From 1f10fa954f139ad6e88706fc233d13b560f0c58d Mon Sep 17 00:00:00 2001 From: almalinux-bot-kernel Date: Fri, 12 Jun 2026 05:41:28 +0000 Subject: [PATCH] Import of kernel-4.18.0-553.132.1.el8_10 --- Makefile.rhelver | 2 +- drivers/infiniband/sw/rxe/rxe_srq.c | 4 +- drivers/md/md.c | 1 + drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +++--- drivers/nvme/host/fc.c | 2 +- fs/dlm/lock.c | 7 ++- fs/dlm/lock.h | 4 +- net/ipv6/icmp.c | 3 ++ net/ipv6/ip6_tunnel.c | 5 +++ sound/usb/6fire/chip.c | 57 ++++++++++++++---------- 10 files changed, 61 insertions(+), 37 deletions(-) diff --git a/Makefile.rhelver b/Makefile.rhelver index 767e830e08..8fe68037b9 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 10 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 553.129.1 +RHEL_RELEASE = 553.132.1 # # ZSTREAM diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c index 02b39498c3..038a9cd554 100644 --- a/drivers/infiniband/sw/rxe/rxe_srq.c +++ b/drivers/infiniband/sw/rxe/rxe_srq.c @@ -69,8 +69,6 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, return -ENOMEM; } - srq->rq.queue = q; - err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata, q->buf, q->buf_size, &q->ip); if (err) { @@ -87,6 +85,8 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, } } + srq->rq.queue = q; + return 0; } diff --git a/drivers/md/md.c b/drivers/md/md.c index 8c71050495..d15251e750 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8813,6 +8813,7 @@ static void md_clone_bio(struct mddev *mddev, struct bio **bio) md_io_clone = container_of(clone, struct md_io_clone, bio_clone); md_io_clone->orig_bio = *bio; md_io_clone->mddev = mddev; + md_io_clone->start_time = 0; if (blk_queue_io_stat((*bio)->bi_disk->queue)) md_io_clone->start_time = bio_start_io_acct(*bio); diff --git a/drivers/net/ethernet/mellanox/mlx4/srq.c b/drivers/net/ethernet/mellanox/mlx4/srq.c index dd890f5d7b..b21eae532a 100644 --- a/drivers/net/ethernet/mellanox/mlx4/srq.c +++ b/drivers/net/ethernet/mellanox/mlx4/srq.c @@ -44,13 +44,14 @@ void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type) { struct mlx4_srq_table *srq_table = &mlx4_priv(dev)->srq_table; struct mlx4_srq *srq; + unsigned long flags; - rcu_read_lock(); + spin_lock_irqsave(&srq_table->lock, flags); srq = radix_tree_lookup(&srq_table->tree, srqn & (dev->caps.num_srqs - 1)); - rcu_read_unlock(); - if (srq) - refcount_inc(&srq->refcount); - else { + if (!srq || !refcount_inc_not_zero(&srq->refcount)) + srq = NULL; + spin_unlock_irqrestore(&srq_table->lock, flags); + if (!srq) { mlx4_warn(dev, "Async event for bogus SRQ %08x\n", srqn); return; } @@ -203,8 +204,8 @@ int mlx4_srq_alloc(struct mlx4_dev *dev, u32 pdn, u32 cqn, u16 xrcd, if (err) goto err_radix; - refcount_set(&srq->refcount, 1); init_completion(&srq->free); + atomic_set_release(&srq->refcount.refs, 1); return 0; diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index 0e79f22226..92f6fe277b 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -3281,13 +3281,13 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl) { struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); - cancel_work_sync(&ctrl->ioerr_work); cancel_delayed_work_sync(&ctrl->connect_work); /* * kill the association on the link side. this will block * waiting for io to terminate */ nvme_fc_delete_association(ctrl); + cancel_work_sync(&ctrl->ioerr_work); } static void diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index f376768380..24690452bc 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -444,13 +444,16 @@ static int rsb_cmp(struct dlm_rsb *r, const char *name, int nlen) return memcmp(r->res_name, maxname, DLM_RESNAME_MAXLEN); } -int dlm_search_rsb_tree(struct rb_root *tree, char *name, int len, - struct dlm_rsb **r_ret) +int dlm_search_rsb_tree(struct rb_root *tree, char *name, + unsigned int len, struct dlm_rsb **r_ret) { struct rb_node *node = tree->rb_node; struct dlm_rsb *r; int rc; + if (len > DLM_RESNAME_MAXLEN) + return -EINVAL; + while (node) { r = rb_entry(node, struct dlm_rsb, res_hashnode); rc = rsb_cmp(r, name, len); diff --git a/fs/dlm/lock.h b/fs/dlm/lock.h index ed8ebd3a85..83efc01a66 100644 --- a/fs/dlm/lock.h +++ b/fs/dlm/lock.h @@ -32,8 +32,8 @@ void dlm_adjust_timeouts(struct dlm_ls *ls); int dlm_master_lookup(struct dlm_ls *ls, int nodeid, char *name, int len, unsigned int flags, int *r_nodeid, int *result); -int dlm_search_rsb_tree(struct rb_root *tree, char *name, int len, - struct dlm_rsb **r_ret); +int dlm_search_rsb_tree(struct rb_root *tree, char *name, + unsigned int len, struct dlm_rsb **r_ret); void dlm_recover_purge(struct dlm_ls *ls); void dlm_purge_mstcpy_locks(struct dlm_rsb *r); diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index ab6b05a74e..9b6ec362a7 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -635,6 +635,9 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type, if (!skb2) return 1; + /* Remove debris left by IPv4 stack. */ + memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); + skb_dst_drop(skb2); skb_pull(skb2, nhs); skb_reset_network_header(skb2); diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index a234bbc7df..2ead63cdeb 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -628,11 +628,16 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (!skb2) return 0; + /* Remove debris left by IPv6 stack. */ + memset(IPCB(skb2), 0, sizeof(*IPCB(skb2))); + skb_dst_drop(skb2); skb_pull(skb2, offset); skb_reset_network_header(skb2); eiph = ip_hdr(skb2); + if (eiph->version != 4 || eiph->ihl < 5) + goto out; /* Try to guess incoming interface */ rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr, diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 33e962178c..bbd8623fb8 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -31,7 +31,6 @@ static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX; /* Index 0-max */ static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR; /* Id for card */ static bool enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE_PNP; /* Enable card */ static struct sfire_chip *chips[SNDRV_CARDS] = SNDRV_DEFAULT_PTR; -static struct usb_device *devices[SNDRV_CARDS] = SNDRV_DEFAULT_PTR; module_param_array(index, int, NULL, 0444); MODULE_PARM_DESC(index, "Index value for the 6fire sound device"); @@ -53,16 +52,13 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) usb6fire_comm_abort(chip); if (chip->control) usb6fire_control_abort(chip); - if (chip->card) { - snd_card_disconnect(chip->card); - snd_card_free_when_closed(chip->card); - chip->card = NULL; - } } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -72,8 +68,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -90,13 +84,12 @@ static int usb6fire_chip_probe(struct usb_interface *intf, /* look if we already serve this card and return if so */ mutex_lock(®ister_mutex); for (i = 0; i < SNDRV_CARDS; i++) { - if (devices[i] == device) { - if (chips[i]) - chips[i]->intf_count++; + if (chips[i] && chips[i]->dev == device) { + chips[i]->intf_count++; usb_set_intfdata(intf, chips[i]); mutex_unlock(®ister_mutex); return 0; - } else if (!devices[i] && regidx < 0) + } else if (!chips[i] && regidx < 0) regidx = i; } if (regidx < 0) { @@ -104,24 +97,27 @@ static int usb6fire_chip_probe(struct usb_interface *intf, dev_err(&intf->dev, "too many cards registered.\n"); return -ENODEV; } - devices[regidx] = device; - mutex_unlock(®ister_mutex); /* check, if firmware is present on device, upload it if not */ ret = usb6fire_fw_init(intf); - if (ret < 0) + if (ret < 0) { + mutex_unlock(®ister_mutex); return ret; - else if (ret == FW_NOT_READY) /* firmware update performed */ + } else if (ret == FW_NOT_READY) { /* firmware update performed */ + mutex_unlock(®ister_mutex); return 0; + } /* if we are here, card can be registered in alsa. */ if (usb_set_interface(device, 0, 0) != 0) { + mutex_unlock(®ister_mutex); dev_err(&intf->dev, "can't set first interface.\n"); return -EIO; } ret = snd_card_new(&intf->dev, index[regidx], id[regidx], THIS_MODULE, sizeof(struct sfire_chip), &card); if (ret < 0) { + mutex_unlock(®ister_mutex); dev_err(&intf->dev, "cannot create alsa card.\n"); return ret; } @@ -131,11 +127,11 @@ static int usb6fire_chip_probe(struct usb_interface *intf, device->bus->busnum, device->devnum); chip = card->private_data; - chips[regidx] = chip; chip->dev = device; chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -158,32 +154,47 @@ static int usb6fire_chip_probe(struct usb_interface *intf, dev_err(&intf->dev, "cannot register card."); goto destroy_chip; } + usb_set_intfdata(intf, chip); + chips[regidx] = chip; + + mutex_unlock(®ister_mutex); return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); + mutex_unlock(®ister_mutex); return ret; } static void usb6fire_chip_disconnect(struct usb_interface *intf) { struct sfire_chip *chip; + struct snd_card *card; + mutex_lock(®ister_mutex); chip = usb_get_intfdata(intf); if (chip) { /* if !chip, fw upload has been performed */ chip->intf_count--; if (!chip->intf_count) { - mutex_lock(®ister_mutex); - devices[chip->regidx] = NULL; chips[chip->regidx] = NULL; - mutex_unlock(®ister_mutex); + /* + * Save card pointer before teardown. + * snd_card_free_when_closed() may free card (and + * the embedded chip) immediately, so it must be + * called last and chip must not be accessed after. + */ + card = chip->card; chip->shutdown = true; + if (card) + snd_card_disconnect(card); usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); + if (card) + snd_card_free_when_closed(card); } } + mutex_unlock(®ister_mutex); } static const struct usb_device_id device_table[] = {