almalinux/kernel
14
1
Fork 0
Code Issues Pull Requests Releases Activity

Import of kernel-4.18.0-553.136.1.el8_10

Browse Source
This commit is contained in:
almalinux-bot-kernel 2026-06-23 05:26:20 +00:00
parent a8926071b0
commit f79607ac92
13 changed files with 202 additions and 117 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile.rhelver
View File

@ -12,7 +12,7 @@ RHEL_MINOR = 10
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 553.134.1
RHEL_RELEASE = 553.136.1
#
# ZSTREAM

5
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
View File

@ -9935,6 +9935,11 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
#if defined(CONFIG_DRM_AMD_DC_DCN)
if (dc_resource_is_dsc_encoding_supported(dc)) {
for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
dm_new_crtc_state->mode_changed_independent_from_dsc = new_crtc_state->mode_changed;
}
for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
if (drm_atomic_crtc_needs_modeset(new_crtc_state)) {
ret = add_affected_mst_dsc_crtcs(state, crtc);

1
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
View File

@ -721,6 +721,7 @@ struct dm_crtc_state {
bool freesync_vrr_info_changed;
bool mode_changed_independent_from_dsc;
bool dsc_force_changed;
bool vrr_supported;
struct mod_freesync_config freesync_config;

9
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
View File

@ -1430,8 +1430,13 @@ int pre_validate_dsc(struct drm_atomic_state *state,
} else {
int ind = find_crtc_index_in_state_by_stream(state, stream);
if (ind >= 0)
state->crtcs[ind].new_state->mode_changed = 0;
if (ind >= 0) {
struct dm_crtc_state *dm_new_crtc_state = to_dm_crtc_state(state->crtcs[ind].new_state);
DRM_INFO_ONCE("%s:%d MST_DSC no mode changed for stream 0x%p\n",
__func__, __LINE__, stream);
dm_new_crtc_state->base.mode_changed = dm_new_crtc_state->mode_changed_independent_from_dsc;
}
}
}
clean_exit:

3
drivers/infiniband/hw/mana/qp.c
View File

@ -24,6 +24,9 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
gc = dev->gdma_dev->gdma_context;
mdev = &gc->mana;
if (rx_hash_key_len > sizeof(req->hashkey))
return -EINVAL;
req_buf_size =
sizeof(*req) + sizeof(mana_handle_t) * MANA_INDIRECT_TABLE_SIZE;
req = kzalloc(req_buf_size, GFP_KERNEL);

19
drivers/net/bonding/bond_main.c
View File

@ -4741,7 +4741,6 @@ static netdev_tx_t bond_xmit_broadcast(struct sk_buff *skb,
struct slave *slave = NULL;
struct list_head *iter;
bool xmit_suc = false;
bool skb_used = false;
bond_for_each_slave_rcu(bond, slave, iter) {
struct sk_buff *skb2;
@ -4749,24 +4748,18 @@ static netdev_tx_t bond_xmit_broadcast(struct sk_buff *skb,
if (!(bond_slave_is_up(slave) && slave->link == BOND_LINK_UP))
continue;
if (bond_is_last_slave(bond, slave)) {
skb2 = skb;
skb_used = true;
} else {
skb2 = skb_clone(skb, GFP_ATOMIC);
if (!skb2) {
net_err_ratelimited("%s: Error: %s: skb_clone() failed\n",
bond_dev->name, __func__);
continue;
}
skb2 = skb_clone(skb, GFP_ATOMIC);
if (!skb2) {
net_err_ratelimited("%s: Error: %s: skb_clone() failed\n",
bond_dev->name, __func__);
continue;
}
if (bond_dev_queue_xmit(bond, skb2, slave->dev) == NETDEV_TX_OK)
xmit_suc = true;
}
if (!skb_used)
dev_kfree_skb_any(skb);
dev_kfree_skb_any(skb);
if (xmit_suc)
return NETDEV_TX_OK;

6
drivers/net/ethernet/microsoft/mana/mana_en.c
View File

@ -2714,6 +2714,7 @@ static int add_adev(struct gdma_dev *gd)
struct auxiliary_device *adev;
struct mana_adev *madev;
int ret;
int id;
madev = kzalloc(sizeof(*madev), GFP_KERNEL);
if (!madev)
@ -2723,7 +2724,8 @@ static int add_adev(struct gdma_dev *gd)
ret = mana_adev_idx_alloc();
if (ret < 0)
goto idx_fail;
adev->id = ret;
id = ret;
adev->id = id;
adev->name = "rdma";
adev->dev.parent = gd->gdma_context->dev;
@ -2745,7 +2747,7 @@ add_fail:
auxiliary_device_uninit(adev);
init_fail:
mana_adev_idx_free(adev->id);
mana_adev_idx_free(id);
idx_fail:
kfree(madev);

30
drivers/nvme/target/tcp.c
View File

@ -364,6 +364,19 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
{
/*
* Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path.
* nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has
* already been consumed and queue teardown has started.
*
* If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues
* nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work()
* cancels it, the queue must not keep that old receive state.
* Otherwise the next nvmet_tcp_io_work() run can reach
* nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again.
*
* That is why queue->rcv_state needs to be updated before we return.
*/
queue->rcv_state = NVMET_TCP_RECV_ERR;
if (status == -EPIPE || status == -ECONNRESET)
kernel_sock_shutdown(queue->sock, SHUT_RDWR);
@ -890,10 +903,25 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
iov.iov_base = icresp;
iov.iov_len = sizeof(*icresp);
ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
if (ret < 0)
if (ret < 0) {
spin_lock_bh(&queue->state_lock);
if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
spin_unlock_bh(&queue->state_lock);
return -ESHUTDOWN;
}
queue->state = NVMET_TCP_Q_DISCONNECTING;
spin_unlock_bh(&queue->state_lock);
return ret; /* queue removal will cleanup */
}
spin_lock_bh(&queue->state_lock);
if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
spin_unlock_bh(&queue->state_lock);
/* Tell nvmet_tcp_socket_error() teardown is in progress. */
return -ESHUTDOWN;
}
queue->state = NVMET_TCP_Q_LIVE;
spin_unlock_bh(&queue->state_lock);
nvmet_prepare_receive_pdu(queue);
return 0;
}

1
include/net/tc_act/tc_pedit.h
View File

@ -14,7 +14,6 @@ struct tcf_pedit_key_ex {
struct tcf_pedit_parms {
struct tc_pedit_key *tcfp_keys;
struct tcf_pedit_key_ex *tcfp_keys_ex;
u32 tcfp_off_max_hint;
unsigned char tcfp_nkeys;
unsigned char tcfp_flags;
struct rcu_head rcu;

30
kernel/sched/core.c
View File

@ -5264,6 +5264,35 @@ static bool check_same_owner(struct task_struct *p)
return match;
}
#ifdef CONFIG_RT_MUTEXES
static inline void __setscheduler_dl_pi(int newprio, int policy,
struct task_struct *p,
int *flags)
{
/*
* In case a DEADLINE task (either proper or boosted) gets
* setscheduled to a lower priority class, check if it neeeds to
* inherit parameters from a potential pi_task. In that case make
* sure replenishment happens with the next enqueue.
*/
if (dl_prio(newprio) && !dl_policy(policy)) {
struct task_struct *pi_task = rt_mutex_get_top_task(p);
if (pi_task) {
p->pi_se = pi_task->pi_se;
*flags |= ENQUEUE_REPLENISH;
}
}
}
#else /* !CONFIG_RT_MUTEXES */
static inline void __setscheduler_dl_pi(int newprio, int policy,
struct task_struct *p,
int *flags)
{
}
#endif /* !CONFIG_RT_MUTEXES */
/*
* Allow unprivileged RT tasks to decrease priority.
* Only issue a capable test if needed and only once to avoid an audit
@ -5507,6 +5536,7 @@ change:
__setscheduler_params(p, attr);
__setscheduler_prio(p, newprio);
__setscheduler_dl_pi(newprio, policy, p, &queue_flags);
if (queued) {
/*

130
net/sched/act_pedit.c
View File

@ -18,6 +18,8 @@
#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/overflow.h>
#include <asm/unaligned.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <linux/tc_act/tc_pedit.h>
@ -239,7 +241,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
goto out_free_ex;
}
nparms->tcfp_off_max_hint = 0;
nparms->tcfp_flags = parm->flags;
nparms->tcfp_nkeys = parm->nkeys;
@ -252,21 +253,21 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
memcpy(nparms->tcfp_keys, parm->keys, ksize);
for (i = 0; i < nparms->tcfp_nkeys; ++i) {
u32 offmask = nparms->tcfp_keys[i].offmask;
u32 cur = nparms->tcfp_keys[i].off;
/* The AT option can be added to static offsets in the datapath */
if (!offmask && cur % 4) {
NL_SET_ERR_MSG_MOD(extack, "Offsets must be on 32bit boundaries");
ret = -EINVAL;
goto out_free_keys;
}
/* sanitize the shift value for any later use */
nparms->tcfp_keys[i].shift = min_t(size_t,
BITS_PER_TYPE(int) - 1,
nparms->tcfp_keys[i].shift);
/* The AT option can read a single byte, we can bound the actual
* value with uchar max.
*/
cur += (0xff & nparms->tcfp_keys[i].offmask) >> nparms->tcfp_keys[i].shift;
/* Each key touches 4 bytes starting from the computed offset */
nparms->tcfp_off_max_hint =
max(nparms->tcfp_off_max_hint, cur + 4);
}
p = to_pedit(*a);
@ -284,6 +285,8 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
return ret;
out_free_keys:
kfree(nparms->tcfp_keys);
put_chain:
if (goto_ch)
tcf_chain_put_by_act(goto_ch);
@ -307,48 +310,36 @@ static void tcf_pedit_cleanup(struct tc_action *a)
call_rcu(&parms->rcu, tcf_pedit_cleanup_rcu);
}
static bool offset_valid(struct sk_buff *skb, int offset)
static bool offset_valid(struct sk_buff *skb, int offset, int len)
{
if (offset > 0 && offset > skb->len)
if (offset < -(int)skb_headroom(skb))
return false;
if (offset < 0 && -offset > skb_headroom(skb))
return false;
return true;
return offset <= (int)skb->len - len;
}
static int pedit_skb_hdr_offset(struct sk_buff *skb,
enum pedit_header_type htype, int *hoffset)
static void pedit_skb_hdr_offset(struct sk_buff *skb,
enum pedit_header_type htype, int *hoffset)
{
int ret = -EINVAL;
/* 'htype' is validated in the netlink parsing */
switch (htype) {
case TCA_PEDIT_KEY_EX_HDR_TYPE_ETH:
if (skb_mac_header_was_set(skb)) {
if (skb_mac_header_was_set(skb))
*hoffset = skb_mac_offset(skb);
ret = 0;
}
break;
case TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK:
case TCA_PEDIT_KEY_EX_HDR_TYPE_IP4:
case TCA_PEDIT_KEY_EX_HDR_TYPE_IP6:
*hoffset = skb_network_offset(skb);
ret = 0;
break;
case TCA_PEDIT_KEY_EX_HDR_TYPE_TCP:
case TCA_PEDIT_KEY_EX_HDR_TYPE_UDP:
if (skb_transport_header_was_set(skb)) {
if (skb_transport_header_was_set(skb))
*hoffset = skb_transport_offset(skb);
ret = 0;
}
break;
default:
ret = -EINVAL;
break;
}
return ret;
}
TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
@ -361,18 +352,10 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
struct tcf_pedit_key_ex *tkey_ex;
struct tcf_pedit_parms *parms;
struct tc_pedit_key *tkey;
u32 max_offset;
int i;
parms = rcu_dereference_bh(p->parms);
max_offset = (skb_transport_header_was_set(skb) ?
skb_transport_offset(skb) :
skb_network_offset(skb)) +
parms->tcfp_off_max_hint;
if (skb_ensure_writable(skb, min(skb->len, max_offset)))
goto done;
tcf_lastuse_update(&p->tcf_tm);
tcf_action_update_bstats(&p->common, skb);
@ -380,11 +363,11 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
tkey_ex = parms->tcfp_keys_ex;
for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) {
int write_offset, write_len;
int offset = tkey->off;
u32 *ptr, hdata;
int hoffset;
u32 val;
int rc;
int hoffset = 0;
u32 cur_val, val;
u32 *ptr;
if (tkey_ex) {
htype = tkey_ex->htype;
@ -393,60 +376,75 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
tkey_ex++;
}
rc = pedit_skb_hdr_offset(skb, htype, &hoffset);
if (rc) {
pr_info("tc action pedit bad header type specified (0x%x)\n",
htype);
goto bad;
}
pedit_skb_hdr_offset(skb, htype, &hoffset);
if (tkey->offmask) {
u8 *d, _d;
int at_offset;
if (!offset_valid(skb, hoffset + tkey->at)) {
pr_info("tc action pedit 'at' offset %d out of bounds\n",
hoffset + tkey->at);
if (check_add_overflow(hoffset, (int)tkey->at, &at_offset) ||
!offset_valid(skb, at_offset, sizeof(_d))) {
pr_info_ratelimited("tc action pedit 'at' offset %d out of bounds\n",
hoffset + tkey->at);
goto bad;
}
d = skb_header_pointer(skb, hoffset + tkey->at,
d = skb_header_pointer(skb, at_offset,
sizeof(_d), &_d);
if (!d)
goto bad;
offset += (*d & tkey->offmask) >> tkey->shift;
if (offset % 4) {
pr_info_ratelimited("tc action pedit offset must be on 32 bit boundaries\n");
goto bad;
}
}
if (offset % 4) {
pr_info("tc action pedit offset must be on 32 bit boundaries\n");
if (check_add_overflow(hoffset, offset, &write_offset)) {
pr_info_ratelimited("tc action pedit offset overflow\n");
goto bad;
}
if (!offset_valid(skb, hoffset + offset)) {
pr_info("tc action pedit offset %d out of bounds\n",
hoffset + offset);
if (!offset_valid(skb, write_offset, sizeof(*ptr))) {
pr_info_ratelimited("tc action pedit offset %d out of bounds\n",
write_offset);
goto bad;
}
ptr = skb_header_pointer(skb, hoffset + offset,
sizeof(hdata), &hdata);
if (!ptr)
goto bad;
if (write_offset < 0) {
if (skb_cow(skb, -write_offset))
goto bad;
if (write_offset + (int)sizeof(*ptr) > 0) {
if (skb_ensure_writable(skb,
min_t(int, skb->len,
write_offset + (int)sizeof(*ptr))))
goto bad;
}
} else {
if (check_add_overflow(write_offset, (int)sizeof(*ptr),
&write_len))
goto bad;
if (skb_ensure_writable(skb, min_t(int, skb->len,
write_len)))
goto bad;
}
ptr = (u32 *)(skb->data + write_offset);
cur_val = get_unaligned(ptr);
/* just do it, baby */
switch (cmd) {
case TCA_PEDIT_KEY_EX_CMD_SET:
val = tkey->val;
break;
case TCA_PEDIT_KEY_EX_CMD_ADD:
val = (*ptr + tkey->val) & ~tkey->mask;
val = (cur_val + tkey->val) & ~tkey->mask;
break;
default:
pr_info("tc action pedit bad command (%d)\n",
cmd);
pr_info_ratelimited("tc action pedit bad command (%d)\n", cmd);
goto bad;
}
*ptr = ((*ptr & tkey->mask) ^ val);
if (ptr == &hdata)
skb_store_bits(skb, hoffset + offset, ptr, 4);
put_unaligned((cur_val & tkey->mask) ^ val, ptr);
}
goto done;

46
sound/drivers/aloop.c
View File

@ -98,6 +98,9 @@ struct loopback_ops {
struct loopback_cable {
spinlock_t lock;
struct loopback_pcm *streams[2];
/* in-flight peer stops running outside cable->lock */
atomic_t stop_count;
wait_queue_head_t stop_wait;
struct snd_pcm_hardware hw;
/* flags */
unsigned int valid;
@ -366,8 +369,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream)
goto unlock;
if (stream == SNDRV_PCM_STREAM_CAPTURE)
goto unlock_eio;
else if (cruntime->state == SNDRV_PCM_STATE_RUNNING)
else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) {
/* close must not free the peer runtime below */
atomic_inc(&cable->stop_count);
stop_capture = true;
}
}
setup = get_setup(dpcm_play);
@ -396,8 +402,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream)
}
spin_unlock_irqrestore(&cable->lock, flags);
if (stop_capture)
if (stop_capture) {
snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING);
if (atomic_dec_and_test(&cable->stop_count))
wake_up(&cable->stop_wait);
}
return 0;
@ -1055,24 +1064,29 @@ static void free_cable(struct snd_pcm_substream *substream)
struct loopback *loopback = substream->private_data;
int dev = get_cable_index(substream);
struct loopback_cable *cable;
struct loopback_pcm *dpcm;
bool other_alive;
cable = loopback->cables[substream->number][dev];
if (!cable)
return;
if (cable->streams[!substream->stream]) {
/* other stream is still alive */
spin_lock_irq(&cable->lock);
cable->streams[substream->stream] = NULL;
spin_unlock_irq(&cable->lock);
} else {
struct loopback_pcm *dpcm = substream->runtime->private_data;
if (cable->ops && cable->ops->close_cable && dpcm)
cable->ops->close_cable(dpcm);
/* free the cable */
loopback->cables[substream->number][dev] = NULL;
kfree(cable);
}
spin_lock_irq(&cable->lock);
cable->streams[substream->stream] = NULL;
other_alive = cable->streams[!substream->stream];
spin_unlock_irq(&cable->lock);
/* Pair with the stop_count increment in loopback_check_format(). */
wait_event(cable->stop_wait, !atomic_read(&cable->stop_count));
if (other_alive)
return;
dpcm = substream->runtime->private_data;
if (cable->ops && cable->ops->close_cable && dpcm)
cable->ops->close_cable(dpcm);
/* free the cable */
loopback->cables[substream->number][dev] = NULL;
kfree(cable);
}
static int loopback_jiffies_timer_open(struct loopback_pcm *dpcm)
@ -1267,6 +1281,8 @@ static int loopback_open(struct snd_pcm_substream *substream)
goto unlock;
}
spin_lock_init(&cable->lock);
atomic_set(&cable->stop_count, 0);
init_waitqueue_head(&cable->stop_wait);
cable->hw = loopback_pcm_hardware;
if (loopback->timer_source)
cable->ops = &loopback_snd_timer_ops;

37
sound/usb/endpoint.c
View File

@ -278,8 +278,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
}
static void prepare_silent_urb(struct snd_usb_endpoint *ep,
struct snd_urb_ctx *ctx)
static int prepare_silent_urb(struct snd_usb_endpoint *ep,
struct snd_urb_ctx *ctx)
{
struct urb *urb = ctx->urb;
unsigned int offs = 0;
@ -292,28 +292,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
extra = sizeof(packet_length);
for (i = 0; i < ctx->packets; ++i) {
unsigned int offset;
unsigned int length;
int counts;
int length;
counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
length = counts * ep->stride; /* number of silent bytes */
offset = offs * ep->stride + extra * i;
urb->iso_frame_desc[i].offset = offset;
length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
if (length < 0)
return length;
length *= ep->stride; /* number of silent bytes */
if (offs + length + extra > ctx->buffer_size)
break;
urb->iso_frame_desc[i].offset = offs;
urb->iso_frame_desc[i].length = length + extra;
if (extra) {
packet_length = cpu_to_le32(length);
memcpy(urb->transfer_buffer + offset,
memcpy(urb->transfer_buffer + offs,
&packet_length, sizeof(packet_length));
offs += extra;
}
memset(urb->transfer_buffer + offset + extra,
memset(urb->transfer_buffer + offs,
ep->silence_value, length);
offs += counts;
offs += length;
}
urb->number_of_packets = ctx->packets;
urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
if (!offs)
return -EPIPE;
urb->number_of_packets = i;
urb->transfer_buffer_length = offs;
ctx->queued = 0;
return 0;
}
/*
@ -335,8 +341,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
if (data_subs && ep->prepare_data_urb)
return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
/* no data provider, so send silence */
prepare_silent_urb(ep, ctx);
break;
return prepare_silent_urb(ep, ctx);
case SND_USB_ENDPOINT_TYPE_SYNC:
if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {