5.4.54-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.4.54-rc1 review
This is the start of the stable review cycle for the 5.4.54 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.54-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.54-rc1
Mark O'Donovan <[email protected]>
ath9k: Fix regression with Atheros 9271
Qiujun Huang <[email protected]>
ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
Mikulas Patocka <[email protected]>
dm integrity: fix integrity recalculation that is improperly skipped
Pierre-Louis Bossart <[email protected]>
ASoC: topology: fix tlvs in error handling for widget_dmixer
Pierre-Louis Bossart <[email protected]>
ASoC: topology: fix kernel oops on route addition error
Geert Uytterhoeven <[email protected]>
ASoC: qcom: Drop HAS_DMA dependency to fix link failure
Hans de Goede <[email protected]>
ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10
Joerg Roedel <[email protected]>
x86, vmlinux.lds: Page-align end of ..page_aligned sections
John David Anglin <[email protected]>
parisc: Add atomic64_set_release() define to avoid CPU soft lockups
Qiu Wenbo <[email protected]>
drm/amd/powerplay: fix a crash when overclocking Vega M
Paweł Gronowski <[email protected]>
drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
Eddie James <[email protected]>
mmc: sdhci-of-aspeed: Fix clock divider calculation
Michael J. Ruhl <[email protected]>
io-mapping: indicate mapping failure
Kirill A. Shutemov <[email protected]>
khugepaged: fix null-pointer dereference due to race
Muchun Song <[email protected]>
mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
Hugh Dickins <[email protected]>
mm/memcg: fix refcount error while moving and swapping
Kirill A. Shutemov <[email protected]>
mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
Fangrui Song <[email protected]>
Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
Tetsuo Handa <[email protected]>
vt: Reject zero-sized screen buffer size.
Tetsuo Handa <[email protected]>
fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
Eric Biggers <[email protected]>
/dev/mem: Add missing memory barriers for devmem_inode
Serge Semin <[email protected]>
serial: 8250_mtk: Fix high-speed baud rates clamping
Yang Yingliang <[email protected]>
serial: 8250: fix null-ptr-deref in serial8250_start_tx()
Johan Hovold <[email protected]>
serial: tegra: fix CREAD handling for PIO
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
Ian Abbott <[email protected]>
staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
Rustam Kovhaev <[email protected]>
staging: wlan-ng: properly check endpoint types
Helmut Grohne <[email protected]>
tty: xilinx_uartps: Really fix id assignment
Johannes Berg <[email protected]>
iwlwifi: mvm: don't call iwl_mvm_free_inactive_queue() under RCU
Steve French <[email protected]>
Revert "cifs: Fix the target file was deleted when rename failed."
Forest Crossman <[email protected]>
usb: xhci: Fix ASM2142/ASM3142 DMA addressing
Chunfeng Yun <[email protected]>
usb: xhci-mtk: fix the failure of bandwidth allocation
Tetsuo Handa <[email protected]>
binder: Don't use mmput() from shrinker function.
Palmer Dabbelt <[email protected]>
RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw
Qi Liu <[email protected]>
drivers/perf: Prevent forced unbinding of PMU drivers
Will Deacon <[email protected]>
asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible()
Arnd Bergmann <[email protected]>
x86: math-emu: Fix up 'cmp' insn for clang ias
Will Deacon <[email protected]>
arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
Qi Liu <[email protected]>
drivers/perf: Fix kernel panic when rmmod PMU modules during perf sampling
PeiSen Hou <[email protected]>
ALSA: hda/realtek - fixup for yet another Intel reference board
Cristian Marussi <[email protected]>
hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
Vasiliy Kupriakov <[email protected]>
platform/x86: asus-wmi: allow BAT1 battery name
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Add new PCI device ids
Guenter Roeck <[email protected]>
hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D
Jack Xiao <[email protected]>
drm/amdgpu: fix preemption unit test
Jack Xiao <[email protected]>
drm/amdgpu/gfx10: fix race condition for kiq
Chu Lin <[email protected]>
hwmon: (adm1275) Make sure we are reading enough data for different chips
Peter Chen <[email protected]>
usb: cdns3: trace: fix some endian issues
Peter Chen <[email protected]>
usb: cdns3: ep0: fix some endian issues
Evgeny Novikov <[email protected]>
usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Jasper Lake
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant
Derek Basehore <[email protected]>
Input: elan_i2c - only increment wakeup count on touch
Ilya Katsnelson <[email protected]>
Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
Leonid Ravich <[email protected]>
dmaengine: ioat setting ioat timeout as module parameter
Angelo Dureghello <[email protected]>
dmaengine: fsl-edma: fix wrong tcd endianness for big-endian cpu
Evgeny Novikov <[email protected]>
hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
Marc Kleine-Budde <[email protected]>
regmap: dev_get_regmap_match(): fix string comparison
leilk.liu <[email protected]>
spi: mediatek: use correct SPI_CFG2_REG MACRO
Merlijn Wajer <[email protected]>
ARM: dts: n900: remove mmc1 card detect gpio
Merlijn Wajer <[email protected]>
Input: add SW_MACHINE_COVER
Dinghao Liu <[email protected]>
dmaengine: tegra210-adma: Fix runtime PM imbalance on error
Hans de Goede <[email protected]>
HID: apple: Disable Fn-key key-re-mapping on clone keyboards
Rodrigo Rivas Costa <[email protected]>
HID: steam: fixes race in handling device list.
Caiyuan Xie <[email protected]>
HID: alps: support devices with report id 2
Federico Ricchiuto <[email protected]>
HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
Stefano Garzarella <[email protected]>
scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
Pi-Hsun Shih <[email protected]>
scripts/decode_stacktrace: strip basepath from all paths
Matthew Howell <[email protected]>
serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
Cong Wang <[email protected]>
geneve: fix an uninitialized value in geneve_changelink()
Cong Wang <[email protected]>
bonding: check return value of register_netdevice() in bond_newlink()
Douglas Anderson <[email protected]>
i2c: i2c-qcom-geni: Fix DMA transfer race
Wolfram Sang <[email protected]>
i2c: rcar: always clear ICSAR to avoid side effects
Claudiu Manoil <[email protected]>
enetc: Remove the mdio bus on PF probe bailout
J. Bruce Fields <[email protected]>
nfsd4: fix NULL dereference in nfsd/clients display code
Bjorn Helgaas <[email protected]>
Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
Wang Hai <[email protected]>
net: ethernet: ave: Fix error returns in ave_init
guodeqing <[email protected]>
ipvs: fix the connection sync failed in some cases
Alexander Lobakin <[email protected]>
qed: suppress false-positives interrupt error messages on HW init
Alexander Lobakin <[email protected]>
qed: suppress "don't support RoCE & iWARP" flooding on HW init
Taehee Yoo <[email protected]>
netdevsim: fix unbalaced locking in nsim_create()
Helmut Grohne <[email protected]>
net: dsa: microchip: call phy_remove_link_mode during probe
Yunsheng Lin <[email protected]>
net: hns3: fix error handling for desc filling
Huang Guobin <[email protected]>
net: ag71xx: add missed clk_disable_unprepare in error path of probe
Shannon Nelson <[email protected]>
ionic: fix up filter locks and debug msgs
Shannon Nelson <[email protected]>
ionic: use offset for ethtool regs data
Liu Jian <[email protected]>
mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
Taehee Yoo <[email protected]>
bonding: check error value of register_netdevice() immediately
Wang Hai <[email protected]>
net: smc91x: Fix possible memory leak in smc_drv_probe()
Chen-Yu Tsai <[email protected]>
drm: sun4i: hdmi: Fix inverted HPD result
Liu Jian <[email protected]>
ieee802154: fix one possible memleak in adf7242_probe
Sergey Organov <[email protected]>
net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
Jing Xiangfeng <[email protected]>
ASoC: Intel: bytcht_es8316: Add missed put_device()
Maor Gottlieb <[email protected]>
RDMA/mlx5: Use xa_lock_irq when access to SRQ table
George Kennedy <[email protected]>
ax88172a: fix ax88172a_unbind() failures
Stefano Garzarella <[email protected]>
vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
Christophe JAILLET <[email protected]>
hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path
Matthew Gerlach <[email protected]>
fpga: dfl: fix bug in port reset handshake
Xu Yilun <[email protected]>
fpga: dfl: pci: reduce the scope of variable 'ret'
Michael Chan <[email protected]>
bnxt_en: Fix completion ring sizing with TPA enabled.
Vasundhara Volam <[email protected]>
bnxt_en: Fix race when modifying pause settings.
Robbie Ko <[email protected]>
btrfs: fix page leaks after failure to lock page for delalloc
Boris Burkov <[email protected]>
btrfs: fix mount failure caused by race with umount
Filipe Manana <[email protected]>
btrfs: fix double free on ulist after backref resolution failure
Hans de Goede <[email protected]>
ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
Takashi Iwai <[email protected]>
ALSA: info: Drop WARN_ON() from buffer NULL sanity check
Joonho Wohn <[email protected]>
ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S
Oleg Nesterov <[email protected]>
uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
Qu Wenruo <[email protected]>
btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance
Qu Wenruo <[email protected]>
btrfs: reloc: fix reloc root leak and NULL pointer dereference
Olga Kornievskaia <[email protected]>
SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
Ming Lei <[email protected]>
dm: do not use waitqueue for request-based DM
Gabriel Krisman Bertazi <[email protected]>
dm mpath: pass IO start time to path selector
Jerry (Fangzhi) Zuo <[email protected]>
drm/amd/display: Check DMCU Exists Before Loading
Charan Teja Kalla <[email protected]>
dmabuf: use spinlock to access dmabuf->name
Tim Harvey <[email protected]>
ARM: dts: imx6qdl-gw551x: fix audio SSI
Fabio Estevam <[email protected]>
ARM: dts: imx6qdl-gw551x: Do not use 'simple-audio-card,dai-link'
Thomas Gleixner <[email protected]>
irqdomain/treewide: Keep firmware node unconditionally allocated
Miklos Szeredi <[email protected]>
fuse: fix weird page warning
Gavin Shan <[email protected]>
drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
Christoph Hellwig <[email protected]>
dm: use bio_uninit instead of bio_disassociate_blkg
Steve Schremmer <[email protected]>
scsi: dh: Add Fujitsu device to devinfo and dh lists
Johannes Thumshirn <[email protected]>
scsi: mpt3sas: Fix error returns in BRM_status_show
Ben Skeggs <[email protected]>
drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
Tom Rix <[email protected]>
net: sky2: initialize return of gm_phy_read
Kai Vehmanen <[email protected]>
ALSA: hda/hdmi: fix failures at PCM open on Intel ICL and later
Xie He <[email protected]>
drivers/net/wan/lapbether: Fixed the value of hard_header_len
Damien Le Moal <[email protected]>
scsi: mpt3sas: Fix unlock imbalance
Max Filippov <[email protected]>
xtensa: update *pos in cpuinfo_op.next
Max Filippov <[email protected]>
xtensa: fix __sync_fetch_and_{and,or}_4 declarations
Tom Rix <[email protected]>
scsi: scsi_transport_spi: Fix function pointer check
Markus Theil <[email protected]>
mac80211: allow rx of mesh eapol frames with default rx key
Jacky Hu <[email protected]>
pinctrl: amd: fix npins for uart0 in kerncz_groups
Navid Emamdoost <[email protected]>
gpio: arizona: put pm_runtime in case of failure
Navid Emamdoost <[email protected]>
gpio: arizona: handle pm_runtime_get_sync failure case
Douglas Anderson <[email protected]>
soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
-------------
Diffstat:
Makefile | 6 +- arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 19 ++--- arch/arm/boot/dts/omap3-n900.dts | 12 ++- arch/arm64/kernel/debug-monitors.c | 4 +- arch/mips/pci/pci-xtalk-bridge.c | 5 +- arch/parisc/include/asm/atomic.h | 2 + arch/riscv/include/asm/barrier.h | 10 ++- arch/x86/kernel/apic/io_apic.c | 10 +-- arch/x86/kernel/apic/msi.c | 18 +++-- arch/x86/kernel/apic/vector.c | 1 - arch/x86/kernel/vmlinux.lds.S | 1 + arch/x86/math-emu/wm_sqrt.S | 2 +- arch/x86/platform/uv/uv_irq.c | 3 +- arch/xtensa/kernel/setup.c | 3 +- arch/xtensa/kernel/xtensa_ksyms.c | 4 +- drivers/android/binder_alloc.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/char/mem.c | 10 ++- drivers/dma-buf/dma-buf.c | 11 ++- drivers/dma/fsl-edma-common.c | 26 ++++--- drivers/dma/ioat/dma.c | 12 +++ drivers/dma/ioat/dma.h | 2 - drivers/dma/tegra210-adma.c | 5 +- drivers/firmware/psci/psci_checker.c | 5 +- drivers/fpga/dfl-afu-main.c | 3 +- drivers/fpga/dfl-pci.c | 3 +- drivers/gpio/gpio-arizona.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 20 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 +-- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 ++- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +- .../gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c | 10 ++- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 4 +- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +- drivers/hid/hid-alps.c | 2 + drivers/hid/hid-apple.c | 18 +++++ drivers/hid/hid-steam.c | 6 +- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++ drivers/hwmon/aspeed-pwm-tacho.c | 2 + drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/adm1275.c | 10 ++- drivers/hwmon/scmi-hwmon.c | 2 +- drivers/i2c/busses/i2c-qcom-geni.c | 6 +- drivers/i2c/busses/i2c-rcar.c | 3 + drivers/infiniband/hw/mlx5/srq_cmd.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 9 ++- drivers/input/mouse/synaptics.c | 1 + drivers/iommu/amd_iommu.c | 5 +- drivers/iommu/hyperv-iommu.c | 5 +- drivers/iommu/intel_irq_remapping.c | 2 +- drivers/md/dm-integrity.c | 4 +- drivers/md/dm-mpath.c | 9 ++- drivers/md/dm-path-selector.h | 2 +- drivers/md/dm-queue-length.c | 2 +- drivers/md/dm-rq.c | 4 - drivers/md/dm-service-time.c | 2 +- drivers/md/dm.c | 87 ++++++++++++++++------ drivers/mmc/host/sdhci-of-aspeed.c | 2 +- drivers/net/bonding/bond_main.c | 10 ++- drivers/net/bonding/bond_netlink.c | 3 +- drivers/net/dsa/microchip/ksz9477.c | 42 ++++++----- drivers/net/dsa/microchip/ksz_common.c | 2 - drivers/net/dsa/microchip/ksz_common.h | 2 - drivers/net/ethernet/atheros/ag71xx.c | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 1 + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++ drivers/net/ethernet/marvell/sky2.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +- .../net/ethernet/pensando/ionic/ionic_ethtool.c | 7 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 ++--- .../net/ethernet/pensando/ionic/ionic_rx_filter.c | 5 ++ drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_int.c | 50 +++++++------ drivers/net/ethernet/qlogic/qed/qed_int.h | 4 +- drivers/net/ethernet/smsc/smc91x.c | 4 +- drivers/net/ethernet/socionext/sni_ave.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/hippi/rrunner.c | 2 +- drivers/net/ieee802154/adf7242.c | 4 +- drivers/net/netdevsim/netdev.c | 4 +- drivers/net/phy/dp83640.c | 4 + drivers/net/usb/ax88172a.c | 1 + drivers/net/wan/lapbether.c | 9 ++- drivers/net/wireless/ath/ath9k/hif_usb.c | 52 ++++++++++--- drivers/net/wireless/ath/ath9k/hif_usb.h | 5 ++ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 8 +- drivers/pci/controller/vmd.c | 5 +- drivers/pci/pci.c | 30 +++----- drivers/perf/arm-cci.c | 1 + drivers/perf/arm-ccn.c | 1 + drivers/perf/arm_dsu_pmu.c | 1 + drivers/perf/arm_smmuv3_pmu.c | 2 + drivers/perf/arm_spe_pmu.c | 1 + drivers/perf/fsl_imx8_ddr_perf.c | 2 + drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 2 + drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 2 + drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 2 + drivers/perf/qcom_l2_pmu.c | 1 + drivers/perf/qcom_l3_pmu.c | 1 + drivers/perf/thunderx2_pmu.c | 1 + drivers/perf/xgene_pmu.c | 1 + drivers/pinctrl/pinctrl-amd.h | 2 +- drivers/platform/x86/asus-wmi.c | 1 + .../x86/intel_speed_select_if/isst_if_common.h | 3 + .../x86/intel_speed_select_if/isst_if_mbox_pci.c | 1 + .../x86/intel_speed_select_if/isst_if_mmio.c | 1 + drivers/scsi/mpt3sas/mpt3sas_ctl.c | 12 +-- drivers/scsi/scsi_devinfo.c | 1 + drivers/scsi/scsi_dh.c | 1 + drivers/scsi/scsi_transport_spi.c | 2 +- drivers/soc/qcom/rpmh.c | 8 +- drivers/spi/spi-mt65xx.c | 15 ++-- drivers/staging/comedi/drivers/addi_apci_1032.c | 20 +++-- drivers/staging/comedi/drivers/addi_apci_1500.c | 24 ++++-- drivers/staging/comedi/drivers/addi_apci_1564.c | 20 +++-- drivers/staging/comedi/drivers/ni_6527.c | 2 +- drivers/staging/wlan-ng/prism2usb.c | 16 +++- drivers/tty/serial/8250/8250_core.c | 2 +- drivers/tty/serial/8250/8250_exar.c | 12 ++- drivers/tty/serial/8250/8250_mtk.c | 18 +++++ drivers/tty/serial/serial-tegra.c | 7 +- drivers/tty/serial/xilinx_uartps.c | 8 +- drivers/tty/vt/vt.c | 29 +++++--- drivers/usb/cdns3/ep0.c | 30 ++++---- drivers/usb/cdns3/trace.h | 6 +- drivers/usb/dwc3/dwc3-pci.c | 8 ++ drivers/usb/gadget/udc/gr_udc.c | 7 +- drivers/usb/host/xhci-mtk-sch.c | 4 + drivers/usb/host/xhci-pci.c | 3 + drivers/video/fbdev/core/bitblit.c | 4 +- drivers/video/fbdev/core/fbcon_ccw.c | 4 +- drivers/video/fbdev/core/fbcon_cw.c | 4 +- drivers/video/fbdev/core/fbcon_ud.c | 4 +- fs/btrfs/backref.c | 1 + fs/btrfs/extent_io.c | 3 +- fs/btrfs/relocation.c | 11 ++- fs/btrfs/volumes.c | 8 ++ fs/cifs/inode.c | 10 +-- fs/fuse/dev.c | 3 +- fs/nfs/direct.c | 13 +--- fs/nfs/file.c | 1 - fs/nfsd/nfs4state.c | 20 ++++- include/asm-generic/mmiowb.h | 6 +- include/asm-generic/vmlinux.lds.h | 5 +- include/linux/device-mapper.h | 3 + include/linux/dma-buf.h | 1 + include/linux/io-mapping.h | 5 +- include/linux/mod_devicetable.h | 2 +- include/sound/rt5670.h | 1 + include/uapi/linux/input-event-codes.h | 3 +- kernel/events/uprobes.c | 2 +- mm/khugepaged.c | 3 + mm/memcontrol.c | 4 +- mm/mmap.c | 16 +++- mm/slab_common.c | 35 +++++++-- net/mac80211/rx.c | 26 +++++++ net/netfilter/ipvs/ip_vs_sync.c | 12 ++- net/vmw_vsock/virtio_transport.c | 2 +- scripts/decode_stacktrace.sh | 4 +- scripts/gdb/linux/symbols.py | 2 +- sound/core/info.c | 4 +- sound/pci/hda/patch_hdmi.c | 36 +++++---- sound/pci/hda/patch_realtek.c | 2 + sound/soc/codecs/rt5670.c | 71 ++++++++++++++---- sound/soc/codecs/rt5670.h | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 4 +- sound/soc/qcom/Kconfig | 2 +- sound/soc/soc-topology.c | 24 ++++-- 173 files changed, 975 insertions(+), 438 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/138 soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
From: Douglas Anderson <[email protected]>
commit 35bb4b22f606c0cc8eedf567313adc18161b1af4 upstream.
Adding an item into the cache should never be able to make the cache cleaner. Use "|=" rather than "=" to update the dirty flag.
--- drivers/soc/qcom/rpmh.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soc/qcom/rpmh.c +4 -4
@@ -150,10 +150,10 @@ existing:break ; } - ctrlr->dirty = (req->sleep_val != old_sleep_val || - req->wake_val != old_wake_val) && - req->sleep_val !=UINT_MAX && - req->wake_val !=UINT_MAX ; + ctrlr->dirty |= (req->sleep_val != old_sleep_val || + req->wake_val != old_wake_val) && + req->sleep_val !=UINT_MAX && + req->wake_val !=UINT_MAX ; unlock:spin_unlock_irqrestore (&ctrlr->cache_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 2/138 gpio: arizona: handle pm_runtime_get_sync failure case
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit e6f390a834b56583e6fc0949822644ce92fbb107 ]
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count. Call pm_runtime_put if pm_runtime_get_sync fails.
--- drivers/gpio/gpio-arizona.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpio/gpio-arizona.c +1 -0
@@ -106,6 +106,7 @@ static int arizona_gpio_direction_out(struct gpio_chip *chip, ret =pm_runtime_get_sync (chip->parent);if (ret <0 ) {dev_err (chip->parent,"Failed to resume: %d\n" , ret); +pm_runtime_put (chip->parent);return ret; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/138 gpio: arizona: put pm_runtime in case of failure
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit 861254d826499944cb4d9b5a15f5a794a6b99a69 ]
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count if pm_runtime_put is not called in error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
--- drivers/gpio/gpio-arizona.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpio/gpio-arizona.c +5 -1
@@ -64,6 +64,7 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset) ret =pm_runtime_get_sync (chip->parent);if (ret <0 ) {dev_err (chip->parent,"Failed to resume: %d\n" , ret); +pm_runtime_put_autosuspend (chip->parent);return ret; }
@@ -72,12 +73,15 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset)if (ret <0 ) {dev_err (chip->parent,"Failed to drop cache: %d\n" , ret); +pm_runtime_put_autosuspend (chip->parent);return ret; } ret =regmap_read (arizona->regmap, reg, &val); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_autosuspend (chip->parent);return ret; + }pm_runtime_mark_last_busy (chip->parent);pm_runtime_put_autosuspend (chip->parent);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/138 pinctrl: amd: fix npins for uart0 in kerncz_groups
In reply to Greg Kroah-HartmanFrom: Jacky Hu <[email protected]>
[ Upstream commit 69339d083dfb7786b0e0b3fc19eaddcf11fabdfb ]
uart0_pins is defined as:
static const unsigned uart0_pins[] = {135, 136, 137, 138, 139};
which npins is wronly specified as 9 later
{
.name = "uart0",
.pins = uart0_pins,
.npins = 9,
},npins should be 5 instead of 9 according to the definition.
--- drivers/pinctrl/pinctrl-amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinctrl-amd.h +1 -1
@@ -252,7 +252,7 @@ static const struct amd_pingroup kerncz_groups[] = { { .name = "uart0", .pins = uart0_pins, - .npins = 9, + .npins = 5, }, { .name = "uart1",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/138 mac80211: allow rx of mesh eapol frames with default rx key
In reply to Greg Kroah-HartmanFrom: Markus Theil <[email protected]>
[ Upstream commit 0b467b63870d9c05c81456aa9bfee894ab2db3b6 ]
Without this patch, eapol frames cannot be received in mesh mode, when 802.1X should be used. Initially only a MGTK is defined, which is found and set as rx->key, when there are no other keys set. ieee80211_drop_unencrypted would then drop these eapol frames, as they are data frames without encryption and there exists some rx->key.
Fix this by differentiating between mesh eapol frames and other data frames with existing rx->key. Allow mesh mesh eapol frames only if they are for our vif address.
With this patch in-place, ieee80211_rx_h_mesh_fwding continues after the ieee80211_drop_unencrypted check and notices, that these eapol frames have to be delivered locally, as they should.
--- net/mac80211/rx.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
net/mac80211/rx.c +26 -0
@@ -2305,6 +2305,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)static int ieee80211_drop_unencrypted (struct ieee80211_rx_data *rx,__le16 fc) { +struct ieee80211_hdr *hdr = (void *)rx->skb->data;struct sk_buff *skb = rx->skb;struct ieee80211_rx_status *status =IEEE80211_SKB_RXCB (skb);
@@ -2315,6 +2316,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)if (status->flag &RX_FLAG_DECRYPTED )return 0 ; +/* check mesh EAPOL frames first */ +if (unlikely (rx->sta &&ieee80211_vif_is_mesh (&rx->sdata->vif) && +ieee80211_is_data (fc))) { +struct ieee80211s_hdr *mesh_hdr; +u16 hdr_len =ieee80211_hdrlen (fc); +u16 ethertype_offset; +__be16 ethertype; + +if (!ether_addr_equal (hdr->addr1, rx->sdata->vif.addr)) + goto drop_check; + +/* make sure fixed part of mesh header is there, also checks skb len */ +if (!pskb_may_pull (rx->skb, hdr_len +6 )) + goto drop_check; + + mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len); + ethertype_offset = hdr_len +ieee80211_get_mesh_hdrlen (mesh_hdr) + +sizeof (rfc1042_header); + +if (skb_copy_bits (rx->skb, ethertype_offset, ðertype,2 ) ==0 && + ethertype == rx->sdata->control_port_protocol) +return 0 ; + } + +drop_check:/* Drop unencrypted frames if key is set. */ if (unlikely(!ieee80211_has_protected(fc) && !ieee80211_is_any_nullfunc(fc) &&
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/138 scsi: scsi_transport_spi: Fix function pointer check
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 5aee52c44d9170591df65fafa1cd408acc1225ce ]
clang static analysis flags several null function pointer problems.
drivers/scsi/scsi_transport_spi.c:374:1: warning: Called function pointer is null (null dereference) [core.CallAndMessage] spi_transport_max_attr(offset, "%d\n");
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Reviewing the store_spi_store_max macro
if (i->f->set_##field) return -EINVAL;
should be
if (!i->f->set_##field) return -EINVAL;
--- drivers/scsi/scsi_transport_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_transport_spi.c +1 -1
@@ -339,7 +339,7 @@ store_spi_transport_##field(struct device *dev, \struct spi_transport_attrs *tp \ = (struct spi_transport_attrs *)&starget->starget_data; \ \ - if (i->f->set_##field) \ + if (!i->f->set_##field) \ return -EINVAL; \ val = simple_strtoul(buf, NULL, 0); \ if (val > tp->max_##field) \
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/138 xtensa: fix __sync_fetch_and_{and,or}_4 declarations
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
[ Upstream commit 73f9941306d5ce030f3ffc7db425c7b2a798cf8e ]
Building xtensa kernel with gcc-10 produces the following warnings:
arch/xtensa/kernel/xtensa_ksyms.c:90:15: warning: conflicting types
for built-in function ‘__sync_fetch_and_and_4’; expected ‘unsigned int(volatile void *, unsigned int)’ [-Wbuiltin-declaration-mismatch]
arch/xtensa/kernel/xtensa_ksyms.c:96:15: warning: conflicting types
for built-in function ‘__sync_fetch_and_or_4’; expected ‘unsigned int(volatile void *, unsigned int)’ [-Wbuiltin-declaration-mismatch]
Fix declarations of these functions to avoid the warning.
--- arch/xtensa/kernel/xtensa_ksyms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/xtensa/kernel/xtensa_ksyms.c +2 -2
@@ -87,13 +87,13 @@ void __xtensa_libgcc_window_spill(void) }EXPORT_SYMBOL (__xtensa_libgcc_window_spill); -unsigned long __sync_fetch_and_and_4 (unsigned long *p,unsigned long v) +unsigned int __sync_fetch_and_and_4 (volatile void *p,unsigned int v) {BUG (); }EXPORT_SYMBOL (__sync_fetch_and_and_4); -unsigned long __sync_fetch_and_or_4 (unsigned long *p,unsigned long v) +unsigned int __sync_fetch_and_or_4 (volatile void *p,unsigned int v) {BUG (); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/138 xtensa: update *pos in cpuinfo_op.next
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
[ Upstream commit 0d5ab144429e8bd80889b856a44d56ab4a5cd59b ]
Increment *pos in the cpuinfo_op.next to fix the following warning triggered by cat /proc/cpuinfo:
seq_file: buggy .next function c_next did not update position index
--- arch/xtensa/kernel/setup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/xtensa/kernel/setup.c +2 -1
@@ -716,7 +716,8 @@ c_start(struct seq_file *f, loff_t *pos)static void *c_next (struct seq_file *f,void *v,loff_t *pos) { -return NULL ; + ++*pos; +return c_start (f, pos); } static void
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/138 scsi: mpt3sas: Fix unlock imbalance
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit cb551b8dc079d2ef189145782627c99cb68c0255 ]
In BRM_status_show(), if the condition "!ioc->is_warpdrive" tested on entry to the function is true, a "goto out" is called. This results in unlocking ioc->pci_access_mutex without this mutex lock being taken. This generates the following splat:
[ 1148.539883] mpt3sas_cm2: BRM_status_show: BRM attribute is only for warpdrive
[ 1148.547184]
[ 1148.548708] =====================================
[ 1148.553501] WARNING: bad unlock balance detected!
[ 1148.558277] 5.8.0-rc3+ #827 Not tainted
[ 1148.562183] -------------------------------------
[ 1148.566959] cat/5008 is trying to release lock (&ioc->pci_access_mutex) at:
[ 1148.574035] [<ffffffffc070b7a3>] BRM_status_show+0xd3/0x100 [mpt3sas]
[ 1148.580574] but there are no more locks to release!
[ 1148.585524]
[ 1148.585524] other info that might help us debug this:
[ 1148.599624] 3 locks held by cat/5008:
[ 1148.607085] #0: ffff92aea3e392c0 (&p->lock){+.+.}-{3:3}, at: seq_read+0x34/0x480
[ 1148.618509] #1: ffff922ef14c4888 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x2a/0xb0
[ 1148.630729] #2: ffff92aedb5d7310 (kn->active#224){.+.+}-{0:0}, at: kernfs_seq_start+0x32/0xb0
[ 1148.643347]
[ 1148.643347] stack backtrace:
[ 1148.655259] CPU: 73 PID: 5008 Comm: cat Not tainted 5.8.0-rc3+ #827
[ 1148.665309] Hardware name: HGST H4060-S/S2600STB, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019
[ 1148.678394] Call Trace:
[ 1148.684750] dump_stack+0x78/0xa0
[ 1148.691802] lock_release.cold+0x45/0x4a
[ 1148.699451] __mutex_unlock_slowpath+0x35/0x270
[ 1148.707675] BRM_status_show+0xd3/0x100 [mpt3sas]
[ 1148.716092] dev_attr_show+0x19/0x40
[ 1148.723664] sysfs_kf_seq_show+0x87/0x100
[ 1148.731193] seq_read+0xbc/0x480
[ 1148.737882] vfs_read+0xa0/0x160
[ 1148.744514] ksys_read+0x58/0xd0
[ 1148.751129] do_syscall_64+0x4c/0xa0
[ 1148.757941] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1148.766240] RIP: 0033:0x7f1230566542
[ 1148.772957] Code: Bad RIP value.
[ 1148.779206] RSP: 002b:00007ffeac1bcac8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 1148.790063] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f1230566542
[ 1148.800284] RDX: 0000000000020000 RSI: 00007f1223460000 RDI: 0000000000000003
[ 1148.810474] RBP: 00007f1223460000 R08: 00007f122345f010 R09: 0000000000000000
[ 1148.820641] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000000
[ 1148.830728] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000Fix this by returning immediately instead of jumping to the out label.
--- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mpt3sas/mpt3sas_ctl.c +1 -1
@@ -2921,7 +2921,7 @@ BRM_status_show(struct device *cdev, struct device_attribute *attr,if (!ioc->is_warpdrive) {ioc_err (ioc,"%s: BRM attribute is only for warpdrive\n" , __func__); - goto out; +return 0 ; }/* pci_access_mutex lock acquired by sysfs show path */ mutex_lock (&ioc->pci_access_mutex);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/138 drivers/net/wan/lapbether: Fixed the value of hard_header_len
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 9dc829a135fb5927f1519de11286e2bbb79f5b66 ]
When this driver transmits data,
first this driver will remove a pseudo header of 1 byte, then the lapb module will prepend the LAPB header of 2 or 3 bytes, then this driver will prepend a length field of 2 bytes, then the underlying Ethernet device will prepend its own header.
So, the header length required should be:
-1 + 3 + 2 + "the header length needed by the underlying device".
This patch fixes kernel panic when this driver is used with AF_PACKET SOCK_DGRAM sockets.
--- drivers/net/wan/lapbether.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/wan/lapbether.c +8 -1
@@ -303,7 +303,6 @@ static void lapbeth_setup(struct net_device *dev) dev->netdev_ops = &lapbeth_netdev_ops; dev->needs_free_netdev = true; dev->type =ARPHRD_X25 ; - dev->hard_header_len =3 ; dev->mtu =1000 ; dev->addr_len =0 ; }
@@ -324,6 +323,14 @@ static int lapbeth_new_device(struct net_device *dev)if (!ndev) goto out; +/* When transmitting data: +* first this driver removes a pseudo header of 1 byte, +* then the lapb module prepends an LAPB header of at most 3 bytes, +* then this driver prepends a length field of 2 bytes, +* then the underlying Ethernet device prepends its own header. +*/ + ndev->hard_header_len =-1 +3 +2 + dev->hard_header_len; + lapbeth =netdev_priv (ndev); lapbeth->axdev = ndev;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/138 ALSA: hda/hdmi: fix failures at PCM open on Intel ICL and later
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit 56275036d8185f92eceac7479d48b858ee3dab84 ]
When HDMI PCM devices are opened in a specific order, with at least one HDMI/DP receiver connected, ALSA PCM open fails to -EBUSY on the connected monitor, on recent Intel platforms (ICL/JSL and newer). While this is not a typical sequence, at least Pulseaudio does this every time when it is started, to discover the available PCMs.
The rootcause is an invalid assumption in hdmi_add_pin(), where the total number of converters is assumed to be known at the time the function is called. On older Intel platforms this held true, but after ICL/JSL, the order how pins and converters are in the subnode list as returned by snd_hda_get_sub_nodes(), was changed. As a result, information for some converters was not stored to per_pin->mux_nids. And this means some pins cannot be connected to all converters, and application instead gets -EBUSY instead at open.
The assumption that converters are always before pins in the subnode list, is not really a valid one. Fix the problem in hdmi_parse_codec() by introducing separate loops for discovering converters and pins.
--- sound/pci/hda/patch_hdmi.c | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-)
sound/pci/hda/patch_hdmi.c +23 -13
@@ -1817,33 +1817,43 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)static int hdmi_parse_codec (struct hda_codec *codec) { -hda_nid_t nid; +hda_nid_t start_nid; +unsigned int caps;int i, nodes; - nodes =snd_hda_get_sub_nodes (codec, codec->core.afg, &nid); -if (!nid || nodes <0 ) { + nodes =snd_hda_get_sub_nodes (codec, codec->core.afg, &start_nid); +if (!start_nid || nodes <0 ) {codec_warn (codec,"HDMI: failed to get afg sub nodes\n" );return -EINVAL ; } -for (i =0 ; i < nodes; i++, nid++) { -unsigned int caps; -unsigned int type; +/* +* hdmi_add_pin() assumes total amount of converters to +* be known, so first discover all converters +*/ +for (i =0 ; i < nodes; i++) { +hda_nid_t nid = start_nid + i; caps =get_wcaps (codec, nid); - type =get_wcaps_type (caps);if (!(caps &AC_WCAP_DIGITAL ))continue ; -switch (type) { -case AC_WID_AUD_OUT : +if (get_wcaps_type (caps) ==AC_WID_AUD_OUT )hdmi_add_cvt (codec, nid); -break ; -case AC_WID_PIN : + } + +/* discover audio pins */ +for (i =0 ; i < nodes; i++) { +hda_nid_t nid = start_nid + i; + + caps =get_wcaps (codec, nid); + +if (!(caps &AC_WCAP_DIGITAL )) +continue ; + +if (get_wcaps_type (caps) ==AC_WID_PIN )hdmi_add_pin (codec, nid); -break ; - } }return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/138 net: sky2: initialize return of gm_phy_read
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 28b18e4eb515af7c6661c3995c6e3c34412c2874 ]
clang static analysis flags this garbage return
drivers/net/ethernet/marvell/sky2.c:208:2: warning: Undefined or garbage value returned to caller [core.uninitialized.UndefReturn]
return v;
^~~~~~~~static inline u16 gm_phy_read( ...
{
u16 v;
__gm_phy_read(hw, port, reg, &v);
return v;
}__gm_phy_read can return without setting v.
So handle similar to skge.c's gm_phy_read, initialize v.
--- drivers/net/ethernet/marvell/sky2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/sky2.c +1 -1
@@ -203,7 +203,7 @@ io_error:static inline u16 gm_phy_read (struct sky2_hw *hw,unsigned port,u16 reg) { -u16 v; +u16 v =0 ;__gm_phy_read (hw, port, reg, &v);return v; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/138 drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
[ Upstream commit 0156e76d388310a490aeb0f2fbb5b284ded3aecc ]
Tegra TRM says worst-case reply time is 1216us, and this should fix some spurious timeouts that have been popping up.
--- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c | 4 ++-- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c +2 -2
@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,if (retries)udelay (400 ); -/* transaction request, wait up to 1ms for it to complete */ +/* transaction request, wait up to 2ms for it to complete */ nvkm_wr32 (device,0x00e4e4 + base,0x00010000 | ctrl); - timeout =1000 ; + timeout =2000 ; do { ctrl = nvkm_rd32(device, 0x00e4e4 + base); udelay(1);
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c +2 -2
@@ -118,10 +118,10 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,if (retries)udelay (400 ); -/* transaction request, wait up to 1ms for it to complete */ +/* transaction request, wait up to 2ms for it to complete */ nvkm_wr32 (device,0x00d954 + base,0x00010000 | ctrl); - timeout =1000 ; + timeout =2000 ; do { ctrl = nvkm_rd32(device, 0x00d954 + base); udelay(1);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/138 scsi: mpt3sas: Fix error returns in BRM_status_show
In reply to Greg Kroah-HartmanFrom: Johannes Thumshirn <[email protected]>
[ Upstream commit 0fd181456aa0826057adbfb6c79c40f4083cfd75 ]
BRM_status_show() has several error branches, but none of them record the error in the error return.
Also while at it remove the manual mutex_unlock() of the pci_access_mutex in case of an ongoing pci error recovery or host removal and jump to the cleanup label instead.
Note: We can safely jump to out from here as io_unit_pg3 is initialized to NULL and if it hasn't been allocated, kfree() skips the NULL pointer.
[mkp: compilation warning]
--- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_ctl.c +6 -4
@@ -2925,15 +2925,14 @@ BRM_status_show(struct device *cdev, struct device_attribute *attr, }/* pci_access_mutex lock acquired by sysfs show path */ mutex_lock (&ioc->pci_access_mutex); -if (ioc->pci_error_recovery || ioc->remove_host) { -mutex_unlock (&ioc->pci_access_mutex); -return 0 ; - } +if (ioc->pci_error_recovery || ioc->remove_host) + goto out;/* allocate upto GPIOVal 36 entries */ sz = offsetof(Mpi2IOUnitPage3_t , GPIOVal) + (sizeof (u16) *36 ); io_unit_pg3 =kzalloc (sz,GFP_KERNEL );if (!io_unit_pg3) { + rc = -ENOMEM ;ioc_err (ioc,"%s: failed allocating memory for iounit_pg3: (%d) bytes\n" , __func__, sz); goto out;
@@ -2943,6 +2942,7 @@ BRM_status_show(struct device *cdev, struct device_attribute *attr, 0) {ioc_err (ioc,"%s: failed reading iounit_pg3\n" , __func__); + rc = -EINVAL ; goto out; }
@@ -2950,12 +2950,14 @@ BRM_status_show(struct device *cdev, struct device_attribute *attr,if (ioc_status !=MPI2_IOCSTATUS_SUCCESS ) {ioc_err (ioc,"%s: iounit_pg3 failed with ioc_status(0x%04x)\n" , __func__, ioc_status); + rc = -EINVAL ; goto out; }if (io_unit_pg3->GPIOCount <25 ) {ioc_err (ioc,"%s: iounit_pg3->GPIOCount less than 25 entries, detected (%d) entries\n" , __func__, io_unit_pg3->GPIOCount); + rc = -EINVAL ; goto out; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/138 scsi: dh: Add Fujitsu device to devinfo and dh lists
In reply to Greg Kroah-HartmanFrom: Steve Schremmer <[email protected]>
[ Upstream commit e094fd346021b820f37188aaa6b502c7490ab5b5 ]
Add FUJITSU ETERNUS_AHB
--- drivers/scsi/scsi_devinfo.c | 1 + drivers/scsi/scsi_dh.c | 1 + 2 files changed, 2 insertions(+)
drivers/scsi/scsi_devinfo.c +1 -0
@@ -239,6 +239,7 @@ static struct { {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, {"LENOVO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, + {"FUJITSU", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, {"SanDisk", "Cruzer Blade", NULL, BLIST_TRY_VPD_PAGES | BLIST_INQUIRY_36}, {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
drivers/scsi/scsi_dh.c +1 -0
@@ -63,6 +63,7 @@ static const struct scsi_dh_blist scsi_dh_blist[] = { {"LSI", "INF-01-00", "rdac", }, {"ENGENIO", "INF-01-00", "rdac", }, {"LENOVO", "DE_Series", "rdac", }, + {"FUJITSU", "ETERNUS_AHB", "rdac", }, {NULL, NULL, NULL }, };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 16/138 dm: use bio_uninit instead of bio_disassociate_blkg
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 382761dc6312965a11f82f2217e16ec421bf17ae ]
bio_uninit is the proper API to clean up a BIO that has been allocated on stack or inside a structure that doesn't come from the BIO allocator. Switch dm to use that instead of bio_disassociate_blkg, which really is an implementation detail. Note that the bio_uninit calls are also moved to the two callers of __send_empty_flush, so that they better pair with the bio_init calls used to initialize them.
--- drivers/md/dm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/md/dm.c +2 -3
@@ -1437,9 +1437,6 @@ static int __send_empty_flush(struct clone_info *ci)BUG_ON (bio_has_data (ci->bio));while ((ti =dm_table_get_target (ci->map, target_nr++)))__send_duplicate_bios (ci, ti, ti->num_flush_bios,NULL ); - -bio_disassociate_blkg (ci->bio); -return 0 ; }
@@ -1627,6 +1624,7 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md, ci.bio = &flush_bio; ci.sector_count =0 ; error =__send_empty_flush (&ci); +bio_uninit (ci.bio);/* dec_pending submits any data associated with flush */ }else if (bio_op (bio) ==REQ_OP_ZONE_RESET ) { ci.bio = bio;
@@ -1701,6 +1699,7 @@ static blk_qc_t __process_bio(struct mapped_device *md, struct dm_table *map, ci.bio = &flush_bio; ci.sector_count =0 ; error =__send_empty_flush (&ci); +bio_uninit (ci.bio);/* dec_pending submits any data associated with flush */ }else {struct dm_target_io *tio;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 17/138 drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
In reply to Greg Kroah-HartmanFrom: Gavin Shan <[email protected]>
[ Upstream commit c377e67c6271954969384f9be1b1b71de13eba30 ]
The CPU mask (@tmp) should be released on failing to allocate @cpu_groups or any of its elements. Otherwise, it leads to memory leakage because the CPU mask variable is dynamically allocated when CONFIG_CPUMASK_OFFSTACK is enabled.
--- drivers/firmware/psci/psci_checker.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/firmware/psci/psci_checker.c +4 -1
@@ -157,8 +157,10 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups) cpu_groups =kcalloc (nb_available_cpus,sizeof (cpu_groups),GFP_KERNEL ); -if (!cpu_groups) +if (!cpu_groups) { +free_cpumask_var (tmp);return -ENOMEM ; + }cpumask_copy (tmp, cpu_online_mask);
@@ -167,6 +169,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)topology_core_cpumask (cpumask_any (tmp));if (!alloc_cpumask_var (&cpu_groups[num_groups],GFP_KERNEL )) { +free_cpumask_var (tmp);free_cpu_groups (num_groups, &cpu_groups);return -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 18/138 fuse: fix weird page warning
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit a5005c3cda6eeb6b95645e6cc32f58dafeffc976 upstream.
When PageWaiters was added, updating this check was missed.
--- fs/fuse/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/fuse/dev.c +2 -1
@@ -771,7 +771,8 @@ static int fuse_check_page(struct page *page) 1 << PG_uptodate | 1 << PG_lru | 1 << PG_active | - 1 << PG_reclaim))) { + 1 << PG_reclaim | + 1 << PG_waiters))) {pr_warn ("trying to steal weird page\n" );pr_warn (" page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n" , page, page->index, page->flags,page_count (page),page_mapcount (page), page->mapping);return 1 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 19/138 irqdomain/treewide: Keep firmware node unconditionally allocated
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit e3beca48a45b5e0e6e6a4e0124276b8248dcc9bb ]
Quite some non OF/ACPI users of irqdomains allocate firmware nodes of type IRQCHIP_FWNODE_NAMED or IRQCHIP_FWNODE_NAMED_ID and free them right after creating the irqdomain. The only purpose of these FW nodes is to convey name information. When this was introduced the core code did not store the pointer to the node in the irqdomain. A recent change stored the firmware node pointer in irqdomain for other reasons and missed to notice that the usage sites which do the alloc_fwnode/create_domain/free_fwnode sequence are broken by this. Storing a dangling pointer is dangerous itself, but in case that the domain is destroyed later on this leads to a double free.
Remove the freeing of the firmware node after creating the irqdomain from all affected call sites to cure this.
--- arch/mips/pci/pci-xtalk-bridge.c | 5 +++-- arch/x86/kernel/apic/io_apic.c | 10 +++++----- arch/x86/kernel/apic/msi.c | 18 ++++++++++++------ arch/x86/kernel/apic/vector.c | 1 - arch/x86/platform/uv/uv_irq.c | 3 ++- drivers/iommu/amd_iommu.c | 5 +++-- drivers/iommu/hyperv-iommu.c | 5 ++++- drivers/iommu/intel_irq_remapping.c | 2 +- drivers/pci/controller/vmd.c | 5 +++-- 9 files changed, 33 insertions(+), 21 deletions(-)
arch/mips/pci/pci-xtalk-bridge.c +3 -2
@@ -444,9 +444,10 @@ static int bridge_probe(struct platform_device *pdev)return -ENOMEM ; domain =irq_domain_create_hierarchy (parent,0 ,8 , fn, &bridge_domain_ops,NULL ); -irq_domain_free_fwnode (fn); -if (!domain) +if (!domain) { +irq_domain_free_fwnode (fn);return -ENOMEM ; + }pci_set_flags (PCI_PROBE_ONLY );
arch/x86/kernel/apic/io_apic.c +5 -5
@@ -2329,12 +2329,12 @@ static int mp_irqdomain_create(int ioapic) ip->irqdomain =irq_domain_create_linear (fn, hwirqs, cfg->ops, (void *)(long )ioapic); -/* Release fw handle if it was allocated above */ -if (!cfg->dev) -irq_domain_free_fwnode (fn); - -if (!ip->irqdomain) +if (!ip->irqdomain) { +/* Release fw handle if it was allocated above */ +if (!cfg->dev) +irq_domain_free_fwnode (fn);return -ENOMEM ; + } ip->irqdomain->parent = parent;
arch/x86/kernel/apic/msi.c +12 -6
@@ -262,12 +262,13 @@ void __init arch_init_msi_domain(struct irq_domain *parent) msi_default_domain =pci_msi_create_irq_domain (fn, &pci_msi_domain_info, parent); -irq_domain_free_fwnode (fn); } -if (!msi_default_domain) +if (!msi_default_domain) { +irq_domain_free_fwnode (fn);pr_warn ("failed to initialize irqdomain for MSI/MSI-x.\n" ); -else + }else { msi_default_domain->flags |=IRQ_DOMAIN_MSI_NOMASK_QUIRK ; + } }#ifdef CONFIG_IRQ_REMAP
@@ -300,7 +301,8 @@ struct irq_domain *arch_create_remap_msi_irq_domain(struct irq_domain *parent,if (!fn)return NULL ; d =pci_msi_create_irq_domain (fn, &pci_msi_ir_domain_info, parent); -irq_domain_free_fwnode (fn); +if (!d) +irq_domain_free_fwnode (fn); return d; }#endif
@@ -363,7 +365,8 @@ static struct irq_domain *dmar_get_irq_domain(void)if (fn) { dmar_domain =msi_create_irq_domain (fn, &dmar_msi_domain_info, x86_vector_domain); -irq_domain_free_fwnode (fn); +if (!dmar_domain) +irq_domain_free_fwnode (fn); } out:mutex_unlock (&dmar_lock);
@@ -488,7 +491,10 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id) } d =msi_create_irq_domain (fn, domain_info, parent); -irq_domain_free_fwnode (fn); +if (!d) { +irq_domain_free_fwnode (fn); +kfree (domain_info); + }return d; }
arch/x86/kernel/apic/vector.c +0 -1
@@ -701,7 +701,6 @@ int __init arch_early_irq_init(void) x86_vector_domain =irq_domain_create_tree (fn, &x86_vector_domain_ops,NULL );BUG_ON (x86_vector_domain ==NULL ); -irq_domain_free_fwnode (fn);irq_set_default_host (x86_vector_domain);arch_init_msi_domain (x86_vector_domain);
arch/x86/platform/uv/uv_irq.c +2 -1
@@ -167,9 +167,10 @@ static struct irq_domain *uv_get_irq_domain(void) goto out; uv_domain =irq_domain_create_tree (fn, &uv_domain_ops,NULL ); -irq_domain_free_fwnode (fn);if (uv_domain) uv_domain->parent = x86_vector_domain; +else +irq_domain_free_fwnode (fn); out:mutex_unlock (&uv_lock);
drivers/iommu/amd_iommu.c +3 -2
@@ -4575,9 +4575,10 @@ int amd_iommu_create_irq_domain(struct amd_iommu *iommu)if (!fn)return -ENOMEM ; iommu->ir_domain =irq_domain_create_tree (fn, &amd_ir_domain_ops, iommu); -irq_domain_free_fwnode (fn); -if (!iommu->ir_domain) +if (!iommu->ir_domain) { +irq_domain_free_fwnode (fn);return -ENOMEM ; + } iommu->ir_domain->parent =arch_get_ir_parent_domain (); iommu->msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain,
drivers/iommu/hyperv-iommu.c +4 -1
@@ -155,7 +155,10 @@ static int __init hyperv_prepare_irq_remapping(void)0 ,IOAPIC_REMAPPING_ENTRY , fn, &hyperv_ir_domain_ops, NULL); -irq_domain_free_fwnode (fn); +if (!ioapic_ir_domain) { +irq_domain_free_fwnode (fn); +return -ENOMEM ; + }/* * Hyper-V doesn't provide irq remapping function for
drivers/iommu/intel_irq_remapping.c +1 -1
@@ -563,8 +563,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)0 ,INTR_REMAP_TABLE_ENTRIES , fn, &intel_ir_domain_ops, iommu); -irq_domain_free_fwnode (fn);if (!iommu->ir_domain) { +irq_domain_free_fwnode (fn);pr_err ("IR%d: failed to allocate irqdomain\n" , iommu->seq_id); goto out_free_bitmap; }
drivers/pci/controller/vmd.c +3 -2
@@ -680,9 +680,10 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features) vmd->irq_domain =pci_msi_create_irq_domain (fn, &vmd_msi_domain_info, x86_vector_domain); -irq_domain_free_fwnode (fn); -if (!vmd->irq_domain) +if (!vmd->irq_domain) { +irq_domain_free_fwnode (fn);return -ENODEV ; + }pci_add_resource (&resources, &vmd->resources[0 ]);pci_add_resource_offset (&resources, &vmd->resources[1 ], offset[0 ]);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 20/138 ARM: dts: imx6qdl-gw551x: Do not use simple-audio-card,dai-link
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit e52928e8d5c1c4837a0c6ec2068beea99defde8b ]
According to Documentation/devicetree/bindings/sound/simple-card.txt the 'simple-audio-card,dai-link' may be omitted when the card has only one DAI link, which is the case here.
Get rid of 'simple-audio-card,dai-link' in order to fix the following build warning with W=1:
arch/arm/boot/dts/imx6qdl-gw551x.dtsi:109.32-121.5: Warning (unit_address_vs_reg): /sound-digital/simple-audio-card,dai-link@0: node has a unit name, but no reg property
--- arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
arch/arm/boot/dts/imx6qdl-gw551x.dtsi +8 -11
@@ -105,19 +105,16 @@ sound-digital { compatible = "simple-audio-card"; simple-audio-card,name = "tda1997x-audio"; + simple-audio-card,format = "i2s"; + simple-audio-card,bitclock-master = <&sound_codec>; + simple-audio-card,frame-master = <&sound_codec>; - simple-audio-card,dai-link@0 { - format = "i2s"; - - cpu { - sound-dai = <&ssi2>; - }; + sound_cpu: simple-audio-card,cpu { + sound-dai = <&ssi2>; + }; - codec { - bitclock-master; - frame-master; - sound-dai = <&hdmi_receiver>; - }; + sound_codec: simple-audio-card,codec { + sound-dai = <&hdmi_receiver>; }; }; };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 21/138 ARM: dts: imx6qdl-gw551x: fix audio SSI
In reply to Greg Kroah-HartmanFrom: Tim Harvey <[email protected]>
[ Upstream commit 4237c625304b212a3f30adf787901082082511ec ]
The audio codec on the GW551x routes to ssi1. It fixes audio capture on the device.
--- arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-gw551x.dtsi +1 -1
@@ -110,7 +110,7 @@ simple-audio-card,frame-master = <&sound_codec>; sound_cpu: simple-audio-card,cpu { - sound-dai = <&ssi2>; + sound-dai = <&ssi1>; }; sound_codec: simple-audio-card,codec {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 22/138 dmabuf: use spinlock to access dmabuf->name
In reply to Greg Kroah-HartmanFrom: Charan Teja Kalla <[email protected]>
[ Upstream commit 6348dd291e3653534a9e28e6917569bc9967b35b ]
There exists a sleep-while-atomic bug while accessing the dmabuf->name under mutex in the dmabuffs_dname(). This is caused from the SELinux permissions checks on a process where it tries to validate the inherited files from fork() by traversing them through iterate_fd() (which traverse files under spin_lock) and call match_file(security/selinux/hooks.c) where the permission checks happen. This audit information is logged using dump_common_audit_data() where it calls d_path() to get the file path name. If the file check happen on the dmabuf's fd, then it ends up in ->dmabuffs_dname() and use mutex to access dmabuf->name. The flow will be like below:flush_unauthorized_files()
iterate_fd()
spin_lock() --> Start of the atomic section.
match_file()
file_has_perm()
avc_has_perm()
avc_audit()
slow_avc_audit()
common_lsm_audit()
dump_common_audit_data()
audit_log_d_path()
d_path()
dmabuffs_dname()
mutex_lock()--> Sleep while atomic.Call trace captured (on 4.19 kernels) is below:
___might_sleep+0x204/0x208 __might_sleep+0x50/0x88 __mutex_lock_common+0x5c/0x1068 __mutex_lock_common+0x5c/0x1068 mutex_lock_nested+0x40/0x50 dmabuffs_dname+0xa0/0x170 d_path+0x84/0x290 audit_log_d_path+0x74/0x130 common_lsm_audit+0x334/0x6e8 slow_avc_audit+0xb8/0xf8 avc_has_perm+0x154/0x218 file_has_perm+0x70/0x180 match_file+0x60/0x78 iterate_fd+0x128/0x168 selinux_bprm_committing_creds+0x178/0x248 security_bprm_committing_creds+0x30/0x48 install_exec_creds+0x1c/0x68 load_elf_binary+0x3a4/0x14e0 search_binary_handler+0xb0/0x1e0
So, use spinlock to access dmabuf->name to avoid sleep-while-atomic.
--- drivers/dma-buf/dma-buf.c | 11 +++++++---- include/linux/dma-buf.h | 1 + 2 files changed, 8 insertions(+), 4 deletions(-)
drivers/dma-buf/dma-buf.c +7 -4
@@ -45,10 +45,10 @@ static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen)size_t ret =0 ; dmabuf = dentry->d_fsdata; -mutex_lock (&dmabuf->lock); +spin_lock (&dmabuf->name_lock);if (dmabuf->name) ret =strlcpy (name, dmabuf->name,DMA_BUF_NAME_LEN ); -mutex_unlock (&dmabuf->lock); +spin_unlock (&dmabuf->name_lock);return dynamic_dname (dentry, buffer, buflen,"/%s:%s" , dentry->d_name.name, ret >0 ? name :"" );
@@ -338,8 +338,10 @@ static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf)kfree (name); goto out_unlock; } +spin_lock (&dmabuf->name_lock);kfree (dmabuf->name); dmabuf->name = name; +spin_unlock (&dmabuf->name_lock); out_unlock:mutex_unlock (&dmabuf->lock);
@@ -402,10 +404,10 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)/* Don't count the temporary reference taken inside procfs seq_show */ seq_printf (m,"count:\t%ld\n" ,file_count (dmabuf->file) -1 );seq_printf (m,"exp_name:\t%s\n" , dmabuf->exp_name); -mutex_lock (&dmabuf->lock); +spin_lock (&dmabuf->name_lock);if (dmabuf->name)seq_printf (m,"name:\t%s\n" , dmabuf->name); -mutex_unlock (&dmabuf->lock); +spin_unlock (&dmabuf->name_lock); }static const struct file_operations dma_buf_fops = {
@@ -537,6 +539,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) dmabuf->size = exp_info->size; dmabuf->exp_name = exp_info->exp_name; dmabuf->owner = exp_info->owner; +spin_lock_init (&dmabuf->name_lock);init_waitqueue_head (&dmabuf->poll); dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll; dmabuf->cb_excl.active = dmabuf->cb_shared.active =0 ;
include/linux/dma-buf.h +1 -0
@@ -303,6 +303,7 @@ struct dma_buf {void *vmap_ptr;const char *exp_name;const char *name; +spinlock_t name_lock;/* spinlock to protect name access */ struct module *owner;struct list_head list_node;void *priv;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 23/138 drm/amd/display: Check DMCU Exists Before Loading
In reply to Greg Kroah-HartmanFrom: Jerry (Fangzhi) Zuo <[email protected]>
[ Upstream commit 17bdb4a82fe5014c8aa5b2103c80c5729744a096 ]
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -1
@@ -928,9 +928,14 @@ static int dm_late_init(void *handle)struct dmcu_iram_parameters params;unsigned int linear_lut[16 ];int i; -struct dmcu *dmcu = adev->dm.dc->res_pool->dmcu; +struct dmcu *dmcu =NULL ;bool ret; +if (!adev->dm.fw_dmcu) +return detect_mst_link_for_all_connectors (adev->ddev); + + dmcu = adev->dm.dc->res_pool->dmcu; +for (i =0 ; i <16 ; i++) linear_lut[i] =0xFFFF * i /15 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 24/138 dm mpath: pass IO start time to path selector
In reply to Greg Kroah-HartmanFrom: Gabriel Krisman Bertazi <[email protected]>
[ Upstream commit 087615bf3acdafd0ba7c7c9ed5286e7b7c80fe1b ]
The HST path selector needs this information to perform path prediction. For request-based mpath, struct request's io_start_time_ns is used, while for bio-based, use the start_time stored in dm_io.
--- drivers/md/dm-mpath.c | 9 ++++++--- drivers/md/dm-path-selector.h | 2 +- drivers/md/dm-queue-length.c | 2 +- drivers/md/dm-service-time.c | 2 +- drivers/md/dm.c | 9 +++++++++ include/linux/device-mapper.h | 2 ++ 6 files changed, 20 insertions(+), 6 deletions(-)
drivers/md/dm-mpath.c +6 -3
@@ -558,7 +558,8 @@ static void multipath_release_clone(struct request *clone,if (pgpath && pgpath->pg->ps.type->end_io) pgpath->pg->ps.type->end_io (&pgpath->pg->ps, &pgpath->path, - mpio->nr_bytes); + mpio->nr_bytes, + clone->io_start_time_ns); }blk_put_request (clone);
@@ -1560,7 +1561,8 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone,struct path_selector *ps = &pgpath->pg->ps;if (ps->type->end_io) - ps->type->end_io (ps, &pgpath->path, mpio->nr_bytes); + ps->type->end_io (ps, &pgpath->path, mpio->nr_bytes, + clone->io_start_time_ns); }return r;
@@ -1604,7 +1606,8 @@ static int multipath_end_io_bio(struct dm_target *ti, struct bio *clone,struct path_selector *ps = &pgpath->pg->ps;if (ps->type->end_io) - ps->type->end_io (ps, &pgpath->path, mpio->nr_bytes); + ps->type->end_io (ps, &pgpath->path, mpio->nr_bytes, +dm_start_time_ns_from_clone (clone)); }return r;
drivers/md/dm-path-selector.h +1 -1
@@ -74,7 +74,7 @@ struct path_selector_type {int (*start_io) (struct path_selector *ps,struct dm_path *path,size_t nr_bytes);int (*end_io) (struct path_selector *ps,struct dm_path *path, -size_t nr_bytes); +size_t nr_bytes,u64 start_time); };/* Register a path selector */
drivers/md/dm-queue-length.c +1 -1
@@ -227,7 +227,7 @@ static int ql_start_io(struct path_selector *ps, struct dm_path *path, }static int ql_end_io (struct path_selector *ps,struct dm_path *path, -size_t nr_bytes) +size_t nr_bytes,u64 start_time) {struct path_info *pi = path->pscontext;
drivers/md/dm-service-time.c +1 -1
@@ -309,7 +309,7 @@ static int st_start_io(struct path_selector *ps, struct dm_path *path, }static int st_end_io (struct path_selector *ps,struct dm_path *path, -size_t nr_bytes) +size_t nr_bytes,u64 start_time) {struct path_info *pi = path->pscontext;
drivers/md/dm.c +9 -0
@@ -649,6 +649,15 @@ static bool md_in_flight(struct mapped_device *md)return md_in_flight_bios (md); } +u64 dm_start_time_ns_from_clone (struct bio *bio) +{ + struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone); +struct dm_io *io = tio->io; + +return jiffies_to_nsecs (io->start_time); +} +EXPORT_SYMBOL_GPL (dm_start_time_ns_from_clone); +static void start_io_acct (struct dm_io *io) {struct mapped_device *md = io->md;
include/linux/device-mapper.h +2 -0
@@ -328,6 +328,8 @@ void *dm_per_bio_data(struct bio *bio, size_t data_size);struct bio *dm_bio_from_per_bio_data (void *data,size_t data_size);unsigned dm_bio_get_target_bio_nr (const struct bio *bio); +u64 dm_start_time_ns_from_clone (struct bio *bio); +int dm_register_target (struct target_type *t);void dm_unregister_target (struct target_type *t);
Signature · 1 line
2.25.1
Re: [PATCH 5.4 024/138] dm mpath: pass IO start time to path selector
Quoted 7 lines · Greg Kroah-Hartman
From: Gabriel Krisman Bertazi <[email protected]>
[ Upstream commit
087615bf3acdafd0ba7c7c9ed5286e7b7c80fe1b]The HST path selector needs this information to perform path prediction. For request-based mpath, struct request's
io_start_time_nsis used, while for bio-based, use thestart_timestored indm_io.
Hi Greg,
This patch is not -stable material. It is only needed for a new feature merged in 5.8.
Thanks,
Signature · 1 line
Gabriel Krisman Bertazi
Greg Kroah-Hartman
maintainerPATCH 25/138 dm: do not use waitqueue for request-based DM
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 85067747cf9888249fa11fa49ef75af5192d3988 ]
Given request-based DM now uses blk-mq's blk_mq_queue_inflight() to determine if outstanding IO has completed (and DM has no control over the blk-mq state machine used to track outstanding IO) it is unsafe to wakeup waiter (dm_wait_for_completion) before blk-mq has cleared a request's state bits (e.g. MQ_RQ_IN_FLIGHT or MQ_RQ_COMPLETE). As such dm_wait_for_completion() could be left to wait indefinitely if no other requests complete.
Fix this by eliminating request-based DM's use of waitqueue to wait for blk-mq requests to complete in dm_wait_for_completion.
Depends-on: 3c94d83cb3526 ("blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight()")
--- drivers/md/dm-rq.c | 4 --- drivers/md/dm.c | 64 ++++++++++++++++++++++++++++------------------ 2 files changed, 39 insertions(+), 29 deletions(-)
drivers/md/dm-rq.c +0 -4
@@ -146,10 +146,6 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)*/ static void rq_completed (struct mapped_device *md) { -/* nudge anyone waiting on suspend queue */ -if (unlikely (wq_has_sleeper (&md->wait))) -wake_up (&md->wait); -/* * dm_put() must be at the end of this function. See the comment above */
drivers/md/dm.c +39 -25
88 lines not on this page · raw message
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 26/138 SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
commit 65caafd0d2145d1dd02072c4ced540624daeab40 upstream.
Reverting commit d03727b248d0 "NFSv4 fix CLOSE not waiting for direct IO compeletion". This patch made it so that fput() by calling inode_dio_done() in nfs_file_release() would wait uninterruptably for any outstanding directIO to the file (but that wait on IO should be killable).
The problem the patch was also trying to address was REMOVE returning ERR_ACCESS because the file is still opened, is supposed to be resolved by server returning ERR_FILE_OPEN and not ERR_ACCESS.
--- fs/nfs/direct.c | 13 ++++--------- fs/nfs/file.c | 1 - 2 files changed, 4 insertions(+), 10 deletions(-)
fs/nfs/direct.c +4 -9
@@ -367,6 +367,8 @@ static void nfs_direct_complete(struct n {struct inode *inode = dreq->inode; +inode_dio_end (inode); +if (dreq->iocb) {long res = (long ) dreq->error;if (dreq->count !=0 ) {
@@ -378,10 +380,7 @@ static void nfs_direct_complete(struct ncomplete (&dreq->completion); -igrab (inode);nfs_direct_req_release (dreq); -inode_dio_end (inode); -iput (inode); }static void nfs_direct_read_completion (struct nfs_pgio_header *hdr)
@@ -511,10 +510,8 @@ static ssize_t nfs_direct_read_schedule_* generic layer handle the completion. */ if (requested_bytes ==0 ) { -igrab (inode); -nfs_direct_req_release (dreq);inode_dio_end (inode); -iput (inode); +nfs_direct_req_release (dreq);return result <0 ? result : -EIO ; }
@@ -926,10 +923,8 @@ static ssize_t nfs_direct_write_schedule* generic layer handle the completion. */ if (requested_bytes ==0 ) { -igrab (inode); -nfs_direct_req_release (dreq);inode_dio_end (inode); -iput (inode); +nfs_direct_req_release (dreq);return result <0 ? result : -EIO ; }
fs/nfs/file.c +0 -1
@@ -83,7 +83,6 @@ nfs_file_release(struct inode *inode, stdprintk ("NFS: release(%pD2)\n" , filp);nfs_inc_stats (inode,NFSIOS_VFSRELEASE ); -inode_dio_wait (inode);nfs_file_clear_open_context (filp);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 27/138 btrfs: reloc: fix reloc root leak and NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 51415b6c1b117e223bc083e30af675cb5c5498f3 upstream.
[BUG]
When balance is canceled, there is a pretty high chance that unmounting the fs can lead to lead the NULL pointer dereference:
BTRFS warning (device dm-3): page private not zero on page 223158272
...
BTRFS warning (device dm-3): page private not zero on page 223162368 BTRFS error (device dm-3): leaked root 18446744073709551608-304 refcount 1
BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 5793 Comm: umount Tainted: G O 5.7.0-rc5-custom+ #53 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:__lock_acquire+0x5dc/0x24c0 Call Trace: lock_acquire+0xab/0x390 _raw_spin_lock+0x39/0x80 btrfs_release_extent_buffer_pages+0xd7/0x200 [btrfs] release_extent_buffer+0xb2/0x170 [btrfs] free_extent_buffer+0x66/0xb0 [btrfs] btrfs_put_root+0x8e/0x130 [btrfs] btrfs_check_leaked_roots.cold+0x5/0x5d [btrfs] btrfs_free_fs_info+0xe5/0x120 [btrfs] btrfs_kill_super+0x1f/0x30 [btrfs] deactivate_locked_super+0x3b/0x80 deactivate_super+0x3e/0x50 cleanup_mnt+0x109/0x160 __cleanup_mnt+0x12/0x20 task_work_run+0x67/0xa0 exit_to_usermode_loop+0xc5/0xd0 syscall_return_slowpath+0x205/0x360 do_syscall_64+0x6e/0xb0 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x7fd028ef740b
[CAUSE]
When balance is canceled, all reloc roots are marked as orphan, and orphan reloc roots are going to be cleaned up.
However for orphan reloc roots and merged reloc roots, their lifespan are quite different:
Merged reloc roots | Orphan reloc roots by cancel
--------------------------------------------------------------------create_reloc_root() | create_reloc_root()
|- refs == 1 | |- refs == 1
|
btrfs_grab_root(reloc_root); | btrfs_grab_root(reloc_root);
|- refs == 2 | |- refs == 2
|
root->reloc_root = reloc_root; | root->reloc_root = reloc_root;
>>> No difference so far <<<
|
prepare_to_merge() | prepare_to_merge()
|- btrfs_set_root_refs(item, 1);| |- if (!err) (err == -EINTR)
|
merge_reloc_roots() | merge_reloc_roots()
|- merge_reloc_root() | |- Doing nothing to put reloc root
|- insert_dirty_subvol() | |- refs == 2
|- __del_reloc_root() |
|- btrfs_put_root() |
|- refs == 1 |
>>> Now orphan reloc roots still have refs 2 <<<
|
clean_dirty_subvols() | clean_dirty_subvols()
|- btrfs_drop_snapshot() | |- btrfS_drop_snapshot()
|- reloc_root get freed | |- reloc_root still has refs 2
| related ebs get freed, but
| reloc_root still recorded in
| allocated_roots
btrfs_check_leaked_roots() | btrfs_check_leaked_roots()
|- No leaked roots | |- Leaked reloc_roots detected
| |- btrfs_put_root()
| |- free_extent_buffer(root->node);
| |- eb already freed, caused NULL
| pointer dereference[FIX]
The fix is to clear fs_root->reloc_root and put it at merge_reloc_roots() time, so that we won't leak reloc roots.
--- fs/btrfs/relocation.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +6 -3
@@ -2525,12 +2525,10 @@ again: reloc_root =list_entry (reloc_roots.next, struct btrfs_root, root_list); + root =read_fs_root (fs_info, reloc_root->root_key.offset);if (btrfs_root_refs (&reloc_root->root_item) >0 ) { - root =read_fs_root (fs_info, - reloc_root->root_key.offset);BUG_ON (IS_ERR (root));BUG_ON (root->reloc_root != reloc_root); - ret =merge_reloc_root (rc, root);if (ret) {if (list_empty (&reloc_root->root_list))
@@ -2539,6 +2537,11 @@ again: goto out; } }else { +if (!IS_ERR (root)) { +if (root->reloc_root == reloc_root) + root->reloc_root =NULL ; + } +list_del_init (&reloc_root->root_list);/* Don't forget to queue this reloc root for cleanup */ list_add_tail(&reloc_root->reloc_dirty_list,
Greg Kroah-Hartman
maintainerPATCH 28/138 btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 1dae7e0e58b484eaa43d530f211098fdeeb0f404 upstream.
[BUG]
There are several reported runaway balance, that balance is flooding the log with "found X extents" where the X never changes.
[CAUSE]
Commit d2311e698578 ("btrfs: relocation: Delay reloc tree deletion after merge_reloc_roots") introduced BTRFS_ROOT_DEAD_RELOC_TREE bit to indicate that one subvolume has finished its tree blocks swap with its reloc tree.
However if balance is canceled or hits ENOSPC halfway, we didn't clear the BTRFS_ROOT_DEAD_RELOC_TREE bit, leaving that bit hanging forever until unmount.
Any subvolume root with that bit, would cause backref cache to skip this tree block, as it has finished its tree block swap. This would cause all tree blocks of that root be ignored by balance, leading to runaway balance.
[FIX]
Fix the problem by also clearing the BTRFS_ROOT_DEAD_RELOC_TREE bit for the original subvolume of orphan reloc root.
Add an umount check for the stale bit still set.
--- fs/btrfs/relocation.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/relocation.c +2 -0
@@ -2540,6 +2540,8 @@ again:if (!IS_ERR (root)) {if (root->reloc_root == reloc_root) root->reloc_root =NULL ; +clear_bit (BTRFS_ROOT_DEAD_RELOC_TREE , + &root->state); }list_del_init (&reloc_root->root_list);
Greg Kroah-Hartman
maintainerPATCH 29/138 uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
In reply to Greg Kroah-HartmanFrom: Oleg Nesterov <[email protected]>
commit fe5ed7ab99c656bd2f5b79b49df0e9ebf2cead8a upstream.
If a tracee is uprobed and it hits int3 inserted by debugger, handle_swbp() does send_sig(SIGTRAP, current, 0) which means si_code == SI_USER. This used to work when this code was written, but then GDB started to validate si_code and now it simply can't use breakpoints if the tracee has an active uprobe:
# cat test.c
void unused_func(void)
{
}
int main(void)
{
return 0;
}# gcc -g test.c -o test # perf probe -x ./test -a unused_func # perf record -e probe_test:unused_func gdb ./test -ex run GNU gdb (GDB) 10.0.50.20200714-git ... Program received signal SIGTRAP, Trace/breakpoint trap. 0x00007ffff7ddf909 in dl_main () from /lib64/ld-linux-x86-64.so.2 (gdb)
The tracee hits the internal breakpoint inserted by GDB to monitor shared library events but GDB misinterprets this SIGTRAP and reports a signal.
Change handle_swbp() to use force_sig(SIGTRAP), this matches do_int3_user() and fixes the problem.
This is the minimal fix for -stable, arch/x86/kernel/uprobes.c is equally wrong; it should use send_sigtrap(TRAP_TRACE) instead of send_sig(SIGTRAP), but this doesn't confuse GDB and needs another x86-specific patch.
--- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/uprobes.c +1 -1
@@ -2205,7 +2205,7 @@ static void handle_swbp(struct pt_regs *if (!uprobe) {if (is_swbp >0 ) {/* No matching uprobe; signal SIGTRAP. */ -send_sig (SIGTRAP , current,0 ); +force_sig (SIGTRAP ); }else {/* * Either we raced with uprobe_unregister() or we can't
Greg Kroah-Hartman
maintainerPATCH 30/138 ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S
In reply to Greg Kroah-HartmanFrom: Joonho Wohn <[email protected]>
commit 568e4e82128aac2c62c2c359ebebb6007fd794f9 upstream.
Fixed no headphone sound bug on laptop Samsung Notebook Pen S (950SBE-951SBE), by using existing patch in Linus' tree, commit 14425f1f521f (ALSA: hda/realtek: Add quirk for Samsung Notebook). This laptop uses the same ALC298 but different subsystem id 0x144dc812. I added SND_PCI_QUIRK at sound/pci/hda/patch_realtek.c
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7551,6 +7551,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x144d ,0xc169 ,"Samsung Notebook 9 Pen (NP930SBE-K01US)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x144d ,0xc176 ,"Samsung Notebook 9 Pro (NP930MBE-K04US)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x144d ,0xc740 ,"Samsung Ativ book 8 (NP870Z5G)" ,ALC269_FIXUP_ATIV_BOOK_8 ), +SND_PCI_QUIRK (0x144d ,0xc812 ,"Samsung Notebook Pen S (NT950SBE-X58)" ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x1458 ,0xfa53 ,"Gigabyte BXBT-2807" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1462 ,0xb120 ,"MSI Cubi MS-B120" ,ALC283_FIXUP_HEADSET_MIC ), SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 31/138 ALSA: info: Drop WARN_ON() from buffer NULL sanity check
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 60379ba08532eca861e933b389526a4dc89e0c42 upstream.
snd_info_get_line() has a sanity check of NULL buffer -- both buffer itself being NULL and buffer->buffer being NULL. Basically both checks are valid and necessary, but the problem is that it's with snd_BUG_ON() macro that triggers WARN_ON(). The latter condition (NULL buffer->buffer) can be met arbitrarily by user since the buffer is allocated at the first write, so it means that user can trigger WARN_ON() at will.
This patch addresses it by simply moving buffer->buffer NULL check out of snd_BUG_ON() so that spurious WARNING is no longer triggered.
--- sound/core/info.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/core/info.c +3 -1
@@ -608,7 +608,9 @@ int snd_info_get_line(struct snd_info_bu {int c =-1 ; -if (snd_BUG_ON (!buffer || !buffer->buffer)) +if (snd_BUG_ON (!buffer)) +return 1 ; +if (!buffer->buffer)return 1 ;if (len <=0 || buffer->stop || buffer->error)return 1 ;
Greg Kroah-Hartman
maintainerPATCH 32/138 ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 5cacc6f5764e94fa753b2c1f5f7f1f3f74286e82 upstream.
The RT5670_PWR_ANLG1 register has 3 bits to select the LDO voltage, so the correct mask is 0x7 not 0x3.
Because of this wrong mask we were programming the ldo bits to a setting of binary 001 (0x05 & 0x03) instead of binary 101 when moving to SND_SOC_BIAS_PREPARE.
According to the datasheet 001 is a reserved value, so no idea what it did, since the driver was working fine before I guess we got lucky and it does something which is ok.
--- sound/soc/codecs/rt5670.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/rt5670.h +1 -1
@@ -757,7 +757,7 @@#define RT5670_PWR_VREF2_BIT 4#define RT5670_PWR_FV2 (0x1 << 3)#define RT5670_PWR_FV2_BIT 3 -#define RT5670_LDO_SEL_MASK (0x3) +#define RT5670_LDO_SEL_MASK (0x7)#define RT5670_LDO_SEL_SFT 0/* Power Management for Analog 2 (0x64) */
Greg Kroah-Hartman
maintainerPATCH 33/138 btrfs: fix double free on ulist after backref resolution failure
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 580c079b5766ac706f56eec5c79aee4bf929fef6 upstream.
At btrfs_find_all_roots_safe() we allocate a ulist and set the **roots argument to point to it. However if later we fail due to an error returned by find_parent_nodes(), we free that ulist but leave a dangling pointer in the **roots argument. Upon receiving the error, a caller of this function can attempt to free the same ulist again, resulting in an invalid memory access.
One such scenario is during qgroup accounting:
btrfs_qgroup_account_extents()
--> calls btrfs_find_all_roots() passes &new_roots (a stack allocated
pointer) to btrfs_find_all_roots()
--> btrfs_find_all_roots() just calls btrfs_find_all_roots_safe()
passing &new_roots to it
--> allocates ulist and assigns its address to **roots (which
points to new_roots from btrfs_qgroup_account_extents())
--> find_parent_nodes() returns an error, so we free the ulist
and leave **roots pointing to it after returning
--> btrfs_qgroup_account_extents() sees btrfs_find_all_roots() returned
an error and jumps to the label 'cleanup', which just tries to free again the same ulist
Stack trace example:
------------[ cut here ]------------ BTRFS: tree first key check failed WARNING: CPU: 1 PID: 1763215 at fs/btrfs/disk-io.c:422 btrfs_verify_level_key+0xe0/0x180 [btrfs] Modules linked in: dm_snapshot dm_thin_pool (...) CPU: 1 PID: 1763215 Comm: fsstress Tainted: G W 5.8.0-rc3-btrfs-next-64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:btrfs_verify_level_key+0xe0/0x180 [btrfs] Code: 28 5b 5d (...) RSP: 0018:ffffb89b473779a0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff90397759bf08 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000027 RDI: 00000000ffffffff RBP: ffff9039a419c000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffffb89b43301000 R12: 000000000000005e R13: ffffb89b47377a2e R14: ffffb89b473779af R15: 0000000000000000 FS: 00007fc47e1e1000(0000) GS:ffff9039ac200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc47e1df000 CR3: 00000003d9e4e001 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: read_block_for_search+0xf6/0x350 [btrfs] btrfs_next_old_leaf+0x242/0x650 [btrfs] resolve_indirect_refs+0x7cf/0x9e0 [btrfs] find_parent_nodes+0x4ea/0x12c0 [btrfs] btrfs_find_all_roots_safe+0xbf/0x130 [btrfs] btrfs_qgroup_account_extents+0x9d/0x390 [btrfs] btrfs_commit_transaction+0x4f7/0xb20 [btrfs] btrfs_sync_file+0x3d4/0x4d0 [btrfs] do_fsync+0x38/0x70 __x64_sys_fdatasync+0x13/0x20 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fc47e2d72e3 Code: Bad RIP value. RSP: 002b:00007fffa32098c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004b RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc47e2d72e3 RDX: 00007fffa3209830 RSI: 00007fffa3209830 RDI: 0000000000000003 RBP: 000000000000072e R08: 0000000000000001 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000003e8 R13: 0000000051eb851f R14: 00007fffa3209970 R15: 00005607c4ac8b50 irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<ffffffffb8eb5e85>] copy_process+0x755/0x1eb0 softirqs last enabled at (0): [<ffffffffb8eb5e85>] copy_process+0x755/0x1eb0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ---[ end trace 8639237550317b48 ]--- BTRFS error (device sdc): tree first key mismatch detected, bytenr=62324736 parent_transid=94 key expected=(262,108,1351680) has=(259,108,1921024) general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI CPU: 2 PID: 1763215 Comm: fsstress Tainted: G W 5.8.0-rc3-btrfs-next-64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:ulist_release+0x14/0x60 [btrfs] Code: c7 07 00 (...) RSP: 0018:ffffb89b47377d60 EFLAGS: 00010282 RAX: 6b6b6b6b6b6b6b6b RBX: ffff903959b56b90 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000270024 RDI: ffff9036e2adc840 RBP: ffff9036e2adc848 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9036e2adc840 R13: 0000000000000015 R14: ffff9039a419ccf8 R15: ffff90395d605840 FS: 00007fc47e1e1000(0000) GS:ffff9039ac600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8c1c0a51c8 CR3: 00000003d9e4e004 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ulist_free+0x13/0x20 [btrfs] btrfs_qgroup_account_extents+0xf3/0x390 [btrfs] btrfs_commit_transaction+0x4f7/0xb20 [btrfs] btrfs_sync_file+0x3d4/0x4d0 [btrfs] do_fsync+0x38/0x70 __x64_sys_fdatasync+0x13/0x20 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fc47e2d72e3 Code: Bad RIP value. RSP: 002b:00007fffa32098c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004b RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc47e2d72e3 RDX: 00007fffa3209830 RSI: 00007fffa3209830 RDI: 0000000000000003 RBP: 000000000000072e R08: 0000000000000001 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000003e8 R13: 0000000051eb851f R14: 00007fffa3209970 R15: 00005607c4ac8b50 Modules linked in: dm_snapshot dm_thin_pool (...) ---[ end trace 8639237550317b49 ]--- RIP: 0010:ulist_release+0x14/0x60 [btrfs] Code: c7 07 00 (...) RSP: 0018:ffffb89b47377d60 EFLAGS: 00010282 RAX: 6b6b6b6b6b6b6b6b RBX: ffff903959b56b90 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000270024 RDI: ffff9036e2adc840 RBP: ffff9036e2adc848 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9036e2adc840 R13: 0000000000000015 R14: ffff9039a419ccf8 R15: ffff90395d605840 FS: 00007fc47e1e1000(0000) GS:ffff9039ad200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6a776f7d40 CR3: 00000003d9e4e002 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Fix this by making btrfs_find_all_roots_safe() set *roots to NULL after it frees the ulist.
--- fs/btrfs/backref.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/backref.c +1 -0
@@ -1422,6 +1422,7 @@ static int btrfs_find_all_roots_safe(strif (ret <0 && ret != -ENOENT ) {ulist_free (tmp);ulist_free (*roots); + *roots =NULL ;return ret; } node =ulist_next (tmp, &uiter);
Greg Kroah-Hartman
maintainerPATCH 34/138 btrfs: fix mount failure caused by race with umount
In reply to Greg Kroah-HartmanFrom: Boris Burkov <[email protected]>
commit 48cfa61b58a1fee0bc49eef04f8ccf31493b7cdd upstream.
It is possible to cause a btrfs mount to fail by racing it with a slow umount. The crux of the sequence is generic_shutdown_super not yet calling sop->put_super before btrfs_mount_root calls btrfs_open_devices. If that occurs, btrfs_open_devices will decide the opened counter is non-zero, increment it, and skip resetting fs_devices->total_rw_bytes to
0. From here, mount will call sget which will result in grab_super trying to take the super block umount semaphore. That semaphore will be held by the slow umount, so mount will block. Before up-ing the semaphore, umount will delete the super block, resulting in mount's sget reliably allocating a new one, which causes the mount path to dutifully fill it out, and increment total_rw_bytes a second time, which causes the mount to fail, as we see double the expected bytes.
Here is the sequence laid out in greater detail:
CPU0 CPU1down_write sb->s_umountbtrfs_kill_super
kill_anon_super(sb)
generic_shutdown_super(sb);
shrink_dcache_for_umount(sb);
sync_filesystem(sb);
evict_inodes(sb); // SLOW
btrfs_mount_root
btrfs_scan_one_device
fs_devices = device->fs_devices
fs_info->fs_devices = fs_devices
// fs_devices-opened makes this a no-op
btrfs_open_devices(fs_devices, mode, fs_type)
s = sget(fs_type, test, set, flags, fs_info);
find sb in s_instances
grab_super(sb);
down_write(&s->s_umount); // blocks
sop->put_super(sb)
// sb->fs_devices->opened == 2; no-op
spin_lock(&sb_lock);
hlist_del_init(&sb->s_instances);
spin_unlock(&sb_lock);
up_write(&sb->s_umount);
return 0;
retry lookup
don't find sb in s_instances (deleted by CPU0)
s = alloc_super
return s;
btrfs_fill_super(s, fs_devices, data)
open_ctree // fs_devices total_rw_bytes improperly set!
btrfs_read_chunk_tree
read_one_dev // increment total_rw_bytes again!!
super_total_bytes < fs_devices->total_rw_bytes // ERROR!!!To fix this, we clear total_rw_bytes from within btrfs_read_chunk_tree before the calls to read_one_dev, while holding the sb umount semaphore and the uuid mutex.
To reproduce, it is sufficient to dirty a decent number of inodes, then quickly umount and mount.
for i in $(seq 0 500)
do
dd if=/dev/zero of="/mnt/foo/$i" bs=1M count=1
done
umount /mnt/foo&
mount /mnt/foodoes the trick for me.
--- fs/btrfs/volumes.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/btrfs/volumes.c +8 -0
@@ -7270,6 +7270,14 @@ int btrfs_read_chunk_tree(struct btrfs_fmutex_lock (&fs_info->chunk_mutex);/* +* It is possible for mount and umount to race in such a way that +* we execute this code path, but open_fs_devices failed to clear +* total_rw_bytes. We certainly want it cleared before reading the +* device items, so clear it here. +*/ + fs_info->fs_devices->total_rw_bytes =0 ; + +/* * Read all device items, and then all the chunk items. All * device items are found before any chunk item (their object id * is smaller than the lowest possible object id for a chunk
Greg Kroah-Hartman
maintainerPATCH 35/138 btrfs: fix page leaks after failure to lock page for delalloc
In reply to Greg Kroah-HartmanFrom: Robbie Ko <[email protected]>
commit 5909ca110b29aa16b23b52b8de8d3bb1035fd738 upstream.
When locking pages for delalloc, we check if it's dirty and mapping still matches. If it does not match, we need to return -EAGAIN and release all pages. Only the current page was put though, iterate over all the remaining pages too.
--- fs/btrfs/extent_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/extent_io.c +2 -1
@@ -1923,7 +1923,8 @@ static int __process_pages_contig(structif (!PageDirty (pages[i]) || pages[i]->mapping != mapping) {unlock_page (pages[i]); -put_page (pages[i]); +for (; i < ret; i++) +put_page (pages[i]); err = -EAGAIN ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 36/138 bnxt_en: Fix race when modifying pause settings.
In reply to Greg Kroah-HartmanFrom: Vasundhara Volam <[email protected]>
[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ]
The driver was modified to not rely on rtnl lock to protect link settings about 2 years ago. The pause setting was missed when making that change. Fix it by acquiring link_lock mutex before calling bnxt_hwrm_set_pause().
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +4 -1
@@ -1688,8 +1688,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,if (epause->tx_pause) link_info->req_flow_ctrl |=BNXT_LINK_PAUSE_TX ; -if (netif_running (dev)) +if (netif_running (dev)) { +mutex_lock (&bp->link_lock); rc =bnxt_hwrm_set_pause (bp); +mutex_unlock (&bp->link_lock); + }return rc; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 37/138 bnxt_en: Fix completion ring sizing with TPA enabled.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit 27640ce68d21e556b66bc5fa022aacd26e53c947 ]
The current completion ring sizing formula is wrong with TPA enabled. The formula assumes that the number of TPA completions are bound by the RX ring size, but that's not true. TPA_START completions are immediately recycled so they are not bound by the RX ring size. We must add bp->max_tpa to the worst case maximum RX and TPA completions.
The completion ring can overflow because of this mistake. This will cause hardware to disable the completion ring when this happens, leading to RX and TX traffic to stall on that ring. This issue is generally exposed only when the RX ring size is set very small.
Fix the formula by adding bp->max_tpa to the number of RX completions if TPA is enabled.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +10 -2
@@ -3423,7 +3423,7 @@ void bnxt_set_tpa_flags(struct bnxt *bp)*/ void bnxt_set_ring_params (struct bnxt *bp) { -u32 ring_size, rx_size, rx_space; +u32 ring_size, rx_size, rx_space, max_rx_cmpl;u32 agg_factor =0 , agg_ring_size =0 ;/* 8 for CRC and VLAN */
@@ -3479,7 +3479,15 @@ void bnxt_set_ring_params(struct bnxt *bp) bp->tx_nr_pages =bnxt_calc_nr_ring_pages (ring_size,TX_DESC_CNT ); bp->tx_ring_mask = (bp->tx_nr_pages *TX_DESC_CNT ) -1 ; - ring_size = bp->rx_ring_size * (2 + agg_factor) + bp->tx_ring_size; + max_rx_cmpl = bp->rx_ring_size; +/* MAX TPA needs to be added because TPA_START completions are +* immediately recycled, so the TPA completions are not bound by +* the RX ring size. +*/ +if (bp->flags &BNXT_FLAG_TPA ) + max_rx_cmpl += bp->max_tpa; +/* RX and TPA completions are 32-byte, all others are 16-byte */ + ring_size = max_rx_cmpl *2 + agg_ring_size + bp->tx_ring_size; bp->cp_ring_size = ring_size; bp->cp_nr_pages =bnxt_calc_nr_ring_pages (ring_size,CP_DESC_CNT );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 38/138 fpga: dfl: pci: reduce the scope of variable ret
In reply to Greg Kroah-HartmanFrom: Xu Yilun <[email protected]>
[ Upstream commit e19485dc7a0d210b428a249c0595769bd495fb71 ]
This is to fix lkp cppcheck warnings:
drivers/fpga/dfl-pci.c:230:6: warning: The scope of the variable 'ret' can be reduced. [variableScope]
int ret = 0;
^ drivers/fpga/dfl-pci.c:230:10: warning: Variable 'ret' is assigned a value that is never used. [unreadVariable]
int ret = 0;
^--- drivers/fpga/dfl-pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/fpga/dfl-pci.c +2 -1
@@ -227,7 +227,6 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs) {struct cci_drvdata *drvdata =pci_get_drvdata (pcidev);struct dfl_fpga_cdev *cdev = drvdata->cdev; -int ret =0 ;if (!num_vfs) {/*
@@ -239,6 +238,8 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs)dfl_fpga_cdev_config_ports_pf (cdev); }else { +int ret; +/* * before enable SRIOV, put released ports into VF access mode * first of all.
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 39/138 fpga: dfl: fix bug in port reset handshake
In reply to Greg Kroah-HartmanFrom: Matthew Gerlach <[email protected]>
[ Upstream commit 8614afd689df59d9ce019439389be20bd788a897 ]
When putting the port in reset, driver must wait for the soft reset acknowledgment bit instead of the soft reset bit.
--- drivers/fpga/dfl-afu-main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/fpga/dfl-afu-main.c +2 -1
@@ -83,7 +83,8 @@ int __afu_port_disable(struct platform_device *pdev)* on this port and minimum soft reset pulse width has elapsed. * Driver polls port_soft_reset_ack to determine if reset done by HW. */ -if (readq_poll_timeout (base +PORT_HDR_CTRL , v, v &PORT_CTRL_SFTRST , +if (readq_poll_timeout (base +PORT_HDR_CTRL , v, + v &PORT_CTRL_SFTRST_ACK ,RST_POLL_INVL ,RST_POLL_TIMEOUT )) {dev_err (&pdev->dev,"timeout, fail to reset device\n" );return -ETIMEDOUT ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 40/138 hippi: Fix a size used in a pci_free_consistent() in an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ]
The size used when calling 'pci_alloc_consistent()' and 'pci_free_consistent()' should match.
Fix it and have it consistent with the corresponding call in 'rr_close()'.
--- drivers/net/hippi/rrunner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/hippi/rrunner.c +1 -1
@@ -1242,7 +1242,7 @@ static int rr_open(struct net_device *dev) rrpriv->info =NULL ; }if (rrpriv->rx_ctrl) { -pci_free_consistent (pdev,sizeof (struct ring_ctrl ), +pci_free_consistent (pdev,256 *sizeof (struct ring_ctrl ), rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma); rrpriv->rx_ctrl =NULL ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 41/138 vsock/virtio: annotate the_virtio_vsock RCU pointer
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit f961134a612c793d5901a93d85a29337c74af978 ]
Commit 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock") starts to use RCU to protect 'the_virtio_vsock' pointer, but we forgot to annotate it.
This patch adds the annotation to fix the following sparse errors:
net/vmw_vsock/virtio_transport.c:73:17: error: incompatible types in comparison expression (different address spaces):
net/vmw_vsock/virtio_transport.c:73:17: struct virtio_vsock [noderef] __rcu *
net/vmw_vsock/virtio_transport.c:73:17: struct virtio_vsock *
net/vmw_vsock/virtio_transport.c:171:17: error: incompatible types in comparison expression (different address spaces):
net/vmw_vsock/virtio_transport.c:171:17: struct virtio_vsock [noderef] __rcu *
net/vmw_vsock/virtio_transport.c:171:17: struct virtio_vsock *
net/vmw_vsock/virtio_transport.c:207:17: error: incompatible types in comparison expression (different address spaces):
net/vmw_vsock/virtio_transport.c:207:17: struct virtio_vsock [noderef] __rcu *
net/vmw_vsock/virtio_transport.c:207:17: struct virtio_vsock *
net/vmw_vsock/virtio_transport.c:561:13: error: incompatible types in comparison expression (different address spaces):
net/vmw_vsock/virtio_transport.c:561:13: struct virtio_vsock [noderef] __rcu *
net/vmw_vsock/virtio_transport.c:561:13: struct virtio_vsock *
net/vmw_vsock/virtio_transport.c:612:9: error: incompatible types in comparison expression (different address spaces):
net/vmw_vsock/virtio_transport.c:612:9: struct virtio_vsock [noderef] __rcu *
net/vmw_vsock/virtio_transport.c:612:9: struct virtio_vsock *
net/vmw_vsock/virtio_transport.c:631:9: error: incompatible types in comparison expression (different address spaces):
net/vmw_vsock/virtio_transport.c:631:9: struct virtio_vsock [noderef] __rcu *
net/vmw_vsock/virtio_transport.c:631:9: struct virtio_vsock *
--- net/vmw_vsock/virtio_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/vmw_vsock/virtio_transport.c +1 -1
@@ -22,7 +22,7 @@#include <net/af_vsock.h> static struct workqueue_struct *virtio_vsock_workqueue; -static struct virtio_vsock *the_virtio_vsock; +static struct virtio_vsock __rcu *the_virtio_vsock;static DEFINE_MUTEX (the_virtio_vsock_mutex);/* protects the_virtio_vsock */ struct virtio_vsock {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 42/138 ax88172a: fix ax88172a_unbind() failures
In reply to Greg Kroah-HartmanFrom: George Kennedy <[email protected]>
[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ]
If ax88172a_unbind() fails, make sure that the return code is less than zero so that cleanup is done properly and avoid UAF.
--- drivers/net/usb/ax88172a.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/ax88172a.c +1 -0
@@ -198,6 +198,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) ret =asix_read_cmd (dev,AX_CMD_READ_NODE_ID ,0 ,0 ,ETH_ALEN , buf,0 );if (ret <ETH_ALEN ) {netdev_err (dev->net,"Failed to read MAC address: %d\n" , ret); + ret = -EIO ; goto free; }memcpy (dev->net->dev_addr, buf,ETH_ALEN );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 43/138 RDMA/mlx5: Use xa_lock_irq when access to SRQ table
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
[ Upstream commit c3d6057e07a5d15be7c69ea545b3f91877808c96 ]
SRQ table is accessed both from interrupt and process context, therefore we must use xa_lock_irq.
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
kworker/u17:9/8573 takes:
ffff8883e3503d30 (&xa->xa_lock#13){?...}-{2:2}, at: mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib] {IN-HARDIRQ-W} state was registered at:
lock_acquire+0xb9/0x3a0
_raw_spin_lock+0x25/0x30
srq_event_notifier+0x2b/0xc0 [mlx5_ib]
notifier_call_chain+0x45/0x70
__atomic_notifier_call_chain+0x69/0x100
forward_event+0x36/0xc0 [mlx5_core]
notifier_call_chain+0x45/0x70
__atomic_notifier_call_chain+0x69/0x100
mlx5_eq_async_int+0xc5/0x160 [mlx5_core]
notifier_call_chain+0x45/0x70
__atomic_notifier_call_chain+0x69/0x100
mlx5_irq_int_handler+0x19/0x30 [mlx5_core]
__handle_irq_event_percpu+0x43/0x2a0
handle_irq_event_percpu+0x30/0x70
handle_irq_event+0x34/0x60
handle_edge_irq+0x7c/0x1b0
do_IRQ+0x60/0x110
ret_from_intr+0x0/0x2a
default_idle+0x34/0x160
do_idle+0x1ec/0x220
cpu_startup_entry+0x19/0x20
start_secondary+0x153/0x1a0
secondary_startup_64+0xa4/0xb0
irq event stamp: 20907
hardirqs last enabled at (20907): _raw_spin_unlock_irq+0x24/0x30
hardirqs last disabled at (20906): _raw_spin_lock_irq+0xf/0x40
softirqs last enabled at (20746): __do_softirq+0x2c9/0x436
softirqs last disabled at (20681): irq_exit+0xb3/0xc0other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&xa->xa_lock#13);
<Interrupt>
lock(&xa->xa_lock#13);
*** DEADLOCK ***2 locks held by kworker/u17:9/8573:
#0: ffff888295218d38 ((wq_completion)mlx5_ib_page_fault){+.+.}-{0:0}, at: process_one_work+0x1f1/0x5f0
#1: ffff888401647e78 ((work_completion)(&pfault->work)){+.+.}-{0:0}, at: process_one_work+0x1f1/0x5f0 stack backtrace:
CPU: 0 PID: 8573 Comm: kworker/u17:9 Tainted: GO 5.7.0_for_upstream_min_debug_2020_06_14_11_31_46_41 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]
Call Trace:
dump_stack+0x71/0x9b
mark_lock+0x4f2/0x590
? print_shortest_lock_dependencies+0x200/0x200
__lock_acquire+0xa00/0x1eb0
lock_acquire+0xb9/0x3a0
? mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib]
_raw_spin_lock+0x25/0x30
? mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib]
mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib]
mlx5_ib_eqe_pf_action+0x257/0xa30 [mlx5_ib]
? process_one_work+0x209/0x5f0
process_one_work+0x27b/0x5f0
? __schedule+0x280/0x7e0
worker_thread+0x2d/0x3c0
? process_one_work+0x5f0/0x5f0
kthread+0x111/0x130
? kthread_park+0x90/0x90
ret_from_fork+0x24/0x30--- drivers/infiniband/hw/mlx5/srq_cmd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/srq_cmd.c +2 -2
@@ -83,11 +83,11 @@ struct mlx5_core_srq *mlx5_cmd_get_srq(struct mlx5_ib_dev *dev, u32 srqn)struct mlx5_srq_table *table = &dev->srq_table;struct mlx5_core_srq *srq; -xa_lock (&table->array); +xa_lock_irq (&table->array); srq =xa_load (&table->array, srqn);if (srq)refcount_inc (&srq->common.refcount); -xa_unlock (&table->array); +xa_unlock_irq (&table->array);return srq; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 44/138 ASoC: Intel: bytcht_es8316: Add missed put_device()
In reply to Greg Kroah-HartmanFrom: Jing Xiangfeng <[email protected]>
[ Upstream commit b3df80ab6d147d4738be242e1c91e5fdbb6b03ef ]
snd_byt_cht_es8316_mc_probe() misses to call put_device() in an error path. Add the missed function call to fix it.
--- sound/soc/intel/boards/bytcht_es8316.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/intel/boards/bytcht_es8316.c +3 -1
@@ -548,8 +548,10 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)if (cnt) { ret =device_add_properties (codec_dev, props); -if (ret) +if (ret) { +put_device (codec_dev);return ret; + } }devm_acpi_dev_add_driver_gpios (codec_dev, byt_cht_es8316_gpios);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 45/138 net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
In reply to Greg Kroah-HartmanFrom: Sergey Organov <[email protected]>
[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ]
Quoted 1 line
From
Documentation/networking/timestamping.txt:
A driver which supports hardware time stamping shall update the struct with the actual, possibly more permissive configuration.
Do update the struct passed when we upscale the requested time stamping mode.
--- drivers/net/phy/dp83640.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/phy/dp83640.c +4 -0
@@ -1348,6 +1348,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L4 ; dp83640->version =PTP_CLASS_V1 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V1_L4_EVENT ;break ;case HWTSTAMP_FILTER_PTP_V2_L4_EVENT :case HWTSTAMP_FILTER_PTP_V2_L4_SYNC :
@@ -1355,6 +1356,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L4 ; dp83640->version =PTP_CLASS_V2 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V2_L4_EVENT ;break ;case HWTSTAMP_FILTER_PTP_V2_L2_EVENT :case HWTSTAMP_FILTER_PTP_V2_L2_SYNC :
@@ -1362,6 +1364,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L2 ; dp83640->version =PTP_CLASS_V2 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V2_L2_EVENT ;break ;case HWTSTAMP_FILTER_PTP_V2_EVENT :case HWTSTAMP_FILTER_PTP_V2_SYNC :
@@ -1369,6 +1372,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) dp83640->hwts_rx_en =1 ; dp83640->layer =PTP_CLASS_L4 |PTP_CLASS_L2 ; dp83640->version =PTP_CLASS_V2 ; + cfg.rx_filter =HWTSTAMP_FILTER_PTP_V2_EVENT ;break ;default :return -ERANGE ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 46/138 ieee802154: fix one possible memleak in adf7242_probe
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
[ Upstream commit 66673f96f0f968b991dc38be06102246919c663c ]
When probe fail, we should destroy the workqueue.
--- drivers/net/ieee802154/adf7242.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ieee802154/adf7242.c +3 -1
@@ -1262,7 +1262,7 @@ static int adf7242_probe(struct spi_device *spi) WQ_MEM_RECLAIM);if (unlikely (!lp->wqueue)) { ret = -ENOMEM ; - goto err_hw_init; + goto err_alloc_wq; } ret =adf7242_hw_init (lp);
@@ -1294,6 +1294,8 @@ static int adf7242_probe(struct spi_device *spi)return ret; err_hw_init: +destroy_workqueue (lp->wqueue); +err_alloc_wq:mutex_destroy (&lp->bmux);ieee802154_free_hw (lp->hw);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 47/138 drm: sun4i: hdmi: Fix inverted HPD result
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit baa1841eb797eadce6c907bdaed7cd6f01815404 ]
When the extra HPD polling in sun4i_hdmi was removed, the result of HPD was accidentally inverted.
Fix this by inverting the check.
--- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +1 -1
@@ -263,7 +263,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)unsigned long reg; reg =readl (hdmi->base +SUN4I_HDMI_HPD_REG ); -if (reg &SUN4I_HDMI_HPD_HIGH ) { +if (!(reg &SUN4I_HDMI_HPD_HIGH )) {cec_phys_addr_invalidate (hdmi->cec_adap);return connector_status_disconnected; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/138 net: smc91x: Fix possible memory leak in smc_drv_probe()
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ]
If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev) should be called to free the ndev created earlier. Otherwise, a memleak will occur.
--- drivers/net/ethernet/smsc/smc91x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/smsc/smc91x.c +2 -2
@@ -2274,7 +2274,7 @@ static int smc_drv_probe(struct platform_device *pdev) ret =try_toggle_control_gpio (&pdev->dev, &lp->power_gpio,"power" ,0 ,0 ,100 );if (ret) -return ret; + goto out_free_netdev;/* * Optional reset GPIO configured? Minimum 100 ns reset needed
@@ -2283,7 +2283,7 @@ static int smc_drv_probe(struct platform_device *pdev) ret =try_toggle_control_gpio (&pdev->dev, &lp->reset_gpio,"reset" ,0 ,0 ,100 );if (ret) -return ret; + goto out_free_netdev;/* * Need to wait for optional EEPROM to load, max 750 us according
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 49/138 bonding: check error value of register_netdevice() immediately
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 544f287b84959203367cd29e16e772717612fab4 ]
If register_netdevice() is failed, net_device should not be used because variables are uninitialized or freed.
So, the routine should be stopped immediately.
But, bond_create() doesn't check return value of register_netdevice() immediately. That will result in a panic because of using uninitialized or freed memory.
Test commands:
modprobe netdev-notifier-error-inject
echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\actions/NETDEV_REGISTER/error
modprobe bonding max_bonds=3
Splat looks like:
[ 375.028492][ T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 375.033207][ T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645 [ 375.036068][ T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 375.039673][ T193] Workqueue: events linkwatch_event [ 375.041557][ T193] RIP: 0010:dev_activate+0x4a/0x340 [ 375.043381][ T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08 [ 375.050267][ T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202 [ 375.052410][ T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006 [ 375.055178][ T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000 [ 375.057762][ T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000 [ 375.059810][ T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08 [ 375.061892][ T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580 [ 375.063931][ T193] FS: 0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000 [ 375.066239][ T193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 375.067841][ T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0 [ 375.069657][ T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 375.071471][ T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 375.073269][ T193] Call Trace: [ 375.074005][ T193] linkwatch_do_dev+0x4d/0x50 [ 375.075052][ T193] __linkwatch_run_queue+0x10b/0x200 [ 375.076244][ T193] linkwatch_event+0x21/0x30 [ 375.077274][ T193] process_one_work+0x252/0x600 [ 375.078379][ T193] ? process_one_work+0x600/0x600 [ 375.079518][ T193] worker_thread+0x3c/0x380 [ 375.080534][ T193] ? process_one_work+0x600/0x600 [ 375.081668][ T193] kthread+0x139/0x150 [ 375.082567][ T193] ? kthread_park+0x90/0x90 [ 375.083567][ T193] ret_from_fork+0x22/0x30
--- drivers/net/bonding/bond_main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_main.c +7 -3
@@ -4864,15 +4864,19 @@ int bond_create(struct net *net, const char *name) bond_dev->rtnl_link_ops = &bond_link_ops; res =register_netdevice (bond_dev); +if (res <0 ) { +free_netdev (bond_dev); +rtnl_unlock (); + +return res; + }netif_carrier_off (bond_dev);bond_work_init_all (bond);rtnl_unlock (); -if (res <0 ) -free_netdev (bond_dev); -return res; +return 0 ; }static int __net_init bond_net_init (struct net *net)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/138 mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
[ Upstream commit 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 ]
When mlxsw_core_trap_register fails in mlxsw_emad_init, destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq.
--- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/core.c +2 -1
@@ -592,7 +592,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) err =mlxsw_core_trap_register (mlxsw_core, &mlxsw_emad_rx_listener, mlxsw_core);if (err) -return err; + goto err_trap_register; err = mlxsw_core->driver->basic_trap_groups_set (mlxsw_core);if (err)
@@ -604,6 +604,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) err_emad_trap_set:mlxsw_core_trap_unregister (mlxsw_core, &mlxsw_emad_rx_listener, mlxsw_core); +err_trap_register:destroy_workqueue (mlxsw_core->emad_wq);return err; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/138 ionic: use offset for ethtool regs data
In reply to Greg Kroah-HartmanFrom: Shannon Nelson <[email protected]>
[ Upstream commit f85ae16f924f92a370b81b4e77862c1c59882fce ]
Use an offset to write the second half of the regs data into the second half of the buffer instead of overwriting the first half.
--- drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +5 -2
@@ -102,15 +102,18 @@ static void ionic_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *p) {struct ionic_lif *lif =netdev_priv (netdev); +unsigned int offset;unsigned int size; regs->version =IONIC_DEV_CMD_REG_VERSION ; + offset =0 ; size =IONIC_DEV_INFO_REG_COUNT *sizeof (u32); -memcpy_fromio (p, lif->ionic->idev.dev_info_regs->words, size); +memcpy_fromio (p + offset, lif->ionic->idev.dev_info_regs->words, size); + offset += size; size =IONIC_DEV_CMD_REG_COUNT *sizeof (u32); -memcpy_fromio (p, lif->ionic->idev.dev_cmd_regs->words, size); +memcpy_fromio (p + offset, lif->ionic->idev.dev_cmd_regs->words, size); } static int ionic_get_link_ksettings(struct net_device *netdev,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/138 ionic: fix up filter locks and debug msgs
In reply to Greg Kroah-HartmanFrom: Shannon Nelson <[email protected]>
[ Upstream commit cbec2153a9a68d011454960ba84887e46e40b37d ]
Add in a couple of forgotten spinlocks and fix up some of the debug messages around filter management.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++++++---------- .../ethernet/pensando/ionic/ionic_rx_filter.c | 5 +++++ 2 files changed, 12 insertions(+), 10 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +7 -10
@@ -809,8 +809,7 @@ static int ionic_lif_addr_add(struct ionic_lif *lif, const u8 *addr)if (f)return 0 ; -netdev_dbg (lif->netdev,"rx_filter add ADDR %pM (id %d)\n" , addr, - ctx.comp.rx_filter_add.filter_id); +netdev_dbg (lif->netdev,"rx_filter add ADDR %pM\n" , addr);memcpy (ctx.cmd.rx_filter_add.mac.addr, addr,ETH_ALEN ); err =ionic_adminq_post_wait (lif, &ctx);
@@ -839,6 +838,9 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr)return -ENOENT ; } +netdev_dbg (lif->netdev,"rx_filter del ADDR %pM (id %d)\n" , + addr, f->filter_id); + ctx.cmd.rx_filter_del.filter_id =cpu_to_le32 (f->filter_id);ionic_rx_filter_free (lif, f);spin_unlock_bh (&lif->rx_filters.lock);
@@ -847,9 +849,6 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr)if (err)return err; -netdev_dbg (lif->netdev,"rx_filter del ADDR %pM (id %d)\n" , addr, - ctx.cmd.rx_filter_del.filter_id); -return 0 ; }
@@ -1291,13 +1290,11 @@ static int ionic_vlan_rx_add_vid(struct net_device *netdev, __be16 proto, };int err; +netdev_dbg (netdev,"rx_filter add VLAN %d\n" , vid); err =ionic_adminq_post_wait (lif, &ctx);if (err)return err; -netdev_dbg (netdev,"rx_filter add VLAN %d (id %d)\n" , vid, - ctx.comp.rx_filter_add.filter_id); -return ionic_rx_filter_save (lif,0 ,IONIC_RXQ_INDEX_ANY ,0 , &ctx); }
@@ -1322,8 +1319,8 @@ static int ionic_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto,return -ENOENT ; } -netdev_dbg (netdev,"rx_filter del VLAN %d (id %d)\n" , vid, -le32_to_cpu (ctx.cmd.rx_filter_del.filter_id)); +netdev_dbg (netdev,"rx_filter del VLAN %d (id %d)\n" , + vid, f->filter_id); ctx.cmd.rx_filter_del.filter_id =cpu_to_le32 (f->filter_id);ionic_rx_filter_free (lif, f);
drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c +5 -0
@@ -36,10 +36,12 @@ int ionic_rx_filters_init(struct ionic_lif *lif)spin_lock_init (&lif->rx_filters.lock); +spin_lock_bh (&lif->rx_filters.lock);for (i =0 ; i <IONIC_RX_FILTER_HLISTS ; i++) {INIT_HLIST_HEAD (&lif->rx_filters.by_hash[i]);INIT_HLIST_HEAD (&lif->rx_filters.by_id[i]); } +spin_unlock_bh (&lif->rx_filters.lock);return 0 ; }
@@ -51,11 +53,13 @@ void ionic_rx_filters_deinit(struct ionic_lif *lif)struct hlist_node *tmp;unsigned int i; +spin_lock_bh (&lif->rx_filters.lock);for (i =0 ; i <IONIC_RX_FILTER_HLISTS ; i++) { head = &lif->rx_filters.by_id[i];hlist_for_each_entry_safe (f, tmp, head, by_id)ionic_rx_filter_free (lif, f); } +spin_unlock_bh (&lif->rx_filters.lock); } int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index,
@@ -91,6 +95,7 @@ int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index, f->filter_id =le32_to_cpu (ctx->comp.rx_filter_add.filter_id); f->rxq_index = rxq_index;memcpy (&f->cmd, ac,sizeof (f->cmd)); +netdev_dbg (lif->netdev,"rx_filter add filter_id %d\n" , f->filter_id);INIT_HLIST_NODE (&f->by_hash);INIT_HLIST_NODE (&f->by_id);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/138 net: ag71xx: add missed clk_disable_unprepare in error path of probe
In reply to Greg Kroah-HartmanFrom: Huang Guobin <[email protected]>
[ Upstream commit befc113c56a76ae7be3986034a0e476d3385e265 ]
The ag71xx_mdio_probe() forgets to call clk_disable_unprepare() when of_reset_control_get_exclusive() failed. Add the missed call to fix it.
--- drivers/net/ethernet/atheros/ag71xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/atheros/ag71xx.c +2 -1
@@ -553,7 +553,8 @@ static int ag71xx_mdio_probe(struct ag71xx *ag) ag->mdio_reset =of_reset_control_get_exclusive (np,"mdio" );if (IS_ERR (ag->mdio_reset)) {netif_err (ag, probe, ndev,"Failed to get reset mdio.\n" ); -return PTR_ERR (ag->mdio_reset); + err =PTR_ERR (ag->mdio_reset); + goto mdio_err_put_clk; } mii_bus->name ="ag71xx_mdio" ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/138 net: hns3: fix error handling for desc filling
In reply to Greg Kroah-HartmanFrom: Yunsheng Lin <[email protected]>
[ Upstream commit 8ceca59fb3ed48a693171bd571c4fcbd555b7f1f ]
The content of the TX desc is automatically cleared by the HW when the HW has sent out the packet to the wire. When desc filling fails in hns3_nic_net_xmit(), it will call hns3_clear_desc() to do the error handling, which miss zeroing of the TX desc and the checking if a unmapping is needed.
So add the zeroing and checking in hns3_clear_desc() to avoid the above problem. Also add DESC_TYPE_UNKNOWN to indicate the info in desc_cb is not valid, because hns3_nic_reclaim_desc() may treat the desc_cb->type of zero as packet and add to the sent pkt statistics accordingly.
--- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++ 2 files changed, 9 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hnae3.h +1 -0
@@ -77,6 +77,7 @@ ((ring)->p = ((ring)->p - 1 + (ring)->desc_num) % (ring)->desc_num)enum hns_desc_type { +DESC_TYPE_UNKNOWN ,DESC_TYPE_SKB ,DESC_TYPE_PAGE , };
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +8 -0
@@ -1292,6 +1292,10 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)unsigned int i;for (i =0 ; i < ring->desc_num; i++) { +struct hns3_desc *desc = &ring->desc[ring->next_to_use]; + +memset (desc,0 ,sizeof (*desc)); +/* check if this is where we started */ if (ring->next_to_use == next_to_use_orig)break ;
@@ -1299,6 +1303,9 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)/* rollback one */ ring_ptr_move_bw (ring, next_to_use); +if (!ring->desc_cb[ring->next_to_use].dma) +continue ; +/* unmap the descriptor dma address */ if (ring->desc_cb[ring->next_to_use].type ==DESC_TYPE_SKB ) dma_unmap_single(dev,
@@ -1313,6 +1320,7 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig) ring->desc_cb[ring->next_to_use].length =0 ; ring->desc_cb[ring->next_to_use].dma =0 ; + ring->desc_cb[ring->next_to_use].type =DESC_TYPE_UNKNOWN ; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 55/138 net: dsa: microchip: call phy_remove_link_mode during probe
In reply to Greg Kroah-HartmanFrom: Helmut Grohne <[email protected]>
[ Upstream commit 3506b2f42dff66ea6814c3dfa1988bafb79e6f88 ]
When doing "ip link set dev ... up" for a ksz9477 backed link, ksz9477_phy_setup is called and it calls phy_remove_link_mode to remove 1000baseT HDX. During phy_remove_link_mode, phy_advertise_supported is called. Doing so reverts any previous change to advertised link modes e.g. using a udevd .link file.
phy_remove_link_mode is not meant to be used while opening a link and should be called during phy probe when the link is not yet available to userspace.
Therefore move the phy_remove_link_mode calls into ksz9477_switch_register. It indirectly calls dsa_register_switch, which creates the relevant struct phy_devices and we update the link modes right after that. At that time dev->features is already initialized by ksz9477_switch_detect.
Remove phy_setup from ksz_dev_ops as no users remain.
--- drivers/net/dsa/microchip/ksz9477.c | 42 ++++++++++++++------------ drivers/net/dsa/microchip/ksz_common.c | 2 -- drivers/net/dsa/microchip/ksz_common.h | 2 -- 3 files changed, 23 insertions(+), 23 deletions(-)
drivers/net/dsa/microchip/ksz9477.c +23 -19
@@ -976,23 +976,6 @@ static void ksz9477_port_mirror_del(struct dsa_switch *ds, int port, PORT_MIRROR_SNIFFER, false); } -static void ksz9477_phy_setup (struct ksz_device *dev,int port, -struct phy_device *phy) -{ -/* Only apply to port with PHY. */ -if (port >= dev->phy_port_cnt) -return ; - -/* The MAC actually cannot run in 1000 half-duplex mode. */ -phy_remove_link_mode (phy, - ETHTOOL_LINK_MODE_1000baseT_Half_BIT); - -/* PHY does not support gigabit. */ -if (!(dev->features &GBIT_SUPPORT )) -phy_remove_link_mode (phy, - ETHTOOL_LINK_MODE_1000baseT_Full_BIT); -} -static bool ksz9477_get_gbit (struct ksz_device *dev,u8 data) {bool gbit;
@@ -1605,7 +1588,6 @@ static const struct ksz_dev_ops ksz9477_dev_ops = { .get_port_addr = ksz9477_get_port_addr, .cfg_port_member = ksz9477_cfg_port_member, .flush_dyn_mac_table = ksz9477_flush_dyn_mac_table, - .phy_setup = ksz9477_phy_setup, .port_setup = ksz9477_port_setup, .r_mib_cnt = ksz9477_r_mib_cnt, .r_mib_pkt = ksz9477_r_mib_pkt,
@@ -1619,7 +1601,29 @@ static const struct ksz_dev_ops ksz9477_dev_ops = {int ksz9477_switch_register (struct ksz_device *dev) { -return ksz_switch_register (dev, &ksz9477_dev_ops); +int ret, i; +struct phy_device *phydev; + + ret =ksz_switch_register (dev, &ksz9477_dev_ops); +if (ret) +return ret; + +for (i =0 ; i < dev->phy_port_cnt; ++i) { +if (!dsa_is_user_port (dev->ds, i)) +continue ; + + phydev =dsa_to_port (dev->ds, i)->slave->phydev; + +/* The MAC actually cannot run in 1000 half-duplex mode. */ +phy_remove_link_mode (phydev, + ETHTOOL_LINK_MODE_1000baseT_Half_BIT); + +/* PHY does not support gigabit. */ +if (!(dev->features &GBIT_SUPPORT )) +phy_remove_link_mode (phydev, + ETHTOOL_LINK_MODE_1000baseT_Full_BIT); + } +return ret; }EXPORT_SYMBOL (ksz9477_switch_register);
drivers/net/dsa/microchip/ksz_common.c +0 -2
@@ -366,8 +366,6 @@ int ksz_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy)/* setup slave port */ dev->dev_ops->port_setup (dev, port, false); -if (dev->dev_ops->phy_setup) - dev->dev_ops->phy_setup (dev, port, phy);/* port_stp_state_set() will be called after to enable the port so * there is no need to do anything.
drivers/net/dsa/microchip/ksz_common.h +0 -2
@@ -120,8 +120,6 @@ struct ksz_dev_ops {u32 (*get_port_addr)(int port,int offset);void (*cfg_port_member)(struct ksz_device *dev,int port,u8 member);void (*flush_dyn_mac_table)(struct ksz_device *dev,int port); -void (*phy_setup)(struct ksz_device *dev,int port, -struct phy_device *phy);void (*port_cleanup)(struct ksz_device *dev,int port);void (*port_setup)(struct ksz_device *dev,int port,bool cpu_port);void (*r_phy)(struct ksz_device *dev,u16 phy,u16 reg,u16 *val);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/138 netdevsim: fix unbalaced locking in nsim_create()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 2c9d8e01f0c6017317eee7638496173d4a64e6bc ]
In the nsim_create(), rtnl_lock() is called before nsim_bpf_init(). If nsim_bpf_init() is failed, rtnl_unlock() should be called, but it isn't called.
So, unbalanced locking would occur.
--- drivers/net/netdevsim/netdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/netdevsim/netdev.c +2 -2
@@ -301,7 +301,7 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port)rtnl_lock (); err =nsim_bpf_init (ns);if (err) - goto err_free_netdev; + goto err_rtnl_unlock;nsim_ipsec_init (ns);
@@ -315,8 +315,8 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port) err_ipsec_teardown:nsim_ipsec_teardown (ns);nsim_bpf_uninit (ns); +err_rtnl_unlock:rtnl_unlock (); -err_free_netdev:free_netdev (dev);return ERR_PTR (err); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/138 qed: suppress "dont support RoCE & iWARP" flooding on HW init
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit 1ea999039fe7c7953da2fbb7ca7c3ef00064d328 ]
Change the verbosity of the "don't support RoCE & iWARP simultaneously" warning to debug level to stop flooding on driver/hardware initialization:
[ 4.783230] qede 01:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth0] [ 4.810020] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 4.861186] qede 01:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth1] [ 4.893311] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 5.181713] qede a1:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth2] [ 5.224740] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 5.276449] qede a1:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth3] [ 5.318671] [qed_rdma_set_pf_params:2076()]Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only [ 5.369548] qede a1:00.02: Storm FW 8.37.7.0, Management FW 8.52.9.0 [MBI 15.10.6] [eth4] [ 5.411645] [qed_rdma_set_pf_params:2076()]Current day drivers don't
support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only
--- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_cxt.c +2 -2
@@ -2073,8 +2073,8 @@ static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn, num_srqs =min_t (u32,QED_RDMA_MAX_SRQS , p_params->num_srqs);if (p_hwfn->mcp_info->func_info.protocol ==QED_PCI_ETH_RDMA ) { -DP_NOTICE (p_hwfn, -"Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n" ); +DP_VERBOSE (p_hwfn,QED_MSG_SP , +"Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n" ); p_hwfn->hw_info.personality =QED_PCI_ETH_ROCE ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/138 qed: suppress false-positives interrupt error messages on HW init
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit eb61c2d69903e977ffa2b80b1da9d1f758cf228d ]
It was found that qed_pglueb_rbc_attn_handler() can produce a lot of false-positive error detections on driver load/reload (especially after crashes/recoveries) and spam the kernel log:
[ 4.958275] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d00ff0 [ 2079.146764] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0 [ 2116.374631] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0 [ 2135.250564] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0
[...]
Reduce the logging level of two false-positive prone error messages from notice to verbose on initialization (only) to not mix it with real error attentions while debugging.
--- drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_int.c | 50 +++++++++++++---------- drivers/net/ethernet/qlogic/qed/qed_int.h | 4 +- 3 files changed, 32 insertions(+), 24 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_dev.c +1 -1
@@ -3092,7 +3092,7 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params) }/* Log and clear previous pglue_b errors if such exist */ -qed_pglueb_rbc_attn_handler (p_hwfn, p_hwfn->p_main_ptt); +qed_pglueb_rbc_attn_handler (p_hwfn, p_hwfn->p_main_ptt, true);/* Enable the PF's internal FID_enable in the PXP */ rc = qed_pglueb_set_pfid_enable(p_hwfn, p_hwfn->p_main_ptt,
drivers/net/ethernet/qlogic/qed/qed_int.c +29 -21
75 lines not on this page · raw message
drivers/net/ethernet/qlogic/qed/qed_int.h +2 -2
@@ -431,7 +431,7 @@ int qed_int_set_timer_res(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,#define QED_MAPPING_MEMORY_SIZE (dev) (NUM_OF_SBS(dev)) -int qed_pglueb_rbc_attn_handler (struct qed_hwfn *p_hwfn, -struct qed_ptt *p_ptt); +int qed_pglueb_rbc_attn_handler (struct qed_hwfn *p_hwfn,struct qed_ptt *p_ptt, +bool hw_init);#endif
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 59/138 ipvs: fix the connection sync failed in some cases
In reply to Greg Kroah-HartmanFrom: guodeqing <[email protected]>
[ Upstream commit 8210e344ccb798c672ab237b1a4f241bda08909b ]
The sync_thread_backup only checks sk_receive_queue is empty or not, there is a situation which cannot sync the connection entries when sk_receive_queue is empty and sk_rmem_alloc is larger than sk_rcvbuf, the sync packets are dropped in __udp_enqueue_schedule_skb, this is because the packets in reader_queue is not read, so the rmem is not reclaimed.
Here I add the check of whether the reader_queue of the udp sock is empty or not to solve this problem.
--- net/netfilter/ipvs/ip_vs_sync.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/netfilter/ipvs/ip_vs_sync.c +8 -4
@@ -1717,6 +1717,8 @@ static int sync_thread_backup(void *data) {struct ip_vs_sync_thread_data *tinfo = data;struct netns_ipvs *ipvs = tinfo->ipvs; +struct sock *sk = tinfo->sock->sk; +struct udp_sock *up =udp_sk (sk);int len; pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
@@ -1724,12 +1726,14 @@ static int sync_thread_backup(void *data) ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id);while (!kthread_should_stop ()) { -wait_event_interruptible (*sk_sleep (tinfo->sock->sk), - !skb_queue_empty (&tinfo->sock->sk->sk_receive_queue) - ||kthread_should_stop ()); +wait_event_interruptible (*sk_sleep (sk), + !skb_queue_empty_lockless (&sk->sk_receive_queue) || + !skb_queue_empty_lockless (&up->reader_queue) || +kthread_should_stop ());/* do we have data now? */ -while (!skb_queue_empty (&(tinfo->sock->sk->sk_receive_queue))) { +while (!skb_queue_empty_lockless (&sk->sk_receive_queue) || + !skb_queue_empty_lockless (&up->reader_queue)) { len =ip_vs_receive (tinfo->sock, tinfo->buf, ipvs->bcfg.sync_maxlen);if (len <=0 ) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 60/138 net: ethernet: ave: Fix error returns in ave_init
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 1264d7fa3a64d8bea7aebb77253f917947ffda25 ]
When regmap_update_bits failed in ave_init(), calls of the functions reset_control_assert() and clk_disable_unprepare() were missed. Add goto out_reset_assert to do this.
--- drivers/net/ethernet/socionext/sni_ave.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/socionext/sni_ave.c +1 -1
@@ -1191,7 +1191,7 @@ static int ave_init(struct net_device *ndev) ret =regmap_update_bits (priv->regmap,SG_ETPINMODE , priv->pinmode_mask, priv->pinmode_val);if (ret) -return ret; + goto out_reset_assert;ave_global_reset (ndev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 61/138 Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
[ Upstream commit d08c30d7a0d1826f771f16cde32bd86e48401791 ]
This reverts commit ec411e02b7a2e785a4ed9ed283207cd14f48699d.
Patrick reported that this commit broke hybrid graphics on a ThinkPad X1 Extreme 2nd with Intel UHD Graphics 630 and NVIDIA GeForce GTX 1650 Mobile:
nouveau 0000:01:00.0: fifo: PBDMA0: 01000000 [] ch 0 [00ff992000 DRM] subc 0 mthd 0008 data 00000000
Karol reported that this commit broke Nouveau firmware loading on a Lenovo P1G2 with Intel UHD Graphics 630 and NVIDIA TU117GLM [Quadro T1000 Mobile]:
nouveau 0000:01:00.0: acr: AHESASC binary failed
In both cases, reverting ec411e02b7a2 solved the problem. Unfortunately, this revert will reintroduce the "Thunderbolt bridges take long time to resume from D3cold" problem:
https://bugzilla.kernel.org/show_bug.cgi?id=206837
--- drivers/pci/pci.c | 30 +++++++++--------------------- 1 file changed, 9 insertions(+), 21 deletions(-)
drivers/pci/pci.c +9 -21
@@ -4610,8 +4610,7 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)* pcie_wait_for_link_delay - Wait until link is active or inactive * @pdev: Bridge device * @active: waiting for active or inactive? -* @delay: Delay to wait after link has become active (in ms). Specify %0 -* for no delay. +* @delay: Delay to wait after link has become active (in ms) * * Use this to wait till link becomes active or inactive. */
@@ -4652,7 +4651,7 @@ static bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active,msleep (10 ); timeout -=10 ; } -if (active && ret && delay) +if (active && ret)msleep (delay);else if (ret != active) pci_info(pdev, "Data Link Layer Link Active not %s in 1000 msec\n",
@@ -4773,28 +4772,17 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev)if (!pcie_downstream_port (dev))return ; -/* -* Per PCIe r5.0, sec 6.6.1, for downstream ports that support -* speeds > 5 GT/s, we must wait for link training to complete -* before the mandatory delay. -* -* We can only tell when link training completes via DLL Link -* Active, which is required for downstream ports that support -* speeds > 5 GT/s (sec 7.5.3.6). Unfortunately some common -* devices do not implement Link Active reporting even when it's -* required, so we'll check for that directly instead of checking -* the supported link speed. We assume devices without Link Active -* reporting can train in 100 ms regardless of speed. -*/ -if (dev->link_active_reporting) { -pci_dbg (dev,"waiting for link to train\n" ); -if (!pcie_wait_for_link_delay (dev, true,0 )) { +if (pcie_get_speed_cap (dev) <=PCIE_SPEED_5_0GT ) { +pci_dbg (dev,"waiting %d ms for downstream link\n" , delay); +msleep (delay); + }else { +pci_dbg (dev,"waiting %d ms for downstream link, after activation\n" , + delay); +if (!pcie_wait_for_link_delay (dev, true, delay)) {/* Did not train, no need to wait any further */ return ; } } -pci_dbg (child,"waiting %d ms to become accessible\n" , delay); -msleep (delay);if (!pci_device_is_present (child)) {pci_dbg (child,"waiting additional %d ms to become accessible\n" , delay);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 62/138 nfsd4: fix NULL dereference in nfsd/clients display code
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 9affa435817711861d774f5626c393c80f16d044 ]
We hold the cl_lock here, and that's enough to keep stateid's from going away, but it's not enough to prevent the files they point to from going away. Take fi_lock and a reference and check for NULL, as we do in other code.
--- fs/nfsd/nfs4state.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
fs/nfsd/nfs4state.c +19 -1
@@ -506,6 +506,17 @@ find_any_file(struct nfs4_file *f)return ret; } +static struct nfsd_file *find_deleg_file (struct nfs4_file *f) +{ +struct nfsd_file *ret =NULL ; + +spin_lock (&f->fi_lock); +if (f->fi_deleg_file) + ret =nfsd_file_get (f->fi_deleg_file); +spin_unlock (&f->fi_lock); +return ret; +} +static atomic_long_t num_delegations;unsigned long max_delegations;
@@ -2378,6 +2389,8 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st) oo = ols->st_stateowner; nf = st->sc_file; file =find_any_file (nf); +if (!file) +return 0 ;seq_printf (s,"- 0x%16phN: { type: open, " , &st->sc_stateid);
@@ -2411,6 +2424,8 @@ static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st) oo = ols->st_stateowner; nf = st->sc_file; file =find_any_file (nf); +if (!file) +return 0 ;seq_printf (s,"- 0x%16phN: { type: lock, " , &st->sc_stateid);
@@ -2439,7 +2454,9 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st) ds =delegstateid (st); nf = st->sc_file; - file = nf->fi_deleg_file; + file =find_deleg_file (nf); +if (!file) +return 0 ;seq_printf (s,"- 0x%16phN: { type: deleg, " , &st->sc_stateid);
@@ -2451,6 +2468,7 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)nfs4_show_superblock (s, file);seq_printf (s," }\n" ); +nfsd_file_put (file);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 63/138 enetc: Remove the mdio bus on PF probe bailout
In reply to Greg Kroah-HartmanFrom: Claudiu Manoil <[email protected]>
[ Upstream commit 26cb7085c8984e5b71d65c374a135134ed8cabb3 ]
For ENETC ports that register an external MDIO bus, the bus doesn't get removed on the error bailout path of enetc_pf_probe().
This issue became much more visible after recent:
commit 07095c025ac2 ("net: enetc: Use DT protocol information to set up the ports") Before this commit, one could make probing fail on the error
path only by having register_netdev() fail, which is unlikely.
But after this commit, because it moved the enetc_of_phy_get()
call up in the probing sequence, now we can trigger an mdiobus_free() bug just by forcing enetc_alloc_msix() to return error, i.e. with the 'pci=nomsi' kernel bootarg (since ENETC relies on MSI support to work), as the calltrace below shows:
kernel BUG at /home/eiz/work/enetc/net/drivers/net/phy/mdio_bus.c:648!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [...] Hardware name: LS1028A RDB Board (DT) pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--) pc : mdiobus_free+0x50/0x58 lr : devm_mdiobus_free+0x14/0x20 [...] Call trace: mdiobus_free+0x50/0x58 devm_mdiobus_free+0x14/0x20 release_nodes+0x138/0x228 devres_release_all+0x38/0x60 really_probe+0x1c8/0x368 driver_probe_device+0x5c/0xc0 device_driver_attach+0x74/0x80 __driver_attach+0x8c/0xd8 bus_for_each_dev+0x7c/0xd8 driver_attach+0x24/0x30 bus_add_driver+0x154/0x200 driver_register+0x64/0x120 __pci_register_driver+0x44/0x50 enetc_pf_driver_init+0x24/0x30 do_one_initcall+0x60/0x1c0 kernel_init_freeable+0x1fc/0x274 kernel_init+0x14/0x110 ret_from_fork+0x10/0x34
--- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/freescale/enetc/enetc_pf.c +1 -0
@@ -885,6 +885,7 @@ static int enetc_pf_probe(struct pci_dev *pdev,return 0 ; err_reg_netdev: +enetc_mdio_remove (pf);enetc_of_put_phy (priv);enetc_free_msix (priv); err_alloc_msix:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 64/138 i2c: rcar: always clear ICSAR to avoid side effects
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit eb01597158ffb1853a7a7fc2c57d4c844640f75e ]
On R-Car Gen2, we get a timeout when reading from the address set in ICSAR, even though the slave interface is disabled. Clearing it fixes this situation. Note that Gen3 is not affected.
To reproduce: bind and undbind an I2C slave on some bus, run 'i2cdetect' on that bus.
--- drivers/i2c/busses/i2c-rcar.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i2c/busses/i2c-rcar.c +3 -0
@@ -865,6 +865,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)/* disable irqs and ensure none is running before clearing ptr */ rcar_i2c_write (priv,ICSIER ,0 );rcar_i2c_write (priv,ICSCR ,0 ); +rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ synchronize_irq (priv->irq); priv->slave =NULL ;
@@ -971,6 +972,8 @@ static int rcar_i2c_probe(struct platform_device *pdev)if (ret <0 ) goto out_pm_put; +rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ +if (priv->devtype ==I2C_RCAR_GEN3 ) { priv->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (!IS_ERR (priv->rstc)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 65/138 i2c: i2c-qcom-geni: Fix DMA transfer race
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 02b9aec59243c6240fc42884acc958602146ddf6 ]
When I have KASAN enabled on my kernel and I start stressing the touchscreen my system tends to hang. The touchscreen is one of the only things that does a lot of big i2c transfers and ends up hitting the DMA paths in the geni i2c driver. It appears that KASAN adds enough delay in my system to tickle a race condition in the DMA setup code.
When the system hangs, I found that it was running the geni_i2c_irq() over and over again. It had these:
m_stat = 0x04000080rx_st = 0x30000011dm_tx_st = 0x00000000dm_rx_st = 0x00000000
dma = 0x00000001
Notably we're in DMA mode but are getting M_RX_IRQ_EN and M_RX_FIFO_WATERMARK_EN over and over again.
Putting some traces in geni_i2c_rx_one_msg() showed that when we failed we were getting to the start of geni_i2c_rx_one_msg() but were never executing geni_se_rx_dma_prep().
I believe that the problem here is that we are starting the geni command before we run geni_se_rx_dma_prep(). If a transfer makes it far enough before we do that then we get into the state I have observed. Let's change the order, which seems to work fine.
Although problems were seen on the RX path, code inspection suggests that the TX should be changed too. Change it as well.
--- drivers/i2c/busses/i2c-qcom-geni.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-qcom-geni.c +4 -2
@@ -368,7 +368,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,geni_se_select_mode (se,GENI_SE_FIFO );writel_relaxed (len, se->base +SE_I2C_RX_TRANS_LEN ); -geni_se_setup_m_cmd (se,I2C_READ , m_param);if (dma_buf &&geni_se_rx_dma_prep (se, dma_buf, len, &rx_dma)) {geni_se_select_mode (se,GENI_SE_FIFO );
@@ -376,6 +375,8 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, dma_buf =NULL ; } +geni_se_setup_m_cmd (se,I2C_READ , m_param); + time_left =wait_for_completion_timeout (&gi2c->done,XFER_TIMEOUT );if (!time_left)geni_i2c_abort_xfer (gi2c);
@@ -409,7 +410,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,geni_se_select_mode (se,GENI_SE_FIFO );writel_relaxed (len, se->base +SE_I2C_TX_TRANS_LEN ); -geni_se_setup_m_cmd (se,I2C_WRITE , m_param);if (dma_buf &&geni_se_tx_dma_prep (se, dma_buf, len, &tx_dma)) {geni_se_select_mode (se,GENI_SE_FIFO );
@@ -417,6 +417,8 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, dma_buf =NULL ; } +geni_se_setup_m_cmd (se,I2C_WRITE , m_param); +if (!dma_buf)/* Get FIFO IRQ */ writel_relaxed (1 , se->base +SE_GENI_TX_WATERMARK_REG );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 66/138 bonding: check return value of register_netdevice() in bond_newlink()
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ]
Very similar to commit 544f287b8495
("bonding: check error value of register_netdevice() immediately"), we should immediately check the return value of register_netdevice() before doing anything else.
--- drivers/net/bonding/bond_netlink.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/bonding/bond_netlink.c +1 -2
@@ -456,11 +456,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,return err; err =register_netdevice (bond_dev); - -netif_carrier_off (bond_dev);if (!err) {struct bonding *bond =netdev_priv (bond_dev); +netif_carrier_off (bond_dev);bond_work_init_all (bond); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 67/138 geneve: fix an uninitialized value in geneve_changelink()
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit 32818c075c54bb0cae44dd6f7ab00b01c52b8372 ]
geneve_nl2info() sets 'df' conditionally, so we have to initialize it by copying the value from existing geneve device in geneve_changelink().
--- drivers/net/geneve.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/geneve.c +1 -1
@@ -1615,11 +1615,11 @@ static int geneve_changelink(struct net_device *dev, struct nlattr *tb[], struct netlink_ext_ack *extack) {struct geneve_dev *geneve =netdev_priv (dev); +enum ifla_geneve_df df = geneve->df;struct geneve_sock *gs4, *gs6;struct ip_tunnel_info info;bool metadata;bool use_udp6_rx_checksums; -enum ifla_geneve_df df;bool ttl_inherit;int err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 68/138 serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
In reply to Greg Kroah-HartmanFrom: Matthew Howell <[email protected]>
[ Upstream commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9 ]
Sealevel XR17V35X based devices are inoperable on kernel versions 4.11 and above due to a change in the GPIO preconfiguration introduced in commit7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Sealevel cards to the value (0x00) used prior to commit 7dea8165f1d
With GPIOs preconfigured as per commit 7dea8165f1d all ports on Sealevel XR17V35X based devices become stuck in high impedance mode, regardless of dip-switch or software configuration. This causes the device to become effectively unusable. This patch (in various forms) has been distributed to our customers and no issues related to it have been reported.
--- drivers/tty/serial/8250/8250_exar.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_exar.c +11 -1
@@ -307,7 +307,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p)* devices will export them as GPIOs, so we pre-configure them safely * as inputs. */ -u8 dir = pcidev->vendor ==PCI_VENDOR_ID_EXAR ?0xff :0x00 ; + +u8 dir =0x00 ; + +if ((pcidev->vendor ==PCI_VENDOR_ID_EXAR ) && + (pcidev->subsystem_vendor !=PCI_VENDOR_ID_SEALEVEL )) { +// Configure GPIO as inputs for Commtech adapters + dir =0xff ; + }else { +// Configure GPIO as outputs for SeaLevel adapters + dir =0x00 ; + }writeb (0x00 , p +UART_EXAR_MPIOINT_7_0 );writeb (0x00 , p +UART_EXAR_MPIOLVL_7_0 );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 69/138 scripts/decode_stacktrace: strip basepath from all paths
In reply to Greg Kroah-HartmanFrom: Pi-Hsun Shih <[email protected]>
[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ]
Currently the basepath is removed only from the beginning of the string. When the symbol is inlined and there's multiple line outputs of addr2line, only the first line would have basepath removed.
Change to remove the basepath prefix from all lines.
--- scripts/decode_stacktrace.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/decode_stacktrace.sh +2 -2
@@ -84,8 +84,8 @@ parse_symbol() { return fi - # Strip out the base of the path - code=${code#$basepath/} + # Strip out the base of the path on each line + code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code") # In the case of inlines, move everything to same line code=${code//$'\n'/' '}
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 70/138 scripts/gdb: fix lx-symbols gdb.error while loading modules
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit 7359608a271ce81803de148befefd309baf88c76 ]
Commit ed66f991bb19 ("module: Refactor section attr into bin attribute") removed the 'name' field from 'struct module_sect_attr' triggering the following error when invoking lx-symbols:
(gdb) lx-symbols
loading vmlinux
scanning for modules in linux/build
loading @0xffffffffc014f000: linux/build/drivers/net/tun.ko Python Exception <class 'gdb.error'> There is no member named name.:
Error occurred in Python: There is no member named name.
This patch fixes the issue taking the module name from the 'struct attribute'.
--- scripts/gdb/linux/symbols.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/gdb/linux/symbols.py +1 -1
@@ -96,7 +96,7 @@ lx-symbols command.""" return "" attrs = sect_attrs['attrs'] section_name_to_address = { - attrs[n]['name'].string(): attrs[n]['address'] + attrs[n]['battr']['attr']['name'].string(): attrs[n]['address'] for n in range(int(sect_attrs['nsections']))} args = [] for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 71/138 HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
In reply to Greg Kroah-HartmanFrom: Federico Ricchiuto <[email protected]>
[ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ]
The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not supply descriptors, so it has to be added to the override list.
--- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +8 -0
@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { }, .driver_data = (void *)&sipodev_desc }, + { + .ident = "Mediacom FlexBook edge 13", + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"MEDIACOM" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"), + }, + .driver_data = (void *)&sipodev_desc + }, { .ident ="Odys Winbook 13" , .matches = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 72/138 HID: alps: support devices with report id 2
In reply to Greg Kroah-HartmanFrom: Caiyuan Xie <[email protected]>
[ Upstream commit aa3c439c144f0a465ed1f28f11c772886fb02b35 ]
Add support for devices which that have reports with id == 2
--- drivers/hid/hid-alps.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-alps.c +2 -0
@@ -25,6 +25,7 @@#define U1_MOUSE_REPORT_ID 0x01/* Mouse data ReportID */ #define U1_ABSOLUTE_REPORT_ID 0x03/* Absolute data ReportID */ +#define U1_ABSOLUTE_REPORT_ID_SECD 0x02/* FW-PTP Absolute data ReportID */ #define U1_FEATURE_REPORT_ID 0x05/* Feature ReportID */ #define U1_SP_ABSOLUTE_REPORT_ID 0x06/* Feature ReportID */
@@ -368,6 +369,7 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size)case U1_FEATURE_REPORT_ID :break ;case U1_ABSOLUTE_REPORT_ID : +case U1_ABSOLUTE_REPORT_ID_SECD :for (i =0 ; i < hdata->max_fingers; i++) {u8 *contact = &data[i *5 ];
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 73/138 HID: steam: fixes race in handling device list.
In reply to Greg Kroah-HartmanFrom: Rodrigo Rivas Costa <[email protected]>
[ Upstream commit 2d3f53a80e4eed078669853a178ed96d88f74143 ]
Using uhid and KASAN this driver crashed because it was getting several connection events where it only expected one. Then the device was added several times to the static device list and it got corrupted.
This patch checks if the device is already in the list before adding it.
--- drivers/hid/hid-steam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/hid/hid-steam.c +4 -2
@@ -526,7 +526,8 @@ static int steam_register(struct steam_device *steam)steam_battery_register (steam);mutex_lock (&steam_devices_lock); -list_add (&steam->list, &steam_devices); +if (list_empty (&steam->list)) +list_add (&steam->list, &steam_devices);mutex_unlock (&steam_devices_lock); }
@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam)hid_info (steam->hdev,"Steam Controller '%s' disconnected" , steam->serial_no);mutex_lock (&steam_devices_lock); -list_del (&steam->list); +list_del_init (&steam->list);mutex_unlock (&steam_devices_lock); steam->serial_no[0 ] =0 ; }
@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev,mutex_init (&steam->mutex); steam->quirks = id->driver_data;INIT_WORK (&steam->work_connect, steam_work_connect_cb); +INIT_LIST_HEAD (&steam->list); steam->client_hdev =steam_create_client_hid (hdev);if (IS_ERR (steam->client_hdev)) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 74/138 HID: apple: Disable Fn-key key-re-mapping on clone keyboards
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ]
The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239) of the Apple Wireless Keyboard (2009 ANSI version) <sigh>.
But its F1 - F10 keys are marked as sending F1 - F10, not the special functions hid-apple.c maps them too; and since its descriptors do not contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped to key-codes which have not been set in the keybit array causing them to not send any events at all.
The lack of a usage code matching the Fn key in the clone is actually useful as this allows solving this problem in a generic way.
This commits adds a fn_found flag and it adds a input_configured callback which checks if this flag is set once all usages have been mapped. If it is not set, then assume this is a clone and clear the quirks bitmap so that the hid-apple code does not add any special handling to this keyboard.
This fixes F1 - F6 not sending anything at all and F7 - F12 sending the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on similar clones.
--- drivers/hid/hid-apple.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/hid/hid-apple.c +18 -0
@@ -54,6 +54,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")struct apple_sc {unsigned long quirks;unsigned int fn_on; +unsigned int fn_found; DECLARE_BITMAP(pressed_numlock, KEY_CNT); };
@@ -339,12 +340,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, struct hid_field *field, struct hid_usage *usage, unsigned long **bit, int *max) { + struct apple_sc *asc = hid_get_drvdata(hdev); +if (usage->hid == (HID_UP_CUSTOM |0x0003 ) || usage->hid == (HID_UP_MSVENDOR |0x0003 ) || usage->hid == (HID_UP_HPVENDOR2 |0x0003 )) {/* The fn key on Apple USB keyboards */ set_bit (EV_REP , hi->input->evbit);hid_map_usage_clear (hi, usage, bit, max,EV_KEY ,KEY_FN ); + asc->fn_found = true;apple_setup_input (hi->input);return 1 ; }
@@ -371,6 +375,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi,return 0 ; } +static int apple_input_configured (struct hid_device *hdev, +struct hid_input *hidinput) +{ +struct apple_sc *asc =hid_get_drvdata (hdev); + +if ((asc->quirks &APPLE_HAS_FN ) && !asc->fn_found) { +hid_info (hdev,"Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n" ); + asc->quirks =0 ; + } + +return 0 ; +} +static int apple_probe (struct hid_device *hdev,const struct hid_device_id *id) {
@@ -585,6 +602,7 @@ static struct hid_driver apple_driver = { .event = apple_event, .input_mapping = apple_input_mapping, .input_mapped = apple_input_mapped, + .input_configured = apple_input_configured, };module_hid_driver (apple_driver);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 75/138 dmaengine: tegra210-adma: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced.
--- drivers/dma/tegra210-adma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/dma/tegra210-adma.c +4 -1
@@ -658,6 +658,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc) ret =pm_runtime_get_sync (tdc2dev (tdc));if (ret <0 ) { +pm_runtime_put_noidle (tdc2dev (tdc));free_irq (tdc->irq, tdc);return ret; }
@@ -869,8 +870,10 @@ static int tegra_adma_probe(struct platform_device *pdev)pm_runtime_enable (&pdev->dev); ret =pm_runtime_get_sync (&pdev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (&pdev->dev); goto rpm_disable; + } ret =tegra_adma_init (tdma);if (ret)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 76/138 Input: add `SW_MACHINE_COVER`
In reply to Greg Kroah-HartmanFrom: Merlijn Wajer <[email protected]>
[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ]
This event code represents the state of a removable cover of a device. Value 0 means that the cover is open or removed, value 1 means that the cover is closed.
--- include/linux/mod_devicetable.h | 2 +- include/uapi/linux/input-event-codes.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
include/linux/mod_devicetable.h +1 -1
@@ -318,7 +318,7 @@ struct pcmcia_device_id {#define INPUT_DEVICE_ID_LED_MAX 0x0f#define INPUT_DEVICE_ID_SND_MAX 0x07#define INPUT_DEVICE_ID_FF_MAX 0x7f -#define INPUT_DEVICE_ID_SW_MAX 0x0f +#define INPUT_DEVICE_ID_SW_MAX 0x10#define INPUT_DEVICE_ID_PROP_MAX 0x1f#define INPUT_DEVICE_ID_MATCH_BUS 1
include/uapi/linux/input-event-codes.h +2 -1
@@ -808,7 +808,8 @@#define SW_LINEIN_INSERT 0x0d/* set = inserted */ #define SW_MUTE_DEVICE 0x0e/* set = device disabled */ #define SW_PEN_INSERTED 0x0f/* set = pen inserted */ -#define SW_MAX 0x0f +#define SW_MACHINE_COVER 0x10/* set = cover closed */ +#define SW_MAX 0x10#define SW_CNT (SW_MAX+1)/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 77/138 ARM: dts: n900: remove mmc1 card detect gpio
In reply to Greg Kroah-HartmanFrom: Merlijn Wajer <[email protected]>
[ Upstream commit ed3e98e919aaaa47e9d9f8a40c3f6f4a22577842 ]
Instead, expose the key via the input framework, as SW_MACHINE_COVER
The chip-detect GPIO is actually detecting if the cover is closed. Technically it's possible to use the SD card with open cover. The only downside is risk of battery falling out and user being able to physically remove the card.
The behaviour of SD card not being available when the device is open is unexpected and creates more problems than it solves. There is a high chance, that more people accidentally break their rootfs by opening the case without physically removing the card.
--- arch/arm/boot/dts/omap3-n900.dts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/arm/boot/dts/omap3-n900.dts +8 -4
@@ -105,6 +105,14 @@ linux,code = <SW_FRONT_PROXIMITY>; linux,can-disable; }; + + machine_cover { + label = "Machine Cover"; + gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */ + linux,input-type = <EV_SW>; + linux,code = <SW_MACHINE_COVER>; + linux,can-disable; + }; }; isp1707: isp1707 {
@@ -814,10 +822,6 @@ pinctrl-0 = <&mmc1_pins>; vmmc-supply = <&vmmc1>; bus-width = <4>; - /* For debugging, it is often good idea to remove this GPIO. - It means you can remove back cover (to reboot by removing - battery) and still use the MMC card. */ - cd-gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */ }; /* most boards use vaux3, only some old versions use vmmc2 instead */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 78/138 spi: mediatek: use correct SPI_CFG2_REG MACRO
In reply to Greg Kroah-HartmanFrom: leilk.liu <[email protected]>
[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ]
this patch use correct SPI_CFG2_REG offset.
--- drivers/spi/spi-mt65xx.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/spi/spi-mt65xx.c +8 -7
@@ -36,7 +36,6 @@#define SPI_CFG0_SCK_LOW_OFFSET 8#define SPI_CFG0_CS_HOLD_OFFSET 16#define SPI_CFG0_CS_SETUP_OFFSET 24 -#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET 16#define SPI_ADJUST_CFG0_CS_HOLD_OFFSET 0#define SPI_ADJUST_CFG0_CS_SETUP_OFFSET 16
@@ -48,6 +47,8 @@#define SPI_CFG1_CS_IDLE_MASK 0xff#define SPI_CFG1_PACKET_LOOP_MASK 0xff00#define SPI_CFG1_PACKET_LENGTH_MASK 0x3ff0000 +#define SPI_CFG2_SCK_HIGH_OFFSET 0 +#define SPI_CFG2_SCK_LOW_OFFSET 16#define SPI_CMD_ACT BIT(0)#define SPI_CMD_RESUME BIT(1)
@@ -279,7 +280,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable)static void mtk_spi_prepare_transfer (struct spi_master *master,struct spi_transfer *xfer) { -u32 spi_clk_hz, div, sck_time, cs_time, reg_val =0 ; +u32 spi_clk_hz, div, sck_time, cs_time, reg_val;struct mtk_spi *mdata =spi_master_get_devdata (master); spi_clk_hz =clk_get_rate (mdata->spi_clk);
@@ -292,18 +293,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master, cs_time = sck_time *2 ;if (mdata->dev_comp->enhance_timing) { + reg_val = (((sck_time -1 ) &0xffff ) + <<SPI_CFG2_SCK_HIGH_OFFSET ); reg_val |= (((sck_time -1 ) &0xffff ) - <<SPI_CFG0_SCK_HIGH_OFFSET ); - reg_val |= (((sck_time -1 ) &0xffff ) - <<SPI_ADJUST_CFG0_SCK_LOW_OFFSET ); + <<SPI_CFG2_SCK_LOW_OFFSET );writel (reg_val, mdata->base +SPI_CFG2_REG ); - reg_val |= (((cs_time -1 ) &0xffff ) + reg_val = (((cs_time -1 ) &0xffff ) <<SPI_ADJUST_CFG0_CS_HOLD_OFFSET ); reg_val |= (((cs_time -1 ) &0xffff ) <<SPI_ADJUST_CFG0_CS_SETUP_OFFSET );writel (reg_val, mdata->base +SPI_CFG0_REG ); }else { - reg_val |= (((sck_time -1 ) &0xff ) + reg_val = (((sck_time -1 ) &0xff ) <<SPI_CFG0_SCK_HIGH_OFFSET ); reg_val |= (((sck_time -1 ) &0xff ) <<SPI_CFG0_SCK_LOW_OFFSET ); reg_val |= (((cs_time -1 ) &0xff ) <<SPI_CFG0_CS_HOLD_OFFSET );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 79/138 regmap: dev_get_regmap_match(): fix string comparison
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ]
This function is used by dev_get_regmap() to retrieve a regmap for the specified device. If the device has more than one regmap, the name parameter can be used to specify one.
The code here uses a pointer comparison to check for equal strings. This however will probably always fail, as the regmap->name is allocated via kstrdup_const() from the regmap's config->name.
Fix this by using strcmp() instead.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -1363,7 +1363,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)/* If the user didn't specify a name match any */ if (data) -return (*r)->name == data; +return !strcmp ((*r)->name, data);else return 1 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 80/138 hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit bc4071aafcf4d0535ee423b69167696d6c03207d ]
aspeed_create_fan() reads a pwm_port value using of_property_read_u32(). If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be a buffer overflow in aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes the potential buffer overflow.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/aspeed-pwm-tacho.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hwmon/aspeed-pwm-tacho.c +2 -0
@@ -851,6 +851,8 @@ static int aspeed_create_fan(struct device *dev, ret =of_property_read_u32 (child,"reg" , &pwm_port);if (ret)return ret; +if (pwm_port >=ARRAY_SIZE (pwm_port_params)) +return -EINVAL ;aspeed_create_pwm_port (priv, (u8 )pwm_port); ret =of_property_count_u8_elems (child,"cooling-levels" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 81/138 dmaengine: fsl-edma: fix wrong tcd endianness for big-endian cpu
In reply to Greg Kroah-HartmanFrom: Angelo Dureghello <[email protected]>
[ Upstream commit 8678c71c17721e0f771f135967ef0cce8f69ce9a ]
Due to recent fixes in m68k arch-specific I/O accessor macros, this driver is not working anymore for ColdFire. Fix wrong tcd endianness removing additional swaps, since edma_writex() functions should already take care of any eventual swap if needed.
Note, i could only test the change in ColdFire mcf54415 and Vybrid vf50 / Colibri where i don't see any issue. So, every feedback and test for all other SoCs involved is really appreciated.
--- drivers/dma/fsl-edma-common.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/dma/fsl-edma-common.c +14 -12
@@ -347,26 +347,28 @@ static void fsl_edma_set_tcd_regs(struct fsl_edma_chan *fsl_chan,/* * TCD parameters are stored in struct fsl_edma_hw_tcd in little * endian format. However, we need to load the TCD registers in -* big- or little-endian obeying the eDMA engine model endian. +* big- or little-endian obeying the eDMA engine model endian, +* and this is performed from specific edma_write functions */ edma_writew (edma,0 , ®s->tcd[ch].csr); -edma_writel (edma,le32_to_cpu (tcd->saddr), ®s->tcd[ch].saddr); -edma_writel (edma,le32_to_cpu (tcd->daddr), ®s->tcd[ch].daddr); -edma_writew (edma,le16_to_cpu (tcd->attr), ®s->tcd[ch].attr); -edma_writew (edma,le16_to_cpu (tcd->soff), ®s->tcd[ch].soff); +edma_writel (edma, (s32 )tcd->saddr, ®s->tcd[ch].saddr); +edma_writel (edma, (s32 )tcd->daddr, ®s->tcd[ch].daddr); -edma_writel (edma,le32_to_cpu (tcd->nbytes), ®s->tcd[ch].nbytes); -edma_writel (edma,le32_to_cpu (tcd->slast), ®s->tcd[ch].slast); +edma_writew (edma, (s16 )tcd->attr, ®s->tcd[ch].attr); +edma_writew (edma, tcd->soff, ®s->tcd[ch].soff); -edma_writew (edma,le16_to_cpu (tcd->citer), ®s->tcd[ch].citer); -edma_writew (edma,le16_to_cpu (tcd->biter), ®s->tcd[ch].biter); -edma_writew (edma,le16_to_cpu (tcd->doff), ®s->tcd[ch].doff); +edma_writel (edma, (s32 )tcd->nbytes, ®s->tcd[ch].nbytes); +edma_writel (edma, (s32 )tcd->slast, ®s->tcd[ch].slast); -edma_writel (edma,le32_to_cpu (tcd->dlast_sga), +edma_writew (edma, (s16 )tcd->citer, ®s->tcd[ch].citer); +edma_writew (edma, (s16 )tcd->biter, ®s->tcd[ch].biter); +edma_writew (edma, (s16 )tcd->doff, ®s->tcd[ch].doff); + +edma_writel (edma, (s32 )tcd->dlast_sga, ®s->tcd[ch].dlast_sga); -edma_writew (edma,le16_to_cpu (tcd->csr), ®s->tcd[ch].csr); +edma_writew (edma, (s16 )tcd->csr, ®s->tcd[ch].csr); } static inline
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 82/138 dmaengine: ioat setting ioat timeout as module parameter
In reply to Greg Kroah-HartmanFrom: Leonid Ravich <[email protected]>
[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ]
DMA transaction time to completion is a function of PCI bandwidth, transaction size and a queue depth. So hard coded value for timeouts might be wrong for some scenarios.
--- drivers/dma/ioat/dma.c | 12 ++++++++++++ drivers/dma/ioat/dma.h | 2 -- 2 files changed, 12 insertions(+), 2 deletions(-)
drivers/dma/ioat/dma.c +12 -0
@@ -26,6 +26,18 @@#include "../dmaengine.h" +int completion_timeout =200 ; +module_param (completion_timeout, int,0644 ); +MODULE_PARM_DESC (completion_timeout, +"set ioat completion timeout [msec] (default 200 [msec])" ); +int idle_timeout =2000 ; +module_param (idle_timeout, int,0644 ); +MODULE_PARM_DESC (idle_timeout, +"set ioat idel timeout [msec] (default 2000 [msec])" ); + +#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout) +#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout) +static char *chanerr_str[] = {"DMA Transfer Source Address Error" ,"DMA Transfer Destination Address Error" ,
drivers/dma/ioat/dma.h +0 -2
@@ -99,8 +99,6 @@ struct ioatdma_chan {#define IOAT_RUN 5#define IOAT_CHAN_ACTIVE 6struct timer_list timer; -#define COMPLETION_TIMEOUT msecs_to_jiffies(100) -#define IDLE_TIMEOUT msecs_to_jiffies(2000)#define RESET_DELAY msecs_to_jiffies(100)struct ioatdma_device *ioat_dma;dma_addr_t completion_dma;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 83/138 Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
In reply to Greg Kroah-HartmanFrom: Ilya Katsnelson <[email protected]>
[ Upstream commit dcb00fc799dc03fd320e123e4c81b3278c763ea5 ]
Tested on my own laptop, touchpad feels slightly more responsive with this on, though it might just be placebo.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {"LEN0093" ,/* T480 */ "LEN0096" ,/* X280 */ "LEN0097" ,/* X280 -> ALPS trackpoint */ +"LEN0099" ,/* X1 Extreme 1st */ "LEN009b" ,/* T580 */ "LEN200f" ,/* T450s */ "LEN2044", /* L470 */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 84/138 Input: elan_i2c - only increment wakeup count on touch
In reply to Greg Kroah-HartmanFrom: Derek Basehore <[email protected]>
[ Upstream commit 966334dfc472bdfa67bed864842943b19755d192 ]
This moves the wakeup increment for elan devices to the touch report. This prevents the drivers from incorrectly reporting a wakeup when the resume callback resets then device, which causes an interrupt to occur.
--- drivers/input/mouse/elan_i2c_core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/input/mouse/elan_i2c_core.c +5 -4
@@ -951,6 +951,8 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet)u8 hover_info = packet[ETP_HOVER_INFO_OFFSET ];bool contact_valid, hover_event; +pm_wakeup_event (&data->client->dev,0 ); + hover_event = hover_info &0x40 ;for (i =0 ; i <ETP_MAX_FINGERS ; i++) { contact_valid = tp_info & (1U << (3 + i));
@@ -974,6 +976,8 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)u8 *packet = &report[ETP_REPORT_ID_OFFSET +1 ];int x, y; +pm_wakeup_event (&data->client->dev,0 ); +if (!data->tp_input) {dev_warn_once (&data->client->dev,"received a trackpoint report while no trackpoint device has been created. Please report upstream.\n" );
@@ -998,7 +1002,6 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)static irqreturn_t elan_isr (int irq,void *dev_id) {struct elan_tp_data *data = dev_id; -struct device *dev = &data->client->dev;int error;u8 report[ETP_MAX_REPORT_LEN ];
@@ -1016,8 +1019,6 @@ static irqreturn_t elan_isr(int irq, void *dev_id)if (error) goto out; -pm_wakeup_event (dev,0 ); -switch (report[ETP_REPORT_ID_OFFSET ]) {case ETP_REPORT_ID :elan_report_absolute (data, report);
@@ -1026,7 +1027,7 @@ static irqreturn_t elan_isr(int irq, void *dev_id)elan_report_trackpoint (data, report);break ;default : -dev_err (dev,"invalid report id data (%x)\n" , +dev_err (&data->client->dev,"invalid report id data (%x)\n" , report[ETP_REPORT_ID_OFFSET ]); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 85/138 usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
[ Upstream commit c3f595a8119207cc0f82b3dc6ec5bbf6f3e6b135 ]
This patch adds the necessary PCI ID for TGP-H devices.
--- drivers/usb/dwc3/dwc3-pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/dwc3-pci.c +4 -0
@@ -38,6 +38,7 @@#define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee#define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee +#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee#define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"#define PCI_INTEL_BXT_FUNC_PMU_PWR 4
@@ -358,6 +359,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { {PCI_VDEVICE (INTEL ,PCI_DEVICE_ID_INTEL_TGPLP ), (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), (kernel_ulong_t) &dwc3_pci_amd_properties, }, { } /* Terminating Entry */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 86/138 usb: dwc3: pci: add support for the Intel Jasper Lake
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
[ Upstream commit e25d1e8532c3d84f075deca1580a7d61e0f43ce6 ]
This patch adds the necessary PCI ID for Intel Jasper Lake devices.
--- drivers/usb/dwc3/dwc3-pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/dwc3-pci.c +4 -0
@@ -39,6 +39,7 @@#define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee +#define PCI_DEVICE_ID_INTEL_JSP 0x4dee#define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"#define PCI_INTEL_BXT_FUNC_PMU_PWR 4
@@ -362,6 +363,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { {PCI_VDEVICE (INTEL ,PCI_DEVICE_ID_INTEL_TGPH ), (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), (kernel_ulong_t) &dwc3_pci_amd_properties, }, { } /* Terminating Entry */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 87/138 usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ]
gr_ep_init() does not assign the allocated request anywhere if allocation of memory for the buffer fails. This is a memory leak fixed by the given patch.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/gadget/udc/gr_udc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/gr_udc.c +5 -2
@@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)if (num ==0 ) { _req =gr_alloc_request (&ep->ep,GFP_ATOMIC ); +if (!_req) +return -ENOMEM ; + buf =devm_kzalloc (dev->dev,PAGE_SIZE ,GFP_DMA |GFP_ATOMIC ); -if (!_req || !buf) { -/* possible _req freed by gr_probe via gr_remove */ +if (!buf) { +gr_free_request (&ep->ep, _req);return -ENOMEM ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 88/138 usb: cdns3: ep0: fix some endian issues
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
[ Upstream commit 9f81d45c79271def8a9b90447b04b9c6323291f9 ]
It is found by sparse.
--- drivers/usb/cdns3/ep0.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/usb/cdns3/ep0.c +15 -15
@@ -37,18 +37,18 @@ static void cdns3_ep0_run_transfer(struct cdns3_device *priv_dev,struct cdns3_usb_regs __iomem *regs = priv_dev->regs;struct cdns3_endpoint *priv_ep = priv_dev->eps[0 ]; - priv_ep->trb_pool[0 ].buffer =TRB_BUFFER (dma_addr); - priv_ep->trb_pool[0 ].length =TRB_LEN (length); + priv_ep->trb_pool[0 ].buffer =cpu_to_le32 (TRB_BUFFER (dma_addr)); + priv_ep->trb_pool[0 ].length =cpu_to_le32 (TRB_LEN (length));if (zlp) { - priv_ep->trb_pool[0 ].control =TRB_CYCLE |TRB_TYPE (TRB_NORMAL ); - priv_ep->trb_pool[1 ].buffer =TRB_BUFFER (dma_addr); - priv_ep->trb_pool[1 ].length =TRB_LEN (0 ); - priv_ep->trb_pool[1 ].control =TRB_CYCLE |TRB_IOC | -TRB_TYPE (TRB_NORMAL ); + priv_ep->trb_pool[0 ].control =cpu_to_le32 (TRB_CYCLE |TRB_TYPE (TRB_NORMAL )); + priv_ep->trb_pool[1 ].buffer =cpu_to_le32 (TRB_BUFFER (dma_addr)); + priv_ep->trb_pool[1 ].length =cpu_to_le32 (TRB_LEN (0 )); + priv_ep->trb_pool[1 ].control =cpu_to_le32 (TRB_CYCLE |TRB_IOC | +TRB_TYPE (TRB_NORMAL )); }else { - priv_ep->trb_pool[0 ].control =TRB_CYCLE |TRB_IOC | -TRB_TYPE (TRB_NORMAL ); + priv_ep->trb_pool[0 ].control =cpu_to_le32 (TRB_CYCLE |TRB_IOC | +TRB_TYPE (TRB_NORMAL )); priv_ep->trb_pool[1 ].control =0 ; }
@@ -264,11 +264,11 @@ static int cdns3_req_ep0_get_status(struct cdns3_device *priv_dev,case USB_RECIP_INTERFACE :return cdns3_ep0_delegate_req (priv_dev, ctrl);case USB_RECIP_ENDPOINT : - index =cdns3_ep_addr_to_index (ctrl->wIndex); + index =cdns3_ep_addr_to_index (le16_to_cpu (ctrl->wIndex)); priv_ep = priv_dev->eps[index];/* check if endpoint is stalled or stall is pending */ -cdns3_select_ep (priv_dev, ctrl->wIndex); +cdns3_select_ep (priv_dev,le16_to_cpu (ctrl->wIndex));if (EP_STS_STALL (readl (&priv_dev->regs->ep_sts)) || (priv_ep->flags &EP_STALL_PENDING )) usb_status =BIT (USB_ENDPOINT_HALT );
@@ -388,10 +388,10 @@ static int cdns3_ep0_feature_handle_endpoint(struct cdns3_device *priv_dev,if (!(ctrl->wIndex & ~USB_DIR_IN ))return 0 ; - index =cdns3_ep_addr_to_index (ctrl->wIndex); + index =cdns3_ep_addr_to_index (le16_to_cpu (ctrl->wIndex)); priv_ep = priv_dev->eps[index]; -cdns3_select_ep (priv_dev, ctrl->wIndex); +cdns3_select_ep (priv_dev,le16_to_cpu (ctrl->wIndex));if (set)__cdns3_gadget_ep_set_halt (priv_ep);
@@ -452,7 +452,7 @@ static int cdns3_req_ep0_set_sel(struct cdns3_device *priv_dev,if (priv_dev->gadget.state <USB_STATE_ADDRESS )return -EINVAL ; -if (ctrl_req->wLength !=6 ) { +if (le16_to_cpu (ctrl_req->wLength) !=6 ) {dev_err (priv_dev->dev,"Set SEL should be 6 bytes, got %d\n" , ctrl_req->wLength);return -EINVAL ;
@@ -476,7 +476,7 @@ static int cdns3_req_ep0_set_isoch_delay(struct cdns3_device *priv_dev,if (ctrl_req->wIndex || ctrl_req->wLength)return -EINVAL ; - priv_dev->isoch_delay = ctrl_req->wValue; + priv_dev->isoch_delay =le16_to_cpu (ctrl_req->wValue);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 89/138 usb: cdns3: trace: fix some endian issues
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
[ Upstream commit 65b7cf48c211ece5e2560a334eb9608e48775a8f ]
It is found by sparse.
--- drivers/usb/cdns3/trace.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/cdns3/trace.h +3 -3
@@ -333,9 +333,9 @@ DECLARE_EVENT_CLASS(cdns3_log_trb,TP_fast_assign ( __assign_str(name, priv_ep->name); __entry->trb = trb; - __entry->buffer = trb->buffer; - __entry->length = trb->length; - __entry->control = trb->control; + __entry->buffer =le32_to_cpu (trb->buffer); + __entry->length =le32_to_cpu (trb->length); + __entry->control =le32_to_cpu (trb->control); __entry->type =usb_endpoint_type (priv_ep->endpoint.desc); ), TP_printk("%s: trb %p, dma buf: 0x%08x, size: %ld, burst: %d ctrl: 0x%08x (%s%s%s%s%s%s%s)",
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 90/138 hwmon: (adm1275) Make sure we are reading enough data for different chips
In reply to Greg Kroah-HartmanFrom: Chu Lin <[email protected]>
[ Upstream commit 6d1d41c075a1a54ba03370e268171fec20e06563 ]
Issue:
When PEC is enabled, binding adm1272 to the adm1275 would fail due to PEC error. See below:
adm1275: probe of xxxx failed with error -74
Diagnosis:
Per the datasheet of adm1272, adm1278, adm1293 and amd1294, PMON_CONFIG (0xd4) is 16bits wide. On the other hand, PMON_CONFIG (0xd4) for adm1275 is 8bits wide. The driver should not assume everything is 8bits wide and read only 8bits from it.
Solution:
If it is adm1272, adm1278, adm1293 and adm1294, use i2c_read_word. Else, use i2c_read_byte
Testing:
Binding adm1272 to the driver.
The change is only tested on adm1272.
--- drivers/hwmon/pmbus/adm1275.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/hwmon/pmbus/adm1275.c +8 -2
@@ -454,6 +454,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id);static int adm1275_probe (struct i2c_client *client,const struct i2c_device_id *id) { +s32 (*config_read_fn)(const struct i2c_client *client,u8 reg);u8 block_buffer[I2C_SMBUS_BLOCK_MAX +1 ];int config, device_config;int ret;
@@ -499,11 +500,16 @@ static int adm1275_probe(struct i2c_client *client,"Device mismatch: Configured %s, detected %s\n" , id->name, mid->name); - config =i2c_smbus_read_byte_data (client,ADM1275_PMON_CONFIG ); +if (mid->driver_data == adm1272 || mid->driver_data == adm1278 || + mid->driver_data == adm1293 || mid->driver_data == adm1294) + config_read_fn = i2c_smbus_read_word_data; +else + config_read_fn = i2c_smbus_read_byte_data; + config =config_read_fn (client,ADM1275_PMON_CONFIG );if (config <0 )return config; - device_config =i2c_smbus_read_byte_data (client,ADM1275_DEVICE_CONFIG ); + device_config =config_read_fn (client,ADM1275_DEVICE_CONFIG );if (device_config <0 )return device_config;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 91/138 drm/amdgpu/gfx10: fix race condition for kiq
In reply to Greg Kroah-HartmanFrom: Jack Xiao <[email protected]>
[ Upstream commit 7d65a577bb58d4f27a3398a4c0cb0b00ab7d0511 ]
During preemption test for gfx10, it uses kiq to trigger gfx preemption, which would result in race condition with flushing TLB for kiq.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +8 -1
@@ -4683,12 +4683,17 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring)struct amdgpu_device *adev = ring->adev;struct amdgpu_kiq *kiq = &adev->gfx.kiq;struct amdgpu_ring *kiq_ring = &kiq->ring; +unsigned long flags;if (!kiq->pmf || !kiq->pmf->kiq_unmap_queues)return -EINVAL ; -if (amdgpu_ring_alloc (kiq_ring, kiq->pmf->unmap_queues_size)) +spin_lock_irqsave (&kiq->ring_lock, flags); + +if (amdgpu_ring_alloc (kiq_ring, kiq->pmf->unmap_queues_size)) { +spin_unlock_irqrestore (&kiq->ring_lock, flags);return -ENOMEM ; + }/* assert preemption condition */ amdgpu_ring_set_preempt_cond_exec (ring, false);
@@ -4699,6 +4704,8 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring) ++ring->trail_seq);amdgpu_ring_commit (kiq_ring); +spin_unlock_irqrestore (&kiq->ring_lock, flags); +/* poll the trailing fence */ for (i =0 ; i < adev->usec_timeout; i++) { if (ring->trail_seq ==
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 92/138 drm/amdgpu: fix preemption unit test
In reply to Greg Kroah-HartmanFrom: Jack Xiao <[email protected]>
[ Upstream commit d845a2051b6b673fab4229b920ea04c7c4352b51 ]
Remove signaled jobs from job list and ensure the job was indeed preempted.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +15 -5
@@ -990,27 +990,37 @@ static void amdgpu_ib_preempt_job_recovery(struct drm_gpu_scheduler *sched)static void amdgpu_ib_preempt_mark_partial_job (struct amdgpu_ring *ring) {struct amdgpu_job *job; -struct drm_sched_job *s_job; +struct drm_sched_job *s_job, *tmp;uint32_t preempt_seq;struct dma_fence *fence, **ptr;struct amdgpu_fence_driver *drv = &ring->fence_drv;struct drm_gpu_scheduler *sched = &ring->sched; +bool preempted = true;if (ring->funcs->type !=AMDGPU_RING_TYPE_GFX )return ; preempt_seq =le32_to_cpu (*(drv->cpu_addr +2 )); -if (preempt_seq <=atomic_read (&drv->last_seq)) -return ; +if (preempt_seq <=atomic_read (&drv->last_seq)) { + preempted = false; + goto no_preempt; + } preempt_seq &= drv->num_fences_mask; ptr = &drv->fences[preempt_seq]; fence =rcu_dereference_protected (*ptr,1 ); +no_preempt:spin_lock (&sched->job_list_lock); -list_for_each_entry (s_job, &sched->ring_mirror_list, node) { +list_for_each_entry_safe (s_job, tmp, &sched->ring_mirror_list, node) { +if (dma_fence_is_signaled (&s_job->s_fence->finished)) { +/* remove job from ring_mirror_list */ +list_del_init (&s_job->node); + sched->ops->free_job (s_job); +continue ; + } job =to_amdgpu_job (s_job); -if (job->fence == fence) +if (preempted && job->fence == fence)/* mark the job as preempted */ job->preemption_status |=AMDGPU_IB_PREEMPTED ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 93/138 hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 8a03746c8baf82e1616f05a1a716d34378dcf780 ]
Stefan Dietrich reports invalid temperature source messages on Asus Formula XII Z490.
nct6775 nct6775.656: Invalid temperature source 28 at index 0,
source register 0x100, temp register 0x73
Debugging suggests that temperature source 28 reports the CPU temperature. Let's assume that temperature sources 28 and 29 reflect "PECI Agent {0,1} Calibration", similar to other chips of the series.
--- drivers/hwmon/nct6775.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwmon/nct6775.c +3 -3
@@ -786,13 +786,13 @@ static const char *const nct6798_temp_label[] = {"Agent1 Dimm1" ,"BYTE_TEMP0" ,"BYTE_TEMP1" , -"" , -"" , +"PECI Agent 0 Calibration" ,/* undocumented */ +"PECI Agent 1 Calibration" ,/* undocumented */ "" , "Virtual_TEMP" }; -#define NCT6798_TEMP_MASK 0x8fff0ffe +#define NCT6798_TEMP_MASK 0xbfff0ffe#define NCT6798_VIRT_TEMP_MASK 0x80000c00/* NCT6102D/NCT6106D specific data */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 94/138 platform/x86: ISST: Add new PCI device ids
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit e1eea3f839f41368d7cb4eb2d872d5b288677e94 ]
Added new PCI device ids for supporting mailbox and MMIO interface for Sapphire Rapids.
--- drivers/platform/x86/intel_speed_select_if/isst_if_common.h | 3 +++ drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c | 1 + drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c | 1 + 3 files changed, 5 insertions(+)
drivers/platform/x86/intel_speed_select_if/isst_if_common.h +3 -0
@@ -13,6 +13,9 @@#define INTEL_RAPL_PRIO_DEVID_0 0x3451#define INTEL_CFG_MBOX_DEVID_0 0x3459 +#define INTEL_RAPL_PRIO_DEVID_1 0x3251 +#define INTEL_CFG_MBOX_DEVID_1 0x3259 +/* * Validate maximum commands in a single request. * This is enough to handle command to every core in one ioctl, or all
drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c +1 -0
@@ -148,6 +148,7 @@ static long isst_if_mbox_proc_cmd(u8 *cmd_ptr, int *write_only, int resume)static const struct pci_device_id isst_if_mbox_ids[] = { {PCI_DEVICE (PCI_VENDOR_ID_INTEL ,INTEL_CFG_MBOX_DEVID_0 )}, + {PCI_DEVICE (PCI_VENDOR_ID_INTEL ,INTEL_CFG_MBOX_DEVID_1 )}, {0 }, };MODULE_DEVICE_TABLE (pci, isst_if_mbox_ids);
drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c +1 -0
@@ -72,6 +72,7 @@ static long isst_if_mmio_rd_wr(u8 *cmd_ptr, int *write_only, int resume)static const struct pci_device_id isst_if_ids[] = { {PCI_DEVICE (PCI_VENDOR_ID_INTEL ,INTEL_RAPL_PRIO_DEVID_0 )}, + {PCI_DEVICE (PCI_VENDOR_ID_INTEL ,INTEL_RAPL_PRIO_DEVID_1 )}, {0 }, };MODULE_DEVICE_TABLE (pci, isst_if_ids);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 95/138 platform/x86: asus-wmi: allow BAT1 battery name
In reply to Greg Kroah-HartmanFrom: Vasiliy Kupriakov <[email protected]>
[ Upstream commit 9a33e375d98ece5ea40c576eabd3257acb90c509 ]
The battery on my laptop ASUS TUF Gaming FX706II is named BAT1. This patch allows battery extension to load.
--- drivers/platform/x86/asus-wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/asus-wmi.c +1 -0
@@ -424,6 +424,7 @@ static int asus_wmi_battery_add(struct power_supply *battery)* battery is named BATT. */ if (strcmp (battery->desc->name,"BAT0" ) !=0 && +strcmp (battery->desc->name,"BAT1" ) !=0 &&strcmp (battery->desc->name,"BATT" ) !=0 )return -ENODEV ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 96/138 hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ]
SMATCH detected a potential buffer overflow in the manipulation of hwmon_attributes array inside the scmi_hwmon_probe function:
drivers/hwmon/scmi-hwmon.c:226
scmi_hwmon_probe() error: buffer overflow 'hwmon_attributes' 6 <= 9
Fix it by statically declaring the size of the array as the maximum possible as defined by hwmon_max define.
--- drivers/hwmon/scmi-hwmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/scmi-hwmon.c +1 -1
@@ -147,7 +147,7 @@ static enum hwmon_sensor_types scmi_types[] = { [ENERGY] = hwmon_energy, }; -static u32 hwmon_attributes[] = { +static u32 hwmon_attributes[hwmon_max] = { [hwmon_chip] =HWMON_C_REGISTER_TZ , [hwmon_temp] =HWMON_T_INPUT |HWMON_T_LABEL , [hwmon_in] =HWMON_I_INPUT |HWMON_I_LABEL ,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 97/138 ALSA: hda/realtek - fixup for yet another Intel reference board
In reply to Greg Kroah-HartmanFrom: PeiSen Hou <[email protected]>
[ Upstream commit 5734e509d5d515c187f642937ef2de1e58d7715d ]
Add headset_jack for the intel reference board support with 10ec:1230.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7546,6 +7546,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x10cf ,0x1629 ,"Lifebook U7x7" , ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),SND_PCI_QUIRK (0x10cf ,0x1845 ,"Lifebook U904" ,ALC269_FIXUP_LIFEBOOK_EXTMIC ),SND_PCI_QUIRK (0x10ec ,0x10f2 ,"Intel Reference board" ,ALC700_FIXUP_INTEL_REFERENCE ), +SND_PCI_QUIRK (0x10ec ,0x1230 ,"Intel Reference board" ,ALC225_FIXUP_HEADSET_JACK ),SND_PCI_QUIRK (0x10f7 ,0x8338 ,"Panasonic CF-SZ6" ,ALC269_FIXUP_HEADSET_MODE ),SND_PCI_QUIRK (0x144d ,0xc109 ,"Samsung Ativ book 9 (NP900X3G)" ,ALC269_FIXUP_INV_DMIC ), SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 98/138 drivers/perf: Fix kernel panic when rmmod PMU modules during perf sampling
In reply to Greg Kroah-HartmanFrom: Qi Liu <[email protected]>
[ Upstream commit bdc5c744c7b6457d18a95c26769dad0e7f480a08 ]
When users try to remove PMU modules during perf sampling, kernel panic will happen because the pmu->read() is a NULL pointer here.
INFO on HiSilicon hip08 platform as follow:
pc : hisi_uncore_pmu_event_update+0x30/0xa4 [hisi_uncore_pmu] lr : hisi_uncore_pmu_read+0x20/0x2c [hisi_uncore_pmu]
sp : ffff800010103e90
x29: ffff800010103e90 x28: ffff0027db0c0e40
x27: ffffa29a76f129d8 x26: ffffa29a77ceb000
x25: ffffa29a773a5000 x24: ffffa29a77392000
x23: ffffddffe5943f08 x22: ffff002784285960
x21: ffff002784285800 x20: ffff0027d2e76c80
x19: ffff0027842859e0 x18: ffff80003498bcc8
x17: ffffa29a76afe910 x16: ffffa29a7583f530
x15: 16151a1512061a1e x14: 0000000000000000
x13: ffffa29a76f1e238 x12: 0000000000000001
x11: 0000000000000400 x10: 00000000000009f0
x9 : ffff8000107b3e70 x8 : ffff0027db0c1890
x7 : ffffa29a773a7000 x6 : 00000007f5131013
x5 : 00000007f5131013 x4 : 09f257d417c00000
x3 : 00000002187bd7ce x2 : ffffa29a38f0f0d8
x1 : ffffa29a38eae268 x0 : ffff0027d2e76c80
Call trace: hisi_uncore_pmu_event_update+0x30/0xa4 [hisi_uncore_pmu] hisi_uncore_pmu_read+0x20/0x2c [hisi_uncore_pmu] __perf_event_read+0x1a0/0x1f8 flush_smp_call_function_queue+0xa0/0x160 generic_smp_call_function_single_interrupt+0x18/0x20 handle_IPI+0x31c/0x4dc gic_handle_irq+0x2c8/0x310 el1_irq+0xcc/0x180 arch_cpu_idle+0x4c/0x20c default_idle_call+0x20/0x30 do_idle+0x1b4/0x270 cpu_startup_entry+0x28/0x30 secondary_start_kernel+0x1a4/0x1fc
To solve the above issue, current module should be registered to kernel, so that try_module_get() can be invoked when perf sampling starts. This adds the reference counting of module and could prevent users from removing modules during sampling.
--- drivers/perf/arm_smmuv3_pmu.c | 1 + drivers/perf/fsl_imx8_ddr_perf.c | 1 + drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 1 + drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 1 + drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 1 + 5 files changed, 5 insertions(+)
drivers/perf/arm_smmuv3_pmu.c +1 -0
@@ -742,6 +742,7 @@ static int smmu_pmu_probe(struct platform_device *pdev)platform_set_drvdata (pdev, smmu_pmu); smmu_pmu->pmu = (struct pmu ) { + .module =THIS_MODULE , .task_ctx_nr = perf_invalid_context, .pmu_enable = smmu_pmu_enable, .pmu_disable = smmu_pmu_disable,
drivers/perf/fsl_imx8_ddr_perf.c +1 -0
@@ -451,6 +451,7 @@ static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base, { *pmu = (struct ddr_pmu ) { .pmu = (struct pmu ) { + .module =THIS_MODULE , .capabilities =PERF_PMU_CAP_NO_EXCLUDE , .task_ctx_nr = perf_invalid_context, .attr_groups = attr_groups,
drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +1 -0
@@ -381,6 +381,7 @@ static int hisi_ddrc_pmu_probe(struct platform_device *pdev) ddrc_pmu->sccl_id, ddrc_pmu->index_id); ddrc_pmu->pmu = (struct pmu ) { .name = name, + .module =THIS_MODULE , .task_ctx_nr = perf_invalid_context, .event_init = hisi_uncore_pmu_event_init, .pmu_enable = hisi_uncore_pmu_enable,
drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +1 -0
@@ -392,6 +392,7 @@ static int hisi_hha_pmu_probe(struct platform_device *pdev) hha_pmu->sccl_id, hha_pmu->index_id); hha_pmu->pmu = (struct pmu ) { .name = name, + .module =THIS_MODULE , .task_ctx_nr = perf_invalid_context, .event_init = hisi_uncore_pmu_event_init, .pmu_enable = hisi_uncore_pmu_enable,
drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c +1 -0
@@ -382,6 +382,7 @@ static int hisi_l3c_pmu_probe(struct platform_device *pdev) l3c_pmu->sccl_id, l3c_pmu->index_id); l3c_pmu->pmu = (struct pmu ) { .name = name, + .module =THIS_MODULE , .task_ctx_nr = perf_invalid_context, .event_init = hisi_uncore_pmu_event_init, .pmu_enable = hisi_uncore_pmu_enable,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 99/138 arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ]
Rather than open-code test_tsk_thread_flag() at each callsite, simply replace the couple of offenders with calls to test_tsk_thread_flag() directly.
--- arch/arm64/kernel/debug-monitors.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/kernel/debug-monitors.c +2 -2
@@ -396,14 +396,14 @@ void user_rewind_single_step(struct task_struct *task)* If single step is active for this thread, then set SPSR.SS * to 1 to avoid returning to the active-pending state. */ -if (test_ti_thread_flag (task_thread_info (task),TIF_SINGLESTEP )) +if (test_tsk_thread_flag (task,TIF_SINGLESTEP ))set_regs_spsr_ss (task_pt_regs (task)); }NOKPROBE_SYMBOL (user_rewind_single_step);void user_fastforward_single_step (struct task_struct *task) { -if (test_ti_thread_flag (task_thread_info (task),TIF_SINGLESTEP )) +if (test_tsk_thread_flag (task,TIF_SINGLESTEP ))clear_regs_spsr_ss (task_pt_regs (task)); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 100/138 x86: math-emu: Fix up cmp insn for clang ias
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ]
The clang integrated assembler requires the 'cmp' instruction to have a length prefix here:
arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl')
cmp $0xffffffff,-24(%ebp)
^
Make this a 32-bit comparison, which it was clearly meant to be.
--- arch/x86/math-emu/wm_sqrt.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/math-emu/wm_sqrt.S +1 -1
@@ -209,7 +209,7 @@ sqrt_stage_2_finish: #ifdef PARANOID /* It should be possible to get here only if the arg is ffff....ffff */ - cmp $0xffffffff,FPU_fsqrt_arg_1 + cmpl $0xffffffff,FPU_fsqrt_arg_1 jnz sqrt_stage_2_error #endif /* PARANOID */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 101/138 asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible()
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
[ Upstream commit bd024e82e4cd95c7f1a475a55f99871936c2b2db ]
Although mmiowb() is concerned only with serialising MMIO writes occuring in contexts where a spinlock is held, the call to mmiowb_set_pending() from the MMIO write accessors can occur in preemptible contexts, such as during driver probe() functions where ordering between CPUs is not usually a concern, assuming that the task migration path provides the necessary ordering guarantees.
Unfortunately, the default implementation of mmiowb_set_pending() is not preempt-safe, as it makes use of a a per-cpu variable to track its internal state. This has been reported to generate the following splat on riscv:
| BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 | caller is regmap_mmio_write32le+0x1c/0x46 | CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.8.0-rc3-hfu+ #1 | Call Trace: | walk_stackframe+0x0/0x7a | dump_stack+0x6e/0x88 | regmap_mmio_write32le+0x18/0x46 | check_preemption_disabled+0xa4/0xaa | regmap_mmio_write32le+0x18/0x46 | regmap_mmio_write+0x26/0x44 | regmap_write+0x28/0x48 | sifive_gpio_probe+0xc0/0x1da
Although it's possible to fix the driver in this case, other splats have been seen from other drivers, including the infamous 8250 UART, and so it's better to address this problem in the mmiowb core itself.
Fix mmiowb_set_pending() by using the raw_cpu_ptr() to get at the mmiowb state and then only updating the 'mmiowb_pending' field if we are not preemptible (i.e. we have a non-zero nesting count).
--- include/asm-generic/mmiowb.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/asm-generic/mmiowb.h +4 -2
@@ -27,7 +27,7 @@#include <asm/smp.h> DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state); -#define __mmiowb_state () this_cpu_ptr(&__mmiowb_state) +#define __mmiowb_state () raw_cpu_ptr(&__mmiowb_state)#else #define __mmiowb_state () arch_mmiowb_state()#endif /* arch_mmiowb_state */
@@ -35,7 +35,9 @@ DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state);static inline void mmiowb_set_pending (void ) {struct mmiowb_state *ms =__mmiowb_state (); - ms->mmiowb_pending = ms->nesting_count; + +if (likely (ms->nesting_count)) + ms->mmiowb_pending = ms->nesting_count; }static inline void mmiowb_spin_lock (void )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 102/138 drivers/perf: Prevent forced unbinding of PMU drivers
In reply to Greg Kroah-HartmanFrom: Qi Liu <[email protected]>
[ Upstream commit f32ed8eb0e3f0d0ef4ddb854554d60ca5863a9f9 ]
Forcefully unbinding PMU drivers during perf sampling will lead to a kernel panic, because the perf upper-layer framework call a NULL pointer in this situation.
To solve this issue, "suppress_bind_attrs" should be set to true, so that bind/unbind can be disabled via sysfs and prevent unbinding PMU drivers during perf sampling.
--- drivers/perf/arm-cci.c | 1 + drivers/perf/arm-ccn.c | 1 + drivers/perf/arm_dsu_pmu.c | 1 + drivers/perf/arm_smmuv3_pmu.c | 1 + drivers/perf/arm_spe_pmu.c | 1 + drivers/perf/fsl_imx8_ddr_perf.c | 1 + drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 1 + drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 1 + drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 1 + drivers/perf/qcom_l2_pmu.c | 1 + drivers/perf/qcom_l3_pmu.c | 1 + drivers/perf/thunderx2_pmu.c | 1 + drivers/perf/xgene_pmu.c | 1 + 13 files changed, 13 insertions(+)
drivers/perf/arm-cci.c +1 -0
@@ -1720,6 +1720,7 @@ static struct platform_driver cci_pmu_driver = { .driver = { .name = DRIVER_NAME, .of_match_table = arm_cci_pmu_matches, + .suppress_bind_attrs = true, }, .probe = cci_pmu_probe, .remove = cci_pmu_remove,
drivers/perf/arm-ccn.c +1 -0
@@ -1545,6 +1545,7 @@ static struct platform_driver arm_ccn_driver = { .driver = { .name = "arm-ccn", .of_match_table = arm_ccn_match, + .suppress_bind_attrs = true, }, .probe = arm_ccn_probe, .remove = arm_ccn_remove,
drivers/perf/arm_dsu_pmu.c +1 -0
@@ -759,6 +759,7 @@ static struct platform_driver dsu_pmu_driver = { .driver = { .name = DRVNAME, .of_match_table = of_match_ptr(dsu_pmu_of_match), + .suppress_bind_attrs = true, }, .probe = dsu_pmu_device_probe, .remove = dsu_pmu_device_remove,
drivers/perf/arm_smmuv3_pmu.c +1 -0
@@ -861,6 +861,7 @@ static void smmu_pmu_shutdown(struct platform_device *pdev)static struct platform_driver smmu_pmu_driver = { .driver = { .name ="arm-smmu-v3-pmcg" , + .suppress_bind_attrs = true, }, .probe = smmu_pmu_probe, .remove = smmu_pmu_remove,
drivers/perf/arm_spe_pmu.c +1 -0
@@ -1228,6 +1228,7 @@ static struct platform_driver arm_spe_pmu_driver = { .driver = { .name = DRVNAME, .of_match_table = of_match_ptr(arm_spe_pmu_of_match), + .suppress_bind_attrs = true, }, .probe = arm_spe_pmu_device_probe, .remove = arm_spe_pmu_device_remove,
drivers/perf/fsl_imx8_ddr_perf.c +1 -0
@@ -646,6 +646,7 @@ static struct platform_driver imx_ddr_pmu_driver = { .driver = { .name = "imx-ddr-pmu", .of_match_table = imx_ddr_pmu_dt_ids, + .suppress_bind_attrs = true, }, .probe = ddr_perf_probe, .remove = ddr_perf_remove,
drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +1 -0
@@ -420,6 +420,7 @@ static struct platform_driver hisi_ddrc_pmu_driver = { .driver = { .name = "hisi_ddrc_pmu", .acpi_match_table = ACPI_PTR(hisi_ddrc_pmu_acpi_match), + .suppress_bind_attrs = true, }, .probe = hisi_ddrc_pmu_probe, .remove = hisi_ddrc_pmu_remove,
drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +1 -0
@@ -431,6 +431,7 @@ static struct platform_driver hisi_hha_pmu_driver = { .driver = { .name = "hisi_hha_pmu", .acpi_match_table = ACPI_PTR(hisi_hha_pmu_acpi_match), + .suppress_bind_attrs = true, }, .probe = hisi_hha_pmu_probe, .remove = hisi_hha_pmu_remove,
drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c +1 -0
@@ -421,6 +421,7 @@ static struct platform_driver hisi_l3c_pmu_driver = { .driver = { .name = "hisi_l3c_pmu", .acpi_match_table = ACPI_PTR(hisi_l3c_pmu_acpi_match), + .suppress_bind_attrs = true, }, .probe = hisi_l3c_pmu_probe, .remove = hisi_l3c_pmu_remove,
drivers/perf/qcom_l2_pmu.c +1 -0
@@ -1028,6 +1028,7 @@ static struct platform_driver l2_cache_pmu_driver = { .driver = { .name = "qcom-l2cache-pmu", .acpi_match_table = ACPI_PTR(l2_cache_pmu_acpi_match), + .suppress_bind_attrs = true, }, .probe = l2_cache_pmu_probe, .remove = l2_cache_pmu_remove,
drivers/perf/qcom_l3_pmu.c +1 -0
@@ -814,6 +814,7 @@ static struct platform_driver qcom_l3_cache_pmu_driver = { .driver = { .name = "qcom-l3cache-pmu", .acpi_match_table = ACPI_PTR(qcom_l3_cache_pmu_acpi_match), + .suppress_bind_attrs = true, }, .probe = qcom_l3_cache_pmu_probe, };
drivers/perf/thunderx2_pmu.c +1 -0
@@ -816,6 +816,7 @@ static struct platform_driver tx2_uncore_driver = { .driver = { .name = "tx2-uncore-pmu", .acpi_match_table = ACPI_PTR(tx2_uncore_acpi_match), + .suppress_bind_attrs = true, }, .probe = tx2_uncore_probe, .remove = tx2_uncore_remove,
drivers/perf/xgene_pmu.c +1 -0
@@ -1981,6 +1981,7 @@ static struct platform_driver xgene_pmu_driver = { .name = "xgene-pmu", .of_match_table = xgene_pmu_of_match, .acpi_match_table = ACPI_PTR(xgene_pmu_acpi_match), + .suppress_bind_attrs = true, }, };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 103/138 RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw
In reply to Greg Kroah-HartmanFrom: Palmer Dabbelt <[email protected]>
[ Upstream commit 38b7c2a3ffb1fce8358ddc6006cfe5c038ff9963 ]
While digging through the recent mmiowb preemption issue it came up that we aren't actually preventing IO from crossing a scheduling boundary. While it's a bit ugly to overload smp_mb__after_spinlock() with this behavior, it's what PowerPC is doing so there's some precedent.
--- arch/riscv/include/asm/barrier.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/riscv/include/asm/barrier.h +9 -1
@@ -58,8 +58,16 @@ do { \* The AQ/RL pair provides a RCpc critical section, but there's not really any * way we can take advantage of that here because the ordering is only enforced * on that one lock. Thus, we're just doing a full fence. +* +* Since we allow writeX to be called from preemptive regions we need at least +* an "o" in the predecessor set to ensure device writes are visible before the +* task is marked as available for scheduling on a new hart. While I don't see +* any concrete reason we need a full IO fence, it seems safer to just upgrade +* this in order to avoid any IO crossing a scheduling boundary. In both +* instances the scheduler pairs this with an mb(), so nothing is necessary on +* the new hart. */ -#define smp_mb__after_spinlock () RISCV_FENCE(rw,rw) +#define smp_mb__after_spinlock () RISCV_FENCE(iorw,iorw)#include <asm-generic/barrier.h>
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 104/138 binder: Dont use mmput() from shrinker function.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit f867c771f98891841c217fa8459244ed0dd28921 upstream.
syzbot is reporting that mmput() from shrinker function has a risk of deadlock [1], for delayed_uprobe_add() from update_ref_ctr() calls kzalloc(GFP_KERNEL) with delayed_uprobe_lock held, and uprobe_clear_state() from __mmput() also holds delayed_uprobe_lock.
Commit a1b2289cef92ef0e ("android: binder: drop lru lock in isolate callback") replaced mmput() with mmput_async() in order to avoid sleeping with spinlock held. But this patch replaces mmput() with mmput_async() in order not to start __mmput() from shrinker context.
[1] https://syzkaller.appspot.com/bug?id=bc9e7303f537c41b2b0cc2dfcea3fc42964c2d45
--- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder_alloc.c +1 -1
@@ -948,7 +948,7 @@ enum lru_status binder_alloc_free_page(strace_binder_unmap_user_end (alloc, index); }up_read (&mm->mmap_sem); -mmput (mm); +mmput_async (mm);trace_binder_unmap_kernel_start (alloc, index);
Greg Kroah-Hartman
maintainerPATCH 105/138 usb: xhci-mtk: fix the failure of bandwidth allocation
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit 5ce1a24dd98c00a57a8fa13660648abf7e08e3ef upstream.
The wMaxPacketSize field of endpoint descriptor may be zero as default value in alternate interface, and they are not actually selected when start stream, so skip them when try to allocate bandwidth.
--- drivers/usb/host/xhci-mtk-sch.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/host/xhci-mtk-sch.c +4 -0
@@ -557,6 +557,10 @@ static bool need_bw_sch(struct usb_host_if (is_fs_or_ls (speed) && !has_tt)return false; +/* skip endpoint with zero maxpkt */ +if (usb_endpoint_maxp (&ep->desc) ==0 ) +return false; +return true; }
Greg Kroah-Hartman
maintainerPATCH 106/138 usb: xhci: Fix ASM2142/ASM3142 DMA addressing
In reply to Greg Kroah-HartmanFrom: Forest Crossman <[email protected]>
commit dbb0897e805f2ab1b8bc358f6c3d878a376b8897 upstream.
The ASM2142/ASM3142 (same PCI IDs) does not support full 64-bit DMA addresses, which can cause silent memory corruption or IOMMU errors on platforms that use the upper bits. Add the XHCI_NO_64BIT_SUPPORT quirk to fix this issue.
--- drivers/usb/host/xhci-pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/xhci-pci.c +3 -0
@@ -250,6 +250,9 @@ static void xhci_pci_quirks(struct devicif (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==0x1142 ) xhci->quirks |=XHCI_TRUST_TX_LENGTH ; +if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && + pdev->device ==0x2142 ) + xhci->quirks |=XHCI_NO_64BIT_SUPPORT ;if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042A_XHCI )
Greg Kroah-Hartman
maintainerPATCH 107/138 Revert "cifs: Fix the target file was deleted when rename failed."
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit 0e6705182d4e1b77248a93470d6d7b3013d59b30 upstream.
This reverts commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2.
Upon additional testing with older servers, it was found that the original commit introduced a regression when using the old SMB1 dialect and rsyncing over an existing file.
The patch will need to be respun to address this, likely including a larger refactoring of the SMB1 and SMB3 rename code paths to make it less confusing and also to address some additional rename error cases that SMB3 may be able to workaround.
--- fs/cifs/inode.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
fs/cifs/inode.c +2 -8
@@ -1791,7 +1791,6 @@ cifs_rename2(struct inode *source_dir, sFILE_UNIX_BASIC_INFO *info_buf_target;unsigned int xid;int rc, tmprc; -bool new_target =d_really_is_negative (target_dentry);if (flags & ~RENAME_NOREPLACE )return -EINVAL ;
@@ -1868,13 +1867,8 @@ cifs_rename2(struct inode *source_dir, s*/ unlink_target: -/* -* If the target dentry was created during the rename, try -* unlinking it if it's not negative -*/ -if (new_target && -d_really_is_positive (target_dentry) && - (rc == -EACCES || rc == -EEXIST )) { +/* Try unlinking the target dentry if it's not negative */ +if (d_really_is_positive (target_dentry) && (rc == -EACCES || rc == -EEXIST )) {if (d_is_dir (target_dentry)) tmprc =cifs_rmdir (target_dir, target_dentry);else
Greg Kroah-Hartman
maintainerPATCH 108/138 iwlwifi: mvm: dont call iwl_mvm_free_inactive_queue() under RCU
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit fbb1461ad1d6eacca9beb69a2f3ce1b5398d399b upstream.
iwl_mvm_free_inactive_queue() will sleep in synchronize_net() under some circumstances, so don't call it under RCU. There doesn't appear to be a need for RCU protection around this particular call.
--- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/sta.c +3 -5
@@ -1184,17 +1184,15 @@ static int iwl_mvm_inactivity_check(strufor_each_set_bit (i, &changetid_queues,IWL_MAX_HW_QUEUES )iwl_mvm_change_queue_tid (mvm, i); +rcu_read_unlock (); +if (free_queue >=0 && alloc_for_sta !=IWL_MVM_INVALID_STA ) { ret =iwl_mvm_free_inactive_queue (mvm, free_queue, queue_owner, alloc_for_sta); -if (ret) { -rcu_read_unlock (); +if (ret)return ret; - } } -rcu_read_unlock (); -return free_queue; }
Greg Kroah-Hartman
maintainerPATCH 109/138 tty: xilinx_uartps: Really fix id assignment
In reply to Greg Kroah-HartmanFrom: Helmut Grohne <[email protected]>
commit 22a82fa7d6c3e16d56a036b1fa697a39b954adf0 upstream.
The problems started with the revert (18cc7ac8a28e28). The cdns_uart_console.index is statically assigned -1. When the port is registered, Linux assigns consecutive numbers to it. It turned out that when using ttyPS1 as console, the index is not updated as we are reusing the same cdns_uart_console instance for multiple ports. When registering ttyPS0, it gets updated from -1 to 0, but when registering ttyPS1, it already is 0 and not updated.
That led to 2ae11c46d5fdc4. It assigns the index prior to registering the uart_driver once. Unfortunately, that ended up breaking the situation where the probe order does not match the id order. When using the same device tree for both uboot and linux, it is important that the serial0 alias points to the console. So some boards reverse those aliases. This was reported by Jan Kiszka. The proposed fix was reverting the index assignment and going back to the previous iteration.
However such a reversed assignement (serial0 -> uart1, serial1 -> uart0) was already partially broken by the revert (18cc7ac8a28e28). While the ttyPS device works, the kmsg connection is already broken and kernel messages go missing. Reverting the id assignment does not fix this.
Quoted 1 line
From the
xilinx_uartpsdriver pov (after reverting the refactoring
commits), there can be only one console. This manifests in static variables console_pprt and cdns_uart_console. These variables are not properly linked and can go out of sync. The cdns_uart_console.index is important for uart_add_one_port. We call that function for each port - one of which hopefully is the console. If it isn't, the CON_ENABLED flag is not set and console_port is cleared. The next cdns_uart_probe call then tries to register the next port using that same cdns_uart_console.
It is important that console_port and cdns_uart_console (and its index in particular) stay in sync. The index assignment implemented by Shubhrajyoti Datta is correct in principle. It just may have to happen a second time if the first cdns_uart_probe call didn't encounter the console device. And we shouldn't change the index once the console uart is registered.
--- drivers/tty/serial/xilinx_uartps.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/tty/serial/xilinx_uartps.c +6 -2
@@ -1559,8 +1559,10 @@ static int cdns_uart_probe(struct platfo* If register_console() don't assign value, then console_port pointer * is cleanup. */ -if (!console_port) +if (!console_port) { + cdns_uart_console.index = id; console_port = port; + }#endif rc =uart_add_one_port (&cdns_uart_uart_driver, port);
@@ -1573,8 +1575,10 @@ static int cdns_uart_probe(struct platfo#ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE /* This is not port which is used for console that's why clean it up */ if (console_port == port && - !(cdns_uart_uart_driver.cons->flags &CON_ENABLED )) + !(cdns_uart_uart_driver.cons->flags &CON_ENABLED )) { console_port =NULL ; + cdns_uart_console.index =-1 ; + }#endif cdns_uart_data->cts_override = of_property_read_bool(pdev->dev.of_node,
Greg Kroah-Hartman
maintainerPATCH 110/138 staging: wlan-ng: properly check endpoint types
In reply to Greg Kroah-HartmanFrom: Rustam Kovhaev <[email protected]>
commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream.
As syzkaller detected, wlan-ng driver does not do sanity check of endpoints in prism2sta_probe_usb(), add check for xfer direction and type
--- drivers/staging/wlan-ng/prism2usb.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/staging/wlan-ng/prism2usb.c +15 -1
@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct us const struct usb_device_id *id) {struct usb_device *dev; - +const struct usb_endpoint_descriptor *epd; +const struct usb_host_interface *iface_desc = interface->cur_altsetting;struct wlandevice *wlandev =NULL ;struct hfa384x *hw =NULL ;int result =0 ; +if (iface_desc->desc.bNumEndpoints !=2 ) { + result = -ENODEV ; + goto failed; + } + + result = -EINVAL ; + epd = &iface_desc->endpoint[1 ].desc; +if (!usb_endpoint_is_bulk_in (epd)) + goto failed; + epd = &iface_desc->endpoint[2 ].desc; +if (!usb_endpoint_is_bulk_out (epd)) + goto failed; + dev =interface_to_usbdev (interface); wlandev =create_wlan ();if (!wlandev) {
Greg Kroah-Hartman
maintainerPATCH 111/138 staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit 0bd0db42a030b75c20028c7ba6e327b9cb554116 upstream.
The INSN_CONFIG comedi instruction with sub-instruction code INSN_CONFIG_DIGITAL_TRIG includes a base channel in data[3]. This is used as a right shift amount for other bitmask values without being checked. Shift amounts greater than or equal to 32 will result in undefined behavior. Add code to deal with this.
--- drivers/staging/comedi/drivers/addi_apci_1032.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1032.c +14 -6
@@ -106,14 +106,22 @@ static int apci1032_cos_insn_config(stru unsigned int *data) {struct apci1032_private *devpriv = dev->private; -unsigned int shift, oldmask; +unsigned int shift, oldmask, himask, lomask;switch (data[0 ]) {case INSN_CONFIG_DIGITAL_TRIG :if (data[1 ] !=0 )return -EINVAL ; shift = data[3 ]; - oldmask = (1U << shift) -1 ; +if (shift <32 ) { + oldmask = (1U << shift) -1 ; + himask = data[4 ] << shift; + lomask = data[5 ] << shift; + }else { + oldmask =0xffffffffu ; + himask =0 ; + lomask =0 ; + }switch (data[2 ]) {case COMEDI_DIGITAL_TRIG_DISABLE : devpriv->ctrl =0 ;
@@ -136,8 +144,8 @@ static int apci1032_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS : if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
@@ -154,8 +162,8 @@ static int apci1032_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;default :return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 112/138 staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit f07804ec77d77f8a9dcf570a24154e17747bc82f upstream.
ni6527_intr_insn_config() processes INSN_CONFIG comedi instructions for the "interrupt" subdevice. When data[0] is INSN_CONFIG_DIGITAL_TRIG it is configuring the digital trigger. When data[2] is COMEDI_DIGITAL_TRIG_ENABLE_EDGES it is configuring rising and falling edge detection for the digital trigger, using a base channel number (or shift amount) in data[3], a rising edge bitmask in data[4] and falling edge bitmask in data[5].
If the base channel number (shift amount) is greater than or equal to the number of channels (24) of the digital input subdevice, there are no changes to the rising and falling edges, so the mask of channels to be changed can be set to 0, otherwise the mask of channels to be changed, and the rising and falling edge bitmasks are shifted by the base channel number before calling ni6527_set_edge_detection() to change the appropriate registers. Unfortunately, the code is comparing the base channel (shift amount) to the interrupt subdevice's number of channels
(1) instead of the digital input subdevice's number of channels (24). Fix it by comparing to 32 because all shift amounts for an unsigned int must be less than that and everything from bit 24 upwards is ignored by ni6527_set_edge_detection() anyway.
--- drivers/staging/comedi/drivers/ni_6527.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/ni_6527.c +1 -1
@@ -332,7 +332,7 @@ static int ni6527_intr_insn_config(struccase COMEDI_DIGITAL_TRIG_ENABLE_EDGES :/* check shift amount */ shift = data[3 ]; -if (shift >= s->n_chan) { +if (shift >=32 ) { mask =0 ; rising =0 ; falling =0 ;
Greg Kroah-Hartman
maintainerPATCH 113/138 staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit fc846e9db67c7e808d77bf9e2ef3d49e3820ce5d upstream.
The INSN_CONFIG comedi instruction with sub-instruction code INSN_CONFIG_DIGITAL_TRIG includes a base channel in data[3]. This is used as a right shift amount for other bitmask values without being checked. Shift amounts greater than or equal to 32 will result in undefined behavior. Add code to deal with this, adjusting the checks for invalid channels so that enabled channel bits that would have been lost by shifting are also checked for validity. Only channels 0 to 15 are valid.
--- drivers/staging/comedi/drivers/addi_apci_1500.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1500.c +19 -5
@@ -452,13 +452,14 @@ static int apci1500_di_cfg_trig(struct cstruct apci1500_private *devpriv = dev->private;unsigned int trig = data[1 ];unsigned int shift = data[3 ]; -unsigned int hi_mask = data[4 ] << shift; -unsigned int lo_mask = data[5 ] << shift; -unsigned int chan_mask = hi_mask | lo_mask; -unsigned int old_mask = (1 << shift) -1 ; +unsigned int hi_mask; +unsigned int lo_mask; +unsigned int chan_mask; +unsigned int old_mask;unsigned int pm;unsigned int pt;unsigned int pp; +unsigned int invalid_chan;if (trig >1 ) { dev_dbg(dev->class_dev,
@@ -466,7 +467,20 @@ static int apci1500_di_cfg_trig(struct creturn -EINVAL ; } -if (chan_mask >0xffff ) { +if (shift <=16 ) { + hi_mask = data[4 ] << shift; + lo_mask = data[5 ] << shift; + old_mask = (1U << shift) -1 ; + invalid_chan = (data[4 ] | data[5 ]) >> (16 - shift); + }else { + hi_mask =0 ; + lo_mask =0 ; + old_mask =0xffff ; + invalid_chan = data[4 ] | data[5 ]; + } + chan_mask = hi_mask | lo_mask; + +if (invalid_chan) {dev_dbg (dev->class_dev,"invalid digital trigger channel\n" );return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 114/138 staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit 926234f1b8434c4409aa4c53637aa3362ca07cea upstream.
The INSN_CONFIG comedi instruction with sub-instruction code INSN_CONFIG_DIGITAL_TRIG includes a base channel in data[3]. This is used as a right shift amount for other bitmask values without being checked. Shift amounts greater than or equal to 32 will result in undefined behavior. Add code to deal with this.
--- drivers/staging/comedi/drivers/addi_apci_1564.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1564.c +14 -6
@@ -331,14 +331,22 @@ static int apci1564_cos_insn_config(stru unsigned int *data) {struct apci1564_private *devpriv = dev->private; -unsigned int shift, oldmask; +unsigned int shift, oldmask, himask, lomask;switch (data[0 ]) {case INSN_CONFIG_DIGITAL_TRIG :if (data[1 ] !=0 )return -EINVAL ; shift = data[3 ]; - oldmask = (1U << shift) -1 ; +if (shift <32 ) { + oldmask = (1U << shift) -1 ; + himask = data[4 ] << shift; + lomask = data[5 ] << shift; + }else { + oldmask =0xffffffffu ; + himask =0 ; + lomask =0 ; + }switch (data[2 ]) {case COMEDI_DIGITAL_TRIG_DISABLE : devpriv->ctrl =0 ;
@@ -362,8 +370,8 @@ static int apci1564_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS : if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
@@ -380,8 +388,8 @@ static int apci1564_cos_insn_config(stru devpriv->mode2 &= oldmask; }/* configure specified channels */ - devpriv->mode1 |= data[4 ] << shift; - devpriv->mode2 |= data[5 ] << shift; + devpriv->mode1 |= himask; + devpriv->mode2 |= lomask;break ;default :return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 115/138 serial: tegra: fix CREAD handling for PIO
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit b374c562ee7ab3f3a1daf959c01868bae761571c upstream.
Commit 33ae787b74fc ("serial: tegra: add support to ignore read") added support for dropping input in case CREAD isn't set, but for PIO the ignore_status_mask wasn't checked until after the character had been put in the receive buffer.
Note that the NULL tty-port test is bogus and will be removed by a follow-on patch.
--- drivers/tty/serial/serial-tegra.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/tty/serial/serial-tegra.c +5 -2
@@ -651,11 +651,14 @@ static void tegra_uart_handle_rx_pio(str ch = (unsigned char )tegra_uart_read (tup,UART_RX ); tup->uport.icount.rx++; -if (!uart_handle_sysrq_char (&tup->uport, ch) && tty) -tty_insert_flip_char (tty, ch, flag); +if (uart_handle_sysrq_char (&tup->uport, ch)) +continue ;if (tup->uport.ignore_status_mask &UART_LSR_DR )continue ; + +if (tty) +tty_insert_flip_char (tty, ch, flag); }while (1 ); }
Greg Kroah-Hartman
maintainerPATCH 116/138 serial: 8250: fix null-ptr-deref in serial8250_start_tx()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit f4c23a140d80ef5e6d3d1f8f57007649014b60fa upstream.
I got null-ptr-deref in serial8250_start_tx():
[ 78.114630] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 78.123778] Mem abort info: [ 78.126560] ESR = 0x86000007 [ 78.129603] EC = 0x21: IABT (current EL), IL = 32 bits [ 78.134891] SET = 0, FnV = 0 [ 78.137933] EA = 0, S1PTW = 0 [ 78.141064] user pgtable: 64k pages, 48-bit VAs, pgdp=00000027d41a8600 [ 78.147562] [0000000000000000] pgd=00000027893f0003, p4d=00000027893f0003, pud=00000027893f0003, pmd=00000027c9a20003, pte=0000000000000000 [ 78.160029] Internal error: Oops: 86000007 [#1] SMP [ 78.164886] Modules linked in: sunrpc vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce ses enclosure sg sbsa_gwdt ipmi_ssif spi_dw_mmio sch_fq_codel vhost_net tun vhost vhost_iotlb tap ip_tables ext4 mbcache jbd2 ahci hisi_sas_v3_hw libahci hisi_sas_main libsas hns3 scsi_transport_sas hclge libata megaraid_sas ipmi_si hnae3 ipmi_devintf ipmi_msghandler br_netfilter bridge stp llc nvme nvme_core xt_sctp sctp libcrc32c dm_mod nbd [ 78.207383] CPU: 11 PID: 23258 Comm: null-ptr Not tainted 5.8.0-rc6+ #48 [ 78.214056] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B210.01 03/12/2020 [ 78.222888] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--) [ 78.228435] pc : 0x0 [ 78.230618] lr : serial8250_start_tx+0x160/0x260 [ 78.235215] sp : ffff800062eefb80 [ 78.238517] x29: ffff800062eefb80 x28: 0000000000000fff [ 78.243807] x27: ffff800062eefd80 x26: ffff202fd83b3000 [ 78.249098] x25: ffff800062eefd80 x24: ffff202fd83b3000 [ 78.254388] x23: ffff002fc5e50be8 x22: 0000000000000002 [ 78.259679] x21: 0000000000000001 x20: 0000000000000000 [ 78.264969] x19: ffffa688827eecc8 x18: 0000000000000000 [ 78.270259] x17: 0000000000000000 x16: 0000000000000000 [ 78.275550] x15: ffffa68881bc67a8 x14: 00000000000002e6 [ 78.280841] x13: ffffa68881bc67a8 x12: 000000000000c539 [ 78.286131] x11: d37a6f4de9bd37a7 x10: ffffa68881cccff0 [ 78.291421] x9 : ffffa68881bc6000 x8 : ffffa688819daa88 [ 78.296711] x7 : ffffa688822a0f20 x6 : ffffa688819e0000 [ 78.302002] x5 : ffff800062eef9d0 x4 : ffffa68881e707a8 [ 78.307292] x3 : 0000000000000000 x2 : 0000000000000002 [ 78.312582] x1 : 0000000000000001 x0 : ffffa688827eecc8 [ 78.317873] Call trace: [ 78.320312] 0x0 [ 78.322147] __uart_start.isra.9+0x64/0x78 [ 78.326229] uart_start+0xb8/0x1c8 [ 78.329620] uart_flush_chars+0x24/0x30 [ 78.333442] n_tty_receive_buf_common+0x7b0/0xc30 [ 78.338128] n_tty_receive_buf+0x44/0x2c8 [ 78.342122] tty_ioctl+0x348/0x11f8 [ 78.345599] ksys_ioctl+0xd8/0xf8 [ 78.348903] __arm64_sys_ioctl+0x2c/0xc8 [ 78.352812] el0_svc_common.constprop.2+0x88/0x1b0 [ 78.357583] do_el0_svc+0x44/0xd0 [ 78.360887] el0_sync_handler+0x14c/0x1d0 [ 78.364880] el0_sync+0x140/0x180 [ 78.368185] Code: bad PC value
SERIAL_PORT_DFNS is not defined on each arch, if it's not defined, serial8250_set_defaults() won't be called in serial8250_isa_init_ports(), so the p->serial_in pointer won't be initialized, and it leads a null-ptr-deref. Fix this problem by calling serial8250_set_defaults() after init uart port.
--- drivers/tty/serial/8250/8250_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_core.c +1 -1
@@ -524,6 +524,7 @@ static void __init serial8250_isa_init_p*/ up->mcr_mask = ~ALPHA_KLUDGE_MCR ; up->mcr_force =ALPHA_KLUDGE_MCR ; +serial8250_set_defaults (up); }/* chain base port ops to support Remote Supervisor Adapter */
@@ -547,7 +548,6 @@ static void __init serial8250_isa_init_p port->membase = old_serial_port[i].iomem_base; port->iotype = old_serial_port[i].io_type; port->regshift = old_serial_port[i].iomem_reg_shift; -serial8250_set_defaults (up); port->irqflags |= irqflag;if (serial8250_isa_config !=NULL )
Greg Kroah-Hartman
maintainerPATCH 117/138 serial: 8250_mtk: Fix high-speed baud rates clamping
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
commit 551e553f0d4ab623e2a6f424ab5834f9c7b5229c upstream.
Commit 7b668c064ec3 ("serial: 8250: Fix max baud limit in generic 8250 port") fixed limits of a baud rate setting for a generic 8250 port. In other words since that commit the baud rate has been permitted to be within [uartclk / 16 / UART_DIV_MAX; uartclk / 16], which is absolutely normal for a standard 8250 UART port. But there are custom 8250 ports, which provide extended baud rate limits. In particular the Mediatek 8250 port can work with baud rates up to "uartclk" speed.
Normally that and any other peculiarity is supposed to be handled in a custom set_termios() callback implemented in the vendor-specific 8250-port glue-driver. Currently that is how it's done for the most of the vendor-specific 8250 ports, but for some reason for Mediatek a solution has been spread out to both the glue-driver and to the generic 8250-port code. Due to that a bug has been introduced, which permitted the extended baud rate limit for all even for standard 8250-ports. The bug has been fixed by the commit 7b668c064ec3 ("serial: 8250: Fix max baud limit in generic 8250 port") by narrowing the baud rates limit back down to the normal bounds. Unfortunately by doing so we also broke the Mediatek-specific extended bauds feature.
A fix of the problem described above is twofold. First since we can't get back the extended baud rate limits feature to the generic set_termios() function and that method supports only a standard baud rates range, the requested baud rate must be locally stored before calling it and then restored back to the new termios structure after the generic set_termios() finished its magic business. By doing so we still use the serial8250_do_set_termios() method to set the LCR/MCR/FCR/etc. registers, while the extended baud rate setting procedure will be performed later in the custom Mediatek-specific set_termios() callback. Second since a true baud rate is now fully calculated in the custom set_termios() method we need to locally update the port timeout by calling the uart_update_timeout() function. After the fixes described above are implemented in the 8250_mtk.c driver, the Mediatek 8250-port should get back to normally working with extended baud rates.
--- drivers/tty/serial/8250/8250_mtk.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/tty/serial/8250/8250_mtk.c +18 -0
@@ -305,8 +305,21 @@ mtk8250_set_termios(struct uart_port *po }#endif +/* +* Store the requested baud rate before calling the generic 8250 +* set_termios method. Standard 8250 port expects bauds to be +* no higher than (uartclk / 16) so the baud will be clamped if it +* gets out of that bound. Mediatek 8250 port supports speed +* higher than that, therefore we'll get original baud rate back +* after calling the generic set_termios method and recalculate +* the speed later in this method. +*/ + baud =tty_termios_baud_rate (termios); +serial8250_do_set_termios (port, termios, old); +tty_termios_encode_baud_rate (termios, baud, baud); +/* * Mediatek UARTs use an extra highspeed register (MTK_UART_HIGHS) *
@@ -338,6 +351,11 @@ mtk8250_set_termios(struct uart_port *po*/ spin_lock_irqsave (&port->lock, flags); +/* +* Update the per-port timeout. +*/ +uart_update_timeout (port, termios->c_cflag, baud); +/* set DLAB we have cval saved in up->lcr from the call to the core */ serial_port_out (port,UART_LCR , up->lcr |UART_LCR_DLAB );serial_dl_write (up, quot);
Greg Kroah-Hartman
maintainerPATCH 118/138 /dev/mem: Add missing memory barriers for devmem_inode
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit b34e7e298d7a5ed76b3aa327c240c29f1ef6dd22 upstream.
WRITE_ONCE() isn't the correct way to publish a pointer to a data structure, since it doesn't include a write memory barrier. Therefore other tasks may see that the pointer has been set but not see that the pointed-to memory has finished being initialized yet. Instead a primitive with "release" semantics is needed.
Use smp_store_release() for this.
The use of READ_ONCE() on the read side is still potentially correct if there's no control dependency, i.e. if all memory being "published" is transitively reachable via the pointer itself. But this pairing is somewhat confusing and error-prone. So just upgrade the read side to smp_load_acquire() so that it clearly pairs with smp_store_release().
--- drivers/char/mem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/char/mem.c +7 -3
@@ -814,7 +814,8 @@ static struct inode *devmem_inode;#ifdef CONFIG_IO_STRICT_DEVMEM void revoke_devmem (struct resource *res) { -struct inode *inode =READ_ONCE (devmem_inode); +/* pairs with smp_store_release() in devmem_init_inode() */ +struct inode *inode =smp_load_acquire (&devmem_inode);/* * Check that the initialization has completed. Losing the race
@@ -1028,8 +1029,11 @@ static int devmem_init_inode(void)return rc; } -/* publish /dev/mem initialized */ -WRITE_ONCE (devmem_inode, inode); +/* +* Publish /dev/mem initialized. +* Pairs with smp_load_acquire() in revoke_devmem(). +*/ +smp_store_release (&devmem_inode, inode);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 119/138 fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit 033724d6864245a11f8e04c066002e6ad22b3fd0 upstream.
syzbot is reporting general protection fault in bitfill_aligned() [1] caused by integer underflow in bit_clear_margins(). The cause of this problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.
If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres is going to shrink, vc->vc_{cols,rows} will not be updated. This allows bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will try to overrun the __iomem region and causes general protection fault.
Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to
new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows);
exception. Since cols and lines are calculated as
cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; vc_resize(vc, cols, rows);
in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0 and var.yres < vc->vc_font.height makes rows = 0. This means that
const int fd = open("/dev/fb0", O_ACCMODE);
struct fb_var_screeninfo var = { };
ioctl(fd, FBIOGET_VSCREENINFO, &var);
var.xres = var.yres = 1;
ioctl(fd, FBIOPUT_VSCREENINFO, &var);easily reproduces integer underflow bug explained above.
Of course, callers of vc_resize() are not handling vc_do_resize() failure is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore, as a band-aid workaround, this patch checks integer underflow in "struct fbcon_ops"->clear_margins call, assuming that vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not cause integer overflow.
[1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6
--- drivers/video/fbdev/core/bitblit.c | 4 ++-- drivers/video/fbdev/core/fbcon_ccw.c | 4 ++-- drivers/video/fbdev/core/fbcon_cw.c | 4 ++-- drivers/video/fbdev/core/fbcon_ud.c | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-)
drivers/video/fbdev/core/bitblit.c +2 -2
@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_ region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dx = info->var.xoffset + rs; region.dy =0 ; region.width = rw;
@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_ info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dx = info->var.xoffset; region.dy = info->var.yoffset + bs; region.width = rs;
drivers/video/fbdev/core/fbcon_ccw.c +2 -2
@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_ region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dx =0 ; region.dy = info->var.yoffset; region.height = rw;
@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_ info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dx = info->var.xoffset + bs; region.dy =0 ; region.height = info->var.yres_virtual;
drivers/video/fbdev/core/fbcon_cw.c +2 -2
@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_d region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dx =0 ; region.dy = info->var.yoffset + rs; region.height = rw;
@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_d info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dx = info->var.xoffset; region.dy = info->var.yoffset; region.height = info->var.yres;
drivers/video/fbdev/core/fbcon_ud.c +2 -2
@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_d region.color = color; region.rop =ROP_COPY ; -if (rw && !bottom_only) { +if ((int ) rw >0 && !bottom_only) { region.dy =0 ; region.dx = info->var.xoffset; region.width = rw;
@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_d info->fbops->fb_fillrect (info, ®ion); } -if (bh) { +if ((int ) bh >0 ) { region.dy = info->var.yoffset; region.dx = info->var.xoffset; region.height = bh;
Greg Kroah-Hartman
maintainerPATCH 120/138 vt: Reject zero-sized screen buffer size.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit ce684552a266cb1c7cc2f7e623f38567adec6653 upstream.
syzbot is reporting general protection fault in do_con_write() [1] caused by vc->vc_screenbuf == ZERO_SIZE_PTR caused by vc->vc_screenbuf_size == 0 caused by vc->vc_cols == vc->vc_rows == vc->vc_size_row == 0 caused by fb_set_var() from ioctl(FBIOPUT_VSCREENINFO) on /dev/fb0 , for gotoxy(vc, 0, 0) from reset_terminal() from vc_init() from vc_allocate()
from con_install() from tty_init_dev() from tty_open() on such console
causes vc->vc_pos == 0x10000000e due to
((unsigned long) ZERO_SIZE_PTR) + -1U * 0 + (-1U << 1).
I don't think that a console with 0 column or 0 row makes sense. And it seems that vc_do_resize() does not intend to allow resizing a console to 0 column or 0 row due to
new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows);
exception.
Theoretically, cols and rows can be any range as long as 0 < cols * rows * 2 <= KMALLOC_MAX_SIZE is satisfied (e.g. cols == 1048576 && rows == 2 is possible) because of
vc->vc_size_row = vc->vc_cols << 1; vc->vc_screenbuf_size = vc->vc_rows * vc->vc_size_row;
in visual_init() and kzalloc(vc->vc_screenbuf_size) in vc_allocate().
Since we can detect cols == 0 or rows == 0 via screenbuf_size = 0 in visual_init(), we can reject kzalloc(0). Then, vc_allocate() will return an error, and con_write() will not be called on a console with 0 column or 0 row.
We need to make sure that integer overflow in visual_init() won't happen. Since vc_do_resize() restricts cols <= 32767 and rows <= 32767, applying 1 <= cols <= 32767 and 1 <= rows <= 32767 restrictions to vc_allocate() will be practically fine.
This patch does not touch con_init(), for returning -EINVAL there does not help when we are not returning -ENOMEM.
[1] https://syzkaller.appspot.com/bug?extid=017265e8553724e514e8
--- drivers/tty/vt/vt.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
drivers/tty/vt/vt.c +18 -11
@@ -1092,10 +1092,19 @@ static const struct tty_port_operations .destruct = vc_port_destruct, }; +/* +* Change # of rows and columns (0 means unchanged/the size of fg_console) +* [this is to be used together with some user program +* like resize that changes the hardware videomode] +*/ +#define VC_MAXCOL (32767) +#define VC_MAXROW (32767) +int vc_allocate (unsigned int currcons)/* return 0 on success */ {struct vt_notifier_param param;struct vc_data *vc; +int err;WARN_CONSOLE_UNLOCKED ();
@@ -1125,6 +1134,11 @@ int vc_allocate(unsigned int currcons) /if (!*vc->vc_uni_pagedir_loc)con_set_default_unimap (vc); + err = -EINVAL ; +if (vc->vc_cols >VC_MAXCOL || vc->vc_rows >VC_MAXROW || + vc->vc_screenbuf_size >KMALLOC_MAX_SIZE || !vc->vc_screenbuf_size) + goto err_free; + err = -ENOMEM ; vc->vc_screenbuf =kzalloc (vc->vc_screenbuf_size,GFP_KERNEL );if (!vc->vc_screenbuf) goto err_free;
@@ -1143,7 +1157,7 @@ err_free:visual_deinit (vc);kfree (vc); vc_cons[currcons].d =NULL ; -return -ENOMEM ; +return err; } static inline int resize_screen(struct vc_data *vc, int width, int height,
@@ -1158,14 +1172,6 @@ static inline int resize_screen(struct vreturn err; } -/* -* Change # of rows and columns (0 means unchanged/the size of fg_console) -* [this is to be used together with some user program -* like resize that changes the hardware videomode] -*/ -#define VC_RESIZE_MAXCOL (32767) -#define VC_RESIZE_MAXROW (32767) -/** * vc_do_resize - resizing method for the tty * @tty: tty being resized
@@ -1201,7 +1207,7 @@ static int vc_do_resize(struct tty_struc user = vc->vc_resize_user; vc->vc_resize_user =0 ; -if (cols >VC_RESIZE_MAXCOL || lines >VC_RESIZE_MAXROW ) +if (cols >VC_MAXCOL || lines >VC_MAXROW )return -EINVAL ; new_cols = (cols ? cols : vc->vc_cols);
@@ -1212,7 +1218,7 @@ static int vc_do_resize(struct tty_strucif (new_cols == vc->vc_cols && new_rows == vc->vc_rows)return 0 ; -if (new_screen_size >KMALLOC_MAX_SIZE ) +if (new_screen_size >KMALLOC_MAX_SIZE || !new_screen_size)return -EINVAL ; newscreen =kzalloc (new_screen_size,GFP_USER );if (!newscreen)
@@ -3396,6 +3402,7 @@ static int __init con_init(void)INIT_WORK (&vc_cons[currcons].SAK_work, vc_SAK);tty_port_init (&vc->port);visual_init (vc, currcons,1 ); +/* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */ vc->vc_screenbuf =kzalloc (vc->vc_screenbuf_size,GFP_NOWAIT );vc_init (vc, vc->vc_rows, vc->vc_cols, currcons || !vc->vc_sw->con_save_screen);
Greg Kroah-Hartman
maintainerPATCH 121/138 Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
In reply to Greg Kroah-HartmanFrom: Fangrui Song <[email protected]>
commit ca9b31f6bb9c6aa9b4e5f0792f39a97bbffb8c51 upstream.
When CROSS_COMPILE is set (e.g. aarch64-linux-gnu-), if $(CROSS_COMPILE)elfedit is found at /usr/bin/aarch64-linux-gnu-elfedit, GCC_TOOLCHAIN_DIR will be set to /usr/bin/. --prefix= will be set to /usr/bin/ and Clang as of 11 will search for both $(prefix)aarch64-linux-gnu-$needle and $(prefix)$needle.
GCC searchs for $(prefix)aarch64-linux-gnu/$version/$needle, $(prefix)aarch64-linux-gnu/$needle and $(prefix)$needle. In practice, $(prefix)aarch64-linux-gnu/$needle rarely contains executables.
To better model how GCC's -B/--prefix takes in effect in practice, newer Clang (since
https://github.com/llvm/llvm-project/commit/3452a0d8c17f7166f479706b293caf6ac76ffd90)
only searches for $(prefix)$needle. Currently it will find /usr/bin/as instead of /usr/bin/aarch64-linux-gnu-as.
Set --prefix= to $(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE)) (/usr/bin/aarch64-linux-gnu-) so that newer Clang can find the appropriate cross compiling GNU as (when -no-integrated-as is in effect).
--- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -1
@@ -528,7 +528,7 @@ ifneq ($(shell $(CC) --version 2>&1 | he ifneq ($(CROSS_COMPILE),) CLANG_FLAGS += --target=$(notdir $(CROSS_COMPILE:%-=%)) GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit)) -CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR) +CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE)) GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..) endif ifneq ($(GCC_TOOLCHAIN),)
Greg Kroah-Hartman
maintainerPATCH 122/138 mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
In reply to Greg Kroah-HartmanFrom: Kirill A. Shutemov <[email protected]>
commit 246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c upstream.
VMA with VM_GROWSDOWN or VM_GROWSUP flag set can change their size under mmap_read_lock(). It can lead to race with __do_munmap():
Thread A Thread B__do_munmap()
detach_vmas_to_be_unmapped()
mmap_write_downgrade()
expand_downwards()
vma->vm_start = address;
// The VMA now overlaps with
// VMAs detached by the Thread A
// page fault populates expanded part
// of the VMA
unmap_region()
// Zaps pagetables partly
// populated by Thread BSimilar race exists for expand_upwards().
The fix is to avoid downgrading mmap_lock in __do_munmap() if detached VMAs are next to VM_GROWSDOWN or VM_GROWSUP VMA.
[[email protected]: s/mmap_sem/mmap_lock/ in comment]
--- mm/mmap.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
mm/mmap.c +14 -2
@@ -2622,7 +2622,7 @@ static void unmap_region(struct mm_struc* Create a list of vma's touched by the unmap, removing them from the mm's * vma list as we go.. */ -static void +static bool detach_vmas_to_be_unmapped (struct mm_struct *mm,struct vm_area_struct *vma,struct vm_area_struct *prev,unsigned long end) {
@@ -2647,6 +2647,17 @@ detach_vmas_to_be_unmapped(struct mm_str/* Kill the cache */ vmacache_invalidate (mm); + +/* +* Do not downgrade mmap_lock if we are next to VM_GROWSDOWN or +* VM_GROWSUP VMA. Such VMAs can change their size under +* down_read(mmap_lock) and collide with the VMA we are about to unmap. +*/ +if (vma && (vma->vm_flags &VM_GROWSDOWN )) +return false; +if (prev && (prev->vm_flags &VM_GROWSUP )) +return false; +return true; }/*
@@ -2827,7 +2838,8 @@ int __do_munmap(struct mm_struct *mm, un }/* Detach vmas from rbtree */ -detach_vmas_to_be_unmapped (mm, vma, prev, end); +if (!detach_vmas_to_be_unmapped (mm, vma, prev, end)) + downgrade = false;if (downgrade)downgrade_write (&mm->mmap_sem);
Greg Kroah-Hartman
maintainerPATCH 123/138 mm/memcg: fix refcount error while moving and swapping
In reply to Greg Kroah-HartmanFrom: Hugh Dickins <[email protected]>
commit 8d22a9351035ef2ff12ef163a1091b8b8cf1e49c upstream.
It was hard to keep a test running, moving tasks between memcgs with move_charge_at_immigrate, while swapping: mem_cgroup_id_get_many()'s refcount is discovered to be 0 (supposedly impossible), so it is then forced to REFCOUNT_SATURATED, and after thousands of warnings in quick succession, the test is at last put out of misery by being OOM killed.
This is because of the way moved_swap accounting was saved up until the task move gets completed in __mem_cgroup_clear_mc(), deferred from when mem_cgroup_move_swap_account() actually exchanged old and new ids. Concurrent activity can free up swap quicker than the task is scanned, bringing id refcount down 0 (which should only be possible when offlining).
Just skip that optimization: do that part of the accounting immediately.
--- mm/memcontrol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/memcontrol.c +2 -2
@@ -5770,7 +5770,6 @@ static void __mem_cgroup_clear_mc(void)if (!mem_cgroup_is_root (mc.to))page_counter_uncharge (&mc.to->memory, mc.moved_swap); -mem_cgroup_id_get_many (mc.to, mc.moved_swap);css_put_many (&mc.to->css, mc.moved_swap); mc.moved_swap =0 ;
@@ -5961,7 +5960,8 @@ put: /* get_mctgt_type() gets the page ent = target.ent;if (!mem_cgroup_move_swap_account (ent, mc.from, mc.to)) { mc.precharge--; -/* we fixup refcnts and charges later. */ +mem_cgroup_id_get_many (mc.to,1 ); +/* we fixup other refcnts and charges later. */ mc.moved_swap++; }break ;
Greg Kroah-Hartman
maintainerPATCH 124/138 mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
commit d38a2b7a9c939e6d7329ab92b96559ccebf7b135 upstream.
If the kmem_cache refcount is greater than one, we should not mark the root kmem_cache as dying. If we mark the root kmem_cache dying incorrectly, the non-root kmem_cache can never be destroyed. It resulted in memory leak when memcg was destroyed. We can use the following steps to reproduce.
1) Use kmem_cache_create() to create a new kmem_cache named A.
2) Coincidentally, the kmem_cache A is an alias for kmem_cache B, so the refcount of B is just increased.
3) Use kmem_cache_destroy() to destroy the kmem_cache A, just decrease the B's refcount but mark the B as dying.
4) Create a new memory cgroup and alloc memory from the kmem_cache B. It leads to create a non-root kmem_cache for allocating memory.
5) When destroy the memory cgroup created in the step 4), the non-root kmem_cache can never be destroyed.
If we repeat steps 4) and 5), this will cause a lot of memory leak. So only when refcount reach zero, we mark the root kmem_cache as dying.
--- mm/slab_common.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-)
mm/slab_common.c +28 -7
@@ -326,6 +326,14 @@ int slab_unmergeable(struct kmem_cache *if (s->refcount <0 )return 1 ; +#ifdef CONFIG_MEMCG_KMEM +/* +* Skip the dying kmem_cache. +*/ +if (s->memcg_params.dying) +return 1 ; +#endif +return 0 ; }
@@ -886,12 +894,15 @@ static int shutdown_memcg_caches(structreturn 0 ; } -static void flush_memcg_workqueue (struct kmem_cache *s) +static void memcg_set_kmem_cache_dying (struct kmem_cache *s) {spin_lock_irq (&memcg_kmem_wq_lock); s->memcg_params.dying = true;spin_unlock_irq (&memcg_kmem_wq_lock); +} +static void flush_memcg_workqueue (struct kmem_cache *s) +{/* * SLAB and SLUB deactivate the kmem_caches through call_rcu. Make * sure all registered rcu callbacks have been invoked.
@@ -923,10 +934,6 @@ static inline int shutdown_memcg_caches( {return 0 ; } - -static inline void flush_memcg_workqueue (struct kmem_cache *s) -{ -}#endif /* CONFIG_MEMCG_KMEM */ void slab_kmem_cache_release (struct kmem_cache *s)
@@ -944,8 +951,6 @@ void kmem_cache_destroy(struct kmem_cachif (unlikely (!s))return ; -flush_memcg_workqueue (s); -get_online_cpus ();get_online_mems ();
@@ -955,6 +960,22 @@ void kmem_cache_destroy(struct kmem_cachif (s->refcount) goto out_unlock; +#ifdef CONFIG_MEMCG_KMEM +memcg_set_kmem_cache_dying (s); + +mutex_unlock (&slab_mutex); + +put_online_mems (); +put_online_cpus (); + +flush_memcg_workqueue (s); + +get_online_cpus (); +get_online_mems (); + +mutex_lock (&slab_mutex); +#endif + err =shutdown_memcg_caches (s);if (!err) err =shutdown_cache (s);
Greg Kroah-Hartman
maintainerPATCH 125/138 khugepaged: fix null-pointer dereference due to race
In reply to Greg Kroah-HartmanFrom: Kirill A. Shutemov <[email protected]>
commit 594cced14ad3903166c8b091ff96adac7552f0b3 upstream.
khugepaged has to drop mmap lock several times while collapsing a page. The situation can change while the lock is dropped and we need to re-validate that the VMA is still in place and the PMD is still subject for collapse.
But we miss one corner case: while collapsing an anonymous pages the VMA could be replaced with file VMA. If the file VMA doesn't have any private pages we get NULL pointer dereference:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] anon_vma_lock_write include/linux/rmap.h:120 [inline] collapse_huge_page mm/khugepaged.c:1110 [inline] khugepaged_scan_pmd mm/khugepaged.c:1349 [inline] khugepaged_scan_mm_slot mm/khugepaged.c:2110 [inline] khugepaged_do_scan mm/khugepaged.c:2193 [inline] khugepaged+0x3bba/0x5a10 mm/khugepaged.c:2238
The fix is to make sure that the VMA is anonymous in hugepage_vma_revalidate(). The helper is only used for collapsing anonymous pages.
--- mm/khugepaged.c | 3 +++ 1 file changed, 3 insertions(+)
mm/khugepaged.c +3 -0
@@ -876,6 +876,9 @@ static int hugepage_vma_revalidate(strucreturn SCAN_ADDRESS_RANGE ;if (!hugepage_vma_check (vma, vma->vm_flags))return SCAN_VMA_CHECK ; +/* Anon VMA expected */ +if (!vma->anon_vma || vma->vm_ops) +return SCAN_VMA_CHECK ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 126/138 io-mapping: indicate mapping failure
In reply to Greg Kroah-HartmanFrom: Michael J. Ruhl <[email protected]>
commit e0b3e0b1a04367fc15c07f44e78361545b55357c upstream.
The !ATOMIC_IOMAP version of io_maping_init_wc will always return success, even when the ioremap fails.
Since the ATOMIC_IOMAP version returns NULL when the init fails, and callers check for a NULL return on error this is unexpected.
During a device probe, where the ioremap failed, a crash can look like this:
BUG: unable to handle page fault for address: 0000000000210000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] PREEMPT SMP
CPU: 0 PID: 177 Comm:
RIP: 0010:fill_page_dma [i915]
gen8_ppgtt_create [i915]
i915_ppgtt_create [i915]
intel_gt_init [i915]
i915_gem_init [i915]
i915_driver_probe [i915]
pci_device_probe
really_probe
driver_probe_deviceThe remap failure occurred much earlier in the probe. If it had been propagated, the driver would have exited with an error.
Return NULL on ioremap failure.
[[email protected]: detect ioremap_wc() errors earlier]
--- include/linux/io-mapping.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/io-mapping.h +4 -1
@@ -108,9 +108,12 @@ io_mapping_init_wc(struct io_mapping *io resource_size_t base, unsigned long size) { + iomap->iomem =ioremap_wc (base, size); +if (!iomap->iomem) +return NULL ; + iomap->base = base; iomap->size = size; - iomap->iomem =ioremap_wc (base, size);#if defined(pgprot_noncached_wc)/* archs can't agree on a name ... */ iomap->prot =pgprot_noncached_wc (PAGE_KERNEL );#elif defined(pgprot_writecombine)
Greg Kroah-Hartman
maintainerPATCH 127/138 mmc: sdhci-of-aspeed: Fix clock divider calculation
In reply to Greg Kroah-HartmanFrom: Eddie James <[email protected]>
commit ebd4050c6144b38098d8eed34df461e5e3fa82a9 upstream.
When calculating the clock divider, start dividing at 2 instead of 1. The divider is divided by two at the end of the calculation, so starting at 1 may result in a divider of 0, which shouldn't happen.
--- drivers/mmc/host/sdhci-of-aspeed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sdhci-of-aspeed.c +1 -1
@@ -68,7 +68,7 @@ static void aspeed_sdhci_set_clock(strucif (WARN_ON (clock > host->max_clk)) clock = host->max_clk; -for (div =1 ; div <256 ; div *=2 ) { +for (div =2 ; div <256 ; div *=2 ) {if ((parent / div) <= clock)break ; }
Greg Kroah-Hartman
maintainerPATCH 128/138 drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
In reply to Greg Kroah-HartmanFrom: Paweł Gronowski <[email protected]>
commit 38e0c89a19fd13f28d2b4721035160a3e66e270b upstream.
NULL dereference occurs when string that is not ended with space or newline is written to some dpm sysfs interface (for example pp_dpm_sclk). This happens because strsep replaces the tmp with NULL if the delimiter is not present in string, which is then dereferenced by tmp[0].
Reproduction example:
sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk'
--- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +3 -6
@@ -691,8 +691,7 @@ static ssize_t amdgpu_set_pp_od_clk_volt tmp_str++;while (isspace (*++tmp_str)); -while (tmp_str[0 ]) { - sub_str =strsep (&tmp_str, delimiter); +while ((sub_str =strsep (&tmp_str, delimiter)) !=NULL ) { ret =kstrtol (sub_str,0 , ¶meter[parameter_size]);if (ret)return -EINVAL ;
@@ -883,8 +882,7 @@ static ssize_t amdgpu_read_mask(const chmemcpy (buf_cpy, buf, bytes); buf_cpy[bytes] ='\0' ; tmp = buf_cpy; -while (tmp[0 ]) { - sub_str =strsep (&tmp, delimiter); +while ((sub_str =strsep (&tmp, delimiter)) !=NULL ) {if (strlen (sub_str)) { ret =kstrtol (sub_str,0 , &level);if (ret)
@@ -1300,8 +1298,7 @@ static ssize_t amdgpu_set_pp_power_profi i++;memcpy (buf_cpy, buf, count-i); tmp_str = buf_cpy; -while (tmp_str[0 ]) { - sub_str =strsep (&tmp_str, delimiter); +while ((sub_str =strsep (&tmp_str, delimiter)) !=NULL ) { ret =kstrtol (sub_str,0 , ¶meter[parameter_size]);if (ret) { count = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 129/138 drm/amd/powerplay: fix a crash when overclocking Vega M
In reply to Greg Kroah-HartmanFrom: Qiu Wenbo <[email protected]>
commit 88bb16ad998a0395fe4b346b7d3f621aaa0a2324 upstream.
Avoid kernel crash when vddci_control is SMU7_VOLTAGE_CONTROL_NONE and vddci_voltage_table is empty. It has been tested on Intel Hades Canyon (i7-8809G).
--- drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c +6 -4
@@ -642,9 +642,6 @@ static int vegam_get_dependency_volt_by_/* sclk is bigger than max sclk in the dependence table */ *voltage |= (dep_table->entries[i -1 ].vddc *VOLTAGE_SCALE ) <<VDDC_SHIFT ; - vddci =phm_find_closest_vddci (&(data->vddci_voltage_table), - (dep_table->entries[i -1 ].vddc - - (uint16_t )VDDC_VDDCI_DELTA ));if (SMU7_VOLTAGE_CONTROL_NONE == data->vddci_control) *voltage |= (data->vbios_boot_state.vddci_bootup_value *
@@ -652,8 +649,13 @@ static int vegam_get_dependency_volt_by_else if (dep_table->entries[i -1 ].vddci) *voltage |= (dep_table->entries[i -1 ].vddci *VOLTAGE_SCALE ) <<VDDC_SHIFT ; -else +else { + vddci =phm_find_closest_vddci (&(data->vddci_voltage_table), + (dep_table->entries[i -1 ].vddc - + (uint16_t )VDDC_VDDCI_DELTA )); + *voltage |= (vddci *VOLTAGE_SCALE ) <<VDDCI_SHIFT ; + }if (SMU7_VOLTAGE_CONTROL_NONE == data->mvdd_control) *mvdd = data->vbios_boot_state.mvdd_bootup_value *VOLTAGE_SCALE ;
Greg Kroah-Hartman
maintainerPATCH 130/138 parisc: Add atomic64_set_release() define to avoid CPU soft lockups
In reply to Greg Kroah-HartmanFrom: John David Anglin <[email protected]>
commit be6577af0cef934ccb036445314072e8cb9217b9 upstream.
Stalls are quite frequent with recent kernels. I enabled CONFIG_SOFTLOCKUP_DETECTOR and I caught the following stall:
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [cc1:22803] CPU: 0 PID: 22803 Comm: cc1 Not tainted 5.6.17+ #3 Hardware name: 9000/800/rp3440 IAOQ[0]: d_alloc_parallel+0x384/0x688 IAOQ[1]: d_alloc_parallel+0x388/0x688 RP(r2): d_alloc_parallel+0x134/0x688 Backtrace: [<000000004036974c>] __lookup_slow+0xa4/0x200 [<0000000040369fc8>] walk_component+0x288/0x458 [<000000004036a9a0>] path_lookupat+0x88/0x198 [<000000004036e748>] filename_lookup+0xa0/0x168 [<000000004036e95c>] user_path_at_empty+0x64/0x80 [<000000004035d93c>] vfs_statx+0x104/0x158 [<000000004035dfcc>] __do_sys_lstat64+0x44/0x80 [<000000004035e5a0>] sys_lstat64+0x20/0x38 [<0000000040180054>] syscall_exit+0x0/0x14
The code was stuck in this loop in d_alloc_parallel:
4037d414: 0e 00 10 dc ldd 0(r16),ret0
4037d418: c7 fc 5f ed bb,< ret0,1f,4037d414 <d_alloc_parallel+0x384>
4037d41c: 08 00 02 40 nopThis is the inner loop of bit_spin_lock which is called by hlist_bl_unlock in d_alloc_parallel:
static inline void bit_spin_lock(int bitnum, unsigned long *addr) {
/*
* Assuming the lock is uncontended, this never enters
* the body of the outer loop. If it is contended, then
* within the inner loop a non-atomic test is used to
* busywait with less bus contention for a good time to
* attempt to acquire the lock bit.
*/
preempt_disable();
#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
while (unlikely(test_and_set_bit_lock(bitnum, addr))) {
preempt_enable();
do {
cpu_relax();
} while (test_bit(bitnum, addr));
preempt_disable();
}
#endif
__acquire(bitlock);
}After consideration, I realized that we must be losing bit unlocks. Then, I noticed that we missed defining atomic64_set_release(). Adding this define fixes the stalls in bit operations.
--- arch/parisc/include/asm/atomic.h | 2 ++ 1 file changed, 2 insertions(+)
arch/parisc/include/asm/atomic.h +2 -0
@@ -212,6 +212,8 @@ atomic64_set(atomic64_t *v, s64 i)_atomic_spin_unlock_irqrestore (v, flags); } +#define atomic64_set_release (v, i) atomic64_set((v), (i)) +static __inline__s64 atomic64_read (const atomic64_t *v) {
Greg Kroah-Hartman
maintainerPATCH 131/138 x86, vmlinux.lds: Page-align end of ..page_aligned sections
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
commit de2b41be8fcccb2f5b6c480d35df590476344201 upstream.
On x86-32 the idt_table with 256 entries needs only 2048 bytes. It is page-aligned, but the end of the .bss..page_aligned section is not guaranteed to be page-aligned.
As a result, objects from other .bss sections may end up on the same 4k page as the idt_table, and will accidentially get mapped read-only during boot, causing unexpected page-faults when the kernel writes to them.
This could be worked around by making the objects in the page aligned sections page sized, but that's wrong.
Explicit sections which store only page aligned objects have an implicit guarantee that the object is alone in the page in which it is placed. That works for all objects except the last one. That's inconsistent.
Enforcing page sized objects for these sections would wreckage memory sanitizers, because the object becomes artificially larger than it should be and out of bound access becomes legit.
Align the end of the .bss..page_aligned and .data..page_aligned section on page-size so all objects places in these sections are guaranteed to have their own page.
[ tglx: Amended changelog ]
--- arch/x86/kernel/vmlinux.lds.S | 1 + include/asm-generic/vmlinux.lds.h | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
arch/x86/kernel/vmlinux.lds.S +1 -0
@@ -362,6 +362,7 @@ SECTIONS .bss : AT(ADDR(.bss) - LOAD_OFFSET) { __bss_start = .; *(.bss..page_aligned) + . = ALIGN(PAGE_SIZE); *(BSS_MAIN) BSS_DECRYPTED . = ALIGN(PAGE_SIZE);
include/asm-generic/vmlinux.lds.h +4 -1
@@ -306,7 +306,8 @@#define PAGE_ALIGNED_DATA (page_align) \ . = ALIGN(page_align); \ - *(.data..page_aligned) + *(.data..page_aligned) \ + . = ALIGN(page_align);#define READ_MOSTLY_DATA (align) \ . = ALIGN(align); \
@@ -695,7 +696,9 @@ . = ALIGN(bss_align); \ .bss : AT(ADDR(.bss) - LOAD_OFFSET) { \BSS_FIRST_SECTIONS \ + . = ALIGN(PAGE_SIZE); \ *(.bss..page_aligned) \ + . = ALIGN(PAGE_SIZE); \ *(.dynbss) \ *(BSS_MAIN ) \ *(COMMON ) \
Greg Kroah-Hartman
maintainerPATCH 132/138 ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 85ca6b17e2bb96b19caac3b02c003d670b66de96 upstream.
The Lenovo Miix 2 10 has a keyboard dock with extra speakers in the dock. Rather then the ACL5672's GPIO1 pin being used as IRQ to the CPU, it is actually used to enable the amplifier for these speakers
(the IRQ to the CPU comes directly from the jack-detect switch).
Add a quirk for having an ext speaker-amplifier enable pin on GPIO1 and replace the Lenovo Miix 2 10's dmi_system_id table entry's wrong GPIO_DEV quirk (which needs to be renamed to GPIO1_IS_IRQ) with the new RT5670_GPIO1_IS_EXT_SPK_EN quirk, so that we enable the external speaker-amplifier as necessary.
Also update the ident field for the dmi_system_id table entry, the Miix models are not Thinkpads.
--- include/sound/rt5670.h | 1 sound/soc/codecs/rt5670.c | 71 ++++++++++++++++++++++++++++++++++++---------- 2 files changed, 57 insertions(+), 15 deletions(-)
include/sound/rt5670.h +1 -0
@@ -12,6 +12,7 @@ struct rt5670_platform_data {int jd_mode;bool in2_diff;bool dev_gpio; +bool gpio1_is_ext_spk_en;bool dmic_en;unsigned int dmic1_data_pin;
sound/soc/codecs/rt5670.c +56 -15
113 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 133/138 ASoC: qcom: Drop HAS_DMA dependency to fix link failure
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit b6aa06de7757667bac88997a8807b143b8436035 upstream.
When building on allyesconfig kernel for a NO_DMA=y platform (e.g. Sun-3), CONFIG_SND_SOC_QCOM_COMMON=y, but CONFIG_SND_SOC_QDSP6_AFE=n, leading to a link failure:
sound/soc/qcom/common.o: In function `qcom_snd_parse_of':
common.c:(.text+0x2e2): undefined reference to `q6afe_is_rx_port'
While SND_SOC_QDSP6 depends on HAS_DMA, SND_SOC_MSM8996 and SND_SOC_SDM845 don't, so the following warning is seen:
WARNING: unmet direct dependencies detected for SND_SOC_QDSP6
Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && QCOM_APR [=y] && HAS_DMA [=n]
Selected by [y]:
- SND_SOC_MSM8996 [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && QCOM_APR [=y]
- SND_SOC_SDM845 [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && QCOM_APR [=y] && CROS_EC [=y] && I2C [=y] && SOUNDWIRE [=y]
Until recently, this warning was harmless (from a compile-testing point-of-view), but the new user of q6afe_is_rx_port() turned this into a hard failure.
As the QDSP6 driver itself builds fine if NO_DMA=y, and it depends on QCOM_APR (which in turns depends on ARCH_QCOM || COMPILE_TEST), it is safe to increase compile testing coverage. Hence fix the link failure by dropping the HAS_DMA dependency of SND_SOC_QDSP6.
--- sound/soc/qcom/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/qcom/Kconfig +1 -1
@@ -72,7 +72,7 @@ config SND_SOC_QDSP6_ASM_DAI config SND_SOC_QDSP6 tristate "SoC ALSA audio driver for QDSP6" - depends on QCOM_APR && HAS_DMA + depends on QCOM_APR select SND_SOC_QDSP6_COMMON select SND_SOC_QDSP6_CORE select SND_SOC_QDSP6_AFE
Greg Kroah-Hartman
maintainerPATCH 134/138 ASoC: topology: fix kernel oops on route addition error
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
commit 6f0307df83f2aa6bdf656c2219c89ce96502d20e upstream.
When errors happens while loading graph components, the kernel oopses while trying to remove all topology components. This can be root-caused to a list pointing to memory that was already freed on error.
remove_route() is already called on errors and will perform the required cleanups so there's no need to free the route memory in soc_tplg_dapm_graph_elems_load() if the route was added to the list. We do however want to free the routes allocated but not added to the list.
--- sound/soc/soc-topology.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
sound/soc/soc-topology.c +17 -5
@@ -1284,17 +1284,29 @@ static int soc_tplg_dapm_graph_elems_loalist_add (&routes[i]->dobj.list, &tplg->comp->dobj_list); ret =soc_tplg_add_route (tplg, routes[i]); -if (ret <0 ) +if (ret <0 ) { +/* +* this route was added to the list, it will +* be freed in remove_route() so increment the +* counter to skip it in the error handling +* below. +*/ + i++;break ; + }/* add route, but keep going if some fail */ snd_soc_dapm_add_routes (dapm, routes[i],1 ); } -/* free memory allocated for all dapm routes in case of error */ -if (ret <0 ) -for (i =0 ; i < count ; i++) -kfree (routes[i]); +/* +* free memory allocated for all dapm routes not added to the +* list in case of error +*/ +if (ret <0 ) { +while (i < count) +kfree (routes[i++]); + }/* * free pointer to array of dapm routes as this is no longer needed.
Greg Kroah-Hartman
maintainerPATCH 135/138 ASoC: topology: fix tlvs in error handling for widget_dmixer
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
commit 8edac489e7c3fce44208373bb3e7b5835a672c66 upstream.
we need to free all allocated tlvs, not just the one allocated in the loop before releasing kcontrols - other the tlvs references will leak.
--- sound/soc/soc-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-topology.c +1 -1
@@ -1394,7 +1394,6 @@ static struct snd_kcontrol_new *soc_tplgif (err <0 ) {dev_err (tplg->dev,"ASoC: failed to init %s\n" , mc->hdr.name); -soc_tplg_free_tlv (tplg, &kc[i]); goto err_sm; } }
@@ -1402,6 +1401,7 @@ static struct snd_kcontrol_new *soc_tplg err_sm:for (; i >=0 ; i--) { +soc_tplg_free_tlv (tplg, &kc[i]); sm = (struct soc_mixer_control *)kc[i].private_value;kfree (sm);kfree (kc[i].name);
Greg Kroah-Hartman
maintainerPATCH 136/138 dm integrity: fix integrity recalculation that is improperly skipped
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 5df96f2b9f58a5d2dc1f30fe7de75e197f2c25f2 upstream.
Commit adc0daad366b62ca1bce3e2958a40b0b71a8b8b3 ("dm: report suspended device during destroy") broke integrity recalculation.
The problem is dm_suspended() returns true not only during suspend, but also during resume. So this race condition could occur:
1. dm_integrity_resume calls queue_work(ic->recalc_wq, &ic->recalc_work)
2. integrity_recalc (&ic->recalc_work) preempts the current thread
3. integrity_recalc calls if (unlikely(dm_suspended(ic->ti))) goto unlock_ret;
4. integrity_recalc exits and no recalculating is done.
To fix this race condition, add a function dm_post_suspending that is only true during the postsuspend phase and use it instead of dm_suspended().
--- drivers/md/dm-integrity.c | 4 ++-- drivers/md/dm.c | 17 +++++++++++++++++ include/linux/device-mapper.h | 1 + 3 files changed, 20 insertions(+), 2 deletions(-)
drivers/md/dm-integrity.c +2 -2
@@ -2298,7 +2298,7 @@ static void integrity_writer(struct workunsigned prev_free_sectors;/* the following test is not needed, but it tests the replay code */ -if (unlikely (dm_suspended (ic->ti)) && !ic->meta_dev) +if (unlikely (dm_post_suspending (ic->ti)) && !ic->meta_dev)return ;spin_lock_irq (&ic->endio_wait.lock);
@@ -2359,7 +2359,7 @@ static void integrity_recalc(struct work next_chunk: -if (unlikely (dm_suspended (ic->ti))) +if (unlikely (dm_post_suspending (ic->ti))) goto unlock_ret; range.logical_sector =le64_to_cpu (ic->sb->recalc_sector);
drivers/md/dm.c +17 -0
@@ -141,6 +141,7 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_#define DMF_NOFLUSH_SUSPENDING 5#define DMF_DEFERRED_REMOVE 6#define DMF_SUSPENDED_INTERNALLY 7 +#define DMF_POST_SUSPENDING 8#define DM_NUMA_NODE NUMA_NO_NODEstatic int dm_numa_node =DM_NUMA_NODE ;
@@ -2377,6 +2378,7 @@ static void __dm_destroy(struct mapped_dif (!dm_suspended_md (md)) {dm_table_presuspend_targets (map);set_bit (DMF_SUSPENDED , &md->flags); +set_bit (DMF_POST_SUSPENDING , &md->flags);dm_table_postsuspend_targets (map); }/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
@@ -2735,7 +2737,9 @@ retry:if (r) goto out_unlock; +set_bit (DMF_POST_SUSPENDING , &md->flags);dm_table_postsuspend_targets (map); +clear_bit (DMF_POST_SUSPENDING , &md->flags); out_unlock:mutex_unlock (&md->suspend_lock);
@@ -2832,7 +2836,9 @@ static void __dm_internal_suspend(struct (void )__dm_suspend (md, map, suspend_flags,TASK_UNINTERRUPTIBLE ,DMF_SUSPENDED_INTERNALLY ); +set_bit (DMF_POST_SUSPENDING , &md->flags);dm_table_postsuspend_targets (map); +clear_bit (DMF_POST_SUSPENDING , &md->flags); }static void __dm_internal_resume (struct mapped_device *md)
@@ -2993,6 +2999,11 @@ int dm_suspended_md(struct mapped_devicereturn test_bit (DMF_SUSPENDED , &md->flags); } +static int dm_post_suspending_md (struct mapped_device *md) +{ +return test_bit (DMF_POST_SUSPENDING , &md->flags); +} +int dm_suspended_internally_md (struct mapped_device *md) {return test_bit (DMF_SUSPENDED_INTERNALLY , &md->flags);
@@ -3009,6 +3020,12 @@ int dm_suspended(struct dm_target *ti) }EXPORT_SYMBOL_GPL (dm_suspended); +int dm_post_suspending (struct dm_target *ti) +{ +return dm_post_suspending_md (dm_table_get_md (ti->table)); +} +EXPORT_SYMBOL_GPL (dm_post_suspending); +int dm_noflush_suspending (struct dm_target *ti) {return __noflush_suspending (dm_table_get_md (ti->table));
include/linux/device-mapper.h +1 -0
@@ -422,6 +422,7 @@ const char *dm_device_name(struct mappedint dm_copy_name_and_uuid (struct mapped_device *md,char *name,char *uuid);struct gendisk *dm_disk (struct mapped_device *md);int dm_suspended (struct dm_target *ti); +int dm_post_suspending (struct dm_target *ti);int dm_noflush_suspending (struct dm_target *ti);void dm_accept_partial_bio (struct bio *bio,unsigned n_sectors); void dm_remap_zone_report(struct dm_target *ti, sector_t start,
Greg Kroah-Hartman
maintainerPATCH 137/138 ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.
In ath9k_hif_usb_rx_cb interface number is assumed to be 0. usb_ifnum_to_if(urb->dev, 0)
But it isn't always true.
The case reported by syzbot:
https://lore.kernel.org/linux-usb/[email protected]
usb 2-1: new high-speed USB device number 2 using dummy_hcd usb 2-1: config 1 has an invalid interface number: 2 but max is 0 usb 2-1: config 1 has no interface number 0
usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
general protection fault, probably for non-canonical address 0xdffffc0000000015: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc5-syzkaller #0
Call Trace
__usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716 dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966 call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786 __do_softirq+0x21e/0x950 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x178/0x1a0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x141/0x540 arch/x86/kernel/apic/apic.c:1146 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 48 +++++++++++++++++++++++-------- drivers/net/wireless/ath/ath9k/hif_usb.h | 5 +++ 2 files changed, 42 insertions(+), 11 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +37 -11
@@ -643,9 +643,9 @@ err:static void ath9k_hif_usb_rx_cb (struct urb *urb) { -struct sk_buff *skb = (struct sk_buff *) urb->context; -struct hif_device_usb *hif_dev = -usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 )); +struct rx_buf *rx_buf = (struct rx_buf *)urb->context; +struct hif_device_usb *hif_dev = rx_buf->hif_dev; +struct sk_buff *skb = rx_buf->skb;int ret;if (!skb)
@@ -685,14 +685,15 @@ resubmit:return ; free:kfree_skb (skb); +kfree (rx_buf); }static void ath9k_hif_usb_reg_in_cb (struct urb *urb) { -struct sk_buff *skb = (struct sk_buff *) urb->context; +struct rx_buf *rx_buf = (struct rx_buf *)urb->context; +struct hif_device_usb *hif_dev = rx_buf->hif_dev; +struct sk_buff *skb = rx_buf->skb;struct sk_buff *nskb; -struct hif_device_usb *hif_dev = -usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 ));int ret;if (!skb)
@@ -750,6 +751,7 @@ resubmit:return ; free:kfree_skb (skb); +kfree (rx_buf); urb->context =NULL ; }
@@ -795,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(sinit_usb_anchor (&hif_dev->mgmt_submitted);for (i =0 ; i <MAX_TX_URB_NUM ; i++) { - tx_buf =kzalloc (sizeof (struct tx_buf ),GFP_KERNEL ); + tx_buf =kzalloc (sizeof (*tx_buf),GFP_KERNEL );if (!tx_buf) goto err;
@@ -832,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urbstatic int ath9k_hif_usb_alloc_rx_urbs (struct hif_device_usb *hif_dev) { -struct urb *urb =NULL ; +struct rx_buf *rx_buf =NULL ;struct sk_buff *skb =NULL ; +struct urb *urb =NULL ;int i, ret;init_usb_anchor (&hif_dev->rx_submitted);
@@ -841,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(sfor (i =0 ; i <MAX_RX_URB_NUM ; i++) { + rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); +if (!rx_buf) { + ret = -ENOMEM ; + goto err_rxb; + } +/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -855,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(s goto err_skb; } + rx_buf->hif_dev = hif_dev; + rx_buf->skb = skb; +usb_fill_bulk_urb (urb, hif_dev->udev,usb_rcvbulkpipe (hif_dev->udev,USB_WLAN_RX_PIPE ), skb->data,MAX_RX_BUF_SIZE , - ath9k_hif_usb_rx_cb, skb); + ath9k_hif_usb_rx_cb, rx_buf);/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->rx_submitted);
@@ -885,6 +897,8 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: +kfree (rx_buf); +err_rxb:ath9k_hif_usb_dealloc_rx_urbs (hif_dev);return ret; }
@@ -896,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_instatic int ath9k_hif_usb_alloc_reg_in_urbs (struct hif_device_usb *hif_dev) { -struct urb *urb =NULL ; +struct rx_buf *rx_buf =NULL ;struct sk_buff *skb =NULL ; +struct urb *urb =NULL ;int i, ret;init_usb_anchor (&hif_dev->reg_in_submitted);for (i =0 ; i <MAX_REG_IN_URB_NUM ; i++) { + rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); +if (!rx_buf) { + ret = -ENOMEM ; + goto err_rxb; + } +/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -918,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_ur goto err_skb; } + rx_buf->hif_dev = hif_dev; + rx_buf->skb = skb; +usb_fill_int_urb (urb, hif_dev->udev,usb_rcvintpipe (hif_dev->udev,USB_REG_IN_PIPE ), skb->data,MAX_REG_IN_BUF_SIZE , - ath9k_hif_usb_reg_in_cb, skb,1 ); + ath9k_hif_usb_reg_in_cb, rx_buf,1 );/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->reg_in_submitted);
@@ -948,6 +972,8 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: +kfree (rx_buf); +err_rxb:ath9k_hif_usb_dealloc_reg_in_urbs (hif_dev);return ret; }
drivers/net/wireless/ath/ath9k/hif_usb.h +5 -0
@@ -86,6 +86,11 @@ struct tx_buf {struct list_head list; }; +struct rx_buf { +struct sk_buff *skb; +struct hif_device_usb *hif_dev; +}; +#define HIF_USB_TX_STOP BIT(0)#define HIF_USB_TX_FLUSH BIT(1)
Greg Kroah-Hartman
maintainerPATCH 138/138 ath9k: Fix regression with Atheros 9271
In reply to Greg Kroah-HartmanFrom: Mark O'Donovan <[email protected]>
commit 92f53e2fda8bb9a559ad61d57bfb397ce67ed0ab upstream.
This fix allows ath9k_htc modules to connect to WLAN once again.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +3 -1
@@ -733,11 +733,13 @@ static void ath9k_hif_usb_reg_in_cb(strureturn ; } + rx_buf->skb = nskb; +usb_fill_int_urb (urb, hif_dev->udev,usb_rcvintpipe (hif_dev->udev,USB_REG_IN_PIPE ), nskb->data,MAX_REG_IN_BUF_SIZE , - ath9k_hif_usb_reg_in_cb, nskb,1 ); + ath9k_hif_usb_reg_in_cb, rx_buf,1 ); } resubmit:
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.54 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.54-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.4:
11 builds: 11 pass, 0 fail
26 boots: 26 pass, 0 fail
56 tests: 56 pass, 0 failLinux version: 5.4.54-rc1-ga41a538926d2
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Thierry
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.54 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.54-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.54 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.54-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 5.4.54-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.4.y
git commit: 7a4613493cc30754cf5159b126623d26314454bd
git describe: v5.4.53-139-g7a4613493cc3
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.4-oe/build/v5.4.53-139-g7a4613493cc3
No regressions (compared to build v5.4.53)
No fixes (compared to build v5.4.53)
Ran 35091 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- juno-r2-compat
- juno-r2-kasan
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* install-android-platform-tools-r2800
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-io-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* v4l2-compliance
* kselftest
* kselftest/drivers
* kselftest/filesystems
* ltp-containers-tests
* ltp-controllers-tests
* ltp-hugetlb-tests
* ltp-ipc-tests
* ltp-mm-tests
* network-basic-tests
* kselftest/net
* ltp-fs-tests
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-native/drivers
* kselftest-vsyscall-mode-native/filesystems
* kselftest-vsyscall-mode-native/net
* kselftest-vsyscall-mode-none
* kselftest-vsyscall-mode-none/drivers
* kselftest-vsyscall-mode-none/filesystems
* kselftest-vsyscall-mode-none/net
* ssuite
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.54 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Jul 2020 13:48:51 +0000. Anything received after that time might be too late.
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 430 pass: 430 fail: 0
Guenter