4.9.231-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.9.231-rc1 review
This is the start of the stable review cycle for the 4.9.231 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.231-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.231-rc1
Suraj Jitindar Singh <[email protected]>
x86/cpu: Move x86_cache_bits settings
Marc Zyngier <[email protected]>
irqchip/gic: Atomically update affinity
Vincent Guittot <[email protected]>
sched/fair: handle case of task_h_load() returning 0
Will Deacon <[email protected]>
arm64: ptrace: Override SPSR.SS when single-stepping is enabled
Michał Mirosław <[email protected]>
misc: atmel-ssc: lock with mutex instead of spinlock
Krzysztof Kozlowski <[email protected]>
dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
Vishwas M <[email protected]>
hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
Huacai Chen <[email protected]>
MIPS: Fix build for LTS kernel caused by backporting lpj adjustment
Frederic Weisbecker <[email protected]>
timer: Fix wheel index calculation on last level
Esben Haabendal <[email protected]>
uio_pdrv_genirq: fix use without device tree and no interrupt
David Pedersen <[email protected]>
Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
Alexander Usyskin <[email protected]>
mei: bus: don't clean driver pointer
Chirantan Ekbote <[email protected]>
fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
Alexander Lobakin <[email protected]>
virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
AceLan Kao <[email protected]>
USB: serial: option: add Quectel EG95 LTE modem
Jörgen Storvist <[email protected]>
USB: serial: option: add GosunCn GM500 series
Igor Moura <[email protected]>
USB: serial: ch341: add new Product ID for CH340
James Hilliard <[email protected]>
USB: serial: cypress_m8: enable Simply Automated UPB PIM
Johan Hovold <[email protected]>
USB: serial: iuu_phoenix: fix memory corruption
Zhang Qiang <[email protected]>
usb: gadget: function: fix missing spinlock in f_uac1_legacy
Peter Chen <[email protected]>
usb: chipidea: core: add wakeup support for extcon
Minas Harutyunyan <[email protected]>
usb: dwc2: Fix shutdown callback in platform
Tom Rix <[email protected]>
USB: c67x00: fix use after free in c67x00_giveback_urb
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix race against the error recovery URB submission
Takashi Iwai <[email protected]>
ALSA: line6: Perform sanity check for each URB creation
Takashi Iwai <[email protected]>
usb: core: Add a helper function to check the validity of EP type in URB
Dmitry Torokhov <[email protected]>
HID: magicmouse: do not set up autorepeat
Álvaro Fernández Rojas <[email protected]>
mtd: rawnand: brcmnand: fix CS0 layout
Jin Yao <[email protected]>
perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode
Krzysztof Kozlowski <[email protected]>
ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
Enric Balletbo i Serra <[email protected]>
Revert "thermal: mediatek: fix register index error"
Dan Carpenter <[email protected]>
staging: comedi: verify array index is correct before using it
Michał Mirosław <[email protected]>
usb: gadget: udc: atmel: fix uninitialized read in debug printk
Marc Kleine-Budde <[email protected]>
spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
Jonathan Cameron <[email protected]>
iio:health:afe4404 Fix timestamp alignment and prevent data leak.
Sasha Levin <[email protected]>
Revert "usb/ohci-platform: Fix a warning when hibernating"
Sasha Levin <[email protected]>
Revert "usb/xhci-plat: Set PM runtime as active on resume"
Sasha Levin <[email protected]>
Revert "usb/ehci-platform: Set PM runtime as active on resume"
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Fix node reference count
Angelo Dureghello <[email protected]>
spi: fix initial SPI_SR value in spi-fsl-dspi
Jonathan Cameron <[email protected]>
iio:health:afe4403 Fix timestamp alignment and prevent data leak.
Jonathan Cameron <[email protected]>
iio:pressure:ms5611 Fix buffer element alignment
Navid Emamdoost <[email protected]>
iio: pressure: zpa2326: handle pm_runtime_get_sync failure
Chuhong Yuan <[email protected]>
iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
Dinghao Liu <[email protected]>
iio: magnetometer: ak8974: Fix runtime PM imbalance on error
Jonathan Cameron <[email protected]>
iio:magnetometer:ak8974: Fix alignment and data leak issues
Andy Shevchenko <[email protected]>
i2c: eg20t: Load module automatically if ID matches
Cong Wang <[email protected]>
cgroup: Fix sock_cgroup_data on big-endian.
Cong Wang <[email protected]>
cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
Eric Dumazet <[email protected]>
tcp: md5: allow changing MD5 keys in all socket states
Eric Dumazet <[email protected]>
tcp: md5: do not send silly options in SYNCOOKIES
Christoph Paasch <[email protected]>
tcp: make sure listeners don't initialize congestion-control state
Sean Tranchetti <[email protected]>
genetlink: remove genl_bind
Eric Dumazet <[email protected]>
tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
Eric Dumazet <[email protected]>
tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
AceLan Kao <[email protected]>
net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
Martin Varghese <[email protected]>
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
Eric Dumazet <[email protected]>
llc: make sure applications use ARPHRD_ETHER
Xin Long <[email protected]>
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
Sabrina Dubroca <[email protected]>
ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
Janosch Frank <[email protected]>
s390/mm: fix huge pte soft dirty copying
Vineet Gupta <[email protected]>
ARC: elf: use right ELF_ARCH
Vineet Gupta <[email protected]>
ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE
Tom Rix <[email protected]>
drm/radeon: fix double free
Boris Burkov <[email protected]>
btrfs: fix fatal extent_buffer readahead vs releasepage race
Greg Kroah-Hartman <[email protected]>
Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
Paolo Bonzini <[email protected]>
KVM: x86: bit 8 of non-leaf PDPEs is not reserved
Will Deacon <[email protected]>
KVM: arm64: Fix definition of PAGE_HYP_DEVICE
Hector Martin <[email protected]>
ALSA: usb-audio: add quirk for MacroSilicon MS2109
Hui Wang <[email protected]>
ALSA: hda - let hs_mic be picked ahead of hp_mic
xidongwang <[email protected]>
ALSA: opl3: fix infoleak in opl3
Nicolas Ferre <[email protected]>
net: macb: mark device wake capable when "magic-packet" property present
Davide Caratti <[email protected]>
bnxt_en: fix NULL dereference in case SR-IOV configuration fails
Wei Li <[email protected]>
arm64: kgdb: Fix single-step exception handling oops
Vinod Koul <[email protected]>
ALSA: compress: fix partial_drain completion state
Andre Edich <[email protected]>
smsc95xx: avoid memory leak in smsc95xx_bind
Andre Edich <[email protected]>
smsc95xx: check return value of smsc95xx_reset
Li Heng <[email protected]>
net: cxgb4: fix return error value in t4_prep_fw
Tomas Henzl <[email protected]>
scsi: mptscsih: Fix read sense data size
yu kuai <[email protected]>
ARM: imx6: add missing put_device() call in imx6q_suspend_init()
Zhang Xiaoxu <[email protected]>
cifs: update ctime and mtime during truncate
Vasily Gorbik <[email protected]>
s390/kasan: fix early pgm check handler execution
Zhenzhong Duan <[email protected]>
spi: spidev: fix a potential use-after-free in spidev_release()
Zhenzhong Duan <[email protected]>
spi: spidev: fix a race between spidev_release and spidev_remove
Thierry Reding <[email protected]>
gpu: host1x: Detach driver on unregister
Christian Borntraeger <[email protected]>
KVM: s390: reduce number of IO pins to 1
-------------
Diffstat:
Makefile | 4 +- arch/arc/include/asm/elf.h | 2 +- arch/arc/kernel/entry.S | 16 +++----- arch/arm/boot/dts/socfpga.dtsi | 2 +- arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- arch/arm/mach-imx/pm-imx6.c | 10 +++-- arch/arm64/include/asm/debug-monitors.h | 2 + arch/arm64/include/asm/pgtable-prot.h | 2 +- arch/arm64/kernel/debug-monitors.c | 20 ++++++++-- arch/arm64/kernel/kgdb.c | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/mips/kernel/time.c | 13 ++----- arch/s390/include/asm/kvm_host.h | 8 ++-- arch/s390/kernel/early.c | 2 + arch/s390/mm/hugetlbpage.c | 2 +- arch/x86/kernel/cpu/common.c | 2 +- arch/x86/kvm/mmu.c | 2 +- drivers/char/virtio_console.c | 3 +- drivers/dma/fsl-edma.c | 7 ++++ drivers/gpu/drm/radeon/ci_dpm.c | 7 ++-- drivers/gpu/host1x/bus.c | 9 +++++ drivers/hid/hid-magicmouse.c | 6 +++ drivers/hwmon/emc2103.c | 2 +- drivers/i2c/busses/i2c-eg20t.c | 1 + drivers/iio/accel/mma8452.c | 5 ++- drivers/iio/health/afe4403.c | 13 ++++--- drivers/iio/health/afe4404.c | 8 ++-- drivers/iio/magnetometer/ak8974.c | 29 ++++++++------ drivers/iio/pressure/ms5611_core.c | 11 ++++-- drivers/iio/pressure/zpa2326.c | 4 +- drivers/input/serio/i8042-x86ia64io.h | 7 ++++ drivers/irqchip/irq-gic.c | 13 ++----- drivers/message/fusion/mptscsih.c | 4 +- drivers/misc/atmel-ssc.c | 24 ++++++------ drivers/misc/mei/bus.c | 3 +- drivers/mtd/nand/brcmnand/brcmnand.c | 5 ++- drivers/net/dsa/bcm_sf2.c | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- drivers/net/ethernet/cadence/macb.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 ++-- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/smsc95xx.c | 9 ++++- drivers/net/wireless/ath/ath9k/hif_usb.c | 48 ++++++----------------- drivers/net/wireless/ath/ath9k/hif_usb.h | 5 --- drivers/spi/spi-fsl-dspi.c | 2 +- drivers/spi/spi-sun6i.c | 14 +++---- drivers/spi/spidev.c | 24 ++++++------ drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++-- drivers/thermal/mtk_thermal.c | 6 +-- drivers/uio/uio_pdrv_genirq.c | 2 +- drivers/usb/c67x00/c67x00-sched.c | 2 +- drivers/usb/chipidea/core.c | 24 ++++++++++++ drivers/usb/core/urb.c | 30 ++++++++++++-- drivers/usb/dwc2/platform.c | 3 +- drivers/usb/gadget/function/f_uac1.c | 2 + drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- drivers/usb/host/ehci-platform.c | 5 --- drivers/usb/host/ohci-platform.c | 5 --- drivers/usb/host/xhci-plat.c | 11 +----- drivers/usb/serial/ch341.c | 1 + drivers/usb/serial/cypress_m8.c | 2 + drivers/usb/serial/cypress_m8.h | 3 ++ drivers/usb/serial/iuu_phoenix.c | 8 ++-- drivers/usb/serial/option.c | 6 +++ fs/btrfs/extent_io.c | 40 +++++++++++-------- fs/cifs/inode.c | 9 +++++ fs/fuse/file.c | 12 +++++- include/linux/cgroup-defs.h | 8 +++- include/linux/cgroup.h | 4 +- include/linux/usb.h | 2 + include/net/dst.h | 10 ++++- include/net/genetlink.h | 8 ---- include/sound/compress_driver.h | 10 ++++- kernel/cgroup.c | 24 +++++++++--- kernel/sched/fair.c | 10 ++++- kernel/time/timer.c | 4 +- net/core/sock.c | 2 +- net/ipv4/ping.c | 3 ++ net/ipv4/tcp.c | 15 ++++--- net/ipv4/tcp_cong.c | 2 +- net/ipv4/tcp_ipv4.c | 15 +++++-- net/ipv4/tcp_output.c | 10 +++-- net/l2tp/l2tp_core.c | 5 +-- net/llc/af_llc.c | 10 +++-- net/netlink/genetlink.c | 52 ------------------------- sound/core/compress_offload.c | 4 ++ sound/drivers/opl3/opl3_synth.c | 2 + sound/pci/hda/hda_auto_parser.c | 6 +++ sound/usb/line6/capture.c | 2 + sound/usb/line6/playback.c | 2 + sound/usb/midi.c | 17 +++++--- sound/usb/quirks-table.h | 52 +++++++++++++++++++++++++ tools/perf/util/stat.c | 6 ++- 93 files changed, 509 insertions(+), 332 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/86 KVM: s390: reduce number of IO pins to 1
From: Christian Borntraeger <[email protected]>
[ Upstream commit 774911290c589e98e3638e73b24b0a4d4530e97c ]
The current number of KVM_IRQCHIP_NUM_PINS results in an order 3 allocation (32kb) for each guest start/restart. This can result in OOM killer activity even with free swap when the memory is fragmented enough:
kernel: qemu-system-s39 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_COMP|__GFP_ZERO), order=3, oom_score_adj=0 kernel: CPU: 1 PID: 357274 Comm: qemu-system-s39 Kdump: loaded Not tainted 5.4.0-29-generic #33-Ubuntu kernel: Hardware name: IBM 8562 T02 Z06 (LPAR) kernel: Call Trace: kernel: ([<00000001f848fe2a>] show_stack+0x7a/0xc0) kernel: [<00000001f8d3437a>] dump_stack+0x8a/0xc0 kernel: [<00000001f8687032>] dump_header+0x62/0x258 kernel: [<00000001f8686122>] oom_kill_process+0x172/0x180 kernel: [<00000001f8686abe>] out_of_memory+0xee/0x580 kernel: [<00000001f86e66b8>] __alloc_pages_slowpath+0xd18/0xe90 kernel: [<00000001f86e6ad4>] __alloc_pages_nodemask+0x2a4/0x320 kernel: [<00000001f86b1ab4>] kmalloc_order+0x34/0xb0 kernel: [<00000001f86b1b62>] kmalloc_order_trace+0x32/0xe0 kernel: [<00000001f84bb806>] kvm_set_irq_routing+0xa6/0x2e0 kernel: [<00000001f84c99a4>] kvm_arch_vm_ioctl+0x544/0x9e0 kernel: [<00000001f84b8936>] kvm_vm_ioctl+0x396/0x760 kernel: [<00000001f875df66>] do_vfs_ioctl+0x376/0x690 kernel: [<00000001f875e304>] ksys_ioctl+0x84/0xb0 kernel: [<00000001f875e39a>] __s390x_sys_ioctl+0x2a/0x40 kernel: [<00000001f8d55424>] system_call+0xd8/0x2c8
As far as I can tell s390x does not use the iopins as we bail our for anything other than KVM_IRQ_ROUTING_S390_ADAPTER and the chip/pin is only used for KVM_IRQ_ROUTING_IRQCHIP. So let us use a small number to reduce the memory footprint.
--- arch/s390/include/asm/kvm_host.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/s390/include/asm/kvm_host.h +4 -4
@@ -32,12 +32,12 @@#define KVM_USER_MEM_SLOTS 32/* -* These seem to be used for allocating ->chip in the routing table, -* which we don't use. 4096 is an out-of-thin-air value. If we need -* to look at ->chip later on, we'll need to revisit this. +* These seem to be used for allocating ->chip in the routing table, which we +* don't use. 1 is as small as we can get to reduce the needed memory. If we +* need to look at ->chip later on, we'll need to revisit this. */ #define KVM_NR_IRQCHIPS 1 -#define KVM_IRQCHIP_NUM_PINS 4096 +#define KVM_IRQCHIP_NUM_PINS 1#define KVM_HALT_POLL_NS_DEFAULT 80000/* s390-specific vcpu->requests bit members */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 2/86 gpu: host1x: Detach driver on unregister
In reply to Greg Kroah-HartmanFrom: Thierry Reding <[email protected]>
[ Upstream commit d9a0a05bf8c76e6dc79230669a8b5d685b168c30 ]
Currently when a host1x device driver is unregistered, it is not detached from the host1x controller, which means that the device will stay around and when the driver is registered again, it may bind to the old, stale device rather than the new one that was created from scratch upon driver registration. This in turn can cause various weird crashes within the driver core because it is confronted with a device that was already deleted.
Fix this by detaching the driver from the host1x controller when it is unregistered. This ensures that the deleted device also is no longer present in the device list that drivers will bind to.
--- drivers/gpu/host1x/bus.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/host1x/bus.c +9 -0
@@ -542,8 +542,17 @@ EXPORT_SYMBOL(host1x_driver_register_full);void host1x_driver_unregister (struct host1x_driver *driver) { +struct host1x *host1x; +driver_unregister (&driver->driver); +mutex_lock (&devices_lock); + +list_for_each_entry (host1x, &devices, list) +host1x_detach_driver (host1x, driver); + +mutex_unlock (&devices_lock); +mutex_lock (&drivers_lock);list_del_init (&driver->list);mutex_unlock (&drivers_lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/86 spi: spidev: fix a race between spidev_release and spidev_remove
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
[ Upstream commit abd42781c3d2155868821f1b947ae45bbc33330d ]
Imagine below scene, spidev is referenced after it's freed.
spidev_release() spidev_remove()
...
spin_lock_irq(&spidev->spi_lock);
spidev->spi = NULL;
spin_unlock_irq(&spidev->spi_lock);
mutex_lock(&device_list_lock);
dofree = (spidev->spi == NULL);
if (dofree)
kfree(spidev);
mutex_unlock(&device_list_lock);
mutex_lock(&device_list_lock);
list_del(&spidev->device_entry);
device_destroy(spidev_class, spidev->devt);
clear_bit(MINOR(spidev->devt), minors);
if (spidev->users == 0)
kfree(spidev);
mutex_unlock(&device_list_lock);Fix it by resetting spidev->spi in device_list_lock's protection.
--- drivers/spi/spidev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spidev.c +2 -2
@@ -809,13 +809,13 @@ static int spidev_remove(struct spi_device *spi) {struct spidev_data *spidev =spi_get_drvdata (spi); +/* prevent new opens */ +mutex_lock (&device_list_lock);/* make sure ops on existing fds can abort cleanly */ spin_lock_irq (&spidev->spi_lock); spidev->spi =NULL ;spin_unlock_irq (&spidev->spi_lock); -/* prevent new opens */ -mutex_lock (&device_list_lock);list_del (&spidev->device_entry);device_destroy (spidev_class, spidev->devt);clear_bit (MINOR (spidev->devt), minors);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/86 spi: spidev: fix a potential use-after-free in spidev_release()
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
[ Upstream commit 06096cc6c5a84ced929634b0d79376b94c65a4bd ]
If an spi device is unbounded from the driver before the release process, there will be an NULL pointer reference when it's referenced in spi_slave_abort().
Fix it by checking it's already freed before reference.
--- drivers/spi/spidev.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/spi/spidev.c +10 -10
@@ -636,15 +636,20 @@ err_find_dev:static int spidev_release (struct inode *inode,struct file *filp) {struct spidev_data *spidev; +int dofree;mutex_lock (&device_list_lock); spidev = filp->private_data; filp->private_data =NULL ; +spin_lock_irq (&spidev->spi_lock); +/* ... after we unbound from the underlying device? */ + dofree = (spidev->spi ==NULL ); +spin_unlock_irq (&spidev->spi_lock); +/* last close? */ spidev->users--;if (!spidev->users) { -int dofree;kfree (spidev->tx_buffer); spidev->tx_buffer =NULL ;
@@ -652,19 +657,14 @@ static int spidev_release(struct inode *inode, struct file *filp)kfree (spidev->rx_buffer); spidev->rx_buffer =NULL ; -spin_lock_irq (&spidev->spi_lock); -if (spidev->spi) - spidev->speed_hz = spidev->spi->max_speed_hz; - -/* ... after we unbound from the underlying device? */ - dofree = (spidev->spi ==NULL ); -spin_unlock_irq (&spidev->spi_lock); -if (dofree)kfree (spidev); +else + spidev->speed_hz = spidev->spi->max_speed_hz; }#ifdef CONFIG_SPI_SLAVE -spi_slave_abort (spidev->spi); +if (!dofree) +spi_slave_abort (spidev->spi);#endif mutex_unlock (&device_list_lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/86 s390/kasan: fix early pgm check handler execution
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
[ Upstream commit 998f5bbe3dbdab81c1cfb1aef7c3892f5d24f6c7 ]
Currently if early_pgm_check_handler is called it ends up in pgm check loop. The problem is that early_pgm_check_handler is instrumented by KASAN but executed without DAT flag enabled which leads to addressing exception when KASAN checks try to access shadow memory.
Fix that by executing early handlers with DAT flag on under KASAN as expected.
--- arch/s390/kernel/early.c | 2 ++ 1 file changed, 2 insertions(+)
arch/s390/kernel/early.c +2 -0
@@ -288,6 +288,8 @@ static noinline __init void setup_lowcore_early(void)psw_t psw; psw.mask =PSW_MASK_BASE |PSW_DEFAULT_KEY |PSW_MASK_EA |PSW_MASK_BA ; +if (IS_ENABLED (CONFIG_KASAN )) + psw.mask |=PSW_MASK_DAT ; psw.addr = (unsigned long ) s390_base_ext_handler; S390_lowcore.external_new_psw = psw; psw.addr = (unsigned long ) s390_base_pgm_handler;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/86 cifs: update ctime and mtime during truncate
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
[ Upstream commit 5618303d8516f8ac5ecfe53ee8e8bc9a40eaf066 ]
As the man description of the truncate, if the size changed, then the st_ctime and st_mtime fields should be updated. But in cifs, we doesn't do it.
It lead the xfstests generic/313 failed.
So, add the ATTR_MTIME|ATTR_CTIME flags on attrs when change the file size
--- fs/cifs/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/cifs/inode.c +9 -0
@@ -2194,6 +2194,15 @@ set_size_out:if (rc ==0 ) { cifsInode->server_eof = attrs->ia_size;cifs_setsize (inode, attrs->ia_size); + +/* +* The man page of truncate says if the size changed, +* then the st_ctime and st_mtime fields for the file +* are updated. +*/ + attrs->ia_ctime = attrs->ia_mtime =current_time (inode); + attrs->ia_valid |=ATTR_CTIME |ATTR_MTIME ; +cifs_truncate_page (inode->i_mapping, inode->i_size); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/86 ARM: imx6: add missing put_device() call in imx6q_suspend_init()
In reply to Greg Kroah-HartmanFrom: yu kuai <[email protected]>
[ Upstream commit 4845446036fc9c13f43b54a65c9b757c14f5141b ]
if of_find_device_by_node() succeed, imx6q_suspend_init() doesn't have a corresponding put_device(). Thus add a jump target to fix the exception handling for this function implementation.
--- arch/arm/mach-imx/pm-imx6.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/arm/mach-imx/pm-imx6.c +6 -4
@@ -481,14 +481,14 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)if (!ocram_pool) {pr_warn ("%s: ocram pool unavailable!\n" , __func__); ret = -ENODEV ; - goto put_node; + goto put_device; } ocram_base =gen_pool_alloc (ocram_pool,MX6Q_SUSPEND_OCRAM_SIZE );if (!ocram_base) {pr_warn ("%s: unable to alloc ocram!\n" , __func__); ret = -ENOMEM ; - goto put_node; + goto put_device; } ocram_pbase =gen_pool_virt_to_phys (ocram_pool, ocram_base);
@@ -511,7 +511,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) ret =imx6_pm_get_base (&pm_info->mmdc_base, socdata->mmdc_compat);if (ret) {pr_warn ("%s: failed to get mmdc base %d!\n" , __func__, ret); - goto put_node; + goto put_device; } ret =imx6_pm_get_base (&pm_info->src_base, socdata->src_compat);
@@ -558,7 +558,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) &imx6_suspend, MX6Q_SUSPEND_OCRAM_SIZE - sizeof(*pm_info)); - goto put_node; + goto put_device; pl310_cache_map_failed:iounmap (pm_info->gpc_base.vbase);
@@ -568,6 +568,8 @@ iomuxc_map_failed:iounmap (pm_info->src_base.vbase); src_map_failed:iounmap (pm_info->mmdc_base.vbase); +put_device: +put_device (&pdev->dev); put_node:of_node_put (node);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/86 scsi: mptscsih: Fix read sense data size
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit afe89f115e84edbc76d316759e206580a06c6973 ]
The sense data buffer in sense_buf_pool is allocated with size of MPT_SENSE_BUFFER_ALLOC(64) (multiplied by req_depth) while SNS_LEN(sc)(96) is used when reading the data. That may lead to a read from unallocated area, sometimes from another (unallocated) page. To fix this, limit the read size to MPT_SENSE_BUFFER_ALLOC.
--- drivers/message/fusion/mptscsih.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/message/fusion/mptscsih.c +1 -3
@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state);int mptscsih_resume (struct pci_dev *pdev);#endif -#define SNS_LEN (scp) SCSI_SENSE_BUFFERSIZE -/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/ /*
@@ -2427,7 +2425,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR/* Copy the sense received into the scsi command block. */ req_index =le16_to_cpu (mf->u.frame.hwhdr.msgctxu.fld.req_idx); sense_data = ((u8 *)ioc->sense_buf_pool + (req_index *MPT_SENSE_BUFFER_ALLOC )); -memcpy (sc->sense_buffer, sense_data,SNS_LEN (sc)); +memcpy (sc->sense_buffer, sense_data,MPT_SENSE_BUFFER_ALLOC );/* Log SMART data (asc = 0x5D, non-IM case only) if required. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/86 net: cxgb4: fix return error value in t4_prep_fw
In reply to Greg Kroah-HartmanFrom: Li Heng <[email protected]>
[ Upstream commit 8a259e6b73ad8181b0b2ef338b35043433db1075 ]
t4_prep_fw goto bye tag with positive return value when something bad happened and which can not free resource in adap_init0. so fix it to return negative value.
--- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +4 -4
@@ -3152,7 +3152,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, drv_fw = &fw_info->fw_hdr;/* Read the header of the firmware on the card */ - ret = -t4_read_flash (adap,FLASH_FW_START , + ret =t4_read_flash (adap,FLASH_FW_START ,sizeof (*card_fw) /sizeof (uint32_t ), (uint32_t *)card_fw,1 );if (ret ==0 ) {
@@ -3181,8 +3181,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,should_install_fs_fw (adap, card_fw_usable,be32_to_cpu (fs_fw->fw_ver), be32_to_cpu(card_fw->fw_ver))) { - ret = -t4_fw_upgrade(adap, adap->mbox, fw_data, - fw_size,0 ); + ret = t4_fw_upgrade(adap, adap->mbox, fw_data, + fw_size,0 );if (ret !=0 ) {dev_err (adap->pdev_dev,"failed to install firmware: %d\n" , ret);
@@ -3213,7 +3213,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,FW_HDR_FW_VER_MICRO_G (c),FW_HDR_FW_VER_BUILD_G (c),FW_HDR_FW_VER_MAJOR_G (k),FW_HDR_FW_VER_MINOR_G (k), FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); - ret =EINVAL ; + ret = -EINVAL ; goto bye; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/86 smsc95xx: check return value of smsc95xx_reset
In reply to Greg Kroah-HartmanFrom: Andre Edich <[email protected]>
[ Upstream commit 7c8b1e855f94f88a0c569be6309fc8d5c8844cd1 ]
The return value of the function smsc95xx_reset() must be checked to avoid returning false success from the function smsc95xx_bind().
--- drivers/net/usb/smsc95xx.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/usb/smsc95xx.c +6 -0
@@ -1292,6 +1292,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)/* Init all registers */ ret =smsc95xx_reset (dev); +if (ret) + goto free_pdata;/* detect device revision as different features may be available */ ret =smsc95xx_read_reg (dev,ID_REV , &val);
@@ -1320,6 +1322,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)schedule_delayed_work (&pdata->carrier_check,CARRIER_CHECK_DELAY );return 0 ; + +free_pdata: +kfree (pdata); +return ret; }static void smsc95xx_unbind (struct usbnet *dev,struct usb_interface *intf)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/86 smsc95xx: avoid memory leak in smsc95xx_bind
In reply to Greg Kroah-HartmanFrom: Andre Edich <[email protected]>
[ Upstream commit 3ed58f96a70b85ef646d5427258f677f1395b62f ]
In a case where the ID_REV register read is failed, the memory for a private data structure has to be freed before returning error from the function smsc95xx_bind.
--- drivers/net/usb/smsc95xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/smsc95xx.c +2 -1
@@ -1298,7 +1298,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)/* detect device revision as different features may be available */ ret =smsc95xx_read_reg (dev,ID_REV , &val);if (ret <0 ) -return ret; + goto free_pdata; + val >>=16 ; pdata->chip_id = val; pdata->mdix_ctrl =get_mdix_status (dev->net);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/86 ALSA: compress: fix partial_drain completion state
In reply to Greg Kroah-HartmanFrom: Vinod Koul <[email protected]>
[ Upstream commit f79a732a8325dfbd570d87f1435019d7e5501c6d ]
On partial_drain completion we should be in SNDRV_PCM_STATE_RUNNING state, so set that for partially draining streams in snd_compr_drain_notify() and use a flag for partially draining streams
While at it, add locks for stream state change insnd_compr_drain_notify() as well.
--- include/sound/compress_driver.h | 10 +++++++++- sound/core/compress_offload.c | 4 ++++ 2 files changed, 13 insertions(+), 1 deletion(-)
include/sound/compress_driver.h +9 -1
@@ -72,6 +72,7 @@ struct snd_compr_runtime {* @direction: stream direction, playback/recording * @metadata_set: metadata set flag, true when set * @next_track: has userspace signal next track transition, true when set +* @partial_drain: undergoing partial_drain for stream, true when set * @private_data: pointer to DSP private data */ struct snd_compr_stream {
@@ -83,6 +84,7 @@ struct snd_compr_stream {enum snd_compr_direction direction;bool metadata_set;bool next_track; +bool partial_drain;void *private_data; };
@@ -185,7 +187,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)if (snd_BUG_ON (!stream))return ; - stream->runtime->state =SNDRV_PCM_STATE_SETUP ; +/* for partial_drain case we are back to running state on success */ +if (stream->partial_drain) { + stream->runtime->state =SNDRV_PCM_STATE_RUNNING ; + stream->partial_drain = false;/* clear this flag as well */ + }else { + stream->runtime->state =SNDRV_PCM_STATE_SETUP ; + }wake_up (&stream->runtime->sleep); }
sound/core/compress_offload.c +4 -0
@@ -723,6 +723,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream) retval = stream->ops->trigger (stream,SNDRV_PCM_TRIGGER_STOP );if (!retval) { +/* clear flags and stop any drain wait */ + stream->partial_drain = false; + stream->metadata_set = false;snd_compr_drain_notify (stream); stream->runtime->total_bytes_available =0 ; stream->runtime->total_bytes_transferred =0 ;
@@ -880,6 +883,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)if (stream->next_track == false)return -EPERM ; + stream->partial_drain = true; retval = stream->ops->trigger (stream,SND_COMPR_TRIGGER_PARTIAL_DRAIN );if (retval) {pr_debug ("Partial drain returned failure\n" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/86 arm64: kgdb: Fix single-step exception handling oops
In reply to Greg Kroah-HartmanFrom: Wei Li <[email protected]>
[ Upstream commit 8523c006264df65aac7d77284cc69aac46a6f842 ]
After entering kdb due to breakpoint, when we execute 'ss' or 'go' (will delay installing breakpoints, do single-step first), it won't work correctly, and it will enter kdb due to oops.
It's because the reason gotten in kdb_stub() is not as expected, and it seems that the ex_vector for single-step should be 0, like what arch powerpc/sh/parisc has implemented.
Before the patch:
Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry [0]kdb> bp printk
Instruction(i) BP #0 at 0xffff8000101486cc (printk)
is enabled addr at ffff8000101486cc, hardtype=0 installed=0
[0]kdb> g
/ # echo h > /proc/sysrq-trigger
Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 due to Breakpoint @ 0xffff8000101486cc [3]kdb> ss
Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 Oops: (null) due to oops @ 0xffff800010082ab8
CPU: 3 PID: 266 Comm: sh Not tainted 5.7.0-rc4-13839-gf0e5ad491718 #6 Hardware name: linux,dummy-virt (DT) pstate: 00000085 (nzcv daIf -PAN -UAO) pc : el1_irq+0x78/0x180 lr : __handle_sysrq+0x80/0x190
sp : ffff800015003bf0
x29: ffff800015003d20 x28: ffff0000fa878040
x27: 0000000000000000 x26: ffff80001126b1f0
x25: ffff800011b6a0d8 x24: 0000000000000000
x23: 0000000080200005 x22: ffff8000101486cc
x21: ffff800015003d30 x20: 0000ffffffffffff
x19: ffff8000119f2000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000
x9 : 0000000000000000 x8 : ffff800015003e50
x7 : 0000000000000002 x6 : 00000000380b9990
x5 : ffff8000106e99e8 x4 : ffff0000fadd83c0
x3 : 0000ffffffffffff x2 : ffff800011b6a0d8
x1 : ffff800011b6a000 x0 : ffff80001130c9d8
Call trace: el1_irq+0x78/0x180 printk+0x0/0x84 write_sysrq_trigger+0xb0/0x118 proc_reg_write+0xb4/0xe0 __vfs_write+0x18/0x40 vfs_write+0xb0/0x1b8 ksys_write+0x64/0xf0 __arm64_sys_write+0x14/0x20 el0_svc_common.constprop.2+0xb0/0x168 do_el0_svc+0x20/0x98 el0_sync_handler+0xec/0x1a8 el0_sync+0x140/0x180
[3]kdb>
After the patch:
Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry [0]kdb> bp printk
Instruction(i) BP #0 at 0xffff8000101486cc (printk)
is enabled addr at ffff8000101486cc, hardtype=0 installed=0
[0]kdb> g
/ # echo h > /proc/sysrq-trigger
Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc [0]kdb> g
Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc [0]kdb> ss
Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to SS trap @ 0xffff800010082ab8 [0]kdb>
--- arch/arm64/kernel/kgdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/kgdb.c +1 -1
@@ -256,7 +256,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr)if (user_mode (regs))return DBG_HOOK_ERROR ; -kgdb_handle_exception (1 ,SIGTRAP ,0 , regs); +kgdb_handle_exception (0 ,SIGTRAP ,0 , regs);return DBG_HOOK_HANDLED ; }NOKPROBE_SYMBOL (kgdb_step_brk_fn);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/86 bnxt_en: fix NULL dereference in case SR-IOV configuration fails
In reply to Greg Kroah-HartmanFrom: Davide Caratti <[email protected]>
[ Upstream commit c8b1d7436045d3599bae56aef1682813ecccaad7 ]
we need to set 'active_vfs' back to 0, if something goes wrong during the allocation of SR-IOV resources: otherwise, further VF configurations will wrongly assume that bp->pf.vf[x] are valid memory locations, and commands like the ones in the following sequence:
# echo 2 >/sys/bus/pci/devices/${ADDR}/sriov_numvfs
# ip link set dev ens1f0np0 up
# ip link set dev ens1f0np0 vf 0 trust onwill cause a kernel crash similar to this:
bnxt_en 0000:3b:00.0: not enough MMIO resources for SR-IOV
BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 43 PID: 2059 Comm: ip Tainted: G I 5.8.0-rc2.upstream+ #871 Hardware name: Dell Inc. PowerEdge R740/08D89F, BIOS 2.2.11 06/13/2019 RIP: 0010:bnxt_set_vf_trust+0x5b/0x110 [bnxt_en] Code: 44 24 58 31 c0 e8 f5 fb ff ff 85 c0 0f 85 b6 00 00 00 48 8d 1c 5b 41 89 c6 b9 0b 00 00 00 48 c1 e3 04 49 03 9c 24 f0 0e 00 00 <8b> 43 14 89 c2 83 c8 10 83 e2 ef 45 84 ed 49 89 e5 0f 44 c2 4c 89 RSP: 0018:ffffac6246a1f570 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000b RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff98b28f538900 RBP: ffff98b28f538900 R08: 0000000000000000 R09: 0000000000000008 R10: ffffffffb9515be0 R11: ffffac6246a1f678 R12: ffff98b28f538000 R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffc05451e0 FS: 00007fde0f688800(0000) GS:ffff98baffd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000104bb0a003 CR4: 00000000007606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: do_setlink+0x994/0xfe0 __rtnl_newlink+0x544/0x8d0 rtnl_newlink+0x47/0x70 rtnetlink_rcv_msg+0x29f/0x350 netlink_rcv_skb+0x4a/0x110 netlink_unicast+0x21d/0x300 netlink_sendmsg+0x329/0x450 sock_sendmsg+0x5b/0x60 ____sys_sendmsg+0x204/0x280 ___sys_sendmsg+0x88/0xd0 __sys_sendmsg+0x5e/0xa0 do_syscall_64+0x47/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +1 -1
@@ -342,6 +342,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp) } } + bp->pf.active_vfs =0 ;kfree (bp->pf.vf); bp->pf.vf =NULL ; }
@@ -590,7 +591,6 @@ void bnxt_sriov_disable(struct bnxt *bp)bnxt_free_vf_resources (bp); - bp->pf.active_vfs =0 ;/* Reclaim all resources for the PF. */ bnxt_hwrm_func_qcaps (bp); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/86 net: macb: mark device wake capable when "magic-packet" property present
In reply to Greg Kroah-HartmanFrom: Nicolas Ferre <[email protected]>
[ Upstream commit ced4799d06375929e013eea04ba6908207afabbe ]
Change the way the "magic-packet" DT property is handled in the macb_probe() function, matching DT binding documentation. Now we mark the device as "wakeup capable" instead of calling the device_init_wakeup() function that would enable the wakeup source.
For Ethernet WoL, enabling the wakeup_source is done by using ethtool and associated macb_set_wol() function that already calls device_set_wakeup_enable() for this purpose.
That would reduce power consumption by cutting more clocks if "magic-packet" property is set but WoL is not configured by ethtool.
--- drivers/net/ethernet/cadence/macb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb.c +1 -1
@@ -3024,7 +3024,7 @@ static int macb_probe(struct platform_device *pdev) bp->wol =0 ;if (of_get_property (np,"magic-packet" ,NULL )) bp->wol |=MACB_WOL_HAS_MAGIC_PACKET ; -device_init_wakeup (&pdev->dev, bp->wol &MACB_WOL_HAS_MAGIC_PACKET ); +device_set_wakeup_capable (&pdev->dev, bp->wol &MACB_WOL_HAS_MAGIC_PACKET );#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT if (GEM_BFEXT (DBWDEF ,gem_readl (bp,DCFG1 )) >GEM_DBW32 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 16/86 ALSA: opl3: fix infoleak in opl3
In reply to Greg Kroah-HartmanFrom: xidongwang <[email protected]>
commit ad155712bb1ea2151944cf06a0e08c315c70c1e3 upstream.
The stack object “info” in snd_opl3_ioctl() has a leaking problem. It has 2 padding bytes which are not initialized and leaked via “copy_to_user”.
--- sound/drivers/opl3/opl3_synth.c | 2 ++ 1 file changed, 2 insertions(+)
sound/drivers/opl3/opl3_synth.c +2 -0
@@ -104,6 +104,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw {struct snd_dm_fm_info info; +memset (&info,0 ,sizeof (info)); + info.fm_mode = opl3->fm_mode; info.rhythm = opl3->rhythm;if (copy_to_user (argp, &info,sizeof (struct snd_dm_fm_info )))
Greg Kroah-Hartman
maintainerPATCH 17/86 ALSA: hda - let hs_mic be picked ahead of hp_mic
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
commit 6a6ca7881b1ab1c13fe0d70bae29211a65dd90de upstream.
We have a Dell AIO, there is neither internal speaker nor internal mic, only a multi-function audio jack on it.
Users reported that after freshly installing the OS and plug a headset to the audio jack, the headset can't output sound. I reproduced this bug, at that moment, the Input Source is as below:
Simple mixer control 'Input Source',0
Capabilities: cenum
Items: 'Headphone Mic' 'Headset Mic'
Item0: 'Headphone Mic'
That is because the patch_realtek will set this audio jack as mic_in mode if Input Source's value is hp_mic.
If it is not fresh installing, this issue will not happen since the systemd will run alsactl restore -f /var/lib/alsa/asound.state, this will set the 'Input Source' according to history value.
If there is internal speaker or internal mic, this issue will not happen since there is valid sink/source in the pulseaudio, the PA will set the 'Input Source' according to active_port.
To fix this issue, change the parser function to let the hs_mic be stored ahead of hp_mic.
--- sound/pci/hda/hda_auto_parser.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/hda/hda_auto_parser.c +6 -0
@@ -76,6 +76,12 @@ static int compare_input_type(const voidif (a->type != b->type)return (int )(a->type - b->type); +/* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */ +if (a->is_headset_mic && b->is_headphone_mic) +return -1 ;/* don't swap */ +else if (a->is_headphone_mic && b->is_headset_mic) +return 1 ;/* swap */ +/* In case one has boost and the other one has not, pick the one with boost first. */ return (int )(b->has_boost_on_pin - a->has_boost_on_pin);
Greg Kroah-Hartman
maintainerPATCH 18/86 ALSA: usb-audio: add quirk for MacroSilicon MS2109
In reply to Greg Kroah-HartmanFrom: Hector Martin <[email protected]>
commit e337bf19f6af38d5c3fa6d06cd594e0f890ca1ac upstream.
These devices claim to be 96kHz mono, but actually are 48kHz stereo with swapped channels and unaligned transfers.
--- sound/usb/quirks-table.h | 52 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+)
sound/usb/quirks-table.h +52 -0
@@ -3323,4 +3323,56 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge } }, +/* +* MacroSilicon MS2109 based HDMI capture cards +* +* These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch. +* They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if +* they pretend to be 96kHz mono as a workaround for stereo being broken +* by that... +* +* They also have swapped L-R channels, but that's for userspace to deal +* with. +*/ +{ + USB_DEVICE(0x534d, 0x2109), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .vendor_name ="MacroSilicon" , + .product_name ="MS2109" , + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = &(const struct snd_usb_audio_quirk []) { + { + .ifnum =2 , + .type =QUIRK_AUDIO_ALIGN_TRANSFER , + }, + { + .ifnum =2 , + .type =QUIRK_AUDIO_STANDARD_MIXER , + }, + { + .ifnum =3 , + .type =QUIRK_AUDIO_FIXED_ENDPOINT , + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S16_LE , + .channels =2 , + .iface =3 , + .altsetting =1 , + .altset_idx =1 , + .attributes =0 , + .endpoint =0x82 , + .ep_attr =USB_ENDPOINT_XFER_ISOC | +USB_ENDPOINT_SYNC_ASYNC , + .rates =SNDRV_PCM_RATE_CONTINUOUS , + .rate_min =48000 , + .rate_max =48000 , + } + }, + { + .ifnum =-1 + } + } + } +}, + #undef USB_DEVICE_VENDOR_SPEC
Greg Kroah-Hartman
maintainerPATCH 19/86 KVM: arm64: Fix definition of PAGE_HYP_DEVICE
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 68cf617309b5f6f3a651165f49f20af1494753ae upstream.
PAGE_HYP_DEVICE is intended to encode attribute bits for an EL2 stage-1 pte mapping a device. Unfortunately, it includes PROT_DEVICE_nGnRE which encodes attributes for EL1 stage-1 mappings such as UXN and nG, which are RES0 for EL2, and DBM which is meaningless as TCR_EL2.HD is not set.
Fix the definition of PAGE_HYP_DEVICE so that it doesn't set RES0 bits at EL2.
--- arch/arm64/include/asm/pgtable-prot.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/pgtable-prot.h +1 -1
@@ -65,7 +65,7 @@#define PAGE_HYP __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_HYP_XN)#define PAGE_HYP_EXEC __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY)#define PAGE_HYP_RO __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY | PTE_HYP_XN) -#define PAGE_HYP_DEVICE __pgprot(PROT_DEVICE_nGnRE | PTE_HYP) +#define PAGE_HYP_DEVICE __pgprot(_PROT_DEFAULT | PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_HYP | PTE_HYP_XN)#define PAGE_S2 __pgprot(_PROT_DEFAULT | PTE_S2_MEMATTR(MT_S2_NORMAL) | PTE_S2_RDONLY)#define PAGE_S2_DEVICE __pgprot(_PROT_DEFAULT | PTE_S2_MEMATTR(MT_S2_DEVICE_nGnRE) | PTE_S2_RDONLY | PTE_UXN)
Greg Kroah-Hartman
maintainerPATCH 20/86 KVM: x86: bit 8 of non-leaf PDPEs is not reserved
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 5ecad245de2ae23dc4e2dbece92f8ccfbaed2fa7 upstream.
Bit 8 would be the "global" bit, which does not quite make sense for non-leaf page table entries. Intel ignores it; AMD ignores it in PDEs and PDPEs, but reserves it in PML4Es.
Probably, earlier versions of the AMD manual documented it as reserved in PDPEs as well, and that behavior made it into KVM as well as kvm-unit-tests; fix it.
--- arch/x86/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/mmu.c +1 -1
@@ -3849,7 +3849,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu nonleaf_bit8_rsvd |rsvd_bits (7 ,7 ) |rsvd_bits (maxphyaddr,51 ); rsvd_check->rsvd_bits_mask[0 ][2 ] = exb_bit_rsvd | - nonleaf_bit8_rsvd | gbpages_bit_rsvd | + gbpages_bit_rsvd |rsvd_bits (maxphyaddr,51 ); rsvd_check->rsvd_bits_mask[0 ][1 ] = exb_bit_rsvd |rsvd_bits (maxphyaddr,51 );
Greg Kroah-Hartman
maintainerPATCH 21/86 Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
This reverts commit 5317abc46279d900c7e63cc122682d819da658bd which is commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.
It is being reverted upstream, just hasn't made it there yet and is causing lots of problems.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 48 +++++++------------------------ drivers/net/wireless/ath/ath9k/hif_usb.h | 5 --- 2 files changed, 11 insertions(+), 42 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +11 -37
@@ -641,9 +641,9 @@ err:static void ath9k_hif_usb_rx_cb (struct urb *urb) { -struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -struct hif_device_usb *hif_dev = rx_buf->hif_dev; -struct sk_buff *skb = rx_buf->skb; +struct sk_buff *skb = (struct sk_buff *) urb->context; +struct hif_device_usb *hif_dev = +usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 ));int ret;if (!skb)
@@ -683,15 +683,14 @@ resubmit:return ; free:kfree_skb (skb); -kfree (rx_buf); }static void ath9k_hif_usb_reg_in_cb (struct urb *urb) { -struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -struct hif_device_usb *hif_dev = rx_buf->hif_dev; -struct sk_buff *skb = rx_buf->skb; +struct sk_buff *skb = (struct sk_buff *) urb->context;struct sk_buff *nskb; +struct hif_device_usb *hif_dev = +usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 ));int ret;if (!skb)
@@ -749,7 +748,6 @@ resubmit:return ; free:kfree_skb (skb); -kfree (rx_buf); urb->context =NULL ; }
@@ -795,7 +793,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(sinit_usb_anchor (&hif_dev->mgmt_submitted);for (i =0 ; i <MAX_TX_URB_NUM ; i++) { - tx_buf =kzalloc (sizeof (*tx_buf),GFP_KERNEL ); + tx_buf =kzalloc (sizeof (struct tx_buf ),GFP_KERNEL );if (!tx_buf) goto err;
@@ -832,9 +830,8 @@ static void ath9k_hif_usb_dealloc_rx_urbstatic int ath9k_hif_usb_alloc_rx_urbs (struct hif_device_usb *hif_dev) { -struct rx_buf *rx_buf =NULL ; -struct sk_buff *skb =NULL ;struct urb *urb =NULL ; +struct sk_buff *skb =NULL ;int i, ret;init_usb_anchor (&hif_dev->rx_submitted);
@@ -842,12 +839,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(sfor (i =0 ; i <MAX_RX_URB_NUM ; i++) { - rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); -if (!rx_buf) { - ret = -ENOMEM ; - goto err_rxb; - } -/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -862,14 +853,11 @@ static int ath9k_hif_usb_alloc_rx_urbs(s goto err_skb; } - rx_buf->hif_dev = hif_dev; - rx_buf->skb = skb; -usb_fill_bulk_urb (urb, hif_dev->udev,usb_rcvbulkpipe (hif_dev->udev,USB_WLAN_RX_PIPE ), skb->data,MAX_RX_BUF_SIZE , - ath9k_hif_usb_rx_cb, rx_buf); + ath9k_hif_usb_rx_cb, skb);/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->rx_submitted);
@@ -895,8 +883,6 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: -kfree (rx_buf); -err_rxb:ath9k_hif_usb_dealloc_rx_urbs (hif_dev);return ret; }
@@ -908,21 +894,14 @@ static void ath9k_hif_usb_dealloc_reg_instatic int ath9k_hif_usb_alloc_reg_in_urbs (struct hif_device_usb *hif_dev) { -struct rx_buf *rx_buf =NULL ; -struct sk_buff *skb =NULL ;struct urb *urb =NULL ; +struct sk_buff *skb =NULL ;int i, ret;init_usb_anchor (&hif_dev->reg_in_submitted);for (i =0 ; i <MAX_REG_IN_URB_NUM ; i++) { - rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); -if (!rx_buf) { - ret = -ENOMEM ; - goto err_rxb; - } -/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -937,14 +916,11 @@ static int ath9k_hif_usb_alloc_reg_in_ur goto err_skb; } - rx_buf->hif_dev = hif_dev; - rx_buf->skb = skb; -usb_fill_int_urb (urb, hif_dev->udev,usb_rcvintpipe (hif_dev->udev,USB_REG_IN_PIPE ), skb->data,MAX_REG_IN_BUF_SIZE , - ath9k_hif_usb_reg_in_cb, rx_buf,1 ); + ath9k_hif_usb_reg_in_cb, skb,1 );/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->reg_in_submitted);
@@ -970,8 +946,6 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: -kfree (rx_buf); -err_rxb:ath9k_hif_usb_dealloc_reg_in_urbs (hif_dev);return ret; }
drivers/net/wireless/ath/ath9k/hif_usb.h +0 -5
@@ -84,11 +84,6 @@ struct tx_buf {struct list_head list; }; -struct rx_buf { -struct sk_buff *skb; -struct hif_device_usb *hif_dev; -}; -#define HIF_USB_TX_STOP BIT(0)#define HIF_USB_TX_FLUSH BIT(1)
Greg Kroah-Hartman
maintainerPATCH 22/86 btrfs: fix fatal extent_buffer readahead vs releasepage race
In reply to Greg Kroah-HartmanFrom: Boris Burkov <[email protected]>
commit 6bf9cd2eed9aee6d742bb9296c994a91f5316949 upstream.
Under somewhat convoluted conditions, it is possible to attempt to release an extent_buffer that is under io, which triggers a BUG_ON in btrfs_release_extent_buffer_pages.
This relies on a few different factors. First, extent_buffer reads done as readahead for searching use WAIT_NONE, so they free the local extent buffer reference while the io is outstanding. However, they should still be protected by TREE_REF. However, if the system is doing signficant reclaim, and simultaneously heavily accessing the extent_buffers, it is possible for releasepage to race with two concurrent readahead attempts in a way that leaves TREE_REF unset when the readahead extent buffer is released.
Essentially, if two tasks race to allocate a new extent_buffer, but the winner who attempts the first io is rebuffed by a page being locked (likely by the reclaim itself) then the loser will still go ahead with issuing the readahead. The loser's call to find_extent_buffer must also race with the reclaim task reading the extent_buffer's refcount as 1 in a way that allows the reclaim to re-clear the TREE_REF checked by find_extent_buffer.
The following represents an example execution demonstrating the race:
CPU0 CPU1 CPU2reada_for_search reada_for_search
readahead_tree_block readahead_tree_block
find_create_tree_block find_create_tree_block
alloc_extent_buffer alloc_extent_buffer
find_extent_buffer // not found
allocates eb
lock pages
associate pages to eb
insert eb into radix tree
set TREE_REF, refs == 2
unlock pages
read_extent_buffer_pages // WAIT_NONE
not uptodate (brand new eb)
lock_page
if !trylock_page
goto unlock_exit // not an error
free_extent_buffer
release_extent_buffer
atomic_dec_and_test refs to 1
find_extent_buffer // found
try_release_extent_buffer
take refs_lock reads refs == 1; no io
atomic_inc_not_zero refs to 2
mark_buffer_accessed
check_buffer_tree_ref
// not STALE, won't take refs_lock
refs == 2; TREE_REF set // no action
read_extent_buffer_pages // WAIT_NONE
clear TREE_REF release_extent_buffer
atomic_dec_and_test refs to 1 unlock_page
still not uptodate (CPU1 read failed on trylock_page)
locks pages
set io_pages > 0
submit io
return
free_extent_buffer
release_extent_buffer
dec refs to 0
delete from radix tree
btrfs_release_extent_buffer_pages
BUG_ON(io_pages > 0)!!!
We observe this at a very low rate in production and were also able to reproduce it in a test environment by introducing some spurious delays and by introducing probabilistic trylock_page failures.
To fix it, we apply check_tree_ref at a point where it could not possibly be unset by a competing task: after io_pages has been incremented. All the codepaths that clear TREE_REF check for io, so they would not be able to clear it after this point until the io is done.
Stack trace, for reference:
[1417839.424739] ------------[ cut here ]------------ [1417839.435328] kernel BUG at fs/btrfs/extent_io.c:4841! [1417839.447024] invalid opcode: 0000 [#1] SMP [1417839.502972] RIP: 0010:btrfs_release_extent_buffer_pages+0x20/0x1f0 [1417839.517008] Code: ed e9 ... [1417839.558895] RSP: 0018:ffffc90020bcf798 EFLAGS: 00010202 [1417839.570816] RAX: 0000000000000002 RBX: ffff888102d6def0 RCX: 0000000000000028 [1417839.586962] RDX: 0000000000000002 RSI: ffff8887f0296482 RDI: ffff888102d6def0 [1417839.603108] RBP: ffff88885664a000 R08: 0000000000000046 R09: 0000000000000238 [1417839.619255] R10: 0000000000000028 R11: ffff88885664af68 R12: 0000000000000000 [1417839.635402] R13: 0000000000000000 R14: ffff88875f573ad0 R15: ffff888797aafd90 [1417839.651549] FS: 00007f5a844fa700(0000) GS:ffff88885f680000(0000) knlGS:0000000000000000 [1417839.669810] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1417839.682887] CR2: 00007f7884541fe0 CR3: 000000049f609002 CR4: 00000000003606e0 [1417839.699037] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1417839.715187] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1417839.731320] Call Trace: [1417839.737103] release_extent_buffer+0x39/0x90 [1417839.746913] read_block_for_search.isra.38+0x2a3/0x370 [1417839.758645] btrfs_search_slot+0x260/0x9b0 [1417839.768054] btrfs_lookup_file_extent+0x4a/0x70 [1417839.778427] btrfs_get_extent+0x15f/0x830 [1417839.787665] ? submit_extent_page+0xc4/0x1c0 [1417839.797474] ? __do_readpage+0x299/0x7a0 [1417839.806515] __do_readpage+0x33b/0x7a0 [1417839.815171] ? btrfs_releasepage+0x70/0x70 [1417839.824597] extent_readpages+0x28f/0x400 [1417839.833836] read_pages+0x6a/0x1c0 [1417839.841729] ? startup_64+0x2/0x30 [1417839.849624] __do_page_cache_readahead+0x13c/0x1a0 [1417839.860590] filemap_fault+0x6c7/0x990 [1417839.869252] ? xas_load+0x8/0x80 [1417839.876756] ? xas_find+0x150/0x190 [1417839.884839] ? filemap_map_pages+0x295/0x3b0 [1417839.894652] __do_fault+0x32/0x110 [1417839.902540] __handle_mm_fault+0xacd/0x1000 [1417839.912156] handle_mm_fault+0xaa/0x1c0 [1417839.921004] __do_page_fault+0x242/0x4b0 [1417839.930044] ? page_fault+0x8/0x30 [1417839.937933] page_fault+0x1e/0x30 [1417839.945631] RIP: 0033:0x33c4bae [1417839.952927] Code: Bad RIP value. [1417839.960411] RSP: 002b:00007f5a844f7350 EFLAGS: 00010206 [1417839.972331] RAX: 000000000000006e RBX: 1614b3ff6a50398a RCX: 0000000000000000 [1417839.988477] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [1417840.004626] RBP: 00007f5a844f7420 R08: 000000000000006e R09: 00007f5a94aeccb8 [1417840.020784] R10: 00007f5a844f7350 R11: 0000000000000000 R12: 00007f5a94aecc79 [1417840.036932] R13: 00007f5a94aecc78 R14: 00007f5a94aecc90 R15: 00007f5a94aecc40
--- fs/btrfs/extent_io.c | 40 ++++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-)
fs/btrfs/extent_io.c +24 -16
@@ -4907,25 +4907,28 @@ struct extent_buffer *alloc_dummy_extentstatic void check_buffer_tree_ref (struct extent_buffer *eb) {int refs; -/* the ref bit is tricky. We have to make sure it is set -* if we have the buffer dirty. Otherwise the -* code to free a buffer can end up dropping a dirty -* page +/* +* The TREE_REF bit is first set when the extent_buffer is added +* to the radix tree. It is also reset, if unset, when a new reference +* is created by find_extent_buffer. * -* Once the ref bit is set, it won't go away while the -* buffer is dirty or in writeback, and it also won't -* go away while we have the reference count on the -* eb bumped. +* It is only cleared in two cases: freeing the last non-tree +* reference to the extent_buffer when its STALE bit is set or +* calling releasepage when the tree reference is the only reference. * -* We can't just set the ref bit without bumping the -* ref on the eb because free_extent_buffer might -* see the ref bit and try to clear it. If this happens -* free_extent_buffer might end up dropping our original -* ref by mistake and freeing the page before we are able -* to add one more ref. +* In both cases, care is taken to ensure that the extent_buffer's +* pages are not under io. However, releasepage can be concurrently +* called with creating new references, which is prone to race +* conditions between the calls to check_buffer_tree_ref in those +* codepaths and clearing TREE_REF in try_release_extent_buffer. * -* So bump the ref count first, then set the bit. If someone -* beat us to it, drop the ref we added. +* The actual lifetime of the extent_buffer in the radix tree is +* adequately protected by the refcount, but the TREE_REF bit and +* its corresponding reference are not. To protect against this +* class of races, we call check_buffer_tree_ref from the codepaths +* which trigger io after they set eb->io_pages. Note that once io is +* initiated, TREE_REF can no longer be cleared, so that is the +* moment at which any such race is best fixed. */ refs =atomic_read (&eb->refs);if (refs >=2 &&test_bit (EXTENT_BUFFER_TREE_REF , &eb->bflags))
@@ -5389,6 +5392,11 @@ int read_extent_buffer_pages(struct exteclear_bit (EXTENT_BUFFER_READ_ERR , &eb->bflags); eb->read_mirror =0 ;atomic_set (&eb->io_pages, num_reads); +/* +* It is possible for releasepage to clear the TREE_REF bit before we +* set io_pages. See check_buffer_tree_ref for a more detailed comment. +*/ +check_buffer_tree_ref (eb);for (i =0 ; i < num_pages; i++) { page = eb->pages[i];
Greg Kroah-Hartman
maintainerPATCH 23/86 drm/radeon: fix double free
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit 41855a898650803e24b284173354cc3e44d07725 upstream.
clang static analysis flags this error
drivers/gpu/drm/radeon/ci_dpm.c:5652:9: warning: Use of memory after it is freed [unix.Malloc]
kfree(rdev->pm.dpm.ps[i].ps_priv);
^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/radeon/ci_dpm.c:5654:2: warning: Attempt to free released memory [unix.Malloc]
kfree(rdev->pm.dpm.ps);
^~~~~~~~~~~~~~~~~~~~~~problem is reported in ci_dpm_fini, with these code blocks.
for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
kfree(rdev->pm.dpm.ps[i].ps_priv);
}
kfree(rdev->pm.dpm.ps);The first free happens in ci_parse_power_table where it cleans up locally on a failure. ci_dpm_fini also does a cleanup.
ret = ci_parse_power_table(rdev);
if (ret) {
ci_dpm_fini(rdev);
return ret;
}So remove the cleanup in ci_parse_power_table and move the num_ps calculation to inside the loop so ci_dpm_fini will know how many array elements to free.
--- drivers/gpu/drm/radeon/ci_dpm.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/ci_dpm.c +3 -4
@@ -5557,6 +5557,7 @@ static int ci_parse_power_table(struct rif (!rdev->pm.dpm.ps)return -ENOMEM ; power_state_offset = (u8 *)state_array->states; + rdev->pm.dpm.num_ps =0 ;for (i =0 ; i < state_array->ucNumEntries; i++) {u8 *idx; power_state = (union pplib_power_state *)power_state_offset;
@@ -5566,10 +5567,8 @@ static int ci_parse_power_table(struct rif (!rdev->pm.power_state[i].clock_info)return -EINVAL ; ps =kzalloc (sizeof (struct ci_ps ),GFP_KERNEL ); -if (ps ==NULL ) { -kfree (rdev->pm.dpm.ps); +if (ps ==NULL )return -ENOMEM ; - } rdev->pm.dpm.ps[i].ps_priv = ps; ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], non_clock_info,
@@ -5591,8 +5590,8 @@ static int ci_parse_power_table(struct r k++; } power_state_offset +=2 + power_state->v2.ucNumDPMLevels; + rdev->pm.dpm.num_ps = i +1 ; } - rdev->pm.dpm.num_ps = state_array->ucNumEntries;/* fill in the vce power states */ for (i =0 ; i <RADEON_MAX_VCE_LEVELS ; i++) {
Greg Kroah-Hartman
maintainerPATCH 24/86 ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
commit 00fdec98d9881bf5173af09aebd353ab3b9ac729 upstream.
Trap handler for syscall tracing reads EFA (Exception Fault Address), in case strace wants PC of trap instruction (EFA is not part of pt_regs as of current code).
However this EFA read is racy as it happens after dropping to pure kernel mode (re-enabling interrupts). A taken interrupt could context-switch, trigger a different task's trap, clobbering EFA for this execution context.
Fix this by reading EFA early, before re-enabling interrupts. A slight side benefit is de-duplication of FAKE_RET_FROM_EXCPN in trap handler. The trap handler is common to both ARCompact and ARCv2 builds too.
This just came out of code rework/review and no real problem was reported but is clearly a potential problem specially for strace.
--- arch/arc/kernel/entry.S | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
arch/arc/kernel/entry.S +5 -11
@@ -156,7 +156,6 @@ END(EV_Extension) tracesys: ; save EFA in case tracer wants the PC of traced task ; using ERET won't work since next-PC has already committed - lr r12, [efa] GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address
@@ -199,15 +198,9 @@ tracesys_exit: ; Breakpoint TRAP ; --------------------------------------------- trap_with_param: - - ; stop_pc info by gdb needs this info - lr r0, [efa] + mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc mov r1, sp - ; Now that we have read EFA, it is safe to do "fake" rtie - ; and get out of CPU exception mode - FAKE_RET_FROM_EXCPN - ; Save callee regs in case gdb wants to have a look ; SP will grow up by size of CALLEE Reg-File ; NOTE: clobbers r12
@@ -234,6 +227,10 @@ ENTRY(EV_Trap) EXCEPTION_PROLOGUE + lr r12, [efa] + + FAKE_RET_FROM_EXCPN + ;============ TRAP 1 :breakpoints ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) bmsk.f 0, r9, 7
@@ -241,9 +238,6 @@ ENTRY(EV_Trap) ;============ TRAP (no param): syscall top level - ; First return from Exception to pure K mode (Exception/IRQs renabled) - FAKE_RET_FROM_EXCPN - ; If syscall tracing ongoing, invoke pre-post-hooks GET_CURR_THR_INFO_FLAGS r10 btst r10, TIF_SYSCALL_TRACE
Greg Kroah-Hartman
maintainerPATCH 25/86 ARC: elf: use right ELF_ARCH
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
commit b7faf971081a4e56147f082234bfff55135305cb upstream.
--- arch/arc/include/asm/elf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arc/include/asm/elf.h +1 -1
@@ -26,7 +26,7 @@#define R_ARC_32_PCREL 0x31/*to set parameters in the core dumps */ -#define ELF_ARCH EM_ARCOMPACT +#define ELF_ARCH EM_ARC_INUSE#define ELF_CLASS ELFCLASS32#ifdef CONFIG_CPU_BIG_ENDIAN
Greg Kroah-Hartman
maintainerPATCH 26/86 s390/mm: fix huge pte soft dirty copying
In reply to Greg Kroah-HartmanFrom: Janosch Frank <[email protected]>
commit 528a9539348a0234375dfaa1ca5dbbb2f8f8e8d2 upstream.
If the pmd is soft dirty we must mark the pte as soft dirty (and not dirty). This fixes some cases for guest migration with huge page backings.
--- arch/s390/mm/hugetlbpage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/hugetlbpage.c +1 -1
@@ -111,7 +111,7 @@ static inline pte_t __rste_to_pte(unsign _PAGE_YOUNG);#ifdef CONFIG_MEM_SOFT_DIRTY pte_val (pte) |=move_set_bit (rste, _SEGMENT_ENTRY_SOFT_DIRTY, - _PAGE_DIRTY); + _PAGE_SOFT_DIRTY);#endif }else pte_val (pte) = _PAGE_INVALID;
Greg Kroah-Hartman
maintainerPATCH 27/86 ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
[ Upstream commit 5eff06902394425c722f0a44d9545909a8800f79 ]
IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to incomplete IPsec ACQUIRE messages being sent to userspace. Currently, both raw sockets and IPv6 ping sockets set those fields.
Expected output of "ip xfrm monitor":
acquire proto esp
sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4
policy src 10.0.2.15/32 dst 8.8.8.8/32
<snip>Currently with ping sockets:
acquire proto esp
sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4
policy src 10.0.2.15/32 dst 8.8.8.8/32
<snip>The Libreswan test suite found this problem after Fedora changed the value for the sysctl net.ipv4.ping_group_range.
--- net/ipv4/ping.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/ping.c +3 -0
@@ -800,6 +800,9 @@ static int ping_v4_sendmsg(struct sock *RT_SCOPE_UNIVERSE , sk->sk_protocol, inet_sk_flowi_flags(sk), faddr, saddr, 0, 0); + fl4.fl4_icmp_type = user_icmph.type; + fl4.fl4_icmp_code = user_icmph.code; +security_sk_classify_flow (sk,flowi4_to_flowi (&fl4)); rt =ip_route_output_flow (net, &fl4, sk);if (IS_ERR (rt)) {
Greg Kroah-Hartman
maintainerPATCH 28/86 l2tp: remove skb_dst_set() from l2tp_xmit_skb()
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 27d53323664c549b5bb2dfaaf6f7ad6e0376a64e ]
In the tx path of l2tp, l2tp_xmit_skb() calls skb_dst_set() to set skb's dst. However, it will eventually call inet6_csk_xmit() or ip_queue_xmit() where skb's dst will be overwritten by:
skb_dst_set_noref(skb, dst);
without releasing the old dst in skb. Then it causes dst/dev refcnt leak:
unregister_netdevice: waiting for eth0 to become free. Usage count = 1
This can be reproduced by simply running:
# modprobe l2tp_eth && modprobe l2tp_ip # sh ./tools/testing/selftests/net/l2tp.sh
So before going to inet6_csk_xmit() or ip_queue_xmit(), skb's dst should be dropped. This patch is to fix it by removing skb_dst_set() from l2tp_xmit_skb() and moving skb_dst_drop() into l2tp_xmit_core().
--- net/l2tp/l2tp_core.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/l2tp/l2tp_core.c +1 -4
@@ -1134,6 +1134,7 @@ static int l2tp_xmit_core(struct l2tp_se/* Queue the packet to IP for output */ skb->ignore_df =1 ; +skb_dst_drop (skb);#if IS_ENABLED (CONFIG_IPV6 )if (tunnel->sock->sk_family ==PF_INET6 && !tunnel->v4mapped) error =inet6_csk_xmit (tunnel->sock, skb,NULL );
@@ -1198,10 +1199,6 @@ int l2tp_xmit_skb(struct l2tp_session *s goto out_unlock; } -/* Get routing info from the tunnel socket */ -skb_dst_drop (skb); -skb_dst_set (skb,sk_dst_check (sk,0 )); - inet =inet_sk (sk); fl = &inet->cork.fl;switch (tunnel->encap) {
Greg Kroah-Hartman
maintainerPATCH 29/86 llc: make sure applications use ARPHRD_ETHER
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a9b1110162357689a34992d5c925852948e5b9fd ]
syzbot was to trigger a bug by tricking AF_LLC with non sensible addr->sllc_arphrd
It seems clear LLC requires an Ethernet device.
Back in commit abf9d537fea2 ("llc: add support for SO_BINDTODEVICE") Octavian Purdila added possibility for application to use a zero value for sllc_arphrd, convert it to ARPHRD_ETHER to not cause regressions on existing applications.
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:199 [inline]
BUG: KASAN: use-after-free in list_empty include/linux/list.h:268 [inline]
BUG: KASAN: use-after-free in waitqueue_active include/linux/wait.h:126 [inline]
BUG: KASAN: use-after-free in wq_has_sleeper include/linux/wait.h:160 [inline]
BUG: KASAN: use-after-free in skwq_has_sleeper include/net/sock.h:2092 [inline]
BUG: KASAN: use-after-free in sock_def_write_space+0x642/0x670 net/core/sock.c:2813
Read of size 8 at addr ffff88801e0b4078 by task ksoftirqd/3/27
CPU: 3 PID: 27 Comm: ksoftirqd/3 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
__read_once_size include/linux/compiler.h:199 [inline]
list_empty include/linux/list.h:268 [inline]
waitqueue_active include/linux/wait.h:126 [inline]
wq_has_sleeper include/linux/wait.h:160 [inline]
skwq_has_sleeper include/net/sock.h:2092 [inline]
sock_def_write_space+0x642/0x670 net/core/sock.c:2813
sock_wfree+0x1e1/0x260 net/core/sock.c:1958
skb_release_head_state+0xeb/0x260 net/core/skbuff.c:652
skb_release_all+0x16/0x60 net/core/skbuff.c:663
__kfree_skb net/core/skbuff.c:679 [inline]
consume_skb net/core/skbuff.c:838 [inline]
consume_skb+0xfb/0x410 net/core/skbuff.c:832
__dev_kfree_skb_any+0xa4/0xd0 net/core/dev.c:2967
dev_kfree_skb_any include/linux/netdevice.h:3650 [inline]
e1000_unmap_and_free_tx_resource.isra.0+0x21b/0x3a0 drivers/net/ethernet/intel/e1000/e1000_main.c:1963
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3854 [inline]
e1000_clean+0x4cc/0x1d10 drivers/net/ethernet/intel/e1000/e1000_main.c:3796
napi_poll net/core/dev.c:6532 [inline]
net_rx_action+0x508/0x1120 net/core/dev.c:6600
__do_softirq+0x262/0x98c kernel/softirq.c:292
run_ksoftirqd kernel/softirq.c:603 [inline]
run_ksoftirqd+0x8e/0x110 kernel/softirq.c:595
smpboot_thread_fn+0x6a3/0xa40 kernel/smpboot.c:165
kthread+0x361/0x430 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 8247:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:521
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc mm/slab.c:3320 [inline]
kmem_cache_alloc+0x121/0x710 mm/slab.c:3484
sock_alloc_inode+0x1c/0x1d0 net/socket.c:240
alloc_inode+0x68/0x1e0 fs/inode.c:230
new_inode_pseudo+0x19/0xf0 fs/inode.c:919
sock_alloc+0x41/0x270 net/socket.c:560
__sock_create+0xc2/0x730 net/socket.c:1384
sock_create net/socket.c:1471 [inline]
__sys_socket+0x103/0x220 net/socket.c:1513
__do_sys_socket net/socket.c:1522 [inline]
__se_sys_socket net/socket.c:1520 [inline]
__ia32_sys_socket+0x73/0xb0 net/socket.c:1520
do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
do_fast_syscall_32+0x27b/0xe16 arch/x86/entry/common.c:408
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
Freed by task 17:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
__cache_free mm/slab.c:3426 [inline]
kmem_cache_free+0x86/0x320 mm/slab.c:3694
sock_free_inode+0x20/0x30 net/socket.c:261
i_callback+0x44/0x80 fs/inode.c:219
__rcu_reclaim kernel/rcu/rcu.h:222 [inline]
rcu_do_batch kernel/rcu/tree.c:2183 [inline]
rcu_core+0x570/0x1540 kernel/rcu/tree.c:2408
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2417
__do_softirq+0x262/0x98c kernel/softirq.c:292
The buggy address belongs to the object at ffff88801e0b4000
which belongs to the cache sock_inode_cache of size 1152
The buggy address is located 120 bytes inside of
1152-byte region [ffff88801e0b4000, ffff88801e0b4480)
The buggy address belongs to the page:
page:ffffea0000782d00 refcount:1 mapcount:0 mapping:ffff88807aa59c40 index:0xffff88801e0b4ffd
raw: 00fffe0000000200 ffffea00008e6c88 ffffea0000782d48 ffff88807aa59c40
raw: ffff88801e0b4ffd ffff88801e0b4000 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88801e0b3f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88801e0b3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801e0b4000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801e0b4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801e0b4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- net/llc/af_llc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/llc/af_llc.c +7 -3
@@ -271,6 +271,10 @@ static int llc_ui_autobind(struct socketif (!sock_flag (sk,SOCK_ZAPPED )) goto out; +if (!addr->sllc_arphrd) + addr->sllc_arphrd =ARPHRD_ETHER ; +if (addr->sllc_arphrd !=ARPHRD_ETHER ) + goto out; rc = -ENODEV ;if (sk->sk_bound_dev_if) { llc->dev =dev_get_by_index (&init_net, sk->sk_bound_dev_if);
@@ -328,15 +332,15 @@ static int llc_ui_bind(struct socket *soif (unlikely (!sock_flag (sk,SOCK_ZAPPED ) || addrlen !=sizeof (*addr))) goto out; rc = -EAFNOSUPPORT ; -if (unlikely (addr->sllc_family !=AF_LLC )) +if (!addr->sllc_arphrd) + addr->sllc_arphrd =ARPHRD_ETHER ; +if (unlikely (addr->sllc_family !=AF_LLC || addr->sllc_arphrd !=ARPHRD_ETHER )) goto out; rc = -ENODEV ;rcu_read_lock ();if (sk->sk_bound_dev_if) { llc->dev =dev_get_by_index_rcu (&init_net, sk->sk_bound_dev_if);if (llc->dev) { -if (!addr->sllc_arphrd) - addr->sllc_arphrd = llc->dev->type;if (is_zero_ether_addr (addr->sllc_mac))memcpy (addr->sllc_mac, llc->dev->dev_addr,IFHWADDRLEN );
Greg Kroah-Hartman
maintainerPATCH 30/86 net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
In reply to Greg Kroah-HartmanFrom: Martin Varghese <[email protected]>
[ Upstream commit 394de110a73395de2ca4516b0de435e91b11b604 ]
The packets from tunnel devices (eg bareudp) may have only metadata in the dst pointer of skb. Hence a pointer check of neigh_lookup is needed in dst_neigh_lookup_skb
Kernel crashes when packets from bareudp device is processed in the kernel neighbour subsytem.
[ 133.384484] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 133.385240] #PF: supervisor instruction fetch in kernel mode [ 133.385828] #PF: error_code(0x0010) - not-present page [ 133.386603] PGD 0 P4D 0 [ 133.386875] Oops: 0010 [#1] SMP PTI [ 133.387275] CPU: 0 PID: 5045 Comm: ping Tainted: G W 5.8.0-rc2+ #15 [ 133.388052] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 133.391076] RIP: 0010:0x0 [ 133.392401] Code: Bad RIP value. [ 133.394029] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246 [ 133.396656] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00 [ 133.399018] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400 [ 133.399685] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000 [ 133.400350] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400 [ 133.401010] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003 [ 133.401667] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000 [ 133.402412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.402948] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0 [ 133.403611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 133.404270] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.404933] Call Trace: [ 133.405169] <IRQ> [ 133.405367] __neigh_update+0x5a4/0x8f0 [ 133.405734] arp_process+0x294/0x820 [ 133.406076] ? __netif_receive_skb_core+0x866/0xe70 [ 133.406557] arp_rcv+0x129/0x1c0 [ 133.406882] __netif_receive_skb_one_core+0x95/0xb0 [ 133.407340] process_backlog+0xa7/0x150 [ 133.407705] net_rx_action+0x2af/0x420 [ 133.408457] __do_softirq+0xda/0x2a8 [ 133.408813] asm_call_on_stack+0x12/0x20 [ 133.409290] </IRQ> [ 133.409519] do_softirq_own_stack+0x39/0x50 [ 133.410036] do_softirq+0x50/0x60 [ 133.410401] __local_bh_enable_ip+0x50/0x60 [ 133.410871] ip_finish_output2+0x195/0x530 [ 133.411288] ip_output+0x72/0xf0 [ 133.411673] ? __ip_finish_output+0x1f0/0x1f0 [ 133.412122] ip_send_skb+0x15/0x40 [ 133.412471] raw_sendmsg+0x853/0xab0 [ 133.412855] ? insert_pfn+0xfe/0x270 [ 133.413827] ? vvar_fault+0xec/0x190 [ 133.414772] sock_sendmsg+0x57/0x80 [ 133.415685] __sys_sendto+0xdc/0x160 [ 133.416605] ? syscall_trace_enter+0x1d4/0x2b0 [ 133.417679] ? __audit_syscall_exit+0x1d9/0x280 [ 133.418753] ? __prepare_exit_to_usermode+0x5d/0x1a0 [ 133.419819] __x64_sys_sendto+0x24/0x30 [ 133.420848] do_syscall_64+0x4d/0x90 [ 133.421768] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 133.422833] RIP: 0033:0x7fe013689c03 [ 133.423749] Code: Bad RIP value. [ 133.424624] RSP: 002b:00007ffc7288f418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 133.425940] RAX: ffffffffffffffda RBX: 000056151fc63720 RCX: 00007fe013689c03 [ 133.427225] RDX: 0000000000000040 RSI: 000056151fc63720 RDI: 0000000000000003 [ 133.428481] RBP: 00007ffc72890b30 R08: 000056151fc60500 R09: 0000000000000010 [ 133.429757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 133.431041] R13: 000056151fc636e0 R14: 000056151fc616bc R15: 0000000000000080 [ 133.432481] Modules linked in: mpls_iptunnel act_mirred act_tunnel_key cls_flower sch_ingress veth mpls_router ip_tunnel bareudp ip6_udp_tunnel udp_tunnel macsec udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc xt_MASQUERADE iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc ebtable_filter ebtables overlay ip6table_filter ip6_tables iptable_filter sunrpc ext4 mbcache jbd2 pcspkr i2c_piix4 virtio_balloon joydev ip_tables xfs libcrc32c ata_generic qxl pata_acpi drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata virtio_net net_failover virtio_console failover virtio_blk i2c_core virtio_pci virtio_ring serio_raw floppy virtio dm_mirror dm_region_hash dm_log dm_mod [ 133.444045] CR2: 0000000000000000 [ 133.445082] ---[ end trace f4aeee1958fd1638 ]--- [ 133.446236] RIP: 0010:0x0 [ 133.447180] Code: Bad RIP value. [ 133.448152] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246 [ 133.449363] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00 [ 133.450835] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400 [ 133.452237] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000 [ 133.453722] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400 [ 133.455149] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003 [ 133.456520] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000 [ 133.458046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.459342] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0 [ 133.460782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 133.462240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.463697] Kernel panic - not syncing: Fatal exception in interrupt [ 133.465226] Kernel Offset: 0xfa00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 133.467025] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
--- include/net/dst.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
include/net/dst.h +9 -1
@@ -479,7 +479,15 @@ static inline struct neighbour *dst_neigstatic inline struct neighbour *dst_neigh_lookup_skb (const struct dst_entry *dst,struct sk_buff *skb) { -struct neighbour *n = dst->ops->neigh_lookup (dst, skb,NULL ); +struct neighbour *n =NULL ; + +/* The packets from tunnel devices (eg bareudp) may have only +* metadata in the dst pointer of skb. Hence a pointer check of +* neigh_lookup is needed. +*/ +if (dst->ops->neigh_lookup) + n = dst->ops->neigh_lookup (dst, skb,NULL ); +return IS_ERR (n) ?NULL : n; }
Greg Kroah-Hartman
maintainerPATCH 31/86 net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
In reply to Greg Kroah-HartmanFrom: AceLan Kao <[email protected]>
[ Upstream commit f815dd5cf48b905eeecf0a2b990e9b7ab048b4f1 ]
Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0195 Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -962,6 +962,7 @@ static const struct usb_device_id produc {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
Greg Kroah-Hartman
maintainerPATCH 32/86 tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 6a2febec338df7e7699a52d00b2e1207dcf65b28 ]
MD5 keys are read with RCU protection, and tcp_md5_do_add() might update in-place a prior key.
Normally, typical RCU updates would allocate a new piece of memory. In this case only key->key and key->keylen might be updated, and we do not care if an incoming packet could see the old key, the new one, or some intermediate value, since changing the key on a live flow is known to be problematic anyway.
We only want to make sure that in the case key->keylen is changed, cpus in tcp_md5_hash_key() wont try to use uninitialized data, or crash because key->keylen was read twice to feed sg_init_one() and ahash_request_set_crypt()
--- net/ipv4/tcp.c | 7 +++++-- net/ipv4/tcp_ipv4.c | 3 +++ 2 files changed, 8 insertions(+), 2 deletions(-)
net/ipv4/tcp.c +5 -2
@@ -3207,10 +3207,13 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);int tcp_md5_hash_key (struct tcp_md5sig_pool *hp,const struct tcp_md5sig_key *key) { +u8 keylen = key->keylen;struct scatterlist sg; -sg_init_one (&sg, key->key, key->keylen); -ahash_request_set_crypt (hp->md5_req, &sg,NULL , key->keylen); +smp_rmb ();/* paired with smp_wmb() in tcp_md5_do_add() */ + +sg_init_one (&sg, key->key, keylen); +ahash_request_set_crypt (hp->md5_req, &sg,NULL , keylen);return crypto_ahash_update (hp->md5_req); }EXPORT_SYMBOL (tcp_md5_hash_key);
net/ipv4/tcp_ipv4.c +3 -0
@@ -938,6 +938,9 @@ int tcp_md5_do_add(struct sock *sk, consif (key) {/* Pre-existing entry - just update that one. */ memcpy (key->key, newkey, newkeylen); + +smp_wmb ();/* pairs with smp_rmb() in tcp_md5_hash_key() */ + key->keylen = newkeylen;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 33/86 tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e6ced831ef11a2a06e8d00aad9d4fc05b610bf38 ]
My prior fix went a bit too far, according to Herbert and Mathieu.
Since we accept that concurrent TCP MD5 lookups might see inconsistent keys, we can use READ_ONCE()/WRITE_ONCE() instead of smp_rmb()/smp_wmb()
Clearing all key->key[] is needed to avoid possible KMSAN reports, if key->keylen is increased. Since tcp_md5_do_add() is not fast path, using __GFP_ZERO to clear all struct tcp_md5sig_key is simpler.
data_race() was added in linux-5.8 and will prevent KCSAN reports, this can safely be removed in stable backports, if data_race() is not yet backported.
v2: use data_race() both in tcp_md5_hash_key() and tcp_md5_do_add()
--- net/ipv4/tcp.c | 6 +++--- net/ipv4/tcp_ipv4.c | 14 ++++++++++---- 2 files changed, 13 insertions(+), 7 deletions(-)
net/ipv4/tcp.c +3 -3
@@ -3207,13 +3207,13 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);int tcp_md5_hash_key (struct tcp_md5sig_pool *hp,const struct tcp_md5sig_key *key) { -u8 keylen = key->keylen; +u8 keylen =READ_ONCE (key->keylen);/* paired with WRITE_ONCE() in tcp_md5_do_add */ struct scatterlist sg; -smp_rmb ();/* paired with smp_wmb() in tcp_md5_do_add() */ -sg_init_one (&sg, key->key, keylen);ahash_request_set_crypt (hp->md5_req, &sg,NULL , keylen); + +/* tcp_md5_do_add() might change key->key under us */ return crypto_ahash_update (hp->md5_req); }EXPORT_SYMBOL (tcp_md5_hash_key);
net/ipv4/tcp_ipv4.c +10 -4
@@ -936,12 +936,18 @@ int tcp_md5_do_add(struct sock *sk, cons key =tcp_md5_do_lookup (sk, addr, family);if (key) { -/* Pre-existing entry - just update that one. */ +/* Pre-existing entry - just update that one. +* Note that the key might be used concurrently. +*/ memcpy (key->key, newkey, newkeylen); -smp_wmb ();/* pairs with smp_rmb() in tcp_md5_hash_key() */ +/* Pairs with READ_ONCE() in tcp_md5_hash_key(). +* Also note that a reader could catch new key->keylen value +* but old key->key[], this is the reason we use __GFP_ZERO +* at sock_kmalloc() time below these lines. +*/ +WRITE_ONCE (key->keylen, newkeylen); - key->keylen = newkeylen;return 0 ; }
@@ -957,7 +963,7 @@ int tcp_md5_do_add(struct sock *sk, consrcu_assign_pointer (tp->md5sig_info, md5sig); } - key =sock_kmalloc (sk,sizeof (*key), gfp); + key =sock_kmalloc (sk,sizeof (*key), gfp | __GFP_ZERO);if (!key)return -ENOMEM ;if (!tcp_alloc_md5sig_pool ()) {
Greg Kroah-Hartman
maintainerPATCH 34/86 genetlink: remove genl_bind
In reply to Greg Kroah-HartmanFrom: Sean Tranchetti <[email protected]>
[ Upstream commit 1e82a62fec613844da9e558f3493540a5b7a7b67 ]
A potential deadlock can occur during registering or unregistering a new generic netlink family between the main nl_table_lock and the cb_lock where each thread wants the lock held by the other, as demonstrated below.
1) Thread 1 is performing a netlink_bind() operation on a socket. As part of this call, it will call netlink_lock_table(), incrementing the nl_table_users count to 1.
2) Thread 2 is registering (or unregistering) a genl_family via the genl_(un)register_family() API. The cb_lock semaphore will be taken for writing.
3) Thread 1 will call genl_bind() as part of the bind operation to handle subscribing to GENL multicast groups at the request of the user. It will attempt to take the cb_lock semaphore for reading, but it will fail and be scheduled away, waiting for Thread 2 to finish the write.
4) Thread 2 will call netlink_table_grab() during the (un)registration call. However, as Thread 1 has incremented nl_table_users, it will not be able to proceed, and both threads will be stuck waiting for the other.
genl_bind() is a noop, unless a genl_family implements the mcast_bind() function to handle setting up family-specific multicast operations. Since no one in-tree uses this functionality as Cong pointed out, simply removing the genl_bind() function will remove the possibility for deadlock, as there is no attempt by Thread 1 above to take the cb_lock semaphore.
--- include/net/genetlink.h | 8 ------- net/netlink/genetlink.c | 52 ------------------------------------------------ 2 files changed, 60 deletions(-)
include/net/genetlink.h +0 -8
@@ -33,12 +33,6 @@ struct genl_info;* do additional, common, filtering and return an error * @post_doit: called after an operation's doit callback, it may * undo operations done by pre_doit, for example release locks -* @mcast_bind: a socket bound to the given multicast group (which -* is given as the offset into the groups array) -* @mcast_unbind: a socket was unbound from the given multicast group. -* Note that unbind() will not be called symmetrically if the -* generic netlink family is removed while there are still open -* sockets. * @attrbuf: buffer to store parsed attributes * @family_list: family list * @mcgrps: multicast groups used by this family (private)
@@ -61,8 +55,6 @@ struct genl_family {void (*post_doit)(const struct genl_ops *ops,struct sk_buff *skb,struct genl_info *info); -int (*mcast_bind)(struct net *net,int group); -void (*mcast_unbind)(struct net *net,int group);struct nlattr ** attrbuf;/* private */ const struct genl_ops * ops;/* private */ const struct genl_multicast_group *mcgrps;/* private */
net/netlink/genetlink.c +0 -52
63 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 35/86 tcp: make sure listeners dont initialize congestion-control state
In reply to Greg Kroah-HartmanFrom: Christoph Paasch <[email protected]>
[ Upstream commit ce69e563b325f620863830c246a8698ccea52048 ]
syzkaller found its way into setsockopt with TCP_CONGESTION "cdg". tcp_cdg_init() does a kcalloc to store the gradients. As sk_clone_lock just copies all the memory, the allocated pointer will be copied as well, if the app called setsockopt(..., TCP_CONGESTION) on the listener. If now the socket will be destroyed before the congestion-control has properly been initialized (through a call to tcp_init_transfer), we will end up freeing memory that does not belong to that particular socket, opening the door to a double-free:
[ 11.413102] ================================================================== [ 11.414181] BUG: KASAN: double-free or invalid-free in tcp_cleanup_congestion_control+0x58/0xd0 [ 11.415329] [ 11.415560] CPU: 3 PID: 4884 Comm: syz-executor.5 Not tainted 5.8.0-rc2 #80 [ 11.416544] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 11.418148] Call Trace: [ 11.418534] <IRQ> [ 11.418834] dump_stack+0x7d/0xb0 [ 11.419297] print_address_description.constprop.0+0x1a/0x210 [ 11.422079] kasan_report_invalid_free+0x51/0x80 [ 11.423433] __kasan_slab_free+0x15e/0x170 [ 11.424761] kfree+0x8c/0x230 [ 11.425157] tcp_cleanup_congestion_control+0x58/0xd0 [ 11.425872] tcp_v4_destroy_sock+0x57/0x5a0 [ 11.426493] inet_csk_destroy_sock+0x153/0x2c0 [ 11.427093] tcp_v4_syn_recv_sock+0xb29/0x1100 [ 11.427731] tcp_get_cookie_sock+0xc3/0x4a0 [ 11.429457] cookie_v4_check+0x13d0/0x2500 [ 11.433189] tcp_v4_do_rcv+0x60e/0x780 [ 11.433727] tcp_v4_rcv+0x2869/0x2e10 [ 11.437143] ip_protocol_deliver_rcu+0x23/0x190 [ 11.437810] ip_local_deliver+0x294/0x350 [ 11.439566] __netif_receive_skb_one_core+0x15d/0x1a0 [ 11.441995] process_backlog+0x1b1/0x6b0 [ 11.443148] net_rx_action+0x37e/0xc40 [ 11.445361] __do_softirq+0x18c/0x61a [ 11.445881] asm_call_on_stack+0x12/0x20 [ 11.446409] </IRQ> [ 11.446716] do_softirq_own_stack+0x34/0x40 [ 11.447259] do_softirq.part.0+0x26/0x30 [ 11.447827] __local_bh_enable_ip+0x46/0x50 [ 11.448406] ip_finish_output2+0x60f/0x1bc0 [ 11.450109] __ip_queue_xmit+0x71c/0x1b60 [ 11.451861] __tcp_transmit_skb+0x1727/0x3bb0 [ 11.453789] tcp_rcv_state_process+0x3070/0x4d3a [ 11.456810] tcp_v4_do_rcv+0x2ad/0x780 [ 11.457995] __release_sock+0x14b/0x2c0 [ 11.458529] release_sock+0x4a/0x170 [ 11.459005] __inet_stream_connect+0x467/0xc80 [ 11.461435] inet_stream_connect+0x4e/0xa0 [ 11.462043] __sys_connect+0x204/0x270 [ 11.465515] __x64_sys_connect+0x6a/0xb0 [ 11.466088] do_syscall_64+0x3e/0x70 [ 11.466617] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 11.467341] RIP: 0033:0x7f56046dc469 [ 11.467844] Code: Bad RIP value. [ 11.468282] RSP: 002b:00007f5604dccdd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 11.469326] RAX: ffffffffffffffda RBX: 000000000068bf00 RCX: 00007f56046dc469 [ 11.470379] RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000004 [ 11.471311] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 11.472286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 11.473341] R13: 000000000041427c R14: 00007f5604dcd5c0 R15: 0000000000000003 [ 11.474321] [ 11.474527] Allocated by task 4884: [ 11.475031] save_stack+0x1b/0x40 [ 11.475548] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 11.476182] tcp_cdg_init+0xf0/0x150 [ 11.476744] tcp_init_congestion_control+0x9b/0x3a0 [ 11.477435] tcp_set_congestion_control+0x270/0x32f [ 11.478088] do_tcp_setsockopt.isra.0+0x521/0x1a00 [ 11.478744] __sys_setsockopt+0xff/0x1e0 [ 11.479259] __x64_sys_setsockopt+0xb5/0x150 [ 11.479895] do_syscall_64+0x3e/0x70 [ 11.480395] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 11.481097] [ 11.481321] Freed by task 4872: [ 11.481783] save_stack+0x1b/0x40 [ 11.482230] __kasan_slab_free+0x12c/0x170 [ 11.482839] kfree+0x8c/0x230 [ 11.483240] tcp_cleanup_congestion_control+0x58/0xd0 [ 11.483948] tcp_v4_destroy_sock+0x57/0x5a0 [ 11.484502] inet_csk_destroy_sock+0x153/0x2c0 [ 11.485144] tcp_close+0x932/0xfe0 [ 11.485642] inet_release+0xc1/0x1c0 [ 11.486131] __sock_release+0xc0/0x270 [ 11.486697] sock_close+0xc/0x10 [ 11.487145] __fput+0x277/0x780 [ 11.487632] task_work_run+0xeb/0x180 [ 11.488118] __prepare_exit_to_usermode+0x15a/0x160 [ 11.488834] do_syscall_64+0x4a/0x70 [ 11.489326] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Wei Wang fixed a part of these CDG-malloc issues with commit c12014440750 ("tcp: memset ca_priv data to 0 properly").
This patch here fixes the listener-scenario: We make sure that listeners setting the congestion-control through setsockopt won't initialize it (thus CDG never allocates on listeners). For those who use AF_UNSPEC to reuse a socket, tcp_disconnect() is changed to cleanup afterwards.
(The issue can be reproduced at least down to v4.4.x.)
--- net/ipv4/tcp.c | 3 +++ net/ipv4/tcp_cong.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +3 -0
@@ -2299,6 +2299,9 @@ int tcp_disconnect(struct sock *sk, int tp->snd_cwnd_cnt =0 ; tp->window_clamp =0 ; tp->delivered =0 ; +if (icsk->icsk_ca_ops->release) + icsk->icsk_ca_ops->release (sk); +memset (icsk->icsk_ca_priv,0 ,sizeof (icsk->icsk_ca_priv));tcp_set_ca_state (sk, TCP_CA_Open); tp->is_sack_reneg =0 ;tcp_clear_retrans (tp);
net/ipv4/tcp_cong.c +1 -1
@@ -198,7 +198,7 @@ static void tcp_reinit_congestion_contro icsk->icsk_ca_setsockopt =1 ;memset (icsk->icsk_ca_priv,0 ,sizeof (icsk->icsk_ca_priv)); -if (sk->sk_state !=TCP_CLOSE ) +if (!((1 << sk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN )))tcp_init_congestion_control (sk); }
Greg Kroah-Hartman
maintainerPATCH 36/86 tcp: md5: do not send silly options in SYNCOOKIES
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e114e1e8ac9d31f25b9dd873bab5d80c1fc482ca ]
Whenever cookie_init_timestamp() has been used to encode ECN,SACK,WSCALE options, we can not remove the TS option in the SYNACK.
Otherwise, tcp_synack_options() will still advertize options like WSCALE that we can not deduce later when receiving the packet from the client to complete 3WHS.
Note that modern linux TCP stacks wont use MD5+TS+SACK in a SYN packet, but we can not know for sure that all TCP stacks have the same logic.
Before the fix a tcpdump would exhibit this wrong exchange :
10:12:15.464591 IP C > S: Flags [S], seq 4202415601, win 65535, options [nop,nop,md5 valid,mss 1400,sackOK,TS val 456965269 ecr 0,nop,wscale 8], length 0 10:12:15.464602 IP S > C: Flags [S.], seq 253516766, ack 4202415602, win 65535, options [nop,nop,md5 valid,mss 1400,nop,nop,sackOK,nop,wscale 8], length 0 10:12:15.464611 IP C > S: Flags [.], ack 1, win 256, options [nop,nop,md5 valid], length 0
10:12:15.464678 IP C > S: Flags [P.], seq 1:13, ack 1, win 256, options [nop,nop,md5 valid], length 12
10:12:15.464685 IP S > C: Flags [.], ack 13, win 65535, options [nop,nop,md5 valid], length 0
After this patch the exchange looks saner :
11:59:59.882990 IP C > S: Flags [S], seq 517075944, win 65535, options [nop,nop,md5 valid,mss 1400,sackOK,TS val 1751508483 ecr 0,nop,wscale 8], length 0 11:59:59.883002 IP S > C: Flags [S.], seq 1902939253, ack 517075945, win 65535, options [nop,nop,md5 valid,mss 1400,sackOK,TS val 1751508479 ecr 1751508483,nop,wscale 8], length 0 11:59:59.883012 IP C > S: Flags [.], ack 1, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508483 ecr 1751508479], length 0
11:59:59.883114 IP C > S: Flags [P.], seq 1:13, ack 1, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508483 ecr 1751508479], length 12 11:59:59.883122 IP S > C: Flags [.], ack 13, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508483 ecr 1751508483], length 0
11:59:59.883152 IP S > C: Flags [P.], seq 1:13, ack 13, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508484 ecr 1751508483], length 12 11:59:59.883170 IP C > S: Flags [.], ack 13, win 256, options [nop,nop,md5 valid,nop,nop,TS val 1751508484 ecr 1751508484], length 0
Of course, no SACK block will ever be added later, but nothing should break. Technically, we could remove the 4 nops included in MD5+TS options, but again some stacks could break seeing not conventional alignment.
--- net/ipv4/tcp_output.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/ipv4/tcp_output.c +6 -4
@@ -615,7 +615,8 @@ static unsigned int tcp_synack_options(s unsigned int mss, struct sk_buff *skb, struct tcp_out_options *opts, const struct tcp_md5sig_key *md5, - struct tcp_fastopen_cookie *foc) + struct tcp_fastopen_cookie *foc, + enum tcp_synack_type synack_type) { struct inet_request_sock *ireq = inet_rsk(req);unsigned int remaining =MAX_TCP_OPTION_SPACE ;
@@ -630,7 +631,8 @@ static unsigned int tcp_synack_options(s* rather than TS in order to fit in better with old, * buggy kernels, but that was deemed to be unnecessary. */ - ireq->tstamp_ok &= !ireq->sack_ok; +if (synack_type !=TCP_SYNACK_COOKIE ) + ireq->tstamp_ok &= !ireq->sack_ok; }#endif
@@ -3165,8 +3167,8 @@ struct sk_buff *tcp_make_synack(const st md5 =tcp_rsk (req)->af_specific->req_md5_lookup (sk,req_to_sk (req));#endif skb_set_hash (skb,tcp_rsk (req)->txhash,PKT_HASH_TYPE_L4 ); - tcp_header_size =tcp_synack_options (req, mss, skb, &opts, md5, foc) + -sizeof (*th); + tcp_header_size =tcp_synack_options (req, mss, skb, &opts, md5, + foc, synack_type) +sizeof (*th);skb_push (skb, tcp_header_size);skb_reset_transport_header (skb);
Greg Kroah-Hartman
maintainerPATCH 37/86 tcp: md5: allow changing MD5 keys in all socket states
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 1ca0fafd73c5268e8fc4b997094b8bb2bfe8deea ]
This essentially reverts commit 721230326891 ("tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets")
Mathieu reported that many vendors BGP implementations can actually switch TCP MD5 on established flows.
Quoting Mathieu :
Here is a list of a few network vendors along with their behavior with respect to TCP MD5:
- Cisco: Allows for password to be changed, but within the hold-down
timer (~180 seconds).
- Juniper: When password is initially set on active connection it will reset, but after that any subsequent password changes no network resets.
- Nokia: No notes on if they flap the tcp connection or not.
- Ericsson/RedBack: Allows for 2 password (old/new) to co-exist until both sides are ok with new passwords.
- Meta-Switch: Expects the password to be set before a connection is attempted, but no further info on whether they reset the TCP connection on a change.
- Avaya: Disable the neighbor, then set password, then re-enable.
- Zebos: Would normally allow the change when socket connected.
We can revert my prior change because commit 9424e2e7ad93 ("tcp: md5: fix potential overestimation of TCP option space") removed the leak of 4 kernel bytes to the wire that was the main reason for my patch.
While doing my investigations, I found a bug when a MD5 key is changed, leading to these commits that stable teams want to consider before backporting this revert :
Commit 6a2febec338d ("tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()") Commit e6ced831ef11 ("tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers")
--- net/ipv4/tcp.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/ipv4/tcp.c +1 -4
@@ -2672,10 +2672,7 @@ static int do_tcp_setsockopt(struct sock#ifdef CONFIG_TCP_MD5SIG case TCP_MD5SIG : -if ((1 << sk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN )) - err = tp->af_specific->md5_parse (sk, optval, optlen); -else - err = -EINVAL ; + err = tp->af_specific->md5_parse (sk, optval, optlen);break ;#endif case TCP_USER_TIMEOUT :
Greg Kroah-Hartman
maintainerPATCH 38/86 cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit ad0f75e5f57ccbceec13274e1e242f2b5a6397ed ]
When we clone a socket in sk_clone_lock(), its sk_cgrp_data is copied, so the cgroup refcnt must be taken too. And, unlike the sk_alloc() path, sock_update_netprioidx() is not called here. Therefore, it is safe and necessary to grab the cgroup refcnt even when cgroup_sk_alloc is disabled.
sk_clone_lock() is in BH context anyway, the in_interrupt() would terminate this function if called there. And for sk_alloc() skcd->val is always zero. So it's safe to factor out the code to make it more readable.
The global variable 'cgroup_sk_alloc_disabled' is used to determine whether to take these reference counts. It is impossible to make the reference counting correct unless we save this bit of information in skcd->val. So, add a new bit there to record whether the socket has already taken the reference counts. This obviously relies on kmalloc() to align cgroup pointers to at least 4 bytes, ARCH_KMALLOC_MINALIGN is certainly larger than that.
This bug seems to be introduced since the beginning, commit d979a39d7242 ("cgroup: duplicate cgroup reference when cloning sockets") tried to fix it but not compeletely. It seems not easy to trigger until the recent commit 090e28b229af
("netprio_cgroup: Fix unlimited memory leak of v2 cgroups") was merged.
--- include/linux/cgroup-defs.h | 6 ++++-- include/linux/cgroup.h | 4 +++- kernel/cgroup.c | 24 ++++++++++++++++++------ net/core/sock.c | 2 +- 4 files changed, 26 insertions(+), 10 deletions(-)
include/linux/cgroup-defs.h +4 -2
@@ -587,7 +587,8 @@ struct sock_cgroup_data { union { #ifdef __LITTLE_ENDIAN struct { - u8 is_data; + u8 is_data : 1; + u8 no_refcnt : 1; u8 padding; u16 prioidx; u32 classid;
@@ -597,7 +598,8 @@ struct sock_cgroup_data {u32 classid;u16 prioidx;u8 padding; - u8 is_data; + u8 no_refcnt : 1; + u8 is_data : 1; } __packed;#endif u64 val;
include/linux/cgroup.h +3 -1
@@ -657,6 +657,7 @@ extern spinlock_t cgroup_sk_update_lock;void cgroup_sk_alloc_disable (void );void cgroup_sk_alloc (struct sock_cgroup_data *skcd); +void cgroup_sk_clone (struct sock_cgroup_data *skcd);void cgroup_sk_free (struct sock_cgroup_data *skcd);static inline struct cgroup *sock_cgroup_ptr (struct sock_cgroup_data *skcd)
@@ -670,7 +671,7 @@ static inline struct cgroup *sock_cgroup*/ v =READ_ONCE (skcd->val); -if (v &1 ) +if (v &3 )return &cgrp_dfl_root.cgrp;return (struct cgroup *)(unsigned long )v ?: &cgrp_dfl_root.cgrp;
@@ -682,6 +683,7 @@ static inline struct cgroup *sock_cgroup#else /* CONFIG_CGROUP_DATA */ static inline void cgroup_sk_alloc (struct sock_cgroup_data *skcd) {} +static inline void cgroup_sk_clone (struct sock_cgroup_data *skcd) {}static inline void cgroup_sk_free (struct sock_cgroup_data *skcd) {}#endif /* CONFIG_CGROUP_DATA */
kernel/cgroup.c +18 -6
@@ -6326,12 +6326,8 @@ void cgroup_sk_alloc_disable(void)void cgroup_sk_alloc (struct sock_cgroup_data *skcd) { -if (cgroup_sk_alloc_disabled) -return ; - -/* Socket clone path */ -if (skcd->val) { -cgroup_get (sock_cgroup_ptr (skcd)); +if (cgroup_sk_alloc_disabled) { + skcd->no_refcnt =1 ;return ; }
@@ -6355,8 +6351,24 @@ void cgroup_sk_alloc(struct sock_cgroup_rcu_read_unlock (); } +void cgroup_sk_clone (struct sock_cgroup_data *skcd) +{ +/* Socket clone path */ +if (skcd->val) { +/* +* We might be cloning a socket which is left in an empty +* cgroup and the cgroup might have already been rmdir'd. +* Don't use cgroup_get_live(). +*/ +cgroup_get (sock_cgroup_ptr (skcd)); + } +} +void cgroup_sk_free (struct sock_cgroup_data *skcd) { +if (skcd->no_refcnt) +return ; +cgroup_put (sock_cgroup_ptr (skcd)); }
net/core/sock.c +1 -1
@@ -1533,7 +1533,7 @@ struct sock *sk_clone_lock(const struct newsk->sk_userlocks = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK ;sock_reset_flag (newsk,SOCK_DONE ); -cgroup_sk_alloc (&newsk->sk_cgrp_data); +cgroup_sk_clone (&newsk->sk_cgrp_data);skb_queue_head_init (&newsk->sk_error_queue); filter =rcu_dereference_protected (newsk->sk_filter,1 );
Greg Kroah-Hartman
maintainerPATCH 39/86 cgroup: Fix sock_cgroup_data on big-endian.
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit 14b032b8f8fce03a546dcf365454bec8c4a58d7d ]
In order for no_refcnt and is_data to be the lowest order two bits in the 'val' we have to pad out the bitfield of the u8.
--- include/linux/cgroup-defs.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/cgroup-defs.h +2 -0
@@ -589,6 +589,7 @@ struct sock_cgroup_data {struct {u8 is_data :1 ;u8 no_refcnt :1 ; +u8 unused :6 ;u8 padding;u16 prioidx;u32 classid;
@@ -598,6 +599,7 @@ struct sock_cgroup_data {u32 classid;u16 prioidx;u8 padding; + u8 unused : 6; u8 no_refcnt : 1; u8 is_data : 1; } __packed;
Greg Kroah-Hartman
maintainerPATCH 40/86 i2c: eg20t: Load module automatically if ID matches
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 5f90786b31fb7d1e199a8999d46c4e3aea672e11 ]
The driver can't be loaded automatically because it misses module alias to be provided. Add corresponding MODULE_DEVICE_TABLE() call to the driver.
--- drivers/i2c/busses/i2c-eg20t.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-eg20t.c +1 -0
@@ -189,6 +189,7 @@ static const struct pci_device_id pch_pcidev_id[] = { { PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, }, {0,} }; +MODULE_DEVICE_TABLE (pci, pch_pcidev_id);static irqreturn_t pch_i2c_handler (int irq,void *pData);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 41/86 iio:magnetometer:ak8974: Fix alignment and data leak issues
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 838e00b13bfd4cac8b24df25bfc58e2eb99bcc70 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc so no data can leak appart from previous readings.
--- drivers/iio/magnetometer/ak8974.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/iio/magnetometer/ak8974.c +7 -3
@@ -153,6 +153,11 @@ struct ak8974 {bool drdy_irq;struct completion drdy_complete;bool drdy_active_low; +/* Ensure timestamp is naturally aligned */ +struct { +__le16 channels[3 ]; +s64 ts__aligned(8) ; + } scan; };static const char ak8974_reg_avdd[] ="avdd" ;
@@ -494,7 +499,6 @@ static void ak8974_fill_buffer(struct ii {struct ak8974 *ak8974 =iio_priv (indio_dev);int ret; -s16 hw_values[8 ];/* Three axes + 64bit padding */ pm_runtime_get_sync (&ak8974->i2c->dev);mutex_lock (&ak8974->lock);
@@ -504,13 +508,13 @@ static void ak8974_fill_buffer(struct iidev_err (&ak8974->i2c->dev,"error triggering measure\n" ); goto out_unlock; } - ret =ak8974_getresult (ak8974, hw_values); + ret =ak8974_getresult (ak8974, ak8974->scan.channels);if (ret) {dev_err (&ak8974->i2c->dev,"error getting measures\n" ); goto out_unlock; } -iio_push_to_buffers_with_timestamp (indio_dev, hw_values, +iio_push_to_buffers_with_timestamp (indio_dev, &ak8974->scan,iio_get_time_ns (indio_dev)); out_unlock:
Greg Kroah-Hartman
maintainerPATCH 42/86 iio: magnetometer: ak8974: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
commit 0187294d227dfc42889e1da8f8ce1e44fc25f147 upstream.
When devm_regmap_init_i2c() returns an error code, a pairing runtime PM usage counter decrement is needed to keep the counter balanced. For error paths after ak8974_set_power(), ak8974_detect() and ak8974_reset(), things are the same.
However, When iio_triggered_buffer_setup() returns an error code, there will be two PM usgae counter decrements.
--- drivers/iio/magnetometer/ak8974.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/iio/magnetometer/ak8974.c +10 -9
@@ -675,19 +675,21 @@ static int ak8974_probe(struct i2c_clien ak8974->map =devm_regmap_init_i2c (i2c, &ak8974_regmap_config);if (IS_ERR (ak8974->map)) {dev_err (&i2c->dev,"failed to allocate register map\n" ); +pm_runtime_put_noidle (&i2c->dev); +pm_runtime_disable (&i2c->dev);return PTR_ERR (ak8974->map); } ret =ak8974_set_power (ak8974,AK8974_PWR_ON );if (ret) {dev_err (&i2c->dev,"could not power on\n" ); - goto power_off; + goto disable_pm; } ret =ak8974_detect (ak8974);if (ret) {dev_err (&i2c->dev,"neither AK8974 nor AMI305 found\n" ); - goto power_off; + goto disable_pm; } ret =ak8974_selftest (ak8974);
@@ -697,14 +699,9 @@ static int ak8974_probe(struct i2c_clien ret =ak8974_reset (ak8974);if (ret) {dev_err (&i2c->dev,"AK8974 reset failed\n" ); - goto power_off; + goto disable_pm; } -pm_runtime_set_autosuspend_delay (&i2c->dev, -AK8974_AUTOSUSPEND_DELAY ); -pm_runtime_use_autosuspend (&i2c->dev); -pm_runtime_put (&i2c->dev); - indio_dev->dev.parent = &i2c->dev; indio_dev->channels = ak8974_channels; indio_dev->num_channels =ARRAY_SIZE (ak8974_channels);
@@ -757,6 +754,11 @@ no_irq: goto cleanup_buffer; } +pm_runtime_set_autosuspend_delay (&i2c->dev, +AK8974_AUTOSUSPEND_DELAY ); +pm_runtime_use_autosuspend (&i2c->dev); +pm_runtime_put (&i2c->dev); +return 0 ; cleanup_buffer:
@@ -765,7 +767,6 @@ disable_pm:pm_runtime_put_noidle (&i2c->dev);pm_runtime_disable (&i2c->dev);ak8974_set_power (ak8974,AK8974_PWR_OFF ); -power_off:regulator_bulk_disable (ARRAY_SIZE (ak8974->regs), ak8974->regs);return ret;
Greg Kroah-Hartman
maintainerPATCH 43/86 iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
commit d7369ae1f4d7cffa7574d15e1f787dcca184c49d upstream.
The function iio_device_register() was called in mma8452_probe(). But the function iio_device_unregister() was not called after a call of the function mma8452_set_freefall_mode() failed. Thus add the missed function call for one error case.
--- drivers/iio/accel/mma8452.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/accel/mma8452.c +4 -1
@@ -1576,10 +1576,13 @@ static int mma8452_probe(struct i2c_clie ret =mma8452_set_freefall_mode (data, false);if (ret <0 ) - goto buffer_cleanup; + goto unregister_device;return 0 ; +unregister_device: +iio_device_unregister (indio_dev); + buffer_cleanup:iio_triggered_buffer_cleanup (indio_dev);
Greg Kroah-Hartman
maintainerPATCH 44/86 iio: pressure: zpa2326: handle pm_runtime_get_sync failure
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
commit d88de040e1df38414fc1e4380be9d0e997ab4d58 upstream.
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count. Call pm_runtime_put if pm_runtime_get_sync fails.
--- drivers/iio/pressure/zpa2326.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/pressure/zpa2326.c +3 -1
@@ -676,8 +676,10 @@ static int zpa2326_resume(const struct iint err; err =pm_runtime_get_sync (indio_dev->dev.parent); -if (err <0 ) +if (err <0 ) { +pm_runtime_put (indio_dev->dev.parent);return err; + }if (err >0 ) {/*
Greg Kroah-Hartman
maintainerPATCH 45/86 iio:pressure:ms5611 Fix buffer element alignment
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 8db4afe163bbdd93dca6fcefbb831ef12ecc6b4d upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. Here there is no data leak possibility so use an explicit structure on the stack to ensure alignment and nice readable fashion.
The forced alignment of ts isn't strictly necessary in this driver as the padding will be correct anyway (there isn't any). However it is probably less fragile to have it there and it acts as documentation of the requirement.
--- drivers/iio/pressure/ms5611_core.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/iio/pressure/ms5611_core.c +8 -3
@@ -215,16 +215,21 @@ static irqreturn_t ms5611_trigger_handlestruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct ms5611_state *st =iio_priv (indio_dev); -s32 buf[4 ];/* s32 (pressure) + s32 (temp) + 2 * s32 (timestamp) */ +/* Ensure buffer elements are naturally aligned */ +struct { +s32 channels[2 ]; +s64 ts__aligned(8) ; + } scan;int ret;mutex_lock (&st->lock); - ret =ms5611_read_temp_and_pressure (indio_dev, &buf[1 ], &buf[0 ]); + ret =ms5611_read_temp_and_pressure (indio_dev, &scan.channels[1 ], + &scan.channels[0 ]);mutex_unlock (&st->lock);if (ret <0 ) goto err; -iio_push_to_buffers_with_timestamp (indio_dev, buf, +iio_push_to_buffers_with_timestamp (indio_dev, &scan,iio_get_time_ns (indio_dev)); err:
Greg Kroah-Hartman
maintainerPATCH 46/86 iio:health:afe4403 Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 3f9c6d38797e9903937b007a341dad0c251765d6 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 32 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak appart from previous readings.
--- drivers/iio/health/afe4403.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/iio/health/afe4403.c +8 -5
@@ -71,6 +71,7 @@ static const struct reg_field afe4403_re* @regulator: Pointer to the regulator for the IC * @trig: IIO trigger for this device * @irq: ADC_RDY line interrupt number +* @buffer: Used to construct data layout to push into IIO buffer. */ struct afe4403_data {struct device *dev;
@@ -80,6 +81,8 @@ struct afe4403_data {struct regulator *regulator;struct iio_trigger *trig;int irq; +/* Ensure suitable alignment for timestamp */ +s32 buffer[8 ]__aligned(8) ; };enum afe4403_chan_id {
@@ -318,7 +321,6 @@ static irqreturn_t afe4403_trigger_handlstruct iio_dev *indio_dev = pf->indio_dev;struct afe4403_data *afe =iio_priv (indio_dev);int ret, bit, i =0 ; -s32 buffer[8 ];u8 tx[4 ] = {AFE440X_CONTROL0 ,0x0 ,0x0 ,AFE440X_CONTROL0_READ };u8 rx[3 ];
@@ -335,9 +337,9 @@ static irqreturn_t afe4403_trigger_handlif (ret) goto err; - buffer[i++] = (rx[0 ] <<16 ) | - (rx[1 ] <<8 ) | - (rx[2 ]); + afe->buffer[i++] = (rx[0 ] <<16 ) | + (rx[1 ] <<8 ) | + (rx[2 ]); }/* Disable reading from the device */
@@ -346,7 +348,8 @@ static irqreturn_t afe4403_trigger_handlif (ret) goto err; -iio_push_to_buffers_with_timestamp (indio_dev, buffer, pf->timestamp); +iio_push_to_buffers_with_timestamp (indio_dev, afe->buffer, + pf->timestamp); err:iio_trigger_notify_done (indio_dev->trig);
Greg Kroah-Hartman
maintainerPATCH 47/86 spi: fix initial SPI_SR value in spi-fsl-dspi
In reply to Greg Kroah-HartmanFrom: Angelo Dureghello <[email protected]>
[ Upstream commit aa54c1c9d90e6db75190813907190fadcce1bf45 ]
On ColdFire mcf54418, using DSPI_DMA_MODE mode, spi transfers at first boot stage are not succeding:
m25p80 spi0.1: unrecognized JEDEC id bytes: 00, 00, 00
The reason is the SPI_SR initial value set by the driver, that is not clearing (not setting to 1) the RF_DF flag. After a tour on the dspi hw modules that use this driver(Vybrid, ColdFire and ls1021a) a better init value for SR register has been set.
--- drivers/spi/spi-fsl-dspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-fsl-dspi.c +1 -1
@@ -70,7 +70,7 @@#define SPI_SR 0x2c#define SPI_SR_EOQF 0x10000000#define SPI_SR_TCFQF 0x80000000 -#define SPI_SR_CLEAR 0xdaad0000 +#define SPI_SR_CLEAR 0x9aaf0000#define SPI_RSER 0x30#define SPI_RSER_EOQFE 0x10000000
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/86 net: dsa: bcm_sf2: Fix node reference count
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 8dbe4c5d5e40fe140221024f7b16bec9f310bf70 ]
of_find_node_by_name() will do an of_node_put() on the "from" argument. With CONFIG_OF_DYNAMIC enabled which checks for device_node reference counts, we would be getting a warning like this:
[ 6.347230] refcount_t: increment on 0; use-after-free. [ 6.352498] WARNING: CPU: 3 PID: 77 at lib/refcount.c:156 refcount_inc_checked+0x38/0x44 [ 6.360601] Modules linked in: [ 6.363661] CPU: 3 PID: 77 Comm: kworker/3:1 Tainted: G W 5.4.46-gb78b3e9956e6 #13 [ 6.372546] Hardware name: BCM97278SV (DT) [ 6.376649] Workqueue: events deferred_probe_work_func [ 6.381796] pstate: 60000005 (nZCv daif -PAN -UAO) [ 6.386595] pc : refcount_inc_checked+0x38/0x44 [ 6.391133] lr : refcount_inc_checked+0x38/0x44 ... [ 6.478791] Call trace: [ 6.481243] refcount_inc_checked+0x38/0x44 [ 6.485433] kobject_get+0x3c/0x4c [ 6.488840] of_node_get+0x24/0x34 [ 6.492247] of_irq_find_parent+0x3c/0xe0 [ 6.496263] of_irq_parse_one+0xe4/0x1d0 [ 6.500191] irq_of_parse_and_map+0x44/0x84 [ 6.504381] bcm_sf2_sw_probe+0x22c/0x844 [ 6.508397] platform_drv_probe+0x58/0xa8 [ 6.512413] really_probe+0x238/0x3fc [ 6.516081] driver_probe_device+0x11c/0x12c [ 6.520358] __device_attach_driver+0xa8/0x100 [ 6.524808] bus_for_each_drv+0xb4/0xd0 [ 6.528650] __device_attach+0xd0/0x164 [ 6.532493] device_initial_probe+0x24/0x30 [ 6.536682] bus_probe_device+0x38/0x98 [ 6.540524] deferred_probe_work_func+0xa8/0xd4 [ 6.545061] process_one_work+0x178/0x288 [ 6.549078] process_scheduled_works+0x44/0x48 [ 6.553529] worker_thread+0x218/0x270 [ 6.557285] kthread+0xdc/0xe4 [ 6.560344] ret_from_fork+0x10/0x18 [ 6.563925] ---[ end trace 68f65caf69bb152a ]---
Fix this by adding a of_node_get() to increment the reference count prior to the call.
--- drivers/net/dsa/bcm_sf2.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/dsa/bcm_sf2.c +2 -0
@@ -1039,6 +1039,8 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)spin_lock_init (&priv->indir_lock);mutex_init (&priv->stats_mutex); +/* Balance of_node_put() done by of_find_node_by_name() */ +of_node_get (dn); ports =of_find_node_by_name (dn,"ports" );if (ports) {bcm_sf2_identify_ports (priv, ports);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 49/86 Revert "usb/ehci-platform: Set PM runtime as active on resume"
In reply to Greg Kroah-HartmanThis reverts commit 5365fc3132a36a027fd7c2bb461e651b37f1e4d1.
Eugeniu Rosca writes:
Quoted 12 lines · Eugeniu Rosca
After integrating v4.14.186 commit
5410d158ca2a50("usb/ehci-platform:
Set PM runtime as active on resume") into downstream v4.14.x, we started to consistently experience below panic [1] on every second s2ram of R-Car H3 Salvator-X Renesas reference board.After some investigations, we concluded the following:
- the issue does not exist in vanilla v5.8-rc4+
- [bisecting shows that] the panic on v4.14.186 is caused by the lack of v5.6-rc1 commit987351e1ea7772("phy: core: Add consumer device link support"). Getting evidence for that is easy. Reverting987351e1ea7772in vanilla leads to a similar backtrace [2].
Quoted 9 lines
Questions:
- Backporting987351e1ea7772("phy: core: Add consumer device link support") to v4.14.187 looks challenging enough, so probably not worth it. Anybody to contradict this?
- Assuming no plans to backport the missing mainline commit to v4.14.x, should the following three v4.14.186 commits be reverted on v4.14.x?
*baef809ea497a4("usb/ohci-platform: Fix a warning when hibernating")
*9f33eff4958885("usb/xhci-plat: Set PM runtime as active on resume")
*5410d158ca2a50("usb/ehci-platform: Set PM runtime as active on resume")
--- drivers/usb/host/ehci-platform.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/usb/host/ehci-platform.c +0 -5
@@ -378,11 +378,6 @@ static int ehci_platform_resume(struct device *dev) }ehci_resume (hcd, priv->reset_on_resume); - -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -return 0 ; }#endif /* CONFIG_PM_SLEEP */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/86 Revert "usb/xhci-plat: Set PM runtime as active on resume"
In reply to Greg Kroah-HartmanThis reverts commit 9e148a5e5e0929a4cb3000de9c843a07508ce575.
Eugeniu Rosca writes:
Quoted 12 lines · Eugeniu Rosca
After integrating v4.14.186 commit
5410d158ca2a50("usb/ehci-platform:
Set PM runtime as active on resume") into downstream v4.14.x, we started to consistently experience below panic [1] on every second s2ram of R-Car H3 Salvator-X Renesas reference board.After some investigations, we concluded the following:
- the issue does not exist in vanilla v5.8-rc4+
- [bisecting shows that] the panic on v4.14.186 is caused by the lack of v5.6-rc1 commit987351e1ea7772("phy: core: Add consumer device link support"). Getting evidence for that is easy. Reverting987351e1ea7772in vanilla leads to a similar backtrace [2].
Quoted 9 lines
Questions:
- Backporting987351e1ea7772("phy: core: Add consumer device link support") to v4.14.187 looks challenging enough, so probably not worth it. Anybody to contradict this?
- Assuming no plans to backport the missing mainline commit to v4.14.x, should the following three v4.14.186 commits be reverted on v4.14.x?
*baef809ea497a4("usb/ohci-platform: Fix a warning when hibernating")
*9f33eff4958885("usb/xhci-plat: Set PM runtime as active on resume")
*5410d158ca2a50("usb/ehci-platform: Set PM runtime as active on resume")
--- drivers/usb/host/xhci-plat.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/usb/host/xhci-plat.c +1 -10
@@ -313,17 +313,8 @@ static int xhci_plat_resume(struct device *dev) {struct usb_hcd *hcd =dev_get_drvdata (dev);struct xhci_hcd *xhci =hcd_to_xhci (hcd); -int ret; - - ret =xhci_resume (xhci,0 ); -if (ret) -return ret; - -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -return 0 ; +return xhci_resume (xhci,0 ); }static const struct dev_pm_ops xhci_plat_pm_ops = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/86 Revert "usb/ohci-platform: Fix a warning when hibernating"
In reply to Greg Kroah-HartmanThis reverts commit 104592a5233d77322c3e527e3925dc7c5a30a6af.
Eugeniu Rosca writes:
Quoted 12 lines · Eugeniu Rosca
After integrating v4.14.186 commit
5410d158ca2a50("usb/ehci-platform:
Set PM runtime as active on resume") into downstream v4.14.x, we started to consistently experience below panic [1] on every second s2ram of R-Car H3 Salvator-X Renesas reference board.After some investigations, we concluded the following:
- the issue does not exist in vanilla v5.8-rc4+
- [bisecting shows that] the panic on v4.14.186 is caused by the lack of v5.6-rc1 commit987351e1ea7772("phy: core: Add consumer device link support"). Getting evidence for that is easy. Reverting987351e1ea7772in vanilla leads to a similar backtrace [2].
Quoted 9 lines
Questions:
- Backporting987351e1ea7772("phy: core: Add consumer device link support") to v4.14.187 looks challenging enough, so probably not worth it. Anybody to contradict this?
- Assuming no plans to backport the missing mainline commit to v4.14.x, should the following three v4.14.186 commits be reverted on v4.14.x?
*baef809ea497a4("usb/ohci-platform: Fix a warning when hibernating")
*9f33eff4958885("usb/xhci-plat: Set PM runtime as active on resume")
*5410d158ca2a50("usb/ehci-platform: Set PM runtime as active on resume")
--- drivers/usb/host/ohci-platform.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/usb/host/ohci-platform.c +0 -5
@@ -340,11 +340,6 @@ static int ohci_platform_resume(struct device *dev) }ohci_resume (hcd, false); - -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -return 0 ; }#endif /* CONFIG_PM_SLEEP */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/86 iio:health:afe4404 Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
[ Upstream commit f88ecccac4be348bbcc6d056bdbc622a8955c04d ]
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 40 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak appart from previous readings.
--- drivers/iio/health/afe4404.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/iio/health/afe4404.c +5 -3
@@ -91,6 +91,7 @@ static const struct reg_field afe4404_reg_fields[] = {* @regulator: Pointer to the regulator for the IC * @trig: IIO trigger for this device * @irq: ADC_RDY line interrupt number +* @buffer: Used to construct a scan to push to the iio buffer. */ struct afe4404_data {struct device *dev;
@@ -99,6 +100,7 @@ struct afe4404_data {struct regulator *regulator;struct iio_trigger *trig;int irq; +s32 buffer[10 ]__aligned(8) ; };enum afe4404_chan_id {
@@ -337,17 +339,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private)struct iio_dev *indio_dev = pf->indio_dev;struct afe4404_data *afe =iio_priv (indio_dev);int ret, bit, i =0 ; -s32 buffer[10 ];for_each_set_bit (bit, indio_dev->active_scan_mask, indio_dev->masklength) { ret =regmap_read (afe->regmap, afe4404_channel_values[bit], - &buffer[i++]); + &afe->buffer[i++]);if (ret) goto err; } -iio_push_to_buffers_with_timestamp (indio_dev, buffer, pf->timestamp); +iio_push_to_buffers_with_timestamp (indio_dev, afe->buffer, + pf->timestamp); err:iio_trigger_notify_done (indio_dev->trig);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/86 spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit ed7815db70d17b1741883f2da8e1d80bc2efe517 ]
A SPI transfer defines the _maximum_ speed of the SPI transfer. However the driver doesn't take into account that the clock divider is always rounded down (due to integer arithmetics). This results in a too high clock rate for the SPI transfer.
E.g.: with a mclk_rate of 24 MHz and a SPI transfer speed of 10 MHz, the original code calculates a reg of "0", which results in a effective divider of "2" and a 12 MHz clock for the SPI transfer.
This patch fixes the issue by using DIV_ROUND_UP() instead of a plain integer division.
While there simplify the divider calculation for the CDR1 case, use order_base_2() instead of two ilog2() calculations.
--- drivers/spi/spi-sun6i.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/spi/spi-sun6i.c +6 -8
@@ -163,7 +163,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master, struct spi_transfer *tfr) {struct sun6i_spi *sspi =spi_master_get_devdata (master); -unsigned int mclk_rate, div, timeout; +unsigned int mclk_rate, div, div_cdr1, div_cdr2, timeout;unsigned int start, end, tx_time;unsigned int tx_len =0 ;int ret =0 ;
@@ -241,14 +241,12 @@ static int sun6i_spi_transfer_one(struct spi_master *master,* First try CDR2, and if we can't reach the expected * frequency, fall back to CDR1. */ - div = mclk_rate / (2 * tfr->speed_hz); -if (div <= (SUN6I_CLK_CTL_CDR2_MASK +1 )) { -if (div >0 ) - div--; - - reg =SUN6I_CLK_CTL_CDR2 (div) |SUN6I_CLK_CTL_DRS ; + div_cdr1 =DIV_ROUND_UP (mclk_rate, tfr->speed_hz); + div_cdr2 =DIV_ROUND_UP (div_cdr1,2 ); +if (div_cdr2 <= (SUN6I_CLK_CTL_CDR2_MASK +1 )) { + reg =SUN6I_CLK_CTL_CDR2 (div_cdr2 -1 ) |SUN6I_CLK_CTL_DRS ; }else { - div =ilog2 (mclk_rate) -ilog2 (tfr->speed_hz); + div =min (SUN6I_CLK_CTL_CDR1_MASK ,order_base_2 (div_cdr1)); reg =SUN6I_CLK_CTL_CDR1 (div); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/86 usb: gadget: udc: atmel: fix uninitialized read in debug printk
In reply to Greg Kroah-HartmanFrom: Michał Mirosław <[email protected]>
[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ]
Fixed commit moved the assignment of 'req', but did not update a reference in the DBG() call. Use the argument as it was renamed.
--- drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/atmel_usba_udc.c +1 -1
@@ -843,7 +843,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)u32 status;DBG (DBG_GADGET |DBG_QUEUE ,"ep_dequeue: %s, req %p\n" , - ep->ep.name, req); + ep->ep.name, _req);spin_lock_irqsave (&udc->lock, flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 55/86 staging: comedi: verify array index is correct before using it
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ]
This code reads from the array before verifying that "trig" is a valid index. If the index is wildly out of bounds then reading from an invalid address could lead to an Oops.
--- drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1500.c +7 -3
@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,unsigned int lo_mask = data[5 ] << shift;unsigned int chan_mask = hi_mask | lo_mask;unsigned int old_mask = (1 << shift) -1 ; -unsigned int pm = devpriv->pm[trig] & old_mask; -unsigned int pt = devpriv->pt[trig] & old_mask; -unsigned int pp = devpriv->pp[trig] & old_mask; +unsigned int pm; +unsigned int pt; +unsigned int pp;if (trig >1 ) { dev_dbg(dev->class_dev,
@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,return -EINVAL ; } + pm = devpriv->pm[trig] & old_mask; + pt = devpriv->pt[trig] & old_mask; + pp = devpriv->pp[trig] & old_mask; +switch (data[2 ]) {case COMEDI_DIGITAL_TRIG_DISABLE :/* clear trigger configuration */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/86 Revert "thermal: mediatek: fix register index error"
In reply to Greg Kroah-HartmanFrom: Enric Balletbo i Serra <[email protected]>
[ Upstream commit a8f62f183021be389561570ab5f8c701a5e70298 ]
This reverts commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6
The above patch is supposed to fix a register index error on mt2701. It is not clear if the problem solved is a hang or just an invalid value returned, my guess is the second. The patch introduces, though, a new hang on MT8173 device making them unusable. So, seems reasonable, revert the patch because introduces a worst issue.
The reason I send a revert instead of trying to fix the issue for MT8173 is because the information needed to fix the issue is in the datasheet and is not public. So I am not really able to fix it.
Fixes the following bug when CONFIG_MTK_THERMAL is set on MT8173 devices.
[ 2.222488] Unable to handle kernel paging request at virtual address ffff8000125f5001 [ 2.230421] Mem abort info: [ 2.233207] ESR = 0x96000021 [ 2.236261] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.241571] SET = 0, FnV = 0 [ 2.244623] EA = 0, S1PTW = 0 [ 2.247762] Data abort info: [ 2.250640] ISV = 0, ISS = 0x00000021 [ 2.254473] CM = 0, WnR = 0 [ 2.257544] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041850000 [ 2.264251] [ffff8000125f5001] pgd=000000013ffff003, pud=000000013fffe003, pmd=000000013fff9003, pte=006800001100b707 [ 2.274867] Internal error: Oops: 96000021 [#1] PREEMPT SMP [ 2.280432] Modules linked in: [ 2.283483] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc6+ #162 [ 2.289914] Hardware name: Google Elm (DT) [ 2.294003] pstate: 20000005 (nzCv daif -PAN -UAO) [ 2.298792] pc : mtk_read_temp+0xb8/0x1c8 [ 2.302793] lr : mtk_read_temp+0x7c/0x1c8 [ 2.306794] sp : ffff80001003b930 [ 2.310100] x29: ffff80001003b930 x28: 0000000000000000 [ 2.315404] x27: 0000000000000002 x26: ffff0000f9550b10 [ 2.320709] x25: ffff0000f9550a80 x24: 0000000000000090 [ 2.326014] x23: ffff80001003ba24 x22: 00000000610344c0 [ 2.331318] x21: 0000000000002710 x20: 00000000000001f4 [ 2.336622] x19: 0000000000030d40 x18: ffff800011742ec0 [ 2.341926] x17: 0000000000000001 x16: 0000000000000001 [ 2.347230] x15: ffffffffffffffff x14: ffffff0000000000 [ 2.352535] x13: ffffffffffffffff x12: 0000000000000028 [ 2.357839] x11: 0000000000000003 x10: ffff800011295ec8 [ 2.363143] x9 : 000000000000291b x8 : 0000000000000002 [ 2.368447] x7 : 00000000000000a8 x6 : 0000000000000004 [ 2.373751] x5 : 0000000000000000 x4 : ffff800011295cb0 [ 2.379055] x3 : 0000000000000002 x2 : ffff8000125f5001 [ 2.384359] x1 : 0000000000000001 x0 : ffff0000f9550a80 [ 2.389665] Call trace: [ 2.392105] mtk_read_temp+0xb8/0x1c8 [ 2.395760] of_thermal_get_temp+0x2c/0x40 [ 2.399849] thermal_zone_get_temp+0x78/0x160 [ 2.404198] thermal_zone_device_update.part.0+0x3c/0x1f8 [ 2.409589] thermal_zone_device_update+0x34/0x48 [ 2.414286] of_thermal_set_mode+0x58/0x88 [ 2.418375] thermal_zone_of_sensor_register+0x1a8/0x1d8 [ 2.423679] devm_thermal_zone_of_sensor_register+0x64/0xb0 [ 2.429242] mtk_thermal_probe+0x690/0x7d0 [ 2.433333] platform_drv_probe+0x5c/0xb0 [ 2.437335] really_probe+0xe4/0x448 [ 2.440901] driver_probe_device+0xe8/0x140 [ 2.445077] device_driver_attach+0x7c/0x88 [ 2.449252] __driver_attach+0xac/0x178 [ 2.453082] bus_for_each_dev+0x78/0xc8 [ 2.456909] driver_attach+0x2c/0x38 [ 2.460476] bus_add_driver+0x14c/0x230 [ 2.464304] driver_register+0x6c/0x128 [ 2.468131] __platform_driver_register+0x50/0x60 [ 2.472831] mtk_thermal_driver_init+0x24/0x30 [ 2.477268] do_one_initcall+0x50/0x298 [ 2.481098] kernel_init_freeable+0x1ec/0x264 [ 2.485450] kernel_init+0x1c/0x110 [ 2.488931] ret_from_fork+0x10/0x1c [ 2.492502] Code: f9401081 f9400402 b8a67821 8b010042 (b9400042) [ 2.498599] ---[ end trace e43e3105ed27dc99 ]--- [ 2.503367] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 2.511020] SMP: stopping secondary CPUs [ 2.514941] Kernel Offset: disabled [ 2.518421] CPU features: 0x090002,25006005 [ 2.522595] Memory Limit: none [ 2.525644] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--
--- drivers/thermal/mtk_thermal.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/thermal/mtk_thermal.c +2 -4
@@ -348,8 +348,7 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)u32 raw;for (i =0 ; i < conf->bank_data[bank->id].num_sensors; i++) { - raw =readl (mt->thermal_base + - conf->msr[conf->bank_data[bank->id].sensors[i]]); + raw =readl (mt->thermal_base + conf->msr[i]); temp = raw_to_mcelsius(mt, conf->bank_data[bank->id].sensors[i],
@@ -486,8 +485,7 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,for (i =0 ; i < conf->bank_data[num].num_sensors; i++)writel (conf->sensor_mux_values[conf->bank_data[num].sensors[i]], - mt->thermal_base + - conf->adcpnp[conf->bank_data[num].sensors[i]]); + mt->thermal_base + conf->adcpnp[i]);writel ((1 << conf->bank_data[num].num_sensors) -1 , mt->thermal_base +TEMP_MONCTL0 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/86 ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit d7adfe5ffed9faa05f8926223086b101e14f700d ]
Fix dtschema validator warnings like:
l2-cache@fffff000: $nodename:0:
'l2-cache@fffff000' does not match '^(cache-controller|cpu)(@[0-9a-f,]+)*$'--- arch/arm/boot/dts/socfpga.dtsi | 2 +- arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/socfpga.dtsi +1 -1
@@ -676,7 +676,7 @@ ocram-ecc@ffd08144 { }; }; - L2: l2-cache@fffef000 { + L2: cache-controller@fffef000 { compatible = "arm,pl310-cache"; reg = <0xfffef000 0x1000>; interrupts = <0 38 0x04>;
arch/arm/boot/dts/socfpga_arria10.dtsi +1 -1
@@ -567,7 +567,7 @@ sdr: sdr@ffc25000 { reg = <0xffcfb100 0x80>; }; - L2: l2-cache@fffff000 { + L2: cache-controller@fffff000 { compatible = "arm,pl310-cache"; reg = <0xfffff000 0x1000>; interrupts = <0 18 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/86 perf stat: Zero all the ena and run array slot stats for interval mode
In reply to Greg Kroah-HartmanFrom: Jin Yao <[email protected]>
commit 0e0bf1ea1147fcf74eab19c2d3c853cc3740a72f upstream.
As the code comments in perf_stat_process_counter() say, we calculate counter's data every interval, and the display code shows ps->res_stats avg value. We need to zero the stats for interval mode.
But the current code only zeros the res_stats[0], it doesn't zero the res_stats[1] and res_stats[2], which are for ena and run of counter.
This patch zeros the whole res_stats[] for interval mode.
--- tools/perf/util/stat.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/perf/util/stat.c +4 -2
@@ -341,8 +341,10 @@ int perf_stat_process_counter(struct per* interval mode, otherwise overall avg running * averages will be shown for each interval. */ -if (config->interval) -init_stats (ps->res_stats); +if (config->interval) { +for (i =0 ; i <3 ; i++) +init_stats (&ps->res_stats[i]); + }if (counter->per_pkg)zero_per_pkg (counter);
Greg Kroah-Hartman
maintainerPATCH 59/86 mtd: rawnand: brcmnand: fix CS0 layout
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
commit 3d3fb3c5be9ce07fa85d8f67fb3922e4613b955b upstream.
Only v3.3-v5.0 have a different CS0 layout. Controllers before v3.3 use the same layout for every CS.
--- drivers/mtd/nand/brcmnand/brcmnand.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/mtd/nand/brcmnand/brcmnand.c +3 -2
@@ -491,8 +491,9 @@ static int brcmnand_revision_init(struct }else { ctrl->cs_offsets = brcmnand_cs_offsets; -/* v5.0 and earlier has a different CS0 offset layout */ -if (ctrl->nand_version <=0x0500 ) +/* v3.3-5.0 have a different CS0 offset layout */ +if (ctrl->nand_version >=0x0303 && + ctrl->nand_version <=0x0500 ) ctrl->cs0_offsets = brcmnand_cs_offsets_cs0; }
Greg Kroah-Hartman
maintainerPATCH 60/86 HID: magicmouse: do not set up autorepeat
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream.
Neither the trackpad, nor the mouse want input core to generate autorepeat events for their buttons, so let's reset the bit (as hid-input sets it for these devices based on the usage vendor code).
--- drivers/hid/hid-magicmouse.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hid/hid-magicmouse.c +6 -0
@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct__set_bit (MSC_RAW , input->mscbit); } +/* +* hid-input may mark device as using autorepeat, but neither +* the trackpad, nor the mouse actually want it. +*/ +__clear_bit (EV_REP , input->evbit); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 61/86 usb: core: Add a helper function to check the validity of EP type in URB
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit e901b9873876ca30a09253731bd3a6b00c44b5b0 upstream.
This patch adds a new helper function to perform a sanity check of the given URB to see whether it contains a valid endpoint. It's a light- weight version of what usb_submit_urb() does, but without the kernel warning followed by the stack trace, just returns an error code.
Especially for a driver that doesn't parse the descriptor but fills the URB with the fixed endpoint (e.g. some quirks for non-compliant devices), this kind of check is preferable at the probe phase before actually submitting the urb.
--- drivers/usb/core/urb.c | 30 ++++++++++++++++++++++++++---- include/linux/usb.h | 2 ++ 2 files changed, 28 insertions(+), 4 deletions(-)
drivers/usb/core/urb.c +26 -4
@@ -183,6 +183,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);/*-------------------------------------------------------------------*/ +static const int pipetypes[4 ] = { +PIPE_CONTROL ,PIPE_ISOCHRONOUS ,PIPE_BULK ,PIPE_INTERRUPT +}; + +/** +* usb_urb_ep_type_check - sanity check of endpoint in the given urb +* @urb: urb to be checked +* +* This performs a light-weight sanity check for the endpoint in the +* given urb. It returns 0 if the urb contains a valid endpoint, otherwise +* a negative error code. +*/ +int usb_urb_ep_type_check (const struct urb *urb) +{ +const struct usb_host_endpoint *ep; + + ep =usb_pipe_endpoint (urb->dev, urb->pipe); +if (!ep) +return -EINVAL ; +if (usb_pipetype (urb->pipe) != pipetypes[usb_endpoint_type (&ep->desc)]) +return -EINVAL ; +return 0 ; +} +EXPORT_SYMBOL_GPL (usb_urb_ep_type_check); +/** * usb_submit_urb - issue an asynchronous transfer request for an endpoint * @urb: pointer to the urb describing the request
@@ -322,9 +347,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);*/ int usb_submit_urb (struct urb *urb,gfp_t mem_flags) { -static int pipetypes[4 ] = { -PIPE_CONTROL ,PIPE_ISOCHRONOUS ,PIPE_BULK ,PIPE_INTERRUPT - };int xfertype, max;struct usb_device *dev;struct usb_host_endpoint *ep;
@@ -443,7 +465,7 @@ int usb_submit_urb(struct urb *urb, gfp_*/ /* Check that the pipe's type matches the endpoint's type */ -if (usb_pipetype (urb->pipe) != pipetypes[xfertype]) +if (usb_urb_ep_type_check (urb))dev_WARN (&dev->dev,"BOGUS urb xfer, pipe %x != type %x\n" ,usb_pipetype (urb->pipe), pipetypes[xfertype]);
include/linux/usb.h +2 -0
@@ -1655,6 +1655,8 @@ static inline int usb_urb_dir_out(structreturn (urb->transfer_flags &URB_DIR_MASK ) ==URB_DIR_OUT ; } +int usb_urb_ep_type_check (const struct urb *urb); +void *usb_alloc_coherent (struct usb_device *dev,size_t size,gfp_t mem_flags,dma_addr_t *dma); void usb_free_coherent(struct usb_device *dev, size_t size,
Greg Kroah-Hartman
maintainerPATCH 62/86 ALSA: line6: Perform sanity check for each URB creation
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream.
LINE6 drivers create stream URBs with a fixed pipe without checking its validity, and this may lead to a kernel WARNING at the submission when a malformed USB descriptor is passed.
For avoiding the kernel warning, perform the similar sanity checks for each pipe type at creating a URB.
--- sound/usb/line6/capture.c | 2 ++ sound/usb/line6/playback.c | 2 ++ 2 files changed, 4 insertions(+)
sound/usb/line6/capture.c +2 -0
@@ -291,6 +291,8 @@ int line6_create_audio_in_urbs(struct sn urb->interval =LINE6_ISO_INTERVAL ; urb->error_count =0 ; urb->complete = audio_in_callback; +if (usb_urb_ep_type_check (urb)) +return -EINVAL ; }return 0 ;
sound/usb/line6/playback.c +2 -0
@@ -436,6 +436,8 @@ int line6_create_audio_out_urbs(struct s urb->interval =LINE6_ISO_INTERVAL ; urb->error_count =0 ; urb->complete = audio_out_callback; +if (usb_urb_ep_type_check (urb)) +return -EINVAL ; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 63/86 ALSA: usb-audio: Fix race against the error recovery URB submission
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream.
USB MIDI driver has an error recovery mechanism to resubmit the URB in the delayed timer handler, and this may race with the standard start / stop operations. Although both start and stop operations themselves don't race with each other due to the umidi->mutex protection, but this isn't applied to the timer handler.
For fixing this potential race, the following changes are applied:
- Since the timer handler can't use the mutex, we apply the umidi->disc_lock protection at each input stream URB submission; this also needs to change the GFP flag to GFP_ATOMIC
- Add a check of the URB refcount and skip if already submitted
- Move the timer cancel call at disconnection to the beginning of the procedure; this assures the in-flight timer handler is gone properly before killing all pending URBs
--- sound/usb/midi.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
sound/usb/midi.c +12 -5
@@ -1477,6 +1477,8 @@ void snd_usbmidi_disconnect(struct list_spin_unlock_irq (&umidi->disc_lock);up_write (&umidi->disc_rwsem); +del_timer_sync (&umidi->error_timer); +for (i =0 ; i <MIDI_MAX_ENDPOINTS ; ++i) {struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];if (ep->out)
@@ -1503,7 +1505,6 @@ void snd_usbmidi_disconnect(struct list_ ep->in =NULL ; } } -del_timer_sync (&umidi->error_timer); }EXPORT_SYMBOL (snd_usbmidi_disconnect);
@@ -2260,16 +2261,22 @@ void snd_usbmidi_input_stop(struct list_ }EXPORT_SYMBOL (snd_usbmidi_input_stop); -static void snd_usbmidi_input_start_ep (struct snd_usb_midi_in_endpoint *ep) +static void snd_usbmidi_input_start_ep (struct snd_usb_midi *umidi, +struct snd_usb_midi_in_endpoint *ep) {unsigned int i; +unsigned long flags;if (!ep)return ;for (i =0 ; i <INPUT_URBS ; ++i) {struct urb *urb = ep->urbs[i]; - urb->dev = ep->umidi->dev; -snd_usbmidi_submit_urb (urb,GFP_KERNEL ); +spin_lock_irqsave (&umidi->disc_lock, flags); +if (!atomic_read (&urb->use_count)) { + urb->dev = ep->umidi->dev; +snd_usbmidi_submit_urb (urb,GFP_ATOMIC ); + } +spin_unlock_irqrestore (&umidi->disc_lock, flags); } }
@@ -2285,7 +2292,7 @@ void snd_usbmidi_input_start(struct listif (umidi->input_running || !umidi->opened[1 ])return ;for (i =0 ; i <MIDI_MAX_ENDPOINTS ; ++i) -snd_usbmidi_input_start_ep (umidi->endpoints[i].in); +snd_usbmidi_input_start_ep (umidi, umidi->endpoints[i].in); umidi->input_running =1 ; }EXPORT_SYMBOL (snd_usbmidi_input_start);
Greg Kroah-Hartman
maintainerPATCH 64/86 USB: c67x00: fix use after free in c67x00_giveback_urb
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream.
clang static analysis flags this error
c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc]
usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
^~~~~~~~~~~~Problem happens in this block of code
c67x00_release_urb(c67x00, urb); usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); spin_unlock(&c67x00->lock); usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
In the call to c67x00_release_urb has this freeing of urbp
urbp = urb->hcpriv; urb->hcpriv = NULL; list_del(&urbp->hep_node); kfree(urbp);
And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd parameter.
Since all is required is the status, pass the status directly as is done in c64x00_urb_dequeue
--- drivers/usb/c67x00/c67x00-sched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/c67x00/c67x00-sched.c +1 -1
@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *cc67x00_release_urb (c67x00, urb);usb_hcd_unlink_urb_from_ep (c67x00_hcd_to_hcd (c67x00), urb);spin_unlock (&c67x00->lock); -usb_hcd_giveback_urb (c67x00_hcd_to_hcd (c67x00), urb, urbp->status); +usb_hcd_giveback_urb (c67x00_hcd_to_hcd (c67x00), urb, status);spin_lock (&c67x00->lock); }
Greg Kroah-Hartman
maintainerPATCH 65/86 usb: dwc2: Fix shutdown callback in platform
In reply to Greg Kroah-HartmanFrom: Minas Harutyunyan <[email protected]>
commit 4fdf228cdf6925af45a2066d403821e0977bfddb upstream.
To avoid lot of interrupts from dwc2 core, which can be asserted in specific conditions need to disable interrupts on HW level instead of disable IRQs on Kernel level, because of IRQ can be shared between drivers.
--- drivers/usb/dwc2/platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/dwc2/platform.c +2 -1
@@ -507,7 +507,8 @@ static void dwc2_driver_shutdown(struct {struct dwc2_hsotg *hsotg =platform_get_drvdata (dev); -disable_irq (hsotg->irq); +dwc2_disable_global_interrupts (hsotg); +synchronize_irq (hsotg->irq); }static const struct of_device_id dwc2_of_match_table[] = {
Greg Kroah-Hartman
maintainerPATCH 66/86 usb: chipidea: core: add wakeup support for extcon
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream.
If wakeup event occurred by extcon event, it needs to call ci_irq again since the first ci_irq calling at extcon notifier only wakes up controller, but do noop for event handling, it causes the extcon use case can't work well from low power mode.
--- drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/usb/chipidea/core.c +24 -0
@@ -1110,6 +1110,29 @@ static void ci_controller_suspend(structenable_irq (ci->irq); } +/* +* Handle the wakeup interrupt triggered by extcon connector +* We need to call ci_irq again for extcon since the first +* interrupt (wakeup int) only let the controller be out of +* low power mode, but not handle any interrupts. +*/ +static void ci_extcon_wakeup_int (struct ci_hdrc *ci) +{ +struct ci_hdrc_cable *cable_id, *cable_vbus; +u32 otgsc =hw_read_otgsc (ci, ~0 ); + + cable_id = &ci->platdata->id_extcon; + cable_vbus = &ci->platdata->vbus_extcon; + +if (!IS_ERR (cable_id->edev) && ci->is_otg && + (otgsc &OTGSC_IDIE ) && (otgsc &OTGSC_IDIS )) +ci_irq (ci->irq, ci); + +if (!IS_ERR (cable_vbus->edev) && ci->is_otg && + (otgsc &OTGSC_BSVIE ) && (otgsc &OTGSC_BSVIS )) +ci_irq (ci->irq, ci); +} +static int ci_controller_resume (struct device *dev) {struct ci_hdrc *ci =dev_get_drvdata (dev);
@@ -1136,6 +1159,7 @@ static int ci_controller_resume(struct denable_irq (ci->irq);if (ci_otg_is_fsm_mode (ci))ci_otg_fsm_wakeup_by_srp (ci); +ci_extcon_wakeup_int (ci); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 67/86 usb: gadget: function: fix missing spinlock in f_uac1_legacy
In reply to Greg Kroah-HartmanFrom: Zhang Qiang <[email protected]>
commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream.
Add a missing spinlock protection for play_queue, because the play_queue may be destroyed when the "playback_work" work func and "f_audio_out_ep_complete" callback func operate this paly_queue at the same time.
--- drivers/usb/gadget/function/f_uac1.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/function/f_uac1.c +2 -0
@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struc/* Copy buffer is full, add it to the play_queue */ if (audio_buf_size - copy_buf->actual < req->actual) { +spin_lock_irq (&audio->lock);list_add_tail (©_buf->list, &audio->play_queue); +spin_unlock_irq (&audio->lock);schedule_work (&audio->playback_work); copy_buf =f_audio_buffer_alloc (audio_buf_size);if (IS_ERR (copy_buf))
Greg Kroah-Hartman
maintainerPATCH 68/86 USB: serial: iuu_phoenix: fix memory corruption
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream.
The driver would happily overwrite its write buffer with user data in 256 byte increments due to a removed buffer-space sanity check.
--- drivers/usb/serial/iuu_phoenix.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/serial/iuu_phoenix.c +5 -3
@@ -717,14 +717,16 @@ static int iuu_uart_write(struct tty_strstruct iuu_private *priv =usb_get_serial_port_data (port);unsigned long flags; -if (count >256 ) -return -ENOMEM ; -spin_lock_irqsave (&priv->lock, flags); + count =min (count,256 - priv->writelen); +if (count ==0 ) + goto out; +/* fill the buffer */ memcpy (priv->writebuf + priv->writelen, buf, count); priv->writelen += count; +out:spin_unlock_irqrestore (&priv->lock, flags);return count;
Greg Kroah-Hartman
maintainerPATCH 69/86 USB: serial: cypress_m8: enable Simply Automated UPB PIM
In reply to Greg Kroah-HartmanFrom: James Hilliard <[email protected]>
commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream.
This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module) which allows for controlling multiple UPB compatible devices from Linux using the standard serial interface.
Based on vendor application source code there are two different models of USB based PIM devices in addition to a number of RS232 based PIM's.
The vendor UPB application source contains the following USB ID's:
#define USB_PCS_VENDOR_ID 0x04b4 #define USB_PCS_PIM_PRODUCT_ID 0x5500 #define USB_SAI_VENDOR_ID 0x17dd #define USB_SAI_PIM_PRODUCT_ID 0x5500
The first set of ID's correspond to the PIM variant sold by Powerline Control Systems while the second corresponds to the Simply Automated Incorporated PIM. As the product ID for both of these match the default cypress HID->COM RS232 product ID it assumed that they both use an internal variant of this HID->COM RS232 converter hardware. However as the vendor ID for the Simply Automated variant is different we need to also add it to the cypress_M8 driver so that it is properly detected.
--- drivers/usb/serial/cypress_m8.c | 2 ++ drivers/usb/serial/cypress_m8.h | 3 +++ 2 files changed, 5 insertions(+)
drivers/usb/serial/cypress_m8.c +2 -0
@@ -63,6 +63,7 @@ static const struct usb_device_id id_tabstatic const struct usb_device_id id_table_cyphidcomrs232[] = { {USB_DEVICE (VENDOR_ID_CYPRESS ,PRODUCT_ID_CYPHIDCOM ) }, + {USB_DEVICE (VENDOR_ID_SAI ,PRODUCT_ID_CYPHIDCOM ) }, {USB_DEVICE (VENDOR_ID_POWERCOM ,PRODUCT_ID_UPS ) }, {USB_DEVICE (VENDOR_ID_FRWD ,PRODUCT_ID_CYPHIDCOM_FRWD ) }, { }/* Terminating entry */
@@ -77,6 +78,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) }, { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) }, { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
drivers/usb/serial/cypress_m8.h +3 -0
@@ -24,6 +24,9 @@#define VENDOR_ID_CYPRESS 0x04b4#define PRODUCT_ID_CYPHIDCOM 0x5500 +/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */ +#define VENDOR_ID_SAI 0x17dd +/* FRWD Dongle - a GPS sports watch */ #define VENDOR_ID_FRWD 0x6737#define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001
Greg Kroah-Hartman
maintainerPATCH 70/86 USB: serial: ch341: add new Product ID for CH340
In reply to Greg Kroah-HartmanFrom: Igor Moura <[email protected]>
commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream.
Add PID for CH340 that's found on some ESP8266 dev boards made by LilyGO. The specific device that contains such serial converter can be seen here: https://github.com/LilyGO/LILYGO-T-OI.
Apparently, it's a regular CH340, but I've confirmed with others that also bought this board that the PID found on this device (0x7522) differs from other devices with the "same" converter (0x7523). Simply adding its PID to the driver and rebuilding it made it work as expected.
--- drivers/usb/serial/ch341.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/ch341.c +1 -0
@@ -71,6 +71,7 @@static const struct usb_device_id id_table[] = { {USB_DEVICE (0x4348 ,0x5523 ) }, + {USB_DEVICE (0x1a86 ,0x7522 ) }, {USB_DEVICE (0x1a86 ,0x7523 ) }, {USB_DEVICE (0x1a86 ,0x5523 ) }, { },
Greg Kroah-Hartman
maintainerPATCH 71/86 USB: serial: option: add GosunCn GM500 series
In reply to Greg Kroah-HartmanFrom: Jörgen Storvist <[email protected]>
commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream.
Add USB IDs for GosunCn GM500 series cellular modules.
RNDIS config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=305a ProdID=1404 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
MBIM config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=305a ProdID=1405 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
ECM config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=305a ProdID=1406 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -2019,6 +2019,9 @@ static const struct usb_device_id option .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ .driver_info = RSVD(6) }, + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 72/86 USB: serial: option: add Quectel EG95 LTE modem
In reply to Greg Kroah-HartmanFrom: AceLan Kao <[email protected]>
commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream.
Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0195 Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -248,6 +248,7 @@ static void option_instat_callback(struc/* These Quectel products use Quectel's vendor ID */ #define QUECTEL_PRODUCT_EC21 0x0121#define QUECTEL_PRODUCT_EC25 0x0125 +#define QUECTEL_PRODUCT_EG95 0x0195#define QUECTEL_PRODUCT_BG96 0x0296#define QUECTEL_PRODUCT_EP06 0x0306
@@ -1095,6 +1096,8 @@ static const struct usb_device_id option .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95), + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),
Greg Kroah-Hartman
maintainerPATCH 73/86 virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
commit 897c44f0bae574c5fb318c759b060bebf9dd6013 upstream.
rproc_serial_id_table lacks an exposure to module devicetable, so when remoteproc firmware requests VIRTIO_ID_RPROC_SERIAL, no uevent is generated and no module autoloading occurs.
Add missing MODULE_DEVICE_TABLE() annotation and move the existing one for VIRTIO_ID_CONSOLE right to the table itself.
--- drivers/char/virtio_console.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/char/virtio_console.c +2 -1
@@ -2161,6 +2161,7 @@ static struct virtio_device_id id_table[ { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID }, { 0 }, }; +MODULE_DEVICE_TABLE (virtio, id_table);static unsigned int features[] = { VIRTIO_CONSOLE_F_SIZE,
@@ -2173,6 +2174,7 @@ static struct virtio_device_id rproc_ser#endif { 0 }, }; +MODULE_DEVICE_TABLE (virtio, rproc_serial_id_table);static unsigned int rproc_serial_features[] = { };
@@ -2325,6 +2327,5 @@ static void __exit fini(void)module_init (init);module_exit (fini); -MODULE_DEVICE_TABLE (virtio, id_table);MODULE_DESCRIPTION ("Virtio console driver" );MODULE_LICENSE ("GPL" );
Greg Kroah-Hartman
maintainerPATCH 74/86 fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
In reply to Greg Kroah-HartmanFrom: Chirantan Ekbote <[email protected]>
commit 31070f6ccec09f3bd4f1e28cd1e592fa4f3ba0b6 upstream.
The ioctl encoding for this parameter is a long but the documentation says it should be an int and the kernel drivers expect it to be an int. If the fuse driver treats this as a long it might end up scribbling over the stack of a userspace process that only allocated enough space for an int.
This was previously discussed in [1] and a patch for fuse was proposed in [2]. From what I can tell the patch in [2] was nacked in favor of adding new, "fixed" ioctls and using those from userspace. However there is still no "fixed" version of these ioctls and the fact is that it's sometimes infeasible to change all userspace to use the new one.
Handling the ioctls specially in the fuse driver seems like the most pragmatic way for fuse servers to support them without causing crashes in userspace applications that call them.
[1]: https://lore.kernel.org/linux-fsdevel/[email protected]/T/
[2]: https://sourceforge.net/p/fuse/mailman/message/31771759/
--- fs/fuse/file.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/fuse/file.c +11 -1
@@ -17,6 +17,7 @@#include <linux/swap.h> #include <linux/falloc.h> #include <linux/uio.h> +#include <linux/fs.h> static const struct file_operations fuse_direct_io_file_operations;
@@ -2520,7 +2521,16 @@ long fuse_do_ioctl(struct file *file, unstruct iovec *iov = iov_page; iov->iov_base = (void __user *)arg; - iov->iov_len =_IOC_SIZE (cmd); + +switch (cmd) { +case FS_IOC_GETFLAGS : +case FS_IOC_SETFLAGS : + iov->iov_len =sizeof (int ); +break ; +default : + iov->iov_len =_IOC_SIZE (cmd); +break ; + }if (_IOC_DIR (cmd) & _IOC_WRITE) { in_iov = iov;
Greg Kroah-Hartman
maintainerPATCH 75/86 mei: bus: dont clean driver pointer
In reply to Greg Kroah-HartmanFrom: Alexander Usyskin <[email protected]>
commit e852c2c251ed9c23ae6e3efebc5ec49adb504207 upstream.
It's not needed to set driver to NULL in mei_cl_device_remove() which is bus_type remove() handler as this is done anyway in __device_release_driver().
Actually this is causing an endless loop in driver_detach() on ubuntu patched kernel, while removing (rmmod) the mei_hdcp module. The reason list_empty(&drv->p->klist_devices.k_list) is always not-empty. as the check is always true in __device_release_driver()
if (dev->driver != drv) return;
The non upstream patch is causing this behavior, titled:
'vfio -- release device lock before userspace requests'
Nevertheless the fix is correct also for the upstream.
--- drivers/misc/mei/bus.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/misc/mei/bus.c +1 -2
@@ -639,9 +639,8 @@ static int mei_cl_device_remove(struct d ret = cldrv->remove (cldev);module_put (THIS_MODULE ); - dev->driver =NULL ; -return ret; +return ret; } static ssize_t name_show(struct device *dev, struct device_attribute *a,
Greg Kroah-Hartman
maintainerPATCH 76/86 Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
In reply to Greg Kroah-HartmanFrom: David Pedersen <[email protected]>
commit 17d51429da722cd8fc77a365a112f008abf4f8b3 upstream.
This fixes two finger trackpad scroll on the Lenovo XiaoXin Air 12. Without nomux, the trackpad behaves as if only one finger is present and moves the cursor when trying to scroll.
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -430,6 +430,13 @@ static const struct dmi_system_id __init }, }, { +/* Lenovo XiaoXin Air 12 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "80UN"), + }, + }, + { .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
Greg Kroah-Hartman
maintainerPATCH 77/86 uio_pdrv_genirq: fix use without device tree and no interrupt
In reply to Greg Kroah-HartmanFrom: Esben Haabendal <[email protected]>
commit bf12fdf0ab728ca8e5933aac46dd972c0dd0421e upstream.
While e3a3c3a20555 ("UIO: fix uio_pdrv_genirq with device tree but no interrupt") added support for using uio_pdrv_genirq for devices without interrupt for device tree platforms, the removal of uio_pdrv in 26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead") broke the support for non device tree platforms.
This change fixes this, so that uio_pdrv_genirq can be used without interrupt on all platforms.
This still leaves the support that uio_pdrv had for custom interrupt handler lacking, as uio_pdrv_genirq does not handle it (yet).
--- drivers/uio/uio_pdrv_genirq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/uio/uio_pdrv_genirq.c +1 -1
@@ -148,7 +148,7 @@ static int uio_pdrv_genirq_probe(structif (!uioinfo->irq) { ret =platform_get_irq (pdev,0 ); uioinfo->irq = ret; -if (ret == -ENXIO && pdev->dev.of_node) +if (ret == -ENXIO ) uioinfo->irq =UIO_IRQ_NONE ;else if (ret <0 ) {dev_err (&pdev->dev,"failed to get IRQ\n" );
Greg Kroah-Hartman
maintainerPATCH 78/86 timer: Fix wheel index calculation on last level
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
commit e2a71bdea81690b6ef11f4368261ec6f5b6891aa upstream.
When an expiration delta falls into the last level of the wheel, that delta has be compared against the maximum possible delay and reduced to fit in if necessary.
However instead of comparing the delta against the maximum, the code compares the actual expiry against the maximum. Then instead of fixing the delta to fit in, it sets the maximum delta as the expiry value.
This can result in various undesired outcomes, the worst possible one being a timer expiring 15 days ahead to fire immediately.
--- kernel/time/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/time/timer.c +2 -2
@@ -500,8 +500,8 @@ static int calc_wheel_index(unsigned lon* Force expire obscene large timeouts to expire at the * capacity limit of the wheel. */ -if (expires >=WHEEL_TIMEOUT_CUTOFF ) - expires =WHEEL_TIMEOUT_MAX ; +if (delta >=WHEEL_TIMEOUT_CUTOFF ) + expires = clk +WHEEL_TIMEOUT_MAX ; idx =calc_index (expires,LVL_DEPTH -1 ); }
Greg Kroah-Hartman
maintainerPATCH 79/86 MIPS: Fix build for LTS kernel caused by backporting lpj adjustment
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
Commit ed26aacfb5f71eecb20a ("mips: Add udelay lpj numbers adjustment") has backported to 4.4~5.4, but the "struct cpufreq_freqs" (and also the cpufreq notifier machanism) of 4.4~4.19 are different from the upstream kernel. These differences cause build errors, and this patch can fix the build.
--- arch/mips/kernel/time.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
arch/mips/kernel/time.c +4 -9
@@ -40,10 +40,8 @@ static unsigned long glb_lpj_ref_freq;static int cpufreq_callback (struct notifier_block *nb,unsigned long val,void *data) { -struct cpufreq_freqs *freq = data; -struct cpumask *cpus = freq->policy->cpus; -unsigned long lpj;int cpu; +struct cpufreq_freqs *freq = data;/* * Skip lpj numbers adjustment if the CPU-freq transition is safe for
@@ -64,6 +62,7 @@ static int cpufreq_callback(struct notif } } + cpu = freq->cpu;/* * Adjust global lpj variable and per-CPU udelay_val number in * accordance with the new CPU frequency.
@@ -74,12 +73,8 @@ static int cpufreq_callback(struct notif glb_lpj_ref_freq, freq->new); -for_each_cpu (cpu, cpus) { - lpj =cpufreq_scale (per_cpu (pcp_lpj_ref, cpu), -per_cpu (pcp_lpj_ref_freq, cpu), - freq->new); - cpu_data[cpu].udelay_val = (unsigned int )lpj; - } + cpu_data[cpu].udelay_val =cpufreq_scale (per_cpu (pcp_lpj_ref, cpu), +per_cpu (pcp_lpj_ref_freq, cpu), freq->new); }return NOTIFY_OK ;
Greg Kroah-Hartman
maintainerPATCH 80/86 hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
In reply to Greg Kroah-HartmanFrom: Vishwas M <[email protected]>
commit 14b0e83dc4f1e52b94acaeb85a18fd7fdd46d2dc upstream.
This patch fixes a bug which does not let FAN mode to be changed from sysfs(pwm1_enable). i.e pwm1_enable can not be set to 3, it will always remain at 0.
This is caused because the device driver handles the result of "read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg)" incorrectly. The driver thinks an error has occurred if the (result != 0). This has been fixed by changing the condition to (result < 0).
--- drivers/hwmon/emc2103.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/emc2103.c +1 -1
@@ -452,7 +452,7 @@ static ssize_t set_pwm_enable(struct dev } result =read_u8_from_i2c (client,REG_FAN_CONF1 , &conf_reg); -if (result) { +if (result <0 ) { count = result; goto err; }
Greg Kroah-Hartman
maintainerPATCH 81/86 dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit f5e5677c420346b4e9788051c2e4d750996c428c upstream.
NULL pointer exception happens occasionally on serial output initiated by login timeout. This was reproduced only if kernel was built with significant debugging options and EDMA driver is used with serial console.
col-vf50 login: root
Password:
Login timed out after 60 seconds.
Unable to handle kernel NULL pointer dereference at virtual address 00000044
Internal error: Oops: 5 [#1] ARM
CPU: 0 PID: 157 Comm: login Not tainted 5.7.0-next-20200610-dirty #4
Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
(fsl_edma_tx_handler) from [<8016eb10>] (__handle_irq_event_percpu+0x64/0x304)
(__handle_irq_event_percpu) from [<8016eddc>] (handle_irq_event_percpu+0x2c/0x7c)
(handle_irq_event_percpu) from [<8016ee64>] (handle_irq_event+0x38/0x5c)
(handle_irq_event) from [<801729e4>] (handle_fasteoi_irq+0xa4/0x160)
(handle_fasteoi_irq) from [<8016ddcc>] (generic_handle_irq+0x34/0x44)
(generic_handle_irq) from [<8016e40c>] (__handle_domain_irq+0x54/0xa8)
(__handle_domain_irq) from [<80508bc8>] (gic_handle_irq+0x4c/0x80)
(gic_handle_irq) from [<80100af0>] (__irq_svc+0x70/0x98)
Exception stack(0x8459fe80 to 0x8459fec8)
fe80: 72286b00 e3359f64 00000001 0000412d a0070013 85c98840 85c98840 a0070013
fea0: 8054e0d4 00000000 00000002 00000000 00000002 8459fed0 8081fbe8 8081fbec
fec0: 60070013 ffffffff
(__irq_svc) from [<8081fbec>] (_raw_spin_unlock_irqrestore+0x30/0x58)
(_raw_spin_unlock_irqrestore) from [<8056cb48>] (uart_flush_buffer+0x88/0xf8)
(uart_flush_buffer) from [<80554e60>] (tty_ldisc_hangup+0x38/0x1ac)
(tty_ldisc_hangup) from [<8054c7f4>] (__tty_hangup+0x158/0x2bc)
(__tty_hangup) from [<80557b90>] (disassociate_ctty.part.1+0x30/0x23c)
(disassociate_ctty.part.1) from [<8011fc18>] (do_exit+0x580/0xba0)
(do_exit) from [<801214f8>] (do_group_exit+0x3c/0xb4)
(do_group_exit) from [<80121580>] (__wake_up_parent+0x0/0x14)Issue looks like race condition between interrupt handler fsl_edma_tx_handler() (called as result of fsl_edma_xfer_desc()) and terminating the transfer with fsl_edma_terminate_all().
The fsl_edma_tx_handler() handles interrupt for a transfer with already freed edesc and idle==true.
--- drivers/dma/fsl-edma.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/dma/fsl-edma.c +7 -0
@@ -682,6 +682,13 @@ static irqreturn_t fsl_edma_tx_handler(i fsl_chan = &fsl_edma->chans[ch];spin_lock (&fsl_chan->vchan.lock); + +if (!fsl_chan->edesc) { +/* terminate_all called before */ +spin_unlock (&fsl_chan->vchan.lock); +continue ; + } +if (!fsl_chan->edesc->iscyclic) {list_del (&fsl_chan->edesc->vdesc.node);vchan_cookie_complete (&fsl_chan->edesc->vdesc);
Greg Kroah-Hartman
maintainerPATCH 82/86 misc: atmel-ssc: lock with mutex instead of spinlock
In reply to Greg Kroah-HartmanFrom: Michał Mirosław <[email protected]>
commit b037d60a3b1d1227609fd858fa34321f41829911 upstream.
Uninterruptible context is not needed in the driver and causes lockdep warning because of mutex taken in of_alias_get_id(). Convert the lock to mutex to avoid the issue.
--- drivers/misc/atmel-ssc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/misc/atmel-ssc.c +12 -12
@@ -13,7 +13,7 @@#include <linux/clk.h> #include <linux/err.h> #include <linux/io.h> -#include <linux/spinlock.h> +#include <linux/mutex.h> #include <linux/atmel-ssc.h> #include <linux/slab.h> #include <linux/module.h>
@@ -21,7 +21,7 @@#include <linux/of.h> /* Serialize access to ssc_list and user count */ -static DEFINE_SPINLOCK (user_lock); +static DEFINE_MUTEX (user_lock);static LIST_HEAD (ssc_list);struct ssc_device *ssc_request (unsigned int ssc_num)
@@ -29,7 +29,7 @@ struct ssc_device *ssc_request(unsignedint ssc_valid =0 ;struct ssc_device *ssc; -spin_lock (&user_lock); +mutex_lock (&user_lock);list_for_each_entry (ssc, &ssc_list, list) {if (ssc->pdev->dev.of_node) { if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc")
@@ -45,18 +45,18 @@ struct ssc_device *ssc_request(unsigned }if (!ssc_valid) { -spin_unlock (&user_lock); +mutex_unlock (&user_lock);pr_err ("ssc: ssc%d platform device is missing\n" , ssc_num);return ERR_PTR (-ENODEV ); }if (ssc->user) { -spin_unlock (&user_lock); +mutex_unlock (&user_lock);dev_dbg (&ssc->pdev->dev,"module busy\n" );return ERR_PTR (-EBUSY ); } ssc->user++; -spin_unlock (&user_lock); +mutex_unlock (&user_lock);clk_prepare (ssc->clk);
@@ -68,14 +68,14 @@ void ssc_free(struct ssc_device *ssc) {bool disable_clk = true; -spin_lock (&user_lock); +mutex_lock (&user_lock);if (ssc->user) ssc->user--;else { disable_clk = false;dev_dbg (&ssc->pdev->dev,"device already free\n" ); } -spin_unlock (&user_lock); +mutex_unlock (&user_lock);if (disable_clk)clk_unprepare (ssc->clk);
@@ -195,9 +195,9 @@ static int ssc_probe(struct platform_devreturn -ENXIO ; } -spin_lock (&user_lock); +mutex_lock (&user_lock);list_add_tail (&ssc->list, &ssc_list); -spin_unlock (&user_lock); +mutex_unlock (&user_lock);platform_set_drvdata (pdev, ssc);
@@ -211,9 +211,9 @@ static int ssc_remove(struct platform_de {struct ssc_device *ssc =platform_get_drvdata (pdev); -spin_lock (&user_lock); +mutex_lock (&user_lock);list_del (&ssc->list); -spin_unlock (&user_lock); +mutex_unlock (&user_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 83/86 arm64: ptrace: Override SPSR.SS when single-stepping is enabled
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 3a5a4366cecc25daa300b9a9174f7fdd352b9068 upstream.
Luis reports that, when reverse debugging with GDB, single-step does not function as expected on arm64:
| I've noticed, under very specific conditions, that a PTRACE_SINGLESTEP | request by GDB won't execute the underlying instruction. As a consequence, | the PC doesn't move, but we return a SIGTRAP just like we would for a | regular successful PTRACE_SINGLESTEP request.
The underlying problem is that when the CPU register state is restored as part of a reverse step, the SPSR.SS bit is cleared and so the hardware single-step state can transition to the "active-pending" state, causing an unexpected step exception to be taken immediately if a step operation is attempted.
In hindsight, we probably shouldn't have exposed SPSR.SS in the pstate accessible by the GPR regset, but it's a bit late for that now. Instead, simply prevent userspace from configuring the bit to a value which is inconsistent with the TIF_SINGLESTEP state for the task being traced.
--- arch/arm64/include/asm/debug-monitors.h | 2 ++ arch/arm64/kernel/debug-monitors.c | 20 ++++++++++++++++---- arch/arm64/kernel/ptrace.c | 4 ++-- 3 files changed, 20 insertions(+), 6 deletions(-)
arch/arm64/include/asm/debug-monitors.h +2 -0
@@ -116,6 +116,8 @@ void disable_debug_monitors(enum dbg_actvoid user_rewind_single_step (struct task_struct *task);void user_fastforward_single_step (struct task_struct *task); +void user_regs_reset_single_step (struct user_pt_regs *regs, +struct task_struct *task);void kernel_enable_single_step (struct pt_regs *regs);void kernel_disable_single_step (void );
arch/arm64/kernel/debug-monitors.c +16 -4
@@ -149,17 +149,20 @@ postcore_initcall(debug_monitors_init);/* * Single step API and exception handling. */ -static void set_regs_spsr_ss (struct pt_regs *regs) +static void set_user_regs_spsr_ss (struct user_pt_regs *regs) { regs->pstate |=DBG_SPSR_SS ; } -NOKPROBE_SYMBOL (set_regs_spsr_ss); +NOKPROBE_SYMBOL (set_user_regs_spsr_ss); -static void clear_regs_spsr_ss (struct pt_regs *regs) +static void clear_user_regs_spsr_ss (struct user_pt_regs *regs) { regs->pstate &= ~DBG_SPSR_SS ; } -NOKPROBE_SYMBOL (clear_regs_spsr_ss); +NOKPROBE_SYMBOL (clear_user_regs_spsr_ss); + +#define set_regs_spsr_ss (r) set_user_regs_spsr_ss(&(r)->user_regs) +#define clear_regs_spsr_ss (r) clear_user_regs_spsr_ss(&(r)->user_regs)/* EL1 Single Step Handler hooks */ static LIST_HEAD (step_hook);
@@ -388,6 +391,15 @@ void user_fastforward_single_step(structclear_regs_spsr_ss (task_pt_regs (task)); } +void user_regs_reset_single_step (struct user_pt_regs *regs, +struct task_struct *task) +{ +if (test_tsk_thread_flag (task,TIF_SINGLESTEP )) +set_user_regs_spsr_ss (regs); +else +clear_user_regs_spsr_ss (regs); +} +/* Kernel API */ void kernel_enable_single_step (struct pt_regs *regs) {
arch/arm64/kernel/ptrace.c +2 -2
@@ -1447,8 +1447,8 @@ static int valid_native_regs(struct user*/ int valid_user_regs (struct user_pt_regs *regs,struct task_struct *task) { -if (!test_tsk_thread_flag (task,TIF_SINGLESTEP )) - regs->pstate &= ~DBG_SPSR_SS ; +/* https://lore.kernel.org/lkml/20191118131525.GA4180@willie-the-truck */ +user_regs_reset_single_step (regs, task);if (is_compat_thread (task_thread_info (task)))return valid_compat_regs (regs);
Greg Kroah-Hartman
maintainerPATCH 84/86 sched/fair: handle case of task_h_load() returning 0
In reply to Greg Kroah-HartmanFrom: Vincent Guittot <[email protected]>
commit 01cfcde9c26d8555f0e6e9aea9d6049f87683998 upstream.
task_h_load() can return 0 in some situations like running stress-ng mmapfork, which forks thousands of threads, in a sched group on a 224 cores system. The load balance doesn't handle this correctly because env->imbalance never decreases and it will stop pulling tasks only after reaching loop_max, which can be equal to the number of running tasks of the cfs. Make sure that imbalance will be decreased by at least 1.
misfit task is the other feature that doesn't handle correctly such situation although it's probably more difficult to face the problem because of the smaller number of CPUs and running tasks on heterogenous system.
We can't simply ensure that task_h_load() returns at least one because it would imply to handle underflow in other places.
--- kernel/sched/fair.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/sched/fair.c +9 -1
@@ -6561,7 +6561,15 @@ static int detach_tasks(struct lb_env *eif (!can_migrate_task (p, env)) goto next; - load =task_h_load (p); +/* +* Depending of the number of CPUs and tasks and the +* cgroup hierarchy, task_h_load() can return a null +* value. Make sure that env->imbalance decreases +* otherwise detach_tasks() will stop only after +* detaching up to loop_max tasks. +*/ + load = max_t(unsigned long, task_h_load(p), 1); +if (sched_feat (LB_MIN ) && load <16 && !env->sd->nr_balance_failed) goto next;
Greg Kroah-Hartman
maintainerPATCH 85/86 irqchip/gic: Atomically update affinity
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 005c34ae4b44f085120d7f371121ec7ded677761 upstream.
The GIC driver uses a RMW sequence to update the affinity, and relies on the gic_lock_irqsave/gic_unlock_irqrestore sequences to update it atomically.
But these sequences only expand into anything meaningful if the BL_SWITCHER option is selected, which almost never happens.
It also turns out that using a RMW and locks is just as silly, as the GIC distributor supports byte accesses for the GICD_TARGETRn registers, which when used make the update atomic by definition.
Drop the terminally broken code and replace it by a byte write.
--- drivers/irqchip/irq-gic.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
drivers/irqchip/irq-gic.c +3 -10
@@ -324,10 +324,8 @@ static int gic_irq_set_vcpu_affinity(strstatic int gic_set_affinity (struct irq_data *d,const struct cpumask *mask_val,bool force) { -void __iomem *reg =gic_dist_base (d) +GIC_DIST_TARGET + (gic_irq (d) & ~3 ); -unsigned int cpu, shift = (gic_irq (d) %4 ) *8 ; -u32 val, mask, bit; -unsigned long flags; +void __iomem *reg =gic_dist_base (d) +GIC_DIST_TARGET +gic_irq (d); +unsigned int cpu;if (!force) cpu =cpumask_any_and (mask_val, cpu_online_mask);
@@ -337,12 +335,7 @@ static int gic_set_affinity(struct irq_dif (cpu >=NR_GIC_CPU_IF || cpu >= nr_cpu_ids)return -EINVAL ; -gic_lock_irqsave (flags); - mask =0xff << shift; - bit = gic_cpu_map[cpu] << shift; - val =readl_relaxed (reg) & ~mask; -writel_relaxed (val | bit, reg); -gic_unlock_irqrestore (flags); +writeb_relaxed (gic_cpu_map[cpu], reg);return IRQ_SET_MASK_OK_DONE ; }
Greg Kroah-Hartman
maintainerPATCH 86/86 x86/cpu: Move x86_cache_bits settings
In reply to Greg Kroah-HartmanFrom: Suraj Jitindar Singh <[email protected]>
This patch is to fix the backport of the upstream patch:cc51e5428ea5 x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
When this was backported to the 4.9 and 4.14 stable branches the line
+ c->x86_cache_bits = c->x86_phys_bits;
was applied in the wrong place, being added to the identify_cpu_without_cpuid() function instead of the get_cpu_cap() function which it was correctly applied to in the 4.4 backport.
This means that x86_cache_bits is not set correctly resulting in the following warning due to the cache bits being left uninitalised (zero).
WARNING: CPU: 0 PID: 7566 at arch/x86/kvm/mmu.c:284 kvm_mmu_set_mmio_spte_mask+0x4e/0x60 [kvm Modules linked in: kvm_intel(+) kvm irqbypass ipv6 crc_ccitt binfmt_misc evdev lpc_ich mfd_core ioatdma pcc_cpufreq dca ena acpi_power_meter hwmon acpi_pad button ext4 crc16 mbcache jbd2 fscrypto nvme nvme_core dm_mirror dm_region_hash dm_log dm_mod dax Hardware name: Amazon EC2 i3.metal/Not Specified, BIOS 1.0 10/16/2017 task: ffff88ff77704c00 task.stack: ffffc9000edac000 RIP: 0010:kvm_mmu_set_mmio_spte_mask+0x4e/0x60 [kvm RSP: 0018:ffffc9000edafc60 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffff45 RDX: 000000000000002e RSI: 0008000000000001 RDI: 0008000000000001 RBP: ffffffffa036f000 R08: ffffffffffffff80 R09: ffffe8ffffccb3c0 R10: 0000000000000038 R11: 0000000000000000 R12: 0000000000005b80 R13: ffffffffa0370e40 R14: 0000000000000001 R15: ffff88bf7c0927e0 FS: 00007fa316f24740(0000) GS:ffff88bf7f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa316ea0000 CR3: 0000003f7e986004 CR4: 00000000003606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kvm_mmu_module_init+0x166/0x230 [kvm kvm_arch_init+0x5d/0x150 [kvm kvm_init+0x1c/0x2d0 [kvm ? hardware_setup+0x4a6/0x4a6 [kvm_intel vmx_init+0x23/0x6aa [kvm_intel ? hardware_setup+0x4a6/0x4a6 [kvm_intel do_one_initcall+0x3e/0x15d do_init_module+0x5b/0x1e5 load_module+0x19e6/0x1dc0 ? SYSC_init_module+0x13b/0x170 SYSC_init_module+0x13b/0x170 do_syscall_64+0x67/0x110 entry_SYSCALL_64_after_hwframe+0x41/0xa6 RIP: 0033:0x7fa316828f3a RSP: 002b:00007ffc9d65c1f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af RAX: ffffffffffffffda RBX: 00007fa316b08849 RCX: 00007fa316828f3a RDX: 00007fa316b08849 RSI: 0000000000071328 RDI: 00007fa316e37000 RBP: 0000000000b47e80 R08: 0000000000000003 R09: 0000000000000000 R10: 00007fa316822dba R11: 0000000000000246 R12: 0000000000b46340 R13: 0000000000b464c0 R14: 0000000000000000 R15: 0000000000040000 Code: e9 65 06 00 75 25 48 b8 00 00 00 00 00 00 00 40 48 09 c6 48 09 c7 48 89 35 f8 65 06 00 48 89 3d f9 65 06 00 c3 0f 0b 0f 0b eb d2 <0f> 0b eb d7 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44
--- arch/x86/kernel/cpu/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/common.c +1 -1
@@ -849,6 +849,7 @@ void get_cpu_cap(struct cpuinfo_x86 *c) else if (cpu_has(c, X86_FEATURE_PAE) || cpu_has(c, X86_FEATURE_PSE36)) c->x86_phys_bits = 36;#endif + c->x86_cache_bits = c->x86_phys_bits;if (c->extended_cpuid_level >=0x8000000a ) c->x86_capability[CPUID_8000_000A_EDX ] =cpuid_edx (0x8000000a );
@@ -888,7 +889,6 @@ static void identify_cpu_without_cpuid(s } }#endif - c->x86_cache_bits = c->x86_phys_bits; }#define NO_SPECULATION BIT(0)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.231 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.231 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.9.231-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: 8c3f33eeb0cc6d2603144f45d841ed8f966dd728
git describe: v4.9.230-87-g8c3f33eeb0cc
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.230-87-g8c3f33eeb0cc
No regressions (compared to build v4.9.230)
No fixes (compared to build v4.9.230)
Ran 34431 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* install-android-platform-tools-r2800
* kselftest
* kselftest/drivers
* kselftest/filesystems
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* v4l2-compliance
* kvm-unit-tests
* network-basic-tests
* ltp-open-posix-tests
* kselftest/net
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-native/drivers
* kselftest-vsyscall-mode-native/filesystems
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.231 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
30 tests: 30 pass, 0 failLinux version: 4.9.231-rc1-g8c3f33eeb0cc
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Cheers,
Thierry
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.231 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
30 tests: 30 pass, 0 failLinux version: 4.9.231-rc1-g8c3f33eeb0cc
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Cheers,
Thierry
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.231 release. There are 86 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
Build results:
total: 171 pass: 171 fail: 0 Qemu test results: total: 386 pass: 386 fail: 0
Guenter