funcs, ++ const uint32_t *formats, ++ unsigned int num_formats, ++ const uint64_t *modifiers); ++ + #endif // DRM_KUNIT_HELPERS_H_ +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-cmdline-fix-drm_display_mode-memory-leak.patch b/queue-6.6/drm-tests-cmdline-fix-drm_display_mode-memory-leak.patch new file mode 100644 index 00000000000..0c6bf68cd74 --- /dev/null +++ b/queue-6.6/drm-tests-cmdline-fix-drm_display_mode-memory-leak.patch @@ -0,0 +1,58 @@ +From 68e294ee57914f78211b881c4cf89ed80d7cd399 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 09:34:10 +0200 +Subject: drm/tests: cmdline: Fix drm_display_mode memory leak + +From: Maxime Ripard + +[ Upstream commit 70f29ca3117a8796cd6bde7612a3ded96d0f2dde ] + +drm_analog_tv_mode() and its variants return a drm_display_mode that +needs to be destroyed later one. The drm_test_cmdline_tv_options() test +never does however, which leads to a memory leak. + +Let's make sure it's freed. + +Reported-by: Philipp Stanner +Closes: https://lore.kernel.org/dri-devel/a7655158a6367ac46194d57f4b7433ef0772a73e.camel@mailbox.org/ +Fixes: e691c9992ae1 ("drm/modes: Introduce the tv_mode property as a command-line option") +Reviewed-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250408-drm-kunit-drm-display-mode-memleak-v1-4-996305a2e75a@kernel.org +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_cmdline_parser_test.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tests/drm_cmdline_parser_test.c b/drivers/gpu/drm/tests/drm_cmdline_parser_test.c +index 88f7f518ffb3b..05dd5cc3b604b 100644 +--- a/drivers/gpu/drm/tests/drm_cmdline_parser_test.c ++++ b/drivers/gpu/drm/tests/drm_cmdline_parser_test.c +@@ -7,6 +7,7 @@ + #include + + #include ++#include + #include + + static const struct drm_connector no_connector = {}; +@@ -955,8 +956,15 @@ struct drm_cmdline_tv_option_test { + static void drm_test_cmdline_tv_options(struct kunit *test) + { + const struct drm_cmdline_tv_option_test *params = test->param_value; +- const struct drm_display_mode *expected_mode = params->mode_fn(NULL); ++ struct drm_display_mode *expected_mode; + struct drm_cmdline_mode mode = { }; ++ int ret; ++ ++ expected_mode = params->mode_fn(NULL); ++ KUNIT_ASSERT_NOT_NULL(test, expected_mode); ++ ++ ret = drm_kunit_add_mode_destroy_action(test, expected_mode); ++ KUNIT_ASSERT_EQ(test, ret, 0); + + KUNIT_EXPECT_TRUE(test, drm_mode_parse_command_line_for_connector(params->cmdline, + &no_connector, &mode)); +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-helpers-add-atomic-helpers.patch b/queue-6.6/drm-tests-helpers-add-atomic-helpers.patch new file mode 100644 index 00000000000..d94a68a4b80 --- /dev/null +++ b/queue-6.6/drm-tests-helpers-add-atomic-helpers.patch @@ -0,0 +1,50 @@ +From 02085a899dcd74d6ef1c61716f3af4b6c23142b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 19:13:48 +0100 +Subject: drm/tests: helpers: Add atomic helpers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Ripard + +[ Upstream commit 66671944e17644804cb0886489e1b8fde924e9b9 ] + +The mock device we were creating was missing any of the driver-wide +helpers. That was fine before since we weren't testing the atomic state +path, but we're going to start, so let's use the default +implementations. + +Reviewed-by: Maíra Canal +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240222-kms-hdmi-connector-state-v7-2-8f4af575fce2@kernel.org +Stable-dep-of: 70f29ca3117a ("drm/tests: cmdline: Fix drm_display_mode memory leak") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_kunit_helpers.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/tests/drm_kunit_helpers.c b/drivers/gpu/drm/tests/drm_kunit_helpers.c +index bccb33b900f39..272a3ba46d602 100644 +--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c ++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + + #include ++#include + #include + #include + #include +@@ -13,6 +14,8 @@ + #define KUNIT_DEVICE_NAME "drm-kunit-mock-device" + + static const struct drm_mode_config_funcs drm_mode_config_funcs = { ++ .atomic_check = drm_atomic_helper_check, ++ .atomic_commit = drm_atomic_helper_commit, + }; + + static int fake_probe(struct platform_device *pdev) +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-helpers-add-helper-for-drm_display_mode_fr.patch b/queue-6.6/drm-tests-helpers-add-helper-for-drm_display_mode_fr.patch new file mode 100644 index 00000000000..037296786c7 --- /dev/null +++ b/queue-6.6/drm-tests-helpers-add-helper-for-drm_display_mode_fr.patch @@ -0,0 +1,101 @@ +From d60d574c7c18e4e736eb18dfabd8d079fdb2338a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2024 10:35:02 +0800 +Subject: drm/tests: helpers: Add helper for drm_display_mode_from_cea_vic() + +From: Jinjie Ruan + +[ Upstream commit caa714f86699bcfb01aa2d698db12d91af7d0d81 ] + +As Maxime suggested, add a new helper +drm_kunit_display_mode_from_cea_vic(), it can replace the direct call +of drm_display_mode_from_cea_vic(), and it will help solving +the `mode` memory leaks. + +Acked-by: Maxime Ripard +Suggested-by: Maxime Ripard +Signed-off-by: Jinjie Ruan +Link: https://patchwork.freedesktop.org/patch/msgid/20241030023504.530425-2-ruanjinjie@huawei.com +Signed-off-by: Maxime Ripard +Stable-dep-of: 70f29ca3117a ("drm/tests: cmdline: Fix drm_display_mode memory leak") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_kunit_helpers.c | 42 +++++++++++++++++++++++ + include/drm/drm_kunit_helpers.h | 4 +++ + 2 files changed, 46 insertions(+) + +diff --git a/drivers/gpu/drm/tests/drm_kunit_helpers.c b/drivers/gpu/drm/tests/drm_kunit_helpers.c +index ca513235b5e2a..9a35b2cf6a032 100644 +--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c ++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c +@@ -3,6 +3,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -383,5 +384,46 @@ drm_kunit_helper_create_crtc(struct kunit *test, + } + EXPORT_SYMBOL_GPL(drm_kunit_helper_create_crtc); + ++static void kunit_action_drm_mode_destroy(void *ptr) ++{ ++ struct drm_display_mode *mode = ptr; ++ ++ drm_mode_destroy(NULL, mode); ++} ++ ++/** ++ * drm_kunit_display_mode_from_cea_vic() - return a mode for CEA VIC ++ for a KUnit test ++ * @test: The test context object ++ * @dev: DRM device ++ * @video_code: CEA VIC of the mode ++ * ++ * Creates a new mode matching the specified CEA VIC for a KUnit test. ++ * ++ * Resources will be cleaned up automatically. ++ * ++ * Returns: A new drm_display_mode on success or NULL on failure ++ */ ++struct drm_display_mode * ++drm_kunit_display_mode_from_cea_vic(struct kunit *test, struct drm_device *dev, ++ u8 video_code) ++{ ++ struct drm_display_mode *mode; ++ int ret; ++ ++ mode = drm_display_mode_from_cea_vic(dev, video_code); ++ if (!mode) ++ return NULL; ++ ++ ret = kunit_add_action_or_reset(test, ++ kunit_action_drm_mode_destroy, ++ mode); ++ if (ret) ++ return NULL; ++ ++ return mode; ++} ++EXPORT_SYMBOL_GPL(drm_kunit_display_mode_from_cea_vic); ++ + MODULE_AUTHOR("Maxime Ripard "); + MODULE_LICENSE("GPL"); +diff --git a/include/drm/drm_kunit_helpers.h b/include/drm/drm_kunit_helpers.h +index 6e99627edf458..3e5f4a23685ef 100644 +--- a/include/drm/drm_kunit_helpers.h ++++ b/include/drm/drm_kunit_helpers.h +@@ -120,4 +120,8 @@ drm_kunit_helper_create_crtc(struct kunit *test, + const struct drm_crtc_funcs *funcs, + const struct drm_crtc_helper_funcs *helper_funcs); + ++struct drm_display_mode * ++drm_kunit_display_mode_from_cea_vic(struct kunit *test, struct drm_device *dev, ++ u8 video_code); ++ + #endif // DRM_KUNIT_HELPERS_H_ +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-helpers-create-kunit-helper-to-destroy-a-d.patch b/queue-6.6/drm-tests-helpers-create-kunit-helper-to-destroy-a-d.patch new file mode 100644 index 00000000000..6c37f746246 --- /dev/null +++ b/queue-6.6/drm-tests-helpers-create-kunit-helper-to-destroy-a-d.patch @@ -0,0 +1,78 @@ +From ef5c93961065674a52bf229473bdf91e5bebe2b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 09:34:07 +0200 +Subject: drm/tests: helpers: Create kunit helper to destroy a drm_display_mode + +From: Maxime Ripard + +[ Upstream commit 13c1d5f3a7fa7b55a26e73bb9e95342374a489b2 ] + +A number of test suites call functions that expect the returned +drm_display_mode to be destroyed eventually. + +However, none of the tests called drm_mode_destroy, which results in a +memory leak. + +Since drm_mode_destroy takes two pointers as argument, we can't use a +kunit wrapper. Let's just create a helper every test suite can use. + +Reviewed-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250408-drm-kunit-drm-display-mode-memleak-v1-1-996305a2e75a@kernel.org +Signed-off-by: Maxime Ripard +Stable-dep-of: 70f29ca3117a ("drm/tests: cmdline: Fix drm_display_mode memory leak") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_kunit_helpers.c | 22 ++++++++++++++++++++++ + include/drm/drm_kunit_helpers.h | 3 +++ + 2 files changed, 25 insertions(+) + +diff --git a/drivers/gpu/drm/tests/drm_kunit_helpers.c b/drivers/gpu/drm/tests/drm_kunit_helpers.c +index 12d58353a54ef..04d98f81c5227 100644 +--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c ++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c +@@ -391,6 +391,28 @@ static void kunit_action_drm_mode_destroy(void *ptr) + drm_mode_destroy(NULL, mode); + } + ++/** ++ * drm_kunit_add_mode_destroy_action() - Add a drm_destroy_mode kunit action ++ * @test: The test context object ++ * @mode: The drm_display_mode to destroy eventually ++ * ++ * Registers a kunit action that will destroy the drm_display_mode at ++ * the end of the test. ++ * ++ * If an error occurs, the drm_display_mode will be destroyed. ++ * ++ * Returns: ++ * 0 on success, an error code otherwise. ++ */ ++int drm_kunit_add_mode_destroy_action(struct kunit *test, ++ struct drm_display_mode *mode) ++{ ++ return kunit_add_action_or_reset(test, ++ kunit_action_drm_mode_destroy, ++ mode); ++} ++EXPORT_SYMBOL_GPL(drm_kunit_add_mode_destroy_action); ++ + /** + * drm_kunit_display_mode_from_cea_vic() - return a mode for CEA VIC for a KUnit test + * @test: The test context object +diff --git a/include/drm/drm_kunit_helpers.h b/include/drm/drm_kunit_helpers.h +index 3e5f4a23685ef..07e9a451262b6 100644 +--- a/include/drm/drm_kunit_helpers.h ++++ b/include/drm/drm_kunit_helpers.h +@@ -120,6 +120,9 @@ drm_kunit_helper_create_crtc(struct kunit *test, + const struct drm_crtc_funcs *funcs, + const struct drm_crtc_helper_funcs *helper_funcs); + ++int drm_kunit_add_mode_destroy_action(struct kunit *test, ++ struct drm_display_mode *mode); ++ + struct drm_display_mode * + drm_kunit_display_mode_from_cea_vic(struct kunit *test, struct drm_device *dev, + u8 video_code); +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-helpers-fix-compiler-warning.patch b/queue-6.6/drm-tests-helpers-fix-compiler-warning.patch new file mode 100644 index 00000000000..1bfcdc7bcad --- /dev/null +++ b/queue-6.6/drm-tests-helpers-fix-compiler-warning.patch @@ -0,0 +1,46 @@ +From 391b1a1f399ba206f46f6305a548f08d2da7108d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jan 2025 00:51:33 +0800 +Subject: drm/tests: helpers: Fix compiler warning + +From: Yu-Chun Lin + +[ Upstream commit b9097e4c8bf3934e4e07e6f9b88741957fef351e ] + +Delete one line break to make the format correct, resolving the +following warning during a W=1 build: + +>> drivers/gpu/drm/tests/drm_kunit_helpers.c:324: warning: bad line: for a KUnit test + +Fixes: caa714f86699 ("drm/tests: helpers: Add helper for drm_display_mode_from_cea_vic()") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202501032001.O6WY1VCW-lkp@intel.com/ +Reviewed-by: Kuan-Wei Chiu +Tested-by: Kuan-Wei Chiu +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Yu-Chun Lin +Link: https://patchwork.freedesktop.org/patch/msgid/20250104165134.1695864-1-eleanor15x@gmail.com +Signed-off-by: Maxime Ripard +Stable-dep-of: 70f29ca3117a ("drm/tests: cmdline: Fix drm_display_mode memory leak") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_kunit_helpers.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tests/drm_kunit_helpers.c b/drivers/gpu/drm/tests/drm_kunit_helpers.c +index 9a35b2cf6a032..12d58353a54ef 100644 +--- a/drivers/gpu/drm/tests/drm_kunit_helpers.c ++++ b/drivers/gpu/drm/tests/drm_kunit_helpers.c +@@ -392,8 +392,7 @@ static void kunit_action_drm_mode_destroy(void *ptr) + } + + /** +- * drm_kunit_display_mode_from_cea_vic() - return a mode for CEA VIC +- for a KUnit test ++ * drm_kunit_display_mode_from_cea_vic() - return a mode for CEA VIC for a KUnit test + * @test: The test context object + * @dev: DRM device + * @video_code: CEA VIC of the mode +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-modes-fix-drm_display_mode-memory-leak.patch b/queue-6.6/drm-tests-modes-fix-drm_display_mode-memory-leak.patch new file mode 100644 index 00000000000..238210aff85 --- /dev/null +++ b/queue-6.6/drm-tests-modes-fix-drm_display_mode-memory-leak.patch @@ -0,0 +1,117 @@ +From a33e64229f9d55383d6c7827a8021bfb9a1867a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 09:34:11 +0200 +Subject: drm/tests: modes: Fix drm_display_mode memory leak + +From: Maxime Ripard + +[ Upstream commit d34146340f95cd9bf06d4ce71cca72127dc0b7cd ] + +drm_analog_tv_mode() and its variants return a drm_display_mode that +needs to be destroyed later one. The drm_modes_analog_tv tests never +do however, which leads to a memory leak. + +Let's make sure it's freed. + +Reported-by: Philipp Stanner +Closes: https://lore.kernel.org/dri-devel/a7655158a6367ac46194d57f4b7433ef0772a73e.camel@mailbox.org/ +Fixes: 4fcd238560ee ("drm/modes: Add a function to generate analog display modes") +Reviewed-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250408-drm-kunit-drm-display-mode-memleak-v1-5-996305a2e75a@kernel.org +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_modes_test.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/gpu/drm/tests/drm_modes_test.c b/drivers/gpu/drm/tests/drm_modes_test.c +index 1e9f63fbfead3..e23067252d18a 100644 +--- a/drivers/gpu/drm/tests/drm_modes_test.c ++++ b/drivers/gpu/drm/tests/drm_modes_test.c +@@ -40,6 +40,7 @@ static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test) + { + struct drm_test_modes_priv *priv = test->priv; + struct drm_display_mode *mode; ++ int ret; + + mode = drm_analog_tv_mode(priv->drm, + DRM_MODE_TV_MODE_NTSC, +@@ -47,6 +48,9 @@ static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test) + true); + KUNIT_ASSERT_NOT_NULL(test, mode); + ++ ret = drm_kunit_add_mode_destroy_action(test, mode); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ + KUNIT_EXPECT_EQ(test, drm_mode_vrefresh(mode), 60); + KUNIT_EXPECT_EQ(test, mode->hdisplay, 720); + +@@ -70,6 +74,7 @@ static void drm_test_modes_analog_tv_ntsc_480i_inlined(struct kunit *test) + { + struct drm_test_modes_priv *priv = test->priv; + struct drm_display_mode *expected, *mode; ++ int ret; + + expected = drm_analog_tv_mode(priv->drm, + DRM_MODE_TV_MODE_NTSC, +@@ -77,9 +82,15 @@ static void drm_test_modes_analog_tv_ntsc_480i_inlined(struct kunit *test) + true); + KUNIT_ASSERT_NOT_NULL(test, expected); + ++ ret = drm_kunit_add_mode_destroy_action(test, expected); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ + mode = drm_mode_analog_ntsc_480i(priv->drm); + KUNIT_ASSERT_NOT_NULL(test, mode); + ++ ret = drm_kunit_add_mode_destroy_action(test, mode); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ + KUNIT_EXPECT_TRUE(test, drm_mode_equal(expected, mode)); + } + +@@ -87,6 +98,7 @@ static void drm_test_modes_analog_tv_pal_576i(struct kunit *test) + { + struct drm_test_modes_priv *priv = test->priv; + struct drm_display_mode *mode; ++ int ret; + + mode = drm_analog_tv_mode(priv->drm, + DRM_MODE_TV_MODE_PAL, +@@ -94,6 +106,9 @@ static void drm_test_modes_analog_tv_pal_576i(struct kunit *test) + true); + KUNIT_ASSERT_NOT_NULL(test, mode); + ++ ret = drm_kunit_add_mode_destroy_action(test, mode); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ + KUNIT_EXPECT_EQ(test, drm_mode_vrefresh(mode), 50); + KUNIT_EXPECT_EQ(test, mode->hdisplay, 720); + +@@ -117,6 +132,7 @@ static void drm_test_modes_analog_tv_pal_576i_inlined(struct kunit *test) + { + struct drm_test_modes_priv *priv = test->priv; + struct drm_display_mode *expected, *mode; ++ int ret; + + expected = drm_analog_tv_mode(priv->drm, + DRM_MODE_TV_MODE_PAL, +@@ -124,9 +140,15 @@ static void drm_test_modes_analog_tv_pal_576i_inlined(struct kunit *test) + true); + KUNIT_ASSERT_NOT_NULL(test, expected); + ++ ret = drm_kunit_add_mode_destroy_action(test, expected); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ + mode = drm_mode_analog_pal_576i(priv->drm); + KUNIT_ASSERT_NOT_NULL(test, mode); + ++ ret = drm_kunit_add_mode_destroy_action(test, mode); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ + KUNIT_EXPECT_TRUE(test, drm_mode_equal(expected, mode)); + } + +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-modeset-fix-drm_display_mode-memory-leak.patch b/queue-6.6/drm-tests-modeset-fix-drm_display_mode-memory-leak.patch new file mode 100644 index 00000000000..80fada9d367 --- /dev/null +++ b/queue-6.6/drm-tests-modeset-fix-drm_display_mode-memory-leak.patch @@ -0,0 +1,43 @@ +From 3d16efae03a0607fcf045400bfeaef58db465f6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 09:34:08 +0200 +Subject: drm/tests: modeset: Fix drm_display_mode memory leak + +From: Maxime Ripard + +[ Upstream commit dacafdcc7789cfeb0f0552716db56f210238225d ] + +drm_mode_find_dmt() returns a drm_display_mode that needs to be +destroyed later one. The drm_test_pick_cmdline_res_1920_1080_60() test +never does however, which leads to a memory leak. + +Let's make sure it's freed. + +Reported-by: Philipp Stanner +Closes: https://lore.kernel.org/dri-devel/a7655158a6367ac46194d57f4b7433ef0772a73e.camel@mailbox.org/ +Fixes: 8fc0380f6ba7 ("drm/client: Add some tests for drm_connector_pick_cmdline_mode()") +Reviewed-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250408-drm-kunit-drm-display-mode-memleak-v1-2-996305a2e75a@kernel.org +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_client_modeset_test.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/tests/drm_client_modeset_test.c b/drivers/gpu/drm/tests/drm_client_modeset_test.c +index 7516f6cb36e4e..3e9518d7b8b7e 100644 +--- a/drivers/gpu/drm/tests/drm_client_modeset_test.c ++++ b/drivers/gpu/drm/tests/drm_client_modeset_test.c +@@ -95,6 +95,9 @@ static void drm_test_pick_cmdline_res_1920_1080_60(struct kunit *test) + expected_mode = drm_mode_find_dmt(priv->drm, 1920, 1080, 60, false); + KUNIT_ASSERT_NOT_NULL(test, expected_mode); + ++ ret = drm_kunit_add_mode_destroy_action(test, expected_mode); ++ KUNIT_ASSERT_EQ(test, ret, 0); ++ + KUNIT_ASSERT_TRUE(test, + drm_mode_parse_command_line_for_connector(cmdline, + connector, +-- +2.39.5 + diff --git a/queue-6.6/drm-tests-probe-helper-fix-drm_display_mode-memory-l.patch b/queue-6.6/drm-tests-probe-helper-fix-drm_display_mode-memory-l.patch new file mode 100644 index 00000000000..575622047b6 --- /dev/null +++ b/queue-6.6/drm-tests-probe-helper-fix-drm_display_mode-memory-l.patch @@ -0,0 +1,63 @@ +From d8dad644084db7325e2ef340f9f4c179579d0480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 09:34:13 +0200 +Subject: drm/tests: probe-helper: Fix drm_display_mode memory leak + +From: Maxime Ripard + +[ Upstream commit 8b6f2e28431b2f9f84073bff50353aeaf25559d0 ] + +drm_analog_tv_mode() and its variants return a drm_display_mode that +needs to be destroyed later one. The +drm_test_connector_helper_tv_get_modes_check() test never does however, +which leads to a memory leak. + +Let's make sure it's freed. + +Reported-by: Philipp Stanner +Closes: https://lore.kernel.org/dri-devel/a7655158a6367ac46194d57f4b7433ef0772a73e.camel@mailbox.org/ +Fixes: 1e4a91db109f ("drm/probe-helper: Provide a TV get_modes helper") +Reviewed-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250408-drm-kunit-drm-display-mode-memleak-v1-7-996305a2e75a@kernel.org +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_probe_helper_test.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tests/drm_probe_helper_test.c b/drivers/gpu/drm/tests/drm_probe_helper_test.c +index 1a2044070a6cb..2a7984431d47b 100644 +--- a/drivers/gpu/drm/tests/drm_probe_helper_test.c ++++ b/drivers/gpu/drm/tests/drm_probe_helper_test.c +@@ -98,7 +98,7 @@ drm_test_connector_helper_tv_get_modes_check(struct kunit *test) + struct drm_connector *connector = &priv->connector; + struct drm_cmdline_mode *cmdline = &connector->cmdline_mode; + struct drm_display_mode *mode; +- const struct drm_display_mode *expected; ++ struct drm_display_mode *expected; + size_t len; + int ret; + +@@ -134,6 +134,9 @@ drm_test_connector_helper_tv_get_modes_check(struct kunit *test) + + KUNIT_EXPECT_TRUE(test, drm_mode_equal(mode, expected)); + KUNIT_EXPECT_TRUE(test, mode->type & DRM_MODE_TYPE_PREFERRED); ++ ++ ret = drm_kunit_add_mode_destroy_action(test, expected); ++ KUNIT_ASSERT_EQ(test, ret, 0); + } + + if (params->num_expected_modes >= 2) { +@@ -145,6 +148,9 @@ drm_test_connector_helper_tv_get_modes_check(struct kunit *test) + + KUNIT_EXPECT_TRUE(test, drm_mode_equal(mode, expected)); + KUNIT_EXPECT_FALSE(test, mode->type & DRM_MODE_TYPE_PREFERRED); ++ ++ ret = drm_kunit_add_mode_destroy_action(test, expected); ++ KUNIT_ASSERT_EQ(test, ret, 0); + } + + mutex_unlock(&priv->drm->mode_config.mutex); +-- +2.39.5 + diff --git a/queue-6.6/iommu-mediatek-fix-null-pointer-deference-in-mtk_iom.patch b/queue-6.6/iommu-mediatek-fix-null-pointer-deference-in-mtk_iom.patch new file mode 100644 index 00000000000..6ca582ba7dd --- /dev/null +++ b/queue-6.6/iommu-mediatek-fix-null-pointer-deference-in-mtk_iom.patch @@ -0,0 +1,87 @@ +From 4aa267bfaf2e633d101e15a53f32c577ddadf4af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Apr 2025 12:22:12 +0200 +Subject: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group + +From: Louis-Alexis Eyraud + +[ Upstream commit 38e8844005e6068f336a3ad45451a562a0040ca1 ] + +Currently, mtk_iommu calls during probe iommu_device_register before +the hw_list from driver data is initialized. Since iommu probing issue +fix, it leads to NULL pointer dereference in mtk_iommu_device_group when +hw_list is accessed with list_first_entry (not null safe). + +So, change the call order to ensure iommu_device_register is called +after the driver data are initialized. + +Fixes: 9e3a2a643653 ("iommu/mediatek: Adapt sharing and non-sharing pgtable case") +Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path") +Reviewed-by: Yong Wu +Tested-by: Chen-Yu Tsai # MT8183 Juniper, MT8186 Tentacruel +Reviewed-by: AngeloGioacchino Del Regno +Tested-by: AngeloGioacchino Del Regno +Signed-off-by: Louis-Alexis Eyraud +Link: https://lore.kernel.org/r/20250403-fix-mtk-iommu-error-v2-1-fe8b18f8b0a8@collabora.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/mtk_iommu.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c +index de698463e94ad..06c0770ff894e 100644 +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -1354,15 +1354,6 @@ static int mtk_iommu_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, data); + mutex_init(&data->mutex); + +- ret = iommu_device_sysfs_add(&data->iommu, dev, NULL, +- "mtk-iommu.%pa", &ioaddr); +- if (ret) +- goto out_link_remove; +- +- ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev); +- if (ret) +- goto out_sysfs_remove; +- + if (MTK_IOMMU_HAS_FLAG(data->plat_data, SHARE_PGTABLE)) { + list_add_tail(&data->list, data->plat_data->hw_list); + data->hw_list = data->plat_data->hw_list; +@@ -1372,19 +1363,28 @@ static int mtk_iommu_probe(struct platform_device *pdev) + data->hw_list = &data->hw_list_head; + } + ++ ret = iommu_device_sysfs_add(&data->iommu, dev, NULL, ++ "mtk-iommu.%pa", &ioaddr); ++ if (ret) ++ goto out_list_del; ++ ++ ret = iommu_device_register(&data->iommu, &mtk_iommu_ops, dev); ++ if (ret) ++ goto out_sysfs_remove; ++ + if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) { + ret = component_master_add_with_match(dev, &mtk_iommu_com_ops, match); + if (ret) +- goto out_list_del; ++ goto out_device_unregister; + } + return ret; + +-out_list_del: +- list_del(&data->list); ++out_device_unregister: + iommu_device_unregister(&data->iommu); + out_sysfs_remove: + iommu_device_sysfs_remove(&data->iommu); +-out_link_remove: ++out_list_del: ++ list_del(&data->list); + if (MTK_IOMMU_IS_TYPE(data->plat_data, MTK_IOMMU_TYPE_MM)) + device_link_remove(data->smicomm_dev, dev); + out_runtime_disable: +-- +2.39.5 + diff --git a/queue-6.6/ipv6-align-behavior-across-nexthops-during-path-sele.patch b/queue-6.6/ipv6-align-behavior-across-nexthops-during-path-sele.patch new file mode 100644 index 00000000000..30e53b4072b --- /dev/null +++ b/queue-6.6/ipv6-align-behavior-across-nexthops-during-path-sele.patch @@ -0,0 +1,63 @@ +From 9a166572c24b7b132875c55767a1fcbea956bd52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 11:43:16 +0300 +Subject: ipv6: Align behavior across nexthops during path selection + +From: Ido Schimmel + +[ Upstream commit 6933cd4714861eea6848f18396a119d741f25fc3 ] + +A nexthop is only chosen when the calculated multipath hash falls in the +nexthop's hash region (i.e., the hash is smaller than the nexthop's hash +threshold) and when the nexthop is assigned a non-negative score by +rt6_score_route(). + +Commit 4d0ab3a6885e ("ipv6: Start path selection from the first +nexthop") introduced an unintentional difference between the first +nexthop and the rest when the score is negative. + +When the first nexthop matches, but has a negative score, the code will +currently evaluate subsequent nexthops until one is found with a +non-negative score. On the other hand, when a different nexthop matches, +but has a negative score, the code will fallback to the nexthop with +which the selection started ('match'). + +Align the behavior across all nexthops and fallback to 'match' when the +first nexthop matches, but has a negative score. + +Fixes: 3d709f69a3e7 ("ipv6: Use hash-threshold instead of modulo-N") +Fixes: 4d0ab3a6885e ("ipv6: Start path selection from the first nexthop") +Reported-by: Willem de Bruijn +Closes: https://lore.kernel.org/netdev/67efef607bc41_1ddca82948c@willemb.c.googlers.com.notmuch/ +Signed-off-by: Ido Schimmel +Reviewed-by: Willem de Bruijn +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250408084316.243559-1-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 2e98531fa51a3..53197087353a7 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -472,10 +472,10 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, + goto out; + + hash = fl6->mp_hash; +- if (hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound) && +- rt6_score_route(first->fib6_nh, first->fib6_flags, oif, +- strict) >= 0) { +- match = first; ++ if (hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound)) { ++ if (rt6_score_route(first->fib6_nh, first->fib6_flags, oif, ++ strict) >= 0) ++ match = first; + goto out; + } + +-- +2.39.5 + diff --git a/queue-6.6/net-ethtool-don-t-call-.cleanup_data-when-prepare_da.patch b/queue-6.6/net-ethtool-don-t-call-.cleanup_data-when-prepare_da.patch new file mode 100644 index 00000000000..86e48fe1dc9 --- /dev/null +++ b/queue-6.6/net-ethtool-don-t-call-.cleanup_data-when-prepare_da.patch @@ -0,0 +1,78 @@ +From 13505c4336259f6579ae350fd149c7d7f3e07a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 15:05:10 +0200 +Subject: net: ethtool: Don't call .cleanup_data when prepare_data fails + +From: Maxime Chevallier + +[ Upstream commit 4f038a6a02d20859a3479293cbf172b0f14cbdd6 ] + +There's a consistent pattern where the .cleanup_data() callback is +called when .prepare_data() fails, when it should really be called to +clean after a successful .prepare_data() as per the documentation. + +Rewrite the error-handling paths to make sure we don't cleanup +un-prepared data. + +Fixes: c781ff12a2f3 ("ethtool: Allow network drivers to dump arbitrary EEPROM data") +Reviewed-by: Kory Maincent +Reviewed-by: Simon Horman +Reviewed-by: Michal Kubecek +Signed-off-by: Maxime Chevallier +Link: https://patch.msgid.link/20250407130511.75621-1-maxime.chevallier@bootlin.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ethtool/netlink.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c +index c1ad63bee8ead..7a9d8fe78ae9d 100644 +--- a/net/ethtool/netlink.c ++++ b/net/ethtool/netlink.c +@@ -402,7 +402,7 @@ static int ethnl_default_doit(struct sk_buff *skb, struct genl_info *info) + ret = ops->prepare_data(req_info, reply_data, info); + rtnl_unlock(); + if (ret < 0) +- goto err_cleanup; ++ goto err_dev; + ret = ops->reply_size(req_info, reply_data); + if (ret < 0) + goto err_cleanup; +@@ -460,7 +460,7 @@ static int ethnl_default_dump_one(struct sk_buff *skb, struct net_device *dev, + ret = ctx->ops->prepare_data(ctx->req_info, ctx->reply_data, info); + rtnl_unlock(); + if (ret < 0) +- goto out; ++ goto out_cancel; + ret = ethnl_fill_reply_header(skb, dev, ctx->ops->hdr_attr); + if (ret < 0) + goto out; +@@ -469,6 +469,7 @@ static int ethnl_default_dump_one(struct sk_buff *skb, struct net_device *dev, + out: + if (ctx->ops->cleanup_data) + ctx->ops->cleanup_data(ctx->reply_data); ++out_cancel: + ctx->reply_data->dev = NULL; + if (ret < 0) + genlmsg_cancel(skb, ehdr); +@@ -676,7 +677,7 @@ static void ethnl_default_notify(struct net_device *dev, unsigned int cmd, + ethnl_init_reply_data(reply_data, ops, dev); + ret = ops->prepare_data(req_info, reply_data, &info); + if (ret < 0) +- goto err_cleanup; ++ goto err_rep; + ret = ops->reply_size(req_info, reply_data); + if (ret < 0) + goto err_cleanup; +@@ -711,6 +712,7 @@ static void ethnl_default_notify(struct net_device *dev, unsigned int cmd, + err_cleanup: + if (ops->cleanup_data) + ops->cleanup_data(reply_data); ++err_rep: + kfree(reply_data); + kfree(req_info); + return; +-- +2.39.5 + diff --git a/queue-6.6/net-libwx-handle-page_pool_dev_alloc_pages-error.patch b/queue-6.6/net-libwx-handle-page_pool_dev_alloc_pages-error.patch new file mode 100644 index 00000000000..e9f10977b04 --- /dev/null +++ b/queue-6.6/net-libwx-handle-page_pool_dev_alloc_pages-error.patch @@ -0,0 +1,44 @@ +From 8251f7502b628fce5b3aee7306891cc0417368b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 13:49:52 -0500 +Subject: net: libwx: handle page_pool_dev_alloc_pages error + +From: Chenyuan Yang + +[ Upstream commit 7f1ff1b38a7c8b872382b796023419d87d78c47e ] + +page_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page) +but it would still proceed to use the NULL pointer and then crash. + +This is similar to commit 001ba0902046 +("net: fec: handle page_pool_dev_alloc_pages error"). + +This is found by our static analysis tool KNighter. + +Signed-off-by: Chenyuan Yang +Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") +Reviewed-by: Joe Damato +Link: https://patch.msgid.link/20250407184952.2111299-1-chenyuan0y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +index c37500aa06379..c019fe964ecea 100644 +--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +@@ -311,7 +311,8 @@ static bool wx_alloc_mapped_page(struct wx_ring *rx_ring, + return true; + + page = page_pool_dev_alloc_pages(rx_ring->page_pool); +- WARN_ON(!page); ++ if (unlikely(!page)) ++ return false; + dma = page_pool_get_dma_addr(page); + + bi->page_dma = dma; +-- +2.39.5 + diff --git a/queue-6.6/net-ppp-add-bound-checking-for-skb-data-on-ppp_sync_.patch b/queue-6.6/net-ppp-add-bound-checking-for-skb-data-on-ppp_sync_.patch new file mode 100644 index 00000000000..2a5088249f3 --- /dev/null +++ b/queue-6.6/net-ppp-add-bound-checking-for-skb-data-on-ppp_sync_.patch @@ -0,0 +1,73 @@ +From b65b50a9cbaaaf8e4fa61b81f4282fa52b401db8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 17:55:08 +0200 +Subject: net: ppp: Add bound checking for skb data on ppp_sync_txmung +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnaud Lecomte + +[ Upstream commit aabc6596ffb377c4c9c8f335124b92ea282c9821 ] + +Ensure we have enough data in linear buffer from skb before accessing +initial bytes. This prevents potential out-of-bounds accesses +when processing short packets. + +When ppp_sync_txmung receives an incoming package with an empty +payload: +(remote) gef➤ p *(struct pppoe_hdr *) (skb->head + skb->network_header) +$18 = { + type = 0x1, + ver = 0x1, + code = 0x0, + sid = 0x2, + length = 0x0, + tag = 0xffff8880371cdb96 +} + +from the skb struct (trimmed) + tail = 0x16, + end = 0x140, + head = 0xffff88803346f400 "4", + data = 0xffff88803346f416 ":\377", + truesize = 0x380, + len = 0x0, + data_len = 0x0, + mac_len = 0xe, + hdr_len = 0x0, + +it is not safe to access data[2]. + +Reported-by: syzbot+29fc8991b0ecb186cf40@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=29fc8991b0ecb186cf40 +Tested-by: syzbot+29fc8991b0ecb186cf40@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Arnaud Lecomte +Link: https://patch.msgid.link/20250408-bound-checking-ppp_txmung-v2-1-94bb6e1b92d0@arnaud-lcm.com +[pabeni@redhat.com: fixed subj typo] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/ppp_synctty.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c +index 52d05ce4a2819..02e1c5bd1892b 100644 +--- a/drivers/net/ppp/ppp_synctty.c ++++ b/drivers/net/ppp/ppp_synctty.c +@@ -506,6 +506,11 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb) + unsigned char *data; + int islcp; + ++ /* Ensure we can safely access protocol field and LCP code */ ++ if (!pskb_may_pull(skb, 3)) { ++ kfree_skb(skb); ++ return NULL; ++ } + data = skb->data; + proto = get_unaligned_be16(data); + +-- +2.39.5 + diff --git a/queue-6.6/net-sched-cls_api-conditional-notification-of-events.patch b/queue-6.6/net-sched-cls_api-conditional-notification-of-events.patch new file mode 100644 index 00000000000..5adc3b906d0 --- /dev/null +++ b/queue-6.6/net-sched-cls_api-conditional-notification-of-events.patch @@ -0,0 +1,73 @@ +From ed44a5c5e6c64bb2407cc59ae6f66f3ab6c9b498 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 16:28:47 -0300 +Subject: net/sched: cls_api: conditional notification of events + +From: Pedro Tammela + +[ Upstream commit 93775590b1ee98bf2976b1f4a1ed24e9ff76170f ] + +As of today tc-filter/chain events are unconditionally built and sent to +RTNLGRP_TC. As with the introduction of rtnl_notify_needed we can check +before-hand if they are really needed. This will help to alleviate +system pressure when filters are concurrently added without the rtnl +lock as in tc-flower. + +Reviewed-by: Jiri Pirko +Reviewed-by: Simon Horman +Signed-off-by: Pedro Tammela +Link: https://lore.kernel.org/r/20231208192847.714940-8-pctammela@mojatatu.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 369609fc6272 ("tc: Ensure we have enough buffer space when sending filter netlink notifications") +Signed-off-by: Sasha Levin +--- + net/sched/cls_api.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 96c39e9a873c7..a0eb389b4fb4b 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -2038,6 +2038,9 @@ static int tfilter_notify(struct net *net, struct sk_buff *oskb, + u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; + int err = 0; + ++ if (!unicast && !rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC)) ++ return 0; ++ + skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); + if (!skb) + return -ENOBUFS; +@@ -2067,6 +2070,9 @@ static int tfilter_del_notify(struct net *net, struct sk_buff *oskb, + u32 portid = oskb ? NETLINK_CB(oskb).portid : 0; + int err; + ++ if (!rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC)) ++ return tp->ops->delete(tp, fh, last, rtnl_held, extack); ++ + skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); + if (!skb) + return -ENOBUFS; +@@ -2891,6 +2897,9 @@ static int tc_chain_notify(struct tcf_chain *chain, struct sk_buff *oskb, + struct sk_buff *skb; + int err = 0; + ++ if (!unicast && !rtnl_notify_needed(net, flags, RTNLGRP_TC)) ++ return 0; ++ + skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); + if (!skb) + return -ENOBUFS; +@@ -2920,6 +2929,9 @@ static int tc_chain_notify_delete(const struct tcf_proto_ops *tmplt_ops, + struct net *net = block->net; + struct sk_buff *skb; + ++ if (!rtnl_notify_needed(net, flags, RTNLGRP_TC)) ++ return 0; ++ + skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); + if (!skb) + return -ENOBUFS; +-- +2.39.5 + diff --git a/queue-6.6/net-tls-explicitly-disallow-disconnect.patch b/queue-6.6/net-tls-explicitly-disallow-disconnect.patch new file mode 100644 index 00000000000..22f73b9be95 --- /dev/null +++ b/queue-6.6/net-tls-explicitly-disallow-disconnect.patch @@ -0,0 +1,69 @@ +From 8266aa4969108a7d70d5dc2636a3b04d8cf349ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 11:03:33 -0700 +Subject: net: tls: explicitly disallow disconnect + +From: Jakub Kicinski + +[ Upstream commit 5071a1e606b30c0c11278d3c6620cd6a24724cf6 ] + +syzbot discovered that it can disconnect a TLS socket and then +run into all sort of unexpected corner cases. I have a vague +recollection of Eric pointing this out to us a long time ago. +Supporting disconnect is really hard, for one thing if offload +is enabled we'd need to wait for all packets to be _acked_. +Disconnect is not commonly used, disallow it. + +The immediate problem syzbot run into is the warning in the strp, +but that's just the easiest bug to trigger: + + WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 + RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 + Call Trace: + + tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363 + tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043 + inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678 + sock_recvmsg_nosec net/socket.c:1023 [inline] + sock_recvmsg+0x109/0x280 net/socket.c:1045 + __sys_recvfrom+0x202/0x380 net/socket.c:2237 + +Fixes: 3c4d7559159b ("tls: kernel TLS support") +Reported-by: syzbot+b4cd76826045a1eb93c1@syzkaller.appspotmail.com +Signed-off-by: Jakub Kicinski +Reviewed-by: Eric Dumazet +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20250404180334.3224206-1-kuba@kernel.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/tls/tls_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 0a67b93a52ec2..d7dea82bcf565 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -804,6 +804,11 @@ static int tls_setsockopt(struct sock *sk, int level, int optname, + return do_tls_setsockopt(sk, optname, optval, optlen); + } + ++static int tls_disconnect(struct sock *sk, int flags) ++{ ++ return -EOPNOTSUPP; ++} ++ + struct tls_context *tls_ctx_create(struct sock *sk) + { + struct inet_connection_sock *icsk = inet_csk(sk); +@@ -899,6 +904,7 @@ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG], + prot[TLS_BASE][TLS_BASE] = *base; + prot[TLS_BASE][TLS_BASE].setsockopt = tls_setsockopt; + prot[TLS_BASE][TLS_BASE].getsockopt = tls_getsockopt; ++ prot[TLS_BASE][TLS_BASE].disconnect = tls_disconnect; + prot[TLS_BASE][TLS_BASE].close = tls_sk_proto_close; + + prot[TLS_SW][TLS_BASE] = prot[TLS_BASE][TLS_BASE]; +-- +2.39.5 + diff --git a/queue-6.6/net_sched-sch_sfq-move-the-limit-validation.patch b/queue-6.6/net_sched-sch_sfq-move-the-limit-validation.patch new file mode 100644 index 00000000000..facd11d03b5 --- /dev/null +++ b/queue-6.6/net_sched-sch_sfq-move-the-limit-validation.patch @@ -0,0 +1,85 @@ +From 60e5c06ab18164cddf27c73543d36b4849aa0fa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 13:24:08 -0700 +Subject: net_sched: sch_sfq: move the limit validation + +From: Octavian Purdila + +[ Upstream commit b3bf8f63e6179076b57c9de660c9f80b5abefe70 ] + +It is not sufficient to directly validate the limit on the data that +the user passes as it can be updated based on how the other parameters +are changed. + +Move the check at the end of the configuration update process to also +catch scenarios where the limit is indirectly updated, for example +with the following configurations: + +tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 depth 1 +tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 divisor 1 + +This fixes the following syzkaller reported crash: + +------------[ cut here ]------------ +UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:203:6 +index 65535 is out of range for type 'struct sfq_head[128]' +CPU: 1 UID: 0 PID: 3037 Comm: syz.2.16 Not tainted 6.14.0-rc2-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x201/0x300 lib/dump_stack.c:120 + ubsan_epilogue lib/ubsan.c:231 [inline] + __ubsan_handle_out_of_bounds+0xf5/0x120 lib/ubsan.c:429 + sfq_link net/sched/sch_sfq.c:203 [inline] + sfq_dec+0x53c/0x610 net/sched/sch_sfq.c:231 + sfq_dequeue+0x34e/0x8c0 net/sched/sch_sfq.c:493 + sfq_reset+0x17/0x60 net/sched/sch_sfq.c:518 + qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035 + tbf_reset+0x41/0x110 net/sched/sch_tbf.c:339 + qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035 + dev_reset_queue+0x100/0x1b0 net/sched/sch_generic.c:1311 + netdev_for_each_tx_queue include/linux/netdevice.h:2590 [inline] + dev_deactivate_many+0x7e5/0xe70 net/sched/sch_generic.c:1375 + +Reported-by: syzbot +Fixes: 10685681bafc ("net_sched: sch_sfq: don't allow 1 packet limit") +Signed-off-by: Octavian Purdila +Acked-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_sfq.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index 68e909e8fabd9..002941d35b643 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -661,10 +661,6 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, + if (!p) + return -ENOMEM; + } +- if (ctl->limit == 1) { +- NL_SET_ERR_MSG_MOD(extack, "invalid limit"); +- return -EINVAL; +- } + + sch_tree_lock(sch); + +@@ -705,6 +701,12 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, + limit = min_t(u32, ctl->limit, maxdepth * maxflows); + maxflows = min_t(u32, maxflows, limit); + } ++ if (limit == 1) { ++ sch_tree_unlock(sch); ++ kfree(p); ++ NL_SET_ERR_MSG_MOD(extack, "invalid limit"); ++ return -EINVAL; ++ } + + /* commit configuration */ + q->limit = limit; +-- +2.39.5 + diff --git a/queue-6.6/net_sched-sch_sfq-use-a-temporary-work-area-for-vali.patch b/queue-6.6/net_sched-sch_sfq-use-a-temporary-work-area-for-vali.patch new file mode 100644 index 00000000000..2a5d7cf3ef2 --- /dev/null +++ b/queue-6.6/net_sched-sch_sfq-use-a-temporary-work-area-for-vali.patch @@ -0,0 +1,124 @@ +From 39b927c5aaef1bd06e8d355b96fcbb392b2a3fed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 13:24:07 -0700 +Subject: net_sched: sch_sfq: use a temporary work area for validating + configuration + +From: Octavian Purdila + +[ Upstream commit 8c0cea59d40cf6dd13c2950437631dd614fbade6 ] + +Many configuration parameters have influence on others (e.g. divisor +-> flows -> limit, depth -> limit) and so it is difficult to correctly +do all of the validation before applying the configuration. And if a +validation error is detected late it is difficult to roll back a +partially applied configuration. + +To avoid these issues use a temporary work area to update and validate +the configuration and only then apply the configuration to the +internal state. + +Signed-off-by: Octavian Purdila +Acked-by: Cong Wang +Signed-off-by: David S. Miller +Stable-dep-of: b3bf8f63e617 ("net_sched: sch_sfq: move the limit validation") +Signed-off-by: Sasha Levin +--- + net/sched/sch_sfq.c | 56 +++++++++++++++++++++++++++++++++++---------- + 1 file changed, 44 insertions(+), 12 deletions(-) + +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index 60754f366ab7b..68e909e8fabd9 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -631,6 +631,15 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, + struct red_parms *p = NULL; + struct sk_buff *to_free = NULL; + struct sk_buff *tail = NULL; ++ unsigned int maxflows; ++ unsigned int quantum; ++ unsigned int divisor; ++ int perturb_period; ++ u8 headdrop; ++ u8 maxdepth; ++ int limit; ++ u8 flags; ++ + + if (opt->nla_len < nla_attr_size(sizeof(*ctl))) + return -EINVAL; +@@ -656,36 +665,59 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt, + NL_SET_ERR_MSG_MOD(extack, "invalid limit"); + return -EINVAL; + } ++ + sch_tree_lock(sch); ++ ++ limit = q->limit; ++ divisor = q->divisor; ++ headdrop = q->headdrop; ++ maxdepth = q->maxdepth; ++ maxflows = q->maxflows; ++ perturb_period = q->perturb_period; ++ quantum = q->quantum; ++ flags = q->flags; ++ ++ /* update and validate configuration */ + if (ctl->quantum) +- q->quantum = ctl->quantum; +- WRITE_ONCE(q->perturb_period, ctl->perturb_period * HZ); ++ quantum = ctl->quantum; ++ perturb_period = ctl->perturb_period * HZ; + if (ctl->flows) +- q->maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS); ++ maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS); + if (ctl->divisor) { +- q->divisor = ctl->divisor; +- q->maxflows = min_t(u32, q->maxflows, q->divisor); ++ divisor = ctl->divisor; ++ maxflows = min_t(u32, maxflows, divisor); + } + if (ctl_v1) { + if (ctl_v1->depth) +- q->maxdepth = min_t(u32, ctl_v1->depth, SFQ_MAX_DEPTH); ++ maxdepth = min_t(u32, ctl_v1->depth, SFQ_MAX_DEPTH); + if (p) { +- swap(q->red_parms, p); +- red_set_parms(q->red_parms, ++ red_set_parms(p, + ctl_v1->qth_min, ctl_v1->qth_max, + ctl_v1->Wlog, + ctl_v1->Plog, ctl_v1->Scell_log, + NULL, + ctl_v1->max_P); + } +- q->flags = ctl_v1->flags; +- q->headdrop = ctl_v1->headdrop; ++ flags = ctl_v1->flags; ++ headdrop = ctl_v1->headdrop; + } + if (ctl->limit) { +- q->limit = min_t(u32, ctl->limit, q->maxdepth * q->maxflows); +- q->maxflows = min_t(u32, q->maxflows, q->limit); ++ limit = min_t(u32, ctl->limit, maxdepth * maxflows); ++ maxflows = min_t(u32, maxflows, limit); + } + ++ /* commit configuration */ ++ q->limit = limit; ++ q->divisor = divisor; ++ q->headdrop = headdrop; ++ q->maxdepth = maxdepth; ++ q->maxflows = maxflows; ++ WRITE_ONCE(q->perturb_period, perturb_period); ++ q->quantum = quantum; ++ q->flags = flags; ++ if (p) ++ swap(q->red_parms, p); ++ + qlen = sch->q.qlen; + while (sch->q.qlen > q->limit) { + dropped += sfq_drop(sch, &to_free); +-- +2.39.5 + diff --git a/queue-6.6/nft_set_pipapo-fix-incorrect-avx2-match-of-5th-field.patch b/queue-6.6/nft_set_pipapo-fix-incorrect-avx2-match-of-5th-field.patch new file mode 100644 index 00000000000..a1094a7d4b2 --- /dev/null +++ b/queue-6.6/nft_set_pipapo-fix-incorrect-avx2-match-of-5th-field.patch @@ -0,0 +1,53 @@ +From 1775efe59c6b56b2923176c64e57c68bac8a9f90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 19:40:18 +0200 +Subject: nft_set_pipapo: fix incorrect avx2 match of 5th field octet + +From: Florian Westphal + +[ Upstream commit e042ed950d4e176379ba4c0722146cd96fb38aa2 ] + +Given a set element like: + + icmpv6 . dead:beef:00ff::1 + +The value of 'ff' is irrelevant, any address will be matched +as long as the other octets are the same. + +This is because of too-early register clobbering: +ymm7 is reloaded with new packet data (pkt[9]) but it still holds data +of an earlier load that wasn't processed yet. + +The existing tests in nft_concat_range.sh selftests do exercise this code +path, but do not trigger incorrect matching due to the network prefix +limitation. + +Fixes: 7400b063969b ("nft_set_pipapo: Introduce AVX2-based lookup implementation") +Reported-by: sontu mazumdar +Closes: https://lore.kernel.org/netfilter/CANgxkqwnMH7fXra+VUfODT-8+qFLgskq3set1cAzqqJaV4iEZg@mail.gmail.com/T/#t +Reviewed-by: Stefano Brivio +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo_avx2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c +index b8d3c3213efee..c15db28c5ebc4 100644 +--- a/net/netfilter/nft_set_pipapo_avx2.c ++++ b/net/netfilter/nft_set_pipapo_avx2.c +@@ -994,8 +994,9 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, + NFT_PIPAPO_AVX2_BUCKET_LOAD8(5, lt, 8, pkt[8], bsize); + + NFT_PIPAPO_AVX2_AND(6, 2, 3); ++ NFT_PIPAPO_AVX2_AND(3, 4, 7); + NFT_PIPAPO_AVX2_BUCKET_LOAD8(7, lt, 9, pkt[9], bsize); +- NFT_PIPAPO_AVX2_AND(0, 4, 5); ++ NFT_PIPAPO_AVX2_AND(0, 3, 5); + NFT_PIPAPO_AVX2_BUCKET_LOAD8(1, lt, 10, pkt[10], bsize); + NFT_PIPAPO_AVX2_AND(2, 6, 7); + NFT_PIPAPO_AVX2_BUCKET_LOAD8(3, lt, 11, pkt[11], bsize); +-- +2.39.5 + diff --git a/queue-6.6/nvmet-fcloop-swap-list_add_tail-arguments.patch b/queue-6.6/nvmet-fcloop-swap-list_add_tail-arguments.patch new file mode 100644 index 00000000000..ed1e55d729a --- /dev/null +++ b/queue-6.6/nvmet-fcloop-swap-list_add_tail-arguments.patch @@ -0,0 +1,38 @@ +From 3e20d80e993472989f49a03c1c3cd6b66f53d6a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 17:29:03 +0200 +Subject: nvmet-fcloop: swap list_add_tail arguments + +From: Daniel Wagner + +[ Upstream commit 2b5f0c5bc819af2b0759a8fcddc1b39102735c0f ] + +The newly element to be added to the list is the first argument of +list_add_tail. This fix is missing dcfad4ab4d67 ("nvmet-fcloop: swap +the list_add_tail arguments"). + +Fixes: 437c0b824dbd ("nvme-fcloop: add target to host LS request support") +Signed-off-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index e6d4226827b52..4b35bdcac185f 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -478,7 +478,7 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport, + if (targetport) { + tport = targetport->private; + spin_lock(&tport->lock); +- list_add_tail(&tport->ls_list, &tls_req->ls_list); ++ list_add_tail(&tls_req->ls_list, &tport->ls_list); + spin_unlock(&tport->lock); + queue_work(nvmet_wq, &tport->ls_work); + } +-- +2.39.5 + diff --git a/queue-6.6/objtool-fix-insn_context_switch-handling-in-validate.patch b/queue-6.6/objtool-fix-insn_context_switch-handling-in-validate.patch new file mode 100644 index 00000000000..902e9a2f936 --- /dev/null +++ b/queue-6.6/objtool-fix-insn_context_switch-handling-in-validate.patch @@ -0,0 +1,53 @@ +From d0946b2b84c028df78f573e88b69cdd86c1b06d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 00:02:13 -0700 +Subject: objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() + +From: Josh Poimboeuf + +[ Upstream commit a8df7d0ef92eca28c610206c6748daf537ac0586 ] + +The !CONFIG_IA32_EMULATION version of xen_entry_SYSCALL_compat() ends +with a SYSCALL instruction which is classified by objtool as +INSN_CONTEXT_SWITCH. + +Unlike validate_branch(), validate_unret() doesn't consider +INSN_CONTEXT_SWITCH in a non-function to be a dead end, so it keeps +going past the end of xen_entry_SYSCALL_compat(), resulting in the +following warning: + + vmlinux.o: warning: objtool: xen_reschedule_interrupt+0x2a: RET before UNTRAIN + +Fix that by adding INSN_CONTEXT_SWITCH handling to validate_unret() to +match what validate_branch() is already doing. + +Fixes: a09a6e2399ba ("objtool: Add entry UNRET validation") +Reported-by: Andrew Cooper +Signed-off-by: Josh Poimboeuf +Signed-off-by: Ingo Molnar +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/f5eda46fd09f15b1f5cde3d9ae3b92b958342add.1744095216.git.jpoimboe@kernel.org +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 9102ad5985cc0..8ba5bcfd5cd57 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -3926,6 +3926,11 @@ static int validate_unret(struct objtool_file *file, struct instruction *insn) + WARN_INSN(insn, "RET before UNTRAIN"); + return 1; + ++ case INSN_CONTEXT_SWITCH: ++ if (insn_func(insn)) ++ break; ++ return 0; ++ + case INSN_NOP: + if (insn->retpoline_safe) + return 0; +-- +2.39.5 + diff --git a/queue-6.6/octeontx2-pf-qos-fix-vf-root-node-parent-queue-index.patch b/queue-6.6/octeontx2-pf-qos-fix-vf-root-node-parent-queue-index.patch new file mode 100644 index 00000000000..888bdf0b749 --- /dev/null +++ b/queue-6.6/octeontx2-pf-qos-fix-vf-root-node-parent-queue-index.patch @@ -0,0 +1,57 @@ +From 085b61aa0bb6717cfe25be18dc411b9e71786569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 12:33:41 +0530 +Subject: octeontx2-pf: qos: fix VF root node parent queue index + +From: Hariprasad Kelam + +[ Upstream commit b7db94734e785e380b0db0f9295e07024f4d42a0 ] + +The current code configures the Physical Function (PF) root node at TL1 +and the Virtual Function (VF) root node at TL2. + +This ensure at any given point of time PF traffic gets more priority. + + PF root node + TL1 + / \ + TL2 TL2 VF root node + / \ + TL3 TL3 + / \ + TL4 TL4 + / \ + SMQ SMQ + +Due to a bug in the current code, the TL2 parent queue index on the +VF interface is not being configured, leading to 'SMQ Flush' errors + +Fixes: 5e6808b4c68d ("octeontx2-pf: Add support for HTB offload") +Signed-off-by: Hariprasad Kelam +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250407070341.2765426-1-hkelam@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/qos.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c +index 4995a2d54d7d0..37db19584c143 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c +@@ -165,6 +165,11 @@ static void __otx2_qos_txschq_cfg(struct otx2_nic *pfvf, + + otx2_config_sched_shaping(pfvf, node, cfg, &num_regs); + } else if (level == NIX_TXSCH_LVL_TL2) { ++ /* configure parent txschq */ ++ cfg->reg[num_regs] = NIX_AF_TL2X_PARENT(node->schq); ++ cfg->regval[num_regs] = (u64)hw->tx_link << 16; ++ num_regs++; ++ + /* configure link cfg */ + if (level == pfvf->qos.link_cfg_lvl) { + cfg->reg[num_regs] = NIX_AF_TL3_TL2X_LINKX_CFG(node->schq, hw->tx_link); +-- +2.39.5 + diff --git a/queue-6.6/rtnl-add-helper-to-check-if-a-notification-is-needed.patch b/queue-6.6/rtnl-add-helper-to-check-if-a-notification-is-needed.patch new file mode 100644 index 00000000000..2a58a59626b --- /dev/null +++ b/queue-6.6/rtnl-add-helper-to-check-if-a-notification-is-needed.patch @@ -0,0 +1,51 @@ +From 9fb697bdcd674fbc3a1e785e9e5e43893c1942da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 16:28:42 -0300 +Subject: rtnl: add helper to check if a notification is needed + +From: Victor Nogueira + +[ Upstream commit 8439109b76a3c405808383bf9dd532fc4b9c2dbd ] + +Building on the rtnl_has_listeners helper, add the rtnl_notify_needed +helper to check if we can bail out early in the notification routines. + +Reviewed-by: Jiri Pirko +Reviewed-by: Simon Horman +Signed-off-by: Victor Nogueira +Signed-off-by: Pedro Tammela +Link: https://lore.kernel.org/r/20231208192847.714940-3-pctammela@mojatatu.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 369609fc6272 ("tc: Ensure we have enough buffer space when sending filter netlink notifications") +Signed-off-by: Sasha Levin +--- + include/linux/rtnetlink.h | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h +index a7d757e96c55f..0cbbbded03319 100644 +--- a/include/linux/rtnetlink.h ++++ b/include/linux/rtnetlink.h +@@ -137,4 +137,19 @@ static inline int rtnl_has_listeners(const struct net *net, u32 group) + return netlink_has_listeners(rtnl, group); + } + ++/** ++ * rtnl_notify_needed - check if notification is needed ++ * @net: Pointer to the net namespace ++ * @nlflags: netlink ingress message flags ++ * @group: rtnl group ++ * ++ * Based on the ingress message flags and rtnl group, returns true ++ * if a notification is needed, false otherwise. ++ */ ++static inline bool ++rtnl_notify_needed(const struct net *net, u16 nlflags, u32 group) ++{ ++ return (nlflags & NLM_F_ECHO) || rtnl_has_listeners(net, group); ++} ++ + #endif /* __LINUX_RTNETLINK_H */ +-- +2.39.5 + diff --git a/queue-6.6/rtnl-add-helper-to-check-if-rtnl-group-has-listeners.patch b/queue-6.6/rtnl-add-helper-to-check-if-rtnl-group-has-listeners.patch new file mode 100644 index 00000000000..6b9c7678c8c --- /dev/null +++ b/queue-6.6/rtnl-add-helper-to-check-if-rtnl-group-has-listeners.patch @@ -0,0 +1,53 @@ +From d9a4011b5344d5739e4c16370858d51f056fdf7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 16:28:41 -0300 +Subject: rtnl: add helper to check if rtnl group has listeners + +From: Jamal Hadi Salim + +[ Upstream commit c5e2a973448d958feb7881e4d875eac59fdeff3d ] + +As of today, rtnl code creates a new skb and unconditionally fills and +broadcasts it to the relevant group. For most operations this is okay +and doesn't waste resources in general. + +When operations are done without the rtnl_lock, as in tc-flower, such +skb allocation, message fill and no-op broadcasting can happen in all +cores of the system, which contributes to system pressure and wastes +precious cpu cycles when no one will receive the built message. + +Introduce this helper so rtnetlink operations can simply check if someone +is listening and then proceed if necessary. + +Reviewed-by: Jiri Pirko +Reviewed-by: Simon Horman +Signed-off-by: Jamal Hadi Salim +Signed-off-by: Victor Nogueira +Signed-off-by: Pedro Tammela +Link: https://lore.kernel.org/r/20231208192847.714940-2-pctammela@mojatatu.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 369609fc6272 ("tc: Ensure we have enough buffer space when sending filter netlink notifications") +Signed-off-by: Sasha Levin +--- + include/linux/rtnetlink.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h +index 3d6cf306cd55e..a7d757e96c55f 100644 +--- a/include/linux/rtnetlink.h ++++ b/include/linux/rtnetlink.h +@@ -130,4 +130,11 @@ extern int ndo_dflt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq, + + extern void rtnl_offload_xstats_notify(struct net_device *dev); + ++static inline int rtnl_has_listeners(const struct net *net, u32 group) ++{ ++ struct sock *rtnl = net->rtnl; ++ ++ return netlink_has_listeners(rtnl, group); ++} ++ + #endif /* __LINUX_RTNETLINK_H */ +-- +2.39.5 + diff --git a/queue-6.6/selftests-futex-futex_waitv-wouldblock-test-should-f.patch b/queue-6.6/selftests-futex-futex_waitv-wouldblock-test-should-f.patch new file mode 100644 index 00000000000..4abdfeb3b89 --- /dev/null +++ b/queue-6.6/selftests-futex-futex_waitv-wouldblock-test-should-f.patch @@ -0,0 +1,42 @@ +From e4b5ec1b539ae1e300dbec9f70b46f5086e7cd1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 22:12:20 +0000 +Subject: selftests/futex: futex_waitv wouldblock test should fail +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Edward Liaw + +[ Upstream commit 7d50e00fef2832e98d7e06bbfc85c1d66ee110ca ] + +Testcase should fail if -EWOULDBLOCK is not returned when expected value +differs from actual value from the waiter. + +Link: https://lore.kernel.org/r/20250404221225.1596324-1-edliaw@google.com +Fixes: 9d57f7c79748920636f8293d2f01192d702fe390 ("selftests: futex: Test sys_futex_waitv() wouldblock") +Signed-off-by: Edward Liaw +Reviewed-by: Thomas Gleixner +Reviewed-by: André Almeida +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../testing/selftests/futex/functional/futex_wait_wouldblock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c b/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c +index 7d7a6a06cdb75..2d8230da90642 100644 +--- a/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c ++++ b/tools/testing/selftests/futex/functional/futex_wait_wouldblock.c +@@ -98,7 +98,7 @@ int main(int argc, char *argv[]) + info("Calling futex_waitv on f1: %u @ %p with val=%u\n", f1, &f1, f1+1); + res = futex_waitv(&waitv, 1, 0, &to, CLOCK_MONOTONIC); + if (!res || errno != EWOULDBLOCK) { +- ksft_test_result_pass("futex_waitv returned: %d %s\n", ++ ksft_test_result_fail("futex_waitv returned: %d %s\n", + res ? errno : res, + res ? strerror(errno) : ""); + ret = RET_FAIL; +-- +2.39.5 + diff --git a/queue-6.6/series b/queue-6.6/series index e69de29bb2d..e60c6df9434 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -0,0 +1,36 @@ +selftests-futex-futex_waitv-wouldblock-test-should-f.patch +drm-i915-mocs-use-to_gt-instead-of-direct-i915-gt.patch +drm-i915-xelpg-extend-driver-code-of-xe_lpg-to-xe_lp.patch +drm-i915-dg2-wait-for-huc-load-completion-before-run.patch +drm-i915-disable-rpg-during-live-selftest.patch +ata-pata_pxa-fix-potential-null-pointer-dereference-.patch +objtool-fix-insn_context_switch-handling-in-validate.patch +tipc-fix-memory-leak-in-tipc_link_xmit.patch +codel-remove-sch-q.qlen-check-before-qdisc_tree_redu.patch +net-tls-explicitly-disallow-disconnect.patch +octeontx2-pf-qos-fix-vf-root-node-parent-queue-index.patch +rtnl-add-helper-to-check-if-rtnl-group-has-listeners.patch +rtnl-add-helper-to-check-if-a-notification-is-needed.patch +net-sched-cls_api-conditional-notification-of-events.patch +tc-ensure-we-have-enough-buffer-space-when-sending-f.patch +net-ethtool-don-t-call-.cleanup_data-when-prepare_da.patch +drm-tests-modeset-fix-drm_display_mode-memory-leak.patch +drm-tests-helpers-add-atomic-helpers.patch +drm-tests-add-helper-to-create-mock-plane.patch +drm-tests-add-helper-to-create-mock-crtc.patch +drm-tests-helpers-add-helper-for-drm_display_mode_fr.patch +drm-tests-helpers-fix-compiler-warning.patch +drm-tests-helpers-create-kunit-helper-to-destroy-a-d.patch +drm-tests-cmdline-fix-drm_display_mode-memory-leak.patch +drm-tests-modes-fix-drm_display_mode-memory-leak.patch +drm-tests-probe-helper-fix-drm_display_mode-memory-l.patch +net-libwx-handle-page_pool_dev_alloc_pages-error.patch +ata-sata_sx4-add-error-handling-in-pdc20621_i2c_read.patch +drm-i915-huc-fix-fence-not-released-on-early-probe-e.patch +nvmet-fcloop-swap-list_add_tail-arguments.patch +net_sched-sch_sfq-use-a-temporary-work-area-for-vali.patch +net_sched-sch_sfq-move-the-limit-validation.patch +ipv6-align-behavior-across-nexthops-during-path-sele.patch +net-ppp-add-bound-checking-for-skb-data-on-ppp_sync_.patch +nft_set_pipapo-fix-incorrect-avx2-match-of-5th-field.patch +iommu-mediatek-fix-null-pointer-deference-in-mtk_iom.patch diff --git a/queue-6.6/tc-ensure-we-have-enough-buffer-space-when-sending-f.patch b/queue-6.6/tc-ensure-we-have-enough-buffer-space-when-sending-f.patch new file mode 100644 index 00000000000..06823b496f4 --- /dev/null +++ b/queue-6.6/tc-ensure-we-have-enough-buffer-space-when-sending-f.patch @@ -0,0 +1,162 @@ +From ef5d2bbde2bccf9316e00199938166d3ecde8c9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 12:55:34 +0200 +Subject: tc: Ensure we have enough buffer space when sending filter netlink + notifications +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 369609fc6272c2f6ad666ba4fd913f3baf32908f ] + +The tfilter_notify() and tfilter_del_notify() functions assume that +NLMSG_GOODSIZE is always enough to dump the filter chain. This is not +always the case, which can lead to silent notify failures (because the +return code of tfilter_notify() is not always checked). In particular, +this can lead to NLM_F_ECHO not being honoured even though an action +succeeds, which forces userspace to create workarounds[0]. + +Fix this by increasing the message size if dumping the filter chain into +the allocated skb fails. Use the size of the incoming skb as a size hint +if set, so we can start at a larger value when appropriate. + +To trigger this, run the following commands: + + # ip link add type veth + # tc qdisc replace dev veth0 root handle 1: fq_codel + # tc -echo filter add dev veth0 parent 1: u32 match u32 0 0 $(for i in $(seq 32); do echo action pedit munge ip dport set 22; done) + +Before this fix, tc just returns: + +Not a filter(cmd 2) + +After the fix, we get the correct echo: + +added filter dev veth0 parent 1: protocol all pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid not_in_hw + match 00000000/00000000 at 0 + action order 1: pedit action pass keys 1 + index 1 ref 1 bind 1 + key #0 at 20: val 00000016 mask ffff0000 +[repeated 32 times] + +[0] https://github.com/openvswitch/ovs/commit/106ef21860c935e5e0017a88bf42b94025c4e511 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Frode Nordahl +Closes: https://bugs.launchpad.net/ubuntu/+source/openvswitch/+bug/2018500 +Signed-off-by: Toke Høiland-Jørgensen +Reviewed-by: Jiri Pirko +Link: https://patch.msgid.link/20250407105542.16601-1-toke@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/cls_api.c | 66 ++++++++++++++++++++++++++++++--------------- + 1 file changed, 45 insertions(+), 21 deletions(-) + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index a0eb389b4fb4b..7245f39d1e652 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -1977,6 +1977,7 @@ static int tcf_fill_node(struct net *net, struct sk_buff *skb, + struct tcmsg *tcm; + struct nlmsghdr *nlh; + unsigned char *b = skb_tail_pointer(skb); ++ int ret = -EMSGSIZE; + + nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags); + if (!nlh) +@@ -2021,11 +2022,45 @@ static int tcf_fill_node(struct net *net, struct sk_buff *skb, + + return skb->len; + ++cls_op_not_supp: ++ ret = -EOPNOTSUPP; + out_nlmsg_trim: + nla_put_failure: +-cls_op_not_supp: + nlmsg_trim(skb, b); +- return -1; ++ return ret; ++} ++ ++static struct sk_buff *tfilter_notify_prep(struct net *net, ++ struct sk_buff *oskb, ++ struct nlmsghdr *n, ++ struct tcf_proto *tp, ++ struct tcf_block *block, ++ struct Qdisc *q, u32 parent, ++ void *fh, int event, ++ u32 portid, bool rtnl_held, ++ struct netlink_ext_ack *extack) ++{ ++ unsigned int size = oskb ? max(NLMSG_GOODSIZE, oskb->len) : NLMSG_GOODSIZE; ++ struct sk_buff *skb; ++ int ret; ++ ++retry: ++ skb = alloc_skb(size, GFP_KERNEL); ++ if (!skb) ++ return ERR_PTR(-ENOBUFS); ++ ++ ret = tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, ++ n->nlmsg_seq, n->nlmsg_flags, event, false, ++ rtnl_held, extack); ++ if (ret <= 0) { ++ kfree_skb(skb); ++ if (ret == -EMSGSIZE) { ++ size += NLMSG_GOODSIZE; ++ goto retry; ++ } ++ return ERR_PTR(-EINVAL); ++ } ++ return skb; + } + + static int tfilter_notify(struct net *net, struct sk_buff *oskb, +@@ -2041,16 +2076,10 @@ static int tfilter_notify(struct net *net, struct sk_buff *oskb, + if (!unicast && !rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC)) + return 0; + +- skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); +- if (!skb) +- return -ENOBUFS; +- +- if (tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, +- n->nlmsg_seq, n->nlmsg_flags, event, +- false, rtnl_held, extack) <= 0) { +- kfree_skb(skb); +- return -EINVAL; +- } ++ skb = tfilter_notify_prep(net, oskb, n, tp, block, q, parent, fh, event, ++ portid, rtnl_held, extack); ++ if (IS_ERR(skb)) ++ return PTR_ERR(skb); + + if (unicast) + err = rtnl_unicast(skb, net, portid); +@@ -2073,16 +2102,11 @@ static int tfilter_del_notify(struct net *net, struct sk_buff *oskb, + if (!rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC)) + return tp->ops->delete(tp, fh, last, rtnl_held, extack); + +- skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); +- if (!skb) +- return -ENOBUFS; +- +- if (tcf_fill_node(net, skb, tp, block, q, parent, fh, portid, +- n->nlmsg_seq, n->nlmsg_flags, RTM_DELTFILTER, +- false, rtnl_held, extack) <= 0) { ++ skb = tfilter_notify_prep(net, oskb, n, tp, block, q, parent, fh, ++ RTM_DELTFILTER, portid, rtnl_held, extack); ++ if (IS_ERR(skb)) { + NL_SET_ERR_MSG(extack, "Failed to build del event notification"); +- kfree_skb(skb); +- return -EINVAL; ++ return PTR_ERR(skb); + } + + err = tp->ops->delete(tp, fh, last, rtnl_held, extack); +-- +2.39.5 + diff --git a/queue-6.6/tipc-fix-memory-leak-in-tipc_link_xmit.patch b/queue-6.6/tipc-fix-memory-leak-in-tipc_link_xmit.patch new file mode 100644 index 00000000000..8fb90edc965 --- /dev/null +++ b/queue-6.6/tipc-fix-memory-leak-in-tipc_link_xmit.patch @@ -0,0 +1,40 @@ +From 6ae3566a2d0ec222e7ffdbdee805a63b38170441 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Apr 2025 09:24:31 +0000 +Subject: tipc: fix memory leak in tipc_link_xmit + +From: Tung Nguyen + +[ Upstream commit 69ae94725f4fc9e75219d2d69022029c5b24bc9a ] + +In case the backlog transmit queue for system-importance messages is overloaded, +tipc_link_xmit() returns -ENOBUFS but the skb list is not purged. This leads to +memory leak and failure when a skb is allocated. + +This commit fixes this issue by purging the skb list before tipc_link_xmit() +returns. + +Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion") +Signed-off-by: Tung Nguyen +Link: https://patch.msgid.link/20250403092431.514063-1-tung.quang.nguyen@est.tech +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/tipc/link.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/tipc/link.c b/net/tipc/link.c +index d0143823658d5..6c6d8546c5786 100644 +--- a/net/tipc/link.c ++++ b/net/tipc/link.c +@@ -1068,6 +1068,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, + if (unlikely(l->backlog[imp].len >= l->backlog[imp].limit)) { + if (imp == TIPC_SYSTEM_IMPORTANCE) { + pr_warn("%s<%s>, link overflow", link_rst_msg, l->name); ++ __skb_queue_purge(list); + return -ENOBUFS; + } + rc = link_schedule_user(l, hdr); +-- +2.39.5 +