Commit Graph

1158980 Commits

Author SHA1 Message Date
Yongqiang Niu
8943be7d1b BACKPORT: mtk-mmsys: Change mtk-mmsys & mtk-mutex to modules
Change mtk-mmsys & mtk-mutex to modules for gki

Bug: 335112842
(cherry picked from commit a7596e62dac7318456c1aa9af5bfccf0f8e6ad7e
 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master)
Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20221118063018.13520-1-yongqiang.niu@mediatek.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Change-Id: I5a0789d26b188ca576a92df34af5940f539f1ac3
2024-04-17 20:28:21 +00:00
AngeloGioacchino Del Regno
34e8dc4ed0 BACKPORT: clk: mediatek: Split configuration options for MT8186 clock drivers
When building clock drivers for MT8186, some may want to build in only
some of them to, for example, get CPUFreq up faster, and some may want
to leave out some clock drivers entirely as a machine may not need the
Warp Engine or the camera ISP (hence, their clock drivers).

Split the various clock drivers in their own configuration options,
keeping MT8186 configuration options consistent with other MediaTek
SoCs.

While at it, also allow building the remaining clock drivers as modules
by switching COMMON_CLK_MT8186 to tristate.

Bug: 335112842
(cherry picked from commit 5baf38e06a570a2a4ed471a996aff6d6ba69cceb
 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master)
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20230306140543.1813621-47-angelogioacchino.delregno@collabora.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Change-Id: Id9dad0e1d56fcae3bb9302b7db63be31afc91d5d
2024-04-17 20:28:21 +00:00
AngeloGioacchino Del Regno
a5ce14670a BACKPORT: clk: mediatek: Add MODULE_LICENSE() where missing
In order to successfully build clock drivers as modules it is required
to declare a module license: add it where missing.
While at it, also change the MODULE_LICENSE text from "GPL v2" to
"GPL" (which means the same) on clk-mt7981-eth.c.

Bug: 335112842
(cherry picked from commit a451da86cf6d10e94372d20622ec41aac9ec00b5
 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master)
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Miles Chen <miles.chen@mediatek.com>
Tested-by: Chen-Yu Tsai <wenst@chromium.org> # MT8183, MT8192, MT8195 Chromebooks
Link: https://lore.kernel.org/r/20230306140543.1813621-38-angelogioacchino.delregno@collabora.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Change-Id: Id78b0caa4520350049ae6162481c381eb3309897
2024-04-17 20:28:21 +00:00
Ken Huang
4bfe25d0b6 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - devm_drm_bridge_add

Bug: 333511135
Change-Id: I4f815c00515c1f2660032e584778edf1c2c41da4
Signed-off-by: Ken Huang <kenbshuang@google.com>
2024-04-17 20:24:33 +00:00
Bart Van Assche
24edb63b85 Reapply "ANDROID: block: Add support for filesystem requests and small segments"
This reverts commit I764adf995cae6b485d4d98e410c78128a88647e0.

Bug: 333812722
Bug: 308663717
Bug: 319125789
Change-Id: Ie7f03b9d1ab67a33ccbc4311ba26cd746e1aaa22
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
[jyescas@google.com: Call blk_segments() in blk_mq_submit_bio()
                     for the case when request is defined or it
                     is null]
Signed-off-by: Juan Yescas <jyescas@google.com>
2024-04-17 18:38:54 +00:00
Michael Wu
141ebdcb28 UPSTREAM: usb:typec:tcpm:support double Rp to Vbus cable as sink
The USB Type-C Cable and Connector Specification defines the wire
connections for the USB Type-C to USB 2.0 Standard-A cable assembly
(Release 2.2, Chapter 3.5.2).
The Notes says that Pin A5 (CC) of the USB Type-C plug shall be connected
to Vbus through a resister Rp.
However, there is a large amount of such double Rp connected to Vbus
non-standard cables which produced by UGREEN circulating on the market, and
it can affects the normal operations of the state machine easily,
especially to CC1 and CC2 be pulled up at the same time.
In fact, we can regard those cables as sink to avoid abnormal state.

Message as follow:
[   58.900212] VBUS on
[   59.265433] CC1: 0 -> 3, CC2: 0 -> 3 [state TOGGLING, polarity 0, connected]
[   62.623308] CC1: 3 -> 0, CC2: 3 -> 0 [state TOGGLING, polarity 0, disconnected]
[   62.625006] VBUS off
[   62.625012] VBUS VSAFE0V

Bug: 335057705
Change-Id: I415db22b0012ace9535039bc4c8e5ec113482e33
Signed-off-by: Michael Wu <michael@allwinnertech.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20230920063030.66312-1-michael@allwinnertech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>
(cherry picked from commit dbc1defec1aa7d8d80da3ea9e3ddafbcfca8f822)
2024-04-17 15:33:19 +00:00
John Scheible
8672a5ee4d ANDROID: Update the ABI symbol list
Adding the following symbols:
  - devm_pm_runtime_enable

Bug: 335356311
Change-Id: Iecd45183cead8807974bb2a065c48aab86e47e89
Signed-off-by: John Scheible <johnscheible@google.com>
2024-04-16 21:17:14 -07:00
Will McVicker
089d1b8f6d ANDROID: Add known structs used by modules to KMI
This adds `struct dwc3` and `struct kernel_all_info` to the KMI via fake
GKI symbols as we know some partners are using these in their
out-of-tree drivers. This ensures that future changes to these structs
will not break partner builds.

Bug: 332277393
Bug: 236036821
Change-Id: Ifa1ac6b71d58415339a63f16a79c1f713dda789f
Signed-off-by: Will McVicker <willmcvicker@google.com>
2024-04-16 13:49:35 -07:00
Pablo Neira Ayuso
77fec6cefe UPSTREAM: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
commit 0d459e2ffb541841714839e8228b845458ed3b27 upstream.

The commit mutex should not be released during the critical section
between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC
worker could collect expired objects and get the released commit lock
within the same GC sequence.

nf_tables_module_autoload() temporarily releases the mutex to load
module dependencies, then it goes back to replay the transaction again.
Move it at the end of the abort phase after nft_gc_seq_end() is called.

Bug: 332996726
Cc: stable@vger.kernel.org
Fixes: 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path")
Reported-by: Kuan-Ting Chen <hexrabbit@devco.re>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 8038ee3c3e5b59bcd78467686db5270c68544e30)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I637389421d8eca5ab59a41bd1a4b70432440034c
2024-04-15 11:20:28 +00:00
Pablo Neira Ayuso
e27468009d UPSTREAM: netfilter: nf_tables: release batch on table validation from abort path
commit a45e6889575c2067d3c0212b6bc1022891e65b91 upstream.

Unlike early commit path stage which triggers a call to abort, an
explicit release of the batch is required on abort, otherwise mutex is
released and commit_list remains in place.

Add WARN_ON_ONCE to ensure commit_list is empty from the abort path
before releasing the mutex.

After this patch, commit_list is always assumed to be empty before
grabbing the mutex, therefore

  03c1f1ef15 ("netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()")

only needs to release the pending modules for registration.

Bug: 332996726
Cc: stable@vger.kernel.org
Fixes: c0391b6ab8 ("netfilter: nf_tables: missing validation from the abort path")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b0b36dcbe0f24383612e5e62bd48df5a8107f7fc)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I38f9b05ac4eadd1d2b7b306cccaf0aeacb61b57a
2024-04-15 11:20:28 +00:00
Pablo Neira Ayuso
26f2c9be9e UPSTREAM: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
commit 552705a3650bbf46a22b1adedc1b04181490fc36 upstream.

While the rhashtable set gc runs asynchronously, a race allows it to
collect elements from anonymous sets with timeouts while it is being
released from the commit path.

Mingi Cho originally reported this issue in a different path in 6.1.x
with a pipapo set with low timeouts which is not possible upstream since
7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set
element timeout").

Fix this by setting on the dead flag for anonymous sets to skip async gc
in this case.

According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on
transaction abort"), Florian plans to accelerate abort path by releasing
objects via workqueue, therefore, this sets on the dead flag for abort
path too.

Bug: 329205787
Cc: stable@vger.kernel.org
Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Reported-by: Mingi Cho <mgcho.minic@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 406b0241d0eb598a0b330ab20ae325537d8d8163)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I6170493c267e020c50a739150f8c421deb635b35
2024-04-15 10:33:08 +00:00
Pablo Neira Ayuso
99aea323a3 UPSTREAM: netfilter: nft_set_pipapo: release elements in clone only from destroy path
[ Upstream commit b0e256f3dd2ba6532f37c5c22e07cb07a36031ee ]

Clone already always provides a current view of the lookup table, use it
to destroy the set, otherwise it is possible to destroy elements twice.

This fix requires:

 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")

which came after:

 9827a0e6e2 ("netfilter: nft_set_pipapo: release elements in clone from abort path").

Bug: 330876672
Fixes: 9827a0e6e2 ("netfilter: nft_set_pipapo: release elements in clone from abort path")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit ff90050771412b91e928093ccd8736ae680063c2)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I8c0811e69f82681c7fcfdca1111f1702e27bb80e
2024-04-15 10:17:49 +00:00
Dylan Chang
b76ed11859 ANDROID: GKI: Add symbol list for Nothing
2 function symbol(s) added
  'char* dentry_path_raw(const struct dentry*, char*, int)'
  'int fscrypt_file_open(struct inode*, struct file*)'

Bug: 334026503
Change-Id: I20b224d5336753a1fa8783178be60dbaae35b3ba
Signed-off-by: Dylan Chang <dylan.chang@nothing.tech>
2024-04-14 10:01:56 +00:00
Norihiko Hama
cfa154389a ANDROID: GKI: Update honda symbol list for asound
Additional missing symbols required for vendor audio module

1 function symbol(s) added
  'int snd_pcm_suspend_all(struct snd_pcm*)'

Bug: 333795249

Change-Id: I8bf2d33b407f76aa528c8160bde1f996e4927b57
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com>
2024-04-12 12:59:04 +00:00
Norihiko Hama
9be03f0456 ANDROID: GKI: Update honda symbol list for xt_LOG
Add some missing symbols required for xt_LOG

2 function symbol(s) added
  'int xt_register_targets(struct xt_target*, unsigned int)'
  'void xt_unregister_targets(struct xt_target*, unsigned int)'

Bug: 333795249

Change-Id: Idb1f0a8028c822428da9fb1de2dd4b6b497c1f52
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com>
2024-04-12 12:58:50 +00:00
Norihiko Hama
a6cb9e0acf ANDROID: GKI: Update honda symbol list for ebtables
Add some missing symbols required for ebtables

2 function symbol(s) added
  'int xt_register_target(struct xt_target*)'
  'void xt_unregister_target(struct xt_target*)'

Bug: 333795249

Change-Id: I8e80c481732ea07cc84c41bb70c18175fc5fd23b
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com>
2024-04-12 12:58:38 +00:00
Norihiko Hama
e6dcd23df8 ANDROID: GKI: Update honda symbol list for net scheduler
Add some missing symbols required for net scheduler

4 function symbol(s) added
  'void tc_cleanup_offload_action(struct flow_action*)'
  'int tc_setup_offload_action(struct flow_action*, const struct tcf_exts*, struct netlink_ext_ack*)'
  'int tcf_action_update_hw_stats(struct tc_action*)'
  'int tcf_exts_validate_ex(struct net*, struct tcf_proto*, struct nlattr**, struct nlattr*, struct tcf_exts*, u32, u32, struct netlink_ext_ack*)'

Bug: 333795249

Change-Id: I2cefa08e07a6c8b8d9b9032f35792d7df9f94b0d
Signed-off-by: Norihiko Hama <Norihiko.Hama@alpsalpine.com>
2024-04-12 12:58:19 +00:00
lukechang
3547821560 ANDROID: softirq: add tasklet to LONG_SOFTIRQ_MASK
In commit 35a06697da ("FROMLIST: sched: Avoid placing RT threads on cores handling long softirqs"), the patch drop TASKLET_SOFTIRQ from LONG_SOFTIRQS.

Some drivers use tasklet softirq for data reception from firmware. When
there's a high volume or continuous stream of data from the firmware,
it can lead to unexpectedly long execution times for RT tasks and further cause jank or audio glitch.

Bug: 333895950
Test: check tasklet are defered when RT task is running

Change-Id: I53d6b43fe5a8860758898f09810a52fe319344f9
Signed-off-by: lukechang <lukechang@google.com>
2024-04-12 02:39:54 +00:00
Minchan Kim
ca4095789f ANDROID: Update the ABI symbol list
1 function symbol(s) added
  'int __traceiter_android_rvh_meminfo_proc_show(void*, struct seq_file*)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_rvh_meminfo_proc_show'

Bug: 333482947
Change-Id: I27ffd601307085f35aa853a214838fda605f901d
Signed-off-by: Minchan Kim <minchan@google.com>
2024-04-11 00:56:49 +00:00
Minchan Kim
59ef545736 ANDROID: vendor_hooks: add restricted vendor hook for meminfo
To report vendor-specific memory statistics, add restricted
vendor hook since normal vendor hook work with only atomic
context.

Bug: 333482947
Change-Id: I5c32961b30f082a8a4aa78906d2fce1cdf4b0d2b
Signed-off-by: Minchan Kim <minchan@google.com>
2024-04-11 00:56:49 +00:00
Chungjui Fan
be55946e20 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - ksoftirqd
  - pwmchip_add
  - pwmchip_remove
  - pwm_get_chip_data
  - pwm_set_chip_data

Bug: 307424586
Change-Id: I1a73d09feb888394925d23b4cdfce7bc3d1b0d9c
Signed-off-by: Chungjui Fan <chungjuifan@google.com>
2024-04-10 18:11:08 +00:00
Viresh Kumar
4b8e1f520a BACKPORT: cpufreq: Don't unregister cpufreq cooling on CPU hotplug
Offlining a CPU and bringing it back online is a common operation and it
happens frequently during system suspend/resume, where the non-boot CPUs
are hotplugged out during suspend and brought back at resume.

The cpufreq core already tries to make this path as fast as possible as
the changes are only temporary in nature and full cleanup of resources
isn't required in this case. For example the drivers can implement
online()/offline() callbacks to avoid a lot of tear down of resources.

On similar lines, there is no need to unregister the cpufreq cooling
device during suspend / resume, but only while the policy is getting
removed.

Moreover, unregistering the cpufreq cooling device is resulting in an
unwanted outcome, where the system suspend is eventually aborted in the
process.  Currently, during system suspend the cpufreq core unregisters
the cooling device, which in turn removes a kobject using device_del()
and that generates a notification to the userspace via uevent broadcast.
This causes system suspend to abort in some setups.

This was also earlier reported (indirectly) by Roman [1]. Maybe there is
another way around to fixing that problem properly, but this change
makes sense anyways.

Move the registering and unregistering of the cooling device to policy
creation and removal times onlyy.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218521
Reported-by: Manaf Meethalavalappu Pallikunhi <quic_manafm@quicinc.com>
Reported-by: Roman Stratiienko <r.stratiienko@gmail.com>
Link: https://patchwork.kernel.org/project/linux-pm/patch/20220710164026.541466-1-r.stratiienko@gmail.com/ [1]
Tested-by: Manaf Meethalavalappu Pallikunhi <quic_manafm@quicinc.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
(cherry picked from commit c4d61a529db788d2e52654f5b02c8d1de4952c5b)
Change-Id: I0b9435be1c2b41ea52a26cb578d850fd8121d57a
[jstultz: Tweaked to work around collision with existing android_vh
calls]
Signed-off-by: John Stultz <jstultz@google.com>
Bug: 333300519
2024-04-10 18:11:00 +00:00
Kyle Tso
165b01710b FROMGIT: usb: typec: tcpm: Correct the PDO counting in pd_set
Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are
incorrectly added one. The index of the loop is equal to the number of
PDOs to be updated when leaving the loop and it doesn't need to be added
one.

When doing the power negotiation, TCPM relies on the "nr_snk_pdo" as
the size of the local sink PDO array to match the Source capabilities
of the partner port. If the off-by-one overflow occurs, a wrong RDO
might be sent and unexpected power transfer might happen such as over
voltage or over current (than expected).

"nr_src_pdo" is used to set the Rp level when the port is in Source
role. It is also the array size of the local Source capabilities when
filling up the buffer which will be sent as the Source PDOs (such as
in Power Negotiation). If the off-by-one overflow occurs, a wrong Rp
level might be set and wrong Source PDOs will be sent to the partner
port. This could potentially cause over current or port resets.

Fixes: cd099cde4ed2 ("usb: typec: tcpm: Support multiple capabilities")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Tso <kyletso@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240404133517.2707955-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 206108037
(cherry picked from commit c4128304c2169b4664ed6fb6200f228cead2ab70
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-linus)
Change-Id: Icf86f562c7bbaefe7e27885e107b373aa4b64fd0
Signed-off-by: Kyle Tso <kyletso@google.com>
2024-04-10 01:35:44 +00:00
Jakub Kicinski
5dc2bc2966 UPSTREAM: tls: fix race between tx work scheduling and socket close
commit e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb upstream.

Similarly to previous commit, the submitting thread (recvmsg/sendmsg)
may exit as soon as the async crypto handler calls complete().
Reorder scheduling the work before calling complete().
This seems more logical in the first place, as it's
the inverse order of what the submitting thread will do.

Bug: 326214245
Reported-by: valis <sec@valis.email>
Fixes: a42055e8d2 ("net/tls: Add support for async encryption of records for performance")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[Lee: Fixed merge-conflict in Stable branches linux-6.1.y and older]
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 196f198ca6fce04ba6ce262f5a0e4d567d7d219d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I3128347d1e45018db30b6f2336ece2a4a3a630db
(cherry picked from commit e78d26a9ec366b108c89099b148ae3cea6f1a8e9)
2024-04-09 16:39:29 +00:00
Pablo Neira Ayuso
cdc8aeb893 UPSTREAM: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
commit 01acb2e8666a6529697141a6017edbf206921913 upstream.

Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER
event is reported, otherwise a stale reference to netdevice remains in
the hook list.

Bug: 332803585
Fixes: 60a3815da7 ("netfilter: add inet ingress support")
Cc: stable@vger.kernel.org
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 70f17b48c86622217a58d5099d29242fc9adac58)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I28482dca416b61dcf2e722ba0aef62d2d41a8f23
2024-04-09 16:39:11 +00:00
Jakub Kicinski
5b4439c0d7 UPSTREAM: tls: fix race between async notify and socket close
[ Upstream commit aec7961916f3f9e88766e2688992da6980f11b8d ]

The submitting thread (one which called recvmsg/sendmsg)
may exit as soon as the async crypto handler calls complete()
so any code past that point risks touching already freed data.

Try to avoid the locking and extra flags altogether.
Have the main thread hold an extra reference, this way
we can depend solely on the atomic ref counter for
synchronization.

Don't futz with reiniting the completion, either, we are now
tightly controlling when completion fires.

Bug: 326214245
Reported-by: valis <sec@valis.email>
Fixes: 0cada33241 ("net/tls: fix race condition causing kernel panic")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7a3ca06d04d589deec81f56229a9a9d62352ce01)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Idda32dd68ed26ae5c85c985305f52c3b2245e32c
2024-04-09 13:05:29 +01:00
Jakub Kicinski
fd16669b18 UPSTREAM: net: tls: factor out tls_*crypt_async_wait()
[ Upstream commit c57ca512f3b68ddcd62bda9cc24a8f5584ab01b1 ]

Factor out waiting for async encrypt and decrypt to finish.
There are already multiple copies and a subsequent fix will
need more. No functional changes.

Note that crypto_wait_req() returns wait->err

Bug: 326214245
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: aec7961916f3 ("tls: fix race between async notify and socket close")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 2c6841c88201e13967583f0f8a9f9b54b9cde404)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I7355c32d284623e08650c4d2b2a7d3be40f0cc0c
2024-04-09 13:05:23 +01:00
Sabrina Dubroca
5cb88480ab UPSTREAM: tls: extract context alloc/initialization out of tls_set_sw_offload
[ Upstream commit 615580cbc99af0da2d1c7226fab43a3d5003eb97 ]

Simplify tls_set_sw_offload a bit.

Bug: 326214245
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: aec7961916f3 ("tls: fix race between async notify and socket close")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit d55eb0b495a9e4de1c61394087bb06f12d18b6bc)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I97ae8c76bb91d49ca26ad9d92c7ce099a3f780ed
2024-04-09 13:05:12 +01:00
Carlos Galo
338203a817 BACKPORT: mm: update mark_victim tracepoints fields
The current implementation of the mark_victim tracepoint provides only the
process ID (pid) of the victim process.  This limitation poses challenges
for userspace tools requiring real-time OOM analysis and intervention.
Although this information is available from the kernel logs, it’s not
the appropriate format to provide OOM notifications.  In Android, BPF
programs are used with the mark_victim trace events to notify userspace of
an OOM kill.  For consistency, update the trace event to include the same
information about the OOMed victim as the kernel logs.

- UID
   In Android each installed application has a unique UID. Including
   the `uid` assists in correlating OOM events with specific apps.

- Process Name (comm)
   Enables identification of the affected process.

- OOM Score
  Will allow userspace to get additional insight of the relative kill
  priority of the OOM victim. In Android, the oom_score_adj is used to
  categorize app state (foreground, background, etc.), which aids in
  analyzing user-perceptible impacts of OOM events [1].

- Total VM, RSS Stats, and pgtables
  Amount of memory used by the victim that will, potentially, be freed up
  by killing it.

[1] 246dc8fc95:frameworks/base/services/core/java/com/android/server/am/ProcessList.java;l=188-283
Signed-off-by: Carlos Galo <carlosgalo@google.com>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Bug: 331214192
(cherry picked from commit 72ba14deb40a9e9668ec5e66a341ed657e5215c2)
[ carlosgalo: Manually added struct cred change in mark_oom_victim function ]
Link: https://lore.kernel.org/all/20240223173258.174828-1-carlosgalo@google.com/
Change-Id: I24f503ceca04b83f8abf42fcd04a3409e17be6b5
2024-04-08 18:00:16 +00:00
Carlos Galo
97808981ed Revert "FROMGIT: BACKPORT: mm: update mark_victim tracepoints fields"
This reverts commit 6b4c816d17.

Reason for revert: b/331214192

Change-Id: I9f4f56de7d65cee19c7015b0cb1bda339d82a5f5
Signed-off-by: Carlos Galo <carlosgalo@google.com>
2024-04-08 18:00:16 +00:00
Minchan Kim
dfd2c809b9 ANDROID: Update the ABI symbol list
4 function symbol(s) added
  'bool __oom_reap_task_mm(struct mm_struct*)'
  'int do_send_sig_info(int, struct kernel_siginfo*, struct task_struct*, enum pid_type)'
  'void get_reclaim_params(int*, int*)'
  'int set_reclaim_params(int, int)'

Bug: 323406883
Change-Id: I07f578ef8ec675e4980f225611630c57ec9eaff3
Signed-off-by: Minchan Kim <minchan@google.com>
2024-04-08 17:39:38 +00:00
Minchan Kim
babe7ef868 ANDROID: export two function to reclaim memory
Export two functions to help memory reclaim.

Bug: 323406883
Change-Id: I099d414c9b3648224ab077b9929c6622b2d4228a
Signed-off-by: Minchan Kim <minchan@google.com>
2024-04-08 17:39:38 +00:00
Minchan Kim
66193f866d ANDROID: add reclaim tune parameter functions
This patch adds two exported functions to set/get reclaim parameters.

Bug: 323406883
Change-Id: I8c29073dba3e77cb5db7f45b640518deae04b8a9
Signed-off-by: Minchan Kim <minchan@google.com>
2024-04-08 17:39:38 +00:00
Pablo Neira Ayuso
27c443059c UPSTREAM: netfilter: nf_tables: disallow anonymous set with timeout flag
commit 16603605b667b70da974bea8216c93e7db043bf1 upstream.

Anonymous sets are never used with timeout from userspace, reject this.
Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.

Bug: 329055463
Cc: stable@vger.kernel.org
Fixes: 761da2935d ("netfilter: nf_tables: add set timeout API support")
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 72c1efe3f247a581667b7d368fff3bd9a03cd57a)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I8c1c818e3d155d5edefee0b741568104081efb38
2024-04-08 16:15:41 +01:00
Giuliano Procida
56ba301cac ANDROID: drop redundant OWNERS_DrNo file
This file should only exist in android-mainline.

Bug: 333350072
Change-Id: I6350acb9d187f94a67c34c2e72b607a9599269b0
Signed-off-by: Giuliano Procida <gprocida@google.com>
2024-04-08 12:52:46 +00:00
Aiswarya Cyriac
60534eef47 UPSTREAM: ALSA: virtio: Fix "Coverity: virtsnd_kctl_tlv_op(): Uninitialized variables" warning.
This commit fixes the following warning when building virtio_snd driver.

"
*** CID 1583619:  Uninitialized variables  (UNINIT)
sound/virtio/virtio_kctl.c:294 in virtsnd_kctl_tlv_op()
288
289     		break;
290     	}
291
292     	kfree(tlv);
293
vvv     CID 1583619:  Uninitialized variables  (UNINIT)
vvv     Using uninitialized value "rc".
294     	return rc;
295     }
296
297     /**
298      * virtsnd_kctl_get_enum_items() - Query items for the ENUMERATED element type.
299      * @snd: VirtIO sound device.
"

This warning is caused by the absence of the "default" branch in the
switch-block, and is a false positive because the kernel calls
virtsnd_kctl_tlv_op() only with values for op_flag processed in
this block.

Also, this commit unifies the cleanup path for all possible control
paths in the callback function.

Signed-off-by: Anton Yakovlev <anton.yakovlev@opensynergy.com>
Signed-off-by: Aiswarya Cyriac <aiswarya.cyriac@opensynergy.com>
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1583619 ("Uninitialized variables")
Fixes: d6568e3de42d ("ALSA: virtio: add support for audio controls")
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/r/20240216100643.688590-1-aiswarya.cyriac@opensynergy.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Bug: 330891925
Change-Id: I6fb999ed48457baddcde95a3539daf010d505296
(cherry picked from commit ba00e413fa1515e4d0890803c01ebc555f500f15)
Signed-off-by: Marcin Radomski <dextero@google.com>
2024-04-04 15:35:58 +00:00
Anton Yakovlev
e7f7d55471 UPSTREAM: ALSA: virtio: add support for audio controls
Implementation of support for audio controls in accordance with the
extension of the virtio sound device specification [1] planned for
virtio-v1.3-cs01.

The device can announce the VIRTIO_SND_F_CTLS feature. If the feature is
negotiated, then an additional field appears in the configuration space:

  struct virtio_snd_config {
    ...
    /* number of available control elements */
    __le32 controls;
  };

The driver can send the following requests to manage audio controls:

  enum {
    ...
    /* control element request types */
    VIRTIO_SND_R_CTL_INFO = 0x0300,
    VIRTIO_SND_R_CTL_ENUM_ITEMS,
    VIRTIO_SND_R_CTL_READ,
    VIRTIO_SND_R_CTL_WRITE,
    VIRTIO_SND_R_CTL_TLV_READ,
    VIRTIO_SND_R_CTL_TLV_WRITE,
    VIRTIO_SND_R_CTL_TLV_COMMAND,
    ...
  };

And the device can send the following audio control event notification:

  enum {
    ...
    /* control element event types */
    VIRTIO_SND_EVT_CTL_NOTIFY = 0x1200,
    ...
  };

See additional details in [1].

[1] https://lists.oasis-open.org/archives/virtio-comment/202104/msg00013.html

Signed-off-by: Anton Yakovlev <anton.yakovlev@opensynergy.com>
Signed-off-by: Aiswarya Cyriac <aiswarya.cyriac@opensynergy.com>
Link: https://lore.kernel.org/r/20240115133654.576068-2-aiswarya.cyriac@opensynergy.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Bug: 330891925
Change-Id: I4c70787a920bc4a7cf82b8115fc9f0a6c77b4859
(cherry picked from commit d6568e3de42dd971a1356f7ba581e6600d53f0a0)
Signed-off-by: Marcin Radomski <dextero@google.com>
2024-04-04 15:35:58 +00:00
Marcin Radomski
0fd2018454 ANDROID: Update symbols list for virtio_snd.ko audio controls
Added just symbols reported as required by:

  tools/bazel run //common-modules/virtual-device:virtual_device_aarch64_dist

because the virtual_device_aarch64_abi_update_symbol_list tool
introduces a ton of unrelated changes - not just trivial reordering, but
also adds some extra symbols.

Bug: 330891925
Test: Build dist packages on the entire commit chain:
Test: tools/bazel run //common-modules/virtual-device:virtual_device_x86_64_dist
Test: tools/bazel run //common-modules/virtual-device:virtual_device_aarch64_dist
Change-Id: I26abf56b3cb9b3cc3f179647ce229aa85a3dd7c8
Signed-off-by: Marcin Radomski <dextero@google.com>
2024-04-04 15:35:55 +00:00
Qais Yousef
ebcdb9dc21 ANDROID: Move cpu_busy_with_softirqs() into sched.h
The extern declaration ended up at the end of rt.c instead of sched.h by
mistake.

Bug: 332629555
Fixes: dcdec80d6b ("ANDROID: Export cpu_busy_with_softirqs()")
Signed-off-by: Qais Yousef <qyousef@google.com>
Change-Id: Id95a1c2261134c4d4f589ec51d350fc5eb2724f9
2024-04-04 02:42:42 +00:00
Charan Teja Kalla
5dd0c4814f UPSTREAM: mm: page_alloc: unreserve highatomic page blocks before oom
__alloc_pages_direct_reclaim() is called from slowpath allocation where
high atomic reserves can be unreserved after there is a progress in
reclaim and yet no suitable page is found.  Later should_reclaim_retry()
gets called from slow path allocation to decide if the reclaim needs to be
retried before OOM kill path is taken.

should_reclaim_retry() checks the available(reclaimable + free pages)
memory against the min wmark levels of a zone and returns:

a) true, if it is above the min wmark so that slow path allocation will
   do the reclaim retries.

b) false, thus slowpath allocation takes oom kill path.

should_reclaim_retry() can also unreserves the high atomic reserves **but
only after all the reclaim retries are exhausted.**

In a case where there are almost none reclaimable memory and free pages
contains mostly the high atomic reserves but allocation context can't use
these high atomic reserves, makes the available memory below min wmark
levels hence false is returned from should_reclaim_retry() leading the
allocation request to take OOM kill path.  This can turn into a early oom
kill if high atomic reserves are holding lot of free memory and
unreserving of them is not attempted.

(early)OOM is encountered on a VM with the below state:
[  295.998653] Normal free:7728kB boost:0kB min:804kB low:1004kB
high:1204kB reserved_highatomic:8192KB active_anon:4kB inactive_anon:0kB
active_file:24kB inactive_file:24kB unevictable:1220kB writepending:0kB
present:70732kB managed:49224kB mlocked:0kB bounce:0kB free_pcp:688kB
local_pcp:492kB free_cma:0kB
[  295.998656] lowmem_reserve[]: 0 32
[  295.998659] Normal: 508*4kB (UMEH) 241*8kB (UMEH) 143*16kB (UMEH)
33*32kB (UH) 7*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB
0*4096kB = 7752kB

Per above log, the free memory of ~7MB exist in the high atomic reserves
is not freed up before falling back to oom kill path.

Fix it by trying to unreserve the high atomic reserves in
should_reclaim_retry() before __alloc_pages_direct_reclaim() can fallback
to oom kill path.

Bug: 332219324
Link: https://lkml.kernel.org/r/1700823445-27531-1-git-send-email-quic_charante@quicinc.com
Fixes: 0aaa29a56e ("mm, page_alloc: reserve pageblocks for high-order atomic allocations on demand")
(cherry picked from commit ac3f3b0a55518056bc80ed32a41931c99e1f7d81)
Change-Id: I432d4ac4864d401a4413f6b2ef902625766f8070
Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
Reported-by: Chris Goldsworthy <quic_cgoldswo@quicinc.com>
Suggested-by: Michal Hocko <mhocko@suse.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Chris Goldsworthy <quic_cgoldswo@quicinc.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-04-03 22:38:24 +00:00
Charan Teja Kalla
6d3db504d1 UPSTREAM: mm: page_alloc: enforce minimum zone size to do high atomic reserves
Highatomic reserves are set to roughly 1% of zone for maximum and a
pageblock size for minimum.  Encountered a system with the below
configuration:
Normal free:7728kB boost:0kB min:804kB low:1004kB high:1204kB
reserved_highatomic:8192KB managed:49224kB

On such systems, even a single pageblock makes highatomic reserves are set
to ~8% of the zone memory.  This high value can easily exert pressure on
the zone.

Per discussion with Michal and Mel, it is not much useful to reserve the
memory for highatomic allocations on such small systems[1].  Since the
minimum size for high atomic reserves is always going to be a pageblock
size and if 1% of zone managed pages is going to be below pageblock size,
don't reserve memory for high atomic allocations.  Thanks Michal for this
suggestion[2].

Since no memory is being reserved for high atomic allocations and if
respective allocation failures are seen, this patch can be reverted.

[1] https://lore.kernel.org/linux-mm/20231117161956.d3yjdxhhm4rhl7h2@techsingularity.net/
[2] https://lore.kernel.org/linux-mm/ZVYRJMUitykepLRy@tiehlicka/

Bug: 332219324
Link: https://lkml.kernel.org/r/c3a2a48e2cfe08176a80eaf01c110deb9e918055.1700821416.git.quic_charante@quicinc.com
Change-Id: Id059b63bd6ee68b3a2cd1c4b44613234a42d0a46
(cherry picked from commit 9cd20f3fe045af95a8fe7a12328b21bfd2f3b8bf)
Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-04-03 22:38:24 +00:00
Charan Teja Kalla
58699757f4 UPSTREAM: mm: page_alloc: correct high atomic reserve calculations
Patch series "mm: page_alloc: fixes for high atomic reserve
caluculations", v3.

The state of the system where the issue exposed shown in oom kill logs:

[  295.998653] Normal free:7728kB boost:0kB min:804kB low:1004kB high:1204kB reserved_highatomic:8192KB active_anon:4kB inactive_anon:0kB active_file:24kB inactive_file:24kB unevictable:1220kB writepending:0kB present:70732kB managed:49224kB mlocked:0kB bounce:0kB free_pcp:688kBlocal_pcp:492kB free_cma:0kB
[  295.998656] lowmem_reserve[]: 0 32
[  295.998659] Normal: 508*4kB (UMEH) 241*8kB (UMEH) 143*16kB (UMEH)
33*32kB (UH) 7*64kB (UH) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 7752kB

From the above, it is seen that ~16MB of memory reserved for high atomic
reserves against the expectation of 1% reserves which is fixed in the 1st
patch.

Don't reserve the high atomic page blocks if 1% of zone memory size is
below a pageblock size.

This patch (of 2):

reserve_highatomic_pageblock() aims to reserve the 1% of the managed pages
of a zone, which is used for the high order atomic allocations.

It uses the below calculation to reserve:
static void reserve_highatomic_pageblock(struct page *page, ....) {

   .......
   max_managed = (zone_managed_pages(zone) / 100) + pageblock_nr_pages;

   if (zone->nr_reserved_highatomic >= max_managed)
       goto out;

   zone->nr_reserved_highatomic += pageblock_nr_pages;
   set_pageblock_migratetype(page, MIGRATE_HIGHATOMIC);
   move_freepages_block(zone, page, MIGRATE_HIGHATOMIC, NULL);

out:
   ....
}

Since we are always appending the 1% of zone managed pages count to
pageblock_nr_pages, the minimum it is turning into 2 pageblocks as the
nr_reserved_highatomic is incremented/decremented in pageblock sizes.

Encountered a system(actually a VM running on the Linux kernel) with the
below zone configuration:
Normal free:7728kB boost:0kB min:804kB low:1004kB high:1204kB
reserved_highatomic:8192KB managed:49224kB

The existing calculations making it to reserve the 8MB(with pageblock size
of 4MB) i.e.  16% of the zone managed memory.  Reserving such high amount
of memory can easily exert memory pressure in the system thus may lead
into unnecessary reclaims till unreserving of high atomic reserves.

Since high atomic reserves are managed in pageblock size granules, as
MIGRATE_HIGHATOMIC is set for such pageblock, fix the calculations for
high atomic reserves as, minimum is pageblock size , maximum is
approximately 1% of the zone managed pages.

Bug: 332219324
Link: https://lkml.kernel.org/r/cover.1700821416.git.quic_charante@quicinc.com
Link: https://lkml.kernel.org/r/1660034138397b82a0a8b6ae51cbe96bd583d89e.1700821416.git.quic_charante@quicinc.com
Change-Id: Icc15fb88ef6166f691f5aa14311bc45bff972b99
(cherry picked from commit d68e39fc45f70e35eb74df2128d315c1d91e4dc4)
Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
Acked-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: David Rientjes <rientjes@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-04-03 22:38:24 +00:00
Qais Yousef
9ce8f4d0bb ANDROID: Update the ABI symbol list
Adding the following symbols:
  - cpu_busy_with_softirqs
  - __traceiter_android_rvh_tick_entry
  - __tracepoint_android_rvh_tick_entry

Bug: 332629555
Change-Id: I8ff85b6c13e39de35013dd742aaccf5db02e74b4
Signed-off-by: Qais Yousef <qyousef@google.com>
2024-04-03 20:32:38 +00:00
Qais Yousef
dcdec80d6b ANDROID: Export cpu_busy_with_softirqs()
This function used to be called task_may_not_preempt() in older versions
and used by modules that have their extension to RT. Export it to allow
users to continue to use it.

Bug: 332629555
Signed-off-by: Qais Yousef <qyousef@google.com>
Change-Id: I04affb8e9e6258f9fb36ebab4d7956a265e9e299
2024-04-03 19:43:22 +00:00
fengqi
baba019a00 ANDROID: GKI: update symbol list file for xiaomi
5 function symbol(s) added
  'struct backlight_device* backlight_device_get_by_name(const char*)'
  'void netdev_reset_tc(struct net_device*)'
  'int netdev_set_num_tc(struct net_device*, u8)'
  'int netdev_set_tc_queue(struct net_device*, u8, u16, u16)'
  'int pci_sriov_set_totalvfs(struct pci_dev*, u16)'

1 variable symbol(s) added
  'const struct udp_tunnel_nic_ops* udp_tunnel_nic_ops'

Bug: 332479153
Change-Id: Ia8c886218eea2048df52bc3406ded44d4ed3ab66
Signed-off-by: fengqi <fengqi@xiaomi.corp-partner.google.com>
2024-04-03 19:21:15 +00:00
Greg Kroah-Hartman
4747c75687 Reapply "ANDROID: null_blk: Support configuring the maximum segment size"
This reverts commit 95d3e50fde4993d5631e83aa65414b98de24cb90.

Bug: 308663717
Bug: 319125789
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Juan Yescas <jyescas@google.com>
Change-Id: Ib07f0e6c7fb3266ca7959aef6615f2daf5701665
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-04-03 17:09:27 +00:00
Kyle Tso
af361f9a10 UPSTREAM: usb: typec: Return size of buffer if pd_set operation succeeds
The attribute writing should return the number of bytes used from the
buffer on success.

Fixes: a7cff92f06 ("usb: typec: USB Power Delivery helpers for ports and partners")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Tso <kyletso@google.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240319074309.3306579-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 206108037
(cherry picked from commit 53f5094fdf5deacd99b8655df692e9278506724d)
Change-Id: If5ad5cd3b82a81480a5dbe488e49482ab4836ab8
Signed-off-by: Kyle Tso <kyletso@google.com>
2024-04-03 07:45:33 +00:00
Kyle Tso
07d4bc4f64 UPSTREAM: usb: typec: tcpm: Update PD of Type-C port upon pd_set
The PD of Type-C port needs to be updated in pd_set. Unlink the Type-C
port device to the old PD before linking it to a new one.

Fixes: cd099cde4ed2 ("usb: typec: tcpm: Support multiple capabilities")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Tso <kyletso@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240311172306.3911309-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 206108037
(cherry picked from commit 17af5050dead6cbcca12c1fcd17e0bb8bb284eae)
Change-Id: I84e6735181e2ab7fd37432533ab6b91b0b560c1e
Signed-off-by: Kyle Tso <kyletso@google.com>
2024-04-03 07:45:33 +00:00
Xu Yang
59dc53906a UPSTREAM: usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()
When unregister pd capabilitie in tcpm, KASAN will capture below double
-free issue. The root cause is the same capabilitiy will be kfreed twice,
the first time is kfreed by pd_capabilities_release() and the second time
is explicitly kfreed by tcpm_port_unregister_pd().

[    3.988059] BUG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc
[    3.995001] Free of addr ffff0008164d3000 by task kworker/u16:0/10
[    4.001206]
[    4.002712] CPU: 2 PID: 10 Comm: kworker/u16:0 Not tainted 6.8.0-rc5-next-20240220-05616-g52728c567a55 #53
[    4.012402] Hardware name: Freescale i.MX8QXP MEK (DT)
[    4.017569] Workqueue: events_unbound deferred_probe_work_func
[    4.023456] Call trace:
[    4.025920]  dump_backtrace+0x94/0xec
[    4.029629]  show_stack+0x18/0x24
[    4.032974]  dump_stack_lvl+0x78/0x90
[    4.036675]  print_report+0xfc/0x5c0
[    4.040289]  kasan_report_invalid_free+0xa0/0xc0
[    4.044937]  __kasan_slab_free+0x124/0x154
[    4.049072]  kfree+0xb4/0x1e8
[    4.052069]  tcpm_port_unregister_pd+0x1a4/0x3dc
[    4.056725]  tcpm_register_port+0x1dd0/0x2558
[    4.061121]  tcpci_register_port+0x420/0x71c
[    4.065430]  tcpci_probe+0x118/0x2e0

To fix the issue, this will remove kree() from tcpm_port_unregister_pd().

Fixes: cd099cde4ed2 ("usb: typec: tcpm: Support multiple capabilities")
cc: stable@vger.kernel.org
Suggested-by: Aisheng Dong <aisheng.dong@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240311065219.777037-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 206108037
(cherry picked from commit b63f90487bdf93a4223ce7853d14717e9d452856)
Change-Id: Ic7878160e11e606c26fbaa64e90e2bf877c53259
Signed-off-by: Kyle Tso <kyletso@google.com>
2024-04-03 07:45:33 +00:00
Kyle Tso
0e88400de9 UPSTREAM: usb: typec: tcpm: Correct port source pdo array in pd_set callback
In tcpm_pd_set, the array of port source capabilities is port->src_pdo,
not port->snk_pdo.

Fixes: cd099cde4ed2 ("usb: typec: tcpm: Support multiple capabilities")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Tso <kyletso@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240311144500.3694849-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 206108037
(cherry picked from commit 893cd9469c68a89a34956121685617dbb37497b1)
Change-Id: I471747b140e22ba6a3ca9eaa54e18ac995395a2d
Signed-off-by: Kyle Tso <kyletso@google.com>
2024-04-03 07:45:33 +00:00