In case of an error during init, in_hw_restart will be set, but it will
never get cleared.
Instead, we will retry to init again, and then we will act like we are in a
restart when we are actually not.
This causes (among others) to a NULL pointer dereference when canceling
rx_omi::finished_work, that was not even initialized, because we thought
that we are in hw_restart.
Set in_hw_restart to true only if the fw is running, then we know that
FW was loaded successfully and we are not going to the retry loop.
Fixes: 7391b2a4f7 ("wifi: iwlwifi: rework firmware error handling")
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250604061200.e0040e0a4b09.Iae469a0abe6bfa3c26d8a88c066bad75c2e8f121@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Pull slab updates from Vlastimil Babka:
- Make kvmalloc() more suitable for callers that need it to succeed,
but without unnecessary overhead by reclaim and compaction to get a
physically contiguous allocation.
Instead fall back to vmalloc() more easily by default, unless
instructed by __GFP_RETRY_MAYFAIL to prefer kmalloc() harder. This
should allow the removal of a xfs-specific workaround (Michal Hocko)
- Remove potentially excessive warnings due to memory pressure when
allocating structures for per-object allocation profiling metadata
(Usama Arif)
* tag 'slab-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
mm: slub: only warn once when allocating slab obj extensions fails
mm: kvmalloc: make kmalloc fast path real fast path
Pull LICENSES update from Greg KH:
"Here is a single patch to the LICENSES/ directory to add the CC0
license that is currently used in the kcpuid x86 tool for one of their
files.
This fixes the error that spdxcheck.py currently has with the kcpuid
file due to a missing LICENSE file for this specific license"
* tag 'spdx-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx:
LICENSES: add CC0-1.0 license text
- Create debugfs directory for 'aspm_state_cnt' only when CONFIG_PCIEASPM
is enabled, since there are no other entries (Hans Zhang)
* pci/controller/tegra194:
PCI: tegra194: Create debugfs directory only when CONFIG_PCIEASPM is enabled
- Reorder rockchip_pci_core_rsts because reset_control_bulk_deassert()
deasserts in reverse order, to fix a link training regression (Jensen
Huang)
- Mark RK3399 as being capable of raising INTx interrupts (Niklas Cassel)
* pci/controller/rockchip:
PCI: rockchip-ep: Mark RK3399 as intx_capable
PCI: rockchip: Fix order of rockchip_pci_core_rsts
- Describe endpoint BAR 4 as being fixed size (Jerome Brunet)
- Document how to obtain R-Car V4H (r8a779g0) controller firmware
(Yoshihiro Shimoda)
* pci/controller/rcar-gen4:
PCI: rcar-gen4: Document how to obtain platform firmware
PCI: rcar-gen4: set ep BAR4 fixed size
- Add OF support for parsing DT 'eq-presets-<N>gts' property for lane
equalization presets (Krishna Chaitanya Chundru)
- Read Maximum Link Width from the Link Capabilities register if DT lacks
'num-lanes' property (Krishna Chaitanya Chundru)
- Add Physical Layer 64 GT/s Capability ID and register offsets for 8, 32,
and 64 GT/s lane equalization registers (Krishna Chaitanya Chundru)
- Add generic dwc support for configuring lane equalization presets
(Krishna Chaitanya Chundru)
- Add DT and driver support for PCIe on IPQ5018 SoC (Nitheesh Sekar)
* pci/controller/qcom:
PCI: qcom: Add support for IPQ5018
dt-bindings: PCI: qcom: Add IPQ5018 SoC
PCI: dwc: Add support for configuring lane equalization presets
PCI: Add lane equalization register offsets
PCI: dwc: Update pci->num_lanes to maximum supported link width
PCI: of: Add of_pci_get_equalization_presets() API
- Use for_each_of_range() iterator for parsing 'ranges' (Rob Herring)
* pci/controller/mvebu:
PCI: mvebu: Use for_each_of_range() iterator for parsing "ranges"
- Apply link training workaround only on IMX6Q, IMX6SX, IMX6SP (Richard
Zhu)
- Remove redundant dw_pcie_wait_for_link() from imx_pcie_start_link();
since the DWC core does this, imx6 only needs it when retraining for a
faster link speed (Richard Zhu)
- Toggle i.MX95 core reset to align with PHY powerup (Richard Zhu)
- Set SYS_AUX_PWR_DET to work around i.MX95 ERR051624 erratum: in some
cases, the controller can't exit 'L23 Ready' through Beacon or PERST#
deassertion (Richard Zhu)
- Clear GEN3_ZRXDC_NONCOMPL to work around i.MX95 ERR051586 erratum:
controller can't meet 2.5 GT/s ZRX-DC timing when operating at 8 GT/s,
causing timeouts in L1 (Richard Zhu)
- Wait for i.MX95 PLL lock before enabling controller (Richard Zhu)
- Save/restore i.MX95 LUT for suspend/resume (Richard Zhu)
* pci/controller/imx6:
PCI: imx6: Save and restore the LUT setting during suspend/resume for i.MX95 SoC
PCI: imx6: Add PLL lock check for i.MX95 SoC
PCI: imx6: Add workaround for errata ERR051586
PCI: imx6: Add workaround for errata ERR051624
PCI: imx6: Toggle the core reset for i.MX95 PCIe
PCI: imx6: Call dw_pcie_wait_for_link() from start_link() callback only when required
PCI: imx6: Skip link up workaround for newer platforms
- Set PORT_LOGIC_LINK_WIDTH to one lane to make initial link training more
robust; this will not affect the intended link width if all lanes are
functional (Wenbin Yao)
* pci/controller/dwc:
PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane
- Check only PCIE_LINKUP, not LTSSM status, to determine whether the link
is up (Shawn Lin)
- Increase N_FTS (used in L0s->L0 transitions) and enable ASPM L0s for Root
Complex and Endpoint modes (Shawn Lin)
- Hide the broken ATS Capability in rockchip_pcie_ep_init() instead of
rockchip_pcie_ep_pre_init() so it stays hidden after PERST# resets
non-sticky registers (Shawn Lin)
- Remove unused PCIE_CLIENT_GENERAL_DEBUG definition (Hans Zhang)
- Organize register and bitfield definitions logically (Hans Zhang)
- Use rockchip_pcie_link_up() to check link up instead of open coding, and
use GENMASK() and FIELD_GET() when possible (Hans Zhang)
- Call phy_power_off() before phy_exit() in rockchip_pcie_phy_deinit()
(Diederik de Haas)
- Return bool (not int) for link-up check in dw_pcie_ops.link_up() and
armada8k, dra7xx, dw-rockchip, exynos, histb, keembay, keystone, kirin,
meson, qcom, qcom-ep, rcar_gen4, spear13xx, tegra194, uniphier, visconti
(Hans Zhang)
- Return bool (not int) for link-up check in mobiveil_pab_ops.link_up() and
layerscape-gen4, mobiveil (Hans Zhang)
- Simplify j721e link-up check (Hans Zhang)
- Convert pci-host-common to a library so platforms that don't need native
host controller drivers don't need to include these helper functions
(Manivannan Sadhasivam)
* pci/controller/dw-rockchip:
PCI: qcom: Replace PERST# sleep time with proper macro
PCI: dw-rockchip: Replace PERST# sleep time with proper macro
PCI: host-common: Convert to library for host controller drivers
PCI: cadence: Simplify J721e link status check
PCI: mobiveil: Return bool from link up check
PCI: dwc: Return bool from link up check
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
PCI: dw-rockchip: Use rockchip_pcie_link_up() to check link up instead of open coding
PCI: dw-rockchip: Reorganize register and bitfield definitions
PCI: dw-rockchip: Remove unused PCIE_CLIENT_GENERAL_DEBUG definition
PCI: dw-rockchip: Move rockchip_pcie_ep_hide_broken_ats_cap_rk3588() to dw_pcie_ep_ops::init()
PCI: dw-rockchip: Enable ASPM L0s capability for both RC and EP modes
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
# Conflicts:
# drivers/pci/controller/pcie-apple.c
# include/linux/pci-ecam.h
- Drop a runtime PM 'put' to resolve a runtime atomic count underflow (Hans
Zhang)
- Use shared PCIE_MSG_CODE_* definitions and remove duplicate
cdns_pcie_msg_code definitions (Hans Zhang)
- Make the cadence core buildable as a module (Kishon Vijay Abraham I)
- Add cdns_pcie_host_disable() and cdns_pcie_ep_disable() for use by
loadable drivers when they are removed (Siddharth Vadapalli)
- Make j721e buildable as a loadable and removable module (Siddharth
Vadapalli)
- Fix j721e host/endpoint dependencies that result in link failures in
some configs (Arnd Bergmann)
* pci/controller/cadence:
PCI: j721e: Fix host/endpoint dependencies
PCI: j721e: Add support to build as a loadable module
PCI: cadence-ep: Introduce cdns_pcie_ep_disable() helper for cleanup
PCI: cadence-host: Introduce cdns_pcie_host_disable() helper for cleanup
PCI: cadence: Add support to build pcie-cadence library as a kernel module
PCI: cadence: Remove duplicate message code definitions
PCI: cadence: Fix runtime atomic count underflow
- Skip ports disabled in DT when setting up ports (Janne Grunau)
- Add t6020 compatible string (Alyssa Rosenzweig)
- Extract ECAM bridge creation helper from pci_host_common_probe() to
separate driver-specific things like MSI from PCI things (Marc Zyngier)
- Dynamically allocate RID-to_SID bitmap to prepare for SoCs with varying
capabilities (Marc Zyngier)
- Directly set/clear INTx mask bits because T602x dropped the accessors
that could do this without locking (Marc Zyngier)
- Move port PHY registers to their own reg items to accommodate T602x,
which moves them around; retain default offsets for existing DTs that
lack phy%d entries with the reg offsets (Hector Martin)
- Stop polling for core refclk, which doesn't work on T602x and the
bootloader has already done anyway (Hector Martin)
- Use gpiod_set_value_cansleep() when asserting PERST# in probe because
we're allowed to sleep there (Hector Martin)
- Move register offsets into SoC-specific structure (Hector Martin)
- Add T602x PCIe support (Hector Martin)
* pci/controller/apple:
PCI: apple: Add T602x PCIe support
PCI: apple: Abstract register offsets via a SoC-specific structure
PCI: apple: Use gpiod_set_value_cansleep in probe flow
PCI: apple: Drop poll for CORE_RC_PHYIF_STAT_REFCLK
PCI: apple: Move port PHY registers to their own reg items
PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
PCI: apple: Move away from INTMSK{SET,CLR} for INTx and private interrupts
PCI: apple: Dynamically allocate RID-to_SID bitmap
PCI: apple: Move over to standalone probing
PCI: ecam: Allow cfg->priv to be pre-populated from the root port device
PCI: host-generic: Extract an ECAM bridge creation helper from pci_host_common_probe()
dt-bindings: pci: apple,pcie: Add t6020 compatible string
PCI: apple: Set only available ports up
- For fixed-size BARs, retain both the actual size and the possibly larger
size allocated to accommodate iATU alignment requirements (Jerome Brunet)
- Simplify ctrl/SPAD space allocation and avoid allocating more space than
needed (Jerome Brunet)
- Correct MSI-X PBA offset calculations for DesignWare and Cadence endpoint
controllers (Niklas Cassel)
- Align the return value (number of interrupts) encoding for
pci_epc_get_msi()/pci_epc_ops::get_msi() and
pci_epc_get_msix()/pci_epc_ops::get_msix() (Niklas Cassel)
- Align the nr_irqs parameter encoding for
pci_epc_set_msi()/pci_epc_ops::set_msi() and
pci_epc_set_msix()/pci_epc_ops::set_msix() (Niklas Cassel)
* pci/endpoint:
PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs encoding
PCI: endpoint: Align pci_epc_set_msi(), pci_epc_ops::set_msi() nr_irqs encoding
PCI: endpoint: Align pci_epc_get_msix(), pci_epc_ops::get_msix() return value encoding
PCI: endpoint: Align pci_epc_get_msi(), pci_epc_ops::get_msi() return value encoding
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: endpoint: pci-epf-vntb: Simplify ctrl/SPAD space allocation
PCI: endpoint: Retain fixed-size BAR size as well as aligned size
- Add an ACS quirk for Loongson Root Ports that don't advertise ACS but
don't allow peer-to-peer transactions between Root Ports; the quirk
allows each Root Port to be in a separate IOMMU group (Huacai Chen)
* pci/virtualization:
PCI: Add ACS quirk for Loongson PCIe
- Rename pwrctrl Kconfig symbols from 'PWRCTL' to 'PWRCTRL' to match the
filename paths. Retain old deprecated symbols for compatibility, except
for the pwrctrl slot driver (PCI_PWRCTRL_SLOT) (Johan Hovold)
- When unregistering pwrctrl, cancel outstanding rescan work before
cleaning up data structures to avoid use-after-free issues (Brian Norris)
* pci/pwrctrl:
arm64: Kconfig: switch to HAVE_PWRCTRL
wifi: ath12k: switch to PCI_PWRCTRL_PWRSEQ
wifi: ath11k: switch to PCI_PWRCTRL_PWRSEQ
PCI/pwrctrl: Rename pwrctrl Kconfig symbols and slot module
PCI/pwrctrl: Cancel outstanding rescan work when unregistering
- Add pm_runtime_put() cleanup helper for use with __free() to
automatically drop the device usage count when a pointer goes out of
scope (Alex Williamson)
- Increment PM usage counter when probing reset methods so we don't try to
read config space of a powered-off device (Alex Williamson)
- Set all devices to D0 during enumeration to ensure ACPI opregion is
connected via _REG (Mario Limonciello)
* pci/pm:
PCI: Explicitly put devices into D0 when initializing
PCI: Increment PM usage counter when probing reset methods
PM: runtime: Define pm_runtime_put cleanup helper
- Fix pci_acpi_scan_root() memory leak when we fail to create a PCI bus
(Zhe Qiao)
* pci/pci-acpi:
PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()
- Ignore Presence Detect Changed caused by DPC. pciehp already ignores
Link Down/Up events caused by DPC, but on slots using in-band presence
detect, DPC causes a spurious Presence Detect Changed event (Lukas
Wunner)
- Ignore Link Down/Up caused by Secondary Bus Reset. On hotplug ports
using in-band presence detect, the reset causes a Presence Detect Changed
event, which mistakenly caused teardown and re-enumeration of the device.
Drivers may need to annotate code that resets their device (Lukas Wunner)
* pci/hotplug:
PCI: hotplug: Drop superfluous #include directives
PCI: pciehp: Ignore Link Down/Up caused by Secondary Bus Reset
PCI: pciehp: Ignore Presence Detect Changed caused by DPC
# Conflicts:
# drivers/pci/pci.h
- Remove pci_fixup_cardbus(), which has no users left (Heiner Kallweit)
- Print the actual delay time in pci_bridge_wait_for_secondary_bus()
instead of assuming it was 1000ms (Wilfred Mallawa)
- Revert 'iommu/amd: Prevent binding other PCI drivers to IOMMU PCI
devices', which broke resume from system sleep on AMD platforms and has
been fixed by other commits (Lukas Wunner)
- Restrict visibility of pci_dev.match_driver since it's no longer used
outside the PCI core (Lukas Wunner)
* pci/enumeration:
PCI: Limit visibility of match_driver flag to PCI core
Revert "iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devices"
PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
PCI: Use PCI_STD_NUM_BARS instead of 6
PCI: Remove pci_fixup_cardbus()
# Conflicts:
# drivers/pci/pci.h
- Remove mtip32xx use of pcim_iounmap_regions(), which is deprecated and
unnecessary (Philipp Stanner)
- Remove pcim_iounmap_regions() and pcim_request_region_exclusive() and
related flags since all uses have been removed (Philipp Stanner)
- Rework devres 'request' functions so they are no longer 'hybrid', i.e.,
their behavior no longer depends on whether pcim_enable_device or
pci_enable_device() was used, and remove related code (Philipp Stanner)
* pci/devres:
PCI: Remove function pcim_intx() prototype from pci.h
PCI: Remove hybrid-devres usage warnings from kernel-doc
PCI: Remove redundant set of request functions
PCI: Remove exclusive requests flags from _pcim_request_region()
PCI: Remove pcim_request_region_exclusive()
Documentation/driver-api: Update pcim_enable_device()
PCI: Remove hybrid devres nature from request functions
PCI: Remove pcim_iounmap_regions()
mtip32xx: Remove unnecessary pcim_iounmap_regions() calls
- Simplify link bandwidth controller by replacing the count of Link
Bandwidth Management Status (LBMS) events with a PCI_LINK_LBMS_SEEN flag
(Ilpo Järvinen)
- Update the Link Speed after retraining, since the Link Speed may have
changed (Ilpo Järvinen)
* pci/bwctrl:
PCI: Update Link Speed after retraining
PCI/bwctrl: Replace lbms_count with PCI_LINK_LBMS_SEEN flag
- Initialize struct aer_err_info before using it to avoid depending on
stack garbage (Bjorn Helgaas)
- Log the DPC Error Source ID only when it's actually valid (when ERR_FATAL
or ERR_NONFATAL was received from a downstream device) and decode into
bus/device/function (Bjorn Helgaas)
- Consolidate AER Error Source ID in one place for message consistency
(Bjorn Helgaas)
- Update statistics and emit trace events early in AER logging paths,
before any potential ratelimiting (Bjorn Helgaas)
- Determine AER log level once and save it so all related messages use the
same level (Karolina Stolarek)
- Use KERN_WARNING, not KERN_ERR, when logging PCIe Correctable Errors.
- Ratelimit PCIe Correctable and Non-Fatal error logging, with sysfs
controls on interval and burst count, to avoid flooding logs and RCU
stall warnings (Jon Pan-Doh)
* pci/aer:
PCI/ERR: Remove misleading TODO regarding kernel panic
PCI/AER: Add sysfs attributes for log ratelimits
PCI/AER: Add ratelimits to PCI AER Documentation
PCI/AER: Ratelimit correctable and non-fatal error logging
PCI/AER: Simplify add_error_device()
PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index
PCI/AER: Rename struct aer_stats to aer_info
PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING
PCI/ERR: Add printk level to pcie_print_tlp_log()
PCI/AER: Check log level once and remember it
PCI/AER: Trace error event before ratelimiting
PCI/AER: Update statistics before ratelimiting
PCI/AER: Simplify pci_print_aer()
PCI/AER: Initialize aer_err_info before using it
PCI/AER: Move aer_print_source() earlier in file
PCI/AER: Rename aer_print_port_info() to aer_print_source()
PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc
PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type()
PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error()
PCI/DPC: Log Error Source ID only when valid
PCI/DPC: Initialize aer_err_info before using it
When CONFIG_SHMEM is not set, the following compiler error occurs:
ld: vmlinux.o: in function `ttm_backup_backup_page':
(.text+0x10363bc): undefined reference to `shmem_writeout'
make[3]: *** [/work/build/trace/nobackup/linux.git/scripts/Makefile.vmlinux:91: vmlinux.unstripped] Error 1
This is due to the replacement of writepage and calling swap_writeout()
and shmem_writeout() directly. The issue is that when CONFIG_SHMEM is
not defined, shmem_writeout() is also not defined.
The function ttm_backup_backup_page() called mapping->a_ops->writepage()
which was then changed to call shmem_writeout() directly.
Even before commit 84798514db ("mm: Remove swap_writepage() and
shmem_writepage()"), it didn't make sense to call anything other than
shmem_writeout() as the ttm_backup deals only with shmem folios.
Have DRM_TTM config option select SHMEM to guarantee that
shmem_writeout() is available.
Link: https://lore.kernel.org/all/20250602170500.48713a2b@gandalf.local.home/
Suggested-by: Hugh Dickins <hughd@google.com>
Fixes: 84798514db ("mm: Remove swap_writepage() and shmem_writepage()")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo()
did not check for this case before dereferencing the returned pointer.
Add a missing NULL check to prevent a potential NULL pointer
dereference when allocation fails.
This improves robustness in low-memory scenarios.
Fixes: a57e5de476 ("gve: DQO: Add TX path")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
There was a typo that caused the extended FP state to be copied into the
wrong location on 32 bit. On 32 bit we only store the xstate internally
as that already contains everything. However, for compatibility, the
mcontext on 32 bit first contains the legacy FP state and then the
xstate.
The code copied the xstate on top of the legacy FP state instead of
using the correct offset. This offset was already calculated in the
xstate_* variables, so simply switch to those to fix the problem.
With this SECCOMP mode works on 32 bit, so lift the restriction.
Fixes: b1e1bd2e69 ("um: Add helper functions to get/set state for SECCOMP")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20250604081705.934112-1-benjamin@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Zenghui reports that since 1396e89e09 ("genirq/msi: Move prepare() call
to per-device allocation"), his Multi-MSI capable device isn't working
anymore.
This is a consequence of 15c72f824b ("PCI/MSI: Add support for per device
MSI[X] domains"), which always creates a MSI domain of size 1, even in the
presence of Multi-MSI.
While this was somehow working until then, moving the .prepare() call ends
up sizing the ITS table with a tiny value for this device, and making the
endpoint driver unhappy.
Instead, always create the domain and call the .prepare() helper with the
maximum expected size.
Fixes: 1396e89e09 ("genirq/msi: Move prepare() call to per-device allocation")
Fixes: 15c72f824b ("PCI/MSI: Add support for per device MSI[X] domains")
Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Zenghui Yu <yuzenghui@huawei.com>
Reviewed-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Link: https://lore.kernel.org/all/20250603141801.915305-1-maz@kernel.org
Closes: https://lore.kernel.org/r/0b1d7aec-1eac-a9cd-502a-339e216e08a1@huawei.com
Fix various spelling errors in comments.
Signed-off-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
When the socket is busy processing nvme_tcp_try_recv() might return
-EAGAIN, but this doesn't automatically imply that the sending side is
blocked, too. So check if there are pending requests once
nvme_tcp_try_recv() returns -EAGAIN and continue with the sending loop
to avoid I/O stalls.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
Acked-by: Chris Leech <cleech@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of
any list, otherwise a malicious R2T PDU might inject a loop in request
list processing.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Commit 104d0e2f62 ("nvme-fabrics: reset admin connection for secure
concatenation") modified nvme_tcp_setup_ctrl() to call
nvme_tcp_configure_admin_queue() twice. The first call prepares for
DH-CHAP negotitation, and the second call is required for secure
concatenation. However, this change triggered BUG KASAN slab-use-after-
free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by
repeating the blktests test case nvme/063 a few times [1].
When the BUG happens, nvme_tcp_create_ctrl() fails in the call chain
below:
nvme_tcp_create_ctrl()
nvme_tcp_alloc_ctrl() new=true ... Alloc nvme_tcp_ctrl and admin_tag_set
nvme_tcp_setup_ctrl() new=true
nvme_tcp_configure_admin_queue() new=true ... Succeed
nvme_alloc_admin_tag_set() ... Alloc the tag set for admin_tag_set
nvme_stop_keep_alive()
nvme_tcp_teardown_admin_queue() remove=false
nvme_tcp_configure_admin_queue() new=false
nvme_tcp_alloc_admin_queue() ... Fail, but do not call nvme_remove_admin_tag_set()
nvme_uninit_ctrl()
nvme_put_ctrl() ... Free up the nvme_tcp_ctrl and admin_tag_set
The first call of nvme_tcp_configure_admin_queue() succeeds with
new=true argument. The second call fails with new=false argument. This
second call does not call nvme_remove_admin_tag_set() on failure, due to
the new=false argument. Then the admin tag set is not removed. However,
nvme_tcp_create_ctrl() assumes that nvme_tcp_setup_ctrl() would call
nvme_remove_admin_tag_set(). Then it frees up struct nvme_tcp_ctrl which
has admin_tag_set field. Later on, the timeout handler accesses the
admin_tag_set field and causes the BUG KASAN slab-use-after-free.
To not leave the admin tag set, call nvme_remove_admin_tag_set() when
the second nvme_tcp_configure_admin_queue() call fails. Do not return
from nvme_tcp_setup_ctrl() on failure. Instead, jump to "destroy_admin"
go-to label to call nvme_tcp_teardown_admin_queue() which calls
nvme_remove_admin_tag_set().
Fixes: 104d0e2f62 ("nvme-fabrics: reset admin connection for secure concatenation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-nvme/6mhxskdlbo6fk6hotsffvwriauurqky33dfb3s44mqtr5dsxmf@gywwmnyh3twm/ [1]
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
nvme already supports registered buffers for non-vectored io_uring
passthrough commands, enable it for the vectored mode as well. It takes
an iovec, each entry of which should contain a range within the same
registered buffer specificied in sqe->buf_index.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
nvme_map_user_request() takes flags as the last argument, but
nvme_uring_cmd_io() shoves a bool "vec" into it. It behaves as
expected because bool is converted to 0/1 and NVME_IOCTL_VEC is
defined as 1, but it's better to pass flags explicitly.
Fixes: 7b7fdb8e2d ("nvme: replace the "bool vec" arguments with flags in the ioctl path")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
The command specific status code, 0x183, was introduced in the NVMe 2.0
specification defined to "Command Size Limits Exceeded" and only ever
applied to DSM and Copy commands. Fix the name and, remove the
incorrect translation to error codes and special treatment in the
target code for it.
Fixes: 3b7c33b28a ("nvme.h: add Write Zeroes definitions")
Cc: Chaitanya Kulkarni <chaitanyak@nvidia.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Some failure modes are handled poorly by kublk. For example, if ublk_drv
is built as a module but not currently loaded into the kernel, ./kublk
add ... just hangs forever. This happens because in this case (and a few
others), the worker process does not notify its parent (via a write to
the shared eventfd) that it has tried and failed to initialize, so the
parent hangs forever. Fix this by ensuring that we always notify the
parent process of any initialization failure, and have the parent print
a (not very descriptive) log line when this happens.
Signed-off-by: Uday Shankar <ushankar@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250603-ublk_init_fail-v1-1-87c91486230e@purestorage.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
When a server has multichannel enabled, we keep polling the server
for interfaces periodically. However, when this query fails, we
disable the polling. This can be problematic as it takes away the
chance for the server to start advertizing again.
This change reschedules the delayed work, even if the current call
failed. That way, multichannel sessions can recover.
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Today, during smb2_reconnect, session_mutex is released as soon as
the tcon is reconnected and is in a good state. However, in case
multichannel is enabled, there is also a query of server interfaces that
follows. We've seen that this query can race with reconnects of other
channels, causing them to step on each other with reconnects.
This change extends the hold of session_mutex till after the query of
server interfaces is complete. In order to avoid recursive smb2_reconnect
checks during query ioctl, this change also introduces a session flag
for sessions where such a query is in progress.
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Our current approach to select a channel for sending requests is this:
1. iterate all channels to find the min and max queue depth
2. if min and max are not the same, pick the channel with min depth
3. if min and max are same, round robin, as all channels are equally loaded
The problem with this approach is that there's a lag between selecting
a channel and sending the request (that increases the queue depth on the channel).
While these numbers will eventually catch up, there could be a skew in the
channel usage, depending on the application's I/O parallelism and the server's
speed of handling requests.
With sufficient parallelism, this lag can artificially increase the queue depth,
thereby impacting the performance negatively.
This change will change the step 1 above to start the iteration from the last
selected channel. This is to reduce the skew in channel usage even in the presence
of this lag.
Fixes: ea90708d3c ("cifs: use the least loaded channel for sending requests")
Cc: <stable@vger.kernel.org>
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Miri Korenblit
Linus Torvalds
Bjorn Helgaas
Steven Rostedt
Dibin Moolakadan Subrahmanian
Manivannan Sadhasivam
Alok Tiwari
Benjamin Berg
Herbert Xu
Marc Zyngier
Yi Zhang
Hannes Reinecke
Shin'ichiro Kawasaki
Pavel Begunkov
Keith Busch
Uday Shankar
Shyam Prasad N
Stefan Metzmacher