4.9.237-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.9.237-rc1 review
This is the start of the stable review cycle for the 4.9.237 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Sep 2020 16:20:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.237-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.237-rc1
Adam Borowski <[email protected]>
x86/defconfig: Enable CONFIG_USB_XHCI_HCD=y
Alexey Kardashevskiy <[email protected]>
powerpc/dma: Fix dma_map_ops::get_required_mask
Quentin Perret <[email protected]>
ehci-hcd: Move include to keep CRC stable
Tobias Diedrich <[email protected]>
serial: 8250_pci: Add Realtek 816a and 816b
Hans de Goede <[email protected]>
Input: i8042 - add Entroware Proteus EL07R4 to nomux and reset lists
Oliver Neukum <[email protected]>
usblp: fix race between disconnect() and read()
Oliver Neukum <[email protected]>
USB: UAS: fix disconnect by unplugging a hub
Penghao <[email protected]>
USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin notebook
Yu Kuai <[email protected]>
drm/mediatek: Add exception handing in mtk_drm_probe() if component init fail
Thomas Bogendoerfer <[email protected]>
MIPS: SNI: Fix spurious interrupts
Tetsuo Handa <[email protected]>
fbcon: Fix user font detection test at fbcon_resize().
Namhyung Kim <[email protected]>
perf test: Free formats for perf pmu parse test
Thomas Bogendoerfer <[email protected]>
MIPS: SNI: Fix MIPS_L1_CACHE_SHIFT
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
Nathan Chancellor <[email protected]>
clk: rockchip: Fix initialization of mux_pll_src_4plls_p
Evan Nimmo <[email protected]>
i2c: algo: pca: Reapply i2c bus settings after reset
Laurent Pinchart <[email protected]>
rapidio: Replace 'select' DMAENGINES 'with depends on'
J. Bruce Fields <[email protected]>
SUNRPC: stop printk reading past end of string
Vincent Whitchurch <[email protected]>
spi: spi-loopback-test: Fix out-of-bounds read
James Smart <[email protected]>
scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery
Dinghao Liu <[email protected]>
scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort
Olga Kornievskaia <[email protected]>
NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall
Miaohe Lin <[email protected]>
net: handle the return value of pskb_carve_frag_list() correctly
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 10.1
Yi Zhang <[email protected]>
RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars
Bart Van Assche <[email protected]>
IB/rxe: Remove a pointless indirection layer
Mathias Nyman <[email protected]>
usb: Fix out of sync data toggle if a configured device is reconfigured
Aleksander Morgado <[email protected]>
USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules
Patrick Riphagen <[email protected]>
USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter
Zeng Tao <[email protected]>
usb: core: fix slab-out-of-bounds Read in read_descriptors
Vaibhav Agarwal <[email protected]>
staging: greybus: audio: fix uninitialized value issue
Tetsuo Handa <[email protected]>
video: fbdev: fix OOB read in vga_8planes_imageblit()
Wanpeng Li <[email protected]>
KVM: VMX: Don't freeze guest when event delivery causes an APIC-access exit
Linus Torvalds <[email protected]>
vgacon: remove software scrollback support
Linus Torvalds <[email protected]>
fbcon: remove now unusued 'softback_lines' cursor() argument
Linus Torvalds <[email protected]>
fbcon: remove soft scrollback code
Ilya Dryomov <[email protected]>
rbd: require global CAP_SYS_ADMIN for mapping and unmapping
Hou Pu <[email protected]>
scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem
Varun Prakash <[email protected]>
scsi: target: iscsi: Fix data digest calculation
Michał Mirosław <[email protected]>
regulator: push allocation in set_consumer_device_supply() out of lock
Filipe Manana <[email protected]>
btrfs: fix wrong address when faulting in pages in the search ioctl
Rustam Kovhaev <[email protected]>
staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()
Johan Hovold <[email protected]>
USB: core: add helpers to retrieve endpoints
Jonathan Cameron <[email protected]>
iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
Jonathan Cameron <[email protected]>
iio:accel:mma7455: Fix timestamp alignment and prevent data leak.
Jonathan Cameron <[email protected]>
iio: accel: kxsd9: Fix alignment of local buffer.
Jonathan Cameron <[email protected]>
iio:light:max44000 Fix timestamp alignment and prevent data leak.
Jonathan Cameron <[email protected]>
iio:magnetometer:ak8975 Fix alignment and data leak issues.
Sandhya Bankar <[email protected]>
drivers: iio: magnetometer: Fix sparse endianness warnings cast to restricted __be16
Jonathan Cameron <[email protected]>
iio:adc:ti-adc081c Fix alignment and data leak issues
Jonathan Cameron <[email protected]>
iio:adc:ina2xx Fix timestamp alignment issue.
Jonathan Cameron <[email protected]>
iio:accel:bmc150-accel: Fix timestamp alignment and prevent data leak.
Jonathan Cameron <[email protected]>
iio:light:ltr501 Fix timestamp alignment issue.
Maxim Kochetkov <[email protected]>
iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
Angelo Compagnucci <[email protected]>
iio: adc: mcp3422: fix locking on error path
Angelo Compagnucci <[email protected]>
iio: adc: mcp3422: fix locking scope
Leon Romanovsky <[email protected]>
gcov: Disable gcov build with GCC 10
Rander Wang <[email protected]>
ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
Xie He <[email protected]>
drivers/net/wan/hdlc_cisco: Add hard_header_len
Vineet Gupta <[email protected]>
irqchip/eznps: Fix build error for !ARC700 builds
Darrick J. Wong <[email protected]>
xfs: initialize the shortform attr header padding entry
Xie He <[email protected]>
drivers/net/wan/lapbether: Set network_header before transmitting
Mohan Kumar <[email protected]>
ALSA: hda: Fix 2 channel swapping for Tegra
Dinghao Liu <[email protected]>
firestream: Fix memleak in fs_open
Dinghao Liu <[email protected]>
NFC: st95hf: Fix memleak in st95hf_in_send_cmd
Xie He <[email protected]>
drivers/net/wan/lapbether: Added needed_tailroom
Luo Jiaxing <[email protected]>
scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
Kamal Heib <[email protected]>
RDMA/rxe: Drop pointless checks in rxe_init_ports
Dinghao Liu <[email protected]>
RDMA/rxe: Fix memleak in rxe_mem_init_user
Dinh Nguyen <[email protected]>
ARM: dts: socfpga: fix register entry for timer3 on Arria10
-------------
Diffstat:
Makefile | 4 +- arch/arc/plat-eznps/include/plat/ctop.h | 1 - arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- arch/mips/Kconfig | 1 + arch/mips/sni/a20r.c | 9 +- arch/powerpc/configs/pasemi_defconfig | 1 - arch/powerpc/configs/ppc6xx_defconfig | 1 - arch/powerpc/kernel/dma-iommu.c | 3 +- arch/x86/configs/i386_defconfig | 2 +- arch/x86/configs/x86_64_defconfig | 2 +- arch/x86/kvm/vmx.c | 1 + drivers/atm/firestream.c | 1 + drivers/block/rbd.c | 12 ++ drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 7 +- drivers/hv/channel_mgmt.c | 7 +- drivers/i2c/algos/i2c-algo-pca.c | 35 ++-- drivers/iio/accel/bmc150-accel-core.c | 15 +- drivers/iio/accel/kxsd9.c | 16 +- drivers/iio/accel/mma7455_core.c | 16 +- drivers/iio/accel/mma8452.c | 11 +- drivers/iio/adc/ina2xx-adc.c | 11 +- drivers/iio/adc/mcp3422.c | 16 +- drivers/iio/adc/ti-adc081c.c | 11 +- drivers/iio/adc/ti-ads1015.c | 10 + drivers/iio/light/ltr501.c | 15 +- drivers/iio/light/max44000.c | 12 +- drivers/iio/magnetometer/ak8975.c | 26 ++- drivers/infiniband/sw/rxe/rxe.c | 5 +- drivers/infiniband/sw/rxe/rxe_loc.h | 20 +- drivers/infiniband/sw/rxe/rxe_mcast.c | 4 +- drivers/infiniband/sw/rxe/rxe_mr.c | 1 + drivers/infiniband/sw/rxe/rxe_net.c | 43 ++-- drivers/infiniband/sw/rxe/rxe_req.c | 4 +- drivers/infiniband/sw/rxe/rxe_resp.c | 4 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 10 +- drivers/infiniband/sw/rxe/rxe_verbs.h | 22 -- drivers/input/serio/i8042-x86ia64io.h | 16 ++ drivers/net/wan/hdlc_cisco.c | 1 + drivers/net/wan/lapbether.c | 3 + drivers/nfc/st95hf/core.c | 2 +- drivers/rapidio/Kconfig | 2 +- drivers/regulator/core.c | 46 ++-- drivers/scsi/libsas/sas_ata.c | 5 +- drivers/scsi/lpfc/lpfc_els.c | 4 +- drivers/scsi/pm8001/pm8001_sas.c | 2 +- drivers/spi/spi-loopback-test.c | 2 +- drivers/staging/greybus/audio_topology.c | 29 +-- drivers/staging/wlan-ng/hfa384x_usb.c | 5 - drivers/staging/wlan-ng/prism2usb.c | 19 +- drivers/target/iscsi/iscsi_target.c | 17 +- drivers/target/iscsi/iscsi_target_login.c | 6 +- drivers/target/iscsi/iscsi_target_login.h | 3 +- drivers/target/iscsi/iscsi_target_nego.c | 3 +- drivers/tty/serial/8250/8250_pci.c | 11 + drivers/usb/class/usblp.c | 5 + drivers/usb/core/message.c | 91 ++++---- drivers/usb/core/quirks.c | 4 + drivers/usb/core/sysfs.c | 5 + drivers/usb/core/usb.c | 83 ++++++++ drivers/usb/host/ehci-hcd.c | 1 + drivers/usb/host/ehci-hub.c | 1 - drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/option.c | 2 + drivers/usb/storage/uas.c | 14 +- drivers/video/console/Kconfig | 25 --- drivers/video/console/bitblit.c | 11 +- drivers/video/console/fbcon.c | 336 +----------------------------- drivers/video/console/fbcon.h | 2 +- drivers/video/console/fbcon_ccw.c | 11 +- drivers/video/console/fbcon_cw.c | 11 +- drivers/video/console/fbcon_ud.c | 11 +- drivers/video/console/tileblit.c | 2 +- drivers/video/console/vgacon.c | 159 +------------- drivers/video/fbdev/vga16fb.c | 2 +- fs/btrfs/ioctl.c | 3 +- fs/nfs/nfs4proc.c | 7 +- fs/xfs/libxfs/xfs_attr_leaf.c | 4 +- include/linux/i2c-algo-pca.h | 15 ++ include/linux/usb.h | 35 ++++ include/soc/nps/common.h | 6 + kernel/gcov/gcc_4_7.c | 4 +- net/core/skbuff.c | 10 +- net/sunrpc/rpcb_clnt.c | 4 +- sound/hda/hdac_device.c | 2 + sound/pci/hda/patch_hdmi.c | 5 + tools/perf/tests/pmu.c | 1 + tools/perf/util/pmu.c | 11 + tools/perf/util/pmu.h | 1 + 90 files changed, 595 insertions(+), 830 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/70 ARM: dts: socfpga: fix register entry for timer3 on Arria10
From: Dinh Nguyen <[email protected]>
[ Upstream commit 0ff5a4812be4ebd4782bbb555d369636eea164f7 ]
Fixes the register address for the timer3 entry on Arria10.
--- arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/socfpga_arria10.dtsi +1 -1
@@ -710,7 +710,7 @@ timer3: timer3@ffd00100 { compatible = "snps,dw-apb-timer"; interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>; - reg = <0xffd01000 0x100>; + reg = <0xffd00100 0x100>; clocks = <&l4_sys_free_clk>; clock-names = "timer"; };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 2/70 RDMA/rxe: Fix memleak in rxe_mem_init_user
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit e3ddd6067ee62f6e76ebcf61ff08b2c729ae412b ]
When page_address() fails, umem should be freed just like when rxe_mem_alloc() fails.
--- drivers/infiniband/sw/rxe/rxe_mr.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/sw/rxe/rxe_mr.c +1 -0
@@ -205,6 +205,7 @@ int rxe_mem_init_user(struct rxe_dev *rxe, struct rxe_pd *pd, u64 start, vaddr =page_address (sg_page (sg));if (!vaddr) {pr_warn ("null vaddr\n" ); +ib_umem_release (umem); err = -ENOMEM ; goto err1; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/70 RDMA/rxe: Drop pointless checks in rxe_init_ports
In reply to Greg Kroah-HartmanFrom: Kamal Heib <[email protected]>
[ Upstream commit 6112ef62826e91afbae5446d5d47b38e25f47e3f ]
Both pkey_tbl_len and gid_tbl_len are set in rxe_init_port_param() - so no need to check if they aren't set.
--- drivers/infiniband/sw/rxe/rxe.c | 3 --- 1 file changed, 3 deletions(-)
drivers/infiniband/sw/rxe/rxe.c +0 -3
@@ -168,9 +168,6 @@ static int rxe_init_ports(struct rxe_dev *rxe)rxe_init_port_param (port); -if (!port->attr.pkey_tbl_len || !port->attr.gid_tbl_len) -return -EINVAL ; - port->pkey_tbl =kcalloc (port->attr.pkey_tbl_len,sizeof (*port->pkey_tbl),GFP_KERNEL );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/70 scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
In reply to Greg Kroah-HartmanFrom: Luo Jiaxing <[email protected]>
[ Upstream commit 53de092f47ff40e8d4d78d590d95819d391bf2e0 ]
It was discovered that sdparm will fail when attempting to disable write cache on a SATA disk connected via libsas.
In the ATA command set the write cache state is controlled through the SET FEATURES operation. This is roughly corresponds to MODE SELECT in SCSI and the latter command is what is used in the SCSI-ATA translation layer. A subtle difference is that a MODE SELECT carries data whereas SET FEATURES is defined as a non-data command in ATA.
Set the DMA data direction to DMA_NONE if the requested ATA command is identified as non-data.
[mkp: commit desc]
--- drivers/scsi/libsas/sas_ata.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/scsi/libsas/sas_ata.c +4 -1
@@ -227,7 +227,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc) task->num_scatter = si; } - task->data_dir = qc->dma_dir; +if (qc->tf.protocol ==ATA_PROT_NODATA ) + task->data_dir =DMA_NONE ; +else + task->data_dir = qc->dma_dir; task->scatter = qc->sg; task->ata_task.retry_count =1 ; task->task_state_flags =SAS_TASK_STATE_PENDING ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/70 drivers/net/wan/lapbether: Added needed_tailroom
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 1ee39c1448c4e0d480c5b390e2db1987561fb5c2 ]
The underlying Ethernet device may request necessary tailroom to be allocated by setting needed_tailroom. This driver should also set needed_tailroom to request the tailroom needed by the underlying Ethernet device to be allocated.
--- drivers/net/wan/lapbether.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wan/lapbether.c +1 -0
@@ -343,6 +343,7 @@ static int lapbeth_new_device(struct net_device *dev)*/ ndev->needed_headroom =-1 +3 +2 + dev->hard_header_len + dev->needed_headroom; + ndev->needed_tailroom = dev->needed_tailroom; lapbeth =netdev_priv (ndev); lapbeth->axdev = ndev;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/70 NFC: st95hf: Fix memleak in st95hf_in_send_cmd
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit f97c04c316d8fea16dca449fdfbe101fbdfee6a2 ]
When down_killable() fails, skb_resp should be freed just like when st95hf_spi_send() fails.
--- drivers/nfc/st95hf/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nfc/st95hf/core.c +1 -1
@@ -981,7 +981,7 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev, rc =down_killable (&stcontext->exchange_lock);if (rc) {WARN (1 ,"Semaphore is not found up in st95hf_in_send_cmd\n" ); -return rc; + goto free_skb_resp; } rc = st95hf_spi_send(&stcontext->spicontext, skb->data,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/70 firestream: Fix memleak in fs_open
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 15ac5cdafb9202424206dc5bd376437a358963f9 ]
When make_rate() fails, vcc should be freed just like other error paths in fs_open().
--- drivers/atm/firestream.c | 1 + 1 file changed, 1 insertion(+)
drivers/atm/firestream.c +1 -0
@@ -1013,6 +1013,7 @@ static int fs_open(struct atm_vcc *atm_vcc) error =make_rate (pcr, r, &tmc0,NULL );if (error) {kfree (tc); +kfree (vcc);return error; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/70 ALSA: hda: Fix 2 channel swapping for Tegra
In reply to Greg Kroah-HartmanFrom: Mohan Kumar <[email protected]>
[ Upstream commit 216116eae43963c662eb84729507bad95214ca6b ]
The Tegra HDA codec HW implementation has an issue related to not swapping the 2 channel Audio Sample Packet(ASP) channel mapping. Whatever the FL and FR mapping specified the left channel always comes out of left speaker and right channel on right speaker. So add condition to disallow the swapping of FL,FR during the playback.
--- sound/pci/hda/patch_hdmi.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/pci/hda/patch_hdmi.c +5 -0
@@ -3224,6 +3224,7 @@ static int tegra_hdmi_build_pcms(struct hda_codec *codec)static int patch_tegra_hdmi (struct hda_codec *codec) { +struct hdmi_spec *spec;int err; err =patch_generic_hdmi (codec);
@@ -3231,6 +3232,10 @@ static int patch_tegra_hdmi(struct hda_codec *codec)return err; codec->patch_ops.build_pcms = tegra_hdmi_build_pcms; + spec = codec->spec; + spec->chmap.ops.chmap_cea_alloc_validate_get_type = + nvhdmi_chmap_cea_alloc_validate_get_type; + spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/70 drivers/net/wan/lapbether: Set network_header before transmitting
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 91244d108441013b7367b3b4dcc6869998676473 ]
Set the skb's network_header before it is passed to the underlying Ethernet device for transmission.
This patch fixes the following issue:
When we use this driver with AF_PACKET sockets, there would be error messages of:
protocol 0805 is buggy, dev (Ethernet interface name)
printed in the system "dmesg" log.
This is because skbs passed down to the Ethernet device for transmission don't have their network_header properly set, and the dev_queue_xmit_nit function in net/core/dev.c complains about this.
Reason of setting the network_header to this place (at the end of the Ethernet header, and at the beginning of the Ethernet payload):
Because when this driver receives an skb from the Ethernet device, the network_header is also set at this place.
--- drivers/net/wan/lapbether.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wan/lapbether.c +2 -0
@@ -213,6 +213,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) skb->dev = dev = lapbeth->ethdev; +skb_reset_network_header (skb); +dev_hard_header (skb, dev,ETH_P_DEC , bcast_addr,NULL ,0 );dev_queue_xmit (skb);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/70 xfs: initialize the shortform attr header padding entry
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 125eac243806e021f33a1fdea3687eccbb9f7636 ]
Don't leak kernel memory contents into the shortform attr fork.
--- fs/xfs/libxfs/xfs_attr_leaf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/xfs/libxfs/xfs_attr_leaf.c +2 -2
@@ -520,8 +520,8 @@ xfs_attr_shortform_create(xfs_da_args_t *args)ASSERT (ifp->if_flags &XFS_IFINLINE ); }xfs_idata_realloc (dp,sizeof (*hdr),XFS_ATTR_FORK ); - hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data; - hdr->count =0 ; + hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data; +memset (hdr,0 ,sizeof (*hdr)); hdr->totsize =cpu_to_be16 (sizeof (*hdr));xfs_trans_log_inode (args->trans, dp,XFS_ILOG_CORE |XFS_ILOG_ADATA ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 11/70 irqchip/eznps: Fix build error for !ARC700 builds
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
[ Upstream commit 89d29997f103d08264b0685796b420d911658b96 ]
eznps driver is supposed to be platform independent however it ends up including stuff from inside arch/arc headers leading to rand config build errors.
The quick hack to fix this (proper fix is too much chrun for non active user-base) is to add following to nps platform agnostic header.
- copy AUX_IENABLE from arch/arc header
- move CTOP_AUX_IACK from arch/arc/plat-eznps/*/**
--- arch/arc/plat-eznps/include/plat/ctop.h | 1 - include/soc/nps/common.h | 6 ++++++ 2 files changed, 6 insertions(+), 1 deletion(-)
arch/arc/plat-eznps/include/plat/ctop.h +0 -1
@@ -42,7 +42,6 @@#define CTOP_AUX_HW_COMPLY (CTOP_AUX_BASE + 0x024)#define CTOP_AUX_LPC (CTOP_AUX_BASE + 0x030)#define CTOP_AUX_EFLAGS (CTOP_AUX_BASE + 0x080) -#define CTOP_AUX_IACK (CTOP_AUX_BASE + 0x088)#define CTOP_AUX_GPA1 (CTOP_AUX_BASE + 0x08C)#define CTOP_AUX_UDMC (CTOP_AUX_BASE + 0x300)
include/soc/nps/common.h +6 -0
@@ -45,6 +45,12 @@#define CTOP_INST_MOV2B_FLIP_R3_B1_B2_INST 0x5B60#define CTOP_INST_MOV2B_FLIP_R3_B1_B2_LIMM 0x00010422 +#ifndef AUX_IENABLE +#define AUX_IENABLE 0x40c +#endif + +#define CTOP_AUX_IACK (0xFFFFF800 + 0x088) +#ifndef __ASSEMBLY__/* In order to increase compilation test coverage */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 12/70 drivers/net/wan/hdlc_cisco: Add hard_header_len
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 1a545ebe380bf4c1433e3c136e35a77764fda5ad ]
This driver didn't set hard_header_len. This patch sets hard_header_len for it according to its header_ops->create function.
This driver's header_ops->create function (cisco_hard_header) creates a header of (struct hdlc_header), so hard_header_len should be set to sizeof(struct hdlc_header).
--- drivers/net/wan/hdlc_cisco.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wan/hdlc_cisco.c +1 -0
@@ -377,6 +377,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)memcpy (&state (hdlc)->settings, &new_settings, size);spin_lock_init (&state (hdlc)->lock); dev->header_ops = &cisco_header_ops; + dev->hard_header_len =sizeof (struct hdlc_header ); dev->type =ARPHRD_CISCO ;call_netdevice_notifiers (NETDEV_POST_TYPE_CHANGE , dev);netif_dormant_on (dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 13/70 ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
In reply to Greg Kroah-HartmanFrom: Rander Wang <[email protected]>
[ Upstream commit 13774d81f38538c5fa2924bdcdfa509155480fa6 ]
In snd_hdac_device_init pm_runtime_set_active is called to increase child_count in parent device. But when it is failed to build connection with GPU for one case that integrated graphic gpu is disabled, snd_hdac_ext_bus_device_exit will be invoked to clean up a HD-audio extended codec base device. At this time the child_count of parent is not decreased, which makes parent device can't get suspended.
This patch calls pm_runtime_set_suspended to decrease child_count in parent device in snd_hdac_device_exit to match with snd_hdac_device_init. pm_runtime_set_suspended can make sure that it will not decrease child_count if the device is already suspended.
--- sound/hda/hdac_device.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/hdac_device.c +2 -0
@@ -123,6 +123,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init);void snd_hdac_device_exit (struct hdac_device *codec) {pm_runtime_put_noidle (&codec->dev); +/* keep balance of runtime PM child_count in parent device */ +pm_runtime_set_suspended (&codec->dev);snd_hdac_bus_remove_device (codec->bus, codec);kfree (codec->vendor_name);kfree (codec->chip_name);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 14/70 gcov: Disable gcov build with GCC 10
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit cfc905f158eaa099d6258031614d11869e7ef71c ]
GCOV built with GCC 10 doesn't initialize n_function variable. This produces different kernel panics as was seen by Colin in Ubuntu and me in FC 32.
As a workaround, let's disable GCOV build for broken GCC 10 version.
--- kernel/gcov/Kconfig | 1 + 1 file changed, 1 insertion(+)
kernel/gcov/Kconfig +1 -0
@@ -3,6 +3,7 @@ menu "GCOV-based kernel profiling" config GCOV_KERNEL bool "Enable gcov-based kernel profiling" depends on DEBUG_FS + depends on !CC_IS_GCC || GCC_VERSION < 100000 select CONSTRUCTORS if !UML default n ---help---
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 15/70 iio: adc: mcp3422: fix locking scope
In reply to Greg Kroah-HartmanFrom: Angelo Compagnucci <[email protected]>
commit 3f1093d83d7164e4705e4232ccf76da54adfda85 upstream.
Locking should be held for the entire reading sequence involving setting the channel, waiting for the channel switch and reading from the channel.
If not, reading from a channel can result mixing with the reading from another channel.
--- drivers/iio/adc/mcp3422.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/iio/adc/mcp3422.c +7 -5
@@ -99,16 +99,12 @@ static int mcp3422_update_config(struct {int ret; -mutex_lock (&adc->lock); - ret =i2c_master_send (adc->i2c, &newconfig,1 );if (ret >0 ) { adc->config = newconfig; ret =0 ; } -mutex_unlock (&adc->lock); -return ret; }
@@ -141,6 +137,8 @@ static int mcp3422_read_channel(struct mu8 config;u8 req_channel = channel->channel; +mutex_lock (&adc->lock); +if (req_channel !=MCP3422_CHANNEL (adc->config)) { config = adc->config; config &= ~MCP3422_CHANNEL_MASK ;
@@ -153,7 +151,11 @@ static int mcp3422_read_channel(struct mmsleep (mcp3422_read_times[MCP3422_SAMPLE_RATE (adc->config)]); } -return mcp3422_read (adc, value, &config); + ret =mcp3422_read (adc, value, &config); + +mutex_unlock (&adc->lock); + +return ret; } static int mcp3422_read_raw(struct iio_dev *iio,
Greg Kroah-Hartman
maintainerPATCH 16/70 iio: adc: mcp3422: fix locking on error path
In reply to Greg Kroah-HartmanFrom: Angelo Compagnucci <[email protected]>
[ Upstream commit a139ffa40f0c24b753838b8ef3dcf6ad10eb7854 ]
Reading from the chip should be unlocked on error path else the lock could never being released.
--- drivers/iio/adc/mcp3422.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/adc/mcp3422.c +3 -1
@@ -146,8 +146,10 @@ static int mcp3422_read_channel(struct m config &= ~MCP3422_PGA_MASK ; config |=MCP3422_PGA_VALUE (adc->pga[req_channel]); ret =mcp3422_update_config (adc, config); -if (ret <0 ) +if (ret <0 ) { +mutex_unlock (&adc->lock);return ret; + }msleep (mcp3422_read_times[MCP3422_SAMPLE_RATE (adc->config)]); }
Greg Kroah-Hartman
maintainerPATCH 17/70 iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
In reply to Greg Kroah-HartmanFrom: Maxim Kochetkov <[email protected]>
commit e71e6dbe96ac80ac2aebe71a6a942e7bd60e7596 upstream.
To stop conversion ads1015_set_power_state() function call unimplemented function __pm_runtime_suspend() from pm_runtime_put_autosuspend() if CONFIG_PM is not set.
In case of CONFIG_PM is not set: __pm_runtime_suspend() returns -ENOSYS, so ads1015_read_raw() failed because ads1015_set_power_state() returns an error.
If CONFIG_PM is disabled, there is no need to start/stop conversion. Fix it by adding return 0 function variant if CONFIG_PM is not set.
--- drivers/iio/adc/ti-ads1015.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/iio/adc/ti-ads1015.c +10 -0
@@ -220,6 +220,7 @@ static const struct iio_chan_spec ads111 IIO_CHAN_SOFT_TIMESTAMP(ADS1015_TIMESTAMP), }; +#ifdef CONFIG_PM static int ads1015_set_power_state (struct ads1015_data *data,bool on) {int ret;
@@ -237,6 +238,15 @@ static int ads1015_set_power_state(struc return ret < 0 ? ret : 0; } +#else /* !CONFIG_PM */ + +static int ads1015_set_power_state (struct ads1015_data *data,bool on) +{ +return 0 ; +} + +#endif /* !CONFIG_PM */ +static int ads1015_get_adc_result (struct ads1015_data *data,int chan,int *val) {
Greg Kroah-Hartman
maintainerPATCH 18/70 iio:light:ltr501 Fix timestamp alignment issue.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 2684d5003490df5398aeafe2592ba9d4a4653998 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. Here we use a structure on the stack. The driver already did an explicit memset so no data leak was possible.
Forced alignment of ts is not strictly necessary but probably makes the code slightly less fragile.
Note there has been some rework in this driver of the years, so no way this will apply cleanly all the way back.
--- drivers/iio/light/ltr501.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/iio/light/ltr501.c +9 -6
@@ -1218,13 +1218,16 @@ static irqreturn_t ltr501_trigger_handlestruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct ltr501_data *data =iio_priv (indio_dev); -u16 buf[8 ]; +struct { +u16 channels[3 ]; +s64 ts__aligned(8) ; + } scan;__le16 als_buf[2 ];u8 mask =0 ;int j =0 ;int ret, psdata; -memset (buf,0 ,sizeof (buf)); +memset (&scan,0 ,sizeof (scan));/* figure out which data needs to be ready */ if (test_bit(0, indio_dev->active_scan_mask) ||
@@ -1243,9 +1246,9 @@ static irqreturn_t ltr501_trigger_handleif (ret <0 )return ret;if (test_bit (0 , indio_dev->active_scan_mask)) - buf[j++] =le16_to_cpu (als_buf[1 ]); + scan.channels[j++] =le16_to_cpu (als_buf[1 ]);if (test_bit (1 , indio_dev->active_scan_mask)) - buf[j++] =le16_to_cpu (als_buf[0 ]); + scan.channels[j++] =le16_to_cpu (als_buf[0 ]); }if (mask <R501_STATUS_PS_RDY ) {
@@ -1253,10 +1256,10 @@ static irqreturn_t ltr501_trigger_handle &psdata, 2);if (ret <0 ) goto done; - buf[j++] = psdata <R501_PS_DATA_MASK ; + scan.channels[j++] = psdata <R501_PS_DATA_MASK ; } -iio_push_to_buffers_with_timestamp (indio_dev, buf, +iio_push_to_buffers_with_timestamp (indio_dev, &scan,iio_get_time_ns (indio_dev)); done:
Greg Kroah-Hartman
maintainerPATCH 19/70 iio:accel:bmc150-accel: Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit a6f86f724394de3629da63fe5e1b7a4ab3396efe upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 16 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data with alignment ensured by use of an explicit c structure. This data is allocated with kzalloc so no data can leak appart from previous readings.
Fixes tag is beyond some major refactoring so likely manual backporting would be needed to get that far back.
Whilst the force alignment of the ts is not strictly necessary, it does make the code less fragile.
--- drivers/iio/accel/bmc150-accel-core.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/iio/accel/bmc150-accel-core.c +12 -3
@@ -197,6 +197,14 @@ struct bmc150_accel_data {struct mutex mutex;u8 fifo_mode, watermark;s16 buffer[8 ]; +/* +* Ensure there is sufficient space and correct alignment for +* the timestamp if enabled +*/ +struct { +__le16 channels[3 ]; +s64 ts__aligned(8) ; + } scan;u8 bw_bits;u32 slope_dur;u32 slope_thres;
@@ -933,15 +941,16 @@ static int __bmc150_accel_fifo_flush(str* now. */ for (i =0 ; i < count; i++) { -u16 sample[8 ];int j, bit; j =0 ;for_each_set_bit (bit, indio_dev->active_scan_mask, indio_dev->masklength) -memcpy (&sample[j++], &buffer[i *3 + bit],2 ); +memcpy (&data->scan.channels[j++], &buffer[i *3 + bit], +sizeof (data->scan.channels[0 ])); -iio_push_to_buffers_with_timestamp (indio_dev, sample, tstamp); +iio_push_to_buffers_with_timestamp (indio_dev, &data->scan, + tstamp); tstamp += sample_period; }
Greg Kroah-Hartman
maintainerPATCH 20/70 iio:adc:ina2xx Fix timestamp alignment issue.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit f8cd222feb82ecd82dcf610fcc15186f55f9c2b5 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 32 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak apart from previous readings. The explicit alignment isn't technically needed here, but it reduced fragility and avoids cut and paste into drivers where it will be needed.
If we want this in older stables will need manual backport due to driver reworks.
--- drivers/iio/adc/ina2xx-adc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/iio/adc/ina2xx-adc.c +7 -4
@@ -117,6 +117,11 @@ struct ina2xx_chip_info {int int_time_vbus;/* Bus voltage integration time uS */ int int_time_vshunt;/* Shunt voltage integration time uS */ bool allow_async_readout; +/* data buffer needs space for channel data and timestamp */ +struct { +u16 chan[4 ]; +u64 ts__aligned(8) ; + } scan; };static const struct ina2xx_config ina2xx_config[] = {
@@ -459,7 +464,6 @@ static const struct iio_chan_spec ina2xxstatic int ina2xx_work_buffer (struct iio_dev *indio_dev) {struct ina2xx_chip_info *chip =iio_priv (indio_dev); -unsigned short data[8 ];int bit, ret, i =0 ;s64 time_a, time_b;unsigned int alert;
@@ -500,13 +504,12 @@ static int ina2xx_work_buffer(struct iioif (ret <0 )return ret; - data[i++] = val; + chip->scan.chan[i++] = val; } time_b =iio_get_time_ns (indio_dev); -iio_push_to_buffers_with_timestamp (indio_dev, - (unsigned int *)data, time_a); +iio_push_to_buffers_with_timestamp (indio_dev, &chip->scan, time_a);return (unsigned long )(time_b - time_a) /1000 ; };
Greg Kroah-Hartman
maintainerPATCH 21/70 iio:adc:ti-adc081c Fix alignment and data leak issues
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 54f82df2ba86e2a8e9cbf4036d192366e3905c89 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc so no data can leak apart from previous readings.
The eplicit alignment of ts is necessary to ensure correct padding on x86_32 where s64 is only aligned to 4 bytes.
--- drivers/iio/adc/ti-adc081c.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/iio/adc/ti-adc081c.c +8 -3
@@ -36,6 +36,12 @@ struct adc081c {/* 8, 10 or 12 */ int bits; + +/* Ensure natural alignment of buffer elements */ +struct { +u16 channel; +s64 ts__aligned(8) ; + } scan; };#define REG_CONV_RES 0x00
@@ -132,14 +138,13 @@ static irqreturn_t adc081c_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct adc081c *data =iio_priv (indio_dev); -u16 buf[8 ];/* 2 bytes data + 6 bytes padding + 8 bytes timestamp */ int ret; ret =i2c_smbus_read_word_swapped (data->i2c,REG_CONV_RES );if (ret <0 ) goto out; - buf[0 ] = ret; -iio_push_to_buffers_with_timestamp (indio_dev, buf, + data->scan.channel = ret; +iio_push_to_buffers_with_timestamp (indio_dev, &data->scan,iio_get_time_ns (indio_dev)); out:iio_trigger_notify_done (indio_dev->trig);
Greg Kroah-Hartman
maintainerPATCH 22/70 drivers: iio: magnetometer: Fix sparse endianness warnings cast to restricted __be16
In reply to Greg Kroah-HartmanFrom: Sandhya Bankar <[email protected]>
commit 69c72ec9c80bbd206c6fac73874d73e69cc623b4 upstream.
Fix the following sparse endianness warnings:
drivers/iio/magnetometer/ak8975.c:716:16: warning: cast to restricted __le16 drivers/iio/magnetometer/ak8975.c:837:19: warning: cast to restricted __le16 drivers/iio/magnetometer/ak8975.c:838:19: warning: cast to restricted __le16 drivers/iio/magnetometer/ak8975.c:839:19: warning: cast to restricted __le16
--- drivers/iio/magnetometer/ak8975.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/iio/magnetometer/ak8975.c +9 -7
@@ -690,6 +690,7 @@ static int ak8975_read_axis(struct iio_dstruct ak8975_data *data =iio_priv (indio_dev);const struct i2c_client *client = data->client;const struct ak_def *def = data->def; +__le16 rval;u16 buff;int ret;
@@ -703,7 +704,7 @@ static int ak8975_read_axis(struct iio_d ret =i2c_smbus_read_i2c_block_data_or_emulated ( client, def->data_regs[index], -sizeof (buff), (u8 *)&buff); +sizeof (rval), (u8 *)&rval);if (ret <0 ) goto exit;
@@ -713,7 +714,7 @@ static int ak8975_read_axis(struct iio_dpm_runtime_put_autosuspend (&data->client->dev);/* Swap bytes and convert to valid range. */ - buff =le16_to_cpu (buff); + buff =le16_to_cpu (rval); *val =clamp_t (s16, buff, -def->range, def->range);return IIO_VAL_INT ;
@@ -813,6 +814,7 @@ static void ak8975_fill_buffer(struct iiconst struct ak_def *def = data->def;int ret;s16 buff[8 ];/* 3 x 16 bits axis values + 1 aligned 64 bits timestamp */ +__le16 fval[3 ];mutex_lock (&data->lock);
@@ -826,17 +828,17 @@ static void ak8975_fill_buffer(struct ii*/ ret =i2c_smbus_read_i2c_block_data_or_emulated (client, def->data_regs[0 ], -3 *sizeof (buff[0 ]), - (u8 *)buff); +3 *sizeof (fval[0 ]), + (u8 *)fval);if (ret <0 ) goto unlock;mutex_unlock (&data->lock);/* Clamp to valid range. */ - buff[0 ] =clamp_t (s16,le16_to_cpu (buff[0 ]), -def->range, def->range); - buff[1 ] =clamp_t (s16,le16_to_cpu (buff[1 ]), -def->range, def->range); - buff[2 ] =clamp_t (s16,le16_to_cpu (buff[2 ]), -def->range, def->range); + buff[0 ] =clamp_t (s16,le16_to_cpu (fval[0 ]), -def->range, def->range); + buff[1 ] =clamp_t (s16,le16_to_cpu (fval[1 ]), -def->range, def->range); + buff[2 ] =clamp_t (s16,le16_to_cpu (fval[2 ]), -def->range, def->range);iio_push_to_buffers_with_timestamp (indio_dev, buff,iio_get_time_ns (indio_dev));
Greg Kroah-Hartman
maintainerPATCH 23/70 iio:magnetometer:ak8975 Fix alignment and data leak issues.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 02ad21cefbac4d89ac443866f25b90449527737b upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc so no data can leak apart from previous readings.
The explicit alignment of ts is not necessary in this case as by coincidence the padding will end up the same, however I consider it to make the code less fragile and have included it.
--- drivers/iio/magnetometer/ak8975.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/iio/magnetometer/ak8975.c +11 -5
@@ -381,6 +381,12 @@ struct ak8975_data {struct iio_mount_matrix orientation;struct regulator *vdd;struct regulator *vid; + +/* Ensure natural alignment of timestamp */ +struct { +s16 channels[3 ]; +s64 ts__aligned(8) ; + } scan; };/* Enable attached power regulator if any. */
@@ -813,7 +819,6 @@ static void ak8975_fill_buffer(struct iiconst struct i2c_client *client = data->client;const struct ak_def *def = data->def;int ret; -s16 buff[8 ];/* 3 x 16 bits axis values + 1 aligned 64 bits timestamp */ __le16 fval[3 ];mutex_lock (&data->lock);
@@ -836,12 +841,13 @@ static void ak8975_fill_buffer(struct iimutex_unlock (&data->lock);/* Clamp to valid range. */ - buff[0 ] =clamp_t (s16,le16_to_cpu (fval[0 ]), -def->range, def->range); - buff[1 ] =clamp_t (s16,le16_to_cpu (fval[1 ]), -def->range, def->range); - buff[2 ] =clamp_t (s16,le16_to_cpu (fval[2 ]), -def->range, def->range); + data->scan.channels[0 ] =clamp_t (s16,le16_to_cpu (fval[0 ]), -def->range, def->range); + data->scan.channels[1 ] =clamp_t (s16,le16_to_cpu (fval[1 ]), -def->range, def->range); + data->scan.channels[2 ] =clamp_t (s16,le16_to_cpu (fval[2 ]), -def->range, def->range); -iio_push_to_buffers_with_timestamp (indio_dev, buff, +iio_push_to_buffers_with_timestamp (indio_dev, &data->scan,iio_get_time_ns (indio_dev)); +return ; unlock:
Greg Kroah-Hartman
maintainerPATCH 24/70 iio:light:max44000 Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 523628852a5f5f34a15252b2634d0498d3cfb347 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 16 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc so no data can leak appart from previous readings.
It is necessary to force the alignment of ts to avoid the padding on x86_32 being different from 64 bit platorms (it alows for 4 bytes aligned 8 byte types.
--- drivers/iio/light/max44000.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/iio/light/max44000.c +8 -4
@@ -78,6 +78,11 @@struct max44000_data {struct mutex lock;struct regmap *regmap; +/* Ensure naturally aligned timestamp */ +struct { +u16 channels[2 ]; +s64 ts__aligned(8) ; + } scan; };/* Default scale is set to the minimum of 0.03125 or 1 / (1 << 5) lux */
@@ -491,7 +496,6 @@ static irqreturn_t max44000_trigger_handstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct max44000_data *data =iio_priv (indio_dev); -u16 buf[8 ];/* 2x u16 + padding + 8 bytes timestamp */ int index =0 ;unsigned int regval;int ret;
@@ -501,17 +505,17 @@ static irqreturn_t max44000_trigger_hand ret =max44000_read_alsval (data);if (ret <0 ) goto out_unlock; - buf[index++] = ret; + data->scan.channels[index++] = ret; }if (test_bit (MAX44000_SCAN_INDEX_PRX , indio_dev->active_scan_mask)) { ret =regmap_read (data->regmap,MAX44000_REG_PRX_DATA , ®val);if (ret <0 ) goto out_unlock; - buf[index] = regval; + data->scan.channels[index] = regval; }mutex_unlock (&data->lock); -iio_push_to_buffers_with_timestamp (indio_dev, buf, +iio_push_to_buffers_with_timestamp (indio_dev, &data->scan,iio_get_time_ns (indio_dev));iio_trigger_notify_done (indio_dev->trig);return IRQ_HANDLED ;
Greg Kroah-Hartman
maintainerPATCH 25/70 iio: accel: kxsd9: Fix alignment of local buffer.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 95ad67577de4ea08eb8e441394e698aa4addcc0b upstream.
iio_push_to_buffers_with_timestamp assumes 8 byte alignment which is not guaranteed by an array of smaller elements.
Note that whilst in this particular case the alignment forcing of the ts element is not strictly necessary it acts as good documentation. Doing this where not necessary should cut down on the number of cut and paste introduced errors elsewhere.
--- drivers/iio/accel/kxsd9.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/iio/accel/kxsd9.c +11 -5
@@ -212,14 +212,20 @@ static irqreturn_t kxsd9_trigger_handlerconst struct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct kxsd9_state *st =iio_priv (indio_dev); +/* +* Ensure correct positioning and alignment of timestamp. +* No need to zero initialize as all elements written. +*/ +struct { +__be16 chan[4 ]; +s64 ts__aligned(8) ; + } hw_values;int ret; -/* 4 * 16bit values AND timestamp */ -__be16 hw_values[8 ]; ret =regmap_bulk_read (st->map,KXSD9_REG_X , - &hw_values, -8 ); + hw_values.chan, +sizeof (hw_values.chan));if (ret) {dev_err (st->dev,"error reading data\n" );
@@ -227,7 +233,7 @@ static irqreturn_t kxsd9_trigger_handler }iio_push_to_buffers_with_timestamp (indio_dev, - hw_values, + &hw_values,iio_get_time_ns (indio_dev));iio_trigger_notify_done (indio_dev->trig);
Greg Kroah-Hartman
maintainerPATCH 26/70 iio:accel:mma7455: Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 7e5ac1f2206eda414f90c698fe1820dee873394d upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses a 16 byte u8 array on the stack As Lars also noted
this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data with alignment ensured by use of an explicit c structure. This data is allocated with kzalloc so no data can leak appart from previous readings.
The force alignment of ts is not strictly necessary in this particularly case but does make the code less fragile.
--- drivers/iio/accel/mma7455_core.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/iio/accel/mma7455_core.c +12 -4
@@ -55,6 +55,14 @@struct mma7455_data {struct regmap *regmap; +/* +* Used to reorganize data. Will ensure correct alignment of +* the timestamp if present +*/ +struct { +__le16 channels[3 ]; +s64 ts__aligned(8) ; + } scan; };static int mma7455_drdy (struct mma7455_data *mma7455)
@@ -85,19 +93,19 @@ static irqreturn_t mma7455_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct mma7455_data *mma7455 =iio_priv (indio_dev); -u8 buf[16 ];/* 3 x 16-bit channels + padding + ts */ int ret; ret =mma7455_drdy (mma7455);if (ret) goto done; - ret =regmap_bulk_read (mma7455->regmap,MMA7455_REG_XOUTL , buf, -sizeof (__le16) *3 ); + ret =regmap_bulk_read (mma7455->regmap,MMA7455_REG_XOUTL , + mma7455->scan.channels, +sizeof (mma7455->scan.channels));if (ret) goto done; -iio_push_to_buffers_with_timestamp (indio_dev, buf, +iio_push_to_buffers_with_timestamp (indio_dev, &mma7455->scan,iio_get_time_ns (indio_dev)); done:
Greg Kroah-Hartman
maintainerPATCH 27/70 iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 89226a296d816727405d3fea684ef69e7d388bd8 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 16 byte u8 array on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to
a suitable structure in the iio_priv() data with alignment ensured by use of an explicit c structure. This data is allocated with kzalloc so no data can leak appart from previous readings.
The additional forcing of the 8 byte alignment of the timestamp is not strictly necessary but makes the code less fragile by making this explicit.
--- drivers/iio/accel/mma8452.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/iio/accel/mma8452.c +8 -3
@@ -105,6 +105,12 @@ struct mma8452_data {u8 ctrl_reg1;u8 data_cfg;const struct mma_chip_info *chip_info; + +/* Ensure correct alignment of time stamp when present */ +struct { +__be16 channels[3 ]; +s64 ts__aligned(8) ; + } buffer; };/**
@@ -985,14 +991,13 @@ static irqreturn_t mma8452_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct mma8452_data *data =iio_priv (indio_dev); -u8 buffer[16 ];/* 3 16-bit channels + padding + ts */ int ret; - ret =mma8452_read (data, (__be16 *)buffer); + ret =mma8452_read (data, data->buffer.channels);if (ret <0 ) goto done; -iio_push_to_buffers_with_timestamp (indio_dev, buffer, +iio_push_to_buffers_with_timestamp (indio_dev, &data->buffer,iio_get_time_ns (indio_dev)); done:
Greg Kroah-Hartman
maintainerPATCH 28/70 USB: core: add helpers to retrieve endpoints
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 66a359390e7e34f9a4c489467234b107b3d76169 upstream.
Many USB drivers iterate over the available endpoints to find required endpoints of a specific type and direction. Typically the endpoints are required for proper function and a missing endpoint should abort probe.
To facilitate code reuse, add a helper to retrieve common endpoints (bulk or interrupt, in or out) and four wrappers to find a single endpoint.
Note that the helpers are marked as __must_check to serve as a reminder to always verify that all expected endpoints are indeed present. This also means that any optional endpoints, typically need to be looked up through separate calls.
--- drivers/usb/core/usb.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++ include/linux/usb.h | 35 ++++++++++++++++++++ 2 files changed, 118 insertions(+)
drivers/usb/core/usb.c +83 -0
@@ -73,6 +73,89 @@ MODULE_PARM_DESC(autosuspend, "default a/** +* usb_find_common_endpoints() -- look up common endpoint descriptors +* @alt: alternate setting to search +* @bulk_in: pointer to descriptor pointer, or NULL +* @bulk_out: pointer to descriptor pointer, or NULL +* @int_in: pointer to descriptor pointer, or NULL +* @int_out: pointer to descriptor pointer, or NULL +* +* Search the alternate setting's endpoint descriptors for the first bulk-in, +* bulk-out, interrupt-in and interrupt-out endpoints and return them in the +* provided pointers (unless they are NULL). +* +* If a requested endpoint is not found, the corresponding pointer is set to +* NULL. +* +* Return: Zero if all requested descriptors were found, or -ENXIO otherwise. +*/ +int usb_find_common_endpoints (struct usb_host_interface *alt, +struct usb_endpoint_descriptor **bulk_in, +struct usb_endpoint_descriptor **bulk_out, +struct usb_endpoint_descriptor **int_in, +struct usb_endpoint_descriptor **int_out) +{ +struct usb_endpoint_descriptor *epd; +int i; + +if (bulk_in) + *bulk_in =NULL ; +if (bulk_out) + *bulk_out =NULL ; +if (int_in) + *int_in =NULL ; +if (int_out) + *int_out =NULL ; + +for (i =0 ; i < alt->desc.bNumEndpoints; ++i) { + epd = &alt->endpoint[i].desc; + +switch (usb_endpoint_type (epd)) { +case USB_ENDPOINT_XFER_BULK : +if (usb_endpoint_dir_in (epd)) { +if (bulk_in && !*bulk_in) { + *bulk_in = epd; +break ; + } + }else { +if (bulk_out && !*bulk_out) { + *bulk_out = epd; +break ; + } + } + +continue ; +case USB_ENDPOINT_XFER_INT : +if (usb_endpoint_dir_in (epd)) { +if (int_in && !*int_in) { + *int_in = epd; +break ; + } + }else { +if (int_out && !*int_out) { + *int_out = epd; +break ; + } + } + +continue ; +default : +continue ; + } + +if ((!bulk_in || *bulk_in) && + (!bulk_out || *bulk_out) && + (!int_in || *int_in) && + (!int_out || *int_out)) { +return 0 ; + } + } + +return -ENXIO ; +} +EXPORT_SYMBOL_GPL (usb_find_common_endpoints); + +/** * usb_find_alt_setting() - Given a configuration, find the alternate setting * for the given interface. * @config: the configuration to search (not necessarily the current config).
include/linux/usb.h +35 -0
@@ -99,6 +99,41 @@ enum usb_interface_condition { USB_INTERFACE_UNBINDING, }; +int __must_check +usb_find_common_endpoints (struct usb_host_interface *alt, +struct usb_endpoint_descriptor **bulk_in, +struct usb_endpoint_descriptor **bulk_out, +struct usb_endpoint_descriptor **int_in, +struct usb_endpoint_descriptor **int_out); + +static inline int __must_check +usb_find_bulk_in_endpoint (struct usb_host_interface *alt, +struct usb_endpoint_descriptor **bulk_in) +{ +return usb_find_common_endpoints (alt, bulk_in,NULL ,NULL ,NULL ); +} + +static inline int __must_check +usb_find_bulk_out_endpoint (struct usb_host_interface *alt, +struct usb_endpoint_descriptor **bulk_out) +{ +return usb_find_common_endpoints (alt,NULL , bulk_out,NULL ,NULL ); +} + +static inline int __must_check +usb_find_int_in_endpoint (struct usb_host_interface *alt, +struct usb_endpoint_descriptor **int_in) +{ +return usb_find_common_endpoints (alt,NULL ,NULL , int_in,NULL ); +} + +static inline int __must_check +usb_find_int_out_endpoint (struct usb_host_interface *alt, +struct usb_endpoint_descriptor **int_out) +{ +return usb_find_common_endpoints (alt,NULL ,NULL ,NULL , int_out); +} +/** * struct usb_interface - what usb device drivers talk to * @altsetting: array of interface structures, one for each alternate
Greg Kroah-Hartman
maintainerPATCH 29/70 staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()
In reply to Greg Kroah-HartmanFrom: Rustam Kovhaev <[email protected]>
commit fea22e159d51c766ba70473f473a0ec914cc7e92 upstream.
let's use usb_find_common_endpoints() to discover endpoints, it does all necessary checks for type and xfer direction
remove memset() in hfa384x_create(), because we now assign endpoints in prism2sta_probe_usb() and because create_wlan() uses kzalloc() to allocate hfa384x struct before calling hfa384x_create()
--- drivers/staging/wlan-ng/hfa384x_usb.c | 5 ----- drivers/staging/wlan-ng/prism2usb.c | 19 ++++++------------- 2 files changed, 6 insertions(+), 18 deletions(-)
drivers/staging/wlan-ng/hfa384x_usb.c +0 -5
@@ -523,13 +523,8 @@ static void hfa384x_usb_defer(struct wor----------------------------------------------------------------*/ void hfa384x_create (struct hfa384x *hw,struct usb_device *usb) { -memset (hw,0 ,sizeof (struct hfa384x )); hw->usb = usb; -/* set up the endpoints */ - hw->endp_in =usb_rcvbulkpipe (usb,1 ); - hw->endp_out =usb_sndbulkpipe (usb,2 ); -/* Set up the waitq */ init_waitqueue_head (&hw->cmdq);
drivers/staging/wlan-ng/prism2usb.c +6 -13
@@ -60,23 +60,14 @@ static int prism2sta_probe_usb(struct us const struct usb_device_id *id) {struct usb_device *dev; -const struct usb_endpoint_descriptor *epd; -const struct usb_host_interface *iface_desc = interface->cur_altsetting; +struct usb_endpoint_descriptor *bulk_in, *bulk_out; +struct usb_host_interface *iface_desc = interface->cur_altsetting;struct wlandevice *wlandev =NULL ;struct hfa384x *hw =NULL ;int result =0 ; -if (iface_desc->desc.bNumEndpoints !=2 ) { - result = -ENODEV ; - goto failed; - } - - result = -EINVAL ; - epd = &iface_desc->endpoint[1 ].desc; -if (!usb_endpoint_is_bulk_in (epd)) - goto failed; - epd = &iface_desc->endpoint[2 ].desc; -if (!usb_endpoint_is_bulk_out (epd)) + result =usb_find_common_endpoints (iface_desc, &bulk_in, &bulk_out,NULL ,NULL ); +if (result) goto failed; dev =interface_to_usbdev (interface);
@@ -95,6 +86,8 @@ static int prism2sta_probe_usb(struct us }/* Initialize the hw data */ + hw->endp_in =usb_rcvbulkpipe (dev, bulk_in->bEndpointAddress); + hw->endp_out =usb_sndbulkpipe (dev, bulk_out->bEndpointAddress);hfa384x_create (hw, dev); hw->wlandev = wlandev;
Greg Kroah-Hartman
maintainerPATCH 30/70 btrfs: fix wrong address when faulting in pages in the search ioctl
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 1c78544eaa4660096aeb6a57ec82b42cdb3bfe5a upstream.
When faulting in the pages for the user supplied buffer for the search ioctl, we are passing only the base address of the buffer to the function fault_in_pages_writeable(). This means that after the first iteration of the while loop that searches for leaves, when we have a non-zero offset, stored in 'sk_offset', we try to fault in a wrong page range.
So fix this by adding the offset in 'sk_offset' to the base address of the user supplied buffer when calling fault_in_pages_writeable().
Several users have reported that the applications compsize and bees have started to operate incorrectly since commit a48b73eca4ceb9 ("btrfs: fix potential deadlock in the search ioctl") was added to stable trees, and these applications make heavy use of the search ioctls. This fixes their issues.
--- fs/btrfs/ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/ioctl.c +2 -1
@@ -2151,7 +2151,8 @@ static noinline int search_ioctl(struct key.offset = sk->min_offset;while (1 ) { - ret =fault_in_pages_writeable (ubuf, *buf_size - sk_offset); + ret =fault_in_pages_writeable (ubuf + sk_offset, + *buf_size - sk_offset);if (ret)break ;
Greg Kroah-Hartman
maintainerPATCH 31/70 regulator: push allocation in set_consumer_device_supply() out of lock
In reply to Greg Kroah-HartmanFrom: Michał Mirosław <[email protected]>
commit 5c06540165d443c6455123eb48e7f1a9b618ab34 upstream.
Pull regulator_list_mutex into set_consumer_device_supply() and keep allocations outside of it. Fourth of the fs_reclaim deadlock case.
--- drivers/regulator/core.c | 46 ++++++++++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 20 deletions(-)
drivers/regulator/core.c +26 -20
@@ -1191,7 +1191,7 @@ static int set_consumer_device_supply(stconst char *consumer_dev_name, const char *supply) { - struct regulator_map *node; + struct regulator_map *node, *new_node;int has_dev;if (supply ==NULL )
@@ -1202,6 +1202,22 @@ static int set_consumer_device_supply(stelse has_dev =0 ; + new_node =kzalloc (sizeof (struct regulator_map ),GFP_KERNEL ); +if (new_node ==NULL ) +return -ENOMEM ; + + new_node->regulator = rdev; + new_node->supply = supply; + +if (has_dev) { + new_node->dev_name =kstrdup (consumer_dev_name,GFP_KERNEL ); +if (new_node->dev_name ==NULL ) { +kfree (new_node); +return -ENOMEM ; + } + } + +mutex_lock (®ulator_list_mutex);list_for_each_entry (node, ®ulator_map_list, list) {if (node->dev_name && consumer_dev_name) {if (strcmp (node->dev_name, consumer_dev_name) !=0 )
@@ -1219,26 +1235,19 @@ static int set_consumer_device_supply(st node->regulator->desc->name, supply, dev_name(&rdev->dev), rdev_get_name(rdev)); -return -EBUSY ; + goto fail; } - node =kzalloc (sizeof (struct regulator_map ),GFP_KERNEL ); -if (node ==NULL ) -return -ENOMEM ; - - node->regulator = rdev; - node->supply = supply; - -if (has_dev) { - node->dev_name =kstrdup (consumer_dev_name,GFP_KERNEL ); -if (node->dev_name ==NULL ) { -kfree (node); -return -ENOMEM ; - } - } +list_add (&new_node->list, ®ulator_map_list); +mutex_unlock (®ulator_list_mutex); -list_add (&node->list, ®ulator_map_list);return 0 ; + +fail: +mutex_unlock (®ulator_list_mutex); +kfree (new_node->dev_name); +kfree (new_node); +return -EBUSY ; }static void unset_regulator_supplies (struct regulator_dev *rdev)
@@ -4034,19 +4043,16 @@ regulator_register(const struct regulato/* add consumers devices */ if (init_data) { -mutex_lock (®ulator_list_mutex);for (i =0 ; i < init_data->num_consumer_supplies; i++) { ret =set_consumer_device_supply (rdev, init_data->consumer_supplies[i].dev_name, init_data->consumer_supplies[i].supply);if (ret <0 ) { -mutex_unlock (®ulator_list_mutex);dev_err (dev,"Failed to set supply %s\n" , init_data->consumer_supplies[i].supply); goto unset_supplies; } } -mutex_unlock (®ulator_list_mutex); } if (!rdev->desc->ops->get_voltage &&
Greg Kroah-Hartman
maintainerPATCH 32/70 scsi: target: iscsi: Fix data digest calculation
In reply to Greg Kroah-HartmanFrom: Varun Prakash <[email protected]>
commit 5528d03183fe5243416c706f64b1faa518b05130 upstream.
Current code does not consider 'page_off' in data digest calculation. To fix this, add a local variable 'first_sg' and set first_sg.offset to sg->offset + page_off.
--- drivers/target/iscsi/iscsi_target.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/target/iscsi/iscsi_target.c +15 -2
@@ -1396,14 +1396,27 @@ static u32 iscsit_do_crypto_hash_sg( sg = cmd->first_data_sg; page_off = cmd->first_data_sg_off; +if (data_length && page_off) { +struct scatterlist first_sg; +u32 len =min_t (u32, data_length, sg->length - page_off); + +sg_init_table (&first_sg,1 ); +sg_set_page (&first_sg,sg_page (sg), len, sg->offset + page_off); + +ahash_request_set_crypt (hash, &first_sg,NULL , len); +crypto_ahash_update (hash); + + data_length -= len; + sg =sg_next (sg); + } +while (data_length) { -u32 cur_len =min_t (u32, data_length, (sg->length - page_off)); +u32 cur_len =min_t (u32, data_length, sg->length);ahash_request_set_crypt (hash, sg,NULL , cur_len);crypto_ahash_update (hash); data_length -= cur_len; - page_off =0 ;/* iscsit_map_iovec has already checked for invalid sg pointers */ sg =sg_next (sg); }
Greg Kroah-Hartman
maintainerPATCH 33/70 scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem
In reply to Greg Kroah-HartmanFrom: Hou Pu <[email protected]>
commit ed43ffea78dcc97db3f561da834f1a49c8961e33 upstream.
The iSCSI target login thread might get stuck with the following stack:
cat /proc/pidof iscsi_np/stack
[<0>] down_interruptible+0x42/0x50 [<0>] iscsit_access_np+0xe3/0x167 [<0>] iscsi_target_locate_portal+0x695/0x8ac [<0>] __iscsi_target_login_thread+0x855/0xb82 [<0>] iscsi_target_login_thread+0x2f/0x5a [<0>] kthread+0xfa/0x130 [<0>] ret_from_fork+0x1f/0x30
This can be reproduced via the following steps:
1. Initiator A tries to log in to iqn1-tpg1 on port 3260. After finishing PDU exchange in the login thread and before the negotiation is finished the the network link goes down. At this point A has not finished login and tpg->np_login_sem is held.
2. Initiator B tries to log in to iqn2-tpg1 on port 3260. After finishing PDU exchange in the login thread the target expects to process remaining login PDUs in workqueue context.
3. Initiator A' tries to log in to iqn1-tpg1 on port 3260 from a new socket. A' will wait for tpg->np_login_sem with np->np_login_timer loaded to wait for at most 15 seconds. The lock is held by A so A' eventually times out.
4. Before A' got timeout initiator B gets negotiation failed and calls iscsi_target_login_drop()->iscsi_target_login_sess_out(). The np->np_login_timer is canceled and initiator A' will hang forever. Because A' is now in the login thread, no new login requests can be serviced.
Fix this by moving iscsi_stop_login_thread_timer() out of iscsi_target_login_sess_out(). Also remove iscsi_np parameter from iscsi_target_login_sess_out().
--- drivers/target/iscsi/iscsi_target_login.c | 6 +++--- drivers/target/iscsi/iscsi_target_login.h | 3 +-- drivers/target/iscsi/iscsi_target_nego.c | 3 +-- 3 files changed, 5 insertions(+), 7 deletions(-)
drivers/target/iscsi/iscsi_target_login.c +3 -3
@@ -1150,7 +1150,7 @@ iscsit_conn_set_transport(struct iscsi_c }void iscsi_target_login_sess_out (struct iscsi_conn *conn, -struct iscsi_np *np,bool zero_tsih,bool new_sess) +bool zero_tsih,bool new_sess) {if (!new_sess) goto old_sess_out;
@@ -1172,7 +1172,6 @@ void iscsi_target_login_sess_out(struct conn->sess =NULL ; old_sess_out: -iscsi_stop_login_thread_timer (np);/* * If login negotiation fails check if the Time2Retain timer * needs to be restarted.
@@ -1432,8 +1431,9 @@ static int __iscsi_target_login_thread(s new_sess_out: new_sess = true; old_sess_out: +iscsi_stop_login_thread_timer (np); tpg_np = conn->tpg_np; -iscsi_target_login_sess_out (conn, np, zero_tsih, new_sess); +iscsi_target_login_sess_out (conn, zero_tsih, new_sess); new_sess = false;if (tpg) {
drivers/target/iscsi/iscsi_target_login.h +1 -2
@@ -14,8 +14,7 @@ extern int iscsit_put_login_tx(struct isextern void iscsit_free_conn (struct iscsi_np *,struct iscsi_conn *);extern int iscsit_start_kthreads (struct iscsi_conn *);extern void iscsi_post_login_handler (struct iscsi_np *,struct iscsi_conn *,u8 ); -extern void iscsi_target_login_sess_out (struct iscsi_conn *,struct iscsi_np *, -bool ,bool ); +extern void iscsi_target_login_sess_out (struct iscsi_conn *,bool ,bool );extern int iscsi_target_login_thread (void *);#endif /*** ISCSI_TARGET_LOGIN_H ***/
drivers/target/iscsi/iscsi_target_nego.c +1 -2
@@ -548,12 +548,11 @@ static bool iscsi_target_sk_check_and_clstatic void iscsi_target_login_drop (struct iscsi_conn *conn,struct iscsi_login *login) { -struct iscsi_np *np = login->np;bool zero_tsih = login->zero_tsih;iscsi_remove_failed_auth_entry (conn);iscsi_target_nego_release (conn); -iscsi_target_login_sess_out (conn, np, zero_tsih, true); +iscsi_target_login_sess_out (conn, zero_tsih, true); }static void iscsi_target_login_timeout (unsigned long data)
Greg Kroah-Hartman
maintainerPATCH 34/70 rbd: require global CAP_SYS_ADMIN for mapping and unmapping
In reply to Greg Kroah-HartmanFrom: Ilya Dryomov <[email protected]>
commit f44d04e696feaf13d192d942c4f14ad2e117065a upstream.
It turns out that currently we rely only on sysfs attribute permissions:
$ ll /sys/bus/rbd/{add*,remove*}
--w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add
--w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add_single_major
--w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/remove
--w------- 1 root root 4096 Sep 3 20:38 /sys/bus/rbd/remove_single_majorThis means that images can be mapped and unmapped (i.e. block devices can be created and deleted) by a UID 0 process even after it drops all privileges or by any process with CAP_DAC_OVERRIDE in its user namespace as long as UID 0 is mapped into that user namespace.
Be consistent with other virtual block devices (loop, nbd, dm, md, etc) and require CAP_SYS_ADMIN in the initial user namespace for mapping and unmapping, and also for dumping the configuration string and refreshing the image header.
--- drivers/block/rbd.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/block/rbd.c +12 -0
@@ -4614,6 +4614,9 @@ static ssize_t rbd_config_info_show(stru {struct rbd_device *rbd_dev =dev_to_rbd_dev (dev); +if (!capable (CAP_SYS_ADMIN )) +return -EPERM ; +return sprintf (buf,"%s\n" , rbd_dev->config_info); }
@@ -4715,6 +4718,9 @@ static ssize_t rbd_image_refresh(structstruct rbd_device *rbd_dev =dev_to_rbd_dev (dev);int ret; +if (!capable (CAP_SYS_ADMIN )) +return -EPERM ; + ret =rbd_dev_refresh (rbd_dev);if (ret)return ret;
@@ -6192,6 +6198,9 @@ static ssize_t do_rbd_add(struct bus_typbool read_only;int rc; +if (!capable (CAP_SYS_ADMIN )) +return -EPERM ; +if (!try_module_get (THIS_MODULE ))return -ENODEV ;
@@ -6340,6 +6349,9 @@ static ssize_t do_rbd_remove(struct bus_bool force = false;int ret; +if (!capable (CAP_SYS_ADMIN )) +return -EPERM ; + dev_id =-1 ; opt_buf[0 ] ='\0' ;sscanf (buf,"%d %5s" , &dev_id, opt_buf);
Greg Kroah-Hartman
maintainerPATCH 35/70 fbcon: remove soft scrollback code
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 50145474f6ef4a9c19205b173da6264a644c7489 upstream.
This (and the VGA soft scrollback) turns out to have various nasty small special cases that nobody really is willing to fight. The soft scrollback code was really useful a few decades ago when you typically used the console interactively as the main way to interact with the machine, but that just isn't the case any more.
So it's not worth dragging along.
--- drivers/video/console/fbcon.c | 334 ------------------------------------------ 1 file changed, 4 insertions(+), 330 deletions(-)
drivers/video/console/fbcon.c +4 -330
@@ -101,12 +101,6 @@ static int logo_lines;/* logo_shown is an index to vc_cons when >= 0; otherwise follows FBCON_LOGO enums. */ static int logo_shown =FBCON_LOGO_CANSHOW ; -/* Software scrollback */ -static int fbcon_softback_size =32768 ; -static unsigned long softback_buf, softback_curr; -static unsigned long softback_in; -static unsigned long softback_top, softback_end; -static int softback_lines;/* console mappings */ static int first_fb_vc;static int last_fb_vc =MAX_NR_CONSOLES -1 ;
@@ -140,8 +134,6 @@ static int fbcon_has_sysfs;static const struct consw fb_con; -#define CM_SOFTBACK (8) -#define advance_row (p, delta) (unsigned short *)((unsigned long)(p) + (delta) * vc->vc_size_row)static int fbcon_set_origin (struct vc_data *);
@@ -349,18 +341,6 @@ static int get_color(struct vc_data *vc,return color; } -static void fbcon_update_softback (struct vc_data *vc) -{ -int l = fbcon_softback_size / vc->vc_size_row; - -if (l >5 ) - softback_end = softback_buf + l * vc->vc_size_row; -else -/* Smaller scrollback makes no sense, and 0 would screw -the operation totally */ - softback_top =0 ; -} -static void fb_flashcursor (struct work_struct *work) { struct fb_info *info = container_of(work, struct fb_info, queue);
@@ -390,7 +370,7 @@ static void fb_flashcursor(struct work_s c =scr_readw ((u16 *) vc->vc_pos); mode = (!ops->cursor_flash || ops->cursor_state.enable) ?CM_ERASE :CM_DRAW ; - ops->cursor (vc, info, mode, softback_lines,get_color (vc, info, c,1 ), + ops->cursor (vc, info, mode,0 ,get_color (vc, info, c,1 ),get_color (vc, info, c,0 ));console_unlock (); }
@@ -450,13 +430,7 @@ static int __init fb_console_setup(char }if (!strncmp (options,"scrollback:" ,11 )) { - options +=11 ; -if (*options) { - fbcon_softback_size =simple_strtoul (options, &options,0 ); -if (*options =='k' || *options =='K' ) { - fbcon_softback_size *=1024 ; - } - } +pr_warn ("Ignoring scrollback size option\n" );continue ; }
@@ -961,31 +935,6 @@ static const char *fbcon_startup(void) p->con_rotate = initial_rotation;set_blitting_type (vc, info); -if (info->fix.type !=FB_TYPE_TEXT ) { -if (fbcon_softback_size) { -if (!softback_buf) { - softback_buf = - (unsigned long ) -kmalloc (fbcon_softback_size, -GFP_KERNEL ); -if (!softback_buf) { - fbcon_softback_size =0 ; - softback_top =0 ; - } - } - }else { -if (softback_buf) { -kfree ((void *) softback_buf); - softback_buf =0 ; - softback_top =0 ; - } - } -if (softback_buf) - softback_in = softback_top = softback_curr = - softback_buf; - softback_lines =0 ; - } -/* Setup default font */ if (!p->fontdata && !vc->vc_font.data) {if (!fontname[0 ] || !(font =find_font (fontname)))
@@ -1148,9 +1097,6 @@ static void fbcon_init(struct vc_data *vif (logo)fbcon_prepare_logo (vc, info, cols, rows, new_cols, new_rows); -if (vc == svc && softback_buf) -fbcon_update_softback (vc); -if (ops->rotate_font && ops->rotate_font (info, vc)) { ops->rotate =FB_ROTATE_UR ;set_blitting_type (vc, info);
@@ -1310,7 +1256,6 @@ static void fbcon_cursor(struct vc_data {struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];struct fbcon_ops *ops = info->fbcon_par; -int y;int c =scr_readw ((u16 *) vc->vc_pos); ops->cur_blink_jiffies =msecs_to_jiffies (vc->vc_cur_blink_ms);
@@ -1324,16 +1269,8 @@ static void fbcon_cursor(struct vc_datafbcon_add_cursor_timer (info); ops->cursor_flash = (mode ==CM_ERASE ) ?0 :1 ; -if (mode &CM_SOFTBACK ) { - mode &= ~CM_SOFTBACK ; - y = softback_lines; - }else { -if (softback_lines) -fbcon_set_origin (vc); - y =0 ; - } - ops->cursor (vc, info, mode, y,get_color (vc, info, c,1 ), + ops->cursor (vc, info, mode,0 ,get_color (vc, info, c,1 ),get_color (vc, info, c,0 )); }
@@ -1404,8 +1341,6 @@ static void fbcon_set_disp(struct fb_infif (con_is_visible (vc)) {update_screen (vc); -if (softback_buf) -fbcon_update_softback (vc); } }
@@ -1543,99 +1478,6 @@ static __inline__ void ypan_down_redraw( scrollback_current =0 ; } -static void fbcon_redraw_softback (struct vc_data *vc,struct display *p, -long delta) -{ -int count = vc->vc_rows; -unsigned short *d, *s; -unsigned long n; -int line =0 ; - - d = (u16 *) softback_curr; -if (d == (u16 *) softback_in) - d = (u16 *) vc->vc_origin; - n = softback_curr + delta * vc->vc_size_row; - softback_lines -= delta; -if (delta <0 ) { -if (softback_curr < softback_top && n < softback_buf) { - n += softback_end - softback_buf; -if (n < softback_top) { - softback_lines -= - (softback_top - n) / vc->vc_size_row; - n = softback_top; - } - }else if (softback_curr >= softback_top - && n < softback_top) { - softback_lines -= - (softback_top - n) / vc->vc_size_row; - n = softback_top; - } - }else { -if (softback_curr > softback_in && n >= softback_end) { - n += softback_buf - softback_end; -if (n > softback_in) { - n = softback_in; - softback_lines =0 ; - } - }else if (softback_curr <= softback_in && n > softback_in) { - n = softback_in; - softback_lines =0 ; - } - } -if (n == softback_curr) -return ; - softback_curr = n; - s = (u16 *) softback_curr; -if (s == (u16 *) softback_in) - s = (u16 *) vc->vc_origin; -while (count--) { -unsigned short *start; -unsigned short *le; -unsigned short c; -int x =0 ; -unsigned short attr =1 ; - - start = s; - le =advance_row (s,1 ); -do { - c =scr_readw (s); -if (attr != (c &0xff00 )) { - attr = c &0xff00 ; -if (s > start) { -fbcon_putcs (vc, start, s - start, - line, x); - x += s - start; - start = s; - } - } -if (c ==scr_readw (d)) { -if (s > start) { -fbcon_putcs (vc, start, s - start, - line, x); - x += s - start +1 ; - start = s +1 ; - }else { - x++; - start++; - } - } - s++; - d++; - }while (s < le); -if (s > start) -fbcon_putcs (vc, start, s - start, line, x); - line++; -if (d == (u16 *) softback_end) - d = (u16 *) softback_buf; -if (d == (u16 *) softback_in) - d = (u16 *) vc->vc_origin; -if (s == (u16 *) softback_end) - s = (u16 *) softback_buf; -if (s == (u16 *) softback_in) - s = (u16 *) vc->vc_origin; - } -} -static void fbcon_redraw_move (struct vc_data *vc,struct display *p,int line,int count,int dy) {
@@ -1775,31 +1617,6 @@ static void fbcon_redraw(struct vc_data } } -static inline void fbcon_softback_note (struct vc_data *vc,int t, -int count) -{ -unsigned short *p; - -if (vc->vc_num != fg_console) -return ; - p = (unsigned short *) (vc->vc_origin + t * vc->vc_size_row); - -while (count) { -scr_memcpyw ((u16 *) softback_in, p, vc->vc_size_row); - count--; - p =advance_row (p,1 ); - softback_in += vc->vc_size_row; -if (softback_in == softback_end) - softback_in = softback_buf; -if (softback_in == softback_top) { - softback_top += vc->vc_size_row; -if (softback_top == softback_end) - softback_top = softback_buf; - } - } - softback_curr = softback_in; -} -static int fbcon_scroll (struct vc_data *vc,int t,int b,int dir,int count) {
@@ -1822,8 +1639,6 @@ static int fbcon_scroll(struct vc_data *case SM_UP :if (count > vc->vc_rows)/* Maximum realistic size */ count = vc->vc_rows; -if (softback_top) -fbcon_softback_note (vc, t, count);if (logo_shown >=0 ) goto redraw_up;switch (p->scrollmode) {
@@ -2194,14 +2009,6 @@ static int fbcon_switch(struct vc_data * info = registered_fb[con2fb_map[vc->vc_num]]; ops = info->fbcon_par; -if (softback_top) { -if (softback_lines) -fbcon_set_origin (vc); - softback_top = softback_curr = softback_in = softback_buf; - softback_lines =0 ; -fbcon_update_softback (vc); - } -if (logo_shown >=0 ) {struct vc_data *conp2 = vc_cons[logo_shown].d;
@@ -2535,9 +2342,6 @@ static int fbcon_do_set_font(struct vc_dint cnt;char *old_data =NULL ; -if (con_is_visible (vc) && softback_lines) -fbcon_set_origin (vc); - resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);if (p->userfont) old_data = vc->vc_font.data;
@@ -2563,8 +2367,6 @@ static int fbcon_do_set_font(struct vc_d cols /= w; rows /= h;vc_resize (vc, cols, rows); -if (con_is_visible (vc) && softback_buf) -fbcon_update_softback (vc); }else if (con_is_visible (vc) && vc->vc_mode ==KD_TEXT ) {fbcon_clear_margins (vc,0 );
@@ -2722,19 +2524,7 @@ static void fbcon_set_palette(struct vc_static u16 *fbcon_screen_pos (struct vc_data *vc,int offset) { -unsigned long p; -int line; - -if (vc->vc_num != fg_console || !softback_lines) -return (u16 *) (vc->vc_origin + offset); - line = offset / vc->vc_size_row; -if (line >= softback_lines) -return (u16 *) (vc->vc_origin + offset - - softback_lines * vc->vc_size_row); - p = softback_curr + offset; -if (p >= softback_end) - p += softback_buf - softback_end; -return (u16 *) p; +return (u16 *) (vc->vc_origin + offset); } static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos,
@@ -2748,22 +2538,7 @@ static unsigned long fbcon_getxy(struct x = offset % vc->vc_cols; y = offset / vc->vc_cols; -if (vc->vc_num == fg_console) - y += softback_lines; ret = pos + (vc->vc_cols - x) *2 ; - }else if (vc->vc_num == fg_console && softback_lines) { -unsigned long offset = pos - softback_curr; - -if (pos < softback_curr) - offset += softback_end - softback_buf; - offset /=2 ; - x = offset % vc->vc_cols; - y = offset / vc->vc_cols; - ret = pos + (vc->vc_cols - x) *2 ; -if (ret == softback_end) - ret = softback_buf; -if (ret == softback_in) - ret = vc->vc_origin; }else {/* Should not happen */ x = y =0 ;
@@ -2791,106 +2566,11 @@ static void fbcon_invert_region(struct v a = ((a) &0x88ff ) | (((a) &0x7000 ) >>4 ) | (((a) &0x0700 ) <<4 );scr_writew (a, p++); -if (p == (u16 *) softback_end) - p = (u16 *) softback_buf; -if (p == (u16 *) softback_in) - p = (u16 *) vc->vc_origin; } } -static void fbcon_scrolldelta (struct vc_data *vc,int lines) -{ -struct fb_info *info = registered_fb[con2fb_map[fg_console]]; -struct fbcon_ops *ops = info->fbcon_par; -struct display *disp = &fb_display[fg_console]; -int offset, limit, scrollback_old; - -if (softback_top) { -if (vc->vc_num != fg_console) -return ; -if (vc->vc_mode !=KD_TEXT || !lines) -return ; -if (logo_shown >=0 ) { -struct vc_data *conp2 = vc_cons[logo_shown].d; - -if (conp2->vc_top == logo_lines - && conp2->vc_bottom == conp2->vc_rows) - conp2->vc_top =0 ; -if (logo_shown == vc->vc_num) { -unsigned long p, q; -int i; - - p = softback_in; - q = vc->vc_origin + - logo_lines * vc->vc_size_row; -for (i =0 ; i < logo_lines; i++) { -if (p == softback_top) -break ; -if (p == softback_buf) - p = softback_end; - p -= vc->vc_size_row; - q -= vc->vc_size_row; -scr_memcpyw ((u16 *) q, (u16 *) p, - vc->vc_size_row); - } - softback_in = softback_curr = p; -update_region (vc, vc->vc_origin, - logo_lines * vc->vc_cols); - } - logo_shown =FBCON_LOGO_CANSHOW ; - } -fbcon_cursor (vc,CM_ERASE |CM_SOFTBACK ); -fbcon_redraw_softback (vc, disp, lines); -fbcon_cursor (vc,CM_DRAW |CM_SOFTBACK ); -return ; - } - -if (!scrollback_phys_max) -return ; - - scrollback_old = scrollback_current; - scrollback_current -= lines; -if (scrollback_current <0 ) - scrollback_current =0 ; -else if (scrollback_current > scrollback_max) - scrollback_current = scrollback_max; -if (scrollback_current == scrollback_old) -return ; - -if (fbcon_is_inactive (vc, info)) -return ; - -fbcon_cursor (vc,CM_ERASE ); - - offset = disp->yscroll - scrollback_current; - limit = disp->vrows; -switch (disp->scrollmode) { -case SCROLL_WRAP_MOVE : - info->var.vmode |=FB_VMODE_YWRAP ; -break ; -case SCROLL_PAN_MOVE : -case SCROLL_PAN_REDRAW : - limit -= vc->vc_rows; - info->var.vmode &= ~FB_VMODE_YWRAP ; -break ; - } -if (offset <0 ) - offset += limit; -else if (offset >= limit) - offset -= limit; - - ops->var.xoffset =0 ; - ops->var.yoffset = offset * vc->vc_font.height; - ops->update_start (info); - -if (!scrollback_current) -fbcon_cursor (vc,CM_DRAW ); -} -static int fbcon_set_origin (struct vc_data *vc) { -if (softback_lines) -fbcon_scrolldelta (vc, softback_lines);return 0 ; }
@@ -2954,8 +2634,6 @@ static void fbcon_modechanged(struct fb_fbcon_set_palette (vc, color_table);update_screen (vc); -if (softback_buf) -fbcon_update_softback (vc); } }
@@ -3375,7 +3053,6 @@ static const struct consw fb_con = { .con_font_default = fbcon_set_def_font, .con_font_copy = fbcon_copy_font, .con_set_palette = fbcon_set_palette, - .con_scrolldelta = fbcon_scrolldelta, .con_set_origin = fbcon_set_origin, .con_invert_region = fbcon_invert_region, .con_screen_pos = fbcon_screen_pos,
@@ -3584,9 +3261,6 @@ static void fbcon_exit(void)if (fbcon_has_exited)return ; -kfree ((void *)softback_buf); - softback_buf =0UL ; -for (i =0 ; i <FB_MAX ; i++) {int pending =0 ;
Greg Kroah-Hartman
maintainerPATCH 36/70 fbcon: remove now unusued softback_lines cursor() argument
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 06a0df4d1b8b13b551668e47b11fd7629033b7df upstream.
Since the softscroll code got removed, this argument is always zero and makes no sense any more.
--- drivers/video/console/bitblit.c | 11 +---------- drivers/video/console/fbcon.c | 4 ++-- drivers/video/console/fbcon.h | 2 +- drivers/video/console/fbcon_ccw.c | 11 +---------- drivers/video/console/fbcon_cw.c | 11 +---------- drivers/video/console/fbcon_ud.c | 11 +---------- drivers/video/console/tileblit.c | 2 +- 7 files changed, 8 insertions(+), 44 deletions(-)
drivers/video/console/bitblit.c +1 -10
@@ -234,7 +234,7 @@ static void bit_clear_margins(struct vc_ }static void bit_cursor (struct vc_data *vc,struct fb_info *info,int mode, -int softback_lines,int fg,int bg) +int fg,int bg) {struct fb_cursor cursor;struct fbcon_ops *ops = info->fbcon_par;
@@ -247,15 +247,6 @@ static void bit_cursor(struct vc_data *v cursor.set =0 ; -if (softback_lines) { -if (y + softback_lines >= vc->vc_rows) { - mode =CM_ERASE ; - ops->cursor_flash =0 ; -return ; - }else - y += softback_lines; - } - c =scr_readw ((u16 *) vc->vc_pos); attribute =get_attribute (info, c); src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
drivers/video/console/fbcon.c +2 -2
@@ -370,7 +370,7 @@ static void fb_flashcursor(struct work_s c =scr_readw ((u16 *) vc->vc_pos); mode = (!ops->cursor_flash || ops->cursor_state.enable) ?CM_ERASE :CM_DRAW ; - ops->cursor (vc, info, mode,0 ,get_color (vc, info, c,1 ), + ops->cursor (vc, info, mode,get_color (vc, info, c,1 ),get_color (vc, info, c,0 ));console_unlock (); }
@@ -1270,7 +1270,7 @@ static void fbcon_cursor(struct vc_data ops->cursor_flash = (mode ==CM_ERASE ) ?0 :1 ; - ops->cursor (vc, info, mode,0 ,get_color (vc, info, c,1 ), + ops->cursor (vc, info, mode,get_color (vc, info, c,1 ),get_color (vc, info, c,0 )); }
drivers/video/console/fbcon.h +1 -1
@@ -62,7 +62,7 @@ struct fbcon_ops {void (*clear_margins)(struct vc_data *vc,struct fb_info *info,int bottom_only);void (*cursor)(struct vc_data *vc,struct fb_info *info,int mode, -int softback_lines,int fg,int bg); +int fg,int bg);int (*update_start)(struct fb_info *info);int (*rotate_font)(struct fb_info *info,struct vc_data *vc);struct fb_var_screeninfo var;/* copy of the current fb_var_screeninfo */
drivers/video/console/fbcon_ccw.c +1 -10
@@ -219,7 +219,7 @@ static void ccw_clear_margins(struct vc_ }static void ccw_cursor (struct vc_data *vc,struct fb_info *info,int mode, -int softback_lines,int fg,int bg) +int fg,int bg) {struct fb_cursor cursor;struct fbcon_ops *ops = info->fbcon_par;
@@ -236,15 +236,6 @@ static void ccw_cursor(struct vc_data *v cursor.set =0 ; -if (softback_lines) { -if (y + softback_lines >= vc->vc_rows) { - mode =CM_ERASE ; - ops->cursor_flash =0 ; -return ; - }else - y += softback_lines; - } - c =scr_readw ((u16 *) vc->vc_pos); attribute =get_attribute (info, c); src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
drivers/video/console/fbcon_cw.c +1 -10
@@ -202,7 +202,7 @@ static void cw_clear_margins(struct vc_d }static void cw_cursor (struct vc_data *vc,struct fb_info *info,int mode, -int softback_lines,int fg,int bg) +int fg,int bg) {struct fb_cursor cursor;struct fbcon_ops *ops = info->fbcon_par;
@@ -219,15 +219,6 @@ static void cw_cursor(struct vc_data *vc cursor.set =0 ; -if (softback_lines) { -if (y + softback_lines >= vc->vc_rows) { - mode =CM_ERASE ; - ops->cursor_flash =0 ; -return ; - }else - y += softback_lines; - } - c =scr_readw ((u16 *) vc->vc_pos); attribute =get_attribute (info, c); src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
drivers/video/console/fbcon_ud.c +1 -10
@@ -249,7 +249,7 @@ static void ud_clear_margins(struct vc_d }static void ud_cursor (struct vc_data *vc,struct fb_info *info,int mode, -int softback_lines,int fg,int bg) +int fg,int bg) {struct fb_cursor cursor;struct fbcon_ops *ops = info->fbcon_par;
@@ -267,15 +267,6 @@ static void ud_cursor(struct vc_data *vc cursor.set =0 ; -if (softback_lines) { -if (y + softback_lines >= vc->vc_rows) { - mode =CM_ERASE ; - ops->cursor_flash =0 ; -return ; - }else - y += softback_lines; - } - c =scr_readw ((u16 *) vc->vc_pos); attribute =get_attribute (info, c); src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.height));
drivers/video/console/tileblit.c +1 -1
@@ -80,7 +80,7 @@ static void tile_clear_margins(struct vc }static void tile_cursor (struct vc_data *vc,struct fb_info *info,int mode, -int softback_lines,int fg,int bg) +int fg,int bg) {struct fb_tilecursor cursor;int use_sw = (vc->vc_cursor_type &0x10 );
Greg Kroah-Hartman
maintainerPATCH 37/70 vgacon: remove software scrollback support
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 973c096f6a85e5b5f2a295126ba6928d9a6afd45 upstream.
Yunhai Zhang recently fixed a VGA software scrollback bug in commit ebfdfeeae8c0 ("vgacon: Fix for missing check in scrollback handling"), but that then made people look more closely at some of this code, and there were more problems on the vgacon side, but also the fbcon software scrollback.
We don't really have anybody who maintains this code - probably because nobody actually _uses_ it any more. Sure, people still use both VGA and the framebuffer consoles, but they are no longer the main user interfaces to the kernel, and haven't been for decades, so these kinds of extra features end up bitrotting and not really being used.
So rather than try to maintain a likely unused set of code, I'll just aggressively remove it, and see if anybody even notices. Maybe there are people who haven't jumped on the whole GUI badnwagon yet, and think it's just a fad. And maybe those people use the scrollback code.
If that turns out to be the case, we can resurrect this again, once we've found the sucker^Wmaintainer for it who actually uses it.
--- arch/powerpc/configs/pasemi_defconfig | 1 arch/powerpc/configs/ppc6xx_defconfig | 1 arch/x86/configs/i386_defconfig | 1 arch/x86/configs/x86_64_defconfig | 1 drivers/video/console/Kconfig | 25 ----- drivers/video/console/vgacon.c | 159 ---------------------------------- 6 files changed, 1 insertion(+), 187 deletions(-)
arch/powerpc/configs/pasemi_defconfig +0 -1
@@ -115,7 +115,6 @@ CONFIG_FB_NVIDIA=y CONFIG_FB_NVIDIA_I2C=y CONFIG_FB_RADEON=y # CONFIG_LCD_CLASS_DEVICE is not set -CONFIG_VGACON_SOFT_SCROLLBACK=y CONFIG_LOGO=y CONFIG_SOUND=y CONFIG_SND=y
arch/powerpc/configs/ppc6xx_defconfig +0 -1
@@ -796,7 +796,6 @@ CONFIG_FB_TRIDENT=m CONFIG_FB_SM501=m CONFIG_FB_IBM_GXT4500=y CONFIG_LCD_PLATFORM=m -CONFIG_VGACON_SOFT_SCROLLBACK=y CONFIG_FRAMEBUFFER_CONSOLE=y CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y CONFIG_LOGO=y
arch/x86/configs/i386_defconfig +0 -1
@@ -217,7 +217,6 @@ CONFIG_FB_MODE_HELPERS=y CONFIG_FB_TILEBLITTING=y CONFIG_FB_EFI=y # CONFIG_LCD_CLASS_DEVICE is not set -CONFIG_VGACON_SOFT_SCROLLBACK=y CONFIG_LOGO=y # CONFIG_LOGO_LINUX_MONO is not set # CONFIG_LOGO_LINUX_VGA16 is not set
arch/x86/configs/x86_64_defconfig +0 -1
@@ -212,7 +212,6 @@ CONFIG_FB_MODE_HELPERS=y CONFIG_FB_TILEBLITTING=y CONFIG_FB_EFI=y # CONFIG_LCD_CLASS_DEVICE is not set -CONFIG_VGACON_SOFT_SCROLLBACK=y CONFIG_LOGO=y # CONFIG_LOGO_LINUX_MONO is not set # CONFIG_LOGO_LINUX_VGA16 is not set
drivers/video/console/Kconfig +0 -25
@@ -22,31 +22,6 @@ config VGA_CONSOLE Say Y. -config VGACON_SOFT_SCROLLBACK - bool "Enable Scrollback Buffer in System RAM" - depends on VGA_CONSOLE - default n - help - The scrollback buffer of the standard VGA console is located in - the VGA RAM. The size of this RAM is fixed and is quite small. - If you require a larger scrollback buffer, this can be placed in - System RAM which is dynamically allocated during initialization. - Placing the scrollback buffer in System RAM will slightly slow - down the console. - - If you want this feature, say 'Y' here and enter the amount of - RAM to allocate for this buffer. If unsure, say 'N'. - -config VGACON_SOFT_SCROLLBACK_SIZE - int "Scrollback Buffer Size (in KB)" - depends on VGACON_SOFT_SCROLLBACK - range 1 1024 - default "64" - help - Enter the amount of System RAM to allocate for the scrollback - buffer. Each 64KB will give you approximately 16 80x25 - screenfuls of scrollback buffer - config MDA_CONSOLE depends on !M68K && !PARISC && ISA tristate "MDA text console (dual-headed)"
drivers/video/console/vgacon.c +1 -158
189 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 38/70 KVM: VMX: Dont freeze guest when event delivery causes an APIC-access exit
In reply to Greg Kroah-HartmanFrom: Wanpeng Li <[email protected]>
commit 99b82a1437cb31340dbb2c437a2923b9814a7b15 upstream.
According to SDM 27.2.4, Event delivery causes an APIC-access VM exit. Don't report internal error and freeze guest when event delivery causes an APIC-access exit, it is handleable and the event will be re-injected during the next vmentry.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/vmx.c +1 -0
@@ -8606,6 +8606,7 @@ static int vmx_handle_exit(struct kvm_vc (exit_reason !=EXIT_REASON_EXCEPTION_NMI && exit_reason !=EXIT_REASON_EPT_VIOLATION && exit_reason !=EXIT_REASON_PML_FULL && + exit_reason !=EXIT_REASON_APIC_ACCESS && exit_reason != EXIT_REASON_TASK_SWITCH)) { vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; vcpu->run->internal.suberror =KVM_INTERNAL_ERROR_DELIVERY_EV ;
Greg Kroah-Hartman
maintainerPATCH 39/70 video: fbdev: fix OOB read in vga_8planes_imageblit()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit bd018a6a75cebb511bb55a0e7690024be975fe93 upstream.
syzbot is reporting OOB read at vga_8planes_imageblit() [1], for "cdat[y] >> 4" can become a negative value due to "const char *cdat".
[1] https://syzkaller.appspot.com/bug?id=0d7a0da1557dcd1989e00cb3692b26d4173b4132
--- drivers/video/fbdev/vga16fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/vga16fb.c +1 -1
@@ -1122,7 +1122,7 @@ static void vga_8planes_imageblit(structchar oldop =setop (0 );char oldsr =setsr (0 );char oldmask =selectmask (); -const char *cdat = image->data; +const unsigned char *cdat = image->data;u32 dx = image->dx;char __iomem *where;int y;
Greg Kroah-Hartman
maintainerPATCH 40/70 staging: greybus: audio: fix uninitialized value issue
In reply to Greg Kroah-HartmanFrom: Vaibhav Agarwal <[email protected]>
commit 1dffeb8b8b4c261c45416d53c75ea51e6ece1770 upstream.
The current implementation for gbcodec_mixer_dapm_ctl_put() uses uninitialized gbvalue for comparison with updated value. This was found using static analysis with coverity.
Uninitialized scalar variable (UNINIT)
11. uninit_use: Using uninitialized value
gbvalue.value.integer_value[0].
460 if (gbvalue.value.integer_value[0] != val) {
This patch fixes the issue with fetching the gbvalue before using it for
comparision.
--- drivers/staging/greybus/audio_topology.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
drivers/staging/greybus/audio_topology.c +15 -14
@@ -462,6 +462,15 @@ static int gbcodec_mixer_dapm_ctl_put(st val = ucontrol->value.integer.value[0 ] & mask; connect = !!val; + ret =gb_pm_runtime_get_sync (bundle); +if (ret) +return ret; + + ret =gb_audio_gb_get_control (module->mgmt_connection, data->ctl_id, +GB_AUDIO_INVALID_INDEX , &gbvalue); +if (ret) + goto exit; +/* update ucontrol */ if (gbvalue.value.integer_value[0 ] != val) {for (wi =0 ; wi < wlist->num_widgets; wi++) {
@@ -475,25 +484,17 @@ static int gbcodec_mixer_dapm_ctl_put(st gbvalue.value.integer_value[0 ] = ucontrol->value.integer.value[0 ]; - ret =gb_pm_runtime_get_sync (bundle); -if (ret) -return ret; - ret =gb_audio_gb_set_control (module->mgmt_connection, data->ctl_id,GB_AUDIO_INVALID_INDEX , &gbvalue); - -gb_pm_runtime_put_autosuspend (bundle); - -if (ret) { -dev_err_ratelimited (codec->dev, -"%d:Error in %s for %s\n" , ret, - __func__, kcontrol->id.name); -return ret; - } } -return 0 ; +exit: +gb_pm_runtime_put_autosuspend (bundle); +if (ret) +dev_err_ratelimited (codec_dev,"%d:Error in %s for %s\n" , ret, + __func__, kcontrol->id.name); +return ret; }#define SOC_DAPM_MIXER_GB (xname, kcount, data) \
Greg Kroah-Hartman
maintainerPATCH 41/70 usb: core: fix slab-out-of-bounds Read in read_descriptors
In reply to Greg Kroah-HartmanFrom: Zeng Tao <[email protected]>
commit a18cd6c9b6bc73dc17e8b7e9bd07decaa8833c97 upstream.
The USB device descriptor may get changed between two consecutive enumerations on the same device for some reason, such as DFU or malicius device.
In that case, we may access the changing descriptor if we don't take the device lock here.
The issue is reported:
https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9
--- drivers/usb/core/sysfs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/core/sysfs.c +5 -0
@@ -848,7 +848,11 @@ read_descriptors(struct file *filp, strusize_t srclen, n;int cfgno;void *src; +int retval; + retval =usb_lock_device_interruptible (udev); +if (retval <0 ) +return -EINTR ;/* The binary attribute begins with the device descriptor. * Following that are the raw descriptor entries for all the * configurations (config plus subsidiary descriptors).
@@ -873,6 +877,7 @@ read_descriptors(struct file *filp, stru off -= srclen; } } +usb_unlock_device (udev);return count - nleft; }
Greg Kroah-Hartman
maintainerPATCH 42/70 USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter
In reply to Greg Kroah-HartmanFrom: Patrick Riphagen <[email protected]>
commit 6ccc48e0eb2f3a5f3bd39954a21317e5f8874726 upstream.
The device added has an FTDI chip inside.
The device is used to connect Xsens USB Motion Trackers.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -708,6 +708,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_MTIUSBCONVERTER_PID) }, { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
drivers/usb/serial/ftdi_sio_ids.h +1 -0
@@ -159,6 +159,7 @@#define XSENS_AWINDA_DONGLE_PID 0x0102#define XSENS_MTW_PID 0x0200/* Xsens MTw */ #define XSENS_MTDEVBOARD_PID 0x0300/* Motion Tracker Development Board */ +#define XSENS_MTIUSBCONVERTER_PID 0x0301/* MTi USB converter */ #define XSENS_CONVERTER_PID 0xD00D/* Xsens USB-serial converter */ /* Xsens devices using FTDI VID */
Greg Kroah-Hartman
maintainerPATCH 43/70 USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules
In reply to Greg Kroah-HartmanFrom: Aleksander Morgado <[email protected]>
commit 1ac698790819b83f39fd7ea4f6cdabee9bdd7b38 upstream.
These modules have 2 different USB layouts:
The default layout with PID 0x9205 (AT+CUSBSELNV=1) exposes 4 TTYs and an ECM interface:
T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9205 Rev=00.00 S: Manufacturer=SimTech, Incorporated S: Product=SimTech SIM7080 S: SerialNumber=1234567890ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#=0x5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
The purpose of each TTY is as follows:
* ttyUSB0: DIAG/QCDM port.
* ttyUSB1: GNSS data.
* ttyUSB2: AT-capable port (control).
* ttyUSB3: AT-capable port (data).
In the secondary layout with PID=0x9206 (AT+CUSBSELNV=86) the module exposes 6 TTY ports:
T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9206 Rev=00.00 S: Manufacturer=SimTech, Incorporated S: Product=SimTech SIM7080 S: SerialNumber=1234567890ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
The purpose of each TTY is as follows:
* ttyUSB0: DIAG/QCDM port.
* ttyUSB1: GNSS data.
* ttyUSB2: AT-capable port (control).
* ttyUSB3: QFLOG interface.
* ttyUSB4: DAM interface.
* ttyUSB5: AT-capable port (data).
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1808,6 +1808,8 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ .driver_info = RSVD(7) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */ + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
Greg Kroah-Hartman
maintainerPATCH 44/70 usb: Fix out of sync data toggle if a configured device is reconfigured
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit cfd54fa83a5068b61b7eb28d3c117d8354c74c7a upstream.
Userspace drivers that use a SetConfiguration() request to "lightweight" reset an already configured usb device might cause data toggles to get out of sync between the device and host, and the device becomes unusable.
The xHCI host requires endpoints to be dropped and added back to reset the toggle. If USB core notices the new configuration is the same as the current active configuration it will avoid these extra steps by calling usb_reset_configuration() instead of usb_set_configuration().
A SetConfiguration() request will reset the device side data toggles. Make sure usb_reset_configuration() function also drops and adds back the endpoints to ensure data toggles are in sync.
To avoid code duplication split the current usb_disable_device() function and reuse the endpoint specific part.
--- drivers/usb/core/message.c | 93 ++++++++++++++++++++------------------------- 1 file changed, 43 insertions(+), 50 deletions(-)
drivers/usb/core/message.c +43 -50
@@ -1142,6 +1142,34 @@ void usb_disable_interface(struct usb_de } } +/* +* usb_disable_device_endpoints -- Disable all endpoints for a device +* @dev: the device whose endpoints are being disabled +* @skip_ep0: 0 to disable endpoint 0, 1 to skip it. +*/ +static void usb_disable_device_endpoints (struct usb_device *dev,int skip_ep0) +{ +struct usb_hcd *hcd =bus_to_hcd (dev->bus); +int i; + +if (hcd->driver->check_bandwidth) { +/* First pass: Cancel URBs, leave endpoint pointers intact. */ +for (i = skip_ep0; i <16 ; ++i) { +usb_disable_endpoint (dev, i, false); +usb_disable_endpoint (dev, i +USB_DIR_IN , false); + } +/* Remove endpoints from the host controller internal state */ +mutex_lock (hcd->bandwidth_mutex); +usb_hcd_alloc_bandwidth (dev,NULL ,NULL ,NULL ); +mutex_unlock (hcd->bandwidth_mutex); + } +/* Second pass: remove endpoint pointers */ +for (i = skip_ep0; i <16 ; ++i) { +usb_disable_endpoint (dev, i, true); +usb_disable_endpoint (dev, i +USB_DIR_IN , true); + } +} +/** * usb_disable_device - Disable all the endpoints for a USB device * @dev: the device whose endpoints are being disabled
@@ -1155,7 +1183,6 @@ void usb_disable_interface(struct usb_devoid usb_disable_device (struct usb_device *dev,int skip_ep0) {int i; -struct usb_hcd *hcd =bus_to_hcd (dev->bus);/* getting rid of interfaces will disconnect * any drivers bound to them (a key side effect)
@@ -1201,22 +1228,8 @@ void usb_disable_device(struct usb_devicdev_dbg (&dev->dev,"%s nuking %s URBs\n" , __func__, skip_ep0 ?"non-ep0" :"all" ); -if (hcd->driver->check_bandwidth) { -/* First pass: Cancel URBs, leave endpoint pointers intact. */ -for (i = skip_ep0; i <16 ; ++i) { -usb_disable_endpoint (dev, i, false); -usb_disable_endpoint (dev, i +USB_DIR_IN , false); - } -/* Remove endpoints from the host controller internal state */ -mutex_lock (hcd->bandwidth_mutex); -usb_hcd_alloc_bandwidth (dev,NULL ,NULL ,NULL ); -mutex_unlock (hcd->bandwidth_mutex); -/* Second pass: remove endpoint pointers */ - } -for (i = skip_ep0; i <16 ; ++i) { -usb_disable_endpoint (dev, i, true); -usb_disable_endpoint (dev, i +USB_DIR_IN , true); - } + +usb_disable_device_endpoints (dev, skip_ep0); }/**
@@ -1459,6 +1472,9 @@ EXPORT_SYMBOL_GPL(usb_set_interface);* The caller must own the device lock. * * Return: Zero on success, else a negative error code. +* +* If this routine fails the device will probably be in an unusable state +* with endpoints disabled, and interfaces only partially enabled. */ int usb_reset_configuration (struct usb_device *dev) {
@@ -1474,10 +1490,7 @@ int usb_reset_configuration(struct usb_d* calls during probe() are fine */ -for (i =1 ; i <16 ; ++i) { -usb_disable_endpoint (dev, i, true); -usb_disable_endpoint (dev, i +USB_DIR_IN , true); - } +usb_disable_device_endpoints (dev,1 );/* skip ep0*/ config = dev->actconfig; retval =0 ;
@@ -1490,34 +1503,10 @@ int usb_reset_configuration(struct usb_dmutex_unlock (hcd->bandwidth_mutex);return -ENOMEM ; } -/* Make sure we have enough bandwidth for each alternate setting 0 */ -for (i =0 ; i < config->desc.bNumInterfaces; i++) { -struct usb_interface *intf = config->interface[i]; -struct usb_host_interface *alt; - - alt =usb_altnum_to_altsetting (intf,0 ); -if (!alt) - alt = &intf->altsetting[0 ]; -if (alt != intf->cur_altsetting) - retval =usb_hcd_alloc_bandwidth (dev,NULL , - intf->cur_altsetting, alt); -if (retval <0 ) -break ; - } -/* If not, reinstate the old alternate settings */ + +/* xHCI adds all endpoints in usb_hcd_alloc_bandwidth */ + retval =usb_hcd_alloc_bandwidth (dev, config,NULL ,NULL );if (retval <0 ) { -reset_old_alts: -for (i--; i >=0 ; i--) { -struct usb_interface *intf = config->interface[i]; -struct usb_host_interface *alt; - - alt =usb_altnum_to_altsetting (intf,0 ); -if (!alt) - alt = &intf->altsetting[0 ]; -if (alt != intf->cur_altsetting) -usb_hcd_alloc_bandwidth (dev,NULL , - alt, intf->cur_altsetting); - }usb_enable_lpm (dev);mutex_unlock (hcd->bandwidth_mutex);return retval;
@@ -1526,8 +1515,12 @@ reset_old_alts:USB_REQ_SET_CONFIGURATION ,0 , config->desc.bConfigurationValue,0 , NULL, 0, USB_CTRL_SET_TIMEOUT); -if (retval <0 ) - goto reset_old_alts; +if (retval <0 ) { +usb_hcd_alloc_bandwidth (dev,NULL ,NULL ,NULL ); +usb_enable_lpm (dev); +mutex_unlock (hcd->bandwidth_mutex); +return retval; + }mutex_unlock (hcd->bandwidth_mutex);/* re-init hc/hcd interface/endpoint state */
Greg Kroah-Hartman
maintainerPATCH 45/70 IB/rxe: Remove a pointless indirection layer
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 839f5ac0d806970a102117be03ef05272c50d20e ]
Neither rxe->ifc_ops nor any of the function pointers in struct struct rxe_ifc_ops ever change. Hence remove the rxe->ifc_ops indirection mechanism.
--- drivers/infiniband/sw/rxe/rxe.c | 2 +- drivers/infiniband/sw/rxe/rxe_loc.h | 20 +++++++++++-- drivers/infiniband/sw/rxe/rxe_mcast.c | 4 +-- drivers/infiniband/sw/rxe/rxe_net.c | 43 ++++++++------------------- drivers/infiniband/sw/rxe/rxe_req.c | 4 +-- drivers/infiniband/sw/rxe/rxe_resp.c | 4 +-- drivers/infiniband/sw/rxe/rxe_verbs.c | 10 +++---- drivers/infiniband/sw/rxe/rxe_verbs.h | 22 -------------- 8 files changed, 42 insertions(+), 67 deletions(-)
drivers/infiniband/sw/rxe/rxe.c +1 -1
@@ -175,7 +175,7 @@ static int rxe_init_ports(struct rxe_dev *rxe)return -ENOMEM ; port->pkey_tbl[0 ] =0xffff ; - port->port_guid = rxe->ifc_ops->port_guid (rxe); + port->port_guid =rxe_port_guid (rxe);spin_lock_init (&port->port_lock);
drivers/infiniband/sw/rxe/rxe_loc.h +18 -2
@@ -141,6 +141,22 @@ void rxe_mem_cleanup(void *arg);int advance_dma_data (struct rxe_dma_info *dma,unsigned int length); +/* rxe_net.c */ +int rxe_loopback (struct sk_buff *skb); +int rxe_send (struct rxe_dev *rxe,struct rxe_pkt_info *pkt, +struct sk_buff *skb); +__be64 rxe_port_guid (struct rxe_dev *rxe); +struct sk_buff *rxe_init_packet (struct rxe_dev *rxe,struct rxe_av *av, +int paylen,struct rxe_pkt_info *pkt); +int rxe_prepare (struct rxe_dev *rxe,struct rxe_pkt_info *pkt, +struct sk_buff *skb,u32 *crc); +enum rdma_link_layer rxe_link_layer (struct rxe_dev *rxe,unsigned int port_num); +const char *rxe_parent_name (struct rxe_dev *rxe,unsigned int port_num); +struct device *rxe_dma_device (struct rxe_dev *rxe); +__be64 rxe_node_guid (struct rxe_dev *rxe); +int rxe_mcast_add (struct rxe_dev *rxe,union ib_gid *mgid); +int rxe_mcast_delete (struct rxe_dev *rxe,union ib_gid *mgid); +/* rxe_qp.c */ int rxe_qp_chk_init (struct rxe_dev *rxe,struct ib_qp_init_attr *init);
@@ -256,9 +272,9 @@ static inline int rxe_xmit_packet(struct rxe_dev *rxe, struct rxe_qp *qp,if (pkt->mask &RXE_LOOPBACK_MASK ) {memcpy (SKB_TO_PKT (skb), pkt,sizeof (*pkt)); - err = rxe->ifc_ops->loopback (skb); + err =rxe_loopback (skb); }else { - err = rxe->ifc_ops->send (rxe, pkt, skb); + err =rxe_send (rxe, pkt, skb); }if (err) {
drivers/infiniband/sw/rxe/rxe_mcast.c +2 -2
@@ -61,7 +61,7 @@ int rxe_mcast_get_grp(struct rxe_dev *rxe, union ib_gid *mgid,rxe_add_key (grp, mgid); - err = rxe->ifc_ops->mcast_add (rxe, mgid); + err =rxe_mcast_add (rxe, mgid);if (err) goto err2;
@@ -186,5 +186,5 @@ void rxe_mc_cleanup(void *arg)struct rxe_dev *rxe = grp->rxe;rxe_drop_key (grp); - rxe->ifc_ops->mcast_delete (rxe, &grp->mgid); +rxe_mcast_delete (rxe, &grp->mgid); }
drivers/infiniband/sw/rxe/rxe_net.c +13 -30
113 lines not on this page · raw message
drivers/infiniband/sw/rxe/rxe_req.c +2 -2
@@ -412,7 +412,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,/* init skb */ av =rxe_get_av (pkt); - skb = rxe->ifc_ops->init_packet (rxe, av, paylen, pkt); + skb =rxe_init_packet (rxe, av, paylen, pkt);if (unlikely (!skb))return NULL ;
@@ -483,7 +483,7 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,u32 *p;int err; - err = rxe->ifc_ops->prepare (rxe, pkt, skb, &crc); + err =rxe_prepare (rxe, pkt, skb, &crc);if (err)return err;
drivers/infiniband/sw/rxe/rxe_resp.c +2 -2
@@ -600,7 +600,7 @@ static struct sk_buff *prepare_ack_packet(struct rxe_qp *qp, pad = (-payload) &0x3 ; paylen = rxe_opcode[opcode].length + payload + pad +RXE_ICRC_SIZE ; - skb = rxe->ifc_ops->init_packet (rxe, &qp->pri_av, paylen, ack); + skb =rxe_init_packet (rxe, &qp->pri_av, paylen, ack);if (!skb)return NULL ;
@@ -629,7 +629,7 @@ static struct sk_buff *prepare_ack_packet(struct rxe_qp *qp,if (ack->mask &RXE_ATMACK_MASK )atmack_set_orig (ack, qp->resp.atomic_orig); - err = rxe->ifc_ops->prepare (rxe, ack, skb, &crc); + err =rxe_prepare (rxe, ack, skb, &crc);if (err) {kfree_skb (skb);return NULL ;
drivers/infiniband/sw/rxe/rxe_verbs.c +4 -6
@@ -234,7 +234,7 @@ static enum rdma_link_layer rxe_get_link_layer(struct ib_device *dev, {struct rxe_dev *rxe =to_rdev (dev); -return rxe->ifc_ops->link_layer (rxe, port_num); +return rxe_link_layer (rxe, port_num); } static struct ib_ucontext *rxe_alloc_ucontext(struct ib_device *dev,
@@ -1194,10 +1194,8 @@ static ssize_t rxe_show_parent(struct device *device, { struct rxe_dev *rxe = container_of(device, struct rxe_dev, ib_dev.dev); -char *name; - name = rxe->ifc_ops->parent_name (rxe,1 ); -return snprintf (buf,16 ,"%s\n" , name); +return snprintf (buf,16 ,"%s\n" ,rxe_parent_name (rxe,1 )); } static DEVICE_ATTR(parent, S_IRUGO, rxe_show_parent, NULL);
@@ -1219,9 +1217,9 @@ int rxe_register_device(struct rxe_dev *rxe) dev->node_type =RDMA_NODE_IB_CA ; dev->phys_port_cnt =1 ; dev->num_comp_vectors =RXE_NUM_COMP_VECTORS ; - dev->dma_device = rxe->ifc_ops->dma_device (rxe); + dev->dma_device =rxe_dma_device (rxe); dev->local_dma_lkey =0 ; - dev->node_guid = rxe->ifc_ops->node_guid (rxe); + dev->node_guid =rxe_node_guid (rxe); dev->dma_ops = &rxe_dma_mapping_ops; dev->uverbs_abi_ver =RXE_UVERBS_ABI_VERSION ;
drivers/infiniband/sw/rxe/rxe_verbs.h +0 -22
@@ -373,26 +373,6 @@ struct rxe_port {u32 qp_gsi_index; }; -/* callbacks from rdma_rxe to network interface layer */ -struct rxe_ifc_ops { -void (*release)(struct rxe_dev *rxe); -__be64 (*node_guid)(struct rxe_dev *rxe); -__be64 (*port_guid)(struct rxe_dev *rxe); -struct device *(*dma_device)(struct rxe_dev *rxe); -int (*mcast_add)(struct rxe_dev *rxe,union ib_gid *mgid); -int (*mcast_delete)(struct rxe_dev *rxe,union ib_gid *mgid); -int (*prepare)(struct rxe_dev *rxe,struct rxe_pkt_info *pkt, -struct sk_buff *skb,u32 *crc); -int (*send)(struct rxe_dev *rxe,struct rxe_pkt_info *pkt, -struct sk_buff *skb); -int (*loopback)(struct sk_buff *skb); -struct sk_buff *(*init_packet)(struct rxe_dev *rxe,struct rxe_av *av, -int paylen,struct rxe_pkt_info *pkt); -char *(*parent_name)(struct rxe_dev *rxe,unsigned int port_num); -enum rdma_link_layer (*link_layer)(struct rxe_dev *rxe, -unsigned int port_num); -}; -struct rxe_dev {struct ib_device ib_dev;struct ib_device_attr attr;
@@ -401,8 +381,6 @@ struct rxe_dev {struct kref ref_cnt;struct mutex usdev_lock; -struct rxe_ifc_ops *ifc_ops; -struct net_device *ndev;int xmit_errors;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 46/70 RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars
In reply to Greg Kroah-HartmanFrom: Yi Zhang <[email protected]>
[ Upstream commit 60b1af64eb35074a4f2d41cc1e503a7671e68963 ]
'parent' sysfs reads will yield '\0' bytes when the interface name has 15 chars, and there will no "\n" output.
To reproduce, create one interface with 15 chars:
[root@test ~]# ip a s enp0s29u1u7u3c2
2: enp0s29u1u7u3c2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
link/ether 02:21:28:57:47:17 brd ff:ff:ff:ff:ff:ff
inet6 fe80::ac41:338f:5bcd:c222/64 scope link noprefixroute
valid_lft forever preferred_lft forever [root@test ~]# modprobe rdma_rxe
[root@test ~]# echo enp0s29u1u7u3c2 > /sys/module/rdma_rxe/parameters/add [root@test ~]# cat /sys/class/infiniband/rxe0/parent enp0s29u1u7u3c2[root@test ~]#
[root@test ~]# f="/sys/class/infiniband/rxe0/parent" [root@test ~]# echo "$(<"$f")"
-bash: warning: command substitution: ignored null byte in input enp0s29u1u7u3c2
Use scnprintf and PAGE_SIZE to fill the sysfs output buffer.
--- drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_verbs.c +1 -1
@@ -1195,7 +1195,7 @@ static ssize_t rxe_show_parent(struct device *device, struct rxe_dev *rxe = container_of(device, struct rxe_dev, ib_dev.dev); -return snprintf (buf,16 ,"%s\n" ,rxe_parent_name (rxe,1 )); +return scnprintf (buf,PAGE_SIZE ,"%s\n" ,rxe_parent_name (rxe,1 )); } static DEVICE_ATTR(parent, S_IRUGO, rxe_show_parent, NULL);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 47/70 gcov: add support for GCC 10.1
In reply to Greg Kroah-HartmanFrom: Peter Oberparleiter <[email protected]>
[ Upstream commit 40249c6962075c040fd071339acae524f18bfac9 ]
Using gcov to collect coverage data for kernels compiled with GCC 10.1 causes random malfunctions and kernel crashes. This is the result of a changed GCOV_COUNTERS value in GCC 10.1 that causes a mismatch between the layout of the gcov_info structure created by GCC profiling code and the related structure used by the kernel.
Fix this by updating the in-kernel GCOV_COUNTERS value. Also re-enable config GCOV_KERNEL for use with GCC 10.
--- kernel/gcov/Kconfig | 1 - kernel/gcov/gcc_4_7.c | 4 +++- 2 files changed, 3 insertions(+), 2 deletions(-)
kernel/gcov/Kconfig +0 -1
@@ -3,7 +3,6 @@ menu "GCOV-based kernel profiling" config GCOV_KERNEL bool "Enable gcov-based kernel profiling" depends on DEBUG_FS - depends on !CC_IS_GCC || GCC_VERSION < 100000 select CONSTRUCTORS if !UML default n ---help---
kernel/gcov/gcc_4_7.c +3 -1
@@ -18,7 +18,9 @@#include <linux/vmalloc.h> #include "gcov.h" -#if (__GNUC__ >=7 ) +#if (__GNUC__ >=10 ) +#define GCOV_COUNTERS 8 +#elif (__GNUC__ >=7 )#define GCOV_COUNTERS 9#elif (__GNUC__ >5 ) || (__GNUC__ ==5 && __GNUC_MINOR__ >=1 )#define GCOV_COUNTERS 10
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 48/70 net: handle the return value of pskb_carve_frag_list() correctly
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
commit eabe861881a733fc84f286f4d5a1ffaddd4f526f upstream.
pskb_carve_frag_list() may return -ENOMEM in pskb_carve_inside_nonlinear(). we should handle this correctly or we would get wrong sk_buff.
--- net/core/skbuff.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/core/skbuff.c +7 -3
@@ -4990,9 +4990,13 @@ static int pskb_carve_inside_nonlinear(sif (skb_has_frag_list (skb))skb_clone_fraglist (skb); -if (k ==0 ) { -/* split line is in frag list */ -pskb_carve_frag_list (skb, shinfo, off - pos, gfp_mask); +/* split line is in frag list */ +if (k ==0 &&pskb_carve_frag_list (skb, shinfo, off - pos, gfp_mask)) { +/* skb_frag_unref() is not needed here as shinfo->nr_frags = 0. */ +if (skb_has_frag_list (skb)) +kfree_skb_list (skb_shinfo (skb)->frag_list); +kfree (data); +return -ENOMEM ; }skb_release_data (skb);
Greg Kroah-Hartman
maintainerPATCH 49/70 NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
[ Upstream commit 3d7a9520f0c3e6a68b6de8c5812fc8b6d7a52626 ]
A client should be able to handle getting an ERR_DELAY error while doing a LOCK call to reclaim state due to delegation being recalled. This is a transient error that can happen due to server moving its volumes and invalidating its file location cache and upon reference to it during the LOCK call needing to do an expensive lookup (leading to an ERR_DELAY error on a PUTFH).
--- fs/nfs/nfs4proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/nfs4proc.c +6 -1
@@ -6527,7 +6527,12 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, err =nfs4_set_lock_state (state, fl);if (err !=0 )return err; - err =_nfs4_do_setlk (state,F_SETLK , fl,NFS_LOCK_NEW ); +do { + err =_nfs4_do_setlk (state,F_SETLK , fl,NFS_LOCK_NEW ); +if (err != -NFS4ERR_DELAY ) +break ; +ssleep (1 ); + }while (err == -NFS4ERR_DELAY );return nfs4_handle_delegation_recall_error (server, state, stateid, fl, err); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 50/70 scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit ea403fde7552bd61bad6ea45e3feb99db77cb31e ]
When pm8001_tag_alloc() fails, task should be freed just like it is done in the subsequent error paths.
--- drivers/scsi/pm8001/pm8001_sas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_sas.c +1 -1
@@ -795,7 +795,7 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha, res =pm8001_tag_alloc (pm8001_ha, &ccb_tag);if (res) -return res; + goto ex_err; ccb = &pm8001_ha->ccb_info[ccb_tag]; ccb->device = pm8001_dev; ccb->ccb_tag = ccb_tag;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 51/70 scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 7b08e89f98cee9907895fabb64cf437bc505ce9a ]
The driver is unable to successfully login with remote device. During pt2pt login, the driver completes its FLOGI request with the remote device having WWN precedence. The remote device issues its own (delayed) FLOGI after accepting the driver's and, upon transmitting the FLOGI, immediately recognizes it has already processed the driver's FLOGI thus it transitions to sending a PLOGI before waiting for an ACC to its FLOGI.
In the driver, the FLOGI is received and an ACC sent, followed by the PLOGI being received and an ACC sent. The issue is that the PLOGI reception occurs before the response from the adapter from the FLOGI ACC is received. Processing of the PLOGI sets state flags to perform the REG_RPI mailbox command and proceed with the rest of discovery on the port. The same completion routine used by both FLOGI and PLOGI is generic in nature. One of the things it does is clear flags, and those flags happen to drive the rest of discovery. So what happened was the PLOGI processing set the flags, the FLOGI ACC completion cleared them, thus when the PLOGI ACC completes it doesn't see the flags and stops.
Fix by modifying the generic completion routine to not clear the rest of discovery flag (NLP_ACC_REGLOGIN) unless the completion is also associated with performing a mailbox command as part of its handling. For things such as FLOGI ACC, there isn't a subsequent action to perform with the adapter, thus there is no mailbox cmd ptr. PLOGI ACC though will perform REG_RPI upon completion, thus there is a mailbox cmd ptr.
--- drivers/scsi/lpfc/lpfc_els.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_els.c +3 -1
@@ -3865,7 +3865,9 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, out:if (ndlp &&NLP_CHK_NODE_ACT (ndlp) && shost) {spin_lock_irq (shost->host_lock); - ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN |NLP_RM_DFLT_RPI ); +if (mbox) + ndlp->nlp_flag &= ~NLP_ACC_REGLOGIN ; + ndlp->nlp_flag &= ~NLP_RM_DFLT_RPI ;spin_unlock_irq (shost->host_lock);/* If the node is not being used by another discovery thread,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 52/70 spi: spi-loopback-test: Fix out-of-bounds read
In reply to Greg Kroah-HartmanFrom: Vincent Whitchurch <[email protected]>
[ Upstream commit 837ba18dfcd4db21ad58107c65bfe89753aa56d7 ]
The "tx/rx-transfer - crossing PAGE_SIZE" test always fails when len=131071 and rx_offset >= 5:
spi-loopback-test spi0.0: Running test tx/rx-transfer - crossing PAGE_SIZE
...
with iteration values: len = 131071, tx_off = 0, rx_off = 3 with iteration values: len = 131071, tx_off = 0, rx_off = 4 with iteration values: len = 131071, tx_off = 0, rx_off = 5
loopback strangeness - rx changed outside of allowed range at: ...a4321000
spi_msg@ffffffd5a4157690
frame_length: 131071
actual_length: 131071
spi_transfer@ffffffd5a41576f8
len: 131071
tx_buf: ffffffd5a4340ffcNote that rx_offset > 3 can only occur if the SPI controller driver sets ->dma_alignment to a higher value than 4, so most SPI controller drivers are not affect.
The allocated Rx buffer is of size SPI_TEST_MAX_SIZE_PLUS, which is 132 KiB (assuming 4 KiB pages). This test uses an initial offset into the rx_buf of PAGE_SIZE - 4, and a len of 131071, so the range expected to be written in this transfer ends at (4096 - 4) + 5 + 131071 == 132 KiB, which is also the end of the allocated buffer. But the code which verifies the content of the buffer reads a byte beyond the allocated buffer and spuriously fails because this out-of-bounds read doesn't return the expected value.
Fix this by using ITERATE_LEN instead of ITERATE_MAX_LEN to avoid testing sizes which cause out-of-bounds reads.
--- drivers/spi/spi-loopback-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-loopback-test.c +1 -1
@@ -74,7 +74,7 @@ static struct spi_test spi_tests[] = { { .description = "tx/rx-transfer - crossing PAGE_SIZE", .fill_option = FILL_COUNT_8, - .iterate_len = { ITERATE_MAX_LEN }, + .iterate_len = { ITERATE_LEN }, .iterate_tx_align = ITERATE_ALIGN, .iterate_rx_align = ITERATE_ALIGN, .transfers = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 53/70 SUNRPC: stop printk reading past end of string
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 8c6b6c793ed32b8f9770ebcdf1ba99af423c303b ]
Since p points at raw xdr data, there's no guarantee that it's NULL terminated, so we should give a length. And probably escape any special characters too.
--- net/sunrpc/rpcb_clnt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sunrpc/rpcb_clnt.c +2 -2
@@ -975,8 +975,8 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr, p =xdr_inline_decode (xdr, len);if (unlikely (p ==NULL )) goto out_fail; -dprintk ("RPC: %5u RPCB_%s reply: %s\n" , req->rq_task->tk_pid, - req->rq_task->tk_msg.rpc_proc->p_name, (char *)p); +dprintk ("RPC: %5u RPCB_%s reply: %*pE\n" , req->rq_task->tk_pid, + req->rq_task->tk_msg.rpc_proc->p_name, len, (char *)p);if (rpc_uaddr2sockaddr (req->rq_xprt->xprt_net, (char *)p, len, sap,sizeof (address)) ==0 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 54/70 rapidio: Replace select DMAENGINES with depends on
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit d2b86100245080cfdf1e95e9e07477474c1be2bd ]
Enabling a whole subsystem from a single driver 'select' is frowned upon and won't be accepted in new drivers, that need to use 'depends on' instead. Existing selection of DMAENGINES will then cause circular dependencies. Replace them with a dependency.
--- drivers/rapidio/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rapidio/Kconfig +1 -1
@@ -25,7 +25,7 @@ config RAPIDIO_ENABLE_RX_TX_PORTS config RAPIDIO_DMA_ENGINE bool "DMA Engine support for RapidIO" depends on RAPIDIO - select DMADEVICES + depends on DMADEVICES select DMA_ENGINE help Say Y here if you want to use DMA Engine frameork for RapidIO data
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 55/70 i2c: algo: pca: Reapply i2c bus settings after reset
In reply to Greg Kroah-HartmanFrom: Evan Nimmo <[email protected]>
[ Upstream commit 0a355aeb24081e4538d4d424cd189f16c0bbd983 ]
If something goes wrong (such as the SCL being stuck low) then we need to reset the PCA chip. The issue with this is that on reset we lose all config settings and the chip ends up in a disabled state which results in a lock up/high CPU usage. We need to re-apply any configuration that had previously been set and re-enable the chip.
--- drivers/i2c/algos/i2c-algo-pca.c | 35 +++++++++++++++++++++----------- include/linux/i2c-algo-pca.h | 15 ++++++++++++++ 2 files changed, 38 insertions(+), 12 deletions(-)
drivers/i2c/algos/i2c-algo-pca.c +23 -12
@@ -50,8 +50,22 @@ static void pca_reset(struct i2c_algo_pca_data *adap)pca_outw (adap,I2C_PCA_INDPTR ,I2C_PCA_IPRESET );pca_outw (adap,I2C_PCA_IND ,0xA5 );pca_outw (adap,I2C_PCA_IND ,0x5A ); + +/* +* After a reset we need to re-apply any configuration +* (calculated in pca_init) to get the bus in a working state. +*/ +pca_outw (adap,I2C_PCA_INDPTR ,I2C_PCA_IMODE ); +pca_outw (adap,I2C_PCA_IND , adap->bus_settings.mode); +pca_outw (adap,I2C_PCA_INDPTR ,I2C_PCA_ISCLL ); +pca_outw (adap,I2C_PCA_IND , adap->bus_settings.tlow); +pca_outw (adap,I2C_PCA_INDPTR ,I2C_PCA_ISCLH ); +pca_outw (adap,I2C_PCA_IND , adap->bus_settings.thi); + +pca_set_con (adap,I2C_PCA_CON_ENSIO ); }else { adap->reset_chip (adap->data); +pca_set_con (adap,I2C_PCA_CON_ENSIO | adap->bus_settings.clock_freq); } }
@@ -435,13 +449,14 @@ static int pca_init(struct i2c_adapter *adap) " Use the nominal frequency.\n", adap->name); } -pca_reset (pca_data); - clock =pca_clock (pca_data);printk (KERN_INFO "%s: Clock frequency is %dkHz\n" , adap->name, freqs[clock]); -pca_set_con (pca_data,I2C_PCA_CON_ENSIO | clock); +/* Store settings as these will be needed when the PCA chip is reset */ + pca_data->bus_settings.clock_freq = clock; + +pca_reset (pca_data); }else {int clock;int mode;
@@ -508,19 +523,15 @@ static int pca_init(struct i2c_adapter *adap) thi = tlow * min_thi / min_tlow; } +/* Store settings as these will be needed when the PCA chip is reset */ + pca_data->bus_settings.mode = mode; + pca_data->bus_settings.tlow = tlow; + pca_data->bus_settings.thi = thi; +pca_reset (pca_data);printk (KERN_INFO "%s: Clock frequency is %dHz\n" , adap->name, clock *100 ); - -pca_outw (pca_data,I2C_PCA_INDPTR ,I2C_PCA_IMODE ); -pca_outw (pca_data,I2C_PCA_IND , mode); -pca_outw (pca_data,I2C_PCA_INDPTR ,I2C_PCA_ISCLL ); -pca_outw (pca_data,I2C_PCA_IND , tlow); -pca_outw (pca_data,I2C_PCA_INDPTR ,I2C_PCA_ISCLH ); -pca_outw (pca_data,I2C_PCA_IND , thi); - -pca_set_con (pca_data,I2C_PCA_CON_ENSIO ); }udelay (500 );/* 500 us for oscillator to stabilise */
include/linux/i2c-algo-pca.h +15 -0
@@ -52,6 +52,20 @@#define I2C_PCA_CON_SI 0x08/* Serial Interrupt */ #define I2C_PCA_CON_CR 0x07/* Clock Rate (MASK) */ +/** +* struct pca_i2c_bus_settings - The configured PCA i2c bus settings +* @mode: Configured i2c bus mode +* @tlow: Configured SCL LOW period +* @thi: Configured SCL HIGH period +* @clock_freq: The configured clock frequency +*/ +struct pca_i2c_bus_settings { +int mode; +int tlow; +int thi; +int clock_freq; +}; +struct i2c_algo_pca_data {void *data;/* private low level data */ void (*write_byte) (void *data,int reg,int val);
@@ -63,6 +77,7 @@ struct i2c_algo_pca_data {* For PCA9665, use the frequency you want here. */ unsigned int i2c_clock;unsigned int chip; +struct pca_i2c_bus_settings bus_settings; };int i2c_pca_add_bus (struct i2c_adapter *);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 56/70 clk: rockchip: Fix initialization of mux_pll_src_4plls_p
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit e9c006bc782c488f485ffe50de20b44e1e3daa18 ]
A new warning in Clang points out that the initialization of mux_pll_src_4plls_p appears incorrect:
../drivers/clk/rockchip/clk-rk3228.c:140:58: warning: suspicious concatenation of string literals in an array initialization; did you mean to separate the elements with a comma? [-Wstring-concatenation]
PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy" "usb480m" };
^
,
../drivers/clk/rockchip/clk-rk3228.c:140:48: note: place parentheses
around the string literal to silence warning
PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy" "usb480m" };
^1 warning generated.
Given the name of the variable and the same variable name in rv1108, it seems that this should have been four distinct elements. Fix it up by adding the comma as suggested.
--- drivers/clk/rockchip/clk-rk3228.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3228.c +1 -1
@@ -126,7 +126,7 @@ PNAME(mux_usb480m_p) = { "usb480m_phy", "xin24m" };PNAME (mux_hdmiphy_p) = {"hdmiphy_phy" ,"xin24m" };PNAME (mux_aclk_cpu_src_p) = {"cpll_aclk_cpu" ,"gpll_aclk_cpu" ,"hdmiphy_aclk_cpu" }; -PNAME (mux_pll_src_4plls_p) = {"cpll" ,"gpll" ,"hdmiphy" "usb480m" }; +PNAME (mux_pll_src_4plls_p) = {"cpll" ,"gpll" ,"hdmiphy" ,"usb480m" };PNAME (mux_pll_src_3plls_p) = {"cpll" ,"gpll" ,"hdmiphy" };PNAME (mux_pll_src_2plls_p) = {"cpll" ,"gpll" };PNAME (mux_sclk_hdmi_cec_p) = {"cpll" ,"gpll" ,"xin24m" };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 57/70 Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
[ Upstream commit 911e1987efc8f3e6445955fbae7f54b428b92bd3 ]
vmbus_wait_for_unload() looks for a CHANNELMSG_UNLOAD_RESPONSE message coming from Hyper-V. But if the message isn't found for some reason, the panic path gets hung forever. Add a timeout of 10 seconds to prevent this.
--- drivers/hv/channel_mgmt.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/hv/channel_mgmt.c +5 -2
@@ -681,7 +681,7 @@ static void vmbus_wait_for_unload(void)void *page_addr;struct hv_message *msg;struct vmbus_channel_message_header *hdr; -u32 message_type; +u32 message_type, i;/* * CHANNELMSG_UNLOAD_RESPONSE is always delivered to the CPU which was
@@ -691,8 +691,11 @@ static void vmbus_wait_for_unload(void)* functional and vmbus_unload_response() will complete * vmbus_connection.unload_event. If not, the last thing we can do is * read message pages for all CPUs directly. +* +* Wait no more than 10 seconds so that the panic path can't get +* hung forever in case the response message isn't seen. */ -while (1 ) { +for (i =0 ; i <1000 ; i++) {if (completion_done (&vmbus_connection.unload_event))break ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 58/70 MIPS: SNI: Fix MIPS_L1_CACHE_SHIFT
In reply to Greg Kroah-HartmanFrom: Thomas Bogendoerfer <[email protected]>
[ Upstream commit 564c836fd945a94b5dd46597d6b7adb464092650 ]
Commit 930beb5ac09a ("MIPS: introduce MIPS_L1_CACHE_SHIFT_<N>") forgot to select the correct MIPS_L1_CACHE_SHIFT for SNI RM. This breaks non coherent DMA because of a wrong allocation alignment.
--- arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/mips/Kconfig +1 -0
@@ -848,6 +848,7 @@ config SNI_RM select I8253 select I8259 select ISA + select MIPS_L1_CACHE_SHIFT_6 select SWAP_IO_SPACE if CPU_BIG_ENDIAN select SYS_HAS_CPU_R4X00 select SYS_HAS_CPU_R5000
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 59/70 perf test: Free formats for perf pmu parse test
In reply to Greg Kroah-HartmanFrom: Namhyung Kim <[email protected]>
[ Upstream commit d26383dcb2b4b8629fde05270b4e3633be9e3d4b ]
The following leaks were detected by ASAN:
Indirect leak of 360 byte(s) in 9 object(s) allocated from:
#0 0x7fecc305180e in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10780e)
#1 0x560578f6dce5 in perf_pmu__new_format util/pmu.c:1333
#2 0x560578f752fc in perf_pmu_parse util/pmu.y:59
#3 0x560578f6a8b7 in perf_pmu__format_parse util/pmu.c:73
#4 0x560578e07045 in test__pmu tests/pmu.c:155
#5 0x560578de109b in run_test tests/builtin-test.c:410
#6 0x560578de109b in test_and_print tests/builtin-test.c:440
#7 0x560578de401a in __cmd_test tests/builtin-test.c:661
#8 0x560578de401a in cmd_test tests/builtin-test.c:807
#9 0x560578e49354 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:312
#10 0x560578ce71a8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:364
#11 0x560578ce71a8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:408
#12 0x560578ce71a8 in main /home/namhyung/project/linux/tools/perf/perf.c:538
#13 0x7fecc2b7acc9 in __libc_start_main ../csu/libc-start.c:308--- tools/perf/tests/pmu.c | 1 + tools/perf/util/pmu.c | 11 +++++++++++ tools/perf/util/pmu.h | 1 + 3 files changed, 13 insertions(+)
tools/perf/tests/pmu.c +1 -0
@@ -169,6 +169,7 @@ int test__pmu(int subtest __maybe_unused) ret =0 ; }while (0 ); +perf_pmu__del_formats (&formats);test_format_dir_put (format);return ret; }
tools/perf/util/pmu.c +11 -0
@@ -1018,6 +1018,17 @@ void perf_pmu__set_format(unsigned long *bits, long from, long to)set_bit (b, bits); } +void perf_pmu__del_formats (struct list_head *formats) +{ +struct perf_pmu_format *fmt, *tmp; + +list_for_each_entry_safe (fmt, tmp, formats, list) { +list_del (&fmt->list); +free (fmt->name); +free (fmt); + } +} +static int sub_non_neg (int a,int b) {if (b > a)
tools/perf/util/pmu.h +1 -0
@@ -71,6 +71,7 @@ int perf_pmu__new_format(struct list_head *list, char *name, int config, unsigned long *bits);void perf_pmu__set_format (unsigned long *bits,long from,long to);int perf_pmu__format_parse (char *dir,struct list_head *head); +void perf_pmu__del_formats (struct list_head *formats);struct perf_pmu *perf_pmu__scan (struct perf_pmu *pmu);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 60/70 fbcon: Fix user font detection test at fbcon_resize().
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit ec0972adecb391a8d8650832263a4790f3bfb4df ]
syzbot is reporting OOB read at fbcon_resize() [1], for
commit 39b3cffb8cf31117 ("fbcon: prevent user font height or width change
from causing potential out-of-bounds access") is by error using
registered_fb[con2fb_map[vc->vc_num]]->fbcon_par->p->userfont (which was set to non-zero) instead of fb_display[vc->vc_num].userfont (which remains zero for that display).
We could remove tricky userfont flag [2], for we can determine it by comparing address of the font data and addresses of built-in font data. But since that commit is failing to fix the original OOB read [3], this patch keeps the change minimal in case we decide to revert altogether.
[1] https://syzkaller.appspot.com/bug?id=ebcbbb6576958a496500fee9cf7aa83ea00b5920
[2] https://syzkaller.appspot.com/text?tag=Patch&x=14030853900000
[3] https://syzkaller.appspot.com/bug?id=6fba8c186d97cf1011ab17660e633b1cc4e080c9
--- drivers/video/console/fbcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/console/fbcon.c +1 -1
@@ -1943,7 +1943,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,struct fb_var_screeninfo var = info->var;int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; -if (ops->p && ops->p->userfont &&FNTSIZE (vc->vc_font.data)) { +if (p->userfont &&FNTSIZE (vc->vc_font.data)) {int size;int pitch =PITCH (vc->vc_font.width);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 61/70 MIPS: SNI: Fix spurious interrupts
In reply to Greg Kroah-HartmanFrom: Thomas Bogendoerfer <[email protected]>
[ Upstream commit b959b97860d0fee8c8f6a3e641d3c2ad76eab6be ]
On A20R machines the interrupt pending bits in cause register need to be updated by requesting the chipset to do it. This needs to be done to find the interrupt cause and after interrupt service. In commit 0b888c7f3a03 ("MIPS: SNI: Convert to new irq_chip functions") the function to do after service update got lost, which caused spurious interrupts.
--- arch/mips/sni/a20r.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/mips/sni/a20r.c +7 -2
@@ -143,7 +143,10 @@ static struct platform_device sc26xx_pdev = { }, }; -static u32 a20r_ack_hwint (void ) +/* +* Trigger chipset to update CPU's CAUSE IP field +*/ +static u32 a20r_update_cause_ip (void ) {u32 status =read_c0_status ();
@@ -205,12 +208,14 @@ static void a20r_hwint(void)int irq;clear_c0_status (IE_IRQ0 ); - status =a20r_ack_hwint (); + status =a20r_update_cause_ip (); cause =read_c0_cause (); irq =ffs (((cause & status) >>8 ) &0xf8 );if (likely (irq >0 ))do_IRQ (SNI_A20R_IRQ_BASE + irq -1 ); + +a20r_update_cause_ip ();set_c0_status (IE_IRQ0 ); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 62/70 drm/mediatek: Add exception handing in mtk_drm_probe() if component init fail
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 64c194c00789889b0f9454f583712f079ba414ee ]
mtk_ddp_comp_init() is called in a loop in mtk_drm_probe(), if it fail, previous successive init component is not proccessed.
Thus uninitialize valid component and put their device if component init failed.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +6 -1
@@ -457,8 +457,13 @@ err_pm:pm_runtime_disable (dev); err_node:of_node_put (private->mutex_node); -for (i =0 ; i <DDP_COMPONENT_ID_MAX ; i++) +for (i =0 ; i <DDP_COMPONENT_ID_MAX ; i++) {of_node_put (private->comp_node[i]); +if (private->ddp_comp[i]) { +put_device (private->ddp_comp[i]->larb_dev); + private->ddp_comp[i] =NULL ; + } + }return ret; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 63/70 USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin notebook
In reply to Greg Kroah-HartmanFrom: Penghao <[email protected]>
commit bcea6dafeeef7d1a6a8320a249aabf981d63b881 upstream.
Add a USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for the BYD zhaoxin notebook. This notebook come with usb touchpad. And we would like to disable touchpad wakeup on this notebook by default.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -236,6 +236,10 @@ static const struct usb_device_id usb_qu/* Generic RTL8153 based ethernet adapters */ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, + /* SONiX USB DEVICE Touchpad */ + { USB_DEVICE(0x0c45, 0x7056), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* Action Semiconductor flash disk */ { USB_DEVICE(0x10d6, 0x2200), .driver_info = USB_QUIRK_STRING_FETCH_255 },
Greg Kroah-Hartman
maintainerPATCH 64/70 USB: UAS: fix disconnect by unplugging a hub
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 325b008723b2dd31de020e85ab9d2e9aa4637d35 upstream.
The SCSI layer can go into an ugly loop if you ignore that a device is gone. You need to report an error in the command rather than in the return value of the queue method.
We need to specifically check for ENODEV. The issue goes back to the introduction of the driver.
--- drivers/usb/storage/uas.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/usb/storage/uas.c +12 -2
@@ -670,8 +670,7 @@ static int uas_queuecommand_lck(struct sif (devinfo->resetting) { cmnd->result =DID_ERROR <<16 ; cmnd->scsi_done (cmnd); -spin_unlock_irqrestore (&devinfo->lock, flags); -return 0 ; + goto zombie; }/* Find a free uas-tag */
@@ -706,6 +705,16 @@ static int uas_queuecommand_lck(struct s cmdinfo->state &= ~(SUBMIT_DATA_IN_URB |SUBMIT_DATA_OUT_URB ); err =uas_submit_urbs (cmnd, devinfo); +/* +* in case of fatal errors the SCSI layer is peculiar +* a command that has finished is a success for the purpose +* of queueing, no matter how fatal the error +*/ +if (err == -ENODEV ) { + cmnd->result =DID_ERROR <<16 ; + cmnd->scsi_done (cmnd); + goto zombie; + }if (err) {/* If we did nothing, give up now */ if (cmdinfo->state &SUBMIT_STATUS_URB ) {
@@ -716,6 +725,7 @@ static int uas_queuecommand_lck(struct s } devinfo->cmnd[idx] = cmnd; +zombie:spin_unlock_irqrestore (&devinfo->lock, flags);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 65/70 usblp: fix race between disconnect() and read()
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 9cdabcb3ef8c24ca3a456e4db7b012befb688e73 upstream.
read() needs to check whether the device has been disconnected before it tries to talk to the device.
--- drivers/usb/class/usblp.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/class/usblp.c +5 -0
@@ -840,6 +840,11 @@ static ssize_t usblp_read(struct file *fif (rv <0 )return rv; +if (!usblp->present) { + count = -ENODEV ; + goto done; + } +if ((avail = usblp->rstatus) <0 ) {printk (KERN_ERR "usblp%d: error %d reading from printer\n" , usblp->minor, (int )avail);
Greg Kroah-Hartman
maintainerPATCH 66/70 Input: i8042 - add Entroware Proteus EL07R4 to nomux and reset lists
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit c4440b8a457779adeec42c5e181cb4016f19ce0f upstream.
The keyboard drops keypresses early during boot unless both the nomux and reset quirks are set. Add DMI table entries for this.
--- drivers/input/serio/i8042-x86ia64io.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +16 -0
@@ -552,6 +552,14 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"), }, }, + { + /* Entroware Proteus */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Entroware"), + DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"), + DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"), + }, + }, { } };
@@ -752,6 +760,14 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), }, }, + { + /* Entroware Proteus */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Entroware"), + DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"), + DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 67/70 serial: 8250_pci: Add Realtek 816a and 816b
In reply to Greg Kroah-HartmanFrom: Tobias Diedrich <[email protected]>
commit 3c5a87be170aba8ac40982182f812dcff6ed1ad1 upstream.
These serial ports are exposed by the OOB-management-engine on RealManage-enabled network cards (e.g. AMD DASH enabled systems using Realtek cards).
Because these have 3 BARs, they fail the "num_iomem <= 1" check in serial_pci_guess_board.
I've manually checked the two IOMEM regions and BAR 2 doesn't seem to respond to reads, but BAR 4 seems to be an MMIO version of the IO ports (untested).
With this change, the ports are detected:
0000:02:00.1: ttyS0 at I/O 0x2200 (irq = 82, base_baud = 115200) is a 16550A 0000:02:00.2: ttyS1 at I/O 0x2100 (irq = 55, base_baud = 115200) is a 16550A
lspci output:
02:00.1 0700: 10ec:816a (rev 0e) (prog-if 02 [16550])
Subsystem: 17aa:5082
Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort+ <TAbort- <MAbort- >SERR- <PERR- INTx-
Interrupt: pin B routed to IRQ 82
IOMMU group: 11
Region 0: I/O ports at 2200 [size=256]
Region 2: Memory at fd715000 (64-bit, non-prefetchable) [size=4K]
Region 4: Memory at fd704000 (64-bit, non-prefetchable) [size=16K]
Capabilities: [40] Power Management version 3
Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=375mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
Address: 0000000000000000 Data: 0000
Capabilities: [70] Express (v2) Endpoint, MSI 01
DevCap: MaxPayload 128 bytes, PhantFunc 0, Latency L0s unlimited, L1 <64us
ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset- SlotPowerLimit 0.000W
DevCtl: CorrErr- NonFatalErr- FatalErr- UnsupReq-
RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop-
MaxPayload 128 bytes, MaxReadReq 512 bytes
DevSta: CorrErr+ NonFatalErr- FatalErr- UnsupReq+ AuxPwr+ TransPend-
LnkCap: Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Exit Latency L0s unlimited, L1 <64us
ClockPM+ Surprise- LLActRep- BwNot- ASPMOptComp+
LnkCtl: ASPM L1 Enabled; RCB 64 bytes, Disabled- CommClk+
ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
LnkSta: Speed 2.5GT/s (ok), Width x1 (ok)
TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
10BitTagComp- 10BitTagReq- OBFF Via message/WAKE#, ExtFmt- EETLPPrefix- EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit- FRS- TPHComp- ExtTPHComp-
AtomicOpsCap: 32bit- 64bit- 128bitCAS-
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR- OBFF Disabled,
AtomicOpsCtl: ReqEn-
LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete- EqualizationPhase1-
EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest- Retimer- 2Retimers- CrosslinkRes: unsupported
Capabilities: [b0] MSI-X: Enable- Count=4 Masked-
Vector table: BAR=4 offset=00000000
PBA: BAR=4 offset=00000800
Capabilities: [d0] Vital Product Data
Not readable
Capabilities: [100 v2] Advanced Error Reporting
UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
UESvrt: DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
CESta: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
CEMsk: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
AERCap: First Error Pointer: 00, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
HeaderLog: 00000000 00000000 00000000 00000000
Capabilities: [160 v1] Device Serial Number 00-00-00-00-00-00-00-00
Capabilities: [170 v1] Latency Tolerance Reporting
Max snoop latency: 0ns
Max no snoop latency: 0ns
Capabilities: [178 v1] L1 PM Substates
L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
PortCommonModeRestoreTime=150us PortTPowerOnTime=150us
L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
T_CommonMode=0us LTR1.2_Threshold=0ns
L1SubCtl2: T_PwrOn=10us
02:00.2 0700: 10ec:816b (rev 0e)
[...same...]
--- drivers/tty/serial/8250/8250_pci.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/tty/serial/8250/8250_pci.c +11 -0
@@ -5709,6 +5709,17 @@ static struct pci_device_id serial_pci_t0 , 0, pbn_exar_XR17V358 }, +/* +* Realtek RealManage +*/ + { PCI_VENDOR_ID_REALTEK, 0x816a, +PCI_ANY_ID ,PCI_ANY_ID , + 0, 0, pbn_b0_1_115200 }, + + { PCI_VENDOR_ID_REALTEK, 0x816b, +PCI_ANY_ID ,PCI_ANY_ID , + 0, 0, pbn_b0_1_115200 }, +/* Fintek PCI serial cards */ { PCI_DEVICE(0x1c29, 0x1104), .driver_data = pbn_fintek_4 }, { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 },
Greg Kroah-Hartman
maintainerPATCH 68/70 ehci-hcd: Move include to keep CRC stable
In reply to Greg Kroah-HartmanFrom: Quentin Perret <[email protected]>
commit 29231826f3bd65500118c473fccf31c0cf14dbc0 upstream.
The CRC calculation done by genksyms is triggered when the parser hits EXPORT_SYMBOL*() macros. At this point, genksyms recursively expands the types of the function parameters, and uses that as the input for the CRC calculation. In the case of forward-declared structs, the type expands to 'UNKNOWN'. Following this, it appears that the result of the expansion of each type is cached somewhere, and seems to be re-used when/if the same type is seen again for another exported symbol in the same C file.
Unfortunately, this can cause CRC 'stability' issues when a struct definition becomes visible in the middle of a C file. For example, let's assume code with the following pattern:
struct foo;
int bar(struct foo *arg)
{
/* Do work ... */
}
EXPORT_SYMBOL_GPL(bar);
/* This contains struct foo's definition */
#include "foo.h"
int baz(struct foo *arg)
{
/* Do more work ... */
}
EXPORT_SYMBOL_GPL(baz);Here, baz's CRC will be computed using the expansion of struct foo that was cached after bar's CRC calculation ('UNKOWN' here). But if EXPORT_SYMBOL_GPL(bar) is removed from the file (because of e.g. symbol trimming using CONFIG_TRIM_UNUSED_KSYMS), struct foo will be expanded late, during baz's CRC calculation, which now has visibility over the full struct definition, hence resulting in a different CRC for baz.
The proper fix for this certainly is in genksyms, but that will take me some time to get right. In the meantime, we have seen one occurrence of this in the ehci-hcd code which hits this problem because of the way it includes C files halfway through the code together with an unlucky mix of symbol trimming.
In order to workaround this, move the include done in ehci-hub.c early in ehci-hcd.c, hence making sure the struct definitions are visible to the entire file. This improves CRC stability of the ehci-hcd exports even when symbol trimming is enabled.
--- drivers/usb/host/ehci-hcd.c | 1 + drivers/usb/host/ehci-hub.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/ehci-hcd.c +1 -0
@@ -35,6 +35,7 @@#include <linux/interrupt.h> #include <linux/usb.h> #include <linux/usb/hcd.h> +#include <linux/usb/otg.h> #include <linux/moduleparam.h> #include <linux/dma-mapping.h> #include <linux/debugfs.h>
drivers/usb/host/ehci-hub.c +0 -1
@@ -27,7 +27,6 @@*/ /*-------------------------------------------------------------------------*/ -#include <linux/usb/otg.h> #define PORT_WAKE_BITS (PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E)
Greg Kroah-Hartman
maintainerPATCH 69/70 powerpc/dma: Fix dma_map_ops::get_required_mask
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
commit 437ef802e0adc9f162a95213a3488e8646e5fc03 upstream.
There are 2 problems with it:
1. "<" vs expected "<<"
2. the shift number is an IOMMU page number mask, not an address mask as the IOMMU page shift is missing.
This did not hit us before f1565c24b596 ("powerpc: use the generic dma_ops_bypass mode") because we had additional code to handle bypass mask so this chunk (almost?) never executed.However there were reports that aacraid does not work with "iommu=nobypass".
After f1565c24b596, aacraid (and probably others which call dma_get_required_mask() before setting the mask) was unable to enable 64bit DMA and fall back to using IOMMU which was known not to work, one of the problems is double free of an IOMMU page.
This fixes DMA for aacraid, both with and without "iommu=nobypass" in the kernel command line. Verified with "stress-ng -d 4".
--- arch/powerpc/kernel/dma-iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/powerpc/kernel/dma-iommu.c +2 -1
@@ -99,7 +99,8 @@ static u64 dma_iommu_get_required_mask(sif (!tbl)return 0 ; - mask =1ULL < (fls_long (tbl->it_offset + tbl->it_size) -1 ); + mask =1ULL << (fls_long (tbl->it_offset + tbl->it_size) + + tbl->it_page_shift -1 ); mask += mask -1 ;return mask;
Greg Kroah-Hartman
maintainerPATCH 70/70 x86/defconfig: Enable CONFIG_USB_XHCI_HCD=y
In reply to Greg Kroah-HartmanFrom: Adam Borowski <[email protected]>
commit 72a9c673636b779e370983fea08e40f97039b981 upstream.
A spanking new machine I just got has all but one USB ports wired as 3.0. Booting defconfig resulted in no keyboard or mouse, which was pretty uncool. Let's enable that -- USB3 is ubiquitous rather than an oddity. As 'y' not 'm' -- recovering from initrd problems needs a keyboard.
Also add it to the 32-bit defconfig.
--- arch/x86/configs/i386_defconfig | 1 + arch/x86/configs/x86_64_defconfig | 1 + 2 files changed, 2 insertions(+)
arch/x86/configs/i386_defconfig +1 -0
@@ -246,6 +246,7 @@ CONFIG_USB_HIDDEV=y CONFIG_USB=y CONFIG_USB_ANNOUNCE_NEW_DEVICES=y CONFIG_USB_MON=y +CONFIG_USB_XHCI_HCD=y CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_TT_NEWSCHED=y CONFIG_USB_OHCI_HCD=y
arch/x86/configs/x86_64_defconfig +1 -0
@@ -241,6 +241,7 @@ CONFIG_USB_HIDDEV=y CONFIG_USB=y CONFIG_USB_ANNOUNCE_NEW_DEVICES=y CONFIG_USB_MON=y +CONFIG_USB_XHCI_HCD=y CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_TT_NEWSCHED=y CONFIG_USB_OHCI_HCD=y
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.237 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Sep 2020 16:20:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.237-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
27 tests: 27 pass, 0 failLinux version: 4.9.237-rc1-gb7aa672795fd
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.237 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Sep 2020 16:20:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.237-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.9.237-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: b7aa672795fd423afa4bd326c3abd59c991263ea
git describe: v4.9.236-71-gb7aa672795fd
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.9.y/build/v4.9.236-71-gb7aa672795fd
No regressions (compared to build v4.9.236-47-g9769e65dc140)
No Fixes (compared to build v4.9.236-47-g9769e65dc140)
Ran 14478 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fs-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-tracing-tests
* perf
* v4l2-compliance
* network-basic-tests
* ltp-open-posix-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-syscalls-tests
* kselftest/net
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.237 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Sep 2020 16:20:12 +0000. Anything received after that time might be too late.
Build results:
total: 171 pass: 171 fail: 0
Qemu test results:
total: 386 pass: 386 fail: 0
Guenter