4.19.153-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 169/264 rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit e69ee0cf655e8e0c4a80f4319e36019b74f17639 ]
We need to call of_node_put(node) on the error paths for this function.
--- drivers/rpmsg/qcom_smd.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-)
drivers/rpmsg/qcom_smd.c +22 -10
@@ -1338,7 +1338,7 @@ static int qcom_smd_parse_edge(struct device *dev, ret =of_property_read_u32 (node, key, &edge->edge_id);if (ret) {dev_err (dev,"edge missing %s property\n" , key); -return -EINVAL ; + goto put_node; } edge->remote_pid =QCOM_SMEM_HOST_ANY ;
@@ -1349,32 +1349,37 @@ static int qcom_smd_parse_edge(struct device *dev, edge->mbox_client.knows_txdone = true; edge->mbox_chan =mbox_request_channel (&edge->mbox_client,0 );if (IS_ERR (edge->mbox_chan)) { -if (PTR_ERR (edge->mbox_chan) != -ENODEV ) -return PTR_ERR (edge->mbox_chan); +if (PTR_ERR (edge->mbox_chan) != -ENODEV ) { + ret =PTR_ERR (edge->mbox_chan); + goto put_node; + } edge->mbox_chan =NULL ; syscon_np =of_parse_phandle (node,"qcom,ipc" ,0 );if (!syscon_np) {dev_err (dev,"no qcom,ipc node\n" ); -return -ENODEV ; + ret = -ENODEV ; + goto put_node; } edge->ipc_regmap =syscon_node_to_regmap (syscon_np); -if (IS_ERR (edge->ipc_regmap)) -return PTR_ERR (edge->ipc_regmap); +if (IS_ERR (edge->ipc_regmap)) { + ret =PTR_ERR (edge->ipc_regmap); + goto put_node; + } key ="qcom,ipc" ; ret =of_property_read_u32_index (node, key,1 , &edge->ipc_offset);if (ret <0 ) {dev_err (dev,"no offset in %s\n" , key); -return -EINVAL ; + goto put_node; } ret =of_property_read_u32_index (node, key,2 , &edge->ipc_bit);if (ret <0 ) {dev_err (dev,"no bit in %s\n" , key); -return -EINVAL ; + goto put_node; } }
@@ -1385,7 +1390,8 @@ static int qcom_smd_parse_edge(struct device *dev, irq =irq_of_parse_and_map (node,0 );if (irq <0 ) {dev_err (dev,"required smd interrupt missing\n" ); -return -EINVAL ; + ret = irq; + goto put_node; } ret = devm_request_irq(dev, irq,
@@ -1393,12 +1399,18 @@ static int qcom_smd_parse_edge(struct device *dev, node->name, edge);if (ret) {dev_err (dev,"failed to request smd irq\n" ); -return ret; + goto put_node; } edge->irq = irq;return 0 ; + +put_node: +of_node_put (node); + edge->of_node =NULL ; + +return ret; }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 170/264 pwm: img: Fix null pointer access in probe
In reply to Greg Kroah-HartmanFrom: Hauke Mehrtens <[email protected]>
[ Upstream commit b39c0615d0667b3a6f2f5c4bf99ffadf3b518bb1 ]
dev_get_drvdata() is called in img_pwm_runtime_resume() before the driver data is set.
When pm_runtime_enabled() returns false in img_pwm_probe() it calls img_pwm_runtime_resume() which results in a null pointer access.
This patch fixes the problem by setting the driver data earlier in the img_pwm_probe() function.
This crash was seen when booting the Imagination Technologies Creator Ci40 (Marduk) with kernel 5.4 in OpenWrt.
--- drivers/pwm/pwm-img.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pwm/pwm-img.c +2 -1
@@ -280,6 +280,8 @@ static int img_pwm_probe(struct platform_device *pdev)return PTR_ERR (pwm->pwm_clk); } +platform_set_drvdata (pdev, pwm); +pm_runtime_set_autosuspend_delay (&pdev->dev,IMG_PWM_PM_TIMEOUT );pm_runtime_use_autosuspend (&pdev->dev);pm_runtime_enable (&pdev->dev);
@@ -316,7 +318,6 @@ static int img_pwm_probe(struct platform_device *pdev) goto err_suspend; } -platform_set_drvdata (pdev, pwm);return 0 ; err_suspend:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 171/264 clk: rockchip: Initialize hw to error to avoid undefined behavior
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
[ Upstream commit b608f11d49ec671739604cc763248d8e8fadbbeb ]
We can get down to this return value from ERR_CAST() without initializing hw. Set it to -ENOMEM so that we always return something sane.
Fixes the following smatch warning:
drivers/clk/rockchip/clk-half-divider.c:228 rockchip_clk_register_halfdiv() error: uninitialized symbol 'hw'. drivers/clk/rockchip/clk-half-divider.c:228 rockchip_clk_register_halfdiv() warn: passing zero to 'ERR_CAST'
--- drivers/clk/rockchip/clk-half-divider.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-half-divider.c +1 -1
@@ -166,7 +166,7 @@ struct clk *rockchip_clk_register_halfdiv(const char *name,unsigned long flags, spinlock_t *lock) { - struct clk *clk; + struct clk *clk = ERR_PTR(-ENOMEM);struct clk_mux *mux =NULL ;struct clk_gate *gate =NULL ;struct clk_divider *div =NULL ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 172/264 clk: at91: clk-main: update key before writing AT91_CKGR_MOR
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 85d071e7f19a6a9abf30476b90b3819642568756 ]
SAMA5D2 datasheet specifies on chapter 33.22.8 (PMC Clock Generator Main Oscillator Register) that writing any value other than 0x37 on KEY field aborts the write operation. Use the key when selecting main clock parent.
--- drivers/clk/at91/clk-main.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/clk/at91/clk-main.c +8 -3
@@ -517,12 +517,17 @@ static int clk_sam9x5_main_set_parent(struct clk_hw *hw, u8 index)return -EINVAL ;regmap_read (regmap,AT91_CKGR_MOR , &tmp); - tmp &= ~MOR_KEY_MASK ;if (index && !(tmp &AT91_PMC_MOSCSEL )) -regmap_write (regmap,AT91_CKGR_MOR , tmp |AT91_PMC_MOSCSEL ); + tmp =AT91_PMC_MOSCSEL ;else if (!index && (tmp &AT91_PMC_MOSCSEL )) -regmap_write (regmap,AT91_CKGR_MOR , tmp & ~AT91_PMC_MOSCSEL ); + tmp =0 ; +else +return 0 ; + +regmap_update_bits (regmap,AT91_CKGR_MOR , +AT91_PMC_MOSCSEL |MOR_KEY_MASK , + tmp |AT91_PMC_KEY );while (!clk_sam9x5_main_ready (regmap))cpu_relax ();
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 173/264 clk: bcm2835: add missing release if devm_clk_hw_register fails
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit f6c992ca7dd4f49042eec61f3fb426c94d901675 ]
In the implementation of bcm2835_register_pll(), the allocated pll is leaked if devm_clk_hw_register() fails to register hw. Release pll if devm_clk_hw_register() fails.
--- drivers/clk/bcm/clk-bcm2835.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/clk/bcm/clk-bcm2835.c +3 -1
@@ -1319,8 +1319,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman, pll->hw.init = &init; ret =devm_clk_hw_register (cprman->dev, &pll->hw); -if (ret) +if (ret) { +kfree (pll);return NULL ; + }return &pll->hw; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 174/264 watchdog: Fix memleak in watchdog_cdev_register
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 5afb6d203d0293512aa2c6ae098274a2a4f6ed02 ]
When watchdog_kworker is NULL, we should free wd_data before the function returns to prevent memleak.
--- drivers/watchdog/watchdog_dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/watchdog/watchdog_dev.c +3 -1
@@ -944,8 +944,10 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) wd_data->wdd = wdd; wdd->wd_data = wd_data; -if (IS_ERR_OR_NULL (watchdog_kworker)) +if (IS_ERR_OR_NULL (watchdog_kworker)) { +kfree (wd_data);return -ENODEV ; + }device_initialize (&wd_data->dev); wd_data->dev.devt =MKDEV (MAJOR (watchdog_devt), wdd->id);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 175/264 watchdog: Use put_device on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 937425d4cd3ae4e2882b41e332bbbab616bcf0ad ]
We should use put_device() instead of freeing device directly after device_initialize().
--- drivers/watchdog/watchdog_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/watchdog_dev.c +1 -1
@@ -973,7 +973,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)pr_err ("%s: a legacy watchdog module is probably present.\n" , wdd->info->identity); old_wd_data =NULL ; -kfree (wd_data); +put_device (&wd_data->dev);return err; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 176/264 watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 08c619b4923056b5dd2d5045757468c76ad0e3fe ]
EFCH_PM_DECODEEN3 is supposed to access DECODEEN register bits 24..31, in other words the register at byte offset 3.
--- drivers/watchdog/sp5100_tco.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/sp5100_tco.h +1 -1
@@ -70,7 +70,7 @@#define EFCH_PM_DECODEEN_WDT_TMREN BIT(7) -#define EFCH_PM_DECODEEN3 0x00 +#define EFCH_PM_DECODEEN3 0x03#define EFCH_PM_DECODEEN_SECOND_RES GENMASK(1, 0)#define EFCH_PM_WATCHDOG_DISABLE ((u8)GENMASK(3, 2))
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 177/264 svcrdma: fix bounce buffers for unaligned offsets and multiple pages
In reply to Greg Kroah-HartmanFrom: Dan Aloni <[email protected]>
[ Upstream commit c327a310ec4d6ecbea13185ed56c11def441d9ab ]
This was discovered using O_DIRECT at the client side, with small unaligned file offsets or IOs that span multiple file pages.
--- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/xprtrdma/svc_rdma_sendto.c +2 -1
@@ -639,10 +639,11 @@ static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma,while (remaining) { len =min_t (u32,PAGE_SIZE - pageoff, remaining); -memcpy (dst,page_address (*ppages), len); +memcpy (dst,page_address (*ppages) + pageoff, len); remaining -= len; dst += len; pageoff =0 ; + ppages++; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 178/264 ext4: limit entries returned when counting fsmap records
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit af8c53c8bc087459b1aadd4c94805d8272358d79 ]
If userspace asked fsmap to try to count the number of entries, we cannot return more than UINT_MAX entries because fmh_entries is u32. Therefore, stop counting if we hit this limit or else we will waste time to return truncated results.
--- fs/ext4/fsmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ext4/fsmap.c +3 -0
@@ -108,6 +108,9 @@ static int ext4_getfsmap_helper(struct super_block *sb,/* Are we just counting mappings? */ if (info->gfi_head->fmh_count ==0 ) { +if (info->gfi_head->fmh_entries ==UINT_MAX ) +return EXT4_QUERY_RANGE_ABORT ; +if (rec_fsblk > info->gfi_next_fsblk) info->gfi_head->fmh_entries++;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 179/264 vfio/pci: Clear token on bypass registration failure
In reply to Greg Kroah-HartmanFrom: Alex Williamson <[email protected]>
[ Upstream commit 852b1beecb6ff9326f7ca4bc0fe69ae860ebdb9e ]
The eventfd context is used as our irqbypass token, therefore if an eventfd is re-used, our token is the same. The irqbypass code will return an -EBUSY in this case, but we'll still attempt to unregister the producer, where if that duplicate token still exists, results in removing the wrong object. Clear the token of failed producers so that they harmlessly fall out when unregistered.
--- drivers/vfio/pci/vfio_pci_intrs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/vfio/pci/vfio_pci_intrs.c +3 -1
@@ -355,11 +355,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, vdev->ctx[vector].producer.token = trigger; vdev->ctx[vector].producer.irq = irq; ret =irq_bypass_register_producer (&vdev->ctx[vector].producer); -if (unlikely (ret)) +if (unlikely (ret)) {dev_info (&pdev->dev,"irq bypass producer (token %p) registration fails: %d\n" , vdev->ctx[vector].producer.token, ret); + vdev->ctx[vector].producer.token =NULL ; + } vdev->ctx[vector].trigger = trigger;return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 180/264 vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages
In reply to Greg Kroah-HartmanFrom: Xiaoyang Xu <[email protected]>
[ Upstream commit 2e6cfd496f5b57034cf2aec738799571b5a52124 ]
pfn is not added to pfn_list when vfio_add_to_pfn_list fails. vfio_unpin_page_external will exit directly without calling vfio_iova_put_vfio_pfn. This will lead to a memory leak.
--- drivers/vfio/vfio_iommu_type1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vfio/vfio_iommu_type1.c +2 -1
@@ -636,7 +636,8 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data, ret =vfio_add_to_pfn_list (dma, iova, phys_pfn[i]);if (ret) { -vfio_unpin_page_external (dma, iova, do_accounting); +if (put_pfn (phys_pfn[i], dma->prot) && do_accounting) +vfio_lock_acct (dma,-1 , true); goto pin_unwind; } }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 181/264 SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()
In reply to Greg Kroah-HartmanFrom: Martijn de Gouw <[email protected]>
[ Upstream commit d48c8124749c9a5081fe68680f83605e272c984b ]
When the passed token is longer than 4032 bytes, the remaining part of the token must be copied from the rqstp->rq_arg.pages. But the copy must make sure it happens in a consecutive way.
With the existing code, the first memcpy copies 'length' bytes from argv->iobase, but since the header is in front, this never fills the whole first page of in_token->pages.
The mecpy in the loop copies the following bytes, but starts writing at the next page of in_token->pages. This leaves the last bytes of page 0 unwritten.
Symptoms were that users with many groups were not able to access NFS exports, when using Active Directory as the KDC.
--- net/sunrpc/auth_gss/svcauth_gss.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
net/sunrpc/auth_gss/svcauth_gss.c +17 -10
@@ -1079,9 +1079,9 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp, struct gssp_in_token *in_token) {struct kvec *argv = &rqstp->rq_arg.head[0 ]; -unsigned int page_base, length; -int pages, i, res; -size_t inlen; +unsigned int length, pgto_offs, pgfrom_offs; +int pages, i, res, pgto, pgfrom; +size_t inlen, to_offs, from_offs; res =gss_read_common_verf (gc, argv, authp, in_handle);if (res)
@@ -1109,17 +1109,24 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,memcpy (page_address (in_token->pages[0 ]), argv->iov_base, length); inlen -= length; - i =1 ; - page_base = rqstp->rq_arg.page_base; + to_offs = length; + from_offs = rqstp->rq_arg.page_base;while (inlen) { - length = min_t(unsigned int, inlen, PAGE_SIZE); -memcpy (page_address (in_token->pages[i]), -page_address (rqstp->rq_arg.pages[i]) + page_base, + pgto = to_offs >>PAGE_SHIFT ; + pgfrom = from_offs >>PAGE_SHIFT ; + pgto_offs = to_offs & ~PAGE_MASK ; + pgfrom_offs = from_offs & ~PAGE_MASK ; + + length = min_t(unsigned int, inlen, + min_t(unsigned int, PAGE_SIZE - pgto_offs, +PAGE_SIZE - pgfrom_offs)); +memcpy (page_address (in_token->pages[pgto]) + pgto_offs, +page_address (rqstp->rq_arg.pages[pgfrom]) + pgfrom_offs, length); + to_offs += length; + from_offs += length; inlen -= length; - page_base =0 ; - i++; }return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 182/264 Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 30df23c5ecdfb8da5b0bc17ceef67eff9e1b0957 ]
If imx6ul_tsc_init() fails then we need to clean up the clocks.
I reversed the "if (input_dev->users) {" condition to make the code a bit simpler.
--- drivers/input/touchscreen/imx6ul_tsc.c | 27 +++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
drivers/input/touchscreen/imx6ul_tsc.c +16 -11
@@ -538,20 +538,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev)mutex_lock (&input_dev->mutex); -if (input_dev->users) { - retval =clk_prepare_enable (tsc->adc_clk); -if (retval) - goto out; - - retval =clk_prepare_enable (tsc->tsc_clk); -if (retval) { -clk_disable_unprepare (tsc->adc_clk); - goto out; - } +if (!input_dev->users) + goto out; - retval =imx6ul_tsc_init (tsc); + retval =clk_prepare_enable (tsc->adc_clk); +if (retval) + goto out; + + retval =clk_prepare_enable (tsc->tsc_clk); +if (retval) { +clk_disable_unprepare (tsc->adc_clk); + goto out; } + retval =imx6ul_tsc_init (tsc); +if (retval) { +clk_disable_unprepare (tsc->tsc_clk); +clk_disable_unprepare (tsc->adc_clk); + goto out; + } out:mutex_unlock (&input_dev->mutex);return retval;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 183/264 Input: stmfts - fix a & vs && typo
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit d04afe14b23651e7a8bc89727a759e982a8458e4 ]
In stmfts_sysfs_hover_enable_write(), we should check value and sdata->hover_enabled is all true.
--- drivers/input/touchscreen/stmfts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/stmfts.c +1 -1
@@ -479,7 +479,7 @@ static ssize_t stmfts_sysfs_hover_enable_write(struct device *dev,mutex_lock (&sdata->mutex); -if (value & sdata->hover_enabled) +if (value && sdata->hover_enabled) goto out;if (sdata->running)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 184/264 Input: ep93xx_keypad - fix handling of platform_get_irq() error
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 7d50f6656dacf085a00beeedbc48b19a37d17881 ]
platform_get_irq() returns -ERRNO on error. In such case comparison to 0 would pass the check.
--- drivers/input/keyboard/ep93xx_keypad.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/keyboard/ep93xx_keypad.c +2 -2
@@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev) } keypad->irq =platform_get_irq (pdev,0 ); -if (!keypad->irq) { - err = -ENXIO ; +if (keypad->irq <0 ) { + err = keypad->irq; goto failed_free; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 185/264 Input: omap4-keypad - fix handling of platform_get_irq() error
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 4738dd1992fa13acfbbd71800c71c612f466fa44 ]
platform_get_irq() returns -ERRNO on error. In such case comparison to 0 would pass the check.
--- drivers/input/keyboard/omap4-keypad.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/input/keyboard/omap4-keypad.c +2 -4
@@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev) } irq =platform_get_irq (pdev,0 ); -if (!irq) { -dev_err (&pdev->dev,"no keyboard irq assigned\n" ); -return -EINVAL ; - } +if (irq <0 ) +return irq; keypad_data =kzalloc (sizeof (struct omap4_keypad ),GFP_KERNEL );if (!keypad_data) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 186/264 Input: twl4030_keypad - fix handling of platform_get_irq() error
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c277e1f0dc3c7d7b5b028e20dd414df241642036 ]
platform_get_irq() returns -ERRNO on error. In such case casting to unsigned and comparing to 0 would pass the check.
--- drivers/input/keyboard/twl4030_keypad.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/input/keyboard/twl4030_keypad.c +3 -5
@@ -63,7 +63,7 @@ struct twl4030_keypad {bool autorepeat;unsigned int n_rows;unsigned int n_cols; -unsigned int irq; +int irq;struct device *dbg_dev;struct input_dev *input;
@@ -389,10 +389,8 @@ static int twl4030_kp_probe(struct platform_device *pdev) } kp->irq =platform_get_irq (pdev,0 ); -if (!kp->irq) { -dev_err (&pdev->dev,"no keyboard irq assigned\n" ); -return -EINVAL ; - } +if (kp->irq <0 ) +return kp->irq; error = matrix_keypad_build_keymap(keymap_data, NULL, TWL4030_MAX_ROWS,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 187/264 Input: sun4i-ps2 - fix handling of platform_get_irq() error
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit cafb3abea6136e59ea534004e5773361e196bb94 ]
platform_get_irq() returns -ERRNO on error. In such case comparison to 0 would pass the check.
--- drivers/input/serio/sun4i-ps2.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/input/serio/sun4i-ps2.c +3 -6
@@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev)struct sun4i_ps2data *drvdata;struct serio *serio;struct device *dev = &pdev->dev; -unsigned int irq;int error; drvdata =kzalloc (sizeof (struct sun4i_ps2data ),GFP_KERNEL );
@@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev)writel (0 , drvdata->reg_base +PS2_REG_GCTL );/* Get IRQ for the device */ - irq =platform_get_irq (pdev,0 ); -if (!irq) { -dev_err (dev,"no IRQ found\n" ); - error = -ENXIO ; + drvdata->irq =platform_get_irq (pdev,0 ); +if (drvdata->irq <0 ) { + error = drvdata->irq; goto err_disable_clk; } - drvdata->irq = irq; drvdata->serio = serio; drvdata->dev = dev;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 188/264 KVM: x86: emulating RDPID failure shall return #UD rather than #GP
In reply to Greg Kroah-HartmanFrom: Robert Hoo <[email protected]>
[ Upstream commit a9e2e0ae686094571378c72d8146b5a1a92d0652 ]
Per Intel's SDM, RDPID takes a #UD if it is unsupported, which is more or less what KVM is emulating when MSR_TSC_AUX is not available. In fact, there are no scenarios in which RDPID is supposed to #GP.
Message-Id: <[email protected]>
--- arch/x86/kvm/emulate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/emulate.c +1 -1
@@ -3561,7 +3561,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt)u64 tsc_aux =0 ;if (ctxt->ops->get_msr (ctxt,MSR_TSC_AUX , &tsc_aux)) -return emulate_gp (ctxt,0 ); +return emulate_ud (ctxt); ctxt->dst.val = tsc_aux;return X86EMUL_CONTINUE ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 189/264 netfilter: conntrack: connection timeout after re-register
In reply to Greg Kroah-HartmanFrom: Francesco Ruggeri <[email protected]>
[ Upstream commit 4f25434bccc28cf8a07876ef5142a2869a674353 ]
If the first packet conntrack sees after a re-register is an outgoing keepalive packet with no data (SEG.SEQ = SND.NXT-1), td_end is set to SND.NXT-1.
When the peer correctly acknowledges SND.NXT, tcp_in_window fails check III (Upper bound for valid (s)ack: sack <= receiver.td_end) and returns false, which cascades into nf_conntrack_in setting skb->_nfct = 0 and in later conntrack iptables rules not matching. In cases where iptables are dropping packets that do not match conntrack rules this can result in idle tcp connections to time out.
v2: adjust td_end when getting the reply rather than when sending out
the keepalive packet.
--- net/netfilter/nf_conntrack_proto_tcp.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
net/netfilter/nf_conntrack_proto_tcp.c +13 -6
@@ -549,13 +549,20 @@ static bool tcp_in_window(const struct nf_conn *ct, swin = win << sender->td_scale; sender->td_maxwin = (swin ==0 ?1 : swin); sender->td_maxend = end + sender->td_maxwin; -/* -* We haven't seen traffic in the other direction yet -* but we have to tweak window tracking to pass III -* and IV until that happens. -*/ -if (receiver->td_maxwin ==0 ) +if (receiver->td_maxwin ==0 ) { +/* We haven't seen traffic in the other +* direction yet but we have to tweak window +* tracking to pass III and IV until that +* happens. +*/ receiver->td_end = receiver->td_maxend = sack; + }else if (sack == receiver->td_end +1 ) { +/* Likely a reply to a keepalive. +* Needed for III. +*/ + receiver->td_end++; + } + } } else if (((state->state == TCP_CONNTRACK_SYN_SENT && dir == IP_CT_DIR_ORIGINAL)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 190/264 netfilter: nf_fwd_netdev: clear timestamp in forwarding path
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c77761c8a59405cb7aa44188b30fffe13fbdd02d ]
Similar to 7980d2eabde8 ("ipvs: clear skb->tstamp in forwarding path"). fq qdisc requires tstamp to be cleared in forwarding path.
--- net/netfilter/nf_dup_netdev.c | 1 + net/netfilter/nft_fwd_netdev.c | 1 + 2 files changed, 2 insertions(+)
net/netfilter/nf_dup_netdev.c +1 -0
@@ -21,6 +21,7 @@ static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev)skb_push (skb, skb->mac_len); skb->dev = dev; + skb->tstamp =0 ;dev_queue_xmit (skb); }
net/netfilter/nft_fwd_netdev.c +1 -0
@@ -129,6 +129,7 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,return ; skb->dev = dev; + skb->tstamp =0 ;neigh_xmit (neigh_table, dev, addr, skb); out: regs->verdict.code = verdict;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 191/264 ARM: dts: imx6sl: fix rng node
In reply to Greg Kroah-HartmanFrom: Horia Geantă <[email protected]>
[ Upstream commit 82ffb35c2ce63ef8e0325f75eb48022abcf8edbe ]
rng DT node was added without a compatible string.
i.MX driver for RNGC (drivers/char/hw_random/imx-rngc.c) also claims support for RNGB, and is currently used for i.MX25.
Let's use this driver also for RNGB block in i.MX6SL.
--- arch/arm/boot/dts/imx6sl.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/imx6sl.dtsi +2 -0
@@ -922,8 +922,10 @@ mmdc: mmdc@21b0000 { }; rngb: rngb@21b4000 { + compatible = "fsl,imx6sl-rngb", "fsl,imx25-rngb"; reg = <0x021b4000 0x4000>; interrupts = <0 5 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6SL_CLK_DUMMY>; }; weim: weim@21b8000 {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 192/264 ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator
In reply to Greg Kroah-HartmanFrom: Jernej Skrabec <[email protected]>
[ Upstream commit 3658a2b7f3e16c7053eb8d70657b94bb62c5a0f4 ]
DCDC1 regulator powers many different subsystems. While some of them can work at 3.0 V, some of them can not. For example, VCC-HDMI can only work between 3.24 V and 3.36 V. According to OS images provided by the board manufacturer this regulator should be set to 3.3 V.
Set DCDC1 and DCDC1SW to 3.3 V in order to fix this.
--- arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +5 -5
@@ -206,16 +206,16 @@ ®_aldo3 { }; ®_dc1sw { - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3000000>; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; regulator-name = "vcc-gmac-phy"; }; ®_dcdc1 { regulator-always-on; - regulator-min-microvolt = <3000000>; - regulator-max-microvolt = <3000000>; - regulator-name = "vcc-3v0"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-name = "vcc-3v3"; }; ®_dcdc2 {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 193/264 memory: omap-gpmc: Fix a couple off by ones
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 4c54228ac8fd55044195825873c50a524131fa53 ]
These comparisons should be >= instead of > to prevent reading one element beyond the end of the gpmc_cs[] array.
--- drivers/memory/omap-gpmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/memory/omap-gpmc.c +2 -2
@@ -951,7 +951,7 @@ static int gpmc_cs_remap(int cs, u32 base)int ret;u32 old_base, size; -if (cs > gpmc_cs_num) { +if (cs >= gpmc_cs_num) {pr_err ("%s: requested chip-select is disabled\n" , __func__);return -ENODEV ; }
@@ -986,7 +986,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)struct resource *res = &gpmc->mem;int r =-1 ; -if (cs > gpmc_cs_num) { +if (cs >= gpmc_cs_num) {pr_err ("%s: requested chip-select is disabled\n" , __func__);return -ENODEV ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 194/264 memory: omap-gpmc: Fix build error without CONFIG_OF
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit 13d029ee51da365aa9c859db0c7395129252bde8 ]
If CONFIG_OF is n, gcc fails:
drivers/memory/omap-gpmc.o: In function `gpmc_omap_onenand_set_timings':
omap-gpmc.c:(.text+0x2a88): undefined reference to `gpmc_read_settings_dt'
Add gpmc_read_settings_dt() helper function, which zero the gpmc_settings so the caller doesn't proceed with random/invalid settings.
--- drivers/memory/omap-gpmc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/memory/omap-gpmc.c +4 -0
@@ -2278,6 +2278,10 @@ static void gpmc_probe_dt_children(struct platform_device *pdev) } }#else +void gpmc_read_settings_dt (struct device_node *np,struct gpmc_settings *p) +{ +memset (p,0 ,sizeof (*p)); +}static int gpmc_probe_dt (struct platform_device *pdev) {return 0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 195/264 memory: fsl-corenet-cf: Fix handling of platform_get_irq() error
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit dd85345abca60a8916617e8d75c0f9ce334336dd ]
platform_get_irq() returns -ERRNO on error. In such case comparison to 0 would pass the check.
--- drivers/memory/fsl-corenet-cf.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/memory/fsl-corenet-cf.c +2 -4
@@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev)dev_set_drvdata (&pdev->dev, ccf); irq =platform_get_irq (pdev,0 ); -if (!irq) { -dev_err (&pdev->dev,"%s: no irq\n" , __func__); -return -ENXIO ; - } +if (irq <0 ) +return irq; ret =devm_request_irq (&pdev->dev, irq, ccf_irq,0 , pdev->name, ccf);if (ret) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 196/264 arm64: dts: qcom: pm8916: Remove invalid reg size from wcd_codec
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit c2f0cbb57dbac6da3d38b47b5b96de0fe4e23884 ]
Tha parent node of "wcd_codec" specifies #address-cells = <1> and #size-cells = <0>, which means that each resource should be described by one cell for the address and size omitted.
However, wcd_codec currently lists 0x200 as second cell (probably the size of the resource). When parsing this would be treated like another memory resource - which is entirely wrong.
To quote the device tree specification [1]:
"If the parent node specifies a value of 0 for #size-cells,
the length field in the value of reg shall be omitted."
[1]: https://www.devicetree.org/specifications/
--- arch/arm64/boot/dts/qcom/pm8916.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/pm8916.dtsi +1 -1
@@ -99,7 +99,7 @@ pm8916_1: pm8916@1 { wcd_codec: codec@f000 { compatible = "qcom,pm8916-wcd-analog-codec"; - reg = <0xf000 0x200>; + reg = <0xf000>; reg-names = "pmic-codec-core"; clocks = <&gcc GCC_CODEC_DIGCODEC_CLK>; clock-names = "mclk";
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 197/264 arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit 027cca9eb5b450c3f6bb916ba999144c2ec23cb7 ]
The mdss node sets #interrupt-cells = <1>, so its interrupts should be referenced using a single cell (in this case: only the interrupt number).
However, right now the mdp/dsi node both have two interrupt cells set, e.g. interrupts = <4 0>. The 0 is probably meant to say IRQ_TYPE_NONE (= 0), but with #interrupt-cells = <1> this is actually interpreted as a second interrupt line.
Remove the IRQ flags from both interrupts to fix this.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -2
@@ -877,7 +877,7 @@ mdp: mdp@1a01000 { reg-names = "mdp_phys"; interrupt-parent = <&mdss>; - interrupts = <0 0>; + interrupts = <0>; clocks = <&gcc GCC_MDSS_AHB_CLK>, <&gcc GCC_MDSS_AXI_CLK>,
@@ -909,7 +909,7 @@ dsi0: dsi@1a98000 { reg-names = "dsi_ctrl"; interrupt-parent = <&mdss>; - interrupts = <4 0>; + interrupts = <4>; assigned-clocks = <&gcc BYTE0_CLK_SRC>, <&gcc PCLK0_CLK_SRC>;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 198/264 ARM: dts: owl-s500: Fix incorrect PPI interrupt specifiers
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
[ Upstream commit 55f6c9931f7c32f19cf221211f099dfd8dab3af9 ]
The PPI interrupts for cortex-a9 were incorrectly specified, fix them.
--- arch/arm/boot/dts/owl-s500.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/owl-s500.dtsi +3 -3
@@ -85,21 +85,21 @@ scu: scu@b0020000 { global_timer: timer@b0020200 { compatible = "arm,cortex-a9-global-timer"; reg = <0xb0020200 0x100>; - interrupts = <GIC_PPI 0 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>; + interrupts = <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>; status = "disabled"; }; twd_timer: timer@b0020600 { compatible = "arm,cortex-a9-twd-timer"; reg = <0xb0020600 0x20>; - interrupts = <GIC_PPI 2 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>; + interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>; status = "disabled"; }; twd_wdt: wdt@b0020620 { compatible = "arm,cortex-a9-twd-wdt"; reg = <0xb0020620 0xe0>; - interrupts = <GIC_PPI 3 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>; + interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>; status = "disabled"; };
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 199/264 arm64: dts: zynqmp: Remove additional compatible string for i2c IPs
In reply to Greg Kroah-HartmanFrom: Michal Simek <[email protected]>
[ Upstream commit 35292518cb0a626fcdcabf739aed75060a018ab5 ]
DT binding permits only one compatible string which was decribed in past by commit 63cab195bf49 ("i2c: removed work arounds in i2c driver for Zynq Ultrascale+ MPSoC").
The commit aea37006e183 ("dt-bindings: i2c: cadence: Migrate i2c-cadence documentation to YAML") has converted binding to yaml and the following issues is reported:
...: i2c@ff030000: compatible: Additional items are not allowed ('cdns,i2c-r1p10' was unexpected)
From schema:.../Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml fds ...: i2c@ff030000: compatible: ['cdns,i2c-r1p14', 'cdns,i2c-r1p10'] is too long
The commit c415f9e8304a ("ARM64: zynqmp: Fix i2c node's compatible string") has added the second compatible string but without removing origin one. The patch is only keeping one compatible string "cdns,i2c-r1p14".
--- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/xilinx/zynqmp.dtsi +2 -2
@@ -411,7 +411,7 @@ gpio: gpio@ff0a0000 { }; i2c0: i2c@ff020000 { - compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; + compatible = "cdns,i2c-r1p14"; status = "disabled"; interrupt-parent = <&gic>; interrupts = <0 17 4>;
@@ -421,7 +421,7 @@ i2c0: i2c@ff020000 { }; i2c1: i2c@ff030000 { - compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; + compatible = "cdns,i2c-r1p14"; status = "disabled"; interrupt-parent = <&gic>; interrupts = <0 18 4>;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 200/264 powerpc/powernv/dump: Fix race while processing OPAL dump
In reply to Greg Kroah-HartmanFrom: Vasant Hegde <[email protected]>
[ Upstream commit 0a43ae3e2beb77e3481d812834d33abe270768ab ]
Every dump reported by OPAL is exported to userspace through a sysfs interface and notified using kobject_uevent(). The userspace daemon (opal_errd) then reads the dump and acknowledges that the dump is saved safely to disk. Once acknowledged the kernel removes the respective sysfs file entry causing respective resources to be released including kobject.
However it's possible the userspace daemon may already be scanning dump entries when a new sysfs dump entry is created by the kernel. User daemon may read this new entry and ack it even before kernel can notify userspace about it through kobject_uevent() call. If that happens then we have a potential race between dump_ack_store->kobject_put() and kobject_uevent which can lead to use-after-free of a kernfs object resulting in a kernel crash.
This patch fixes this race by protecting the sysfs file creation/notification by holding a reference count on kobject until we safely send kobject_uevent().
The function create_dump_obj() returns the dump object which if used by caller function will end up in use-after-free problem again. However, the return value of create_dump_obj() function isn't being used today and there is no need as well. Hence change it to return void to make this fix complete.
--- arch/powerpc/platforms/powernv/opal-dump.c | 41 +++++++++++++++------- 1 file changed, 29 insertions(+), 12 deletions(-)
arch/powerpc/platforms/powernv/opal-dump.c +29 -12
@@ -322,15 +322,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj,return count; } -static struct dump_obj *create_dump_obj (uint32_t id,size_t size, -uint32_t type) +static void create_dump_obj (uint32_t id,size_t size,uint32_t type) {struct dump_obj *dump;int rc; dump =kzalloc (sizeof (*dump),GFP_KERNEL );if (!dump) -return NULL ; +return ; dump->kobj.kset = dump_kset;
@@ -350,21 +349,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size, rc =kobject_add (&dump->kobj,NULL ,"0x%x-0x%x" , type, id);if (rc) {kobject_put (&dump->kobj); -return NULL ; +return ; } +/* +* As soon as the sysfs file for this dump is created/activated there is +* a chance the opal_errd daemon (or any userspace) might read and +* acknowledge the dump before kobject_uevent() is called. If that +* happens then there is a potential race between +* dump_ack_store->kobject_put() and kobject_uevent() which leads to a +* use-after-free of a kernfs object resulting in a kernel crash. +* +* To avoid that, we need to take a reference on behalf of the bin file, +* so that our reference remains valid while we call kobject_uevent(). +* We then drop our reference before exiting the function, leaving the +* bin file to drop the last reference (if it hasn't already). +*/ + +/* Take a reference for the bin file */ +kobject_get (&dump->kobj); rc =sysfs_create_bin_file (&dump->kobj, &dump->dump_attr); -if (rc) { +if (rc ==0 ) { +kobject_uevent (&dump->kobj,KOBJ_ADD ); + +pr_info ("%s: New platform dump. ID = 0x%x Size %u\n" , + __func__, dump->id, dump->size); + }else { +/* Drop reference count taken for bin file */ kobject_put (&dump->kobj); -return NULL ; } -pr_info ("%s: New platform dump. ID = 0x%x Size %u\n" , - __func__, dump->id, dump->size); - -kobject_uevent (&dump->kobj,KOBJ_ADD ); - -return dump; +/* Drop our reference */ +kobject_put (&dump->kobj); +return ; }static irqreturn_t process_dump (int irq,void *data)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 201/264 nvmet: fix uninitialized work for zero kato
In reply to Greg Kroah-HartmanFrom: zhenwei pi <[email protected]>
[ Upstream commit 85bd23f3dc09a2ae9e56885420e52c54bf983713 ]
When connecting a controller with a zero kato value using the following command line
nvme connect -t tcp -n NQN -a ADDR -s PORT --keep-alive-tmo=0
the warning below can be reproduced:
WARNING: CPU: 1 PID: 241 at kernel/workqueue.c:1627 __queue_delayed_work+0x6d/0x90 with trace: mod_delayed_work_on+0x59/0x90 nvmet_update_cc+0xee/0x100 [nvmet] nvmet_execute_prop_set+0x72/0x80 [nvmet] nvmet_tcp_try_recv_pdu+0x2f7/0x770 [nvmet_tcp] nvmet_tcp_io_work+0x63f/0xb2d [nvmet_tcp] ...
This is caused by queuing up an uninitialized work. Althrough the keep-alive timer is disabled during allocating the controller (fixed in 0d3b6a8d213a), ka_work still has a chance to run (called by nvmet_start_ctrl).
--- drivers/nvme/target/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/target/core.c +2 -1
@@ -787,7 +787,8 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)* in case a host died before it enabled the controller. Hence, simply * reset the keep alive timer when the controller is enabled. */ -mod_delayed_work (system_wq, &ctrl->ka_work, ctrl->kato *HZ ); +if (ctrl->kato) +mod_delayed_work (system_wq, &ctrl->ka_work, ctrl->kato *HZ ); }static void nvmet_clear_ctrl (struct nvmet_ctrl *ctrl)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 202/264 NTB: hw: amd: fix an issue about leak system resources
In reply to Greg Kroah-HartmanFrom: Kaige Li <[email protected]>
[ Upstream commit 44a0a3c17919db1498cebb02ecf3cf4abc1ade7b ]
The related system resources were not released when pci_set_dma_mask(), pci_set_consistent_dma_mask(), or pci_iomap() return error in the amd_ntb_init_pci() function. Add pci_release_regions() to fix it.
--- drivers/ntb/hw/amd/ntb_hw_amd.c | 1 + 1 file changed, 1 insertion(+)
drivers/ntb/hw/amd/ntb_hw_amd.c +1 -0
@@ -1036,6 +1036,7 @@ static int amd_ntb_init_pci(struct amd_ntb_dev *ndev, err_dma_mask:pci_clear_master (pdev); +pci_release_regions (pdev); err_pci_regions:pci_disable_device (pdev); err_pci_enable:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 203/264 sched/features: Fix !CONFIG_JUMP_LABEL case
In reply to Greg Kroah-HartmanFrom: Juri Lelli <[email protected]>
[ Upstream commit a73f863af4ce9730795eab7097fb2102e6854365 ]
Commit:
765cc3a4b224e ("sched/core: Optimize sched_feat() for !CONFIG_SCHED_DEBUG builds")
made sched features static for !CONFIG_SCHED_DEBUG configurations, but overlooked the CONFIG_SCHED_DEBUG=y and !CONFIG_JUMP_LABEL cases.
For the latter echoing changes to /sys/kernel/debug/sched_features has the nasty effect of effectively changing what sched_features reports, but without actually changing the scheduler behaviour (since different translation units get different sysctl_sched_features).
Fix CONFIG_SCHED_DEBUG=y and !CONFIG_JUMP_LABEL configurations by properly restructuring ifdefs.
--- kernel/sched/core.c | 2 +- kernel/sched/sched.h | 13 ++++++++++--- 2 files changed, 11 insertions(+), 4 deletions(-)
kernel/sched/core.c +1 -1
@@ -24,7 +24,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); -#if defined(CONFIG_SCHED_DEBUG ) && defined(CONFIG_JUMP_LABEL ) +#ifdef CONFIG_SCHED_DEBUG /* * Debugging: various feature bits *
kernel/sched/sched.h +10 -3
@@ -1361,7 +1361,7 @@ enum {#undef SCHED_FEAT -#if defined(CONFIG_SCHED_DEBUG ) && defined(CONFIG_JUMP_LABEL ) +#ifdef CONFIG_SCHED_DEBUG /* * To support run-time toggling of sched features, all the translation units
@@ -1369,6 +1369,7 @@ enum {*/ extern const_debug unsigned int sysctl_sched_features; +#ifdef CONFIG_JUMP_LABEL #define SCHED_FEAT (name, enabled) \ static __always_inline bool static_branch_##name(struct static_key *key) \ { \
@@ -1381,7 +1382,13 @@ static __always_inline bool static_branch_##name(struct static_key *key) \extern struct static_key sched_feat_keys[__SCHED_FEAT_NR];#define sched_feat (x) (static_branch_##x(&sched_feat_keys[__SCHED_FEAT_##x])) -#else /* !(SCHED_DEBUG && CONFIG_JUMP_LABEL) */ +#else /* !CONFIG_JUMP_LABEL */ + +#define sched_feat (x) (sysctl_sched_features & (1UL << __SCHED_FEAT_##x)) + +#endif /* CONFIG_JUMP_LABEL */ + +#else /* !SCHED_DEBUG */ /* * Each translation unit has its own copy of sysctl_sched_features to allow
@@ -1397,7 +1404,7 @@ static const_debug __maybe_unused unsigned int sysctl_sched_features =#define sched_feat (x) !!(sysctl_sched_features & (1UL << __SCHED_FEAT_##x)) -#endif /* SCHED_DEBUG && CONFIG_JUMP_LABEL */ +#endif /* SCHED_DEBUG */ extern struct static_key_false sched_numa_balancing;extern struct static_key_false sched_schedstats;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 204/264 perf: correct SNOOPX field offset
In reply to Greg Kroah-HartmanFrom: Al Grant <[email protected]>
[ Upstream commit f3d301c1f2f5676465cdf3259737ea19cc82731f ]
perf_event.h has macros that define the field offsets in the data_src bitmask in perf records. The SNOOPX and REMOTE offsets were both 37. These are distinct fields, and the bitfield layout in perf_mem_data_src confirms that SNOOPX should be at offset 38.
--- include/uapi/linux/perf_event.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/perf_event.h +1 -1
@@ -1079,7 +1079,7 @@ union perf_mem_data_src {#define PERF_MEM_SNOOPX_FWD 0x01/* forward */ /* 1 free */ -#define PERF_MEM_SNOOPX_SHIFT 37 +#define PERF_MEM_SNOOPX_SHIFT 38/* locked instruction */ #define PERF_MEM_LOCK_NA 0x01/* not available */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 205/264 i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 8058d69905058ec8f467a120b5ec5bb831ea67f3 ]
Commit 21653a4181ff ("i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices()")'s intention was to only move the acpi_install_address_space_handler() call to the point before where the ACPI declared i2c-children of the adapter where instantiated by i2c_acpi_register_devices().
But i2c_acpi_install_space_handler() had a call to acpi_walk_dep_device_list() hidden (that is I missed it) at the end of it, so as an unwanted side-effect now acpi_walk_dep_device_list() was also being called before i2c_acpi_register_devices().
Move the acpi_walk_dep_device_list() call to the end of i2c_acpi_register_devices(), so that it is once again called *after* the i2c_client-s hanging of the adapter have been created.
This fixes the Microsoft Surface Go 2 hanging at boot.
--- drivers/i2c/i2c-core-acpi.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/i2c/i2c-core-acpi.c +10 -1
@@ -219,6 +219,7 @@ static acpi_status i2c_acpi_add_device(acpi_handle handle, u32 level,void i2c_acpi_register_devices (struct i2c_adapter *adap) {acpi_status status; +acpi_handle handle;if (!has_acpi_companion (&adap->dev))return ;
@@ -229,6 +230,15 @@ void i2c_acpi_register_devices(struct i2c_adapter *adap) adap, NULL);if (ACPI_FAILURE (status))dev_warn (&adap->dev,"failed to enumerate I2C slaves\n" ); + +if (!adap->dev.parent) +return ; + + handle =ACPI_HANDLE (adap->dev.parent); +if (!handle) +return ; + +acpi_walk_dep_device_list (handle); } const struct acpi_device_id *
@@ -693,7 +703,6 @@ int i2c_acpi_install_space_handler(struct i2c_adapter *adapter)return -ENOMEM ; } -acpi_walk_dep_device_list (handle);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 206/264 block: ratelimit handle_bad_sector() message
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit f4ac712e4fe009635344b9af5d890fe25fcc8c0d ]
syzbot is reporting unkillable task [1], for the caller is failing to handle a corrupted filesystem image which attempts to access beyond the end of the device. While we need to fix the caller, flooding the console with handle_bad_sector() message is unlikely useful.
[1] https://syzkaller.appspot.com/bug?id=f1f49fb971d7a3e01bd8ab8cff2ff4572ccf3092
--- block/blk-core.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
block/blk-core.c +4 -5
@@ -2127,11 +2127,10 @@ static void handle_bad_sector(struct bio *bio, sector_t maxsector) {char b[BDEVNAME_SIZE ]; -printk (KERN_INFO "attempt to access beyond end of device\n" ); -printk (KERN_INFO "%s: rw=%d, want=%Lu, limit=%Lu\n" , -bio_devname (bio, b), bio->bi_opf, - (unsigned long long )bio_end_sector (bio), - (long long )maxsector); +pr_info_ratelimited ("attempt to access beyond end of device\n" +"%s: rw=%d, want=%llu, limit=%llu\n" , +bio_devname (bio, b), bio->bi_opf, +bio_end_sector (bio), maxsector); }#ifdef CONFIG_FAIL_MAKE_REQUEST
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 207/264 crypto: ccp - fix error handling
In reply to Greg Kroah-HartmanFrom: Pavel Machek <[email protected]>
[ Upstream commit e356c49c6cf0db3f00e1558749170bd56e47652d ]
Fix resource leak in error handling.
--- drivers/crypto/ccp/ccp-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/ccp/ccp-ops.c +1 -1
@@ -1752,7 +1752,7 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)break ;default : ret = -EINVAL ; - goto e_ctx; + goto e_data; } }else {/* Stash the context */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 208/264 media: firewire: fix memory leak
In reply to Greg Kroah-HartmanFrom: Pavel Machek <[email protected]>
[ Upstream commit b28e32798c78a346788d412f1958f36bb760ec03 ]
Fix memory leak in node_probe.
--- drivers/media/firewire/firedtv-fw.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/firewire/firedtv-fw.c +4 -2
@@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) name_len =fw_csr_string (unit->directory,CSR_MODEL , name,sizeof (name)); -if (name_len <0 ) -return name_len; +if (name_len <0 ) { + err = name_len; + goto fail_free; + }for (i =ARRAY_SIZE (model_names); --i; )if (strlen (model_names[i]) <= name_len &&strncmp (name, model_names[i], name_len) ==0 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 209/264 media: ati_remote: sanity check for both endpoints
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
[ Upstream commit a8be80053ea74bd9c3f9a3810e93b802236d6498 ]
If you do sanity checks, you should do them for both endpoints. Hence introduce checking for endpoint type for the output endpoint, too.
--- drivers/media/rc/ati_remote.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/rc/ati_remote.c +4 -0
@@ -845,6 +845,10 @@ static int ati_remote_probe(struct usb_interface *interface,err ("%s: endpoint_in message size==0? \n" , __func__);return -ENODEV ; } +if (!usb_endpoint_is_int_out (endpoint_out)) { +err ("%s: Unexpected endpoint_out\n" , __func__); +return -ENODEV ; + } ati_remote =kzalloc (sizeof (struct ati_remote ),GFP_KERNEL ); rc_dev =rc_allocate_device (RC_DRIVER_SCANCODE );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 210/264 media: st-delta: Fix reference count leak in delta_run_work
In reply to Greg Kroah-HartmanFrom: Aditya Pakki <[email protected]>
[ Upstream commit 57cc666d36adc7b45e37ba4cd7bc4e44ec4c43d7 ]
delta_run_work() calls delta_get_sync() that increments the reference counter. In case of failure, decrement the reference count by calling delta_put_autosuspend().
--- drivers/media/platform/sti/delta/delta-v4l2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/sti/delta/delta-v4l2.c +3 -1
@@ -954,8 +954,10 @@ static void delta_run_work(struct work_struct *work)/* enable the hardware */ if (!dec->pm) { ret =delta_get_sync (ctx); -if (ret) +if (ret) { +delta_put_autosuspend (ctx); goto err; + } }/* decode this access unit */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 211/264 media: sti: Fix reference count leaks
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit 6f4432bae9f2d12fc1815b5e26cc07e69bcad0df ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code, causing incorrect ref count if pm_runtime_put_noidle() is not called in error handling paths. Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
--- drivers/media/platform/sti/hva/hva-hw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/sti/hva/hva-hw.c +2 -0
@@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)if (pm_runtime_get_sync (dev) <0 ) {dev_err (dev,"%s failed to get pm_runtime\n" ,HVA_PREFIX ); +pm_runtime_put_noidle (dev);mutex_unlock (&hva->protect_mutex);return -EFAULT ; }
@@ -557,6 +558,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s)if (pm_runtime_get_sync (dev) <0 ) {seq_puts (s,"Cannot wake up IP\n" ); +pm_runtime_put_noidle (dev);mutex_unlock (&hva->protect_mutex);return ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 212/264 media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit 7ef64ceea0008c17e94a8a2c60c5d6d46f481996 ]
On calling pm_runtime_get_sync() the reference count of the device is incremented. In case of failure, decrement the reference count before returning the error.
--- drivers/media/platform/exynos4-is/fimc-isp.c | 4 +++- drivers/media/platform/exynos4-is/fimc-lite.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/exynos4-is/fimc-isp.c +3 -1
@@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on)if (on) { ret =pm_runtime_get_sync (&is->pdev->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put (&is->pdev->dev);return ret; + }set_bit (IS_ST_PWR_ON , &is->state); ret =fimc_is_start_firmware (is);
drivers/media/platform/exynos4-is/fimc-lite.c +1 -1
@@ -480,7 +480,7 @@ static int fimc_lite_open(struct file *file)set_bit (ST_FLITE_IN_USE , &fimc->state); ret =pm_runtime_get_sync (&fimc->pdev->dev);if (ret <0 ) - goto unlock; + goto err_pm; ret =v4l2_fh_open (file);if (ret <0 )
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 213/264 media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit c47f7c779ef0458a58583f00c9ed71b7f5a4d0a2 ]
On calling pm_runtime_get_sync() the reference count of the device is incremented. In case of failure, decrement the reference count before returning the error.
--- drivers/media/platform/exynos4-is/media-dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/exynos4-is/media-dev.c +3 -1
@@ -481,8 +481,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)return -ENXIO ; ret =pm_runtime_get_sync (fmd->pmf); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put (fmd->pmf);return ret; + } fmd->num_sensors =0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 214/264 media: exynos4-is: Fix a reference count leak
In reply to Greg Kroah-HartmanFrom: Qiushi Wu <[email protected]>
[ Upstream commit 64157b2cb1940449e7df2670e85781c690266588 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code, causing incorrect ref count if pm_runtime_put_noidle() is not called in error handling paths. Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
--- drivers/media/platform/exynos4-is/mipi-csis.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/exynos4-is/mipi-csis.c +3 -1
@@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable)if (enable) {s5pcsis_clear_counters (state); ret =pm_runtime_get_sync (&state->pdev->dev); -if (ret && ret !=1 ) +if (ret && ret !=1 ) { +pm_runtime_put_noidle (&state->pdev->dev);return ret; + } }mutex_lock (&state->lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 215/264 media: vsp1: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 98fae901c8883640202802174a4bd70a1b9118bd ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced.
--- drivers/media/platform/vsp1/vsp1_drv.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/media/platform/vsp1/vsp1_drv.c +8 -3
@@ -562,7 +562,12 @@ int vsp1_device_get(struct vsp1_device *vsp1)int ret; ret =pm_runtime_get_sync (vsp1->dev); -return ret <0 ? ret :0 ; +if (ret <0 ) { +pm_runtime_put_noidle (vsp1->dev); +return ret; + } + +return 0 ; }/*
@@ -845,12 +850,12 @@ static int vsp1_probe(struct platform_device *pdev)/* Configure device parameters based on the version register. */ pm_runtime_enable (&pdev->dev); - ret =pm_runtime_get_sync (&pdev->dev); + ret =vsp1_device_get (vsp1);if (ret <0 ) goto done; vsp1->version =vsp1_read (vsp1,VI6_IP_VERSION ); -pm_runtime_put_sync (&pdev->dev); +vsp1_device_put (vsp1);for (i =0 ; i <ARRAY_SIZE (vsp1_device_infos); ++i) { if ((vsp1->version & VI6_IP_VERSION_MODEL_MASK) ==
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 216/264 media: platform: s3c-camif: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit dafa3605fe60d5a61239d670919b2a36e712481e ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced.
Also, call pm_runtime_disable() when pm_runtime_get_sync() returns an error code.
--- drivers/media/platform/s3c-camif/camif-core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/media/platform/s3c-camif/camif-core.c +2 -3
@@ -476,7 +476,7 @@ static int s3c_camif_probe(struct platform_device *pdev) ret =camif_media_dev_init (camif);if (ret <0 ) - goto err_alloc; + goto err_pm; ret =camif_register_sensor (camif);if (ret <0 )
@@ -510,10 +510,9 @@ static int s3c_camif_probe(struct platform_device *pdev)media_device_unregister (&camif->media_dev);media_device_cleanup (&camif->media_dev);camif_unregister_media_entities (camif); -err_alloc: +err_pm:pm_runtime_put (dev);pm_runtime_disable (dev); -err_pm:camif_clk_put (camif); err_clk:s3c_camif_unregister_subdev (camif);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 217/264 media: platform: sti: hva: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit d912a1d9e9afe69c6066c1ceb6bfc09063074075 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced.
--- drivers/media/platform/sti/hva/hva-hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/sti/hva/hva-hw.c +1 -1
@@ -393,7 +393,7 @@ int hva_hw_probe(struct platform_device *pdev, struct hva_dev *hva) ret =pm_runtime_get_sync (dev);if (ret <0 ) {dev_err (dev,"%s failed to set PM\n" ,HVA_PREFIX ); - goto err_clk; + goto err_pm; }/* check IP hardware version */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 218/264 media: bdisp: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit dbd2f2dc025f9be8ae063e4f270099677238f620 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced.
--- drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/platform/sti/bdisp/bdisp-v4l2.c +1 -2
@@ -1371,7 +1371,7 @@ static int bdisp_probe(struct platform_device *pdev) ret =pm_runtime_get_sync (dev);if (ret <0 ) {dev_err (dev,"failed to set PM\n" ); - goto err_dbg; + goto err_pm; }/* Filters */
@@ -1399,7 +1399,6 @@ static int bdisp_probe(struct platform_device *pdev)bdisp_hw_free_filters (bdisp->dev); err_pm:pm_runtime_put (dev); -err_dbg:bdisp_debugfs_remove (bdisp); err_v4l2:v4l2_device_unregister (&bdisp->v4l2_dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 219/264 media: media/pci: prevent memory leak in bttv_probe
In reply to Greg Kroah-HartmanFrom: Xiaolong Huang <[email protected]>
[ Upstream commit 7b817585b730665126b45df5508dd69526448bc8 ]
In bttv_probe if some functions such as pci_enable_device, pci_set_dma_mask and request_mem_region fails the allocated
memory for btv should be released.
--- drivers/media/pci/bt8xx/bttv-driver.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/media/pci/bt8xx/bttv-driver.c +10 -3
@@ -4055,11 +4055,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) btv->id = dev->device;if (pci_enable_device (dev)) {pr_warn ("%d: Can't enable device\n" , btv->c.nr); -return -EIO ; + result = -EIO ; + goto free_mem; }if (pci_set_dma_mask (dev,DMA_BIT_MASK (32 ))) {pr_warn ("%d: No suitable DMA available\n" , btv->c.nr); -return -EIO ; + result = -EIO ; + goto free_mem; } if (!request_mem_region(pci_resource_start(dev,0), pci_resource_len(dev,0),
@@ -4067,7 +4069,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)pr_warn ("%d: can't request iomem (0x%llx)\n" , btv->c.nr, (unsigned long long )pci_resource_start (dev,0 )); -return -EBUSY ; + result = -EBUSY ; + goto free_mem; }pci_set_master (dev);pci_set_command (dev);
@@ -4253,6 +4256,10 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)release_mem_region (pci_resource_start (btv->c.pci,0 ),pci_resource_len (btv->c.pci,0 ));pci_disable_device (btv->c.pci); + +free_mem: + bttvs[btv->c.nr] =NULL ; +kfree (btv);return result; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 220/264 media: uvcvideo: Ensure all probed info is returned to v4l2
In reply to Greg Kroah-HartmanFrom: Adam Goode <[email protected]>
[ Upstream commit 8a652a17e3c005dcdae31b6c8fdf14382a29cbbe ]
bFrameIndex and bFormatIndex can be negotiated by the camera during probing, resulting in the camera choosing a different format than expected. v4l2 can already accommodate such changes, but the code was not updating the proper fields.
Without such a change, v4l2 would potentially interpret the payload incorrectly, causing corrupted output. This was happening on the Elgato HD60 S+, which currently always renegotiates to format 1.
As an aside, the Elgato firmware is buggy and should not be renegotating, but it is still a valid thing for the camera to do. Both macOS and Windows will properly probe and read uncorrupted images from this camera.
With this change, both qv4l2 and chromium can now read uncorrupted video from the Elgato HD60 S+.
[Add blank lines, remove periods at the of messages]
--- drivers/media/usb/uvc/uvc_v4l2.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/media/usb/uvc/uvc_v4l2.c +30 -0
@@ -252,11 +252,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,if (ret <0 ) goto done; +/* After the probe, update fmt with the values returned from +* negotiation with the device. +*/ +for (i =0 ; i < stream->nformats; ++i) { +if (probe->bFormatIndex == stream->format[i].index) { + format = &stream->format[i]; +break ; + } + } + +if (i == stream->nformats) { +uvc_trace (UVC_TRACE_FORMAT ,"Unknown bFormatIndex %u\n" , + probe->bFormatIndex); +return -EINVAL ; + } + +for (i =0 ; i < format->nframes; ++i) { +if (probe->bFrameIndex == format->frame[i].bFrameIndex) { + frame = &format->frame[i]; +break ; + } + } + +if (i == format->nframes) { +uvc_trace (UVC_TRACE_FORMAT ,"Unknown bFrameIndex %u\n" , + probe->bFrameIndex); +return -EINVAL ; + } + fmt->fmt.pix.width = frame->wWidth; fmt->fmt.pix.height = frame->wHeight; fmt->fmt.pix.field =V4L2_FIELD_NONE ; fmt->fmt.pix.bytesperline =uvc_v4l2_get_bytesperline (format, frame); fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize; + fmt->fmt.pix.pixelformat = format->fcc; fmt->fmt.pix.colorspace = format->colorspace; fmt->fmt.pix.priv =0 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 221/264 mmc: sdio: Check for CISTPL_VERS_1 buffer size
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 8ebe2607965d3e2dc02029e8c7dd35fbe508ffd0 ]
Before parsing CISTPL_VERS_1 structure check that its size is at least two bytes to prevent buffer overflow.
--- drivers/mmc/core/sdio_cis.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/core/sdio_cis.c +3 -0
@@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,unsigned i, nr_strings;char **buffer, *string; +if (size <2 ) +return 0 ; +/* Find all null-terminated (including zero length) strings in the TPLLV1_INFO field. Trailing garbage is ignored. */ buf +=2 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 222/264 media: saa7134: avoid a shift overflow
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit 15a36aae1ec1c1f17149b6113b92631791830740 ]
As reported by smatch:
drivers/media/pci/saa7134//saa7134-tvaudio.c:686 saa_dsp_writel() warn: should 'reg << 2' be a 64 bit type?
On a 64-bits Kernel, the shift might be bigger than 32 bits.
In real, this should never happen, but let's shut up the warning.
--- drivers/media/pci/saa7134/saa7134-tvaudio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/pci/saa7134/saa7134-tvaudio.c +2 -1
@@ -693,7 +693,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value) {int err; -audio_dbg (2 ,"dsp write reg 0x%x = 0x%06x\n" , reg <<2 , value); +audio_dbg (2 ,"dsp write reg 0x%x = 0x%06x\n" , + (reg <<2 ) &0xffffffff , value); err =saa_dsp_wait_bit (dev,SAA7135_DSP_RWSTATE_WRR );if (err <0 )return err;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 223/264 fs: dlm: fix configfs memory leak
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 3d2825c8c6105b0f36f3ff72760799fa2e71420e ]
This patch fixes the following memory detected by kmemleak and umount gfs2 filesystem which removed the last lockspace:
unreferenced object 0xffff9264f482f600 (size 192):
comm "dlm_controld", pid 325, jiffies 4294690276 (age 48.136s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 6e 6f 64 65 73 00 00 00 ........nodes...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000060481d7>] make_space+0x41/0x130
[<000000008d905d46>] configfs_mkdir+0x1a2/0x5f0
[<00000000729502cf>] vfs_mkdir+0x155/0x210
[<000000000369bcf1>] do_mkdirat+0x6d/0x110
[<00000000cc478a33>] do_syscall_64+0x33/0x40
[<00000000ce9ccf01>] entry_SYSCALL_64_after_hwframe+0x44/0xa9The patch just remembers the "nodes" entry pointer in space as I think it's created as subdirectory when parent "spaces" is created. In function drop_space() we will lost the pointer reference to nds because configfs_remove_default_groups(). However as this subdirectory is always available when "spaces" exists it will just be freed when "spaces" will be freed.
--- fs/dlm/config.c | 3 +++ 1 file changed, 3 insertions(+)
fs/dlm/config.c +3 -0
@@ -218,6 +218,7 @@ struct dlm_space {struct list_head members;struct mutex members_lock;int members_count; +struct dlm_nodes *nds; };struct dlm_comms {
@@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)INIT_LIST_HEAD (&sp->members);mutex_init (&sp->members_lock); sp->members_count =0 ; + sp->nds = nds;return &sp->group; fail:
@@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i)static void release_space (struct config_item *i) {struct dlm_space *sp =config_item_to_space (i); +kfree (sp->nds);kfree (sp); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 224/264 media: venus: core: Fix runtime PM imbalance in venus_probe
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit bbe516e976fce538db96bd2b7287df942faa14a3 ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error code. Thus a pairing decrement is needed on the error handling path to keep the counter balanced. For other error paths after this call, things are the same.
Fix this by adding pm_runtime_put_noidle() after 'err_runtime_disable' label. But in this case, the error path after pm_runtime_put_sync() will decrease PM usage counter twice. Thus add an extra pm_runtime_get_noresume() in this path to balance PM counter.
--- drivers/media/platform/qcom/venus/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/platform/qcom/venus/core.c +4 -1
@@ -321,8 +321,10 @@ static int venus_probe(struct platform_device *pdev) goto err_dev_unregister; ret =pm_runtime_put_sync (dev); -if (ret) +if (ret) { +pm_runtime_get_noresume (dev); goto err_dev_unregister; + }return 0 ;
@@ -333,6 +335,7 @@ static int venus_probe(struct platform_device *pdev) err_venus_shutdown:venus_shutdown (dev); err_runtime_disable: +pm_runtime_put_noidle (dev);pm_runtime_set_suspended (dev);pm_runtime_disable (dev);hfi_destroy (core);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 225/264 ntfs: add check for mft record size in superblock
In reply to Greg Kroah-HartmanFrom: Rustam Kovhaev <[email protected]>
[ Upstream commit 4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e ]
Number of bytes allocated for mft record should be equal to the mft record size stored in ntfs superblock as reported by syzbot, userspace might trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find()
--- fs/ntfs/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ntfs/inode.c +6 -0
@@ -1835,6 +1835,12 @@ int ntfs_read_inode_mount(struct inode *vi)brelse (bh); } +if (le32_to_cpu (m->bytes_allocated) != vol->mft_record_size) { +ntfs_error (sb,"Incorrect mft record size %u in superblock, should be %u." , +le32_to_cpu (m->bytes_allocated), vol->mft_record_size); + goto err_out; + } +/* Apply the mst fixups. */ if (post_read_mst_fixup ((NTFS_RECORD *)m, vol->mft_record_size)) {/* FIXME: Try to use the $MFTMirr now. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 226/264 ip_gre: set dev->hard_header_len and dev->needed_headroom properly
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit fdafed459998e2be0e877e6189b24cb7a0183224 ]
GRE tunnel has its own header_ops, ipgre_header_ops, and sets it conditionally. When it is set, it assumes the outer IP header is already created before ipgre_xmit().
This is not true when we send packets through a raw packet socket, where L2 headers are supposed to be constructed by user. Packet socket calls dev_validate_header() to validate the header. But GRE tunnel does not set dev->hard_header_len, so that check can be simply bypassed, therefore uninit memory could be passed down to ipgre_xmit(). Similar for dev->needed_headroom.
dev->hard_header_len is supposed to be the length of the header created by dev->header_ops->create(), so it should be used whenever header_ops is set, and dev->needed_headroom should be used when it is not set.
--- net/ipv4/ip_gre.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/ipv4/ip_gre.c +11 -4
@@ -680,9 +680,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, }if (dev->header_ops) { -/* Need space for new headers */ -if (skb_cow_head (skb, dev->needed_headroom - - (tunnel->hlen +sizeof (struct iphdr )))) +if (skb_cow_head (skb,0 )) goto free_skb; tnl_params = (const struct iphdr *)skb->data;
@@ -800,7 +798,11 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu) len = tunnel->tun_hlen - len; tunnel->hlen = tunnel->hlen + len; - dev->needed_headroom = dev->needed_headroom + len; +if (dev->header_ops) + dev->hard_header_len += len; +else + dev->needed_headroom += len; +if (set_mtu) dev->mtu =max_t (int, dev->mtu - len,68 );
@@ -1003,6 +1005,7 @@ static void __gre_tunnel_init(struct net_device *dev) tunnel->parms.iph.protocol =IPPROTO_GRE ; tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen; + dev->needed_headroom = tunnel->hlen +sizeof (tunnel->parms.iph); dev->features |=GRE_FEATURES ; dev->hw_features |=GRE_FEATURES ;
@@ -1046,10 +1049,14 @@ static int ipgre_tunnel_init(struct net_device *dev)return -EINVAL ; dev->flags =IFF_BROADCAST ; dev->header_ops = &ipgre_header_ops; + dev->hard_header_len = tunnel->hlen +sizeof (*iph); + dev->needed_headroom = 0; }#endif }else if (!tunnel->collect_md) { dev->header_ops = &ipgre_header_ops; + dev->hard_header_len = tunnel->hlen +sizeof (*iph); + dev->needed_headroom =0 ; }return ip_tunnel_init (dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 227/264 mac80211: handle lack of sband->bitrates in rates
In reply to Greg Kroah-HartmanFrom: Thomas Pedersen <[email protected]>
[ Upstream commit 8b783d104e7f40684333d2ec155fac39219beb2f ]
Even though a driver or mac80211 shouldn't produce a legacy bitrate if sband->bitrates doesn't exist, don't crash if that is the case either.
This fixes a kernel panic if station dump is run before last_rate can be updated with a data frame when sband->bitrates is missing (eg. in S1G bands).
--- net/mac80211/cfg.c | 3 ++- net/mac80211/sta_info.c | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-)
net/mac80211/cfg.c +2 -1
@@ -664,7 +664,8 @@ void sta_set_rate_info_tx(struct sta_info *sta,u16 brate; sband =ieee80211_get_sband (sta->sdata); -if (sband) { +WARN_ON_ONCE (sband && !sband->bitrates); +if (sband && sband->bitrates) { brate = sband->bitrates[rate->idx].bitrate; rinfo->legacy =DIV_ROUND_UP (brate,1 << shift); }
net/mac80211/sta_info.c +4 -0
@@ -2009,6 +2009,10 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,int rate_idx =STA_STATS_GET (LEGACY_IDX , rate); sband = local->hw.wiphy->bands[band]; + +if (WARN_ON_ONCE (!sband->bitrates)) +break ; + brate = sband->bitrates[rate_idx].bitrate;if (rinfo->bw ==RATE_INFO_BW_5 ) shift =2 ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 228/264 PM: hibernate: remove the bogus call to get_gendisk() in software_resume()
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 428805c0c5e76ef643b1fbc893edfb636b3d8aef ]
get_gendisk grabs a reference on the disk and file operation, so this code will leak both of them while having absolutely no use for the gendisk itself.
This effectively reverts commit 2df83fa4bce421f ("PM / Hibernate: Use get_gendisk to verify partition if resume_file is integer format")
--- kernel/power/hibernate.c | 11 ----------- 1 file changed, 11 deletions(-)
kernel/power/hibernate.c +0 -11
@@ -842,17 +842,6 @@ static int software_resume(void)/* Check if the device is there */ swsusp_resume_device =name_to_dev_t (resume_file); - -/* -* name_to_dev_t is ineffective to verify parition if resume_file is in -* integer format. (e.g. major:minor) -*/ -if (isdigit (resume_file[0 ]) && resume_wait) { -int partno; -while (!get_gendisk (swsusp_resume_device, &partno)) -msleep (10 ); - } -if (!swsusp_resume_device) {/* * Some device discovery might still be in progress; we need
Signature · 1 line
2.25.1
Re: [PATCH 4.19 228/264] PM: hibernate: remove the bogus call to get_gendisk() in software_resume()
Quoted 10 lines · Greg Kroah-Hartman
From: Christoph Hellwig <[email protected]>
[ Upstream commit
428805c0c5e76ef643b1fbc893edfb636b3d8aef]
get_gendiskgrabs a reference on the disk and file operation, so this code will leak both of them while having absolutely no use for the gendisk itself.This effectively reverts commit
2df83fa4bce421f("PM / Hibernate: Useget_gendiskto verify partition ifresume_fileis integer format")
This does not fix anything in 4.19, and should not be there.
It will break resume for people using resumewait option and using numeric values, as original changelog explains. Eventually, someone will cry regression and we'll have to fix it in the mainline, but no need to bring this to -stable, too.
Pavel
Quoted 19 lines
+++
b/kernel/power/hibernate.ckernel/power/hibernate.c +0
-11@@ -842,17 +842,6 @@ static int software_resume(void)/* Check if the device is there */ swsusp_resume_device =name_to_dev_t (resume_file); - -/* -* name_to_dev_t is ineffective to verify parition if resume_file is in -* integer format. (e.g. major:minor) -*/ -if (isdigit (resume_file[0 ]) && resume_wait) { -int partno; -while (!get_gendisk (swsusp_resume_device, &partno)) -msleep (10 ); - } -if (!swsusp_resume_device) {/* * Some device discovery might still be in progress; we need
Signature · 1 line
http://www.livejournal.com/~pavelmachek
Re: [PATCH 4.19 228/264] PM: hibernate: remove the bogus call to get_gendisk() in software_resume()
Quoted 6 lines · Pavel Machek
This does not fix anything in 4.19, and should not be there.
It will break resume for people using resumewait option and using numeric values, as original changelog explains. Eventually, someone will cry regression and we'll have to fix it in the mainline, but no need to bring this to -stable, too.
If this code ever gets hit this patch fixes a reference count leak.
Greg Kroah-Hartman
maintainerPATCH 229/264 scsi: mvumi: Fix error return in mvumi_io_attach()
In reply to Greg Kroah-HartmanFrom: Jing Xiangfeng <[email protected]>
[ Upstream commit 055f15ab2cb4a5cbc4c0a775ef3d0066e0fa9b34 ]
Return PTR_ERR() from the error handling case instead of 0.
--- drivers/scsi/mvumi.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/mvumi.c +1 -0
@@ -2439,6 +2439,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba)if (IS_ERR (mhba->dm_thread)) {dev_err (&mhba->pdev->dev,"failed to create device scan thread\n" ); + ret =PTR_ERR (mhba->dm_thread);mutex_unlock (&mhba->sas_discovery_mutex); goto fail_create_thread; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 230/264 scsi: target: core: Add CONTROL field for trace events
In reply to Greg Kroah-HartmanFrom: Roman Bolshakov <[email protected]>
[ Upstream commit 7010645ba7256992818b518163f46bd4cdf8002a ]
trace-cmd report doesn't show events from target subsystem because scsi_command_size() leaks through event format string:
[target:target_sequencer_start] function scsi_command_size not defined [target:target_cmd_complete] function scsi_command_size not defined
Addition of scsi_command_size() to plugin_scsi.c in trace-cmd doesn't help because an expression is used inside TP_printk(). trace-cmd event parser doesn't understand minus sign inside [ ]:
Error: expected ']' but read '-'
Rather than duplicating kernel code in plugin_scsi.c, provide a dedicated field for CONTROL byte.
--- include/scsi/scsi_common.h | 7 +++++++ include/trace/events/target.h | 12 ++++++------ 2 files changed, 13 insertions(+), 6 deletions(-)
include/scsi/scsi_common.h +7 -0
@@ -25,6 +25,13 @@ scsi_command_size(const unsigned char *cmnd) scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]); } +static inline unsigned char +scsi_command_control (const unsigned char *cmnd) +{ +return (cmnd[0 ] ==VARIABLE_LENGTH_CMD ) ? + cmnd[1 ] : cmnd[COMMAND_SIZE (cmnd[0 ]) -1 ]; +} +/* Returns a human-readable name for the device */ extern const char *scsi_device_type (unsigned type);
include/trace/events/target.h +6 -6
@@ -140,6 +140,7 @@ TRACE_EVENT(target_sequencer_start, __field( unsigned int, opcode ) __field( unsigned int, data_length ) __field( unsigned int, task_attribute ) + __field( unsigned char, control ) __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) __string( initiator, cmd->se_sess->se_node_acl->initiatorname ) ),
@@ -149,6 +150,7 @@ TRACE_EVENT(target_sequencer_start, __entry->opcode = cmd->t_task_cdb[0 ]; __entry->data_length = cmd->data_length; __entry->task_attribute = cmd->sam_task_attr; + __entry->control =scsi_command_control (cmd->t_task_cdb);memcpy (__entry->cdb, cmd->t_task_cdb,TCM_MAX_COMMAND_SIZE );__assign_str (initiator, cmd->se_sess->se_node_acl->initiatorname); ),
@@ -158,9 +160,7 @@ TRACE_EVENT(target_sequencer_start,show_opcode_name (__entry->opcode), __entry->data_length,__print_hex (__entry->cdb,16 ),show_task_attribute_name (__entry->task_attribute), -scsi_command_size (__entry->cdb) <=16 ? - __entry->cdb[scsi_command_size (__entry->cdb) -1 ] : - __entry->cdb[1 ] + __entry->control ) );
@@ -175,6 +175,7 @@ TRACE_EVENT(target_cmd_complete, __field( unsigned int, opcode ) __field( unsigned int, data_length ) __field( unsigned int, task_attribute ) + __field( unsigned char, control ) __field( unsigned char, scsi_status ) __field( unsigned char, sense_length ) __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE )
@@ -187,6 +188,7 @@ TRACE_EVENT(target_cmd_complete, __entry->opcode = cmd->t_task_cdb[0 ]; __entry->data_length = cmd->data_length; __entry->task_attribute = cmd->sam_task_attr; + __entry->control =scsi_command_control (cmd->t_task_cdb); __entry->scsi_status = cmd->scsi_status; __entry->sense_length = cmd->scsi_status ==SAM_STAT_CHECK_CONDITION ?min (18 , ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET ] +8 ) :0 ;
@@ -203,9 +205,7 @@ TRACE_EVENT(target_cmd_complete,show_opcode_name (__entry->opcode), __entry->data_length,__print_hex (__entry->cdb,16 ),show_task_attribute_name (__entry->task_attribute), -scsi_command_size (__entry->cdb) <=16 ? - __entry->cdb[scsi_command_size (__entry->cdb) -1 ] : - __entry->cdb[1 ] + __entry->control ) );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 231/264 mic: vop: copy data to kernel space then write to io memory
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
[ Upstream commit 675f0ad4046946e80412896436164d172cd92238 ]
Read and write io memory should address align on ARCH ARM. Change to use memcpy_toio to avoid kernel panic caused by the address un-align issue.
--- drivers/misc/mic/vop/vop_vringh.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/misc/mic/vop/vop_vringh.c +14 -6
@@ -611,6 +611,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf,size_t partlen;bool dma =VOP_USE_DMA ;int err =0 ; +size_t offset =0 ;if (daddr & (dma_alignment -1 )) { vdev->tx_dst_unaligned += len;
@@ -659,13 +660,20 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf,* We are copying to IO below and should ideally use something * like copy_from_user_toio(..) if it existed. */ -if (copy_from_user ((void __force *)dbuf, ubuf, len)) { - err = -EFAULT ; -dev_err (vop_dev (vdev),"%s %d err %d\n" , - __func__, __LINE__, err); - goto err; +while (len) { + partlen =min_t (size_t, len,VOP_INT_DMA_BUF_SIZE ); + +if (copy_from_user (vvr->buf, ubuf + offset, partlen)) { + err = -EFAULT ; +dev_err (vop_dev (vdev),"%s %d err %d\n" , + __func__, __LINE__, err); + goto err; + } +memcpy_toio (dbuf + offset, vvr->buf, partlen); + offset += partlen; + vdev->out_bytes += partlen; + len -= partlen; } - vdev->out_bytes += len; err =0 ; err: vpdev->hw_ops->iounmap (vpdev, dbuf);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 232/264 misc: vop: add round_up(x,4) for vring_size to avoid kernel panic
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
[ Upstream commit cc1a2679865a94b83804822996eed010a50a7c1d ]
Since struct _mic_vring_info and vring are allocated together and follow vring, if the vring_size() is not four bytes aligned, which will cause the start address of struct _mic_vring_info is not four byte aligned. For example, when vring entries is 128, the vring_size() will be 5126 bytes. The _mic_vring_info struct layout in ddr looks like:0x90002400: 00000000 00390000 EE010000 0000C0FF
Here 0x39 is the avail_idx member, and 0xC0FFEE01 is the magic member.
When EP use ioread32(magic) to reads the magic in RC's share memory, it will cause kernel panic on ARM64 platform due to the cross-byte io read. Here read magic in user space use le32toh(vr0->info->magic) will meet the same issue.
So add round_up(x,4) for vring_size, then the struct _mic_vring_info will store in this way:0x90002400: 00000000 00000000 00000039 C0FFEE01
Which will avoid kernel panic when read magic in struct _mic_vring_info.
--- drivers/misc/mic/vop/vop_main.c | 2 +- drivers/misc/mic/vop/vop_vringh.c | 4 ++-- samples/mic/mpssd/mpssd.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
drivers/misc/mic/vop/vop_main.c +1 -1
@@ -301,7 +301,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,/* First assign the vring's allocated in host memory */ vqconfig =_vop_vq_config (vdev->desc) + index;memcpy_fromio (&config, vqconfig,sizeof (config)); - _vr_size =vring_size (le16_to_cpu (config.num),MIC_VIRTIO_RING_ALIGN ); + _vr_size =round_up (vring_size (le16_to_cpu (config.num),MIC_VIRTIO_RING_ALIGN ),4 ); vr_size =PAGE_ALIGN (_vr_size +sizeof (struct _mic_vring_info )); va = vpdev->hw_ops->ioremap (vpdev,le64_to_cpu (config.address), vr_size);
drivers/misc/mic/vop/vop_vringh.c +2 -2
@@ -308,7 +308,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, num =le16_to_cpu (vqconfig[i].num);mutex_init (&vvr->vr_mutex); - vr_size =PAGE_ALIGN (vring_size (num,MIC_VIRTIO_RING_ALIGN ) + + vr_size =PAGE_ALIGN (round_up (vring_size (num,MIC_VIRTIO_RING_ALIGN ),4 ) +sizeof (struct _mic_vring_info )); vr->va = (void *) __get_free_pages(GFP_KERNEL | __GFP_ZERO,
@@ -320,7 +320,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, goto err; } vr->len = vr_size; - vr->info = vr->va +vring_size (num,MIC_VIRTIO_RING_ALIGN ); + vr->info = vr->va +round_up (vring_size (num,MIC_VIRTIO_RING_ALIGN ),4 ); vr->info->magic =cpu_to_le32 (MIC_MAGIC + vdev->virtio_id + i); vr_addr =dma_map_single (&vpdev->dev, vr->va, vr_size,DMA_BIDIRECTIONAL );
samples/mic/mpssd/mpssd.c +2 -2
@@ -414,9 +414,9 @@ mic_virtio_copy(struct mic_info *mic, int fd,static inline unsigned _vring_size (unsigned int num,unsigned long align) { -return ((sizeof (struct vring_desc ) * num +sizeof (__u16) * (3 + num) +return _ALIGN_UP (((sizeof (struct vring_desc ) * num +sizeof (__u16) * (3 + num) + align -1 ) & ~(align -1 )) - +sizeof (__u16) *3 +sizeof (struct vring_used_elem ) * num; + +sizeof (__u16) *3 +sizeof (struct vring_used_elem ) * num,4 ); }/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 233/264 usb: gadget: function: printer: fix use-after-free in __lock_acquire
In reply to Greg Kroah-HartmanFrom: Zqiang <[email protected]>
[ Upstream commit e8d5f92b8d30bb4ade76494490c3c065e12411b1 ]
Fix this by increase object reference count.
BUG: KASAN: use-after-free in __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 Read of size 8 at addr ffff8880683b0018 by task syz-executor.0/3377 CPU: 1 PID: 3377 Comm: syz-executor.0 Not tainted 5.6.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 lock_acquire+0x127/0x350 kernel/locking/lockdep.c:4488 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 printer_ioctl+0x4a/0x110 drivers/usb/gadget/function/f_printer.c:723 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0xfb/0x130 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4531a9 Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd14ad72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 00000000004531a9
RDX: fffffffffffffff9 RSI: 000000000000009e RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbd61
R13: 00000000004d0a98 R14: 00007fd14ad736d4 R15: 00000000ffffffff
Allocated by task 2393: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:515 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2813 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] gprinter_alloc+0xa1/0x870 drivers/usb/gadget/function/f_printer.c:1416 usb_get_function+0x58/0xc0 drivers/usb/gadget/functions.c:61 config_usb_cfg_link+0x1ed/0x3e0 drivers/usb/gadget/configfs.c:444 configfs_symlink+0x527/0x11d0 fs/configfs/symlink.c:202 vfs_symlink+0x33d/0x5b0 fs/namei.c:4201 do_symlinkat+0x11b/0x1d0 fs/namei.c:4228 __do_sys_symlinkat fs/namei.c:4242 [inline] __se_sys_symlinkat fs/namei.c:4239 [inline] __x64_sys_symlinkat+0x73/0xb0 fs/namei.c:4239 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 3368: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x135/0x190 mm/kasan/common.c:476 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485 slab_free_hook mm/slub.c:1444 [inline] slab_free_freelist_hook mm/slub.c:1477 [inline] slab_free mm/slub.c:3034 [inline] kfree+0xf7/0x410 mm/slub.c:3995 gprinter_free+0x49/0xd0 drivers/usb/gadget/function/f_printer.c:1353 usb_put_function+0x38/0x50 drivers/usb/gadget/functions.c:87 config_usb_cfg_unlink+0x2db/0x3b0 drivers/usb/gadget/configfs.c:485 configfs_unlink+0x3b9/0x7f0 fs/configfs/symlink.c:250 vfs_unlink+0x287/0x570 fs/namei.c:4073 do_unlinkat+0x4f9/0x620 fs/namei.c:4137 __do_sys_unlink fs/namei.c:4184 [inline] __se_sys_unlink fs/namei.c:4182 [inline] __x64_sys_unlink+0x42/0x50 fs/namei.c:4182 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880683b0000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 24 bytes inside of 1024-byte region [ffff8880683b0000, ffff8880683b0400) The buggy address belongs to the page: page:ffffea0001a0ec00 refcount:1 mapcount:0 mapping:ffff88806c00e300 index:0xffff8880683b1800 compound_mapcount: 0 flags: 0x100000000010200(slab|head) raw: 0100000000010200 0000000000000000 0000000600000001 ffff88806c00e300 raw: ffff8880683b1800 000000008010000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
--- drivers/usb/gadget/function/f_printer.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_printer.c +14 -2
@@ -31,6 +31,7 @@#include <linux/types.h> #include <linux/ctype.h> #include <linux/cdev.h> +#include <linux/kref.h> #include <asm/byteorder.h> #include <linux/io.h>
@@ -64,7 +65,7 @@ struct printer_dev {struct usb_gadget *gadget;s8 interface;struct usb_ep *in_ep, *out_ep; - +struct kref kref;struct list_head rx_reqs;/* List of free RX structs */ struct list_head rx_reqs_active;/* List of Active RX xfers */ struct list_head rx_buffers;/* List of completed xfers */
@@ -218,6 +219,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,/*-------------------------------------------------------------------------*/ +static void printer_dev_free (struct kref *kref) +{ + struct printer_dev *dev = container_of(kref, struct printer_dev, kref); + +kfree (dev); +} +static struct usb_request *printer_req_alloc (struct usb_ep *ep,unsigned len,gfp_t gfp_flags) {
@@ -348,6 +356,7 @@ printer_open(struct inode *inode, struct file *fd)spin_unlock_irqrestore (&dev->lock, flags); +kref_get (&dev->kref);DBG (dev,"printer_open returned %x\n" , ret);return ret; }
@@ -365,6 +374,7 @@ printer_close(struct inode *inode, struct file *fd) dev->printer_status &= ~PRINTER_SELECTED ;spin_unlock_irqrestore (&dev->lock, flags); +kref_put (&dev->kref, printer_dev_free);DBG (dev,"printer_close\n" );return 0 ;
@@ -1350,7 +1360,8 @@ static void gprinter_free(struct usb_function *f)struct f_printer_opts *opts; opts = container_of(f->fi, struct f_printer_opts, func_inst); -kfree (dev); + +kref_put (&dev->kref, printer_dev_free);mutex_lock (&opts->lock); --opts->refcnt;mutex_unlock (&opts->lock);
@@ -1419,6 +1430,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)return ERR_PTR (-ENOMEM ); } +kref_init (&dev->kref); ++opts->refcnt; dev->minor = opts->minor; dev->pnp_string = opts->pnp_string;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 234/264 udf: Limit sparing table size
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 44ac6b829c4e173fdf6df18e6dd86aecf9a3dc99 ]
Although UDF standard allows it, we don't support sparing table larger than a single block. Check it during mount so that we don't try to access memory beyond end of buffer.
--- fs/udf/super.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/udf/super.c +6 -0
@@ -1349,6 +1349,12 @@ static int udf_load_sparable_map(struct super_block *sb, (int)spm->numSparingTables);return -EIO ; } +if (le32_to_cpu (spm->sizeSparingTable) > sb->s_blocksize) { +udf_err (sb,"error loading logical volume descriptor: " +"Too big sparing table size (%u)\n" , +le32_to_cpu (spm->sizeSparingTable)); +return -EIO ; + }for (i =0 ; i < spm->numSparingTables; i++) { loc =le32_to_cpu (spm->locSparingTable[i]);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 235/264 udf: Avoid accessing uninitialized data on failed inode read
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 044e2e26f214e5ab26af85faffd8d1e4ec066931 ]
When we fail to read inode, some data accessed in udf_evict_inode() may be uninitialized. Move the accesses to !is_bad_inode() branch.
--- fs/udf/inode.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
fs/udf/inode.c +14 -11
@@ -132,21 +132,24 @@ void udf_evict_inode(struct inode *inode)struct udf_inode_info *iinfo =UDF_I (inode);int want_delete =0 ; -if (!inode->i_nlink && !is_bad_inode (inode)) { - want_delete =1 ; -udf_setsize (inode,0 ); -udf_update_inode (inode,IS_SYNC (inode)); +if (!is_bad_inode (inode)) { +if (!inode->i_nlink) { + want_delete =1 ; +udf_setsize (inode,0 ); +udf_update_inode (inode,IS_SYNC (inode)); + } +if (iinfo->i_alloc_type !=ICBTAG_FLAG_AD_IN_ICB && + inode->i_size != iinfo->i_lenExtents) { +udf_warn (inode->i_sb, +"Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n" , + inode->i_ino, inode->i_mode, + (unsigned long long )inode->i_size, + (unsigned long long )iinfo->i_lenExtents); + } }truncate_inode_pages_final (&inode->i_data);invalidate_inode_buffers (inode);clear_inode (inode); -if (iinfo->i_alloc_type !=ICBTAG_FLAG_AD_IN_ICB && - inode->i_size != iinfo->i_lenExtents) { -udf_warn (inode->i_sb,"Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n" , - inode->i_ino, inode->i_mode, - (unsigned long long )inode->i_size, - (unsigned long long )iinfo->i_lenExtents); - }kfree (iinfo->i_ext.i_data); iinfo->i_ext.i_data =NULL ;udf_clear_extent_cache (inode);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 236/264 USB: cdc-acm: handle broken union descriptors
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 960c7339de27c6d6fec13b54880501c3576bb08d ]
Handle broken union functional descriptors where the master-interface doesn't exist or where its class is of neither Communication or Data type (as required by the specification) by falling back to "combined-interface" probing.
Note that this still allows for handling union descriptors with switched interfaces.
This specifically makes the Whistler radio scanners TRX series devices work with the driver without adding further quirks to the device-id table.
--- drivers/usb/class/cdc-acm.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/usb/class/cdc-acm.c +12 -0
@@ -1275,9 +1275,21 @@ static int acm_probe(struct usb_interface *intf, } } }else { +int class =-1 ; + data_intf_num = union_header->bSlaveInterface0; control_interface =usb_ifnum_to_if (usb_dev, union_header->bMasterInterface0); data_interface =usb_ifnum_to_if (usb_dev, data_intf_num); + +if (control_interface) + class = control_interface->cur_altsetting->desc.bInterfaceClass; + +if (class !=USB_CLASS_COMM && class !=USB_CLASS_CDC_DATA ) { +dev_dbg (&intf->dev,"Broken union descriptor, assuming single interface\n" ); + combined_interfaces =1 ; + control_interface = data_interface = intf; + goto look_for_collapsed_interface; + } }if (!control_interface || !data_interface) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 237/264 usb: dwc3: simple: add support for Hikey 970
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit b68d9251561f33661e53dd618f1cafe7ec9ec3c2 ]
This binding driver is needed for Hikey 970 to work, as otherwise a Serror is produced:
[ 1.837458] SError Interrupt on CPU0, code 0xbf000002 -- SError
[ 1.837462] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.8.0+ #205
[ 1.837463] Hardware name: HiKey970 (DT)
[ 1.837465] Workqueue: events deferred_probe_work_func
[ 1.837467] pstate: 20000005 (nzCv daif -PAN -UAO BTYPE=--)
[ 1.837468] pc : _raw_spin_unlock_irqrestore+0x18/0x50
[ 1.837469] lr : regmap_unlock_spinlock+0x14/0x20
[ 1.837470] sp : ffff8000124dba60
[ 1.837471] x29: ffff8000124dba60 x28: 0000000000000000
[ 1.837474] x27: ffff0001b7e854c8 x26: ffff80001204ea18
[ 1.837476] x25: 0000000000000005 x24: ffff800011f918f8
[ 1.837479] x23: ffff800011fbb588 x22: ffff0001b7e40e00
[ 1.837481] x21: 0000000000000100 x20: 0000000000000000
[ 1.837483] x19: ffff0001b767ec00 x18: 00000000ff10c000
[ 1.837485] x17: 0000000000000002 x16: 0000b0740fdb9950
[ 1.837488] x15: ffff8000116c1198 x14: ffffffffffffffff
[ 1.837490] x13: 0000000000000030 x12: 0101010101010101
[ 1.837493] x11: 0000000000000020 x10: ffff0001bf17d130
[ 1.837495] x9 : 0000000000000000 x8 : ffff0001b6938080
[ 1.837497] x7 : 0000000000000000 x6 : 000000000000003f
[ 1.837500] x5 : 0000000000000000 x4 : 0000000000000000
[ 1.837502] x3 : ffff80001096a880 x2 : 0000000000000000
[ 1.837505] x1 : ffff0001b7e40e00 x0 : 0000000100000001
[ 1.837507] Kernel panic - not syncing: Asynchronous SError Interrupt
[ 1.837509] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.8.0+ #205
[ 1.837510] Hardware name: HiKey970 (DT)
[ 1.837511] Workqueue: events deferred_probe_work_func
[ 1.837513] Call trace:
[ 1.837514] dump_backtrace+0x0/0x1e0
[ 1.837515] show_stack+0x18/0x24
[ 1.837516] dump_stack+0xc0/0x11c
[ 1.837517] panic+0x15c/0x324
[ 1.837518] nmi_panic+0x8c/0x90
[ 1.837519] arm64_serror_panic+0x78/0x84
[ 1.837520] do_serror+0x158/0x15c
[ 1.837521] el1_error+0x84/0x100
[ 1.837522] _raw_spin_unlock_irqrestore+0x18/0x50
[ 1.837523] regmap_write+0x58/0x80
[ 1.837524] hi3660_reset_deassert+0x28/0x34
[ 1.837526] reset_control_deassert+0x50/0x260
[ 1.837527] reset_control_deassert+0xf4/0x260
[ 1.837528] dwc3_probe+0x5dc/0xe6c
[ 1.837529] platform_drv_probe+0x54/0xb0
[ 1.837530] really_probe+0xe0/0x490
[ 1.837531] driver_probe_device+0xf4/0x160
[ 1.837532] __device_attach_driver+0x8c/0x114
[ 1.837533] bus_for_each_drv+0x78/0xcc
[ 1.837534] __device_attach+0x108/0x1a0
[ 1.837535] device_initial_probe+0x14/0x20
[ 1.837537] bus_probe_device+0x98/0xa0
[ 1.837538] deferred_probe_work_func+0x88/0xe0
[ 1.837539] process_one_work+0x1cc/0x350
[ 1.837540] worker_thread+0x2c0/0x470
[ 1.837541] kthread+0x154/0x160
[ 1.837542] ret_from_fork+0x10/0x30
[ 1.837569] SMP: stopping secondary CPUs
[ 1.837570] Kernel Offset: 0x1d0000 from 0xffff800010000000
[ 1.837571] PHYS_OFFSET: 0x0
[ 1.837572] CPU features: 0x240002,20882004
[ 1.837573] Memory Limit: none--- drivers/usb/dwc3/dwc3-of-simple.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/dwc3-of-simple.c +1 -0
@@ -243,6 +243,7 @@ static const struct of_device_id of_dwc3_simple_match[] = { { .compatible = "amlogic,meson-axg-dwc3" }, { .compatible = "amlogic,meson-gxl-dwc3" }, { .compatible = "allwinner,sun50i-h6-dwc3" }, + { .compatible = "hisilicon,hi3670-dwc3" }, {/* Sentinel */ } };MODULE_DEVICE_TABLE (of, of_dwc3_simple_match);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 238/264 can: flexcan: flexcan_chip_stop(): add error handling and propagate error value
In reply to Greg Kroah-HartmanFrom: Joakim Zhang <[email protected]>
[ Upstream commit 9ad02c7f4f279504bdd38ab706fdc97d5f2b2a9c ]
This patch implements error handling and propagates the error value of flexcan_chip_stop(). This function will be called from flexcan_suspend() in an upcoming patch in some SoCs which support LPSR mode.
Add a new function flexcan_chip_stop_disable_on_error() that tries to disable the chip even in case of errors.
--- drivers/net/can/flexcan.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-)
drivers/net/can/flexcan.c +28 -6
@@ -1091,18 +1091,23 @@ static int flexcan_chip_start(struct net_device *dev)return err; } -/* flexcan_chip_stop +/* __flexcan_chip_stop * -* this functions is entered with clocks enabled +* this function is entered with clocks enabled */ -static void flexcan_chip_stop (struct net_device *dev) +static int __flexcan_chip_stop (struct net_device *dev,bool disable_on_error) {struct flexcan_priv *priv =netdev_priv (dev);struct flexcan_regs __iomem *regs = priv->regs; +int err;/* freeze + disable module */ -flexcan_chip_freeze (priv); -flexcan_chip_disable (priv); + err =flexcan_chip_freeze (priv); +if (err && !disable_on_error) +return err; + err =flexcan_chip_disable (priv); +if (err && !disable_on_error) + goto out_chip_unfreeze;/* Disable all interrupts */ priv->write (0 , ®s->imask2);
@@ -1112,6 +1117,23 @@ static void flexcan_chip_stop(struct net_device *dev)flexcan_transceiver_disable (priv); priv->can.state =CAN_STATE_STOPPED ; + +return 0 ; + + out_chip_unfreeze: +flexcan_chip_unfreeze (priv); + +return err; +} + +static inline int flexcan_chip_stop_disable_on_error (struct net_device *dev) +{ +return __flexcan_chip_stop (dev, true); +} + +static inline int flexcan_chip_stop (struct net_device *dev) +{ +return __flexcan_chip_stop (dev, false); }static int flexcan_open (struct net_device *dev)
@@ -1165,7 +1187,7 @@ static int flexcan_close(struct net_device *dev)netif_stop_queue (dev);can_rx_offload_disable (&priv->offload); -flexcan_chip_stop (dev); +flexcan_chip_stop_disable_on_error (dev);free_irq (dev->irq, dev);clk_disable_unprepare (priv->clk_per);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 239/264 ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()
In reply to Greg Kroah-HartmanFrom: Brooke Basile <[email protected]>
[ Upstream commit 03fb92a432ea5abe5909bca1455b7e44a9380480 ]
Calls to usb_kill_anchored_urbs() after usb_kill_urb() on multiprocessor systems create a race condition in which usb_kill_anchored_urbs() deallocates the URB before the completer callback is called in usb_kill_urb(), resulting in a use-after-free.
To fix this, add proper lock protection to usb_kill_urb() calls that can possibly run concurrently with usb_kill_anchored_urbs().
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/net/wireless/ath/ath9k/hif_usb.c +19 -0
@@ -449,10 +449,19 @@ static void hif_usb_stop(void *hif_handle)spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags);/* The pending URBs have to be canceled. */ +spin_lock_irqsave (&hif_dev->tx.tx_lock, flags);list_for_each_entry_safe (tx_buf, tx_buf_tmp, &hif_dev->tx.tx_pending, list) { +usb_get_urb (tx_buf->urb); +spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags);usb_kill_urb (tx_buf->urb); +list_del (&tx_buf->list); +usb_free_urb (tx_buf->urb); +kfree (tx_buf->buf); +kfree (tx_buf); +spin_lock_irqsave (&hif_dev->tx.tx_lock, flags); } +spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags);usb_kill_anchored_urbs (&hif_dev->mgmt_submitted); }
@@ -762,27 +771,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)struct tx_buf *tx_buf =NULL , *tx_buf_tmp =NULL ;unsigned long flags; +spin_lock_irqsave (&hif_dev->tx.tx_lock, flags);list_for_each_entry_safe (tx_buf, tx_buf_tmp, &hif_dev->tx.tx_buf, list) { +usb_get_urb (tx_buf->urb); +spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags);usb_kill_urb (tx_buf->urb);list_del (&tx_buf->list);usb_free_urb (tx_buf->urb);kfree (tx_buf->buf);kfree (tx_buf); +spin_lock_irqsave (&hif_dev->tx.tx_lock, flags); } +spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags);spin_lock_irqsave (&hif_dev->tx.tx_lock, flags); hif_dev->tx.flags |=HIF_USB_TX_FLUSH ;spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags); +spin_lock_irqsave (&hif_dev->tx.tx_lock, flags);list_for_each_entry_safe (tx_buf, tx_buf_tmp, &hif_dev->tx.tx_pending, list) { +usb_get_urb (tx_buf->urb); +spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags);usb_kill_urb (tx_buf->urb);list_del (&tx_buf->list);usb_free_urb (tx_buf->urb);kfree (tx_buf->buf);kfree (tx_buf); +spin_lock_irqsave (&hif_dev->tx.tx_lock, flags); } +spin_unlock_irqrestore (&hif_dev->tx.tx_lock, flags);usb_kill_anchored_urbs (&hif_dev->mgmt_submitted); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 240/264 misc: rtsx: Fix memory leak in rtsx_pci_probe
In reply to Greg Kroah-HartmanFrom: Keita Suzuki <[email protected]>
[ Upstream commit bc28369c6189009b66d9619dd9f09bd8c684bb98 ]
When mfd_add_devices() fail, pcr->slots should also be freed. However, the current implementation does not free the member, leading to a memory leak.
Fix this by adding a new goto label that frees pcr->slots.
--- drivers/misc/cardreader/rtsx_pcr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/misc/cardreader/rtsx_pcr.c +3 -1
@@ -1524,12 +1524,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, ret =mfd_add_devices (&pcidev->dev, pcr->id, rtsx_pcr_cells,ARRAY_SIZE (rtsx_pcr_cells),NULL ,0 ,NULL );if (ret <0 ) - goto disable_irq; + goto free_slots;schedule_delayed_work (&pcr->idle_work,msecs_to_jiffies (200 ));return 0 ; +free_slots: +kfree (pcr->slots); disable_irq:free_irq (pcr->irq, (void *)pcr); disable_msi:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 241/264 reiserfs: only call unlock_new_inode() if I_NEW
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit 8859bf2b1278d064a139e3031451524a49a56bd0 ]
unlock_new_inode() is only meant to be called after a new inode has already been inserted into the hash table. But reiserfs_new_inode() can call it even before it has inserted the inode, triggering the WARNING in unlock_new_inode(). Fix this by only calling unlock_new_inode() if the inode has the I_NEW flag set, indicating that it's in the table.
This addresses the syzbot report "WARNING in unlock_new_inode"
(https://syzkaller.appspot.com/bug?extid=187510916eb6a14598f7).
--- fs/reiserfs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/reiserfs/inode.c +2 -1
@@ -2161,7 +2161,8 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, out_inserted_sd:clear_nlink (inode); th->t_trans_id =0 ;/* so the caller can't use this handle later */ -unlock_new_inode (inode);/* OK to do even if we hadn't locked it */ +if (inode->i_state &I_NEW ) +unlock_new_inode (inode);iput (inode);return err; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 242/264 xfs: make sure the rt allocator doesnt run off the end
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 2a6ca4baed620303d414934aa1b7b0a8e7bab05f ]
There's an overflow bug in the realtime allocator. If the rt volume is large enough to handle a single allocation request that is larger than the maximum bmap extent length and the rt bitmap ends exactly on a bitmap block boundary, it's possible that the near allocator will try to check the freeness of a range that extends past the end of the bitmap. This fails with a corruption error and shuts down the fs.
Therefore, constrain maxlen so that the range scan cannot run off the end of the rt bitmap.
--- fs/xfs/xfs_rtalloc.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/xfs/xfs_rtalloc.c +11 -0
@@ -245,6 +245,9 @@ xfs_rtallocate_extent_block( end =XFS_BLOCKTOBIT (mp, bbno +1 ) -1 ; i <= end; i++) { +/* Make sure we don't scan off the end of the rt volume. */ + maxlen =min (mp->m_sb.sb_rextents, i + maxlen) - i; +/* * See if there's a free extent of maxlen starting at i. * If it's not so then next will contain the first non-free.
@@ -440,6 +443,14 @@ xfs_rtallocate_extent_near(*/ if (bno >= mp->m_sb.sb_rextents) bno = mp->m_sb.sb_rextents -1 ; + +/* Make sure we don't run off the end of the rt volume. */ + maxlen =min (mp->m_sb.sb_rextents, bno + maxlen) - bno; +if (maxlen < minlen) { + *rtblock =NULLRTBLOCK ; +return 0 ; + } +/* * Try the exact allocation first. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 243/264 usb: ohci: Default to per-port over-current protection
In reply to Greg Kroah-HartmanFrom: Hamish Martin <[email protected]>
[ Upstream commit b77d2a0a223bc139ee8904991b2922d215d02636 ]
Some integrated OHCI controller hubs do not expose all ports of the hub to pins on the SoC. In some cases the unconnected ports generate spurious over-current events. For example the Broadcom 56060/Ranger 2 SoC contains a nominally 3 port hub but only the first port is wired.
Default behaviour for ohci-platform driver is to use global over-current protection mode (AKA "ganged"). This leads to the spurious over-current events affecting all ports in the hub.
We now alter the default to use per-port over-current protection.
This patch results in the following configuration changes depending on quirks:
- For quirk OHCI_QUIRK_SUPERIO no changes. These systems remain set up for ganged power switching and no over-current protection.
- For quirk OHCI_QUIRK_AMD756 or OHCI_QUIRK_HUB_POWER power switching remains at none, while over-current protection is now guaranteed to be set to per-port rather than the previous behaviour where it was either none or global over-current protection depending on the value at function entry.
--- drivers/usb/host/ohci-hcd.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/usb/host/ohci-hcd.c +10 -6
@@ -665,20 +665,24 @@ static int ohci_run (struct ohci_hcd *ohci)/* handle root hub init quirks ... */ val =roothub_a (ohci); - val &= ~(RH_A_PSM |RH_A_OCPM ); +/* Configure for per-port over-current protection by default */ + val &= ~RH_A_NOCP ; + val |=RH_A_OCPM ;if (ohci->flags &OHCI_QUIRK_SUPERIO ) { -/* NSC 87560 and maybe others */ +/* NSC 87560 and maybe others. +* Ganged power switching, no over-current protection. +*/ val |=RH_A_NOCP ; - val &= ~(RH_A_POTPGT |RH_A_NPS ); -ohci_writel (ohci, val, &ohci->regs->roothub.a); + val &= ~(RH_A_POTPGT |RH_A_NPS |RH_A_PSM |RH_A_OCPM ); }else if ((ohci->flags &OHCI_QUIRK_AMD756 ) || (ohci->flags &OHCI_QUIRK_HUB_POWER )) {/* hub power always on; required for AMD-756 and some -* Mac platforms. ganged overcurrent reporting, if any. +* Mac platforms. */ val |=RH_A_NPS ; -ohci_writel (ohci, val, &ohci->regs->roothub.a); } +ohci_writel (ohci, val, &ohci->regs->roothub.a); +ohci_writel (ohci,RH_HS_LPSC , &ohci->regs->roothub.status);ohci_writel (ohci, (val &RH_A_NPS ) ?0 :RH_B_PPCM , &ohci->regs->roothub.b);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 244/264 Bluetooth: Only mark socket zapped after unlocking
In reply to Greg Kroah-HartmanFrom: Abhishek Pandit-Subedi <[email protected]>
[ Upstream commit 20ae4089d0afeb24e9ceb026b996bfa55c983cc2 ]
Since l2cap_sock_teardown_cb doesn't acquire the channel lock before setting the socket as zapped, it could potentially race with l2cap_sock_release which frees the socket. Thus, wait until the cleanup is complete before marking the socket as zapped.
This race was reproduced on a JBL GO speaker after the remote device rejected L2CAP connection due to resource unavailability.
Here is a dmesg log with debug logs from a repro of this bug:
[ 3465.424086] Bluetooth: hci_core.c:hci_acldata_packet() hci0 len 16 handle 0x0003 flags 0x0002 [ 3465.424090] Bluetooth: hci_conn.c:hci_conn_enter_active_mode() hcon 00000000cfedd07d mode 0 [ 3465.424094] Bluetooth: l2cap_core.c:l2cap_recv_acldata() conn 000000007eae8952 len 16 flags 0x2 [ 3465.424098] Bluetooth: l2cap_core.c:l2cap_recv_frame() len 12, cid 0x0001 [ 3465.424102] Bluetooth: l2cap_core.c:l2cap_raw_recv() conn 000000007eae8952 [ 3465.424175] Bluetooth: l2cap_core.c:l2cap_sig_channel() code 0x03 len 8 id 0x0c [ 3465.424180] Bluetooth: l2cap_core.c:l2cap_connect_create_rsp() dcid 0x0045 scid 0x0000 result 0x02 status 0x00 [ 3465.424189] Bluetooth: l2cap_core.c:l2cap_chan_put() chan 000000006acf9bff orig refcnt 4 [ 3465.424196] Bluetooth: l2cap_core.c:l2cap_chan_del() chan 000000006acf9bff, conn 000000007eae8952, err 111, state BT_CONNECT [ 3465.424203] Bluetooth: l2cap_sock.c:l2cap_sock_teardown_cb() chan 000000006acf9bff state BT_CONNECT [ 3465.424221] Bluetooth: l2cap_core.c:l2cap_chan_put() chan 000000006acf9bff orig refcnt 3 [ 3465.424226] Bluetooth: hci_core.h:hci_conn_drop() hcon 00000000cfedd07d orig refcnt 6 [ 3465.424234] BUG: spinlock bad magic on CPU#2, kworker/u17:0/159 [ 3465.425626] Bluetooth: hci_sock.c:hci_sock_sendmsg() sock 000000002bb0cb64 sk 00000000a7964053 [ 3465.430330] lock: 0xffffff804410aac0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 [ 3465.430332] Causing a watchdog bite!
--- net/bluetooth/l2cap_sock.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/bluetooth/l2cap_sock.c +4 -3
@@ -1341,8 +1341,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) parent =bt_sk (sk)->parent; -sock_set_flag (sk,SOCK_ZAPPED ); -switch (chan->state) {case BT_OPEN :case BT_BOUND :
@@ -1369,8 +1367,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)break ; } -release_sock (sk); + +/* Only zap after cleanup to avoid use after free race */ +sock_set_flag (sk,SOCK_ZAPPED ); + } static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 245/264 scsi: ibmvfc: Fix error return in ibmvfc_probe()
In reply to Greg Kroah-HartmanFrom: Jing Xiangfeng <[email protected]>
[ Upstream commit 5e48a084f4e824e1b624d3fd7ddcf53d2ba69e53 ]
Fix to return error code PTR_ERR() from the error handling case instead of 0.
--- drivers/scsi/ibmvscsi/ibmvfc.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/ibmvscsi/ibmvfc.c +1 -0
@@ -4795,6 +4795,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id)if (IS_ERR (vhost->work_thread)) {dev_err (dev,"Couldn't create kernel thread: %ld\n" ,PTR_ERR (vhost->work_thread)); + rc =PTR_ERR (vhost->work_thread); goto free_host_mem; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 246/264 brcmsmac: fix memory leak in wlc_phy_attach_lcnphy
In reply to Greg Kroah-HartmanFrom: Keita Suzuki <[email protected]>
[ Upstream commit f4443293d741d1776b86ed1dd8c4e4285d0775fc ]
When wlc_phy_txpwr_srom_read_lcnphy fails in wlc_phy_attach_lcnphy, the allocated pi->u.pi_lcnphy is leaked, since struct brcms_phy will be freed in the caller function.
Fix this by calling wlc_phy_detach_lcnphy in the error handler of wlc_phy_txpwr_srom_read_lcnphy before returning.
--- .../net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +3 -1
@@ -5085,8 +5085,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi) pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft; pi->pi_fptr.detach = wlc_phy_detach_lcnphy; -if (!wlc_phy_txpwr_srom_read_lcnphy (pi)) +if (!wlc_phy_txpwr_srom_read_lcnphy (pi)) { +kfree (pi->u.pi_lcnphy);return false; + }if (LCNREV_IS (pi->pubpi.phy_rev,1 )) {if (pi_lcn->lcnphy_tempsense_option ==3 ) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 247/264 rtl8xxxu: prevent potential memory leak
In reply to Greg Kroah-HartmanFrom: Chris Chiu <[email protected]>
[ Upstream commit 86279456a4d47782398d3cb8193f78f672e36cac ]
Free the skb if usb_submit_urb fails on rx_urb. And free the urb no matter usb_submit_urb succeeds or not in rtl8xxxu_submit_int_urb.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +9 -1
@@ -5453,7 +5453,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) ret =usb_submit_urb (urb,GFP_KERNEL );if (ret) {usb_unanchor_urb (urb); -usb_free_urb (urb); goto error; }
@@ -5462,6 +5461,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)rtl8xxxu_write32 (priv,REG_USB_HIMR , val32); error: +usb_free_urb (urb);return ret; }
@@ -5787,6 +5787,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)struct rtl8xxxu_priv *priv = hw->priv;struct rtl8xxxu_rx_urb *rx_urb;struct rtl8xxxu_tx_urb *tx_urb; +struct sk_buff *skb;unsigned long flags;int ret, i;
@@ -5837,6 +5838,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) rx_urb->hw = hw; ret =rtl8xxxu_submit_rx_urb (priv, rx_urb); +if (ret) { +if (ret != -ENOMEM ) { + skb = (struct sk_buff *)rx_urb->urb.context; +dev_kfree_skb (skb); + } +rtl8xxxu_queue_rx_urb (priv, rx_urb); + } } exit:/*
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 248/264 Fix use after free in get_capset_info callback.
In reply to Greg Kroah-HartmanFrom: Doug Horn <[email protected]>
[ Upstream commit e219688fc5c3d0d9136f8d29d7e0498388f01440 ]
If a response to virtio_gpu_cmd_get_capset_info takes longer than five seconds to return, the callback will access freed kernel memory in vg->capsets.
--- drivers/gpu/drm/virtio/virtgpu_kms.c | 2 ++ drivers/gpu/drm/virtio/virtgpu_vq.c | 10 +++++++--- 2 files changed, 9 insertions(+), 3 deletions(-)
drivers/gpu/drm/virtio/virtgpu_kms.c +2 -0
@@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev, vgdev->capsets[i].id > 0, 5 * HZ);if (ret ==0 ) {DRM_ERROR ("timed out waiting for cap set %d\n" , i); +spin_lock (&vgdev->display_info_lock);kfree (vgdev->capsets); vgdev->capsets =NULL ; +spin_unlock (&vgdev->display_info_lock);return ; } DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n",
drivers/gpu/drm/virtio/virtgpu_vq.c +7 -3
@@ -566,9 +566,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,int i =le32_to_cpu (cmd->capset_index);spin_lock (&vgdev->display_info_lock); - vgdev->capsets[i].id =le32_to_cpu (resp->capset_id); - vgdev->capsets[i].max_version =le32_to_cpu (resp->capset_max_version); - vgdev->capsets[i].max_size =le32_to_cpu (resp->capset_max_size); +if (vgdev->capsets) { + vgdev->capsets[i].id =le32_to_cpu (resp->capset_id); + vgdev->capsets[i].max_version =le32_to_cpu (resp->capset_max_version); + vgdev->capsets[i].max_size =le32_to_cpu (resp->capset_max_size); + }else { +DRM_ERROR ("invalid capset memory." ); + }spin_unlock (&vgdev->display_info_lock);wake_up (&vgdev->resp_wq); }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 249/264 scsi: qedi: Protect active command list to avoid list corruption
In reply to Greg Kroah-HartmanFrom: Nilesh Javali <[email protected]>
[ Upstream commit c0650e28448d606c84f76c34333dba30f61de993 ]
Protect active command list for non-I/O commands like login response, logout response, text response, and recovery cleanup of active list to avoid list corruption.
--- drivers/scsi/qedi/qedi_fw.c | 8 ++++++++ drivers/scsi/qedi/qedi_iscsi.c | 2 ++ 2 files changed, 10 insertions(+)
drivers/scsi/qedi/qedi_fw.c +8 -0
@@ -62,6 +62,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,"Freeing tid=0x%x for cid=0x%x\n" , cmd->task_id, qedi_conn->iscsi_conn_id); +spin_lock (&qedi_conn->list_lock);if (likely (cmd->io_cmd_in_list)) { cmd->io_cmd_in_list = false;list_del_init (&cmd->io_cmd);
@@ -72,6 +73,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi, cmd->task_id, qedi_conn->iscsi_conn_id, &cmd->io_cmd); } +spin_unlock (&qedi_conn->list_lock); cmd->state =RESPONSE_RECEIVED ;qedi_clear_task_idx (qedi, cmd->task_id);
@@ -125,6 +127,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,"Freeing tid=0x%x for cid=0x%x\n" , cmd->task_id, qedi_conn->iscsi_conn_id); +spin_lock (&qedi_conn->list_lock);if (likely (cmd->io_cmd_in_list)) { cmd->io_cmd_in_list = false;list_del_init (&cmd->io_cmd);
@@ -135,6 +138,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi, cmd->task_id, qedi_conn->iscsi_conn_id, &cmd->io_cmd); } +spin_unlock (&qedi_conn->list_lock); cmd->state =RESPONSE_RECEIVED ;qedi_clear_task_idx (qedi, cmd->task_id);
@@ -227,11 +231,13 @@ static void qedi_process_tmf_resp(struct qedi_ctx *qedi, tmf_hdr = (struct iscsi_tm *)qedi_cmd->task->hdr; +spin_lock (&qedi_conn->list_lock);if (likely (qedi_cmd->io_cmd_in_list)) { qedi_cmd->io_cmd_in_list = false;list_del_init (&qedi_cmd->io_cmd); qedi_conn->active_cmd_count--; } +spin_unlock (&qedi_conn->list_lock); if (((tmf_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) == ISCSI_TM_FUNC_LOGICAL_UNIT_RESET) ||
@@ -293,11 +299,13 @@ static void qedi_process_login_resp(struct qedi_ctx *qedi,ISCSI_LOGIN_RESPONSE_HDR_DATA_SEG_LEN_MASK ; qedi_conn->gen_pdu.resp_wr_ptr = qedi_conn->gen_pdu.resp_buf + pld_len; +spin_lock (&qedi_conn->list_lock);if (likely (cmd->io_cmd_in_list)) { cmd->io_cmd_in_list = false;list_del_init (&cmd->io_cmd); qedi_conn->active_cmd_count--; } +spin_unlock (&qedi_conn->list_lock);memset (task_ctx,'\0' ,sizeof (*task_ctx));
drivers/scsi/qedi/qedi_iscsi.c +2 -0
@@ -976,11 +976,13 @@ static void qedi_cleanup_active_cmd_list(struct qedi_conn *qedi_conn) {struct qedi_cmd *cmd, *cmd_tmp; +spin_lock (&qedi_conn->list_lock);list_for_each_entry_safe (cmd, cmd_tmp, &qedi_conn->active_cmd_list, io_cmd) {list_del_init (&cmd->io_cmd); qedi_conn->active_cmd_count--; } +spin_unlock (&qedi_conn->list_lock); }static void qedi_ep_disconnect (struct iscsi_endpoint *ep)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 250/264 scsi: qedi: Fix list_del corruption while removing active I/O
In reply to Greg Kroah-HartmanFrom: Nilesh Javali <[email protected]>
[ Upstream commit 28b35d17f9f8573d4646dd8df08917a4076a6b63 ]
While aborting the I/O, the firmware cleanup task timed out and driver deleted the I/O from active command list. Some time later the firmware sent the cleanup task response and driver again deleted the I/O from active command list causing firmware to send completion for non-existent I/O and list_del corruption of active command list.
Add fix to check if I/O is present before deleting it from the active command list to ensure firmware sends valid I/O completion and protect against list_del corruption.
--- drivers/scsi/qedi/qedi_fw.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/scsi/qedi/qedi_fw.c +11 -4
@@ -837,8 +837,11 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,qedi_clear_task_idx (qedi_conn->qedi, rtid);spin_lock (&qedi_conn->list_lock); -list_del_init (&dbg_cmd->io_cmd); - qedi_conn->active_cmd_count--; +if (likely (dbg_cmd->io_cmd_in_list)) { + dbg_cmd->io_cmd_in_list = false; +list_del_init (&dbg_cmd->io_cmd); + qedi_conn->active_cmd_count--; + }spin_unlock (&qedi_conn->list_lock); qedi_cmd->state =CLEANUP_RECV ;wake_up_interruptible (&qedi_conn->wait_queue);
@@ -1257,6 +1260,7 @@ int qedi_cleanup_all_io(struct qedi_ctx *qedi, struct qedi_conn *qedi_conn, qedi_conn->cmd_cleanup_req++;qedi_iscsi_cleanup_task (ctask, true); + cmd->io_cmd_in_list = false;list_del_init (&cmd->io_cmd); qedi_conn->active_cmd_count--; QEDI_WARN(&qedi->dbg_ctx,
@@ -1470,8 +1474,11 @@ static void qedi_tmf_work(struct work_struct *work)spin_unlock_bh (&qedi_conn->tmf_work_lock);spin_lock (&qedi_conn->list_lock); -list_del_init (&cmd->io_cmd); - qedi_conn->active_cmd_count--; +if (likely (cmd->io_cmd_in_list)) { + cmd->io_cmd_in_list = false; +list_del_init (&cmd->io_cmd); + qedi_conn->active_cmd_count--; + }spin_unlock (&qedi_conn->list_lock);clear_bit (QEDI_CONN_FW_CLEANUP , &qedi_conn->flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 251/264 tty: ipwireless: fix error handling
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit db332356222d9429731ab9395c89cca403828460 ]
ipwireless_send_packet() can only return 0 on success and -ENOMEM on error, the caller should check non zero for error condition
--- drivers/tty/ipwireless/network.c | 4 ++-- drivers/tty/ipwireless/tty.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/tty/ipwireless/network.c +2 -2
@@ -117,7 +117,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, skb->len, notify_packet_sent, network); -if (ret ==-1 ) { +if (ret <0 ) {skb_pull (skb,2 );return 0 ; }
@@ -134,7 +134,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, notify_packet_sent, network);kfree (buf); -if (ret ==-1 ) +if (ret <0 )return 0 ; }kfree_skb (skb);
drivers/tty/ipwireless/tty.c +1 -1
@@ -218,7 +218,7 @@ static int ipw_write(struct tty_struct *linux_tty, ret =ipwireless_send_packet (tty->hardware,IPW_CHANNEL_RAS , buf, count, ipw_write_packet_sent_callback, tty); -if (ret ==-1 ) { +if (ret <0 ) {mutex_unlock (&tty->ipw_tty_mutex);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 252/264 ipvs: Fix uninit-value in do_ip_vs_set_ctl()
In reply to Greg Kroah-HartmanFrom: Peilin Ye <[email protected]>
[ Upstream commit c5a8a8498eed1c164afc94f50a939c1a10abf8ad ]
do_ip_vs_set_ctl() is referencing uninitialized stack value when len is zero. Fix it.
--- net/netfilter/ipvs/ip_vs_ctl.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/netfilter/ipvs/ip_vs_ctl.c +4 -3
@@ -2393,6 +2393,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)/* Set timeout values for (tcp tcpfin udp) */ ret =ip_vs_set_timeout (ipvs, (struct ip_vs_timeout_user *)arg); goto out_unlock; + }else if (!len) { +/* No more commands with len == 0 below */ + ret = -EINVAL ; + goto out_unlock; } usvc_compat = (struct ip_vs_service_user *)arg;
@@ -2469,9 +2473,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)break ;case IP_VS_SO_SET_DELDEST : ret =ip_vs_del_dest (svc, &udest); -break ; -default : - ret = -EINVAL ; } out_unlock:
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 253/264 reiserfs: Fix memory leak in reiserfs_parse_options()
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ]
When a usrjquota or grpjquota mount option is used multiple times, we will leak memory allocated for the file name. Make sure the last setting is used and all the previous ones are properly freed.
--- fs/reiserfs/super.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/reiserfs/super.c +4 -4
@@ -1264,6 +1264,10 @@ static int reiserfs_parse_options(struct super_block *s, "turned on.");return 0 ; } +if (qf_names[qtype] != +REISERFS_SB (s)->s_qf_names[qtype]) +kfree (qf_names[qtype]); + qf_names[qtype] =NULL ; if (*arg) { /* Some filename specified? */ if (REISERFS_SB(s)->s_qf_names[qtype] && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
@@ -1293,10 +1297,6 @@ static int reiserfs_parse_options(struct super_block *s,else *mount_options |=1 <<REISERFS_GRPQUOTA ; }else { -if (qf_names[qtype] != -REISERFS_SB (s)->s_qf_names[qtype]) -kfree (qf_names[qtype]); - qf_names[qtype] =NULL ;if (qtype ==USRQUOTA ) *mount_options &= ~(1 <<REISERFS_USRQUOTA );else
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 254/264 mwifiex: dont call del_timer_sync() on uninitialized timer
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit 621a3a8b1c0ecf16e1e5667ea5756a76a082b738 ]
syzbot is reporting that del_timer_sync() is called from mwifiex_usb_cleanup_tx_aggr() from mwifiex_unregister_dev() without checking timer_setup() from mwifiex_usb_tx_init() was called [1].
Ganapathi Bhat proposed a possibly cleaner fix, but it seems that that fix was forgotten [2].
"grep -FrB1 'del_timer' drivers/ | grep -FA1 '.function)'" says that currently there are 28 locations which call del_timer[_sync]() only if that timer's function field was initialized (because timer_setup() sets that timer's function field). Therefore, let's use same approach here.
[1] https://syzkaller.appspot.com/bug?id=26525f643f454dd7be0078423e3cdb0d57744959
[2] https://lkml.kernel.org/r/CA+ASDXMHt2gq9Hy+iP_BYkWXsSreWdp3_bAfMkNcuqJ3K+-jbQ@mail.gmail.com
--- drivers/net/wireless/marvell/mwifiex/usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/marvell/mwifiex/usb.c +2 -1
@@ -1355,7 +1355,8 @@ static void mwifiex_usb_cleanup_tx_aggr(struct mwifiex_adapter *adapter) skb_dequeue(&port->tx_aggr.aggr_list)))mwifiex_write_data_complete (adapter, skb_tmp,0 ,-1 ); -del_timer_sync (&port->tx_aggr.timer_cnxt.hold_timer); +if (port->tx_aggr.timer_cnxt.hold_timer.function) +del_timer_sync (&port->tx_aggr.timer_cnxt.hold_timer); port->tx_aggr.timer_cnxt.is_hold_timer_set = false; port->tx_aggr.timer_cnxt.hold_tmo_msecs =0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 255/264 brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach
In reply to Greg Kroah-HartmanFrom: Wang Yufen <[email protected]>
[ Upstream commit 6c151410d5b57e6bb0d91a735ac511459539a7bf ]
When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL, we should destroy the workqueue.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +2 -0
@@ -1563,6 +1563,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)BRCMF_TX_IOCTL_MAX_MSG_SIZE , msgbuf->ioctbuf, msgbuf->ioctbuf_handle); +if (msgbuf->txflow_wq) +destroy_workqueue (msgbuf->txflow_wq);kfree (msgbuf); }return -ENOMEM ;
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 256/264 usb: core: Solve race condition in anchor cleanup functions
In reply to Greg Kroah-HartmanFrom: Eli Billauer <[email protected]>
[ Upstream commit fbc299437c06648afcc7891e6e2e6638dd48d4df ]
usb_kill_anchored_urbs() is commonly used to cancel all URBs on an anchor just before releasing resources which the URBs rely on. By doing so, users of this function rely on that no completer callbacks will take place from any URB on the anchor after it returns.
However if this function is called in parallel with __usb_hcd_giveback_urb processing a URB on the anchor, the latter may call the completer callback after usb_kill_anchored_urbs() returns. This can lead to a kernel panic due to use after release of memory in interrupt context.
The race condition is that __usb_hcd_giveback_urb() first unanchors the URB and then makes the completer callback. Such URB is hence invisible to usb_kill_anchored_urbs(), allowing it to return before the completer has been called, since the anchor's urb_list is empty.
Even worse, if the racing completer callback resubmits the URB, it may remain in the system long after usb_kill_anchored_urbs() returns.
Hence list_empty(&anchor->urb_list), which is used in the existing while-loop, doesn't reliably ensure that all URBs of the anchor are gone.
A similar problem exists with usb_poison_anchored_urbs() and usb_scuttle_anchored_urbs().
This patch adds an external do-while loop, which ensures that all URBs are indeed handled before these three functions return. This change has no effect at all unless the race condition occurs, in which case the loop will busy-wait until the racing completer callback has finished. This is a rare condition, so the CPU waste of this spinning is negligible.
The additional do-while loop relies on usb_anchor_check_wakeup(), which returns true iff the anchor list is empty, and there is no __usb_hcd_giveback_urb() in the system that is in the middle of the unanchor-before-complete phase. The @suspend_wakeups member of struct usb_anchor is used for this purpose, which was introduced to solve another problem which the same race condition causes, in commit 6ec4147e7bdb ("usb-anchor: Delay usb_wait_anchor_empty_timeout wake up till completion is done").
The surely_empty variable is necessary, because usb_anchor_check_wakeup() must be called with the lock held to prevent races. However the spinlock must be released and reacquired if the outer loop spins with an empty URB list while waiting for the unanchor-before-complete passage to finish:
The completer callback may very well attempt to take the very same lock.
To summarize, using usb_anchor_check_wakeup() means that the patched functions can return only when the anchor's list is empty, and there is no invisible URB being processed. Since the inner while loop finishes on the empty list condition, the new do-while loop will terminate as well, except for when the said race condition occurs.
--- drivers/usb/core/urb.c | 89 +++++++++++++++++++++++++----------------- 1 file changed, 54 insertions(+), 35 deletions(-)
drivers/usb/core/urb.c +54 -35
@@ -773,11 +773,12 @@ void usb_block_urb(struct urb *urb)EXPORT_SYMBOL_GPL (usb_block_urb);/** -* usb_kill_anchored_urbs - cancel transfer requests en masse +* usb_kill_anchored_urbs - kill all URBs associated with an anchor * @anchor: anchor the requests are bound to * -* this allows all outstanding URBs to be killed starting -* from the back of the queue +* This kills all outstanding URBs starting from the back of the queue, +* with guarantee that no completer callbacks will take place from the +* anchor after this function returns. * * This routine should not be called by a driver after its disconnect * method has returned.
@@ -785,20 +786,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb);void usb_kill_anchored_urbs (struct usb_anchor *anchor) {struct urb *victim; +int surely_empty; -spin_lock_irq (&anchor->lock); -while (!list_empty (&anchor->urb_list)) { - victim = list_entry(anchor->urb_list.prev, struct urb, - anchor_list); -/* we must make sure the URB isn't freed before we kill it*/ -usb_get_urb (victim); -spin_unlock_irq (&anchor->lock); -/* this will unanchor the URB */ -usb_kill_urb (victim); -usb_put_urb (victim); +do {spin_lock_irq (&anchor->lock); - } -spin_unlock_irq (&anchor->lock); +while (!list_empty (&anchor->urb_list)) { + victim =list_entry (anchor->urb_list.prev, + struct urb, anchor_list); +/* make sure the URB isn't freed before we kill it */ +usb_get_urb (victim); +spin_unlock_irq (&anchor->lock); +/* this will unanchor the URB */ +usb_kill_urb (victim); +usb_put_urb (victim); +spin_lock_irq (&anchor->lock); + } + surely_empty =usb_anchor_check_wakeup (anchor); + +spin_unlock_irq (&anchor->lock); +cpu_relax (); + }while (!surely_empty); }EXPORT_SYMBOL_GPL (usb_kill_anchored_urbs);
@@ -817,21 +824,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);void usb_poison_anchored_urbs (struct usb_anchor *anchor) {struct urb *victim; +int surely_empty; -spin_lock_irq (&anchor->lock); - anchor->poisoned =1 ; -while (!list_empty (&anchor->urb_list)) { - victim = list_entry(anchor->urb_list.prev, struct urb, - anchor_list); -/* we must make sure the URB isn't freed before we kill it*/ -usb_get_urb (victim); -spin_unlock_irq (&anchor->lock); -/* this will unanchor the URB */ -usb_poison_urb (victim); -usb_put_urb (victim); +do {spin_lock_irq (&anchor->lock); - } -spin_unlock_irq (&anchor->lock); + anchor->poisoned =1 ; +while (!list_empty (&anchor->urb_list)) { + victim =list_entry (anchor->urb_list.prev, + struct urb, anchor_list); +/* make sure the URB isn't freed before we kill it */ +usb_get_urb (victim); +spin_unlock_irq (&anchor->lock); +/* this will unanchor the URB */ +usb_poison_urb (victim); +usb_put_urb (victim); +spin_lock_irq (&anchor->lock); + } + surely_empty =usb_anchor_check_wakeup (anchor); + +spin_unlock_irq (&anchor->lock); +cpu_relax (); + }while (!surely_empty); }EXPORT_SYMBOL_GPL (usb_poison_anchored_urbs);
@@ -971,14 +984,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor) {struct urb *victim;unsigned long flags; +int surely_empty; + +do { +spin_lock_irqsave (&anchor->lock, flags); +while (!list_empty (&anchor->urb_list)) { + victim =list_entry (anchor->urb_list.prev, + struct urb, anchor_list); +__usb_unanchor_urb (victim, anchor); + } + surely_empty =usb_anchor_check_wakeup (anchor); -spin_lock_irqsave (&anchor->lock, flags); -while (!list_empty (&anchor->urb_list)) { - victim = list_entry(anchor->urb_list.prev, struct urb, - anchor_list); -__usb_unanchor_urb (victim, anchor); - } -spin_unlock_irqrestore (&anchor->lock, flags); +spin_unlock_irqrestore (&anchor->lock, flags); +cpu_relax (); + }while (!surely_empty); }EXPORT_SYMBOL_GPL (usb_scuttle_anchored_urbs);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 257/264 scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config()
In reply to Greg Kroah-HartmanFrom: Can Guo <[email protected]>
[ Upstream commit 89dd87acd40a44de8ff3358138aedf8f73f4efc6 ]
If ufs_qcom_dump_dbg_regs() calls ufs_qcom_testbus_config() from ufshcd_suspend/resume and/or clk gate/ungate context, pm_runtime_get_sync() and ufshcd_hold() will cause a race condition. Fix this by removing the unnecessary calls of pm_runtime_get_sync() and ufshcd_hold().
--- drivers/scsi/ufs/ufs-qcom.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/scsi/ufs/ufs-qcom.c +0 -5
@@ -1581,9 +1581,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host)*/ } mask <<= offset; - -pm_runtime_get_sync (host->hba->dev); -ufshcd_hold (host->hba, false);ufshcd_rmwl (host->hba,TEST_BUS_SEL , (u32 )host->testbus.select_major <<19 ,REG_UFS_CFG1 );
@@ -1596,8 +1593,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host)* committed before returning. */ mb (); -ufshcd_release (host->hba); -pm_runtime_put_sync (host->hba->dev);return 0 ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 258/264 ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()
In reply to Greg Kroah-HartmanFrom: Zekun Shen <[email protected]>
[ Upstream commit bad60b8d1a7194df38fd7fe4b22f3f4dcf775099 ]
The idx in __ath10k_htt_rx_ring_fill_n function lives in consistent dma region writable by the device. Malfunctional or malicious device could manipulate such idx to have a OOB write. Either by
htt->rx_ring.netbufs_ring[idx] = skb;
or by
ath10k_htt_set_paddrs_ring(htt, paddr, idx);The idx can also be negative as it's signed, giving a large memory space to write to.
It's possibly exploitable by corruptting a legit pointer with a skb pointer. And then fill skb with payload as rougue object.
Part of the log here. Sometimes it appears as UAF when writing to a freed memory by chance.
[ 15.594376] BUG: unable to handle page fault for address: ffff887f5c1804f0 [ 15.595483] #PF: supervisor write access in kernel mode [ 15.596250] #PF: error_code(0x0002) - not-present page [ 15.597013] PGD 0 P4D 0 [ 15.597395] Oops: 0002 [#1] SMP KASAN PTI [ 15.597967] CPU: 0 PID: 82 Comm: kworker/u2:2 Not tainted 5.6.0 #69 [ 15.598843] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 15.600438] Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core] [ 15.601389] RIP: 0010:__ath10k_htt_rx_ring_fill_n (linux/drivers/net/wireless/ath/ath10k/htt_rx.c:173) ath10k_core
--- drivers/net/wireless/ath/ath10k/htt_rx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/ath/ath10k/htt_rx.c +8 -0
@@ -153,6 +153,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)BUILD_BUG_ON (HTT_RX_RING_FILL_LEVEL >=HTT_RX_RING_SIZE /2 ); idx =__le32_to_cpu (*htt->rx_ring.alloc_idx.vaddr); + +if (idx <0 || idx >= htt->rx_ring.size) { +ath10k_err (htt->ar,"rx ring index is not valid, firmware malfunctioning?\n" ); + idx &= htt->rx_ring.size_mask; + ret = -ENOMEM ; + goto fail; + } +while (num >0 ) { skb =dev_alloc_skb (HTT_RX_BUF_SIZE +HTT_RX_DESC_ALIGN );if (!skb) {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 259/264 net: korina: cast KSEG0 address to pointer in kfree
In reply to Greg Kroah-HartmanFrom: Valentin Vidic <[email protected]>
[ Upstream commit 3bd57b90554b4bb82dce638e0668ef9dc95d3e96 ]
Fixes gcc warning:
passing argument 1 of 'kfree' makes pointer from integer without a cast
--- drivers/net/ethernet/korina.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/korina.c +2 -2
@@ -1113,7 +1113,7 @@ static int korina_probe(struct platform_device *pdev)return rc; probe_err_register: -kfree (KSEG0ADDR (lp->td_ring)); +kfree ((struct dma_desc *)KSEG0ADDR (lp->td_ring)); probe_err_td_ring:iounmap (lp->tx_dma_regs); probe_err_dma_tx:
@@ -1133,7 +1133,7 @@ static int korina_remove(struct platform_device *pdev)iounmap (lp->eth_regs);iounmap (lp->rx_dma_regs);iounmap (lp->tx_dma_regs); -kfree (KSEG0ADDR (lp->td_ring)); +kfree ((struct dma_desc *)KSEG0ADDR (lp->td_ring));unregister_netdev (bif->dev);free_netdev (bif->dev);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 260/264 tty: serial: fsl_lpuart: fix lpuart32_poll_get_char
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
commit 29788ab1d2bf26c130de8f44f9553ee78a27e8d5 upstream.
The watermark is set to 1, so we need to input two chars to trigger RDRF using the original logic. With the new logic, we could always get the char when there is data in FIFO.
--- drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -563,7 +563,7 @@ static void lpuart32_poll_put_char(strucstatic int lpuart32_poll_get_char (struct uart_port *port) { -if (!(lpuart32_read (port,UARTSTAT ) &UARTSTAT_RDRF )) +if (!(lpuart32_read (port,UARTWATER ) >>UARTWATER_RXCNT_OFF ))return NO_POLL_CHAR ;return lpuart32_read (port,UARTDATA );
Greg Kroah-Hartman
maintainerPATCH 261/264 usb: cdc-acm: add quirk to blacklist ETAS ES58X devices
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
commit a4f88430af896bf34ec25a7a5f0e053fb3d928e0 upstream.
The ES58X devices has a CDC ACM interface (used for debug
purpose). During probing, the device is thus recognized as USB Modem (CDC ACM), preventing the etas-es58x module to load:
usbcore: registered new interface driver etas_es58x
usb 1-1.1: new full-speed USB device number 14 using xhci_hcd
usb 1-1.1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 1.00 usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1.1: Product: ES581.4
usb 1-1.1: Manufacturer: ETAS GmbH
usb 1-1.1: SerialNumber: 2204355
cdc_acm 1-1.1:1.0: No union descriptor, testing for castrated device cdc_acm 1-1.1:1.0: ttyACM0: USB ACM device
Thus, these have been added to the ignore list indrivers/usb/class/cdc-acm.c
N.B. Future firmware release of the ES58X will remove the CDC-ACM interface.
lsusb -v of the three devices variant (ES581.4, ES582.1 and ES584.1):
Bus 001 Device 011: ID 108c:0159 Robert Bosch GmbH ES581.4 Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 2 Communications
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x108c Robert Bosch GmbH
idProduct 0x0159
bcdDevice 1.00
iManufacturer 1 ETAS GmbH
iProduct 2 ES581.4
iSerial 3 2204355
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0035
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 5 Bus Powered Configuration
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 0
iInterface 4 ACM Control Interface
CDC Header:
bcdCDC 1.10
CDC Call Management:
bmCapabilities 0x01
call management
bDataInterface 0
CDC ACM:
bmCapabilities 0x06
sends break
line coding and serial state
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0010 1x 16 bytes
bInterval 10
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Device Status: 0x0000
(Bus Powered)
Bus 001 Device 012: ID 108c:0168 Robert Bosch GmbH ES582 Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 2 Communications
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x108c Robert Bosch GmbH
idProduct 0x0168
bcdDevice 1.00
iManufacturer 1 ETAS GmbH
iProduct 2 ES582
iSerial 3 0108933
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0043
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 1 AT-commands (v.25ter)
iInterface 0
CDC Header:
bcdCDC 1.10
CDC ACM:
bmCapabilities 0x02
line coding and serial state
CDC Union:
bMasterInterface 0
bSlaveInterface 1
CDC Call Management:
bmCapabilities 0x03
call management
use DataInterface
bDataInterface 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 2 Communications
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)
Bus 001 Device 013: ID 108c:0169 Robert Bosch GmbH ES584.1 Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 2 Communications
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x108c Robert Bosch GmbH
idProduct 0x0169
bcdDevice 1.00
iManufacturer 1 ETAS GmbH
iProduct 2 ES584.1
iSerial 3 0100320
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0043
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 1 AT-commands (v.25ter)
iInterface 0
CDC Header:
bcdCDC 1.10
CDC ACM:
bmCapabilities 0x02
line coding and serial state
CDC Union:
bMasterInterface 0
bSlaveInterface 1
CDC Call Management:
bmCapabilities 0x03
call management
use DataInterface
bDataInterface 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 2 Communications
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)
--- drivers/usb/class/cdc-acm.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/class/cdc-acm.c +11 -0
@@ -1944,6 +1944,17 @@ static const struct usb_device_id acm_id .driver_info = IGNORE_DEVICE, }, +/* Exclude ETAS ES58x */ + { USB_DEVICE(0x108c, 0x0159), /* ES581.4 */ + .driver_info =IGNORE_DEVICE , + }, + { USB_DEVICE(0x108c, 0x0168), /* ES582.1 */ + .driver_info = IGNORE_DEVICE, + }, + { USB_DEVICE(0x108c, 0x0169), /* ES584.1 */ + .driver_info = IGNORE_DEVICE, + }, + { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ .driver_info = SEND_ZERO_PACKET, },
Greg Kroah-Hartman
maintainerPATCH 262/264 USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 37d2a36394d954413a495da61da1b2a51ecd28ab upstream.
syzbot is reporting hung task at wdm_flush() [1], for there is a circular dependency that wdm_flush() from flip_close() for /dev/cdc-wdm0 forever waits for /dev/raw-gadget to be closed while close() for /dev/raw-gadget cannot be called unless close() for /dev/cdc-wdm0 completes.
Tetsuo Handa considered that such circular dependency is an usage error [2] which corresponds to an unresponding broken hardware [3]. But Alan Stern responded that we should be prepared for such hardware [4]. Therefore, this patch changes wdm_flush() to use wait_event_interruptible_timeout() which gives up after 30 seconds, for hardware that remains silent must be ignored. The 30 seconds are coming out of thin air.
Changing wait_event() to wait_event_interruptible_timeout() makes error reporting from close() syscall less reliable. To compensate it, this patch also implements wdm_fsync() which does not use timeout. Those who want to be very sure that data has gone out to the device are now advised to call fsync(), with a caveat that fsync() can return -EINVAL when running on older kernels which do not implement wdm_fsync().
This patch also fixes three more problems (listed below) found during exhaustive discussion and testing.
Since multiple threads can concurrently call wdm_write()/wdm_flush(), we need to use wake_up_all() whenever clearing WDM_IN_USE in order to make sure that all waiters are woken up. Also, error reporting needs to use fetch-and-clear approach in order not to report same error for multiple times.
Since wdm_flush() checks WDM_DISCONNECTING, wdm_write() should as well check WDM_DISCONNECTING.
In wdm_flush(), since locks are not held, it is not safe to dereference desc->intf after checking that WDM_DISCONNECTING is not set [5]. Thus, remove dev_err() from wdm_flush().
[1] https://syzkaller.appspot.com/bug?id=e7b761593b23eb50855b9ea31e3be5472b711186
[2] https://lkml.kernel.org/r/[email protected]
[3] https://lkml.kernel.org/r/[email protected]
[4] https://lkml.kernel.org/r/[email protected]
[5] https://lkml.kernel.org/r/[email protected]
--- drivers/usb/class/cdc-wdm.c | 70 +++++++++++++++++++++++++++++++++----------- 1 file changed, 54 insertions(+), 16 deletions(-)
drivers/usb/class/cdc-wdm.c +54 -16
@@ -58,6 +58,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);#define WDM_MAX 16 +/* we cannot wait forever at flush() */ +#define WDM_FLUSH_TIMEOUT (30 * HZ) +/* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */ #define WDM_DEFAULT_BUFSIZE 256
@@ -151,7 +154,7 @@ static void wdm_out_callback(struct urbkfree (desc->outbuf); desc->outbuf =NULL ;clear_bit (WDM_IN_USE , &desc->flags); -wake_up (&desc->wait); +wake_up_all (&desc->wait); }static void wdm_in_callback (struct urb *urb)
@@ -393,6 +396,9 @@ static ssize_t wdm_writeif (test_bit (WDM_RESETTING , &desc->flags)) r = -EIO ; +if (test_bit (WDM_DISCONNECTING , &desc->flags)) + r = -ENODEV ; +if (r <0 ) { rv = r; goto out_free_mem_pm;
@@ -424,6 +430,7 @@ static ssize_t wdm_writeif (rv <0 ) { desc->outbuf =NULL ;clear_bit (WDM_IN_USE , &desc->flags); +wake_up_all (&desc->wait);/* for wdm_wait_for_response() */ dev_err (&desc->intf->dev,"Tx URB error: %d\n" , rv); rv =usb_translate_errors (rv); goto out_free_mem_pm;
@@ -583,28 +590,58 @@ err:return rv; } -static int wdm_flush (struct file *file,fl_owner_t id) +static int wdm_wait_for_response (struct file *file,long timeout) {struct wdm_device *desc = file->private_data; +long rv;/* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */ -wait_event (desc->wait, -/* -* needs both flags. We cannot do with one -* because resetting it would cause a race -* with write() yet we need to signal -* a disconnect -*/ - !test_bit (WDM_IN_USE , &desc->flags) || -test_bit (WDM_DISCONNECTING , &desc->flags)); +/* +* Needs both flags. We cannot do with one because resetting it would +* cause a race with write() yet we need to signal a disconnect. +*/ + rv =wait_event_interruptible_timeout (desc->wait, + !test_bit (WDM_IN_USE , &desc->flags) || +test_bit (WDM_DISCONNECTING , &desc->flags), + timeout); -/* cannot dereference desc->intf if WDM_DISCONNECTING */ +/* +* To report the correct error. This is best effort. +* We are inevitably racing with the hardware. +*/ if (test_bit (WDM_DISCONNECTING , &desc->flags))return -ENODEV ; -if (desc->werr <0 ) -dev_err (&desc->intf->dev,"Error in flush path: %d\n" , - desc->werr); +if (!rv) +return -EIO ; +if (rv <0 ) +return -EINTR ; + +spin_lock_irq (&desc->iuspin); + rv = desc->werr; + desc->werr =0 ; +spin_unlock_irq (&desc->iuspin); -return usb_translate_errors (desc->werr); +return usb_translate_errors (rv); + +} + +/* +* You need to send a signal when you react to malicious or defective hardware. +* Also, don't abort when fsync() returned -EINVAL, for older kernels which do +* not implement wdm_flush() will return -EINVAL. +*/ +static int wdm_fsync (struct file *file,loff_t start,loff_t end,int datasync) +{ +return wdm_wait_for_response (file,MAX_SCHEDULE_TIMEOUT ); +} + +/* +* Same with wdm_fsync(), except it uses finite timeout in order to react to +* malicious or defective hardware which ceased communication after close() was +* implicitly called due to process termination. +*/ +static int wdm_flush (struct file *file,fl_owner_t id) +{ +return wdm_wait_for_response (file,WDM_FLUSH_TIMEOUT ); }static __poll_t wdm_poll (struct file *file,struct poll_table_struct *wait)
@@ -729,6 +766,7 @@ static const struct file_operations wdm_ .owner = THIS_MODULE, .read = wdm_read, .write = wdm_write, + .fsync = wdm_fsync, .open = wdm_open, .flush = wdm_flush, .release = wdm_release,
Greg Kroah-Hartman
maintainerPATCH 263/264 eeprom: at25: set minimum read/write access stride to 1
In reply to Greg Kroah-HartmanFrom: Christian Eggers <[email protected]>
commit 284f52ac1c6cfa1b2e5c11b84653dd90e4e91de7 upstream.
SPI eeproms are addressed by byte.
--- drivers/misc/eeprom/at25.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/eeprom/at25.c +1 -1
@@ -362,7 +362,7 @@ static int at25_probe(struct spi_device at25->nvmem_config.reg_read = at25_ee_read; at25->nvmem_config.reg_write = at25_ee_write; at25->nvmem_config.priv = at25; - at25->nvmem_config.stride =4 ; + at25->nvmem_config.stride =1 ; at25->nvmem_config.word_size =1 ; at25->nvmem_config.size = chip.byte_len;
Greg Kroah-Hartman
maintainerPATCH 264/264 usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
In reply to Greg Kroah-HartmanFrom: Lorenzo Colitti <[email protected]>
[ Upstream commit 7974ecd7d3c0f42a98566f281e44ea8573a2ad88 ]
Currently, enabling f_ncm at SuperSpeed Plus speeds results in an oops in config_ep_by_speed because ncm_set_alt passes in NULL ssp_descriptors. Fix this by re-using the SuperSpeed descriptors. This is safe because usb_assign_descriptors calls usb_copy_descriptors.
Tested: enabled f_ncm on a dwc3 gadget and 10Gbps link, ran iperf
--- drivers/usb/gadget/function/f_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +1 -1
@@ -1523,7 +1523,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) fs_ncm_notify_desc.bEndpointAddress; status =usb_assign_descriptors (f, ncm_fs_function, ncm_hs_function, - ncm_ss_function,NULL ); + ncm_ss_function, ncm_ss_function);if (status) goto fail;
Signature · 1 line
2.25.1
A message that is not in the archive (sent off-list or not yet received): [email protected]
Retry.
Quoted 27 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0perf failures are as usual. powerpc:
arch/powerpc/kernel/tau_6xx.c: In function 'TAU_init':include/linux/workqueue.h:427:24: error: too many arguments for formatTested-by Guenter Roeck <[email protected]>Guenter
Sasha Levin
maintainerQuoted 26 lines · Guenter Roeck
Retry.
Quoted 23 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0perf failures are as usual. powerpc:
arch/powerpc/kernel/tau_6xx.c: In function 'TAU_init':include/linux/workqueue.h:427:24: error: too many arguments for format
Right, we don't have 69de8bda87b ("kernel/workqueue: Use dynamic lockdep keys for workqueues") on 4.19. I've fixed up the patch, thanks!
Signature · 2 lines
Thanks, Sasha
Hi Greg,
Quoted 23 lines · Guenter Roeck
Retry.
Quoted 20 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert b801d568c7d8 ("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?
Regards,
Salvatore
Greg Kroah-Hartman
maintainerQuoted 25 lines · Salvatore Bonaccorso
Hi Greg,
Quoted 22 lines · Guenter Roeck
Retry.
Quoted 19 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0
Quoted 5 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?
No bugfix that I know of :)
If you can send a patch that I can apply to resolve this, I'll gladly take it.
thanks,
greg k-h
Quoted 25 lines · Salvatore Bonaccorso
Hi Greg,
Quoted 22 lines · Guenter Roeck
Retry.
Quoted 19 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0
Quoted 6 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?
The problem is:
In file included from util/evlist.h:15:0,
from util/evsel.c:30:
util/evsel.c: In function ‘perf_evsel__exit’:util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type /usr/include/stdlib.h:563:13: note: expected ‘void *’ but argument is of type ‘const char *’
extern void free (void *__ptr) __THROW;
This is seen with older versions of gcc (6.5.0 in my case). I have no idea why newer versions of gcc/glibc accept this (afaics free() still expects a char *, not a const char *). The underlying problem is that pmu_name should not be declared const char *, but char *, since it is allocated. The upstream version of perf no longer uses the same definition of zfree(). It was changed from
#define zfree(ptr) ({ free(*ptr); *ptr = NULL; })
to
#define zfree(ptr) __zfree((void **)(ptr))which does the necessary typecast. The fix would be to either change the definition of zfree to add the typecast, or to change the definition of pmu_name to drop the const. Both would only apply to v4.19.y. I don't know if either would be acceptable.
Either case, reverting b801d568c7d8 won't solve that problem.
Guenter
Hi!
Quoted 21 lines
Quoted 6 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?The problem is:
In file included from
util/evlist.h:15:0,from util/evsel.c:30:
util/evsel.c: In function ‘perf_evsel__exit’:util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type/usr/include/stdlib.h:563:13: note: expected ‘void *’ but argument is of type ‘const char *’
extern void free (void*__ptr)__THROW;This is seen with older versions of gcc (6.5.0 in my case). I have no idea why newer versions of gcc/glibc accept this (afaics
free()still expects a char *, not a const char *). The underlying problem is thatpmu_nameshould not be declared const char *, but char *, since it is allocated. The upstream version of perf no longer uses the same definition ofzfree(). It was changed from
Quoted 6 lines
#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) to #define zfree(ptr) __zfree((void **)(ptr))which does the necessary typecast. The fix would be to either change the definition of zfree to add the typecast, or to change the definition of
pmu_nameto drop the const. Both would only apply to v4.19.y. I don't know if either would be acceptable.
As the problem is already fixed in the mainline, either solution should be acceptable for -stable.
Probably the one adjusting the zfree() is more suitable, as that is the way it was solved in the mainline.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerQuoted 30 lines · Pavel Machek
Hi!
Quoted 21 lines
Quoted 6 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?The problem is:
In file included from
util/evlist.h:15:0,from util/evsel.c:30:
util/evsel.c: In function ‘perf_evsel__exit’:util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type/usr/include/stdlib.h:563:13: note: expected ‘void *’ but argument is of type ‘const char *’
extern void free (void*__ptr)__THROW;This is seen with older versions of gcc (6.5.0 in my case). I have no idea why newer versions of gcc/glibc accept this (afaics
free()still expects a char *, not a const char *). The underlying problem is thatpmu_nameshould not be declared const char *, but char *, since it is allocated. The upstream version of perf no longer uses the same definition ofzfree(). It was changed fromQuoted 6 lines
#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) to #define zfree(ptr) __zfree((void **)(ptr))which does the necessary typecast. The fix would be to either change the definition of zfree to add the typecast, or to change the definition of
pmu_nameto drop the const. Both would only apply to v4.19.y. I don't know if either would be acceptable.
Quoted 5 lines
As the problem is already fixed in the mainline, either solution should be acceptable for -stable.
Probably the one adjusting the
zfree()is more suitable, as that is the way it was solved in the mainline.
If you can provide the proper patches backported to 4.19, I will gladly take them. I tried to figure it out and couldn't, so good luck!
greg k-h
Hi Guenter,
Quoted 47 lines · Guenter Roeck
Quoted 25 lines · Salvatore Bonaccorso
Hi Greg,
Quoted 22 lines · Guenter Roeck
Retry.
Quoted 19 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0Quoted 6 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?The problem is:
In file included from
util/evlist.h:15:0,from util/evsel.c:30:
util/evsel.c: In function ‘perf_evsel__exit’:util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type/usr/include/stdlib.h:563:13: note: expected ‘void *’ but argument is of type ‘const char *’
extern void free (void*__ptr)__THROW;This is seen with older versions of gcc (6.5.0 in my case). I have no idea why newer versions of gcc/glibc accept this (afaics
free()still expects a char *, not a const char *). The underlying problem is thatpmu_nameshould not be declared const char *, but char *, since it is allocated. The upstream version of perf no longer uses the same definition ofzfree(). It was changed from
Quoted 8 lines
#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) to #define zfree(ptr) __zfree((void **)(ptr))which does the necessary typecast. The fix would be to either change the definition of zfree to add the typecast, or to change the definition of
pmu_nameto drop the const. Both would only apply to v4.19.y. I don't know if either would be acceptable.Either case, reverting
b801d568c7d8won't solve that problem.
Are we talking about the same problem though? With v4.19.157 and building with "gcc (Debian 8.3.0-6) 8.3.0", with an unpatched source:
$ LC_ALL=C.UTF-8 ARCH=x86 make perf mkdir -p . make --no-print-directory -C perf O= subdir= BUILD: Doing 'make -j2' parallel build Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/perf_event.h' differs from latest version at 'include/uapi/linux/perf_event.h' diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/x86/lib/memcpy_64.S' differs from latest version at 'arch/x86/lib/memcpy_64.S' diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S Warning: Kernel ABI header at 'tools/include/uapi/linux/mman.h' differs from latest version at 'include/uapi/linux/mman.h' diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.h
Auto-detecting system features:
... dwarf: [ on ] ... dwarf_getlocations: [ on ] ... glibc: [ on ] ... gtk2: [ OFF ] ... libaudit: [ on ] ... libbfd: [ OFF ] ... libelf: [ on ] ... libnuma: [ on ] ... numa_num_possible_cpus: [ on ] ... libperl: [ on ] ... libpython: [ on ] ... libslang: [ on ] ... libcrypto: [ on ] ... libunwind: [ on ] ... libdw-dwarf-unwind: [ on ] ... zlib: [ on ] ... lzma: [ on ] ... get_cpuid: [ on ] ... bpf: [ on ]
Makefile.config:456: No sys/sdt.h found, no SDT events are defined, please install systemtap-sdt-devel or systemtap-sdt-dev Makefile.config:623: GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev Makefile.config:682: No 'python-config' tool was found: disables Python support - please install python-devel/python-dev Makefile.config:853: No alternatives command found, you need to set JDIR= to point to the root of your Java directory
Warning: Kernel ABI header at 'tools/include/uapi/linux/bpf.h' differs from latest version at 'include/uapi/linux/bpf.h'
CC util/cs-etm-decoder/cs-etm-decoder.o
CC util/intel-pt.outil/cs-etm-decoder/cs-etm-decoder.c: In function 'cs_etm_decoder__buffer_packet':util/cs-etm-decoder/cs-etm-decoder.c:287:24: error: 'traceid_list' undeclared (first use in this function); did you mean 'trace_event'?
inode = intlist__find(traceid_list, trace_chan_id);
^~~~~~~~~~~~
trace_eventutil/cs-etm-decoder/cs-etm-decoder.c:287:24: note: each undeclared identifier is reported only once for each function it appears in make[6]: *** [/build/linux-stable/tools/build/Makefile.build:97: util/cs-etm-decoder/cs-etm-decoder.o] Error 1 make[5]: *** [/build/linux-stable/tools/build/Makefile.build:139: cs-etm-decoder] Error 2
make[5]: *** Waiting for unfinished jobs....
make[4]: *** [/build/linux-stable/tools/build/Makefile.build:139: util] Error 2
make[3]: *** [Makefile.perf:633: libperf-in.o] Error 2
make[2]: *** [Makefile.perf:206: sub-make] Error 2
make[1]: *** [Makefile:70: all] Error 2
make: *** [Makefile:77: perf] Error 2
Reverting b801d568c7d8 would still fix the issue for me.
Regards,
Salvatore
Quoted 124 lines · Salvatore Bonaccorso
Hi Guenter,
Quoted 47 lines · Guenter Roeck
Quoted 25 lines · Salvatore Bonaccorso
Hi Greg,
Quoted 22 lines · Guenter Roeck
Retry.
Quoted 19 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0Quoted 6 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?The problem is:
In file included from
util/evlist.h:15:0,from util/evsel.c:30:
util/evsel.c: In function ‘perf_evsel__exit’:util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type/usr/include/stdlib.h:563:13: note: expected ‘void *’ but argument is of type ‘const char *’
extern void free (void*__ptr)__THROW;This is seen with older versions of gcc (6.5.0 in my case). I have no idea why newer versions of gcc/glibc accept this (afaics
free()still expects a char *, not a const char *). The underlying problem is thatpmu_nameshould not be declared const char *, but char *, since it is allocated. The upstream version of perf no longer uses the same definition ofzfree(). It was changed fromQuoted 8 lines
#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) to #define zfree(ptr) __zfree((void **)(ptr))which does the necessary typecast. The fix would be to either change the definition of zfree to add the typecast, or to change the definition of
pmu_nameto drop the const. Both would only apply to v4.19.y. I don't know if either would be acceptable.Either case, reverting
b801d568c7d8won't solve that problem.Are we talking about the same problem though? With v4.19.157 and building with "gcc (Debian 8.3.0-6) 8.3.0", with an unpatched source:
$ LC_ALL=C.UTF-8 ARCH=x86 make perf mkdir -p . make --no-print-directory -C perf O= subdir= BUILD: Doing 'make -j2' parallel build Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/perf_event.h' differs from latest version at 'include/uapi/linux/perf_event.h' diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/x86/lib/memcpy_64.S' differs from latest version at 'arch/x86/lib/memcpy_64.S' diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S Warning: Kernel ABI header at 'tools/include/uapi/linux/mman.h' differs from latest version at 'include/uapi/linux/mman.h' diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.hAuto-detecting system features:
... dwarf: [ on ] ... dwarf_getlocations: [ on ] ... glibc: [ on ] ... gtk2: [ OFF ] ... libaudit: [ on ] ... libbfd: [ OFF ] ... libelf: [ on ] ... libnuma: [ on ] ... numa_num_possible_cpus: [ on ] ... libperl: [ on ] ... libpython: [ on ] ... libslang: [ on ] ... libcrypto: [ on ] ... libunwind: [ on ] ... libdw-dwarf-unwind: [ on ] ... zlib: [ on ] ... lzma: [ on ] ... get_cpuid: [ on ] ... bpf: [ on ]Makefile.config:456: No
sys/sdt.hfound, no SDT events are defined, please install systemtap-sdt-devel or systemtap-sdt-dev Makefile.config:623: GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev Makefile.config:682: No 'python-config' tool was found: disables Python support - please install python-devel/python-dev Makefile.config:853: No alternatives command found, you need to set JDIR= to point to the root of your Java directory
Warning: Kernel ABI header at 'tools/include/uapi/linux/bpf.h' differs from latest version at 'include/uapi/linux/bpf.h'
CCutil/cs-etm-decoder/cs-etm-decoder.o
CCutil/intel-pt.outil/cs-etm-decoder/cs-etm-decoder.c: In function 'cs_etm_decoder__buffer_packet':util/cs-etm-decoder/cs-etm-decoder.c:287:24: error: 'traceid_list' undeclared (first use in this function); did you mean 'trace_event'?inode = intlist__find(traceid_list, trace_chan_id); ^~~~~~~~~~~~ trace_event
util/cs-etm-decoder/cs-etm-decoder.c:287:24: note: each undeclared identifier is reported only once for each function it appears in make[6]: *** [/build/linux-stable/tools/build/Makefile.build:97:util/cs-etm-decoder/cs-etm-decoder.o] Error 1 make[5]: *** [/build/linux-stable/tools/build/Makefile.build:139: cs-etm-decoder] Error 2
make[5]: *** Waiting for unfinished jobs....
make[4]: *** [/build/linux-stable/tools/build/Makefile.build:139: util] Error 2
make[3]: *** [Makefile.perf:633: libperf-in.o] Error 2
make[2]: *** [Makefile.perf:206: sub-make] Error 2
make[1]: *** [Makefile:70: all] Error 2
make: *** [Makefile:77: perf] Error 2
Quoted 2 lines
Reverting
b801d568c7d8would still fix the issue for me.
You are correct, that is a different issue, and b801d568c7d8 will need to be reverted to fix it. I just can't figure out how to convince perf to compile this file for me.
Guenter
Hi Guenter,
Quoted 125 lines · Guenter Roeck
Quoted 124 lines · Salvatore Bonaccorso
Hi Guenter,
Quoted 47 lines · Guenter Roeck
Quoted 25 lines · Salvatore Bonaccorso
Hi Greg,
Quoted 22 lines · Guenter Roeck
Retry.
Quoted 19 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0Quoted 6 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?The problem is:
In file included from
util/evlist.h:15:0,from util/evsel.c:30:
util/evsel.c: In function ‘perf_evsel__exit’:util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type/usr/include/stdlib.h:563:13: note: expected ‘void *’ but argument is of type ‘const char *’
extern void free (void*__ptr)__THROW;This is seen with older versions of gcc (6.5.0 in my case). I have no idea why newer versions of gcc/glibc accept this (afaics
free()still expects a char *, not a const char *). The underlying problem is thatpmu_nameshould not be declared const char *, but char *, since it is allocated. The upstream version of perf no longer uses the same definition ofzfree(). It was changed fromQuoted 8 lines
#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) to #define zfree(ptr) __zfree((void **)(ptr))which does the necessary typecast. The fix would be to either change the definition of zfree to add the typecast, or to change the definition of
pmu_nameto drop the const. Both would only apply to v4.19.y. I don't know if either would be acceptable.Either case, reverting
b801d568c7d8won't solve that problem.Are we talking about the same problem though? With v4.19.157 and building with "gcc (Debian 8.3.0-6) 8.3.0", with an unpatched source:
$ LC_ALL=C.UTF-8 ARCH=x86 make perf mkdir -p . make --no-print-directory -C perf O= subdir= BUILD: Doing 'make -j2' parallel build Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/perf_event.h' differs from latest version at 'include/uapi/linux/perf_event.h' diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/x86/lib/memcpy_64.S' differs from latest version at 'arch/x86/lib/memcpy_64.S' diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S Warning: Kernel ABI header at 'tools/include/uapi/linux/mman.h' differs from latest version at 'include/uapi/linux/mman.h' diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.hAuto-detecting system features:
... dwarf: [ on ] ... dwarf_getlocations: [ on ] ... glibc: [ on ] ... gtk2: [ OFF ] ... libaudit: [ on ] ... libbfd: [ OFF ] ... libelf: [ on ] ... libnuma: [ on ] ... numa_num_possible_cpus: [ on ] ... libperl: [ on ] ... libpython: [ on ] ... libslang: [ on ] ... libcrypto: [ on ] ... libunwind: [ on ] ... libdw-dwarf-unwind: [ on ] ... zlib: [ on ] ... lzma: [ on ] ... get_cpuid: [ on ] ... bpf: [ on ]Makefile.config:456: No
sys/sdt.hfound, no SDT events are defined, please install systemtap-sdt-devel or systemtap-sdt-dev Makefile.config:623: GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev Makefile.config:682: No 'python-config' tool was found: disables Python support - please install python-devel/python-dev Makefile.config:853: No alternatives command found, you need to set JDIR= to point to the root of your Java directory
Warning: Kernel ABI header at 'tools/include/uapi/linux/bpf.h' differs from latest version at 'include/uapi/linux/bpf.h'
CCutil/cs-etm-decoder/cs-etm-decoder.o
CCutil/intel-pt.outil/cs-etm-decoder/cs-etm-decoder.c: In function 'cs_etm_decoder__buffer_packet':util/cs-etm-decoder/cs-etm-decoder.c:287:24: error: 'traceid_list' undeclared (first use in this function); did you mean 'trace_event'?inode = intlist__find(traceid_list, trace_chan_id); ^~~~~~~~~~~~ trace_event
util/cs-etm-decoder/cs-etm-decoder.c:287:24: note: each undeclared identifier is reported only once for each function it appears in make[6]: *** [/build/linux-stable/tools/build/Makefile.build:97:util/cs-etm-decoder/cs-etm-decoder.o] Error 1 make[5]: *** [/build/linux-stable/tools/build/Makefile.build:139: cs-etm-decoder] Error 2
make[5]: *** Waiting for unfinished jobs....
make[4]: *** [/build/linux-stable/tools/build/Makefile.build:139: util] Error 2
make[3]: *** [Makefile.perf:633: libperf-in.o] Error 2
make[2]: *** [Makefile.perf:206: sub-make] Error 2
make[1]: *** [Makefile:70: all] Error 2
make: *** [Makefile:77: perf] Error 2
Quoted 5 lines
Quoted 2 lines
Reverting
b801d568c7d8would still fix the issue for me.You are correct, that is a different issue, and
b801d568c7d8will need to be reverted to fix it. I just can't figure out how to convince perf to compile this file for me.
Thanks for confirming/acking.
So how to move from here, Greg do you need an explicit patch with the revert or can it be taken from here?
Salvatore
Greg Kroah-Hartman
maintainerQuoted 131 lines · Salvatore Bonaccorso
Hi Guenter,
Quoted 128 lines · Guenter Roeck
Quoted 126 lines · Salvatore Bonaccorso
Hi Guenter,
Quoted 47 lines · Guenter Roeck
Quoted 25 lines · Salvatore Bonaccorso
Hi Greg,
Quoted 22 lines · Guenter Roeck
Retry.
Quoted 19 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 152 fail: 3 Failed builds: i386:tools/perf powerpc:ppc6xx_defconfig x86_64:tools/perf Qemu test results: total: 417 pass: 417 fail: 0Quoted 6 lines
Quoted 1 line
Quoted 1 line
perf failures are as usual. powerpc:
Regarding the perf failures, do you plan to revert
b801d568c7d8("perf
cs-etm: Move definition of 'traceid_list' global variable from header file") included in 4.19.152 or is a bugfix underway?The problem is:
In file included from
util/evlist.h:15:0,from util/evsel.c:30:
util/evsel.c: In function ‘perf_evsel__exit’:util/util.h:25:28: error: passing argument 1 of ‘free’ discards ‘const’ qualifier from pointer target type/usr/include/stdlib.h:563:13: note: expected ‘void *’ but argument is of type ‘const char *’
extern void free (void*__ptr)__THROW;This is seen with older versions of gcc (6.5.0 in my case). I have no idea why newer versions of gcc/glibc accept this (afaics
free()still expects a char *, not a const char *). The underlying problem is thatpmu_nameshould not be declared const char *, but char *, since it is allocated. The upstream version of perf no longer uses the same definition ofzfree(). It was changed fromQuoted 8 lines
#define zfree(ptr) ({ free(*ptr); *ptr = NULL; }) to #define zfree(ptr) __zfree((void **)(ptr))which does the necessary typecast. The fix would be to either change the definition of zfree to add the typecast, or to change the definition of
pmu_nameto drop the const. Both would only apply to v4.19.y. I don't know if either would be acceptable.Either case, reverting
b801d568c7d8won't solve that problem.Are we talking about the same problem though? With v4.19.157 and building with "gcc (Debian 8.3.0-6) 8.3.0", with an unpatched source:
$ LC_ALL=C.UTF-8 ARCH=x86 make perf mkdir -p . make --no-print-directory -C perf O= subdir= BUILD: Doing 'make -j2' parallel build Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/perf_event.h' differs from latest version at 'include/uapi/linux/perf_event.h' diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/x86/lib/memcpy_64.S' differs from latest version at 'arch/x86/lib/memcpy_64.S' diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S Warning: Kernel ABI header at 'tools/include/uapi/linux/mman.h' differs from latest version at 'include/uapi/linux/mman.h' diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.hAuto-detecting system features:
... dwarf: [ on ] ... dwarf_getlocations: [ on ] ... glibc: [ on ] ... gtk2: [ OFF ] ... libaudit: [ on ] ... libbfd: [ OFF ] ... libelf: [ on ] ... libnuma: [ on ] ... numa_num_possible_cpus: [ on ] ... libperl: [ on ] ... libpython: [ on ] ... libslang: [ on ] ... libcrypto: [ on ] ... libunwind: [ on ] ... libdw-dwarf-unwind: [ on ] ... zlib: [ on ] ... lzma: [ on ] ... get_cpuid: [ on ] ... bpf: [ on ]Makefile.config:456: No
sys/sdt.hfound, no SDT events are defined, please install systemtap-sdt-devel or systemtap-sdt-dev Makefile.config:623: GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev Makefile.config:682: No 'python-config' tool was found: disables Python support - please install python-devel/python-dev Makefile.config:853: No alternatives command found, you need to set JDIR= to point to the root of your Java directory
Warning: Kernel ABI header at 'tools/include/uapi/linux/bpf.h' differs from latest version at 'include/uapi/linux/bpf.h'
CCutil/cs-etm-decoder/cs-etm-decoder.o
CCutil/intel-pt.outil/cs-etm-decoder/cs-etm-decoder.c: In function 'cs_etm_decoder__buffer_packet':util/cs-etm-decoder/cs-etm-decoder.c:287:24: error: 'traceid_list' undeclared (first use in this function); did you mean 'trace_event'?inode = intlist__find(traceid_list, trace_chan_id); ^~~~~~~~~~~~ trace_event
util/cs-etm-decoder/cs-etm-decoder.c:287:24: note: each undeclared identifier is reported only once for each function it appears in make[6]: *** [/build/linux-stable/tools/build/Makefile.build:97:util/cs-etm-decoder/cs-etm-decoder.o] Error 1 make[5]: *** [/build/linux-stable/tools/build/Makefile.build:139: cs-etm-decoder] Error 2
make[5]: *** Waiting for unfinished jobs....
make[4]: *** [/build/linux-stable/tools/build/Makefile.build:139: util] Error 2
make[3]: *** [Makefile.perf:633: libperf-in.o] Error 2
make[2]: *** [Makefile.perf:206: sub-make] Error 2
make[1]: *** [Makefile:70: all] Error 2
make: *** [Makefile:77: perf] Error 2Reverting
b801d568c7d8would still fix the issue for me.
Quoted 7 lines
Quoted 2 lines
You are correct, that is a different issue, and
b801d568c7d8will need to be reverted to fix it. I just can't figure out how to convince perf to compile this file for me.Thanks for confirming/acking.
So how to move from here, Greg do you need an explicit patch with the revert or can it be taken from here?
An explicit patch is always best, as I can't test this because I have the same build problems that Guenter has for this.
thanks,
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.153-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.19.153-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: 8919185062d40d0559c701be480cc8fa547291ed
git describe: v4.19.152-265-g8919185062d4
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.19.y/build/v4.19.152-265-g8919185062d4
No regressions (compared to build v4.19.152)
No fixes (compared to build v4.19.152)
Ran 28857 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* v4l2-compliance
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-ipc-tests
* network-basic-tests
* libhugetlbfs
* ltp-commands-tests
* ltp-fs-tests
* ltp-math-tests
* ltp-open-posix-tests
* ltp-tracing-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.153-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.19:
15 builds: 15 pass, 0 fail
22 boots: 22 pass, 0 fail
38 tests: 38 pass, 0 failLinux version: 4.19.153-rc1-g8919185062d4
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Jon
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/208235954
It shows failed run -- https://lava.ciplatform.org/scheduler/job/73174
-- but that seems to be something wrong with our test infrastructure. So... no problems detected by CIP project.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerQuoted 10 lines · Pavel Machek
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 4.19.153 release. There are 264 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Oct 2020 13:53:47 +0000. Anything received after that time might be too late.
Quoted 7 lines
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/208235954
It shows failed run -- https://lava.ciplatform.org/scheduler/job/73174
-- but that seems to be something wrong with our test infrastructure. So... no problems detected by CIP project.Tested-by Pavel Machek (CIP) <[email protected]>
Thanks for testing 2 of these and letting me know.
greg k-h