4.19.164-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 162/346 ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
In reply to Greg Kroah-HartmanFrom: Cristian Birsan <[email protected]>
[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]
The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without it the driver probes but VBus is not powered because of wrong pincontrol configuration.
--- arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++ 1 file changed, 7 insertions(+)
arch/arm/boot/dts/at91-sama5d4_xplained.dts +7 -0
@@ -170,6 +170,11 @@ atmel,pins = <AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; }; + pinctrl_usb_default: usb_default { + atmel,pins = + <AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE + AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; pinctrl_key_gpio: key_gpio_0 { atmel,pins = <AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
@@ -195,6 +200,8 @@ &pioE 11 GPIO_ACTIVE_HIGH &pioE 14 GPIO_ACTIVE_HIGH >; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb_default>; status = "okay"; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 163/346 ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
In reply to Greg Kroah-HartmanFrom: Cristian Birsan <[email protected]>
[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]
The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without it the driver probes but VBus is not powered because of wrong pincontrol configuration.
--- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++ 1 file changed, 7 insertions(+)
arch/arm/boot/dts/at91-sama5d3_xplained.dts +7 -0
@@ -243,6 +243,11 @@ atmel,pins = <AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; /* PE9, conflicts with A9 */ }; + pinctrl_usb_default: usb_default { + atmel,pins = + <AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE + AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>; + }; }; }; };
@@ -260,6 +265,8 @@ &pioE 3 GPIO_ACTIVE_LOW &pioE 4 GPIO_ACTIVE_LOW >; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb_default>; status = "okay"; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 164/346 orinoco: Move context allocation after processing the skb
In reply to Greg Kroah-HartmanFrom: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]
ezusb_xmit() allocates a context which is leaked if orinoco_process_xmit_skb() returns an error.
Move ezusb_alloc_ctx() after the invocation of orinoco_process_xmit_skb() because the context is not needed so early. ezusb_access_ltv() will cleanup the context in case of an error.
--- .../net/wireless/intersil/orinoco/orinoco_usb.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/wireless/intersil/orinoco/orinoco_usb.c +7 -7
@@ -1237,13 +1237,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)if (skb->len <ETH_HLEN ) goto drop; - ctx =ezusb_alloc_ctx (upriv,EZUSB_RID_TX ,0 ); -if (!ctx) - goto busy; - -memset (ctx->buf,0 ,BULK_BUF_SIZE ); - buf = ctx->buf->data; - tx_control =0 ; err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
@@ -1251,6 +1244,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)if (err) goto drop; + ctx =ezusb_alloc_ctx (upriv,EZUSB_RID_TX ,0 ); +if (!ctx) + goto drop; + +memset (ctx->buf,0 ,BULK_BUF_SIZE ); + buf = ctx->buf->data; + {__le16 *tx_cntl = (__le16 *)buf; *tx_cntl =cpu_to_le16 (tx_control);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 165/346 cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]
Add the missing destroy_workqueue() before return from cw1200_init_common in the error handling case.
--- drivers/net/wireless/st/cw1200/main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/st/cw1200/main.c +2 -0
@@ -384,6 +384,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr, CW1200_LINK_ID_MAX, cw1200_skb_dtor, priv)) { +destroy_workqueue (priv->workqueue);ieee80211_free_hw (hw);return NULL ; }
@@ -395,6 +396,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,for (; i >0 ; i--)cw1200_queue_deinit (&priv->tx_queue[i -1 ]);cw1200_queue_stats_deinit (&priv->tx_queue_stats); +destroy_workqueue (priv->workqueue);ieee80211_free_hw (hw);return NULL ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 166/346 dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ]
Return the corresponding error code when first_msi_entry() returns NULL in mv_xor_v2_probe().
--- drivers/dma/mv_xor_v2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/mv_xor_v2.c +3 -1
@@ -777,8 +777,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev) goto disable_clk; msi_desc =first_msi_entry (&pdev->dev); -if (!msi_desc) +if (!msi_desc) { + ret = -ENODEV ; goto free_msi_irqs; + } xor_dev->msi_desc = msi_desc; ret = devm_request_irq(&pdev->dev, msi_desc->irq,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 167/346 media: siano: fix memory leak of debugfs members in smsdvb_hotplug
In reply to Greg Kroah-HartmanFrom: Keita Suzuki <[email protected]>
[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ]
When dvb_create_media_graph fails, the debugfs kept inside client should be released. However, the current implementation does not release them.
Fix this by adding a new goto label to call smsdvb_debugfs_release.
--- drivers/media/common/siano/smsdvb-main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/common/siano/smsdvb-main.c +4 -1
@@ -1180,12 +1180,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev, rc =dvb_create_media_graph (&client->adapter, true);if (rc <0 ) {pr_err ("dvb_create_media_graph failed %d\n" , rc); - goto client_error; + goto media_graph_error; }pr_info ("DVB interface registered.\n" );return 0 ; +media_graph_error: +smsdvb_debugfs_release (client); + client_error:dvb_unregister_frontend (&client->frontend);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 168/346 platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit 2bf5046bdb649908df8bcc0a012c56eee931a9af ]
Remove PSU EEPROM configuration for systems class equipped with Mellanox chip Spectrum and Celeron CPU - system types MSN2700, MSN2100. Till now all the systems from this class used few types of power units, all equipped with EEPROM device with address space two bytes. Thus, all these devices have been handled by EEPROM driver "24c02".
There is a new requirement is to support power unit replacement by "off the shelf" device, matching electrical required parameters. Such device can be equipped with different EEPROM type, which could be one byte address space addressing or even could be not equipped with EEPROM. In such case "24c02" will not work.
--- drivers/platform/x86/mlx-platform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/platform/x86/mlx-platform.c +2 -4
@@ -251,15 +251,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = { .label = "psu1", .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, .mask = BIT(0), - .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0], - .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR, + .hpdev.nr = MLXPLAT_CPLD_NR_NONE, }, { .label = "psu2", .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, .mask = BIT(1), - .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1], - .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR, + .hpdev.nr = MLXPLAT_CPLD_NR_NONE, }, };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 169/346 platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]
Remove PSU EEPROM configuration for systems class equipped with Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now all the systems from this class used few types of power units, all equipped with EEPROM device with address space two bytes. Thus, all these devices have been handled by EEPROM driver "24c02".
There is a new requirement is to support power unit replacement by "off the shelf" device, matching electrical required parameters. Such device can be equipped with different EEPROM type, which could be one byte address space addressing or even could be not equipped with EEPROM. In such case "24c02" will not work.
--- drivers/platform/x86/mlx-platform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/platform/x86/mlx-platform.c +2 -4
@@ -420,15 +420,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = { .label = "psu1", .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, .mask = BIT(0), - .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0], - .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, + .hpdev.nr = MLXPLAT_CPLD_NR_NONE, }, { .label = "psu2", .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, .mask = BIT(1), - .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1], - .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, + .hpdev.nr = MLXPLAT_CPLD_NR_NONE, }, };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 170/346 samples: bpf: Fix lwt_len_hist reusing previous BPF map
In reply to Greg Kroah-HartmanFrom: Daniel T. Lee <[email protected]>
[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ]
Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the map isn't cleared on test end. This leds to reuse of that map for each test, which prevents the results of the test from being accurate.
This commit fixes the problem by removing of pinned map from bpffs. Also, this commit add the executable permission to shell script files.
--- samples/bpf/lwt_len_hist.sh | 2 ++ samples/bpf/test_lwt_bpf.sh | 0 2 files changed, 2 insertions(+) mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh
samples/bpf/lwt_len_hist.sh +2 -0
@@ -8,6 +8,8 @@ VETH1=tst_lwt1b TRACE_ROOT=/sys/kernel/debug/tracing function cleanup { + # To reset saved histogram, remove pinned map + rm /sys/fs/bpf/tc/globals/lwt_len_hist_map ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null ip link del $VETH0 2> /dev/null ip link del $VETH1 2> /dev/null
samples/bpf/test_lwt_bpf.sh +0 -0
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 171/346 mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]
kfree(dev) has been called inside put_device so anther kfree would cause a use-after-free bug/
--- drivers/bus/mips_cdmm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/bus/mips_cdmm.c +1 -3
@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)dev_set_name (&dev->dev,"cdmm%u-%u" , cpu, id); ++id; ret =device_register (&dev->dev); -if (ret) { +if (ret)put_device (&dev->dev); -kfree (dev); - } } }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 172/346 media: max2175: fix max2175_set_csm_mode() error code
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ]
This is supposed to return negative error codes but the type is bool so it returns true instead.
--- drivers/media/i2c/max2175.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/max2175.c +1 -1
@@ -511,7 +511,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx) } } -static bool max2175_set_csm_mode (struct max2175 *ctx, +static int max2175_set_csm_mode (struct max2175 *ctx,enum max2175_csm_mode new_mode) {int ret =max2175_poll_csm_ready (ctx);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 173/346 slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 39014ce6d6028614a46395923a2c92d058b6fa87 ]
Attempting to send a power request during PM operations, when the QMI handle isn't initialized results in a NULL pointer dereference. So check if the QMI handle has been initialized before attempting to post the power requests.
--- drivers/slimbus/qcom-ngd-ctrl.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/slimbus/qcom-ngd-ctrl.c +6 -0
@@ -1200,6 +1200,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev)struct qcom_slim_ngd_ctrl *ctrl =dev_get_drvdata (dev);int ret =0 ; +if (!ctrl->qmi.handle) +return 0 ; +if (ctrl->state >=QCOM_SLIM_NGD_CTRL_ASLEEP ) ret =qcom_slim_ngd_power_up (ctrl);if (ret) {
@@ -1493,6 +1496,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)struct qcom_slim_ngd_ctrl *ctrl =dev_get_drvdata (dev);int ret =0 ; +if (!ctrl->qmi.handle) +return 0 ; + ret =qcom_slim_qmi_power_request (ctrl, false);if (ret && ret != -EBUSY )dev_info (ctrl->dev,"slim resource not idle:%d\n" , ret);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 174/346 HSI: omap_ssi: Dont jump to free ID in ssi_add_controller()
In reply to Greg Kroah-HartmanFrom: Jing Xiangfeng <[email protected]>
[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]
In current code, it jumps to ida_simple_remove() when ida_simple_get() failes to allocate an ID. Just return to fix it.
--- drivers/hsi/controllers/omap_ssi_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hsi/controllers/omap_ssi_core.c +1 -1
@@ -389,7 +389,7 @@ static int ssi_add_controller(struct hsi_controller *ssi, err =ida_simple_get (&platform_omap_ssi_ida,0 ,0 ,GFP_KERNEL );if (err <0 ) - goto out_err; +return err; ssi->id = err; ssi->owner =THIS_MODULE ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 175/346 ARM: dts: Remove non-existent i2c1 from 98dx3236
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ]
The switches with integrated CPUs have only got a single i2c controller. They incorrectly gained one when they were split from the Armada-XP.
--- arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 ----- 1 file changed, 5 deletions(-)
arch/arm/boot/dts/armada-xp-98dx3236.dtsi +0 -5
@@ -266,11 +266,6 @@ reg = <0x11000 0x100>; }; -&i2c1 { - compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c"; - reg = <0x11100 0x100>; -}; - &mpic { reg = <0x20a00 0x2d0>, <0x21070 0x58>; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 176/346 arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 4076a007bd0f6171434bdb119a0b8797749b0502 ]
The board has a standard USB A female port connected to the USB OTG controller's data pins. Set dr_mode in the OTG controller node to indicate this usage, instead of having the implementation guess.
--- arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +1 -0
@@ -255,6 +255,7 @@ }; &usb20_otg { + dr_mode = "host"; status = "okay"; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 177/346 power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit a0f1ccd96c7049377d892a4299b6d5e47ec9179d ]
Commit 9c80662a74cd ("power: supply: axp288_charger: Add special handling for HP Pavilion x2 10") added special handling for HP Pavilion x2 10 models which use the weird combination of a Type-C connector and the non Type-C aware AXP288 PMIC.
This special handling was activated by a DMI match a the product-name of "HP Pavilion x2 Detachable". Recently I've learned that there are also older "HP Pavilion x2 Detachable" models with an AXP288 PMIC + a micro-usb connector where we should not activate the special handling for the Type-C connectors.
Extend the matching to also match on the DMI board-name and match on the 2 boards (one Bay Trail based one Cherry Trail based) of which we are certain that they use the AXP288 + Type-C connector combination.
Note the DSDT code from these older (AXP288 + micro-USB) models contains some AML code (which never runs under Linux) which reads the micro-USB connector id-pin and if it is pulled to ground, which would normally mean the port is in host mode!, then it sets the input-current-limit to 3A, it seems HP is using the micro-USB port as a charging only connector and identifies their own 3A capable charger though this hack which is a major violation of the USB specs. Note HP also hardcodes a 2A limit when the id-pin is not pulled to ground, which is also in violation of the specs.
I've no intention to add support for HP's hack to support 3A charging on these older models. By making the DMI matches for the Type-C equipped models workaround more tighter, these older models will be treated just like any other AXP288 + micro-USB equipped device and the input-current limit will follow the BC 1.2 spec (using the defacto standard values there where the BC 1.2 spec defines a range).
--- drivers/power/supply/axp288_charger.c | 28 ++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/power/supply/axp288_charger.c +17 -11
@@ -555,14 +555,15 @@ out:/* * The HP Pavilion x2 10 series comes in a number of variants: -* Bay Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "815D" -* Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E" -* Cherry Trail SoC + TI PMIC, DMI_BOARD_NAME: "827C" or "82F4" +* Bay Trail SoC + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021" +* Bay Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "815D" +* Cherry Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "813E" +* Cherry Trail SoC + TI PMIC, Type-C, DMI_BOARD_NAME: "827C" or "82F4" * -* The variants with the AXP288 PMIC are all kinds of special: +* The variants with the AXP288 + Type-C connector are all kinds of special: * -* 1. All variants use a Type-C connector which the AXP288 does not support, so -* when using a Type-C charger it is not recognized. Unlike most AXP288 devices, +* 1. They use a Type-C connector which the AXP288 does not support, so when +* using a Type-C charger it is not recognized. Unlike most AXP288 devices, * this model actually has mostly working ACPI AC / Battery code, the ACPI code * "solves" this by simply setting the input_current_limit to 3A. * There are still some issues with the ACPI code, so we use this native driver,
@@ -585,12 +586,17 @@ out:*/ static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = { { -/* -* Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry -* Trail model has "HP", so we only match on product_name. -*/ .matches = { -DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion x2 Detachable" ), +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), +DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion x2 Detachable" ), +DMI_EXACT_MATCH (DMI_BOARD_NAME ,"815D" ), + }, + }, + { + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"HP" ), +DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion x2 Detachable" ), +DMI_EXACT_MATCH (DMI_BOARD_NAME ,"813E" ), }, }, {}/* Terminating entry */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 178/346 power: supply: bq24190_charger: fix reference leak
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to call pm_runtime_put_noidle will result in reference leak in callers(bq24190_sysfs_show, bq24190_charger_get_property, bq24190_charger_set_property, bq24190_battery_get_property, bq24190_battery_set_property), so we should fix it.
--- drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/power/supply/bq24190_charger.c +15 -5
@@ -446,8 +446,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,return -EINVAL ; ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (bdi->dev);return ret; + } ret =bq24190_read_mask (bdi, info->reg, info->mask, info->shift, &v);if (ret)
@@ -1092,8 +1094,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,dev_dbg (bdi->dev,"prop: %d\n" , psp); ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (bdi->dev);return ret; + }switch (psp) {case POWER_SUPPLY_PROP_CHARGE_TYPE :
@@ -1164,8 +1168,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,dev_dbg (bdi->dev,"prop: %d\n" , psp); ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (bdi->dev);return ret; + }switch (psp) {case POWER_SUPPLY_PROP_ONLINE :
@@ -1425,8 +1431,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,dev_dbg (bdi->dev,"prop: %d\n" , psp); ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (bdi->dev);return ret; + }switch (psp) {case POWER_SUPPLY_PROP_STATUS :
@@ -1471,8 +1479,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,dev_dbg (bdi->dev,"prop: %d\n" , psp); ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) +if (ret <0 ) { +pm_runtime_put_noidle (bdi->dev);return ret; + }switch (psp) {case POWER_SUPPLY_PROP_ONLINE :
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 179/346 genirq/irqdomain: Dont try to free an interrupt that has no mapping
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]
When an interrupt allocation fails for N interrupts, it is pretty common for the error handling code to free the same number of interrupts, no matter how many interrupts have actually been allocated.
This may result in the domain freeing code to be unexpectedly called for interrupts that have no mapping in that domain. Things end pretty badly.
Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure that thiss does not follow the hierarchy if no mapping exists for a given interrupt.
--- kernel/irq/irqdomain.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
kernel/irq/irqdomain.c +9 -2
@@ -1247,8 +1247,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain, unsigned int irq_base, unsigned int nr_irqs) { - if (domain->ops->free) - domain->ops->free(domain, irq_base, nr_irqs); +unsigned int i; + +if (!domain->ops->free) +return ; + +for (i =0 ; i < nr_irqs; i++) { +if (irq_domain_get_irq_data (domain, irq_base + i)) + domain->ops->free (domain, irq_base + i,1 ); + } } int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 180/346 PCI: Bounds-check command-line resource alignment requests
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
[ Upstream commit 6534aac198b58309ff2337981d3f893e0be1d19d ]
32-bit BARs are limited to 2GB size (2^31). By extension, I assume 64-bit BARs are limited to 2^63 bytes. Limit the alignment requested by the "pci=resource_alignment=" command-line parameter to 2^63.
--- drivers/pci/pci.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/pci/pci.c +8 -6
@@ -5840,19 +5840,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,while (*p) { count =0 ;if (sscanf (p,"%d%n" , &align_order, &count) ==1 && - p[count] =='@' ) { + p[count] =='@' ) { p += count +1 ; +if (align_order >63 ) { +pr_err ("PCI: Invalid requested alignment (order %d)\n" , + align_order); + align_order =PAGE_SHIFT ; + } }else { - align_order =-1 ; + align_order =PAGE_SHIFT ; } ret =pci_dev_str_match (dev, p, &p);if (ret ==1 ) { *resize = true; -if (align_order ==-1 ) - align =PAGE_SIZE ; -else - align =1 << align_order; + align =1 << align_order;break ; }else if (ret <0 ) { pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 181/346 PCI: Fix overflow in command-line resource alignment requests
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit cc73eb321d246776e5a9f7723d15708809aa3699 ]
The shift of 1 by align_order is evaluated using 32 bit arithmetic and the result is assigned to a resource_size_t type variable that is a 64 bit unsigned integer on 64 bit platforms. Fix an overflow before widening issue by making the 1 a ULL.
Addresses-Coverity: ("Unintentional integer overflow")
--- drivers/pci/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/pci.c +1 -1
@@ -5854,7 +5854,7 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev, ret =pci_dev_str_match (dev, p, &p);if (ret ==1 ) { *resize = true; - align =1 << align_order; + align =1ULL << align_order;break ; }else if (ret <0 ) { pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 182/346 PCI: iproc: Fix out-of-bound array accesses
In reply to Greg Kroah-HartmanFrom: Bharat Gooty <[email protected]>
[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ]
Declare the full size array for all revisions of PAX register sets to avoid potentially out of bound access of the register array when they are being initialized in iproc_pcie_rev_init().
--- drivers/pci/controller/pcie-iproc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/pci/controller/pcie-iproc.c +5 -5
@@ -300,7 +300,7 @@ enum iproc_pcie_reg { };/* iProc PCIe PAXB BCMA registers */ -static const u16 iproc_pcie_reg_paxb_bcma[] = { +static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG ] = { [IPROC_PCIE_CLK_CTRL ] =0x000 , [IPROC_PCIE_CFG_IND_ADDR ] =0x120 , [IPROC_PCIE_CFG_IND_DATA ] =0x124 ,
@@ -311,7 +311,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = { };/* iProc PCIe PAXB registers */ -static const u16 iproc_pcie_reg_paxb[] = { +static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG ] = { [IPROC_PCIE_CLK_CTRL ] =0x000 , [IPROC_PCIE_CFG_IND_ADDR ] =0x120 , [IPROC_PCIE_CFG_IND_DATA ] =0x124 ,
@@ -327,7 +327,7 @@ static const u16 iproc_pcie_reg_paxb[] = { };/* iProc PCIe PAXB v2 registers */ -static const u16 iproc_pcie_reg_paxb_v2[] = { +static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG ] = { [IPROC_PCIE_CLK_CTRL ] =0x000 , [IPROC_PCIE_CFG_IND_ADDR ] =0x120 , [IPROC_PCIE_CFG_IND_DATA ] =0x124 ,
@@ -355,7 +355,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = { };/* iProc PCIe PAXC v1 registers */ -static const u16 iproc_pcie_reg_paxc[] = { +static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG ] = { [IPROC_PCIE_CLK_CTRL ] =0x000 , [IPROC_PCIE_CFG_IND_ADDR ] =0x1f0 , [IPROC_PCIE_CFG_IND_DATA ] =0x1f4 ,
@@ -364,7 +364,7 @@ static const u16 iproc_pcie_reg_paxc[] = { };/* iProc PCIe PAXC v2 registers */ -static const u16 iproc_pcie_reg_paxc_v2[] = { +static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG ] = { [IPROC_PCIE_MSI_GIC_MODE ] =0x050 , [IPROC_PCIE_MSI_BASE_ADDR ] =0x074 , [IPROC_PCIE_MSI_WINDOW_SIZE ] =0x078 ,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 183/346 arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
In reply to Greg Kroah-HartmanFrom: Artem Lapkin <[email protected]>
[ Upstream commit b6c605e00ce8910d7ec3d9a54725d78b14db49b9 ]
The max frequency for the w25q32 (VIM v1.2) and w25q128 (VIM v1.4) spifc chip should be 104Mhz not 30MHz.
--- arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +1 -1
@@ -399,7 +399,7 @@ #size-cells = <1>; compatible = "winbond,w25q16", "jedec,spi-nor"; reg = <0>; - spi-max-frequency = <3000000>; + spi-max-frequency = <104000000>; }; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 184/346 ARM: dts: at91: at91sam9rl: fix ADC triggers
In reply to Greg Kroah-HartmanFrom: Alexandre Belloni <[email protected]>
[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]
The triggers for the ADC were taken from at91sam9260 dtsi but are not correct.
--- arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
arch/arm/boot/dts/at91sam9rl.dtsi +11 -8
@@ -277,23 +277,26 @@ atmel,adc-use-res = "highres"; trigger0 { - trigger-name = "timer-counter-0"; + trigger-name = "external-rising"; trigger-value = <0x1>; + trigger-external; }; + trigger1 { - trigger-name = "timer-counter-1"; - trigger-value = <0x3>; + trigger-name = "external-falling"; + trigger-value = <0x2>; + trigger-external; }; trigger2 { - trigger-name = "timer-counter-2"; - trigger-value = <0x5>; + trigger-name = "external-any"; + trigger-value = <0x3>; + trigger-external; }; trigger3 { - trigger-name = "external"; - trigger-value = <0x13>; - trigger-external; + trigger-name = "continuous"; + trigger-value = <0x6>; }; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 185/346 platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 2425ccd30fd78ce35237350fe8baac31dc18bd45 ]
Fix to return the error code -ENODEV when fails to init wmi and smm.
--- drivers/platform/x86/dell-smbios-base.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell-smbios-base.c +1 -0
@@ -597,6 +597,7 @@ static int __init dell_smbios_init(void)if (wmi && smm) {pr_err ("No SMBIOS backends available (wmi: %d, smm: %d)\n" , wmi, smm); + ret = -ENODEV ; goto fail_create_group; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 186/346 ath10k: Fix the parsing error in service available event
In reply to Greg Kroah-HartmanFrom: Rakesh Pillai <[email protected]>
[ Upstream commit c7cee9c0f499f27ec6de06bea664b61320534768 ]
The wmi service available event has been extended to contain extra 128 bit for new services to be indicated by firmware.
Currently the presence of any optional TLVs in
the wmi service available event leads to a parsing error with the below error message:ath10k_snoc 18800000.wifi: failed to parse svc_avail tlv: -71
The wmi service available event parsing should not return error for the newly added optional TLV. Fix this parsing for service available event message.
Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2-00720-QCAHLSWMTPL-1
--- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++- drivers/net/wireless/ath/ath10k/wmi.c | 9 +++++++-- drivers/net/wireless/ath/ath10k/wmi.h | 1 + 3 files changed, 11 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath10k/wmi-tlv.c +3 -1
@@ -1157,13 +1157,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len,switch (tag) {case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT : + arg->service_map_ext_valid = true; arg->service_map_ext_len = *(__le32 *)ptr; arg->service_map_ext = ptr +sizeof (__le32);return 0 ;default :break ; } -return -EPROTO ; + +return 0 ; } static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar,
drivers/net/wireless/ath/ath10k/wmi.c +7 -2
@@ -5510,8 +5510,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb) ret); } -ath10k_wmi_map_svc_ext (ar, arg.service_map_ext, ar->wmi.svc_map, -__le32_to_cpu (arg.service_map_ext_len)); +/* +* Initialization of "arg.service_map_ext_valid" to ZERO is necessary +* for the below logic to work. +*/ +if (arg.service_map_ext_valid) +ath10k_wmi_map_svc_ext (ar, arg.service_map_ext, ar->wmi.svc_map, +__le32_to_cpu (arg.service_map_ext_len)); }static int ath10k_wmi_event_temperature (struct ath10k *ar,struct sk_buff *skb)
drivers/net/wireless/ath/ath10k/wmi.h +1 -0
@@ -6710,6 +6710,7 @@ struct wmi_svc_rdy_ev_arg { };struct wmi_svc_avail_ev_arg { +bool service_map_ext_valid;__le32 service_map_ext_len;const __le32 *service_map_ext; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 187/346 ath10k: Fix an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ]
If 'ath10k_usb_create()' fails, we should release some resources and report an error instead of silently continuing.
--- drivers/net/wireless/ath/ath10k/usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/ath/ath10k/usb.c +2 -0
@@ -1019,6 +1019,8 @@ static int ath10k_usb_probe(struct usb_interface *interface, ar_usb =ath10k_usb_priv (ar); ret =ath10k_usb_create (ar, interface); +if (ret) + goto err; ar_usb->ar = ar; ar->dev_id = product_id;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 188/346 ath10k: Release some resources in an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ]
Should an error occur after calling 'ath10k_usb_create()', it should be undone by a corresponding 'ath10k_usb_destroy()' call
--- drivers/net/wireless/ath/ath10k/usb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/usb.c +4 -1
@@ -1032,7 +1032,7 @@ static int ath10k_usb_probe(struct usb_interface *interface, ret =ath10k_core_register (ar, chip_id);if (ret) {ath10k_warn (ar,"failed to register driver core: %d\n" , ret); - goto err; + goto err_usb_destroy; }/* TODO: remove this once USB support is fully implemented */
@@ -1040,6 +1040,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,return 0 ; +err_usb_destroy: +ath10k_usb_destroy (ar); + err:ath10k_core_destroy (ar);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 189/346 NFSv4.2: condition READDIRs mask for security label based on LSM state
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]
Currently, the client will always ask for security_labels if the server returns that it supports that feature regardless of any LSM modules (such as Selinux) enforcing security policy. This adds performance penalty to the READDIR operation.
Client adjusts superblock's support of the security_label based on the server's support but also current client's configuration of the LSM modules. Thus, prior to using the default bitmask in READDIR, this patch checks the server's capabilities and then instructs READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.
v5: fixing silly mistakes of the rushed v4
v4: simplifying logic
v3: changing label's initialization per Ondrej's comment
v2: dropping selinux hook and using the sb cap.
--- fs/nfs/nfs4proc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/nfs/nfs4proc.c +8 -2
@@ -4687,12 +4687,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred, u64 cookie, struct page **pages, unsigned int count, bool plus) { struct inode *dir = d_inode(dentry); +struct nfs_server *server =NFS_SERVER (dir);struct nfs4_readdir_arg args = { .fh =NFS_FH (dir), .pages = pages, .pgbase =0 , .count = count, - .bitmask =NFS_SERVER (d_inode (dentry))->attr_bitmask, .plus = plus, };struct nfs4_readdir_res res;
@@ -4707,9 +4707,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,dprintk ("%s: dentry = %pd2, cookie = %Lu\n" , __func__, dentry, (unsigned long long )cookie); +if (!(server->caps &NFS_CAP_SECURITY_LABEL )) + args.bitmask = server->attr_bitmask_nl; +else + args.bitmask = server->attr_bitmask; +nfs4_setup_readdir (cookie,NFS_I (dir)->cookieverf, dentry, &args); res.pgbase = args.pgbase; - status =nfs4_call_sync (NFS_SERVER (dir)->client,NFS_SERVER (dir), &msg, &args.seq_args, &res.seq_res,0 ); + status =nfs4_call_sync (server->client, server, &msg, &args.seq_args, + &res.seq_res,0 );if (status >=0 ) {memcpy (NFS_I (dir)->cookieverf, res.verifier.data,NFS4_VERIFIER_SIZE ); status += args.pgbase;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 190/346 SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ]
According to RFC5666, the correct netid for an IPv6 addressed RDMA transport is "rdma6", which we've supported as a mount option since Linux-4.7. The problem is when we try to load the module "xprtrdma6", that will fail, since there is no modulealias of that name.
--- include/linux/sunrpc/xprt.h | 1 + net/sunrpc/xprt.c | 65 +++++++++++++++++++++++++-------- net/sunrpc/xprtrdma/module.c | 1 + net/sunrpc/xprtrdma/transport.c | 1 + net/sunrpc/xprtsock.c | 4 ++ 5 files changed, 56 insertions(+), 16 deletions(-)
include/linux/sunrpc/xprt.h +1 -0
@@ -317,6 +317,7 @@ struct xprt_class {struct rpc_xprt * (*setup)(struct xprt_create *);struct module *owner;char name[32 ]; +const char * netid[]; };/*
net/sunrpc/xprt.c +49 -16
80 lines not on this page · raw message
net/sunrpc/xprtrdma/module.c +1 -0
@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");MODULE_LICENSE ("Dual BSD/GPL" );MODULE_ALIAS ("svcrdma" );MODULE_ALIAS ("xprtrdma" ); +MODULE_ALIAS ("rpcrdma6" ); static void __exit rpc_rdma_cleanup(void) {
net/sunrpc/xprtrdma/transport.c +1 -0
@@ -854,6 +854,7 @@ static struct xprt_class xprt_rdma = { .owner = THIS_MODULE, .ident = XPRT_TRANSPORT_RDMA, .setup = xprt_setup_rdma, + .netid = { "rdma", "rdma6", "" }, }; void xprt_rdma_cleanup(void)
net/sunrpc/xprtsock.c +4 -0
@@ -3241,6 +3241,7 @@ static struct xprt_class xs_local_transport = { .owner = THIS_MODULE, .ident = XPRT_TRANSPORT_LOCAL, .setup = xs_setup_local, + .netid = { "" }, }; static struct xprt_class xs_udp_transport = {
@@ -3249,6 +3250,7 @@ static struct xprt_class xs_udp_transport = { .owner = THIS_MODULE, .ident = XPRT_TRANSPORT_UDP, .setup = xs_setup_udp, + .netid = { "udp", "udp6", "" }, }; static struct xprt_class xs_tcp_transport = {
@@ -3257,6 +3259,7 @@ static struct xprt_class xs_tcp_transport = { .owner = THIS_MODULE, .ident = XPRT_TRANSPORT_TCP, .setup = xs_setup_tcp, + .netid = { "tcp", "tcp6", "" }, }; static struct xprt_class xs_bc_tcp_transport = {
@@ -3265,6 +3268,7 @@ static struct xprt_class xs_bc_tcp_transport = { .owner = THIS_MODULE, .ident = XPRT_TRANSPORT_BC_TCP, .setup = xs_setup_bc_tcp, + .netid = { "" }, }; /**
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 191/346 lockd: dont use interval-based rebinding over TCP
In reply to Greg Kroah-HartmanFrom: Calum Mackay <[email protected]>
[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]
NLM uses an interval-based rebinding, i.e. it clears the transport's binding under certain conditions if more than 60 seconds have elapsed since the connection was last bound.
This rebinding is not necessary for an autobind RPC client over a connection-oriented protocol like TCP.
It can also cause problems: it is possible for nlm_bind_host() to clear XPRT_BOUND whilst a connection worker is in the middle of trying to reconnect, after it had already been checked in xprt_connect().
When the connection worker notices that XPRT_BOUND has been cleared under it, in xs_tcp_finish_connecting(), that results in:
xs_tcp_setup_socket: connect returned unhandled error -107
Worse, it's possible that the two can get into lockstep, resulting in the same behaviour repeated indefinitely, with the above error every 300 seconds, without ever recovering, and the connection never being established. This has been seen in practice, with a large number of NLM client tasks, following a server restart.
The existing callers of nlm_bind_host & nlm_rebind_host should not need to force the rebind, for TCP, so restrict the interval-based rebinding to UDP only.
For TCP, we will still rebind when needed, e.g. on timeout, and connection error (including closure), since connection-related errors on an existing connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(), already unconditionally clear XPRT_BOUND.
To avoid having to add the fix, and explanation, to both nlm_bind_host() and nlm_rebind_host(), remove the duplicate code from the former, and have it call the latter.
Drop the dprintk, which adds no value over a trace.
--- fs/lockd/host.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
fs/lockd/host.c +11 -9
@@ -432,12 +432,7 @@ nlm_bind_host(struct nlm_host *host)* RPC rebind is required */ if ((clnt = host->h_rpcclnt) !=NULL ) { -if (time_after_eq (jiffies, host->h_nextrebind)) { -rpc_force_rebind (clnt); - host->h_nextrebind = jiffies +NLM_HOST_REBIND ; -dprintk ("lockd: next rebind in %lu jiffies\n" , - host->h_nextrebind - jiffies); - } +nlm_rebind_host (host); }else {unsigned long increment = nlmsvc_timeout;struct rpc_timeout timeparms = {
@@ -485,13 +480,20 @@ nlm_bind_host(struct nlm_host *host)return clnt; } -/* -* Force a portmap lookup of the remote lockd port +/** +* nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port +* @host: NLM host handle for peer +* +* This is not needed when using a connection-oriented protocol, such as TCP. +* The existing autobind mechanism is sufficient to force a rebind when +* required, e.g. on connection state transitions. */ void nlm_rebind_host (struct nlm_host *host) { -dprintk ("lockd: rebind host %s\n" , host->h_name); +if (host->h_proto !=IPPROTO_UDP ) +return ; +if (host->h_rpcclnt &&time_after_eq (jiffies, host->h_nextrebind)) {rpc_force_rebind (host->h_rpcclnt); host->h_nextrebind = jiffies +NLM_HOST_REBIND ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 192/346 NFS: switch nfsiod to be an UNBOUND workqueue.
In reply to Greg Kroah-HartmanFrom: NeilBrown <[email protected]>
[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]
nfsiod is currently a concurrency-managed workqueue (CMWQ). This means that workitems scheduled to nfsiod on a given CPU are queued behind all other work items queued on any CMWQ on the same CPU. This can introduce unexpected latency.
Occaionally nfsiod can even cause excessive latency. If the work item to complete a CLOSE request calls the final iput() on an inode, the address_space of that inode will be dismantled. This takes time proportional to the number of in-memory pages, which on a large host working on large files (e.g.. 5TB), can be a large number of pages resulting in a noticable number of seconds.
We can avoid these latency problems by switching nfsiod to WQ_UNBOUND. This causes each concurrent work item to gets a dedicated thread which can be scheduled to an idle CPU.
There is precedent for this as several other filesystems use WQ_UNBOUND workqueue for handling various async events.
--- fs/nfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/inode.c +1 -1
@@ -2142,7 +2142,7 @@ static int nfsiod_start(void) {struct workqueue_struct *wq;dprintk ("RPC: creating workqueue nfsiod\n" ); - wq =alloc_workqueue ("nfsiod" ,WQ_MEM_RECLAIM ,0 ); + wq =alloc_workqueue ("nfsiod" ,WQ_MEM_RECLAIM |WQ_UNBOUND ,0 );if (wq ==NULL )return -ENOMEM ; nfsiod_workqueue = wq;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 193/346 vfio-pci: Use io_remap_pfn_range() for PCI IO memory
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ]
commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped BAR space into userspace to work correctly on AMD SME systems that default to all memory encrypted.
Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it should be calling io_remap_pfn_range() otherwise it will not work on SME systems.
--- drivers/vfio/pci/vfio_pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/vfio/pci/vfio_pci.c +2 -2
@@ -1380,8 +1380,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)mutex_unlock (&vdev->vma_lock); -if (remap_pfn_range (vma, vma->vm_start, vma->vm_pgoff, - vma->vm_end - vma->vm_start, vma->vm_page_prot)) +if (io_remap_pfn_range (vma, vma->vm_start, vma->vm_pgoff, + vma->vm_end - vma->vm_start, vma->vm_page_prot)) ret =VM_FAULT_SIGBUS ; up_out:
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 194/346 media: saa7146: fix array overflow in vidioc_s_audio()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]
The "a->index" value comes from the user via the ioctl. The problem is that the shift can wrap resulting in setting "mxb->cur_audinput" to an invalid value, which later results in an array overflow.
--- drivers/media/pci/saa7146/mxb.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/media/pci/saa7146/mxb.c +10 -9
@@ -653,16 +653,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *struct mxb *mxb = (struct mxb *)dev->ext_priv;DEB_D ("VIDIOC_S_AUDIO %d\n" , a->index); -if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) { -if (mxb->cur_audinput != a->index) { - mxb->cur_audinput = a->index; -tea6420_route (mxb, a->index); -if (mxb->cur_audinput ==0 ) -mxb_update_audmode (mxb); - } -return 0 ; +if (a->index >=32 || + !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index))) +return -EINVAL ; + +if (mxb->cur_audinput != a->index) { + mxb->cur_audinput = a->index; +tea6420_route (mxb, a->index); +if (mxb->cur_audinput ==0 ) +mxb_update_audmode (mxb); } -return -EINVAL ; +return 0 ; }#ifdef CONFIG_VIDEO_ADV_DEBUG
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 195/346 clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ]
If clk_notifier_register() failed, ttc_setup_clockevent() will return without freeing 'ttcce', which will leak memory.
--- drivers/clocksource/cadence_ttc_timer.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/clocksource/cadence_ttc_timer.c +9 -9
@@ -419,10 +419,8 @@ static int __init ttc_setup_clockevent(struct clk *clk, ttcce->ttc.clk = clk; err =clk_prepare_enable (ttcce->ttc.clk); -if (err) { -kfree (ttcce); -return err; - } +if (err) + goto out_kfree; ttcce->ttc.clk_rate_change_nb.notifier_call = ttc_rate_change_clockevent_cb;
@@ -432,7 +430,7 @@ static int __init ttc_setup_clockevent(struct clk *clk, &ttcce->ttc.clk_rate_change_nb);if (err) {pr_warn ("Unable to register clock notifier.\n" ); -return err; + goto out_kfree; } ttcce->ttc.freq =clk_get_rate (ttcce->ttc.clk);
@@ -461,15 +459,17 @@ static int __init ttc_setup_clockevent(struct clk *clk, err =request_irq (irq, ttc_clock_event_interrupt,IRQF_TIMER , ttcce->ce.name, ttcce); -if (err) { -kfree (ttcce); -return err; - } +if (err) + goto out_kfree;clockevents_config_and_register (&ttcce->ce, ttcce->ttc.freq /PRESCALE ,1 ,0xfffe );return 0 ; + +out_kfree: +kfree (ttcce); +return err; }/**
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 196/346 ARM: dts: at91: sama5d2: map securam as device
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ]
Due to strobe signal not being propagated from CPU to securam the securam needs to be mapped as device or strongly ordered memory to work properly. Otherwise, updating to one offset may affect the adjacent locations in securam.
--- arch/arm/boot/dts/sama5d2.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/sama5d2.dtsi +1 -0
@@ -1247,6 +1247,7 @@ clocks = <&securam_clk>; #address-cells = <1>; #size-cells = <1>; + no-memory-wc; ranges = <0 0xf8044000 0x1420>; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 197/346 pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]
if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have a corresponding put_device(). Thus add put_device() to fix the exception handling for this function implementation.
--- drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/pinctrl/pinctrl-falcon.c +9 -5
@@ -438,24 +438,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)/* load and remap the pad resources of the different banks */ for_each_compatible_node (np,NULL ,"lantiq,pad-falcon" ) { -struct platform_device *ppdev =of_find_device_by_node (np);const __be32 *bank =of_get_property (np,"lantiq,bank" ,NULL );struct resource res; +struct platform_device *ppdev;u32 avail;int pins;if (!of_device_is_available (np))continue ; -if (!ppdev) { -dev_err (&pdev->dev,"failed to find pad pdev\n" ); -continue ; - }if (!bank || *bank >=PORTS )continue ;if (of_address_to_resource (np,0 , &res))continue ; + + ppdev =of_find_device_by_node (np); +if (!ppdev) { +dev_err (&pdev->dev,"failed to find pad pdev\n" ); +continue ; + } + falcon_info.clk[*bank] =clk_get (&ppdev->dev,NULL ); +put_device (&ppdev->dev);if (IS_ERR (falcon_info.clk[*bank])) {dev_err (&ppdev->dev,"failed to get clock\n" );return PTR_ERR (falcon_info.clk[*bank]);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 198/346 arm64: dts: rockchip: Fix UART pull-ups on rk3328
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ]
For UARTs, the local pull-ups should be on the RX pin, not the TX pin. UARTs transmit active-low, so a disconnected RX pin should be pulled high instead of left floating to prevent noise being interpreted as transmissions.
This gets rid of bogus sysrq events when the UART console is not connected.
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +8 -8
@@ -1085,8 +1085,8 @@ uart0 { uart0_xfer: uart0-xfer { - rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>, - <1 RK_PB0 1 &pcfg_pull_none>; + rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>, + <1 RK_PB0 1 &pcfg_pull_up>; }; uart0_cts: uart0-cts {
@@ -1104,8 +1104,8 @@ uart1 { uart1_xfer: uart1-xfer { - rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>, - <3 RK_PA6 4 &pcfg_pull_none>; + rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>, + <3 RK_PA6 4 &pcfg_pull_up>; }; uart1_cts: uart1-cts {
@@ -1123,15 +1123,15 @@ uart2-0 { uart2m0_xfer: uart2m0-xfer { - rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>, - <1 RK_PA1 2 &pcfg_pull_none>; + rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>, + <1 RK_PA1 2 &pcfg_pull_up>; }; }; uart2-1 { uart2m1_xfer: uart2m1-xfer { - rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>, - <2 RK_PA1 1 &pcfg_pull_none>; + rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>, + <2 RK_PA1 1 &pcfg_pull_up>; }; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 199/346 memstick: r592: Fix error return in r592_probe()
In reply to Greg Kroah-HartmanFrom: Jing Xiangfeng <[email protected]>
[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]
Fix to return a error code from the error handling case instead of 0.
--- drivers/memstick/host/r592.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/memstick/host/r592.c +8 -4
@@ -762,8 +762,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto error3; dev->mmio =pci_ioremap_bar (pdev,0 ); -if (!dev->mmio) +if (!dev->mmio) { + error = -ENOMEM ; goto error4; + } dev->irq = pdev->irq;spin_lock_init (&dev->irq_lock);
@@ -789,12 +791,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id) &dev->dummy_dma_page_physical_address, GFP_KERNEL);r592_stop_dma (dev ,0 ); -if (request_irq (dev->irq, &r592_irq,IRQF_SHARED , -DRV_NAME , dev)) + error =request_irq (dev->irq, &r592_irq,IRQF_SHARED , +DRV_NAME , dev); +if (error) goto error6;r592_update_card_detect (dev); -if (memstick_add_host (host)) + error =memstick_add_host (host); +if (error) goto error7;message ("driver successfully loaded" );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 200/346 net/mlx5: Properly convey driver version to firmware
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ]
mlx5 firmware expects driver version in specific format X.X.X, so make it always correct and based on real kernel version aligned with the driver.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +5 -1
@@ -51,6 +51,7 @@#ifdef CONFIG_RFS_ACCEL #include <linux/cpu_rmap.h> #endif +#include <linux/version.h> #include <net/devlink.h> #include "mlx5_core.h" #include "fs_core.h"
@@ -211,7 +212,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)strncat (string,"," , remaining_size); remaining_size =max_t (int,0 , driver_ver_sz -strlen (string)); -strncat (string,DRIVER_VERSION , remaining_size); + +snprintf (string +strlen (string), remaining_size,"%u.%u.%u" , + (u8)((LINUX_VERSION_CODE >>16 ) &0xff ), (u8)((LINUX_VERSION_CODE >>8 ) &0xff ), + (u16)(LINUX_VERSION_CODE &0xffff ));/*Send the command*/ MLX5_SET(set_driver_version_in, in, opcode,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 201/346 ASoC: jz4740-i2s: add missed checks for clk_get()
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]
jz4740_i2s_set_sysclk() does not check the return values of clk_get(), while the file dereferences the pointers in clk_put().
Add the missed checks to fix it.
--- sound/soc/jz4740/jz4740-i2s.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/jz4740/jz4740-i2s.c +4 -0
@@ -318,10 +318,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,switch (clk_id) {case JZ4740_I2S_CLKSRC_EXT : parent =clk_get (NULL ,"ext" ); +if (IS_ERR (parent)) +return PTR_ERR (parent);clk_set_parent (i2s->clk_i2s, parent);break ;case JZ4740_I2S_CLKSRC_PLL : parent =clk_get (NULL ,"pll half" ); +if (IS_ERR (parent)) +return PTR_ERR (parent);clk_set_parent (i2s->clk_i2s, parent); ret =clk_set_rate (i2s->clk_i2s, freq);break ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 202/346 dm ioctl: fix error return code in target_message
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/md/dm-ioctl.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-ioctl.c +1 -0
@@ -1575,6 +1575,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t paraif (!argc) {DMWARN ("Empty message received." ); + r = -EINVAL ; goto out_argv; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 203/346 clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
In reply to Greg Kroah-HartmanFrom: Keqian Zhu <[email protected]>
[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]
ARM virtual counter supports event stream, it can only trigger an event when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes, so the actual period of event stream is 2^(cntkctl_evnti + 1). For example, when the trigger bit is 0, then virtual counter trigger an event for every two cycles.
While we're at it, rework the way we compute the trigger bit position by making it more obvious that when bits [n:n-1] are both set (with n being the most significant bit), we pick bit (n + 1).
--- drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/arm_arch_timer.c +16 -7
@@ -827,15 +827,24 @@ static void arch_timer_evtstrm_enable(int divider)static void arch_timer_configure_evtstream (void ) { -int evt_stream_div, pos; +int evt_stream_div, lsb; + +/* +* As the event stream can at most be generated at half the frequency +* of the counter, use half the frequency when computing the divider. +*/ + evt_stream_div = arch_timer_rate /ARCH_TIMER_EVT_STREAM_FREQ /2 ; + +/* +* Find the closest power of two to the divisor. If the adjacent bit +* of lsb (last set bit, starts from 0) is set, then we use (lsb + 1). +*/ + lsb =fls (evt_stream_div) -1 ; +if (lsb >0 && (evt_stream_div &BIT (lsb -1 ))) + lsb++; -/* Find the closest power of two to the divisor */ - evt_stream_div = arch_timer_rate /ARCH_TIMER_EVT_STREAM_FREQ ; - pos =fls (evt_stream_div); -if (pos >1 && !(evt_stream_div & (1 << (pos -2 )))) - pos--;/* enable event stream */ -arch_timer_evtstrm_enable (min (pos,15 )); +arch_timer_evtstrm_enable (max (0 ,min (lsb,15 ))); }static void arch_counter_set_user_access (void )
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 204/346 cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this cpufreq driver when it is compiled as an external module.
--- drivers/cpufreq/highbank-cpufreq.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/cpufreq/highbank-cpufreq.c +7 -0
@@ -104,6 +104,13 @@ out_put_node: }module_init (hb_cpufreq_driver_init); +static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = { + { .compatible ="calxeda,highbank" }, + { .compatible ="calxeda,ecx-2000" }, + { }, +}; +MODULE_DEVICE_TABLE (of, hb_cpufreq_of_match); +MODULE_AUTHOR ("Mark Langsdorf <[email protected]>" );MODULE_DESCRIPTION ("Calxeda Highbank cpufreq driver" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 205/346 cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this cpufreq driver when it is compiled as an external module.
--- drivers/cpufreq/mediatek-cpufreq.c | 1 + 1 file changed, 1 insertion(+)
drivers/cpufreq/mediatek-cpufreq.c +1 -0
@@ -554,6 +554,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = { { } }; +MODULE_DEVICE_TABLE (of, mtk_cpufreq_machines);static int __init mtk_cpufreq_driver_init (void ) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 206/346 cpufreq: st: Add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this cpufreq driver when it is compiled as an external module.
--- drivers/cpufreq/sti-cpufreq.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/cpufreq/sti-cpufreq.c +7 -0
@@ -295,6 +295,13 @@ register_cpufreq_dt: }module_init (sti_cpufreq_init); +static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = { + { .compatible ="st,stih407" }, + { .compatible ="st,stih410" }, + { }, +}; +MODULE_DEVICE_TABLE (of, sti_cpufreq_of_match); +MODULE_DESCRIPTION ("STMicroelectronics CPUFreq/OPP driver" );MODULE_AUTHOR ("Ajitpal Singh <[email protected]>" );MODULE_AUTHOR ("Lee Jones <[email protected]>" );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 207/346 cpufreq: loongson1: Add missing MODULE_ALIAS
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ]
This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq driver when it is compiled as an external module.
--- drivers/cpufreq/loongson1-cpufreq.c | 1 + 1 file changed, 1 insertion(+)
drivers/cpufreq/loongson1-cpufreq.c +1 -0
@@ -217,6 +217,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {module_platform_driver (ls1x_cpufreq_platdrv); +MODULE_ALIAS ("platform:ls1x-cpufreq" );MODULE_AUTHOR ("Kelvin Cheung <[email protected]>" );MODULE_DESCRIPTION ("Loongson1 CPUFreq driver" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 208/346 cpufreq: scpi: Add missing MODULE_ALIAS
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ]
This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq driver when it is compiled as an external module.
--- drivers/cpufreq/scpi-cpufreq.c | 1 + 1 file changed, 1 insertion(+)
drivers/cpufreq/scpi-cpufreq.c +1 -0
@@ -246,6 +246,7 @@ static struct platform_driver scpi_cpufreq_platdrv = { };module_platform_driver (scpi_cpufreq_platdrv); +MODULE_ALIAS ("platform:scpi-cpufreq" );MODULE_AUTHOR ("Sudeep Holla <[email protected]>" );MODULE_DESCRIPTION ("ARM SCPI CPUFreq interface driver" );MODULE_LICENSE ("GPL v2" );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 209/346 scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ]
Add the missing destroy_workqueue() before return from __qedi_probe in the error handling case when fails to create workqueue qedi->offload_thread.
--- drivers/scsi/qedi/qedi_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/qedi/qedi_main.c +3 -1
@@ -2580,7 +2580,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)QEDI_ERR (&qedi->dbg_ctx,"Unable to start offload thread!\n" ); rc = -ENODEV ; - goto free_cid_que; + goto free_tmf_thread; }/* F/w needs 1st task context memory entry for performance */
@@ -2600,6 +2600,8 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)return 0 ; +free_tmf_thread: +destroy_workqueue (qedi->tmf_thread); free_cid_que:qedi_release_cid_que (qedi); free_uio:
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 210/346 scsi: pm80xx: Fix error return in pm8001_pci_probe()
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ]
The driver did not return an error in the case where pm8001_configure_phy_settings() failed.
Use rc to store the return value of pm8001_configure_phy_settings().
--- drivers/scsi/pm8001/pm8001_init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_init.c +2 -1
@@ -1059,7 +1059,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,pm8001_init_sas_add (pm8001_ha);/* phy setting support for motherboard controller */ -if (pm8001_configure_phy_settings (pm8001_ha)) + rc =pm8001_configure_phy_settings (pm8001_ha); +if (rc) goto err_out_shost;pm8001_post_sas_ha_init (shost, chip);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 211/346 seq_buf: Avoid type mismatch for seq_buf_init
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ]
Building with W=2 prints a number of warnings for one function that has a pointer type mismatch:
linux/seq_buf.h: In function 'seq_buf_init':linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]
Change the type in the function prototype according to the type in the structure.
--- include/linux/seq_buf.h | 2 +- include/linux/trace_seq.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
include/linux/seq_buf.h +1 -1
@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s) }static inline void -seq_buf_init (struct seq_buf *s,unsigned char *buf,unsigned int size) +seq_buf_init (struct seq_buf *s,char *buf,unsigned int size) { s->buffer = buf; s->size = size;
include/linux/trace_seq.h +2 -2
@@ -12,7 +12,7 @@*/ struct trace_seq { -unsigned char buffer[PAGE_SIZE ]; +char buffer[PAGE_SIZE ];struct seq_buf seq;int full; };
@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s)* that is about to be written to and then return the result * of that write. */ -static inline unsigned char * +static inline char *trace_seq_buffer_ptr (struct trace_seq *s) {return s->buffer +seq_buf_used (&s->seq);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 212/346 scsi: fnic: Fix error return code in fnic_probe()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]
Return a negative error code from the error handling case instead of 0 as done elsewhere in this function.
--- drivers/scsi/fnic/fnic_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/fnic/fnic_main.c +1 -0
@@ -746,6 +746,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)for (i =0 ; i <FNIC_IO_LOCKS ; i++)spin_lock_init (&fnic->io_req_lock[i]); + err = -ENOMEM ; fnic->io_req_pool =mempool_create_slab_pool (2 , fnic_io_req_cache);if (!fnic->io_req_pool) goto err_out_free_resources;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 213/346 platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit ba4939f1dd46dde08c2f9b9d7ac86ed3ea7ead86 ]
Fix array names to match assignments for data items and data items counter in 'mlxplat_mlxcpld_default_items' structure for:
.data = mlxplat_mlxcpld_default_pwr_items_data, .count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
and
.data = mlxplat_mlxcpld_default_fan_items_data, .count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
Replace:
- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for ARRAY_SIZE() calculation.
- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data' for ARRAY_SIZE() calculation.
--- drivers/platform/x86/mlx-platform.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/mlx-platform.c +2 -2
@@ -333,7 +333,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = { .aggr_mask = MLXPLAT_CPLD_AGGR_PWR_MASK_DEF, .reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET, .mask = MLXPLAT_CPLD_PWR_MASK, - .count = ARRAY_SIZE(mlxplat_mlxcpld_pwr), + .count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data), .inversed = 0, .health = false, },
@@ -342,7 +342,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = { .aggr_mask = MLXPLAT_CPLD_AGGR_FAN_MASK_DEF, .reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET, .mask = MLXPLAT_CPLD_FAN_MASK, - .count = ARRAY_SIZE(mlxplat_mlxcpld_fan), + .count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data), .inversed = 1, .health = false, },
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 214/346 powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ]
There are three ways pseries_suspend_begin() can be reached:
1. When "mem" is written to /sys/power/state:
kobj_attr_store()
-> state_store()
-> pm_suspend()
-> suspend_devices_and_enter()
-> pseries_suspend_begin()This never works because there is no way to supply a valid stream id using this interface, and H_VASI_STATE is called with a stream id of zero. So this call path is useless at best.
2. When a stream id is written to /sys/devices/system/power/hibernate. pseries_suspend_begin() is polled directly from store_hibernate() until the stream is in the "Suspending" state (i.e. the platform is ready for the OS to suspend execution):
dev_attr_store()
-> store_hibernate()
-> pseries_suspend_begin()
3. When a stream id is written to /sys/devices/system/power/hibernate (continued). After #2, pseries_suspend_begin() is called once again from the pm core:
dev_attr_store()
-> store_hibernate()
-> pm_suspend()
-> suspend_devices_and_enter()
-> pseries_suspend_begin()This is redundant because the VASI suspend state is already known to be Suspending.
The begin() callback of platform_suspend_ops is optional, so we can simply remove that assignment with no loss of function.
--- arch/powerpc/platforms/pseries/suspend.c | 1 - 1 file changed, 1 deletion(-)
arch/powerpc/platforms/pseries/suspend.c +0 -1
@@ -223,7 +223,6 @@ static struct bus_type suspend_subsys = {static const struct platform_suspend_ops pseries_suspend_ops = { .valid = suspend_valid_only_mem, - .begin = pseries_suspend_begin, .prepare_late = pseries_prepare_late, .enter = pseries_suspend_enter, };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 215/346 powerpc/pseries/hibernation: remove redundant cacheinfo update
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ]
Partitions with cache nodes in the device tree can encounter the following warning on resume:
CPU 0 already accounted in PowerPC,POWER9@0(Data)
WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820
These calls to cacheinfo_cpu_offline/online have been redundant since commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration").
--- arch/powerpc/platforms/pseries/suspend.c | 3 --- 1 file changed, 3 deletions(-)
arch/powerpc/platforms/pseries/suspend.c +0 -3
@@ -26,7 +26,6 @@#include <asm/mmu.h> #include <asm/rtas.h> #include <asm/topology.h> -#include "../../kernel/cacheinfo.h" static u64 stream_id;static struct device suspend_dev;
@@ -91,9 +90,7 @@ static void pseries_suspend_enable_irqs(void)* Update configuration which can be modified based on device tree * changes during resume. */ -cacheinfo_cpu_offline (smp_processor_id ());post_mobility_fixup (); -cacheinfo_cpu_online (smp_processor_id ()); }/**
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 216/346 usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ]
The pm_runtime_enable will decrement the power disable depth. Imbalance depth will resulted in enabling runtime PM of device fails later. Thus a pairing decrement must be needed on the error handling path to keep it balanced.
--- drivers/usb/host/ehci-omap.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/ehci-omap.c +1 -0
@@ -222,6 +222,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev) err_pm_runtime:pm_runtime_put_sync (dev); +pm_runtime_disable (dev); err_phy:for (i =0 ; i < omap->nports; i++) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 217/346 usb: oxu210hp-hcd: Fix memory leak in oxu_create
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ]
usb_create_hcd will alloc memory for hcd, and we should call usb_put_hcd to free it when adding fails to prevent memory leak.
--- drivers/usb/host/oxu210hp-hcd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/oxu210hp-hcd.c +3 -1
@@ -3719,8 +3719,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev, oxu->is_otg = otg; ret =usb_add_hcd (hcd, irq,IRQF_SHARED ); -if (ret <0 ) +if (ret <0 ) { +usb_put_hcd (hcd);return ERR_PTR (ret); + }device_wakeup_enable (hcd->self.controller);return hcd;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 218/346 speakup: fix uninitialized flush_lock
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ]
The flush_lock is uninitialized, use DEFINE_SPINLOCK to define and initialize flush_lock.
--- drivers/staging/speakup/speakup_dectlk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/speakup/speakup_dectlk.c +1 -1
@@ -37,7 +37,7 @@ static unsigned char get_index(struct spk_synth *synth);static int in_escape;static int is_flushing; -static spinlock_t flush_lock; +static DEFINE_SPINLOCK (flush_lock);static DECLARE_WAIT_QUEUE_HEAD (flush);static struct var_t vars[] = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 219/346 nfsd: Fix message level for normal termination
In reply to Greg Kroah-HartmanFrom: kazuo ito <[email protected]>
[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ]
The warning message from nfsd terminating normally can confuse system adminstrators or monitoring software.
Though it's not exactly fair to pin-point a commit where it originated, the current form in the current place started to appear in:
--- fs/nfsd/nfssvc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/nfsd/nfssvc.c +1 -2
@@ -417,8 +417,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)return ;nfsd_shutdown_net (net); -printk (KERN_WARNING "nfsd: last server has exited, flushing export " -"cache\n" ); +pr_info ("nfsd: last server has exited, flushing export cache\n" );nfsd_export_flush (net); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 220/346 nfs_common: need lock during iterate through the list
In reply to Greg Kroah-HartmanFrom: Cheng Lin <[email protected]>
[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]
If the elem is deleted during be iterated on it, the iteration process will fall into an endless loop.
kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]
PID: 17137 TASK: ffff8818d93c0000 CPU: 4 COMMAND: "nfsd" [exception RIP: __state_in_grace+76]
RIP: ffffffffc00e817c RSP: ffff8818d3aefc98 RFLAGS: 00000246 RAX: ffff881dc0c38298 RBX: ffffffff81b03580 RCX: ffff881dc02c9f50 RDX: ffff881e3fce8500 RSI: 0000000000000001 RDI: ffffffff81b03580 RBP: ffff8818d3aefca0 R8: 0000000000000020 R9: ffff8818d3aefd40 R10: ffff88017fc03800 R11: ffff8818e83933c0 R12: ffff8818d3aefd40 R13: 0000000000000000 R14: ffff8818e8391068 R15: ffff8818fa6e4000 CS: 0010 SS: 0018
#0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace] #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd] #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
#3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd] #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd] #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc] #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc] #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
#8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
#9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607
The troublemake elem:
crash> lock_manager ffff881dc0c38298
struct lock_manager {
list = {
next = 0xffff881dc0c38298,
prev = 0xffff881dc0c38298
},
block_opens = false
}
--- fs/nfs_common/grace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/nfs_common/grace.c +5 -1
@@ -68,10 +68,14 @@ __state_in_grace(struct net *net, bool open)if (!open)return !list_empty (grace_list); +spin_lock (&grace_lock);list_for_each_entry (lm, grace_list, list) { -if (lm->block_opens) +if (lm->block_opens) { +spin_unlock (&grace_lock);return true; + } } +spin_unlock (&grace_lock);return false; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 221/346 x86/kprobes: Restore BTF if the single-stepping is cancelled
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ]
Fix to restore BTF if single-stepping causes a page fault and it is cancelled.
Usually the BTF flag was restored when the single stepping is done (in resume_execution()). However, if a page fault happens on the single stepping instruction, the fault handler is invoked and the single stepping is cancelled. Thus, the BTF flag is not restored.
--- arch/x86/kernel/kprobes/core.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/x86/kernel/kprobes/core.c +5 -0
@@ -1041,6 +1041,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)* So clear it by resetting the current kprobe: */ regs->flags &= ~X86_EFLAGS_TF ; +/* +* Since the single step (trap) has been cancelled, +* we need to restore BTF here. +*/ +restore_btf ();/* * If the TF flag was set before the kprobe hit,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 222/346 bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 3d70fb03711c37bc64e8e9aea5830f498835f6bf ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/bus/fsl-mc/fsl-mc-allocator.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/bus/fsl-mc/fsl-mc-allocator.c +3 -1
@@ -292,8 +292,10 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev, goto error; mc_adev = resource->data; -if (!mc_adev) +if (!mc_adev) { + error = -EINVAL ; goto error; + } *new_mc_adev = mc_adev;return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 223/346 clk: tegra: Fix duplicated SE clock entry
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ]
The periph_clks[] array contains duplicated entry for Security Engine clock which was meant to be defined for T210, but it wasn't added properly. This patch corrects the T210 SE entry and fixes the following error message on T114/T124: "Tegra clk 127: register failed with -17".
Tested-by Nicolas Chauvet <[email protected]>
Reported-by Nicolas Chauvet <[email protected]>
--- drivers/clk/tegra/clk-id.h | 1 + drivers/clk/tegra/clk-tegra-periph.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/clk/tegra/clk-id.h +1 -0
@@ -233,6 +233,7 @@ enum clk_id { tegra_clk_sdmmc4, tegra_clk_sdmmc4_8, tegra_clk_se, + tegra_clk_se_10, tegra_clk_soc_therm, tegra_clk_soc_therm_8, tegra_clk_sor0,
drivers/clk/tegra/clk-tegra-periph.c +1 -1
@@ -650,7 +650,7 @@ static struct tegra_periph_init_data periph_clks[] = {INT8 ("host1x" , mux_pllm_pllc2_c_c3_pllp_plla,CLK_SOURCE_HOST1X ,28 ,0 , tegra_clk_host1x_8),INT8 ("host1x" , mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0,CLK_SOURCE_HOST1X ,28 ,0 , tegra_clk_host1x_9),INT8 ("se" , mux_pllp_pllc2_c_c3_pllm_clkm,CLK_SOURCE_SE ,127 ,TEGRA_PERIPH_ON_APB , tegra_clk_se), -INT8 ("se" , mux_pllp_pllc2_c_c3_clkm,CLK_SOURCE_SE ,127 ,TEGRA_PERIPH_ON_APB , tegra_clk_se), +INT8 ("se" , mux_pllp_pllc2_c_c3_clkm,CLK_SOURCE_SE ,127 ,TEGRA_PERIPH_ON_APB , tegra_clk_se_10),INT8 ("2d" , mux_pllm_pllc2_c_c3_pllp_plla,CLK_SOURCE_2D ,21 ,0 , tegra_clk_gr2d_8),INT8 ("3d" , mux_pllm_pllc2_c_c3_pllp_plla,CLK_SOURCE_3D ,24 ,0 , tegra_clk_gr3d_8), INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03),
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 224/346 extcon: max77693: Fix modalias string
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ]
The platform device driver name is "max77693-muic", so advertise it properly in the modalias string. This fixes automated module loading when this driver is compiled as a module.
--- drivers/extcon/extcon-max77693.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/extcon/extcon-max77693.c +1 -1
@@ -1275,4 +1275,4 @@ module_platform_driver(max77693_muic_driver);MODULE_DESCRIPTION ("Maxim MAX77693 Extcon driver" );MODULE_AUTHOR ("Chanwoo Choi <[email protected]>" );MODULE_LICENSE ("GPL" ); -MODULE_ALIAS ("platform:extcon-max77693" ); +MODULE_ALIAS ("platform:max77693-muic" );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 225/346 mac80211: dont set set TDLS STA bandwidth wider than possible
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit f65607cdbc6b0da356ef5a22552ddd9313cf87a0 ]
When we set up a TDLS station, we set sta->sta.bandwidth solely based on the capabilities, because the "what's the current bandwidth" check is bypassed and only applied for other types of stations.
This leads to the unfortunate scenario that the sta->sta.bandwidth is 160 MHz if both stations support it, but we never actually configure this bandwidth unless the AP is already using 160 MHz; even for wider bandwidth support we only go up to 80 MHz (at least right now.)
For iwlwifi, this can also lead to firmware asserts, telling us that we've configured the TX rates for a higher bandwidth than is actually available due to the PHY configuration.
For non-TDLS, we check against the interface's requested bandwidth, but we explicitly skip this check for TDLS to cope with the wider BW case. Change this to
(a) still limit to the TDLS peer's own chandef, which gets factored into the overall PHY configuration we request from the driver, and
(b) limit it to when the TDLS peer is authorized, because it's only factored into the channel context in this case.
--- net/mac80211/vht.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/mac80211/vht.c +10 -4
@@ -421,12 +421,18 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)* IEEE80211-2016 specification makes higher bandwidth operation * possible on the TDLS link if the peers have wider bandwidth * capability. +* +* However, in this case, and only if the TDLS peer is authorized, +* limit to the tdls_chandef so that the configuration here isn't +* wider than what's actually requested on the channel context. */ if (test_sta_flag (sta,WLAN_STA_TDLS_PEER ) && -test_sta_flag (sta,WLAN_STA_TDLS_WIDER_BW )) -return bw; - - bw =min (bw,ieee80211_chan_width_to_rx_bw (bss_width)); +test_sta_flag (sta,WLAN_STA_TDLS_WIDER_BW ) && +test_sta_flag (sta,WLAN_STA_AUTHORIZED ) && + sta->tdls_chandef.chan) + bw =min (bw,ieee80211_chan_width_to_rx_bw (sta->tdls_chandef.width)); +else + bw =min (bw,ieee80211_chan_width_to_rx_bw (bss_width));return bw; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 226/346 ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ]
The error handling frees "ctl" but it's still on the "dsp->ctl_list" list so that could result in a use after free. Remove it from the list before returning.
--- sound/soc/codecs/wm_adsp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/wm_adsp.c +3 -2
@@ -1379,7 +1379,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp, ctl_work =kzalloc (sizeof (*ctl_work),GFP_KERNEL );if (!ctl_work) { ret = -ENOMEM ; - goto err_ctl_cache; + goto err_list_del; } ctl_work->dsp = dsp;
@@ -1389,7 +1389,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,return 0 ; -err_ctl_cache: +err_list_del: +list_del (&ctl->list);kfree (ctl->cache); err_ctl_name:kfree (ctl->name);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 227/346 irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ]
The alpine-msi driver has an interesting allocation error handling, where it frees the same interrupts repeatedly. Hilarity follows.
This code is probably never executed, but let's fix it nonetheless.
--- drivers/irqchip/irq-alpine-msi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/irqchip/irq-alpine-msi.c +1 -2
@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,return 0 ; err_sgi: -while (--i >=0 ) -irq_domain_free_irqs_parent (domain, virq, i); +irq_domain_free_irqs_parent (domain, virq, i -1 );alpine_msix_free_sgi (priv, sgi, nr_irqs);return err; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 228/346 watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ]
If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled, the build fails with the following error.
drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe':
sirfsoc_wdt.c:(.text+0x112):
undefined reference to `devm_platform_ioremap_resource'
--- drivers/watchdog/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/watchdog/Kconfig +1 -0
@@ -651,6 +651,7 @@ config MOXART_WDT config SIRFSOC_WATCHDOG tristate "SiRFSOC watchdog" + depends on HAS_IOMEM depends on ARCH_SIRF || COMPILE_TEST select WATCHDOG_CORE default y
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 229/346 watchdog: sprd: remove watchdog disable from resume fail path
In reply to Greg Kroah-HartmanFrom: Lingling Xu <[email protected]>
[ Upstream commit f61a59acb462840bebcc192f754fe71b6a16ff99 ]
sprd_wdt_start() would return fail if the loading operation is not completed in a certain time, disabling watchdog for that case would probably cause the kernel crash when kick watchdog later, that's too bad, so remove the watchdog disable operation for the fail case to make sure other parts in the kernel can run normally.
[ chunyan: Massaged changelog ]
--- drivers/watchdog/sprd_wdt.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/watchdog/sprd_wdt.c +2 -7
@@ -360,15 +360,10 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)if (ret)return ret; -if (watchdog_active (&wdt->wdd)) { +if (watchdog_active (&wdt->wdd)) ret =sprd_wdt_start (&wdt->wdd); -if (ret) { -sprd_wdt_disable (wdt); -return ret; - } - } -return 0 ; +return ret; }static const struct dev_pm_ops sprd_wdt_pm_ops = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 230/346 watchdog: sprd: check busy bit before new loading rather than after that
In reply to Greg Kroah-HartmanFrom: Lingling Xu <[email protected]>
[ Upstream commit 3e07d240939803bed9feb2a353d94686a411a7ca ]
As the specification described, users must check busy bit before start a new loading operation to make sure that the previous loading is done and the device is ready to accept a new one.
[ chunyan: Massaged changelog ]
--- drivers/watchdog/sprd_wdt.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
drivers/watchdog/sprd_wdt.c +13 -12
@@ -116,18 +116,6 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,u32 tmr_step = timeout *SPRD_WDT_CNT_STEP ;u32 prtmr_step = pretimeout *SPRD_WDT_CNT_STEP ; -sprd_wdt_unlock (wdt->base); -writel_relaxed ((tmr_step >>SPRD_WDT_CNT_HIGH_SHIFT ) & -SPRD_WDT_LOW_VALUE_MASK , wdt->base +SPRD_WDT_LOAD_HIGH ); -writel_relaxed ((tmr_step &SPRD_WDT_LOW_VALUE_MASK ), - wdt->base +SPRD_WDT_LOAD_LOW ); -writel_relaxed ((prtmr_step >>SPRD_WDT_CNT_HIGH_SHIFT ) & -SPRD_WDT_LOW_VALUE_MASK , - wdt->base +SPRD_WDT_IRQ_LOAD_HIGH ); -writel_relaxed (prtmr_step &SPRD_WDT_LOW_VALUE_MASK , - wdt->base +SPRD_WDT_IRQ_LOAD_LOW ); -sprd_wdt_lock (wdt->base); -/* * Waiting the load value operation done, * it needs two or three RTC clock cycles.
@@ -142,6 +130,19 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,if (delay_cnt >=SPRD_WDT_LOAD_TIMEOUT )return -EBUSY ; + +sprd_wdt_unlock (wdt->base); +writel_relaxed ((tmr_step >>SPRD_WDT_CNT_HIGH_SHIFT ) & +SPRD_WDT_LOW_VALUE_MASK , wdt->base +SPRD_WDT_LOAD_HIGH ); +writel_relaxed ((tmr_step &SPRD_WDT_LOW_VALUE_MASK ), + wdt->base +SPRD_WDT_LOAD_LOW ); +writel_relaxed ((prtmr_step >>SPRD_WDT_CNT_HIGH_SHIFT ) & +SPRD_WDT_LOW_VALUE_MASK , + wdt->base +SPRD_WDT_IRQ_LOAD_HIGH ); +writel_relaxed (prtmr_step &SPRD_WDT_LOW_VALUE_MASK , + wdt->base +SPRD_WDT_IRQ_LOAD_LOW ); +sprd_wdt_lock (wdt->base); +return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 231/346 watchdog: Fix potential dereferencing of null pointer
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 6f733cb2e7db38f8141b14740bcde577844a03b7 ]
A reboot notifier, which stops the WDT by calling the stop hook without any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.
Howerer we allow the WDT driver to omit the stop hook since commit "d0684c8a93549" ("watchdog: Make stop function optional") and provide a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to control reboot policy"). Together that commits make user potential to insert a watchdog driver that don't provide a stop hook but with the stop_on_reboot parameter set, then dereferencing of null pointer occurs on system reboot.
Check the stop hook before registering the reboot notifier to fix the issue.
--- drivers/watchdog/watchdog_core.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
drivers/watchdog/watchdog_core.c +13 -9
@@ -246,15 +246,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd) }if (test_bit (WDOG_STOP_ON_REBOOT , &wdd->status)) { - wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; - - ret =register_reboot_notifier (&wdd->reboot_nb); -if (ret) { -pr_err ("watchdog%d: Cannot register reboot notifier (%d)\n" , - wdd->id, ret); -watchdog_dev_unregister (wdd); -ida_simple_remove (&watchdog_ida, id); -return ret; +if (!wdd->ops->stop) +pr_warn ("watchdog%d: stop_on_reboot not supported\n" , wdd->id); +else { + wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; + + ret =register_reboot_notifier (&wdd->reboot_nb); +if (ret) { +pr_err ("watchdog%d: Cannot register reboot notifier (%d)\n" , + wdd->id, ret); +watchdog_dev_unregister (wdd); +ida_simple_remove (&watchdog_ida, id); +return ret; + } } }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 232/346 um: Monitor error events in IRQ controller
In reply to Greg Kroah-HartmanFrom: Anton Ivanov <[email protected]>
[ Upstream commit e3a01cbee9c5f2c6fc813dd6af007716e60257e7 ]
Ensure that file closes, connection closes, etc are propagated as interrupts in the interrupt controller.
--- arch/um/os-Linux/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/os-Linux/irq.c +1 -1
@@ -48,7 +48,7 @@ int os_epoll_triggered(int index, int events)int os_event_mask (int irq_type) {if (irq_type ==IRQ_READ ) -return EPOLLIN |EPOLLPRI ; +return EPOLLIN |EPOLLPRI |EPOLLERR |EPOLLHUP |EPOLLRDHUP ;if (irq_type ==IRQ_WRITE )return EPOLLOUT ;return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 233/346 um: tty: Fix handling of close in tty lines
In reply to Greg Kroah-HartmanFrom: Anton Ivanov <[email protected]>
[ Upstream commit 9b1c0c0e25dcccafd30e7d4c150c249cc65550eb ]
Fix a logical error in tty reading. We get 0 and errno == EAGAIN on the first attempt to read from a closed file descriptor.
Compared to that a true EAGAIN is EAGAIN and -1.
If we check errno for EAGAIN first, before checking the return value we miss the fact that the descriptor is closed.
This bug is as old as the driver. It was not showing up with the original POLL based IRQ controller, because it was producing multiple events. Switching to EPOLL unmasked it.
--- arch/um/drivers/chan_user.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/um/drivers/chan_user.c +2 -2
@@ -26,10 +26,10 @@ int generic_read(int fd, char *c_out, void *unused) n =read (fd, c_out,sizeof (*c_out));if (n >0 )return n; -else if (errno ==EAGAIN ) -return 0 ;else if (n ==0 )return -EIO ; +else if (errno ==EAGAIN ) +return 0 ;return -errno; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 234/346 um: chan_xterm: Fix fd leak
In reply to Greg Kroah-HartmanFrom: Anton Ivanov <[email protected]>
[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ]
xterm serial channel was leaking a fd used in setting up the port helper
This bug is prehistoric - it predates switching to git. The "fixes" header here is really just to mark all the versions we would like this to apply to which is "Anything from the Cretaceous period onwards".
No dinosaurs were harmed in fixing this bug.
--- arch/um/drivers/xterm.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/um/drivers/xterm.c +5 -0
@@ -18,6 +18,7 @@struct xterm_chan {int pid;int helper_pid; +int chan_fd;char *title;int device;int raw;
@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)return NULL ; *data = ((struct xterm_chan ) { .pid =-1 , .helper_pid =-1 , + .chan_fd =-1 , .device = device, .title = opts->xterm_title, .raw = opts->raw } );
@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d, goto out_kill; } + data->chan_fd = fd; new =xterm_fd (fd, &data->helper_pid);if (new <0 ) { err = new;
@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)os_kill_process (data->helper_pid,0 ); data->helper_pid =-1 ; +if (data->chan_fd !=-1 ) +os_close_file (data->chan_fd);os_close_file (fd); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 235/346 nfc: s3fwrn5: Release the nfc firmware
In reply to Greg Kroah-HartmanFrom: Bongsu Jeon <[email protected]>
[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ]
add the code to release the nfc firmware when the firmware image size is wrong.
--- drivers/nfc/s3fwrn5/firmware.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/nfc/s3fwrn5/firmware.c +3 -1
@@ -304,8 +304,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)if (ret <0 )return ret; -if (fw->fw->size <S3FWRN5_FW_IMAGE_HEADER_SIZE ) +if (fw->fw->size <S3FWRN5_FW_IMAGE_HEADER_SIZE ) { +release_firmware (fw->fw);return -EINVAL ; + }memcpy (fw->date, fw->fw->data +0x00 ,12 ); fw->date[12 ] ='\0' ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 236/346 powerpc/ps3: use dma_mapping_error()
In reply to Greg Kroah-HartmanFrom: Vincent Stehlé <[email protected]>
[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ]
The DMA address returned by dma_map_single() should be checked with dma_mapping_error(). Fix the ps3stor_setup() function accordingly.
--- drivers/ps3/ps3stor_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ps3/ps3stor_lib.c +1 -1
@@ -201,7 +201,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler) dev->bounce_lpar =ps3_mm_phys_to_lpar (__pa (dev->bounce_buf)); dev->bounce_dma =dma_map_single (&dev->sbd.core, dev->bounce_buf, dev->bounce_size,DMA_BIDIRECTIONAL ); -if (!dev->bounce_dma) { +if (dma_mapping_error (&dev->sbd.core, dev->bounce_dma)) {dev_err (&dev->sbd.core,"%s:%u: map DMA region failed\n" , __func__, __LINE__); error = -ENODEV ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 237/346 checkpatch: fix unescaped left brace
In reply to Greg Kroah-HartmanFrom: Dwaipayan Ray <[email protected]>
[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ]
There is an unescaped left brace in a regex in OPEN_BRACE check. This throws a runtime error when checkpatch is run with --fix flag and the OPEN_BRACE check is executed.
Fix it by escaping the left brace.
--- scripts/checkpatch.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/checkpatch.pl +1 -1
@@ -4059,7 +4059,7 @@ sub process { $fix) { fix_delete_line($fixlinenr, $rawline); my $fixed_line = $rawline; - $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/; + $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/; my $line1 = $1; my $line2 = $2; fix_insert_line($fixlinenr, ltrim($line1));
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 238/346 net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ]
If the 'register_netdev()' call fails, we must undo a previous 'bcmgenet_mii_init()' call.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +3 -1
@@ -3593,8 +3593,10 @@ static int bcmgenet_probe(struct platform_device *pdev)clk_disable_unprepare (priv->clk); err =register_netdev (dev); -if (err) +if (err) { +bcmgenet_mii_exit (dev); goto err; + }return err;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 239/346 net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ]
'irq_of_parse_and_map()' should be balanced by a corresponding 'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
Add such a call in the error handling path of the probe function and in the remove function.
--- drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/allwinner/sun4i-emac.c +5 -2
@@ -847,13 +847,13 @@ static int emac_probe(struct platform_device *pdev) db->clk =devm_clk_get (&pdev->dev,NULL );if (IS_ERR (db->clk)) { ret =PTR_ERR (db->clk); - goto out_iounmap; + goto out_dispose_mapping; } ret =clk_prepare_enable (db->clk);if (ret) {dev_err (&pdev->dev,"Error couldn't enable clock (%d)\n" , ret); - goto out_iounmap; + goto out_dispose_mapping; } ret =sunxi_sram_claim (&pdev->dev);
@@ -910,6 +910,8 @@ out_release_sram:sunxi_sram_release (&pdev->dev); out_clk_disable_unprepare:clk_disable_unprepare (db->clk); +out_dispose_mapping: +irq_dispose_mapping (ndev->irq); out_iounmap:iounmap (db->membase); out:
@@ -928,6 +930,7 @@ static int emac_remove(struct platform_device *pdev)unregister_netdev (ndev);sunxi_sram_release (&pdev->dev);clk_disable_unprepare (db->clk); +irq_dispose_mapping (ndev->irq);iounmap (db->membase);free_netdev (ndev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 240/346 net: korina: fix return value
In reply to Greg Kroah-HartmanFrom: Vincent Stehlé <[email protected]>
[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ]
The ndo_start_xmit() method must not attempt to free the skb to transmit when returning NETDEV_TX_BUSY. Therefore, make sure the korina_send_packet() function returns NETDEV_TX_OK when it frees a packet.
--- drivers/net/ethernet/korina.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/korina.c +1 -1
@@ -219,7 +219,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)dev_kfree_skb_any (skb);spin_unlock_irqrestore (&lp->lock, flags); -return NETDEV_TX_BUSY ; +return NETDEV_TX_OK ; } }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 241/346 libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 4c46764733c85b82c07e9559b39da4d00a7dd659 ]
Forget to set error code when nd_label_alloc_slot failed, and we add it to avoid overwritten error code.
--- drivers/nvdimm/label.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/nvdimm/label.c +3 -1
@@ -880,8 +880,10 @@ static int __blk_label_update(struct nd_region *nd_region,if (is_old_resource (res, old_res_list, old_num_resources))continue ;/* carry-over */ slot =nd_label_alloc_slot (ndd); -if (slot ==UINT_MAX ) +if (slot ==UINT_MAX ) { + rc = -ENXIO ; goto abort; + }dev_dbg (ndd->dev,"allocated: %d\n" , slot); nd_label =to_label (ndd, slot);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 242/346 watchdog: qcom: Avoid context switch in restart handler
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ]
The use of msleep() in the restart handler will cause scheduler to induce a context switch which is not desirable. This generates below warning on SDX55 when WDT is the only available restart source:
[ 39.800188] reboot: Restarting system [ 39.804115] ------------[ cut here ]------------ [ 39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764 [ 39.812538] Modules linked in: [ 39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47 [ 39.824854] Hardware name: Generic DT based system [ 39.833470] [<c0310fbc>] (unwind_backtrace) from [<c030c544>] (show_stack+0x10/0x14) [ 39.838154] [<c030c544>] (show_stack) from [<c0c218f0>] (dump_stack+0x8c/0xa0) [ 39.846049] [<c0c218f0>] (dump_stack) from [<c0322f80>] (__warn+0xd8/0xf0) [ 39.853058] [<c0322f80>] (__warn) from [<c0c1dc08>] (warn_slowpath_fmt+0x64/0xc8) [ 39.859925] [<c0c1dc08>] (warn_slowpath_fmt) from [<c038b6f4>] (rcu_note_context_switch+0x190/0x764) [ 39.867503] [<c038b6f4>] (rcu_note_context_switch) from [<c0c2aa3c>] (__schedule+0x84/0x640) [ 39.876685] [<c0c2aa3c>] (__schedule) from [<c0c2b050>] (schedule+0x58/0x10c) [ 39.885095] [<c0c2b050>] (schedule) from [<c0c2eed0>] (schedule_timeout+0x1e8/0x3d4) [ 39.892135] [<c0c2eed0>] (schedule_timeout) from [<c039ad40>] (msleep+0x2c/0x38) [ 39.899947] [<c039ad40>] (msleep) from [<c0a59d0c>] (qcom_wdt_restart+0xc4/0xcc) [ 39.907319] [<c0a59d0c>] (qcom_wdt_restart) from [<c0a58290>] (watchdog_restart_notifier+0x18/0x28) [ 39.914715] [<c0a58290>] (watchdog_restart_notifier) from [<c03468e0>] (atomic_notifier_call_chain+0x60/0x84) [ 39.923487] [<c03468e0>] (atomic_notifier_call_chain) from [<c030ae64>] (machine_restart+0x78/0x7c) [ 39.933551] [<c030ae64>] (machine_restart) from [<c0348048>] (__do_sys_reboot+0xdc/0x1e0) [ 39.942397] [<c0348048>] (__do_sys_reboot) from [<c0300060>] (ret_fast_syscall+0x0/0x54) [ 39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0) [ 39.958855] bfa0: 0001221c bed2fe24 fee1dead 28121969 01234567 00000000 [ 39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000 [ 39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580 [ 39.980124] ---[ end trace 3f578288bad866e4 ]---
Hence, replace msleep() with mdelay() to fix this issue.
--- drivers/watchdog/qcom-wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/qcom-wdt.c +1 -1
@@ -121,7 +121,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action,*/ wmb (); -msleep (150 ); +mdelay (150 );return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 243/346 watchdog: coh901327: add COMMON_CLK dependency
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ]
clang produces a build failure in configurations without COMMON_CLK when a timeout calculation goes wrong:
arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable':
coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay'
Add a Kconfig dependency to only do build testing when COMMON_CLK is enabled.
--- drivers/watchdog/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/Kconfig +1 -1
@@ -515,7 +515,7 @@ config SUNXI_WATCHDOG config COH901327_WATCHDOG bool "ST-Ericsson COH 901 327 watchdog" - depends on ARCH_U300 || (ARM && COMPILE_TEST) + depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST) default y if MACH_U300 select WATCHDOG_CORE help
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 244/346 clk: ti: Fix memleak in ti_fapll_synth_setup
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ]
If clk_register fails, we should goto free branch
before function returns to prevent memleak.
--- drivers/clk/ti/fapll.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/clk/ti/fapll.c +9 -2
@@ -497,6 +497,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd, {struct clk_init_data *init;struct fapll_synth *synth; +struct clk *clk =ERR_PTR (-ENOMEM ); init =kzalloc (sizeof (*init),GFP_KERNEL );if (!init)
@@ -519,13 +520,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd, synth->hw.init = init; synth->clk_pll = pll_clk; -return clk_register (NULL , &synth->hw); + clk =clk_register (NULL , &synth->hw); +if (IS_ERR (clk)) { +pr_err ("failed to register clock\n" ); + goto free; + } + +return clk; free:kfree (synth);kfree (init); -return ERR_PTR (-ENOMEM ); +return clk; }static void __init ti_fapll_setup (struct device_node *node)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 245/346 pwm: zx: Add missing cleanup in error path
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ]
zx_pwm_probe() called clk_prepare_enable() before; this must be undone in the error path.
--- drivers/pwm/pwm-zx.c | 1 + 1 file changed, 1 insertion(+)
drivers/pwm/pwm-zx.c +1 -0
@@ -241,6 +241,7 @@ static int zx_pwm_probe(struct platform_device *pdev) ret =pwmchip_add (&zpc->chip);if (ret <0 ) {dev_err (&pdev->dev,"failed to add PWM chip: %d\n" , ret); +clk_disable_unprepare (zpc->pclk);return ret; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 247/346 perf record: Fix memory leak when using --user-regs=? to list registers
In reply to Greg Kroah-HartmanFrom: Zheng Zengkai <[email protected]>
[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ]
When using 'perf record's option '-I' or '--user-regs=' along with argument '?' to list available register names, memory of variable 'os' allocated by strdup() needs to be released before __parse_regs() returns, otherwise memory leak will occur.
--- tools/perf/util/parse-regs-options.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/parse-regs-options.c +1 -1
@@ -41,7 +41,7 @@ parse_regs(const struct option *opt, const char *str, int unset) }fputc ('\n' , stderr);/* just printing available regs */ -return -1 ; + goto error; }for (r = sample_reg_masks; r->name; r++) {if (!strcasecmp (s, r->name))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 248/346 qlcnic: Fix error code in probe
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ]
Return -EINVAL if we can't find the correct device. Currently it returns success.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +1 -0
@@ -2508,6 +2508,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)qlcnic_sriov_vf_register_map (ahw);break ;default : + err = -EINVAL ; goto err_out_free_hw_res; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 249/346 clk: s2mps11: Fix a resource leak in error handling paths in the probe function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]
Some resource should be released in the error handling path of the probe function, as already done in the remove function.
The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add missing of_node_put and of_clk_del_provider")
--- drivers/clk/clk-s2mps11.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/clk-s2mps11.c +1 -0
@@ -211,6 +211,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)return ret; err_reg: +of_node_put (s2mps11_clks[0 ].clk_np);while (--i >=0 )clkdev_drop (s2mps11_clks[i].lookup);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 250/346 clk: sunxi-ng: Make sure divider tables have sentinel
In reply to Greg Kroah-HartmanFrom: Jernej Skrabec <[email protected]>
[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ]
Two clock divider tables are missing sentinel at the end. Effect of that is that clock framework reads past the last entry. Fix that with adding sentinel at the end.
Issue was discovered with KASan.
--- drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 + drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 + 2 files changed, 2 insertions(+)
drivers/clk/sunxi-ng/ccu-sun50i-a64.c +1 -0
@@ -381,6 +381,7 @@ static struct clk_div_table ths_div_table[] = { { .val = 1, .div = 2 }, { .val = 2, .div = 4 }, { .val = 3, .div = 6 }, + { /* Sentinel */ }, };static const char *const ths_parents[] = {"osc24M" };static struct ccu_div ths_clk = {
drivers/clk/sunxi-ng/ccu-sun8i-h3.c +1 -0
@@ -328,6 +328,7 @@ static struct clk_div_table ths_div_table[] = { { .val = 1, .div = 2 }, { .val = 2, .div = 4 }, { .val = 3, .div = 6 }, + { /* Sentinel */ }, }; static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M", 0x074, 0, 2, ths_div_table, BIT(31), 0);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 251/346 kconfig: fix return value of do_error_if()
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 135b4957eac43af2aedf8e2a277b9540f33c2558 ]
$(error-if,...) is expanded to an empty string. Currently, it relies on eval_clause() returning xstrdup("") when all attempts for expansion fail, but the correct implementation is to make do_error_if() return xstrdup("").
--- scripts/kconfig/preprocess.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/kconfig/preprocess.c +1 -1
@@ -111,7 +111,7 @@ static char *do_error_if(int argc, char *argv[])if (!strcmp (argv[0 ],"y" ))pperror ("%s" , argv[1 ]); -return NULL ; +return xstrdup ("" ); }static char *do_filename (int argc,char *argv[])
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 252/346 ARM: sunxi: Add machine match for the Allwinner V3 SoC
In reply to Greg Kroah-HartmanFrom: Paul Kocialkowski <[email protected]>
[ Upstream commit ad2091f893bd5dfe2824f0d6819600d120698e9f ]
The Allwinner V3 SoC shares the same base as the V3s but comes with extra pins and features available. As a result, it has its dedicated compatible string (already used in device trees), which is added here.
--- arch/arm/mach-sunxi/sunxi.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-sunxi/sunxi.c +1 -0
@@ -66,6 +66,7 @@ static const char * const sun8i_board_dt_compat[] = {"allwinner,sun8i-h2-plus" ,"allwinner,sun8i-h3" ,"allwinner,sun8i-r40" , +"allwinner,sun8i-v3" ,"allwinner,sun8i-v3s" , NULL, };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 253/346 cfg80211: initialize rekey_data
In reply to Greg Kroah-HartmanFrom: Sara Sharon <[email protected]>
[ Upstream commit f495acd8851d7b345e5f0e521b2645b1e1f928a0 ]
In case we have old supplicant, the akm field is uninitialized.
--- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/nl80211.c +1 -1
@@ -11502,7 +11502,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)struct net_device *dev = info->user_ptr[1 ];struct wireless_dev *wdev = dev->ieee80211_ptr;struct nlattr *tb[NUM_NL80211_REKEY_DATA ]; -struct cfg80211_gtk_rekey_data rekey_data; +struct cfg80211_gtk_rekey_data rekey_data = {};int err;if (!info->attrs[NL80211_ATTR_REKEY_DATA ])
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 254/346 fix namespaced fscaps when !CONFIG_SECURITY
In reply to Greg Kroah-HartmanFrom: Serge Hallyn <[email protected]>
[ Upstream commit ed9b25d1970a4787ac6a39c2091e63b127ecbfc1 ]
Namespaced file capabilities were introduced in 8db6c34f1dbc . When userspace reads an xattr for a namespaced capability, a virtualized representation of it is returned if the caller is in a user namespace owned by the capability's owning rootid. The function which performs this virtualization was not hooked up if CONFIG_SECURITY=n. Therefore in that case the original xattr was shown instead of the virtualized one.
To test this using libcap-bin (*1),
$ v=$(mktemp) $ unshare -Ur setcap cap_sys_admin-eip $v $ unshare -Ur setcap -v cap_sys_admin-eip $v /tmp/tmp.lSiIFRvt8Y: OK
"setcap -v" verifies the values instead of setting them, and will check whether the rootid value is set. Therefore, with this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will fail:
$ v=$(mktemp) $ unshare -Ur setcap cap_sys_admin=eip $v $ unshare -Ur setcap -v cap_sys_admin=eip $v nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in []
Fix this bug by calling cap_inode_getsecurity() in security_inode_getsecurity() instead of returning -EOPNOTSUPP, when CONFIG_SECURITY=n.
*1 - note, if libcap is too old for getcap to have the '-n' option, then use verify-caps instead.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689
--- include/linux/security.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/security.h +1 -1
@@ -787,7 +787,7 @@ static inline int security_inode_killpriv(struct dentry *dentry)static inline int security_inode_getsecurity (struct inode *inode,const char *name,void **buffer,bool alloc) { -return -EOPNOTSUPP ; +return cap_inode_getsecurity (inode, name, buffer, alloc); }static inline int security_inode_setsecurity (struct inode *inode,const char *name,const void *value,size_t size,int flags)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 255/346 lwt: Disable BH too in run_lwt_bpf()
In reply to Greg Kroah-HartmanFrom: Dongdong Wang <[email protected]>
[ Upstream commit d9054a1ff585ba01029584ab730efc794603d68f ]
The per-cpu bpf_redirect_info is shared among all skb_do_redirect() and BPF redirect helpers. Callers on RX path are all in BH context, disabling preemption is not sufficient to prevent BH interruption.
In production, we observed strange packet drops because of the race condition between LWT xmit and TC ingress, and we verified this issue is fixed after we disable BH.
Although this bug was technically introduced from the beginning, that is commit 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure"), at that time call_rcu() had to be call_rcu_bh() to match the RCU context. So this patch may not work well before RCU flavor consolidation has been completed around v5.0.
Update the comments above the code too, as call_rcu() is now BH friendly.
--- net/core/lwt_bpf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/core/lwt_bpf.c +4 -4
@@ -44,12 +44,11 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt, {int ret; -/* Preempt disable is needed to protect per-cpu redirect_info between -* BPF prog and skb_do_redirect(). The call_rcu in bpf_prog_put() and -* access to maps strictly require a rcu_read_lock() for protection, -* mixing with BH RCU lock doesn't work. +/* Preempt disable and BH disable are needed to protect per-cpu +* redirect_info between BPF prog and skb_do_redirect(). */ preempt_disable (); +local_bh_disable ();bpf_compute_data_pointers (skb); ret =bpf_prog_run_save_cb (lwt->prog, skb);
@@ -82,6 +81,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,break ; } +local_bh_enable ();preempt_enable ();return ret;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 256/346 Input: cros_ec_keyb - send scancodes in addition to key events
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit 80db2a087f425b63f0163bc95217abd01c637cb5 ]
To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN capability, so it is only matter of actually sending the events.
--- drivers/input/keyboard/cros_ec_keyb.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/keyboard/cros_ec_keyb.c +1 -0
@@ -183,6 +183,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,"changed: [r%d c%d]: byte %02x\n" , row, col, new_state); +input_event (idev,EV_MSC ,MSC_SCAN , pos);input_report_key (idev, keycodes[pos], new_state); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 257/346 Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
In reply to Greg Kroah-HartmanFrom: Simon Beginn <[email protected]>
[ Upstream commit cffdd6d90482316e18d686060a4397902ea04bd2 ]
The touchscreen on the Teclast x98 Pro is also mounted upside-down in relation to the display orientation.
--- drivers/input/touchscreen/goodix.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/input/touchscreen/goodix.c +12 -0
@@ -136,6 +136,18 @@ static const struct dmi_system_id rotated_screen[] = { DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), }, }, + { + .ident = "Teclast X98 Pro", + .matches = { +/* +* Only match BIOS date, because the manufacturers +* BIOS does not report the board name at all +* (sometimes)... +*/ +DMI_MATCH (DMI_BOARD_VENDOR ,"TECLAST" ), + DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"), + }, + }, { .ident ="WinBook TW100" , .matches = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 258/346 media: gspca: Fix memory leak in probe
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit e469d0b09a19496e1972a20974bbf55b728151eb upstream.
The gspca driver leaks memory when a probe fails. gspca_dev_probe2() calls v4l2_device_register(), which takes a reference to the underlying device node (in this case, a USB interface). But the failure pathway neglects to call v4l2_device_unregister(), the routine responsible for dropping this reference. Consequently the memory for the USB interface and its device never gets released.
This patch adds the missing function call.
--- drivers/media/usb/gspca/gspca.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/usb/gspca/gspca.c +1 -0
@@ -1585,6 +1585,7 @@ out:input_unregister_device (gspca_dev->input_dev);#endif v4l2_ctrl_handler_free (gspca_dev->vdev.ctrl_handler); +v4l2_device_unregister (&gspca_dev->v4l2_dev);kfree (gspca_dev->usb_buf);kfree (gspca_dev);return ret;
Greg Kroah-Hartman
maintainerPATCH 259/346 media: sunxi-cir: ensure IR is handled when it is continuous
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 3f56df4c8ffeb120ed41906d3aae71799b7e726a upstream.
If a user holds a button down on a remote, then no ir idle interrupt will be generated until the user releases the button, depending on how quickly the remote repeats. No IR is processed until that point, which means that holding down a button may not do anything.
This also resolves an issue on a Cubieboard 1 where the IR receiver is picking up ambient infrared as IR and spews out endless
"rc rc0: IR event FIFO is full!" messages unless you choose to live in the dark.
--- drivers/media/rc/sunxi-cir.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/rc/sunxi-cir.c +2 -0
@@ -129,6 +129,8 @@ static irqreturn_t sunxi_ir_irq(int irqn }else if (status ®_RXINT_RPEI_EN ) {ir_raw_event_set_idle (ir->rc, true);ir_raw_event_handle (ir->rc); + }else { +ir_raw_event_handle (ir->rc); }spin_unlock (&ir->ir_lock);
Greg Kroah-Hartman
maintainerPATCH 260/346 media: netup_unidvb: Dont leak SPI master in probe error path
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit e297ddf296de35037fa97f4302782def196d350a upstream.
If the call to spi_register_master() fails on probe of the NetUP Universal DVB driver, the spi_master struct is erroneously not freed.
Likewise, if spi_new_device() fails, the spi_controller struct is not unregistered. Plug the leaks.
While at it, fix an ordering issue in netup_spi_release() wherein spi_unregister_master() is called after fiddling with the IRQ control register. The correct order is to call spi_unregister_master() *before* this teardown step because bus accesses may still be ongoing until that function returns.
--- drivers/media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/pci/netup_unidvb/netup_unidvb_spi.c +3 -2
@@ -184,7 +184,7 @@ int netup_spi_init(struct netup_unidvb_dstruct spi_master *master;struct netup_spi *nspi; - master =spi_alloc_master (&ndev->pci_dev->dev, + master =devm_spi_alloc_master (&ndev->pci_dev->dev,sizeof (struct netup_spi ));if (!master) { dev_err(&ndev->pci_dev->dev,
@@ -217,6 +217,7 @@ int netup_spi_init(struct netup_unidvb_d ndev->pci_slot, ndev->pci_func);if (!spi_new_device (master, &netup_spi_board)) { +spi_unregister_master (master); ndev->spi =NULL ;dev_err (&ndev->pci_dev->dev,"%s(): unable to create SPI device\n" , __func__);
@@ -235,13 +236,13 @@ void netup_spi_release(struct netup_unidif (!spi)return ; +spi_unregister_master (spi->master);spin_lock_irqsave (&spi->lock, flags); reg =readw (&spi->regs->control_stat);writew (reg |NETUP_SPI_CTRL_IRQ , &spi->regs->control_stat); reg =readw (&spi->regs->control_stat);writew (reg & ~NETUP_SPI_CTRL_IMASK , &spi->regs->control_stat);spin_unlock_irqrestore (&spi->lock, flags); -spi_unregister_master (spi->master); ndev->spi =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 261/346 media: ipu3-cio2: Remove traces of returned buffers
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
commit 61e7f892b5ee1dd10ea8bff805f3c3fe6e535959 upstream.
If starting a video buffer queue fails, the buffers are returned to videobuf2. Remove the reference to the buffer from the driver's queue as well.
--- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/pci/intel/ipu3/ipu3-cio2.c +1 -0
@@ -801,6 +801,7 @@ static void cio2_vb2_return_all_buffers(atomic_dec (&q->bufs_queued);vb2_buffer_done (&q->bufs[i]->vbb.vb2_buf, state); + q->bufs[i] =NULL ; } } }
Greg Kroah-Hartman
maintainerPATCH 262/346 media: ipu3-cio2: Return actual subdev format
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
commit 8160e86702e0807bd36d40f82648f9f9820b9d5a upstream.
Return actual subdev format on ipu3-cio2 subdev pads. The earlier implementation was based on an infinite recursion that exhausted the stack.
--- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-)
drivers/media/pci/intel/ipu3/ipu3-cio2.c +3 -21
@@ -1246,29 +1246,11 @@ static int cio2_subdev_get_fmt(struct v4 struct v4l2_subdev_format *fmt) { struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev); -struct v4l2_subdev_format format; -int ret; -if (fmt->which ==V4L2_SUBDEV_FORMAT_TRY ) { +if (fmt->which ==V4L2_SUBDEV_FORMAT_TRY ) fmt->format = *v4l2_subdev_get_try_format (sd, cfg, fmt->pad); -return 0 ; - } - -if (fmt->pad ==CIO2_PAD_SINK ) { - format.which =V4L2_SUBDEV_FORMAT_ACTIVE ; - ret =v4l2_subdev_call (sd, pad, get_fmt,NULL , - &format); - -if (ret) -return ret; -/* update colorspace etc */ - q->subdev_fmt.colorspace = format.format.colorspace; - q->subdev_fmt.ycbcr_enc = format.format.ycbcr_enc; - q->subdev_fmt.quantization = format.format.quantization; - q->subdev_fmt.xfer_func = format.format.xfer_func; - } - - fmt->format = q->subdev_fmt; +else + fmt->format = q->subdev_fmt;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 263/346 media: ipu3-cio2: Serialise access to pad format
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
commit 55a6c6b2be3d6670bf5772364d8208bd8dc17da4 upstream.
Pad format can be accessed from user space. Serialise access to it.
--- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 11 +++++++++++ drivers/media/pci/intel/ipu3/ipu3-cio2.h | 1 + 2 files changed, 12 insertions(+)
drivers/media/pci/intel/ipu3/ipu3-cio2.c +11 -0
@@ -1247,11 +1247,15 @@ static int cio2_subdev_get_fmt(struct v4 { struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev); +mutex_lock (&q->subdev_lock); +if (fmt->which ==V4L2_SUBDEV_FORMAT_TRY ) fmt->format = *v4l2_subdev_get_try_format (sd, cfg, fmt->pad);else fmt->format = q->subdev_fmt; +mutex_unlock (&q->subdev_lock); +return 0 ; }
@@ -1275,6 +1279,8 @@ static int cio2_subdev_set_fmt(struct v4if (fmt->pad ==CIO2_PAD_SOURCE )return cio2_subdev_get_fmt (sd, cfg, fmt); +mutex_lock (&q->subdev_lock); +if (fmt->which ==V4L2_SUBDEV_FORMAT_TRY ) { *v4l2_subdev_get_try_format (sd, cfg, fmt->pad) = fmt->format; }else {
@@ -1285,6 +1291,8 @@ static int cio2_subdev_set_fmt(struct v4 fmt->format = q->subdev_fmt; } +mutex_unlock (&q->subdev_lock); +return 0 ; }
@@ -1532,6 +1540,7 @@ static int cio2_queue_init(struct cio2_d/* Initialize miscellaneous variables */ mutex_init (&q->lock); +mutex_init (&q->subdev_lock);/* Initialize formats to default values */ fmt = &q->subdev_fmt;
@@ -1649,6 +1658,7 @@ fail_vdev_media_entity: fail_subdev_media_entity:cio2_fbpt_exit (q, &cio2->pci_dev->dev); fail_fbpt: +mutex_destroy (&q->subdev_lock);mutex_destroy (&q->lock);return r;
@@ -1662,6 +1672,7 @@ static void cio2_queue_exit(struct cio2_v4l2_device_unregister_subdev (&q->subdev);media_entity_cleanup (&q->subdev.entity);cio2_fbpt_exit (q, &cio2->pci_dev->dev); +mutex_destroy (&q->subdev_lock);mutex_destroy (&q->lock); }
drivers/media/pci/intel/ipu3/ipu3-cio2.h +1 -0
@@ -334,6 +334,7 @@ struct cio2_queue {/* Subdev, /dev/v4l-subdevX */ struct v4l2_subdev subdev; +struct mutex subdev_lock;/* Serialise acces to subdev_fmt field */ struct media_pad subdev_pads[CIO2_PADS ];struct v4l2_mbus_framefmt subdev_fmt;atomic_t frame_sequence;
Greg Kroah-Hartman
maintainerPATCH 264/346 media: ipu3-cio2: Validate mbus format in setting subdev format
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.
Validate media bus code, width and height when setting the subdev format.
This effectively reworks how setting subdev format is implemented in the driver.
--- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-)
drivers/media/pci/intel/ipu3/ipu3-cio2.c +20 -9
@@ -1271,6 +1271,9 @@ static int cio2_subdev_set_fmt(struct v4 struct v4l2_subdev_format *fmt) { struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev); +struct v4l2_mbus_framefmt *mbus; +u32 mbus_code = fmt->format.code; +unsigned int i;/* * Only allow setting sink pad format;
@@ -1279,18 +1282,26 @@ static int cio2_subdev_set_fmt(struct v4if (fmt->pad ==CIO2_PAD_SOURCE )return cio2_subdev_get_fmt (sd, cfg, fmt); -mutex_lock (&q->subdev_lock); +if (fmt->which ==V4L2_SUBDEV_FORMAT_TRY ) + mbus =v4l2_subdev_get_try_format (sd, cfg, fmt->pad); +else + mbus = &q->subdev_fmt; + + fmt->format.code = formats[0 ].mbus_code; -if (fmt->which ==V4L2_SUBDEV_FORMAT_TRY ) { - *v4l2_subdev_get_try_format (sd, cfg, fmt->pad) = fmt->format; - }else { -/* It's the sink, allow changing frame size */ - q->subdev_fmt.width = fmt->format.width; - q->subdev_fmt.height = fmt->format.height; - q->subdev_fmt.code = fmt->format.code; - fmt->format = q->subdev_fmt; +for (i =0 ; i <ARRAY_SIZE (formats); i++) { +if (formats[i].mbus_code == fmt->format.code) { + fmt->format.code = mbus_code; +break ; + } } + fmt->format.width =min_t (u32, fmt->format.width,CIO2_IMAGE_MAX_WIDTH ); + fmt->format.height =min_t (u32, fmt->format.height, +CIO2_IMAGE_MAX_LENGTH ); + +mutex_lock (&q->subdev_lock); + *mbus = fmt->format;mutex_unlock (&q->subdev_lock);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 265/346 media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
commit 219a8b9c04e54872f9a4d566633fb42f08bcbe2a upstream.
The ipu3-cio2 doesn't make use of the field and this is reflected in V4L2 buffers as well as the try format. Do this in active format, too.
--- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/pci/intel/ipu3/ipu3-cio2.c +1 -0
@@ -1299,6 +1299,7 @@ static int cio2_subdev_set_fmt(struct v4 fmt->format.width =min_t (u32, fmt->format.width,CIO2_IMAGE_MAX_WIDTH ); fmt->format.height =min_t (u32, fmt->format.height,CIO2_IMAGE_MAX_LENGTH ); + fmt->format.field =V4L2_FIELD_NONE ;mutex_lock (&q->subdev_lock); *mbus = fmt->format;
Greg Kroah-Hartman
maintainerPATCH 266/346 Input: cyapa_gen6 - fix out-of-bounds stack access
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit f051ae4f6c732c231046945b36234e977f8467c6 upstream.
gcc -Warray-bounds warns about a serious bug incyapa_pip_retrieve_data_structure:
drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop':include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds]
40 | *((__le16 *)p) = cpu_to_le16(val);drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd'
569 | } __packed cmd;
| ^~~
Apparently the '-2' was added to the pointer instead of the value, writing garbage into the stack next to this variable.
--- drivers/input/mouse/cyapa_gen6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/mouse/cyapa_gen6.c +1 -1
@@ -573,7 +573,7 @@ static int cyapa_pip_retrieve_data_strucmemset (&cmd,0 ,sizeof (cmd));put_unaligned_le16 (PIP_OUTPUT_REPORT_ADDR , &cmd.head.addr); -put_unaligned_le16 (sizeof (cmd), &cmd.head.length -2 ); +put_unaligned_le16 (sizeof (cmd) -2 , &cmd.head.length); cmd.head.report_id =PIP_APP_CMD_REPORT_ID ; cmd.head.cmd_code =PIP_RETRIEVE_DATA_STRUCTURE ;put_unaligned_le16 (read_offset, &cmd.read_offset);
Greg Kroah-Hartman
maintainerPATCH 267/346 ALSA: hda/ca0132 - Change Input Source enum strings.
In reply to Greg Kroah-HartmanFrom: Connor McAdams <[email protected]>
commit 7079f785b50055a32b72eddcb7d9ba5688db24d0 upstream.
Change the Input Source enumerated control's strings to make it play nice with pulseaudio.
--- sound/pci/hda/patch_ca0132.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_ca0132.c +1 -1
@@ -106,7 +106,7 @@ enum { };/* Strings for Input Source Enum Control */ -static const char *const in_src_str[3 ] = {"Rear Mic" ,"Line" ,"Front Mic" }; +static const char *const in_src_str[3 ] = {"Microphone" ,"Line In" ,"Front Microphone" };#define IN_SRC_NUM_OF_INPUTS 3enum {REAR_MIC ,
Re: [PATCH 4.19 267/346] ALSA: hda/ca0132 - Change Input Source enum strings.
Hi!
Quoted 9 lines
From: Connor McAdams <[email protected]>
commit
7079f785b50055a32b72eddcb7d9ba5688db24d0upstream.Change the Input Source enumerated control's strings to make it play nice with pulseaudio.
+++
b/sound/pci/hda/patch_ca0132.c
sound/pci/hda/patch_ca0132.c enum { · line 110
Quoted 6 lines
sound/pci/hda/patch_ca0132.c +1
-1@@ -106,7 +106,7 @@ enum { };/* Strings for Input Source Enum Control */ -static const char *const in_src_str[3 ] = {"Rear Mic" ,"Line" ,"Front Mic" }; +static const char *const in_src_str[3 ] = {"Microphone" ,"Line In" ,"Front Microphone" };#define IN_SRC_NUM_OF_INPUTS 3
If pulseaudio expects the strings to be from small set, should we have defines for them?
If pulseaudio can't understand short versions, do these need fixing, too?
hda_auto_parser.c: "Internal Mic", "Dock Mic", "Mic", "Rear Mic", "Front Mic"hda_auto_parser.c: return "Headset Mic";hda_auto_parser.c: return "Headphone Mic";hda_auto_parser.c: return "Mic";hda_auto_parser.c: return "Headphone Mic";hda_jack.c: cfg, "Headphone Mic");hda_jack.c: cfg, "Headphone Mic");hda_proc.c: "Line In", "Aux", "Mic", "Telephony",
Best regards,
Pavel
Signature · 1 line
http://www.livejournal.com/~pavelmachek
Re: [PATCH 4.19 267/346] ALSA: hda/ca0132 - Change Input Source enum strings.
Quoted 22 lines · Pavel Machek
Hi!
Quoted 9 lines
From: Connor McAdams <[email protected]>
commit
7079f785b50055a32b72eddcb7d9ba5688db24d0upstream.Change the Input Source enumerated control's strings to make it play nice with pulseaudio.
+++
b/sound/pci/hda/patch_ca0132.csound/pci/hda/patch_ca0132.c enum { · line 110
Quoted 6 lines
sound/pci/hda/patch_ca0132.c +1
-1@@ -106,7 +106,7 @@ enum { };/* Strings for Input Source Enum Control */ -static const char *const in_src_str[3 ] = {"Rear Mic" ,"Line" ,"Front Mic" }; +static const char *const in_src_str[3 ] = {"Microphone" ,"Line In" ,"Front Microphone" };#define IN_SRC_NUM_OF_INPUTS 3If pulseaudio expects the strings to be from small set, should we have defines for them?
Quoted 2 lines
If pulseaudio can't understand short versions, do these need fixing, too?
I don't believe so. Even if PA really doesn't understand, it's a problem of PA itself to be fixed there.
In this particular case, we changed the driver side since it's an easier path and very specific to the certain model. But if it's about the generic parser that is applied to all models, it's a different story.
thanks,
Takashi
Greg Kroah-Hartman
maintainerPATCH 268/346 PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 7482c5cb90e5a7f9e9e12dd154d405e0219656e3 upstream.
The idea behind acpi_pm_set_bridge_wakeup() was to allow bridges to be reference counted for wakeup enabling, because they may be enabled to signal wakeup on behalf of their subordinate devices and that may happen for multiple times in a row, whereas for the other devices it only makes sense to enable wakeup signaling once.
However, this becomes problematic if the bridge itself is suspended, because it is treated as a "regular" device in that case and the reference counting doesn't work.
For instance, suppose that there are two devices below a bridge and they both can signal wakeup. Every time one of them is suspended, wakeup signaling is enabled for the bridge, so when they both have been suspended, the bridge's wakeup reference counter value is 2.
Say that the bridge is suspended subsequently and acpi_pci_wakeup() is called for it. Because the bridge can signal wakeup, that function will invoke acpi_pm_set_device_wakeup() to configure it and __acpi_pm_set_device_wakeup() will be called with the last argument equal to 1. This causes __acpi_device_wakeup_enable() invoked by it to omit the reference counting, because the reference counter of the target device (the bridge) is 2 at that time.
Now say that the bridge resumes and one of the device below it resumes too, so the bridge's reference counter becomes 0 and wakeup signaling is disabled for it, but there is still the other suspended device which may need the bridge to signal wakeup on its behalf and that is not going to work.
To address this scenario, use wakeup enable reference counting for all devices, not just for bridges, so drop the last argument from __acpi_device_wakeup_enable() and __acpi_pm_set_device_wakeup(), which causes acpi_pm_set_device_wakeup() and acpi_pm_set_bridge_wakeup() to become identical, so drop the latter and use the former instead of it everywhere.
--- drivers/acpi/device_pm.c | 41 ++++++++++++----------------------------- drivers/pci/pci-acpi.c | 4 ++-- include/acpi/acpi_bus.h | 5 ----- 3 files changed, 14 insertions(+), 36 deletions(-)
drivers/acpi/device_pm.c +12 -29
@@ -702,7 +702,7 @@ static void acpi_pm_notify_work_func(strstatic DEFINE_MUTEX (acpi_wakeup_lock);static int __acpi_device_wakeup_enable (struct acpi_device *adev, -u32 target_state,int max_count) +u32 target_state) {struct acpi_device_wakeup *wakeup = &adev->wakeup;acpi_status status;
@@ -710,9 +710,10 @@ static int __acpi_device_wakeup_enable(smutex_lock (&acpi_wakeup_lock); -if (wakeup->enable_count >= max_count) +if (wakeup->enable_count >=INT_MAX ) { +acpi_handle_info (adev->handle,"Wakeup enable count out of bounds!\n" ); goto out; - + }if (wakeup->enable_count >0 ) goto inc;
@@ -749,7 +750,7 @@ out:*/ static int acpi_device_wakeup_enable (struct acpi_device *adev,u32 target_state) { -return __acpi_device_wakeup_enable (adev, target_state,1 ); +return __acpi_device_wakeup_enable (adev, target_state); }/**
@@ -779,8 +780,12 @@ out:mutex_unlock (&acpi_wakeup_lock); } -static int __acpi_pm_set_device_wakeup (struct device *dev,bool enable, -int max_count) +/** +* acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device. +* @dev: Device to enable/disable to generate wakeup events. +* @enable: Whether to enable or disable the wakeup functionality. +*/ +int acpi_pm_set_device_wakeup (struct device *dev,bool enable) {struct acpi_device *adev;int error;
@@ -800,37 +805,15 @@ static int __acpi_pm_set_device_wakeup(sreturn 0 ; } - error =__acpi_device_wakeup_enable (adev,acpi_target_system_state (), - max_count); + error =__acpi_device_wakeup_enable (adev,acpi_target_system_state ());if (!error)dev_dbg (dev,"Wakeup enabled by ACPI\n" );return error; } - -/** -* acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device. -* @dev: Device to enable/disable to generate wakeup events. -* @enable: Whether to enable or disable the wakeup functionality. -*/ -int acpi_pm_set_device_wakeup (struct device *dev,bool enable) -{ -return __acpi_pm_set_device_wakeup (dev, enable,1 ); -}EXPORT_SYMBOL_GPL (acpi_pm_set_device_wakeup);/** -* acpi_pm_set_bridge_wakeup - Enable/disable remote wakeup for given bridge. -* @dev: Bridge device to enable/disable to generate wakeup events. -* @enable: Whether to enable or disable the wakeup functionality. -*/ -int acpi_pm_set_bridge_wakeup (struct device *dev,bool enable) -{ -return __acpi_pm_set_device_wakeup (dev, enable,INT_MAX ); -} -EXPORT_SYMBOL_GPL (acpi_pm_set_bridge_wakeup); - -/** * acpi_dev_pm_low_power - Put ACPI device into a low-power state. * @dev: Device to put into a low-power state. * @adev: ACPI device node corresponding to @dev.
drivers/pci/pci-acpi.c +2 -2
@@ -587,7 +587,7 @@ static int acpi_pci_propagate_wakeup(str {while (bus->parent) {if (acpi_pm_device_can_wakeup (&bus->self->dev)) -return acpi_pm_set_bridge_wakeup (&bus->self->dev, enable); +return acpi_pm_set_device_wakeup (&bus->self->dev, enable); bus = bus->parent; }
@@ -595,7 +595,7 @@ static int acpi_pci_propagate_wakeup(str/* We have reached the root bus. */ if (bus->bridge) {if (acpi_pm_device_can_wakeup (bus->bridge)) -return acpi_pm_set_bridge_wakeup (bus->bridge, enable); +return acpi_pm_set_device_wakeup (bus->bridge, enable); }return 0 ; }
include/acpi/acpi_bus.h +0 -5
@@ -622,7 +622,6 @@ acpi_status acpi_remove_pm_notifier(strubool acpi_pm_device_can_wakeup (struct device *dev);int acpi_pm_device_sleep_state (struct device *,int *,int );int acpi_pm_set_device_wakeup (struct device *dev,bool enable); -int acpi_pm_set_bridge_wakeup (struct device *dev,bool enable);#else static inline void acpi_pm_wakeup_event (struct device *dev) {
@@ -653,10 +652,6 @@ static inline int acpi_pm_set_device_wak {return -ENODEV ; } -static inline int acpi_pm_set_bridge_wakeup (struct device *dev,bool enable) -{ -return -ENODEV ; -}#endif #ifdef CONFIG_ACPI_SLEEP
Greg Kroah-Hartman
maintainerPATCH 269/346 Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
In reply to Greg Kroah-HartmanFrom: Daniel Scally <[email protected]>
commit 12fc4dad94dfac25599f31257aac181c691ca96f upstream.
This reverts commit 8a66790b7850a6669129af078768a1d42076a0ef.
Switching this function to AE_CTRL_TERMINATE broke the documented behaviour of acpi_dev_get_resources() - AE_CTRL_TERMINATE does not, in fact, terminate the resource walk because acpi_walk_resource_buffer() ignores it (specifically converting it to AE_OK), referring to that value as "an OK termination by the user function". This means that acpi_dev_get_resources() does not abort processing when the preproc function returns a negative value.
--- drivers/acpi/resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/resource.c +1 -1
@@ -549,7 +549,7 @@ static acpi_status acpi_dev_process_reso ret = c->preproc (ares, c->preproc_data);if (ret <0 ) { c->error = ret; -return AE_CTRL_TERMINATE ; +return AE_ABORT_METHOD ; }else if (ret >0 ) {return AE_OK ; }
Greg Kroah-Hartman
maintainerPATCH 270/346 ACPI: PNP: compare the string length in the matching_id()
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
commit b08221c40febcbda9309dd70c61cf1b0ebb0e351 upstream.
Recently we met a touchscreen problem on some Thinkpad machines, the touchscreen driver (i2c-hid) is not loaded and the touchscreen can't work.
An i2c ACPI device with the name WACF2200 is defined in the BIOS, with the current rule in matching_id(), this device will be regarded as a PNP device since there is WACFXXX in the acpi_pnp_device_ids[] and this PNP device is attached to the acpi device as the 1st physical_node, this will make the i2c bus match fail when i2c bus calls acpi_companion_match() to match the acpi_id_table in the i2c-hid driver.
WACF2200 is an i2c device instead of a PNP device, after adding the string length comparing, the matching_id() will return false when matching WACF2200 and WACFXXX, and it is reasonable to compare the string length when matching two IDs.
--- drivers/acpi/acpi_pnp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_pnp.c +3 -0
@@ -320,6 +320,9 @@ static bool matching_id(const char *idst {int i; +if (strlen (idstr) !=strlen (list_id)) +return false; +if (memcmp (idstr, list_id,3 ))return false;
Greg Kroah-Hartman
maintainerPATCH 271/346 ALSA: hda: Fix regressions on clear and reconfig sysfs
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 2506318e382c4c7daa77bdc48f80a0ee82804588 upstream.
It seems that the HD-audio clear and reconfig sysfs don't work any longer after the recent driver core change. There are multiple issues around that: the linked list corruption and the dead device handling. The former issue is fixed by another patch for the driver core itself, while the latter patch needs to be addressed in HD-audio side.
This patch corresponds to the latter, it recovers those broken functions by replacing the device detach and attach actions with the standard core API functions, which are almost equivalent with unbind and bind actions.
--- sound/pci/hda/hda_codec.c | 2 +- sound/pci/hda/hda_sysfs.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/hda_codec.c +1 -1
@@ -1782,7 +1782,7 @@ int snd_hda_codec_reset(struct hda_codecreturn -EBUSY ;/* OK, let it free */ -snd_hdac_device_unregister (&codec->core); +device_release_driver (hda_codec_dev (codec));/* allow device access again */ snd_hda_unlock_devices (bus);
sound/pci/hda/hda_sysfs.c +1 -1
@@ -138,7 +138,7 @@ static int reconfig_codec(struct hda_cod "The codec is being used, can't reconfigure.\n"); goto error; } - err =snd_hda_codec_configure (codec); + err =device_reprobe (hda_codec_dev (codec));if (err <0 ) goto error; err =snd_card_register (codec->card);
Greg Kroah-Hartman
maintainerPATCH 272/346 ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
In reply to Greg Kroah-HartmanFrom: Chris Chiu <[email protected]>
commit 5cfca59604e423f720297e30a9dc493eea623493 upstream.
The ASUS laptop X430UN with ALC256 can't detect the headset microphone until ALC256_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7084,6 +7084,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x10d0 ,"ASUS X540LA/X540LJ" ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x115d ,"Asus 1015E" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x1043 ,0x11c0 ,"ASUS X556UR" ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1043 ,0x1271 ,"ASUS X430UN" ,ALC256_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x1290 ,"ASUS X441SA" ,ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x12a0 ,"ASUS X441UV" ,ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
Greg Kroah-Hartman
maintainerPATCH 273/346 ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
In reply to Greg Kroah-HartmanFrom: Chris Chiu <[email protected]>
commit 7e413528474d5895e3e315c019fb0c43522eb6d9 upstream.
The ASUS laptop Q524UQK with ALC255 codec can't detect the headset microphone until ALC255_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7101,6 +7101,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x1b13 ,"Asus U41SV" ,ALC269_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1043 ,0x1bbd ,"ASUS Z550MA" ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x1c23 ,"Asus X55U" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x1043 ,0x125e ,"ASUS Q524UQK" ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x1ccd ,"ASUS X555UB" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x3030 ,"ASUS ZN270IE" ,ALC256_FIXUP_ASUS_AIO_GPIO2 ), SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
Greg Kroah-Hartman
maintainerPATCH 274/346 ALSA: pcm: oss: Fix a few more UBSAN fixes
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 11cb881bf075cea41092a20236ba708b18e1dbb2 upstream.
There are a few places that call round{up|down}_pow_of_two() with the value zero, and this causes undefined behavior warnings. Avoid calling those macros if such a nonsense value is passed; it's a minor optimization as well, as we handle it as either an error or a value to be skipped, instead.
--- sound/core/oss/pcm_oss.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
sound/core/oss/pcm_oss.c +14 -8
@@ -708,6 +708,8 @@ static int snd_pcm_oss_period_size(struc oss_buffer_size =snd_pcm_plug_client_size (substream,snd_pcm_hw_param_value_max (slave_params,SNDRV_PCM_HW_PARAM_BUFFER_SIZE ,NULL )) * oss_frame_size; +if (!oss_buffer_size) +return -EINVAL ; oss_buffer_size =rounddown_pow_of_two (oss_buffer_size);if (atomic_read (&substream->mmap_count)) {if (oss_buffer_size > runtime->oss.mmap_bytes)
@@ -743,17 +745,21 @@ static int snd_pcm_oss_period_size(struc min_period_size =snd_pcm_plug_client_size (substream,snd_pcm_hw_param_value_min (slave_params,SNDRV_PCM_HW_PARAM_PERIOD_SIZE ,NULL )); - min_period_size *= oss_frame_size; - min_period_size =roundup_pow_of_two (min_period_size); -if (oss_period_size < min_period_size) - oss_period_size = min_period_size; +if (min_period_size) { + min_period_size *= oss_frame_size; + min_period_size =roundup_pow_of_two (min_period_size); +if (oss_period_size < min_period_size) + oss_period_size = min_period_size; + } max_period_size =snd_pcm_plug_client_size (substream,snd_pcm_hw_param_value_max (slave_params,SNDRV_PCM_HW_PARAM_PERIOD_SIZE ,NULL )); - max_period_size *= oss_frame_size; - max_period_size =rounddown_pow_of_two (max_period_size); -if (oss_period_size > max_period_size) - oss_period_size = max_period_size; +if (max_period_size) { + max_period_size *= oss_frame_size; + max_period_size =rounddown_pow_of_two (max_period_size); +if (oss_period_size > max_period_size) + oss_period_size = max_period_size; + } oss_periods = oss_buffer_size / oss_period_size;
Greg Kroah-Hartman
maintainerPATCH 275/346 ALSA: hda/realtek: Add quirk for MSI-GP73
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 09926202e939fd699650ac0fc0baa5757e069390 upstream.
MSI-GP73 (with SSID 1462:1229) requires yet again ALC1220_FIXUP_CLEVO_P950 quirk like other MSI models.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2491,6 +2491,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1458 ,0xa0ce ,"Gigabyte X570 Aorus Xtreme" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x11f7 ,"MSI-GE63" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1228 ,"MSI-GP63" ,ALC1220_FIXUP_CLEVO_P950 ), +SND_PCI_QUIRK (0x1462 ,0x1229 ,"MSI-GP73" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1275 ,"MSI-GL63" ,ALC1220_FIXUP_CLEVO_P950 ),SND_PCI_QUIRK (0x1462 ,0x1276 ,"MSI-GL73" ,ALC1220_FIXUP_CLEVO_P950 ), SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
Greg Kroah-Hartman
maintainerPATCH 276/346 ALSA: hda/realtek: Apply jack fixup for Quanta NL3
In reply to Greg Kroah-HartmanFrom: Chris Chiu <[email protected]>
commit 6ca653e3f73a1af0f30dbf9c2c79d2897074989f upstream.
The Quanta NL3 laptop has both a headphone output jack and a headset jack, on the right edge of the chassis.
The pin information suggests that both of these are at the Front. The PulseAudio is confused to differentiate them so one of the jack can neither get the jack sense working nor the audio output.
The ALC269_FIXUP_LIFEBOOK chained with ALC269_FIXUP_QUANTA_MUTE can help to differentiate 2 jacks and get the 'Auto-Mute Mode' working correctly.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -7129,6 +7129,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1458 ,0xfa53 ,"Gigabyte BXBT-2807" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1462 ,0xb120 ,"MSI Cubi MS-B120" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1462 ,0xb171 ,"Cubi N 8GL (MS-B171)" ,ALC283_FIXUP_HEADSET_MIC ), +SND_PCI_QUIRK (0x152d ,0x1082 ,"Quanta NL3" ,ALC269_FIXUP_LIFEBOOK ),SND_PCI_QUIRK (0x1558 ,0x1323 ,"Clevo N130ZU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x1325 ,"System76 Darter Pro (darp5)" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 277/346 ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
In reply to Greg Kroah-HartmanFrom: Amadej Kastelic <[email protected]>
commit 725124d10d00b2f56bb5bd08b431cc74ab3b3ace upstream.
Add VID to support native DSD reproduction on FiiO devices.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1465,6 +1465,7 @@ u64 snd_usb_interface_dsd_format_quirks(case 0x25ce :/* Mytek devices */ case 0x278b :/* Rotel? */ case 0x292b :/* Gustard/Ess based devices */ +case 0x2972 :/* FiiO devices */ case 0x2ab6 :/* T+A devices */ case 0x3353 :/* Khadas devices */ case 0x3842 :/* EVGA */
Greg Kroah-Hartman
maintainerPATCH 278/346 ALSA: usb-audio: Disable sample read check if firmware doesnt give back
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 9df28edce7c6ab38050235f6f8b43dd7ccd01b6d upstream.
Some buggy firmware don't give the current sample rate but leaves zero. Handle this case more gracefully without warning but just skip the current rate verification from the next time.
--- sound/usb/clock.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/usb/clock.c +6 -0
@@ -508,6 +508,12 @@ static int set_sample_rate_v1(struct snd } crate = data[0 ] | (data[1 ] <<8 ) | (data[2 ] <<16 ); +if (!crate) { +dev_info (&dev->dev,"failed to read current rate; disabling the check\n" ); + chip->sample_rate_read_error =3 ;/* three strikes, see above */ +return 0 ; + } +if (crate != rate) {dev_warn (&dev->dev,"current rate %d is different from the runtime rate %d\n" , crate, rate);// runtime->rate = crate;
Greg Kroah-Hartman
maintainerPATCH 279/346 s390/smp: perform initial CPU reset also for SMT siblings
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
commit b5e438ebd7e808d1d2435159ac4742e01a94b8da upstream.
Not resetting the SMT siblings might leave them in unpredictable state. One of the observed problems was that the CPU timer wasn't reset and therefore large system time values where accounted during CPU bringup.
--- arch/s390/kernel/smp.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-)
arch/s390/kernel/smp.c +3 -15
@@ -863,24 +863,12 @@ static void smp_start_secondary(void *cp/* Upping and downing of CPUs */ int __cpu_up (unsigned int cpu,struct task_struct *tidle) { -struct pcpu *pcpu; -int base, i, rc; +struct pcpu *pcpu = pcpu_devices + cpu; +int rc; - pcpu = pcpu_devices + cpu;if (pcpu->state !=CPU_STATE_CONFIGURED )return -EIO ; - base =smp_get_base_cpu (cpu); -for (i =0 ; i <= smp_cpu_mtid; i++) { -if (base + i < nr_cpu_ids) -if (cpu_online (base + i)) -break ; - } -/* -* If this is the first CPU of the core to get online -* do an initial CPU reset. -*/ -if (i > smp_cpu_mtid && -pcpu_sigp_retry (pcpu_devices + base,SIGP_INITIAL_CPU_RESET ,0 ) != +if (pcpu_sigp_retry (pcpu,SIGP_INITIAL_CPU_RESET ,0 ) !=SIGP_CC_ORDER_CODE_ACCEPTED )return -EIO ;
Greg Kroah-Hartman
maintainerPATCH 280/346 s390/kexec_file: fix diag308 subcode when loading crash kernel
In reply to Greg Kroah-HartmanFrom: Philipp Rudo <[email protected]>
commit 613775d62ec60202f98d2c5f520e6e9ba6dd4ac4 upstream.
diag308 subcode 0 performes a clear reset which inlcudes the reset of all registers in the system. While this is the preferred behavior when loading a normal kernel via kexec it prevents the crash kernel to store the register values in the dump. To prevent this use subcode 1 when loading a crash kernel instead.
--- arch/s390/purgatory/head.S | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/s390/purgatory/head.S +5 -4
@@ -61,14 +61,15 @@ jh 10b .endm -.macro START_NEXT_KERNEL base +.macro START_NEXT_KERNEL base subcode lg %r4,kernel_entry-\base(%r13) lg %r5,load_psw_mask-\base(%r13) ogr %r4,%r5 stg %r4,0(%r0) xgr %r0,%r0 - diag %r0,%r0,0x308 + lghi %r1,\subcode + diag %r0,%r1,0x308 .endm .text
@@ -123,7 +124,7 @@ ENTRY(purgatory_start) je .start_crash_kernel /* start normal kernel */ - START_NEXT_KERNEL .base_crash + START_NEXT_KERNEL .base_crash 0 .return_old_kernel: lmg %r6,%r15,gprregs-.base_crash(%r13)
@@ -227,7 +228,7 @@ ENTRY(purgatory_start) MEMCPY %r9,%r10,%r11 /* start crash kernel */ - START_NEXT_KERNEL .base_dst + START_NEXT_KERNEL .base_dst 1 load_psw_mask:
Greg Kroah-Hartman
maintainerPATCH 281/346 s390/dasd: fix hanging device offline processing
In reply to Greg Kroah-HartmanFrom: Stefan Haberland <[email protected]>
commit 658a337a606f48b7ebe451591f7681d383fa115e upstream.
For an LCU update a read unit address configuration IO is required. This is started using sleep_on(), which has early exit paths in case the device is not usable for IO. For example when it is in offline processing.
In those cases the LCU update should fail and not be retried. Therefore lcu_update_work checks if EOPNOTSUPP is returned or not.
Commit 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration") accidentally removed the EOPNOTSUPP return code from read_unit_address_configuration(), which in turn might lead to an endless loop of the LCU update in offline processing.
Fix by returning EOPNOTSUPP again if the device is not able to perform the request.
--- drivers/s390/block/dasd_alias.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/s390/block/dasd_alias.c +9 -1
@@ -462,11 +462,19 @@ static int read_unit_address_configuratispin_unlock_irqrestore (&lcu->lock, flags); rc =dasd_sleep_on (cqr); -if (rc && !suborder_not_supported (cqr)) { +if (!rc) + goto out; + +if (suborder_not_supported (cqr)) { +/* suborder not supported or device unusable for IO */ + rc = -EOPNOTSUPP ; + }else { +/* IO failed but should be retried */ spin_lock_irqsave (&lcu->lock, flags); lcu->flags |=NEED_UAC_UPDATE ;spin_unlock_irqrestore (&lcu->lock, flags); } +out:dasd_sfree_request (cqr, cqr->memdev);return rc; }
Greg Kroah-Hartman
maintainerPATCH 282/346 s390/dasd: prevent inconsistent LCU device data
In reply to Greg Kroah-HartmanFrom: Stefan Haberland <[email protected]>
commit a29ea01653493b94ea12bb2b89d1564a265081b6 upstream.
Prevent _lcu_update from adding a device to a pavgroup if the LCU still requires an update. The data is not reliable any longer and in parallel devices might have been moved on the lists already.
This might lead to list corruptions or invalid PAV grouping. Only add devices to a pavgroup if the LCU is up to date. Additional steps are taken by the scheduled lcu update.
--- drivers/s390/block/dasd_alias.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/s390/block/dasd_alias.c +9 -0
@@ -511,6 +511,14 @@ static int _lcu_update(struct dasd_devicreturn rc;spin_lock_irqsave (&lcu->lock, flags); +/* +* there is another update needed skip the remaining handling +* the data might already be outdated +* but especially do not add the device to an LCU with pending +* update +*/ +if (lcu->flags &NEED_UAC_UPDATE ) + goto out; lcu->pav =NO_PAV ;for (i =0 ; i <MAX_DEVICES_PER_LCU ; ++i) {switch (lcu->uac->unit[i].ua_type) {
@@ -529,6 +537,7 @@ static int _lcu_update(struct dasd_devic alias_list) {_add_device_to_lcu (lcu, device, refdev); } +out:spin_unlock_irqrestore (&lcu->lock, flags);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 283/346 s390/dasd: fix list corruption of pavgroup group list
In reply to Greg Kroah-HartmanFrom: Stefan Haberland <[email protected]>
commit 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 upstream.
dasd_alias_add_device() moves devices to the active_devices list in case of a scheduled LCU update regardless if they have previously been in a pavgroup or not.
Example: device A and B are in the same pavgroup.
Device A has already been in a pavgroup and the private->pavgroup pointer is set and points to a valid pavgroup. While going through dasd_add_device it is moved from the pavgroup to the active_devices list.
In parallel device B might be removed from the same pavgroup in remove_device_from_lcu() which in turn checks if the group is empty and deletes it accordingly because device A has already been removed from there.
When now device A enters remove_device_from_lcu() it is tried to remove it from the pavgroup again because the pavgroup pointer is still set and again the empty group will be cleaned up which leads to a list corruption.
Fix by setting private->pavgroup to NULL in dasd_add_device.
If the device has been the last device on the pavgroup an empty pavgroup remains but this will be cleaned up by the scheduled lcu_update which iterates over all existing pavgroups.
--- drivers/s390/block/dasd_alias.c | 1 + 1 file changed, 1 insertion(+)
drivers/s390/block/dasd_alias.c +1 -0
@@ -642,6 +642,7 @@ int dasd_alias_add_device(struct dasd_de }if (lcu->flags &UPDATE_PENDING ) {list_move (&device->alias_list, &lcu->active_devices); + private->pavgroup =NULL ;_schedule_lcu_update (lcu, device); }spin_unlock_irqrestore (&lcu->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 284/346 s390/dasd: fix list corruption of lcu list
In reply to Greg Kroah-HartmanFrom: Stefan Haberland <[email protected]>
commit 53a7f655834c7c335bf683f248208d4fbe4b47bc upstream.
In dasd_alias_disconnect_device_from_lcu the device is removed from any list on the LCU. Afterwards the LCU is removed from the lcu list if it does not contain devices any longer.
The lcu->lock protects the lcu from parallel updates. But to cancel all workers and wait for completion the lcu->lock has to be unlocked.
If two devices are removed in parallel and both are removed from the LCU the first device that takes the lcu->lock again will delete the LCU because it is already empty but the second device also tries to free the LCU which leads to a list corruption of the lcu list.
Fix by removing the device right before the lcu is checked without unlocking the lcu->lock in between.
--- drivers/s390/block/dasd_alias.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/block/dasd_alias.c +1 -1
@@ -256,7 +256,6 @@ void dasd_alias_disconnect_device_from_lreturn ; device->discipline->get_uid (device, &uid);spin_lock_irqsave (&lcu->lock, flags); -list_del_init (&device->alias_list);/* make sure that the workers don't use this device */ if (device == lcu->suc_data.device) {spin_unlock_irqrestore (&lcu->lock, flags);
@@ -283,6 +282,7 @@ void dasd_alias_disconnect_device_from_lspin_lock_irqsave (&aliastree.lock, flags);spin_lock (&lcu->lock); +list_del_init (&device->alias_list);if (list_empty (&lcu->grouplist) &&list_empty (&lcu->active_devices) &&list_empty (&lcu->inactive_devices)) {
Greg Kroah-Hartman
maintainerPATCH 285/346 staging: comedi: mf6x4: Fix AI end-of-conversion detection
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit 56c90457ebfe9422496aac6ef3d3f0f0ea8b2ec2 upstream.
I have had reports from two different people that attempts to read the analog input channels of the MF624 board fail with an ETIMEDOUT error.
After triggering the conversion, the code calls comedi_timeout() with mf6x4_ai_eoc() as the callback function to check if the conversion is complete. The callback returns 0 if complete or -EBUSY if not yet complete. comedi_timeout() returns -ETIMEDOUT if it has not completed within a timeout period which is propagated as an error to the user application.
The existing code considers the conversion to be complete when the EOLC bit is high. However, according to the user manuals for the MF624 and MF634 boards, this test is incorrect because EOLC is an active low signal that goes high when the conversion is triggered, and goes low when the conversion is complete. Fix the problem by inverting the test of the EOLC bit state.
--- drivers/staging/comedi/drivers/mf6x4.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/comedi/drivers/mf6x4.c +2 -1
@@ -112,8 +112,9 @@ static int mf6x4_ai_eoc(struct comedi_destruct mf6x4_private *devpriv = dev->private;unsigned int status; +/* EOLC goes low at end of conversion. */ status =ioread32 (devpriv->gpioc_reg); -if (status &MF6X4_GPIOC_EOLC ) +if ((status &MF6X4_GPIOC_EOLC ) ==0 )return 0 ;return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 286/346 powerpc/perf: Exclude kernel samples while counting events in user space.
In reply to Greg Kroah-HartmanFrom: Athira Rajeev <[email protected]>
commit aa8e21c053d72b6639ea5a7f1d3a1d0209534c94 upstream.
Perf event attritube supports exclude_kernel flag to avoid sampling/profiling in supervisor state (kernel). Based on this event attr flag, Monitor Mode Control Register bit is set to freeze on supervisor state. But sometimes (due to hardware limitation), Sampled Instruction Address Register (SIAR) locks on to kernel address even when freeze on supervisor is set. Patch here adds a check to drop those samples.
--- arch/powerpc/perf/core-book3s.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/powerpc/perf/core-book3s.c +10 -0
@@ -2059,6 +2059,16 @@ static void record_and_restart(struct peperf_event_update_userpage (event);/* +* Due to hardware limitation, sometimes SIAR could sample a kernel +* address even when freeze on supervisor state (kernel) is set in +* MMCR2. Check attr.exclude_kernel and address to drop the sample in +* these cases. +*/ +if (event->attr.exclude_kernel && record) +if (is_kernel_addr (mfspr (SPRN_SIAR ))) + record =0 ; + +/* * Finally record data if requested. */ if (record) {
Greg Kroah-Hartman
maintainerPATCH 287/346 crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit 17858b140bf49961b71d4e73f1c3ea9bc8e7dda0 upstream.
ecdh_set_secret() casts a void* pointer to a const u64* in order to feed it into ecc_is_key_valid(). This is not generally permitted by the C standard, and leads to actual misalignment faults on ARMv6 cores. In some cases, these are fixed up in software, but this still leads to performance hits that are entirely avoidable.
So let's copy the key into the ctx buffer first, which we will do anyway in the common case, and which guarantees correct alignment.
--- crypto/ecdh.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
crypto/ecdh.c +5 -4
@@ -57,12 +57,13 @@ static int ecdh_set_secret(struct cryptoreturn ecc_gen_privkey (ctx->curve_id, ctx->ndigits, ctx->private_key); -if (ecc_is_key_valid (ctx->curve_id, ctx->ndigits, - (const u64 *)params.key, params.key_size) <0 ) -return -EINVAL ; -memcpy (ctx->private_key, params.key, params.key_size); +if (ecc_is_key_valid (ctx->curve_id, ctx->ndigits, + ctx->private_key, params.key_size) <0 ) { +memzero_explicit (ctx->private_key, params.key_size); +return -EINVAL ; + }return 0 ; }
Re: [PATCH 4.19 287/346] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
Hi!
Quoted 8 lines
ecdh_set_secret()casts a void* pointer to a const u64* in order to feed it intoecc_is_key_valid(). This is not generally permitted by the C standard, and leads to actual misalignment faults on ARMv6 cores. In some cases, these are fixed up in software, but this still leads to performance hits that are entirely avoidable.So let's copy the key into the ctx buffer first, which we will do anyway in the common case, and which guarantees correct alignment.
Fair enough... but: params.key_size is validated in ecc_is_key_valid(), and that now happens _after_ memcpy.
How is it guaranteed that we don't overflow the buffer during memcpy?
Quoted 7 lines
+++
b/crypto/ecdh.ccrypto/ecdh.c +0
-2@@ -57,12 +57,13 @@ static int ecdh_set_secret(struct cryptoreturn ecc_gen_privkey (ctx->curve_id, ctx->ndigits, ctx->private_key); -if (ecc_is_key_valid (ctx->curve_id, ctx->ndigits, - (const u64 *)params.key, params.key_size) <0 )
crypto/ecdh.c static int ecdh_set_secret(struct crypto · line 67
Quoted 10 lines
crypto/ecdh.c +5
-2-return -EINVAL ; -memcpy (ctx->private_key, params.key, params.key_size); +if (ecc_is_key_valid (ctx->curve_id, ctx->ndigits, + ctx->private_key, params.key_size) <0 ) { +memzero_explicit (ctx->private_key, params.key_size); +return -EINVAL ; + }return 0 ;
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: [PATCH 4.19 287/346] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
Quoted 9 lines · Pavel Machek
Hi!
Quoted 6 lines
ecdh_set_secret()casts a void* pointer to a const u64* in order to feed it intoecc_is_key_valid(). This is not generally permitted by the C standard, and leads to actual misalignment faults on ARMv6 cores. In some cases, these are fixed up in software, but this still leads to performance hits that are entirely avoidable.
Quoted 8 lines
Quoted 2 lines
So let's copy the key into the ctx buffer first, which we will do anyway in the common case, and which guarantees correct alignment.
Fair enough... but: params.key_size is validated in
ecc_is_key_valid(), and that now happens _after_ memcpy.How is it guaranteed that we don't overflow the buffer during memcpy?
It is not, thanks for pointing that out. There are some redundant checks being performed, so you won't trigger it easily with fuzzing, but afaict, an intentionally crafted invalid input could indeed overflow the buffer.
I'll send a fix shortly.
Quoted 23 lines
Quoted 7 lines
+++
b/crypto/ecdh.ccrypto/ecdh.c +0
-2@@ -57,12 +57,13 @@ static int ecdh_set_secret(struct cryptoreturn ecc_gen_privkey (ctx->curve_id, ctx->ndigits, ctx->private_key); -if (ecc_is_key_valid (ctx->curve_id, ctx->ndigits, - (const u64 *)params.key, params.key_size) <0 )crypto/ecdh.c static int ecdh_set_secret(struct crypto · line 67
Quoted 10 lines
crypto/ecdh.c +5
-2-return -EINVAL ; -memcpy (ctx->private_key, params.key, params.key_size); +if (ecc_is_key_valid (ctx->curve_id, ctx->ndigits, + ctx->private_key, params.key_size) <0 ) { +memzero_explicit (ctx->private_key, params.key_size); +return -EINVAL ; + }return 0 ;Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 288/346 EDAC/amd64: Fix PCI component registration
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
commit 706657b1febf446a9ba37dc51b89f46604f57ee9 upstream.
In order to setup its PCI component, the driver needs any node private instance in order to get a reference to the PCI device and hand that into edac_pci_create_generic_ctl(). For convenience, it uses the 0th memory controller descriptor under the assumption that if any, the 0th will be always present.
However, this assumption goes wrong when the 0th node doesn't have memory and the driver doesn't initialize an instance for it:
EDAC amd64: F17h detected (node 0).
...
EDAC amd64: Node 0: No DIMMs detected.
But looking up node instances is not really needed - all one needs is the pointer to the proper device which gets discovered during instance init.
So stash that pointer into a variable and use it when setting up the EDAC PCI component.
Clear that variable when the driver needs to unwind due to some instances failing init to avoid any registration imbalance.
--- drivers/edac/amd64_edac.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/edac/amd64_edac.c +14 -12
@@ -18,6 +18,9 @@ static struct msr __percpu *msrs;/* Per-node stuff */ static struct ecc_settings **ecc_stngs; +/* Device for the PCI component */ +static struct device *pci_ctl_dev; +/* * Valid scrub rates for the K8 hardware memory scrubber. We map the scrubbing * bandwidth to a valid bit pattern. The 'set' operation finds the 'matching-
@@ -2563,6 +2566,9 @@ reserve_mc_sibling_devs(struct amd64_pvtreturn -ENODEV ; } +if (!pci_ctl_dev) + pci_ctl_dev = &pvt->F0->dev; +edac_dbg (1 ,"F0: %s\n" ,pci_name (pvt->F0));edac_dbg (1 ,"F3: %s\n" ,pci_name (pvt->F3));edac_dbg (1 ,"F6: %s\n" ,pci_name (pvt->F6));
@@ -2587,6 +2593,9 @@ reserve_mc_sibling_devs(struct amd64_pvtreturn -ENODEV ; } +if (!pci_ctl_dev) + pci_ctl_dev = &pvt->F2->dev; +edac_dbg (1 ,"F1: %s\n" ,pci_name (pvt->F1));edac_dbg (1 ,"F2: %s\n" ,pci_name (pvt->F2));edac_dbg (1 ,"F3: %s\n" ,pci_name (pvt->F3));
@@ -3441,21 +3450,10 @@ static void remove_one_instance(unsignedstatic void setup_pci_device (void ) { -struct mem_ctl_info *mci; -struct amd64_pvt *pvt; -if (pci_ctl)return ; - mci =edac_mc_find (0 ); -if (!mci) -return ; - - pvt = mci->pvt_info; -if (pvt->umc) - pci_ctl =edac_pci_create_generic_ctl (&pvt->F0->dev,EDAC_MOD_STR ); -else - pci_ctl =edac_pci_create_generic_ctl (&pvt->F2->dev,EDAC_MOD_STR ); + pci_ctl =edac_pci_create_generic_ctl (pci_ctl_dev,EDAC_MOD_STR );if (!pci_ctl) {pr_warn ("%s(): Unable to create PCI control\n" , __func__);pr_warn ("%s(): PCI error report via EDAC not set\n" , __func__);
@@ -3535,6 +3533,8 @@ static int __init amd64_edac_init(void)return 0 ; err_pci: + pci_ctl_dev =NULL ; +msrs_free (msrs); msrs =NULL ;
@@ -3566,6 +3566,8 @@ static void __exit amd64_edac_exit(void)kfree (ecc_stngs); ecc_stngs =NULL ; + pci_ctl_dev =NULL ; +msrs_free (msrs); msrs =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 289/346 USB: serial: mos7720: fix parallel-port state restore
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 975323ab8f116667676c30ca3502a6757bd89e8d upstream.
The parallel-port restore operations is called when a driver claims the port and is supposed to restore the provided state (e.g. saved when releasing the port).
--- drivers/usb/serial/mos7720.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/mos7720.c +2 -0
@@ -638,6 +638,8 @@ static void parport_mos7715_restore_statspin_unlock (&release_lock);return ; } + mos_parport->shadowDCR = s->u.pc.ctr; + mos_parport->shadowECR = s->u.pc.ecr;write_parport_reg_nonblock (mos_parport,MOS7720_DCR , mos_parport->shadowDCR); write_parport_reg_nonblock(mos_parport, MOS7720_ECR,
Greg Kroah-Hartman
maintainerPATCH 290/346 USB: serial: digi_acceleport: fix write-wakeup deadlocks
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 5098e77962e7c8947f87bd8c5869c83e000a522a upstream.
The driver must not call tty_wakeup() while holding its private lock as line disciplines are allowed to call back into write() from write_wakeup(), leading to a deadlock.
Also remove the unneeded work struct that was used to defer wakeup in order to work around a possible race in ancient times (see comment about n_tty write_chan() in commit 14b54e39b412 ("USB: serial: remove changelogs and old todo entries")).
--- drivers/usb/serial/digi_acceleport.c | 45 ++++++++++------------------------- 1 file changed, 13 insertions(+), 32 deletions(-)
drivers/usb/serial/digi_acceleport.c +13 -32
@@ -19,7 +19,6 @@#include <linux/tty_flip.h> #include <linux/module.h> #include <linux/spinlock.h> -#include <linux/workqueue.h> #include <linux/uaccess.h> #include <linux/usb.h> #include <linux/wait.h>
@@ -198,14 +197,12 @@ struct digi_port {int dp_throttle_restart;wait_queue_head_t dp_flush_wait;wait_queue_head_t dp_close_wait;/* wait queue for close */ -struct work_struct dp_wakeup_work;struct usb_serial_port *dp_port; };/* Local Function Declarations */ -static void digi_wakeup_write_lock (struct work_struct *work);static int digi_write_oob_command (struct usb_serial_port *port,unsigned char *buf,int count,int interruptible); static int digi_write_inb_command(struct usb_serial_port *port,
@@ -356,26 +353,6 @@ __releases(lock)return timeout; } - -/* -* Digi Wakeup Write -* -* Wake up port, line discipline, and tty processes sleeping -* on writes. -*/ - -static void digi_wakeup_write_lock (struct work_struct *work) -{ -struct digi_port *priv = - container_of(work, struct digi_port, dp_wakeup_work); -struct usb_serial_port *port = priv->dp_port; -unsigned long flags; - -spin_lock_irqsave (&priv->dp_port_lock, flags); -tty_port_tty_wakeup (&port->port); -spin_unlock_irqrestore (&priv->dp_port_lock, flags); -} -/* * Digi Write OOB Command *
@@ -987,6 +964,7 @@ static void digi_write_bulk_callback(strunsigned long flags;int ret =0 ;int status = urb->status; +bool wakeup;/* port and serial sanity check */ if (port ==NULL || (priv =usb_get_serial_port_data (port)) ==NULL ) {
@@ -1013,6 +991,7 @@ static void digi_write_bulk_callback(str }/* try to send any buffered data on this port */ + wakeup = true;spin_lock_irqsave (&priv->dp_port_lock, flags); priv->dp_write_urb_in_use =0 ;if (priv->dp_out_buf_len >0 ) {
@@ -1028,19 +1007,18 @@ static void digi_write_bulk_callback(strif (ret ==0 ) { priv->dp_write_urb_in_use =1 ; priv->dp_out_buf_len =0 ; + wakeup = false; } } -/* wake up processes sleeping on writes immediately */ -tty_port_tty_wakeup (&port->port); -/* also queue up a wakeup at scheduler time, in case we */ -/* lost the race in write_chan(). */ -schedule_work (&priv->dp_wakeup_work); -spin_unlock_irqrestore (&priv->dp_port_lock, flags); +if (ret && ret != -EPERM )dev_err_console (port,"%s: usb_submit_urb failed, ret=%d, port=%d\n" , __func__, ret, priv->dp_port_num); + +if (wakeup) +tty_port_tty_wakeup (&port->port); }static int digi_write_room (struct tty_struct *tty)
@@ -1240,7 +1218,6 @@ static int digi_port_init(struct usb_serinit_waitqueue_head (&priv->dp_transmit_idle_wait);init_waitqueue_head (&priv->dp_flush_wait);init_waitqueue_head (&priv->dp_close_wait); -INIT_WORK (&priv->dp_wakeup_work, digi_wakeup_write_lock); priv->dp_port = port;init_waitqueue_head (&port->write_wait);
@@ -1509,13 +1486,14 @@ static int digi_read_oob_callback(struct rts =C_CRTSCTS (tty);if (tty && opcode ==DIGI_CMD_READ_INPUT_SIGNALS ) { +bool wakeup = false; +spin_lock_irqsave (&priv->dp_port_lock, flags);/* convert from digi flags to termiox flags */ if (val &DIGI_READ_INPUT_SIGNALS_CTS ) { priv->dp_modem_signals |=TIOCM_CTS ; -/* port must be open to use tty struct */ if (rts) -tty_port_tty_wakeup (&port->port); + wakeup = true; }else { priv->dp_modem_signals &= ~TIOCM_CTS ;/* port must be open to use tty struct */
@@ -1534,6 +1512,9 @@ static int digi_read_oob_callback(struct priv->dp_modem_signals &= ~TIOCM_CD ;spin_unlock_irqrestore (&priv->dp_port_lock, flags); + +if (wakeup) +tty_port_tty_wakeup (&port->port); }else if (opcode ==DIGI_CMD_TRANSMIT_IDLE ) {spin_lock_irqsave (&priv->dp_port_lock, flags); priv->dp_transmit_idle =1 ;
Greg Kroah-Hartman
maintainerPATCH 291/346 USB: serial: keyspan_pda: fix dropped unthrottle interrupts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 696c541c8c6cfa05d65aa24ae2b9e720fc01766e upstream.
Commit c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity checks") broke write-unthrottle handling by dropping well-formed unthrottle-interrupt packets which are precisely two bytes long. This could lead to blocked writers not being woken up when buffer space again becomes available.
Instead, stop unconditionally printing the third byte which is (presumably) only valid on modem-line changes.
--- drivers/usb/serial/keyspan_pda.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/serial/keyspan_pda.c +2 -2
@@ -172,11 +172,11 @@ static void keyspan_pda_rx_interrupt(strbreak ;case 1 :/* status interrupt */ -if (len <3 ) { +if (len <2 ) {dev_warn (&port->dev,"short interrupt message received\n" );break ; } -dev_dbg (&port->dev,"rx int, d1=%d, d2=%d\n" , data[1 ], data[2 ]); +dev_dbg (&port->dev,"rx int, d1=%d\n" , data[1 ]);switch (data[1 ]) {case 1 :/* modemline change */ break ;
Greg Kroah-Hartman
maintainerPATCH 292/346 USB: serial: keyspan_pda: fix write deadlock
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream.
The write() callback can be called in interrupt context (e.g. when used as a console) so interrupts must be disabled while holding the port lock to prevent a possible deadlock.
--- drivers/usb/serial/keyspan_pda.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/serial/keyspan_pda.c +4 -3
@@ -443,6 +443,7 @@ static int keyspan_pda_write(struct tty_int request_unthrottle =0 ;int rc =0 ;struct keyspan_pda_private *priv; +unsigned long flags; priv =usb_get_serial_port_data (port);/* guess how much room is left in the device's ring buffer, and if we
@@ -462,13 +463,13 @@ static int keyspan_pda_write(struct tty_the TX urb is in-flight (wait until it completes) the device is full (wait until it says there is room) */ -spin_lock_bh (&port->lock); +spin_lock_irqsave (&port->lock, flags);if (!test_bit (0 , &port->write_urbs_free) || priv->tx_throttled) { -spin_unlock_bh (&port->lock); +spin_unlock_irqrestore (&port->lock, flags);return 0 ; }clear_bit (0 , &port->write_urbs_free); -spin_unlock_bh (&port->lock); +spin_unlock_irqrestore (&port->lock, flags);/* At this point the URB is in our control, nobody else can submit it again (the only sudden transition was the one from EINPROGRESS to
Greg Kroah-Hartman
maintainerPATCH 293/346 USB: serial: keyspan_pda: fix stalled writes
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit c01d2c58698f710c9e13ba3e2d296328606f74fd upstream.
Make sure to clear the write-busy flag also in case no new data was submitted due to lack of device buffer space so that writing is resumed once space again becomes available.
--- drivers/usb/serial/keyspan_pda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/keyspan_pda.c +1 -1
@@ -548,7 +548,7 @@ static int keyspan_pda_write(struct tty_ rc = count; exit: -if (rc <0 ) +if (rc <=0 )set_bit (0 , &port->write_urbs_free);return rc; }
Greg Kroah-Hartman
maintainerPATCH 294/346 USB: serial: keyspan_pda: fix write-wakeup use-after-free
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 37faf50615412947868c49aee62f68233307f4e4 upstream.
The driver's deferred write wakeup was never flushed on disconnect, something which could lead to the driver port data being freed while the wakeup work is still scheduled.
Fix this by using the usb-serial write wakeup which gets cancelled properly on disconnect.
--- drivers/usb/serial/keyspan_pda.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-)
drivers/usb/serial/keyspan_pda.c +3 -14
@@ -43,8 +43,7 @@struct keyspan_pda_private {int tx_room;int tx_throttled; -struct work_struct wakeup_work; -struct work_struct unthrottle_work; +struct work_struct unthrottle_work;struct usb_serial *serial;struct usb_serial_port *port; };
@@ -97,15 +96,6 @@ static const struct usb_device_id id_tab };#endif -static void keyspan_pda_wakeup_write (struct work_struct *work) -{ -struct keyspan_pda_private *priv = - container_of(work, struct keyspan_pda_private, wakeup_work); -struct usb_serial_port *port = priv->port; - -tty_port_tty_wakeup (&port->port); -} -static void keyspan_pda_request_unthrottle (struct work_struct *work) { struct keyspan_pda_private *priv =
@@ -183,7 +173,7 @@ static void keyspan_pda_rx_interrupt(strcase 2 :/* tx unthrottle interrupt */ priv->tx_throttled =0 ;/* queue up a wakeup at scheduler time */ -schedule_work (&priv->wakeup_work); +usb_serial_port_softint (port);break ;default :break ;
@@ -563,7 +553,7 @@ static void keyspan_pda_write_bulk_callb priv =usb_get_serial_port_data (port);/* queue up a wakeup at scheduler time */ -schedule_work (&priv->wakeup_work); +usb_serial_port_softint (port); }
@@ -716,7 +706,6 @@ static int keyspan_pda_port_probe(structif (!priv)return -ENOMEM ; -INIT_WORK (&priv->wakeup_work, keyspan_pda_wakeup_write);INIT_WORK (&priv->unthrottle_work, keyspan_pda_request_unthrottle); priv->serial = port->serial; priv->port = port;
Greg Kroah-Hartman
maintainerPATCH 295/346 USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 49fbb8e37a961396a5b6c82937c70df91de45e9d upstream.
The driver's transmit-unthrottle work was never flushed on disconnect, something which could lead to the driver port data being freed while the unthrottle work is still scheduled.
Fix this by cancelling the unthrottle work when shutting down the port.
--- drivers/usb/serial/keyspan_pda.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/keyspan_pda.c +4 -0
@@ -647,8 +647,12 @@ error: }static void keyspan_pda_close (struct usb_serial_port *port) { +struct keyspan_pda_private *priv =usb_get_serial_port_data (port); +usb_kill_urb (port->write_urb);usb_kill_urb (port->interrupt_in_urb); + +cancel_work_sync (&priv->unthrottle_work); }
Greg Kroah-Hartman
maintainerPATCH 296/346 USB: serial: keyspan_pda: fix write unthrottling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 320f9028c7873c3c7710e8e93e5c979f4c857490 upstream.
The driver did not update its view of the available device buffer space until write() was called in task context. This meant that write_room() would return 0 even after the device had sent a write-unthrottle notification, something which could lead to blocked writers not being woken up (e.g. when using OPOST).
Note that we must also request an unthrottle notification is case a write() request fills the device buffer exactly.
--- drivers/usb/serial/keyspan_pda.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-)
drivers/usb/serial/keyspan_pda.c +20 -9
@@ -40,6 +40,8 @@#define DRIVER_AUTHOR "Brian Warner <[email protected]>"#define DRIVER_DESC "USB Keyspan PDA Converter driver" +#define KEYSPAN_TX_THRESHOLD 16 +struct keyspan_pda_private {int tx_room;int tx_throttled;
@@ -110,7 +112,7 @@ static void keyspan_pda_request_unthrott7 ,/* request_unthrottle */ USB_TYPE_VENDOR |USB_RECIP_INTERFACE |USB_DIR_OUT , -16 ,/* value: threshold */ +KEYSPAN_TX_THRESHOLD ,0 ,/* index */ NULL , 0,
@@ -129,6 +131,8 @@ static void keyspan_pda_rx_interrupt(strint retval;int status = urb->status;struct keyspan_pda_private *priv; +unsigned long flags; + priv =usb_get_serial_port_data (port);switch (status) {
@@ -171,7 +175,10 @@ static void keyspan_pda_rx_interrupt(strcase 1 :/* modemline change */ break ;case 2 :/* tx unthrottle interrupt */ +spin_lock_irqsave (&port->lock, flags); priv->tx_throttled =0 ; + priv->tx_room =max (priv->tx_room,KEYSPAN_TX_THRESHOLD ); +spin_unlock_irqrestore (&port->lock, flags);/* queue up a wakeup at scheduler time */ usb_serial_port_softint (port);break ;
@@ -505,7 +512,8 @@ static int keyspan_pda_write(struct tty_ goto exit; } } -if (count > priv->tx_room) { + +if (count >= priv->tx_room) {/* we're about to completely fill the Tx buffer, so we'll be throttled afterwards. */ count = priv->tx_room;
@@ -560,14 +568,17 @@ static void keyspan_pda_write_bulk_callbstatic int keyspan_pda_write_room (struct tty_struct *tty) {struct usb_serial_port *port = tty->driver_data; -struct keyspan_pda_private *priv; - priv =usb_get_serial_port_data (port); -/* used by n_tty.c for processing of tabs and such. Giving it our -conservative guess is probably good enough, but needs testing by -running a console through the device. */ -return priv->tx_room; -} +struct keyspan_pda_private *priv =usb_get_serial_port_data (port); +unsigned long flags; +int room =0 ; + +spin_lock_irqsave (&port->lock, flags); +if (test_bit (0 , &port->write_urbs_free) && !priv->tx_throttled) + room = priv->tx_room; +spin_unlock_irqrestore (&port->lock, flags); +return room; +}static int keyspan_pda_chars_in_buffer (struct tty_struct *tty) {
Greg Kroah-Hartman
maintainerPATCH 297/346 ext4: fix a memory leak of ext4_free_data
In reply to Greg Kroah-HartmanFrom: Chunguang Xu <[email protected]>
commit cca415537244f6102cbb09b5b90db6ae2c953bdd upstream.
When freeing metadata, we will create an ext4_free_data and insert it into the pending free list. After the current transaction is committed, the object will be freed.
ext4_mb_free_metadata() will check whether the area to be freed overlaps with the pending free list. If true, return directly. At this time, ext4_free_data is leaked. Fortunately, the probability of this problem is small, since it only occurs if the file system is corrupted such that a block is claimed by more one inode and those inodes are deleted within a single jbd2 transaction.
--- fs/ext4/mballoc.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/mballoc.c +1 -0
@@ -4690,6 +4690,7 @@ ext4_mb_free_metadata(handle_t *handle,ext4_group_first_block_no (sb, group) +EXT4_C2B (sbi, cluster), "Block already on to-be-freed list"); +kmem_cache_free (ext4_free_data_cachep, new_entry);return 0 ; } }
Greg Kroah-Hartman
maintainerPATCH 298/346 ext4: fix deadlock with fs freezing and EA inodes
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 46e294efc355c48d1dd4d58501aa56dac461792a upstream.
Xattr code using inodes with large xattr data can end up dropping last inode reference (and thus deleting the inode) from places like ext4_xattr_set_entry(). That function is called with transaction started and so ext4_evict_inode() can deadlock against fs freezing like:
CPU1 CPU2
removexattr() freeze_super()
vfs_removexattr()
ext4_xattr_set()
handle = ext4_journal_start()
...
ext4_xattr_set_entry()
iput(old_ea_inode)
ext4_evict_inode(old_ea_inode)
sb->s_writers.frozen = SB_FREEZE_FS;
sb_wait_write(sb, SB_FREEZE_FS);
ext4_freeze()
jbd2_journal_lock_updates()
-> blocks waiting for all
handles to stop
sb_start_intwrite()
-> blocks as sb is already in SB_FREEZE_FS stateGenerally it is advisable to delete inodes from a separate transaction as it can consume quite some credits however in this case it would be quite clumsy and furthermore the credits for inode deletion are quite limited and already accounted for. So just tweak ext4_evict_inode() to avoid freeze protection if we have transaction already started and thus it is not really needed anyway.
--- fs/ext4/inode.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
fs/ext4/inode.c +15 -6
@@ -203,6 +203,7 @@ void ext4_evict_inode(struct inode *inod*/ int extra_credits =6 ;struct ext4_xattr_inode_array *ea_inode_array =NULL ; +bool freeze_protected = false;trace_ext4_evict_inode (inode);
@@ -250,9 +251,14 @@ void ext4_evict_inode(struct inode *inod/* * Protect us against freezing - iput() caller didn't have to have any -* protection against it -*/ -sb_start_intwrite (inode->i_sb); +* protection against it. When we are in a running transaction though, +* we are already protected against freezing and we cannot grab further +* protection due to lock ordering constraints. +*/ +if (!ext4_journal_current_handle ()) { +sb_start_intwrite (inode->i_sb); + freeze_protected = true; + }if (!IS_NOQUOTA (inode)) extra_credits +=EXT4_MAXQUOTAS_DEL_BLOCKS (inode->i_sb);
@@ -271,7 +277,8 @@ void ext4_evict_inode(struct inode *inod* cleaned up. */ ext4_orphan_del (NULL , inode); -sb_end_intwrite (inode->i_sb); +if (freeze_protected) +sb_end_intwrite (inode->i_sb); goto no_delete; }
@@ -312,7 +319,8 @@ void ext4_evict_inode(struct inode *inod stop_handle:ext4_journal_stop (handle);ext4_orphan_del (NULL , inode); -sb_end_intwrite (inode->i_sb); +if (freeze_protected) +sb_end_intwrite (inode->i_sb);ext4_xattr_inode_array_free (ea_inode_array); goto no_delete; }
@@ -341,7 +349,8 @@ stop_handle:else ext4_free_inode (handle, inode);ext4_journal_stop (handle); -sb_end_intwrite (inode->i_sb); +if (freeze_protected) +sb_end_intwrite (inode->i_sb);ext4_xattr_inode_array_free (ea_inode_array);return ; no_delete:
Greg Kroah-Hartman
maintainerPATCH 299/346 KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit ca4e514774930f30b66375a974b5edcbebaf0e7e upstream.
ARMv8.2 introduced TTBCR2, which shares TCR_EL1 with TTBCR. Gracefully handle traps to this register when HCR_EL2.TVM is set.
--- arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/sys_regs.c | 1 + 2 files changed, 2 insertions(+)
arch/arm64/include/asm/kvm_host.h +1 -0
@@ -165,6 +165,7 @@ enum vcpu_sysreg {#define c2_TTBR1 (TTBR1_EL1 * 2)/* Translation Table Base Register 1 */ #define c2_TTBR1_high (c2_TTBR1 + 1)/* TTBR1 top 32 bits */ #define c2_TTBCR (TCR_EL1 * 2)/* Translation Table Base Control R. */ +#define c2_TTBCR2 (c2_TTBCR + 1)/* Translation Table Base Control R. 2 */ #define c3_DACR (DACR32_EL2 * 2)/* Domain Access Control Register */ #define c5_DFSR (ESR_EL1 * 2)/* Data Fault Status Register */ #define c5_IFSR (IFSR32_EL2 * 2)/* Instruction Fault Status Register */
arch/arm64/kvm/sys_regs.c +1 -0
@@ -1661,6 +1661,7 @@ static const struct sys_reg_desc cp15_re { Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 }, { Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 }, { Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, c2_TTBCR }, + { Op1( 0), CRn( 2), CRm( 0), Op2( 3), access_vm_reg, NULL, c2_TTBCR2 }, { Op1( 0), CRn( 3), CRm( 0), Op2( 0), access_vm_reg, NULL, c3_DACR }, { Op1( 0), CRn( 5), CRm( 0), Op2( 0), access_vm_reg, NULL, c5_DFSR }, { Op1( 0), CRn( 5), CRm( 0), Op2( 1), access_vm_reg, NULL, c5_IFSR },
Greg Kroah-Hartman
maintainerPATCH 300/346 ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
In reply to Greg Kroah-HartmanFrom: H. Nikolaus Schaller <[email protected]>
commit df9dbaf2c415cd94ad520067a1eccfee62f00a33 upstream.
The pinmux control register offset passed to OMAP4_IOPAD is odd.
--- arch/arm/boot/dts/omap4-panda-es.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/omap4-panda-es.dts +1 -1
@@ -49,7 +49,7 @@ button_pins: pinmux_button_pins { pinctrl-single,pins = < - OMAP4_IOPAD(0x11b, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */ + OMAP4_IOPAD(0x0fc, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */ >; }; };
Greg Kroah-Hartman
maintainerPATCH 301/346 ARM: dts: at91: sama5d2: fix CAN message ram offset and size
In reply to Greg Kroah-HartmanFrom: Nicolas Ferre <[email protected]>
commit 85b8350ae99d1300eb6dc072459246c2649a8e50 upstream.
CAN0 and CAN1 instances share the same message ram configured at 0x210000 on sama5d2 Linux systems.
According to current configuration of CAN0, we need 0x1c00 bytes so that the CAN1 don't overlap its message ram:
64 x RX FIFO0 elements => 64 x 72 bytes
32 x TXE (TX Event FIFO) elements => 32 x 8 bytes
32 x TXB (TX Buffer) elements => 32 x 72 bytes
So a total of 7168 bytes (0x1C00).
Fix offset to match this needed size.
Make the CAN0 message ram ioremap match exactly this size so that is easily understandable. Adapt CAN1 size accordingly.
--- arch/arm/boot/dts/sama5d2.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/sama5d2.dtsi +3 -3
@@ -1298,7 +1298,7 @@ can0: can@f8054000 { compatible = "bosch,m_can"; - reg = <0xf8054000 0x4000>, <0x210000 0x4000>; + reg = <0xf8054000 0x4000>, <0x210000 0x1c00>; reg-names = "m_can", "message_ram"; interrupts = <56 IRQ_TYPE_LEVEL_HIGH 7>, <64 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1491,7 +1491,7 @@ can1: can@fc050000 { compatible = "bosch,m_can"; - reg = <0xfc050000 0x4000>, <0x210000 0x4000>; + reg = <0xfc050000 0x4000>, <0x210000 0x3800>; reg-names = "m_can", "message_ram"; interrupts = <57 IRQ_TYPE_LEVEL_HIGH 7>, <65 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1501,7 +1501,7 @@ assigned-clocks = <&can1_gclk>; assigned-clock-parents = <&utmi>; assigned-clock-rates = <40000000>; - bosch,mram-cfg = <0x1100 0 0 64 0 0 32 32>; + bosch,mram-cfg = <0x1c00 0 0 64 0 0 32 32>; status = "disabled"; };
Greg Kroah-Hartman
maintainerPATCH 302/346 powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
In reply to Greg Kroah-HartmanFrom: Mathieu Desnoyers <[email protected]>
commit d85be8a49e733dcd23674aa6202870d54bf5600d upstream.
The placeholder for instruction selection should use the second argument's operand, which is %1, not %0. This could generate incorrect assembly code if the memory addressing of operand %0 is a different form from that of operand %1.
Also remove the %Un placeholder because having %Un placeholders for two operands which are based on the same local var (ptep) doesn't make much sense. By the way, it doesn't change the current behaviour because "<>" constraint is missing for the associated "=m".
[chleroy: revised commit log iaw segher's comments and removed %U0]
--- arch/powerpc/include/asm/book3s/32/pgtable.h | 4 ++-- arch/powerpc/include/asm/nohash/pgtable.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/include/asm/book3s/32/pgtable.h +2 -2
@@ -434,9 +434,9 @@ static inline void __set_pte_at(struct mif (pte_val (*ptep) & _PAGE_HASHPTE)flush_hash_entry (mm, ptep, addr); __asm__ __volatile__("\ -stw%U0%X0 %2,%0\n\ +stw%X0 %2,%0\n\ eieio\n\ -stw%U0%X0 %L2,%1" +stw%X1 %L2,%1" :"=m" (*ptep),"=m" (*((unsigned char *)ptep+4 )) :"r" (pte) :"memory" );
arch/powerpc/include/asm/nohash/pgtable.h +2 -2
@@ -151,9 +151,9 @@ static inline void __set_pte_at(struct m*/ if (IS_ENABLED (CONFIG_PPC32 ) &&IS_ENABLED (CONFIG_PTE_64BIT ) && !percpu) { __asm__ __volatile__("\ -stw%U0%X0 %2,%0\n\ +stw%X0 %2,%0\n\ eieio\n\ -stw%U0%X0 %L2,%1" +stw%X1 %L2,%1" :"=m" (*ptep),"=m" (*((unsigned char *)ptep+4 )) :"r" (pte) :"memory" );return ;
Greg Kroah-Hartman
maintainerPATCH 303/346 powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
commit f10881a46f8914428110d110140a455c66bdf27b upstream.
Commit bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace") introduced the following error when invoking the errinjct userspace tool:
[root@ltcalpine2-lp5 librtas]# errinjct open
[327884.071171] sys_rtas: RTAS call blocked - exploit attempt? [327884.071186] sys_rtas: token=0x26, nargs=0 (called by errinjct) errinjct: Could not open RTAS error injection facility errinjct: librtas: open: Unexpected I/O error
The entry for ibm,open-errinjct in rtas_filter array has a typo where the "j" is omitted in the rtas call name. After fixing this typo the errinjct tool functions again as expected.
[root@ltcalpine2-lp5 linux]# errinjct open
RTAS error injection facility open, token = 1
--- arch/powerpc/kernel/rtas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/rtas.c +1 -1
@@ -1095,7 +1095,7 @@ static struct rtas_filter rtas_filters[] { "ibm,display-message", -1, 0, -1, -1, -1 }, { "ibm,errinjct", -1, 2, -1, -1, -1, 1024 }, { "ibm,close-errinjct", -1, -1, -1, -1, -1 }, - { "ibm,open-errinct", -1, -1, -1, -1, -1 }, + { "ibm,open-errinjct", -1, -1, -1, -1, -1 }, { "ibm,get-config-addr-info2", -1, -1, -1, -1, -1 }, { "ibm,get-dynamic-sensor-state", -1, 1, -1, -1, -1 }, { "ibm,get-indices", -1, 2, 3, -1, -1 },
Greg Kroah-Hartman
maintainerPATCH 304/346 powerpc/xmon: Change printk() to pr_cont()
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
commit 7c6c86b36a36dd4a13d30bba07718e767aa2e7a1 upstream.
Since some time now, printk() adds carriage return, leading to unusable xmon output if there is no udbg backend available:
[ 54.288722] sysrq: Entering xmon [ 54.292209] Vector: 0 at [cace3d2c] [ 54.292274] pc: [ 54.292331] c0023650 [ 54.292468] : xmon+0x28/0x58 [ 54.292519] [ 54.292574] lr: [ 54.292630] c0023724 [ 54.292749] : sysrq_handle_xmon+0xa4/0xfc [ 54.292801] [ 54.292867] sp: cace3de8 [ 54.292931] msr: 9032 [ 54.292999] current = 0xc28d0000 [ 54.293072] pid = 377, comm = sh [ 54.293157] Linux version 5.10.0-rc6-s3k-dev-01364-gedf13f0ccd76-dirty ([email protected]) (powerpc64-linux-gcc (GCC) 10.1.0, GNU ld (GNU Binutils) 2.34) #4211 PREEMPT Fri Dec 4 09:32:11 UTC 2020 [ 54.293287] enter ? for help [ 54.293470] [cace3de8] [ 54.293532] c0023724 [ 54.293654] sysrq_handle_xmon+0xa4/0xfc [ 54.293711] (unreliable) ... [ 54.296002] [ 54.296159] --- Exception: c01 (System Call) at [ 54.296217] 0fd4e784 [ 54.296303] [ 54.296375] SP (7fca6ff0) is in userspace [ 54.296431] mon> [ 54.296484] <no input ...>
Use pr_cont() instead.
--- arch/powerpc/xmon/nonstdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/xmon/nonstdio.c +1 -1
@@ -182,7 +182,7 @@ void xmon_printf(const char *format, ...if (n && rc ==0 ) {/* No udbg hooks, fallback to printk() - dangerous */ -printk ("%s" , xmon_outbuf); +pr_cont ("%s" , xmon_outbuf); } }
Greg Kroah-Hartman
maintainerPATCH 305/346 powerpc/powernv/memtrace: Dont leak kernel memory to user space
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit c74cf7a3d59a21b290fe0468f5b470d0b8ee37df upstream.
We currently leak kernel memory to user space, because memory offlining doesn't do any implicit clearing of memory and we are missing explicit clearing of memory.
Let's keep it simple and clear pages before removing the linear mapping.
Reproduced in QEMU/TCG with 10 GiB of main memory:
[root@localhost ~]# dd obs=9G if=/dev/urandom of=/dev/null
[... wait until "free -m" used counter no longer changes and cancel] 19665802+0 records in
1+0 records out
9663676416 bytes (9.7 GB, 9.0 GiB) copied, 135.548 s, 71.3 MB/s [root@localhost ~]# cat /sys/devices/system/memory/block_size_bytes 40000000
[root@localhost ~]# echo 0x40000000 > /sys/kernel/debug/powerpc/memtrace/enable
[ 402.978663][ T1086] page:000000001bc4bc74 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24900 [ 402.980063][ T1086] flags: 0x7ffff000001000(reserved) [ 402.980415][ T1086] raw: 007ffff000001000 c00c000000924008 c00c000000924008 0000000000000000 [ 402.980627][ T1086] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 402.980845][ T1086] page dumped because: unmovable page [ 402.989608][ T1086] Offlined Pages 16384 [ 403.324155][ T1086] memtrace: Allocated trace memory on node 0 at 0x0000000200000000
Before this patch:
[root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace | head
00000000 c8 25 72 51 4d 26 36 c5 5c c2 56 15 d5 1a cd 10 |.%rQM&6.\.V.....|
00000010 19 b9 50 b2 cb e3 60 b8 ec 0a f3 ec 4b 3c 39 f0 |..P...`.....K<9.|$
00000020 4e 5a 4c cf bd 26 19 ff 37 79 13 67 24 b7 b8 57 |NZL..&..7y.g$..W|$
00000030 98 3e f5 be 6f 14 6a bd a4 52 bc 6e e9 e0 c1 5d |.>..o.j..R.n...]|$
00000040 76 b3 ae b5 88 d7 da e3 64 23 85 2c 10 88 07 b6 |v.......d#.,....|$
00000050 9a d8 91 de f7 50 27 69 2e 64 9c 6f d3 19 45 79 |.....P'i.d.o..Ey|$
00000060 6a 6f 8a 61 71 19 1f c7 f1 df 28 26 ca 0f 84 55 |jo.aq.....(&...U|$
00000070 01 3f be e4 e2 e1 da ff 7b 8c 8e 32 37 b4 24 53 |.?......{..27.$S|$
00000080 1b 70 30 45 56 e6 8c c4 0e b5 4c fb 9f dd 88 06 |.p0EV.....L.....|$
00000090 ef c4 18 79 f1 60 b1 5c 79 59 4d f4 36 d7 4a 5c |...y.`.\yYM.6.J\|$After this patch:
[root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace | head 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| *
40000000
--- arch/powerpc/platforms/powernv/memtrace.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
arch/powerpc/platforms/powernv/memtrace.c +22 -0
@@ -70,6 +70,23 @@ static int change_memblock_state(structreturn 0 ; } +static void memtrace_clear_range (unsigned long start_pfn, +unsigned long nr_pages) +{ +unsigned long pfn; + +/* +* As pages are offline, we cannot trust the memmap anymore. As HIGHMEM +* does not apply, avoid passing around "struct page" and use +* clear_page() instead directly. +*/ +for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) { +if (IS_ALIGNED (pfn,PAGES_PER_SECTION )) +cond_resched (); +clear_page (__va (PFN_PHYS (pfn))); + } +} +/* called with device_hotplug_lock held */ static bool memtrace_offline_pages (u32 nid,u64 start_pfn,u64 nr_pages) {
@@ -115,6 +132,11 @@ static u64 memtrace_alloc_node(u32 nid,for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {if (memtrace_offline_pages (nid, base_pfn, nr_pages) == true) {/* +* Clear the range while we still have a linear +* mapping. +*/ +memtrace_clear_range (base_pfn, nr_pages); +/* * Remove memory in memory block size chunks so that * iomem resources are always split to the same size and * we never try to remove memory that spans two iomem
Greg Kroah-Hartman
maintainerPATCH 306/346 powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit d6718941a2767fb383e105d257d2105fe4f15f0e upstream.
It's very easy to crash the kernel right now by simply trying to enable memtrace concurrently, hammering on the "enable" interface
loop.sh:
#!/bin/bash
dmesg --console-off
while true; do
echo 0x40000000 > /sys/kernel/debug/powerpc/memtrace/enable
done
[root@localhost ~]# loop.sh &
[root@localhost ~]# loop.sh &
Resulting quickly in a kernel crash. Let's properly protect using a mutex.
--- arch/powerpc/platforms/powernv/memtrace.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
arch/powerpc/platforms/powernv/memtrace.c +15 -7
@@ -33,6 +33,7 @@ struct memtrace_entry {char name[16 ]; }; +static DEFINE_MUTEX (memtrace_mutex);static u64 memtrace_size;static struct memtrace_entry *memtrace_array;
@@ -294,6 +295,7 @@ static int memtrace_online(void)static int memtrace_enable_set (void *data,u64 val) { +int rc = -EAGAIN ;u64 bytes;/*
@@ -306,25 +308,31 @@ static int memtrace_enable_set(void *datreturn -EINVAL ; } +mutex_lock (&memtrace_mutex); +/* Re-add/online previously removed/offlined memory */ if (memtrace_size) {if (memtrace_online ()) -return -EAGAIN ; + goto out_unlock; } -if (!val) -return 0 ; +if (!val) { + rc =0 ; + goto out_unlock; + }/* Offline and remove memory */ if (memtrace_init_regions_runtime (val)) -return -EINVAL ; + goto out_unlock;if (memtrace_init_debugfs ()) -return -EINVAL ; + goto out_unlock; memtrace_size = val; - -return 0 ; + rc =0 ; +out_unlock: +mutex_unlock (&memtrace_mutex); +return rc; }static int memtrace_enable_get (void *data,u64 *val)
Greg Kroah-Hartman
maintainerPATCH 307/346 ima: Dont modify file descriptor mode on the fly
In reply to Greg Kroah-HartmanFrom: Roberto Sassu <[email protected]>
commit 207cdd565dfc95a0a5185263a567817b7ebf5467 upstream.
Commit a408e4a86b36b ("ima: open a new file instance if no read permissions") already introduced a second open to measure a file when the original file descriptor does not allow it. However, it didn't remove the existing method of changing the mode of the original file descriptor, which is still necessary if the current process does not have enough privileges to open a new one.
Changing the mode isn't really an option, as the filesystem might need to do preliminary steps to make the read possible. Thus, this patch removes the code and keeps the second open as the only option to measure a file when it is unreadable with the original file descriptor.
--- security/integrity/ima/ima_crypto.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-)
security/integrity/ima/ima_crypto.c +5 -15
@@ -415,7 +415,7 @@ int ima_calc_file_hash(struct file *fileloff_t i_size;int rc;struct file *f = file; -bool new_file_instance = false, modified_mode = false; +bool new_file_instance = false;/* * For consistency, fail file's opened with the O_DIRECT flag on
@@ -433,18 +433,10 @@ int ima_calc_file_hash(struct file *file O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL); flags |=O_RDONLY ; f =dentry_open (&file->f_path, flags, file->f_cred); -if (IS_ERR (f)) { -/* -* Cannot open the file again, lets modify f_mode -* of original and continue -*/ -pr_info_ratelimited ("Unable to reopen file for reading.\n" ); - f = file; - f->f_mode |=FMODE_READ ; - modified_mode = true; - }else { - new_file_instance = true; - } +if (IS_ERR (f)) +return PTR_ERR (f); + + new_file_instance = true; } i_size =i_size_read (file_inode (f));
@@ -459,8 +451,6 @@ int ima_calc_file_hash(struct file *file out:if (new_file_instance)fput (f); -else if (modified_mode) - f->f_mode &= ~FMODE_READ ;return rc; }
Greg Kroah-Hartman
maintainerPATCH 308/346 ceph: fix race in concurrent __ceph_remove_cap invocations
In reply to Greg Kroah-HartmanFrom: Luis Henriques <[email protected]>
commit e5cafce3ad0f8652d6849314d951459c2bff7233 upstream.
A NULL pointer dereference may occur in __ceph_remove_cap with some of the callbacks used in ceph_iterate_session_caps, namely trim_caps_cb and remove_session_caps_cb. Those callers hold the session->s_mutex, so they are prevented from concurrent execution, but ceph_evict_inode does not.
Since the callers of this function hold the i_ceph_lock, the fix is simply a matter of returning immediately if caps->ci is NULL.
Cc: [email protected]
URL: https://tracker.ceph.com/issues/43272
--- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/ceph/caps.c +9 -2
@@ -1047,12 +1047,19 @@ void __ceph_remove_cap(struct ceph_cap * {struct ceph_mds_session *session = cap->session;struct ceph_inode_info *ci = cap->ci; -struct ceph_mds_client *mdsc = -ceph_sb_to_client (ci->vfs_inode.i_sb)->mdsc; +struct ceph_mds_client *mdsc;int removed =0 ; +/* 'ci' being NULL means the remove have already occurred */ +if (!ci) { +dout ("%s: cap inode is NULL\n" , __func__); +return ; + } +dout ("__ceph_remove_cap %p from %p\n" , cap, &ci->vfs_inode); + mdsc =ceph_inode_to_client (&ci->vfs_inode)->mdsc; +/* remove from inode's cap rbtree, and clear auth cap */ rb_erase (&cap->ci_node, &ci->i_caps);if (ci->i_auth_cap == cap)
Greg Kroah-Hartman
maintainerPATCH 309/346 SMB3: avoid confusing warning message on mount to Azure
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit ebcd6de98754d9b6a5f89d7835864b1c365d432f upstream.
Mounts to Azure cause an unneeded warning message in dmesg
"CIFS: VFS: parse_server_interfaces: incomplete interface info"
Azure rounds up the size (by 8 additional bytes, to a 16 byte boundary) of the structure returned on the query of the server interfaces at mount time. This is permissible even though different than other servers so do not log a warning if query network interfaces response is only rounded up by 8 bytes or fewer.
--- fs/cifs/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cifs/smb2ops.c +2 -1
@@ -366,7 +366,8 @@ parse_server_interfaces(struct network_i goto out; } -if (bytes_left || p->Next) +/* Azure rounds the buffer size up 8, to a 16 byte boundary */ +if ((bytes_left >8 ) || p->Next)cifs_dbg (VFS ,"%s: incomplete interface info\n" , __func__);
Greg Kroah-Hartman
maintainerPATCH 310/346 SMB3.1.1: do not log warning message if server doesnt populate salt
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit 7955f105afb6034af344038d663bc98809483cdd upstream.
In the negotiate protocol preauth context, the server is not required to populate the salt (although it is done by most servers) so do not warn on mount.
We retain the checks (warn) that the preauth context is the minimum size and that the salt does not exceed DataLength of the SMB response. Although we use the defaults in the case that the preauth context response is invalid, these checks may be useful in the future as servers add support for additional mechanisms.
--- fs/cifs/smb2pdu.c | 7 +++++-- fs/cifs/smb2pdu.h | 14 +++++++++++--- 2 files changed, 16 insertions(+), 5 deletions(-)
fs/cifs/smb2pdu.c +5 -2
@@ -406,8 +406,8 @@ build_preauth_ctxt(struct smb2_preauth_n pneg_ctxt->ContextType =SMB2_PREAUTH_INTEGRITY_CAPABILITIES ; pneg_ctxt->DataLength =cpu_to_le16 (38 ); pneg_ctxt->HashAlgorithmCount =cpu_to_le16 (1 ); - pneg_ctxt->SaltLength =cpu_to_le16 (SMB311_SALT_SIZE ); -get_random_bytes (pneg_ctxt->Salt,SMB311_SALT_SIZE ); + pneg_ctxt->SaltLength =cpu_to_le16 (SMB311_LINUX_CLIENT_SALT_SIZE ); +get_random_bytes (pneg_ctxt->Salt,SMB311_LINUX_CLIENT_SALT_SIZE ); pneg_ctxt->HashAlgorithms =SMB2_PREAUTH_INTEGRITY_SHA512 ; }
@@ -461,6 +461,9 @@ static void decode_preauth_context(strucif (len <MIN_PREAUTH_CTXT_DATA_LEN ) {printk_once (KERN_WARNING "server sent bad preauth context\n" );return ; + }else if (len <MIN_PREAUTH_CTXT_DATA_LEN +le16_to_cpu (ctxt->SaltLength)) { +pr_warn_once ("server sent invalid SaltLength\n" ); +return ; }if (le16_to_cpu (ctxt->HashAlgorithmCount) !=1 )printk_once (KERN_WARNING "illegal SMB3 hash algorithm count\n" );
fs/cifs/smb2pdu.h +11 -3
@@ -257,12 +257,20 @@ struct smb2_neg_context {/* Followed by array of data */ } __packed; -#define SMB311_SALT_SIZE 32 +#define SMB311_LINUX_CLIENT_SALT_SIZE 32/* Hash Algorithm Types */ #define SMB2_PREAUTH_INTEGRITY_SHA512 cpu_to_le16(0x0001)#define SMB2_PREAUTH_HASH_SIZE 64 -#define MIN_PREAUTH_CTXT_DATA_LEN (SMB311_SALT_SIZE + 6) +/* +* SaltLength that the server send can be zero, so the only three required +* fields (all __le16) end up six bytes total, so the minimum context data len +* in the response is six bytes which accounts for +* +* HashAlgorithmCount, SaltLength, and 1 HashAlgorithm. +*/ +#define MIN_PREAUTH_CTXT_DATA_LEN 6 +struct smb2_preauth_neg_context {__le16 ContextType;/* 1 */ __le16 DataLength;
@@ -270,7 +278,7 @@ struct smb2_preauth_neg_context {__le16 HashAlgorithmCount;/* 1 */ __le16 SaltLength;__le16 HashAlgorithms;/* HashAlgorithms[0] since only one defined */ -__u8 Salt[SMB311_SALT_SIZE ]; +__u8 Salt[SMB311_LINUX_CLIENT_SALT_SIZE ]; } __packed;/* Encryption Algorithms Ciphers */
Greg Kroah-Hartman
maintainerPATCH 311/346 ubifs: wbuf: Dont leak kernel memory to flash
In reply to Greg Kroah-HartmanFrom: Richard Weinberger <[email protected]>
commit 20f1431160c6b590cdc269a846fc5a448abf5b98 upstream.
Write buffers use a kmalloc()'ed buffer, they can leak up to seven bytes of kernel memory to flash if writes are not aligned.
So use ubifs_pad() to fill these gaps with padding bytes. This was never a problem while scanning because the scanner logic manually aligns node lengths and skips over these gaps.
--- fs/ubifs/io.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/ubifs/io.c +11 -2
@@ -331,7 +331,7 @@ void ubifs_pad(const struct ubifs_info * {uint32_t crc; -ubifs_assert (c, pad >=0 && !(pad &7 )); +ubifs_assert (c, pad >=0 );if (pad >=UBIFS_PAD_NODE_SZ ) {struct ubifs_ch *ch = buf;
@@ -728,6 +728,10 @@ int ubifs_wbuf_write_nolock(struct ubifs* write-buffer. */ memcpy (wbuf->buf + wbuf->used, buf, len); +if (aligned_len > len) { +ubifs_assert (c, aligned_len - len <8 ); +ubifs_pad (c, wbuf->buf + wbuf->used + len, aligned_len - len); + }if (aligned_len == wbuf->avail) { dbg_io("flush jhead %s wbuf to LEB %d:%d",
@@ -820,13 +824,18 @@ int ubifs_wbuf_write_nolock(struct ubifs }spin_lock (&wbuf->lock); -if (aligned_len) +if (aligned_len) {/* * And now we have what's left and what does not take whole * max. write unit, so write it to the write-buffer and we are * done. */ memcpy (wbuf->buf, buf + written, len); +if (aligned_len > len) { +ubifs_assert (c, aligned_len - len <8 ); +ubifs_pad (c, wbuf->buf + len, aligned_len - len); + } + }if (c->leb_size - wbuf->offs >= c->max_write_size) wbuf->size = c->max_write_size;
Greg Kroah-Hartman
maintainerPATCH 312/346 jffs2: Fix GC exit abnormally
In reply to Greg Kroah-HartmanFrom: Zhe Li <[email protected]>
commit 9afc9a8a4909fece0e911e72b1060614ba2f7969 upstream.
The log of this problem is:
jffs2: Error garbage collecting node at 0x***!
jffs2: No space for garbage collection. Aborting GC thread
This is because GC believe that it do nothing, so it abort.
After going over the image of jffs2, I find a scene that can trigger this problem stably.
The scene is: there is a normal dirent node at summary-area, but abnormal at corresponding not-summary-area with error name_crc.
The reason that GC exit abnormally is because it find that abnormal dirent node to GC, but when it goes to function jffs2_add_fd_to_list, it cannot meet the condition listed below:
if ((*prev)->nhash == new->nhash && !strcmp((*prev)->name, new->name))
So no node is marked obsolete, statistical information of erase_block do not change, which cause GC exit abnormally.
The root cause of this problem is: we do not check the name_crc of the abnormal dirent node with summary is enabled.
Noticed that in function jffs2_scan_dirent_node, we use function jffs2_scan_dirty_space to deal with the dirent node with error name_crc. So this patch add a checking code in function read_direntry to ensure the correctness of dirent node. If checked failed, the dirent node will be marked obsolete so GC will pass this node and this problem will be fixed.
--- fs/jffs2/readinode.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/jffs2/readinode.c +16 -0
@@ -672,6 +672,22 @@ static inline int read_direntry(struct jjffs2_free_full_dirent (fd);return -EIO ; } + +#ifdef CONFIG_JFFS2_SUMMARY +/* +* we use CONFIG_JFFS2_SUMMARY because without it, we +* have checked it while mounting +*/ + crc =crc32 (0 , fd->name, rd->nsize); +if (unlikely (crc !=je32_to_cpu (rd->name_crc))) { +JFFS2_NOTICE ("name CRC failed on dirent node at" +"%#08x: read %#08x,calculated %#08x\n" , +ref_offset (ref),je32_to_cpu (rd->node_crc), crc); +jffs2_mark_node_obsolete (c, ref); +jffs2_free_full_dirent (fd); +return 0 ; + } +#endif } fd->nhash =full_name_hash (NULL , fd->name, rd->nsize);
Greg Kroah-Hartman
maintainerPATCH 313/346 jfs: Fix array index bounds check in dbAdjTree
In reply to Greg Kroah-HartmanFrom: Dave Kleikamp <[email protected]>
commit c61b3e4839007668360ed8b87d7da96d2e59fc6c upstream.
Bounds checking tools can flag a bug in dbAdjTree() for an array index out of bounds in dmt_stree. Since dmt_stree can refer to the stree in both structures dmaptree and dmapctl, use the larger array to eliminate the false positive.
--- fs/jfs/jfs_dmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/jfs_dmap.h +1 -1
@@ -196,7 +196,7 @@ typedef union dmtree {#define dmt_leafidx t1.leafidx#define dmt_height t1.height#define dmt_budmin t1.budmin -#define dmt_stree t1.stree +#define dmt_stree t2.stree/* * on-disk aggregate disk allocation map descriptor.
Greg Kroah-Hartman
maintainerPATCH 314/346 drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
In reply to Greg Kroah-HartmanFrom: Zwane Mwaikambo <[email protected]>
commit 73b62cdb93b68d7e2c1d373c6a411bc00c53e702 upstream.
I observed this when unplugging a DP monitor whilst a computer is asleep and then waking it up. This left DP chardev nodes still being present on the filesystem and accessing these device nodes caused an oops because drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened. This can also be reproduced by creating a device node with mknod(1) and issuing an open(2)
[166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018 [166164.933202] #PF: supervisor read access in kernel mode [166164.933204] #PF: error_code(0x0000) - not-present page [166164.933205] PGD 0 P4D 0 [166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI [166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G W 5.8.0-rc6+ #1 [166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W (1.11 ) 04/21/2020 [166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70 [drm_kms_helper] [166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7 c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6 <8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1 [166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246 [166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000 [166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180 [166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0 [166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003 [166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000 [166164.933244] FS: 00007f7fb041eb00(0000) GS:ffff8a9411500000(0000) knlGS:0000000000000000 [166164.933245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0 [166164.933247] Call Trace: [166164.933264] auxdev_open+0x1b/0x40 [drm_kms_helper] [166164.933278] chrdev_open+0xa7/0x1c0 [166164.933282] ? cdev_put.part.0+0x20/0x20 [166164.933287] do_dentry_open+0x161/0x3c0 [166164.933291] vfs_open+0x2d/0x30 [166164.933297] path_openat+0xb27/0x10e0 [166164.933306] ? atime_needs_update+0x73/0xd0 [166164.933309] do_filp_open+0x91/0x100 [166164.933313] ? __alloc_fd+0xb2/0x150 [166164.933316] do_sys_openat2+0x210/0x2d0 [166164.933318] do_sys_open+0x46/0x80 [166164.933320] __x64_sys_openat+0x20/0x30 [166164.933328] do_syscall_64+0x52/0xc0 [166164.933336] entry_SYSCALL_64_after_hwframe+0x44/0xa9
(gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29 Dump of assembler code for function drm_dp_aux_dev_get_by_minor:
0x0000000000017b10 <+0>: callq 0x17b15 <drm_dp_aux_dev_get_by_minor+5> 0x0000000000017b15 <+5>: push %rbp 0x0000000000017b16 <+6>: mov %rsp,%rbp 0x0000000000017b19 <+9>: push %r12 0x0000000000017b1b <+11>: mov %edi,%r12d 0x0000000000017b1e <+14>: mov $0x0,%rdi 0x0000000000017b25 <+21>: callq 0x17b2a <drm_dp_aux_dev_get_by_minor+26> 0x0000000000017b2a <+26>: mov %r12d,%esi 0x0000000000017b2d <+29>: mov $0x0,%rdi 0x0000000000017b34 <+36>: callq 0x17b39 <drm_dp_aux_dev_get_by_minor+41> 0x0000000000017b39 <+41>: mov 0x18(%rax),%edx <========= 0x0000000000017b3c <+44>: mov %rax,%r12 0x0000000000017b3f <+47>: lea 0x18(%rax),%rdi 0x0000000000017b43 <+51>: test %edx,%edx 0x0000000000017b45 <+53>: je 0x17b7a <drm_dp_aux_dev_get_by_minor+106> 0x0000000000017b47 <+55>: lea 0x1(%rdx),%ecx 0x0000000000017b4a <+58>: mov %edx,%eax 0x0000000000017b4c <+60>: lock cmpxchg %ecx,(%rdi) 0x0000000000017b50 <+64>: jne 0x17b76 <drm_dp_aux_dev_get_by_minor+102> 0x0000000000017b52 <+66>: test %edx,%edx 0x0000000000017b54 <+68>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93> 0x0000000000017b56 <+70>: test %ecx,%ecx 0x0000000000017b58 <+72>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93> 0x0000000000017b5a <+74>: mov $0x0,%rdi 0x0000000000017b61 <+81>: callq 0x17b66 <drm_dp_aux_dev_get_by_minor+86> 0x0000000000017b66 <+86>: mov %r12,%rax 0x0000000000017b69 <+89>: pop %r12 0x0000000000017b6b <+91>: pop %rbp 0x0000000000017b6c <+92>: retq 0x0000000000017b6d <+93>: xor %esi,%esi 0x0000000000017b6f <+95>: callq 0x17b74 <drm_dp_aux_dev_get_by_minor+100> 0x0000000000017b74 <+100>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74> 0x0000000000017b76 <+102>: mov %eax,%edx 0x0000000000017b78 <+104>: jmp 0x17b43 <drm_dp_aux_dev_get_by_minor+51> 0x0000000000017b7a <+106>: xor %r12d,%r12d 0x0000000000017b7d <+109>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74>
End of assembler dump.
(gdb) list *drm_dp_aux_dev_get_by_minor+0x290x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
60 static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
61 {
62 struct drm_dp_aux_dev *aux_dev = NULL;
63
64 mutex_lock(&aux_idr_mutex); 65 aux_dev = idr_find(&aux_idr, index); 66 if (!kref_get_unless_zero(&aux_dev->refcount))
67 aux_dev = NULL;
68 mutex_unlock(&aux_idr_mutex);
69
(gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount $8 = 0x18
Looking at the caller, checks on the minor are pushed down to drm_dp_aux_dev_get_by_minor()
static int auxdev_open(struct inode *inode, struct file *file)
{
unsigned int minor = iminor(inode);
struct drm_dp_aux_dev *aux_dev;
aux_dev = drm_dp_aux_dev_get_by_minor(minor); <====
if (!aux_dev)
return -ENODEV;
file->private_data = aux_dev;
return 0;
}--- drivers/gpu/drm/drm_dp_aux_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_dp_aux_dev.c +1 -1
@@ -60,7 +60,7 @@ static struct drm_dp_aux_dev *drm_dp_auxmutex_lock (&aux_idr_mutex); aux_dev =idr_find (&aux_idr, index); -if (!kref_get_unless_zero (&aux_dev->refcount)) +if (aux_dev && !kref_get_unless_zero (&aux_dev->refcount)) aux_dev =NULL ;mutex_unlock (&aux_idr_mutex);
Greg Kroah-Hartman
maintainerPATCH 315/346 spi: spi-sh: Fix use-after-free on unbind
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit e77df3eca12be4b17f13cf9f215cff248c57d98f upstream.
spi_sh_remove() accesses the driver's private data after calling spi_unregister_master() even though that function releases the last reference on the spi_master and thereby frees the private data.
Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound.
--- drivers/spi/spi-sh.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
drivers/spi/spi-sh.c +4 -9
@@ -450,7 +450,7 @@ static int spi_sh_probe(struct platform_return irq; } - master =spi_alloc_master (&pdev->dev,sizeof (struct spi_sh_data )); + master =devm_spi_alloc_master (&pdev->dev,sizeof (struct spi_sh_data ));if (master ==NULL ) {dev_err (&pdev->dev,"spi_alloc_master error.\n" );return -ENOMEM ;
@@ -468,16 +468,14 @@ static int spi_sh_probe(struct platform_break ;default :dev_err (&pdev->dev,"No support width\n" ); - ret = -ENODEV ; - goto error1; +return -ENODEV ; } ss->irq = irq; ss->master = master; ss->addr =devm_ioremap (&pdev->dev, res->start,resource_size (res));if (ss->addr ==NULL ) {dev_err (&pdev->dev,"ioremap error.\n" ); - ret = -ENOMEM ; - goto error1; +return -ENOMEM ; }INIT_LIST_HEAD (&ss->queue);spin_lock_init (&ss->lock);
@@ -487,7 +485,7 @@ static int spi_sh_probe(struct platform_ ret =request_irq (irq, spi_sh_irq,0 ,"spi_sh" , ss);if (ret <0 ) {dev_err (&pdev->dev,"request_irq error\n" ); - goto error1; +return ret; } master->num_chipselect =2 ;
@@ -506,9 +504,6 @@ static int spi_sh_probe(struct platform_ error3:free_irq (irq, ss); - error1: -spi_master_put (master); -return ret; }
Greg Kroah-Hartman
maintainerPATCH 316/346 spi: davinci: Fix use-after-free on unbind
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 373afef350a93519b4b8d636b0895da8650b714b upstream.
davinci_spi_remove() accesses the driver's private data after it's been freed with spi_master_put().
Fix by moving the spi_master_put() to the end of the function.
--- drivers/spi/spi-davinci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-davinci.c +1 -1
@@ -1086,13 +1086,13 @@ static int davinci_spi_remove(struct plaspi_bitbang_stop (&dspi->bitbang);clk_disable_unprepare (dspi->clk); -spi_master_put (master);if (dspi->dma_rx) {dma_release_channel (dspi->dma_rx);dma_release_channel (dspi->dma_tx); } +spi_master_put (master);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 317/346 spi: pic32: Dont leak DMA channels in probe error path
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit c575e9113bff5e024d75481613faed5ef9d465b2 upstream.
If the calls to devm_request_irq() or devm_spi_register_master() fail on probe of the PIC32 SPI driver, the DMA channels requested by pic32_spi_dma_prep() are erroneously not released. Plug the leak.
--- drivers/spi/spi-pic32.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-pic32.c +1 -0
@@ -839,6 +839,7 @@ static int pic32_spi_probe(struct platforeturn 0 ; err_bailout: +pic32_spi_dma_unprep (pic32s);clk_disable_unprepare (pic32s->clk); err_master:spi_master_put (master);
Greg Kroah-Hartman
maintainerPATCH 318/346 spi: rb4xx: Dont leak SPI master in probe error path
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit a4729c3506c3eb1a6ca5c0289f4e7cafa4115065 upstream.
If the calls to devm_clk_get(), devm_spi_register_master() or clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver, the spi_master struct is erroneously not freed.
Fix by switching over to the new devm_spi_alloc_master() helper.
--- drivers/spi/spi-rb4xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-rb4xx.c +1 -1
@@ -148,7 +148,7 @@ static int rb4xx_spi_probe(struct platfoif (IS_ERR (spi_base))return PTR_ERR (spi_base); - master =spi_alloc_master (&pdev->dev,sizeof (*rbspi)); + master =devm_spi_alloc_master (&pdev->dev,sizeof (*rbspi));if (!master)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 319/346 spi: sc18is602: Dont leak SPI master in probe error path
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 5b8c88462d83331dacb48aeaec8388117fef82e0 upstream.
If the call to devm_gpiod_get_optional() fails on probe of the NXP SC18IS602/603 SPI driver, the spi_master struct is erroneously not freed.
Fix by switching over to the new devm_spi_alloc_master() helper.
--- drivers/spi/spi-sc18is602.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/spi/spi-sc18is602.c +2 -11
@@ -248,13 +248,12 @@ static int sc18is602_probe(struct i2c_clstruct sc18is602_platform_data *pdata =dev_get_platdata (dev);struct sc18is602 *hw;struct spi_master *master; -int error;if (!i2c_check_functionality (client->adapter,I2C_FUNC_I2C |I2C_FUNC_SMBUS_WRITE_BYTE_DATA ))return -EINVAL ; - master =spi_alloc_master (dev,sizeof (struct sc18is602 )); + master =devm_spi_alloc_master (dev,sizeof (struct sc18is602 ));if (!master)return -ENOMEM ;
@@ -308,15 +307,7 @@ static int sc18is602_probe(struct i2c_cl master->min_speed_hz = hw->freq /128 ; master->max_speed_hz = hw->freq /4 ; - error =devm_spi_register_master (dev, master); -if (error) - goto error_reg; - -return 0 ; - -error_reg: -spi_master_put (master); -return error; +return devm_spi_register_master (dev, master); }static const struct i2c_device_id sc18is602_id[] = {
Greg Kroah-Hartman
maintainerPATCH 320/346 spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 5ef76dac0f2c26aeae4ee79eb830280f16d5aceb upstream.
If the calls to devm_platform_ioremap_resource(), irq_of_parse_and_map() or devm_request_irq() fail on probe of the ST SSC4 SPI driver, the runtime PM disable depth is incremented even though it was not decremented before. Fix it.
--- drivers/spi/spi-st-ssc4.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/spi/spi-st-ssc4.c +3 -2
@@ -379,13 +379,14 @@ static int spi_st_probe(struct platform_ ret =devm_spi_register_master (&pdev->dev, master);if (ret) {dev_err (&pdev->dev,"Failed to register master\n" ); - goto clk_disable; + goto rpm_disable; }return 0 ; -clk_disable: +rpm_disable:pm_runtime_disable (&pdev->dev); +clk_disable:clk_disable_unprepare (spi_st->clk); put_master:spi_master_put (master);
Greg Kroah-Hartman
maintainerPATCH 321/346 spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
commit 702b15cb97123cedcec56a39d9a21c5288eb9ae1 upstream.
Fix the missing clk_disable_unprepare() before return from mt7621_spi_probe in the error handling case.
--- drivers/staging/mt7621-spi/spi-mt7621.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/mt7621-spi/spi-mt7621.c +2 -0
@@ -455,6 +455,7 @@ static int mt7621_spi_probe(struct platf master =spi_alloc_master (&pdev->dev,sizeof (*rs));if (master ==NULL ) {dev_info (&pdev->dev,"master allocation failed\n" ); +clk_disable_unprepare (clk);return -ENOMEM ; }
@@ -480,6 +481,7 @@ static int mt7621_spi_probe(struct platf ret =device_reset (&pdev->dev);if (ret) {dev_err (&pdev->dev,"SPI reset failed!\n" ); +clk_disable_unprepare (clk);return ret; }
Greg Kroah-Hartman
maintainerPATCH 322/346 soc: qcom: smp2p: Safely acquire spinlock without IRQs
In reply to Greg Kroah-HartmanFrom: Evan Green <[email protected]>
commit fc3e62e25c3896855b7c3d72df19ca6be3459c9f upstream.
smp2p_update_bits() should disable interrupts when it acquires its spinlock. This is important because without the _irqsave, a priority inversion can occur.
This function is called both with interrupts enabled in qcom_q6v5_request_stop(), and with interrupts disabled in ipa_smp2p_panic_notifier(). IRQ handling of spinlocks should be consistent to avoid the panic notifier deadlocking because it's sitting on the thread that's already got the lock via _request_stop().
Found via lockdep.
--- drivers/soc/qcom/smp2p.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/soc/qcom/smp2p.c +3 -2
@@ -326,15 +326,16 @@ static int qcom_smp2p_inbound_entry(strustatic int smp2p_update_bits (void *data,u32 mask,u32 value) {struct smp2p_entry *entry = data; +unsigned long flags;u32 orig;u32 val; -spin_lock (&entry->lock); +spin_lock_irqsave (&entry->lock, flags); val = orig =readl (entry->value); val &= ~mask; val |= value;writel (val, entry->value); -spin_unlock (&entry->lock); +spin_unlock_irqrestore (&entry->lock, flags);if (val != orig)qcom_smp2p_kick (entry->smp2p);
Greg Kroah-Hartman
maintainerPATCH 323/346 mtd: spinand: Fix OOB read
In reply to Greg Kroah-HartmanFrom: Miquel Raynal <[email protected]>
commit 868cbe2a6dcee451bd8f87cbbb2a73cf463b57e5 upstream.
So far OOB have never been used in SPI-NAND, add the missing memcpy to make it work properly.
--- drivers/mtd/nand/spi/core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mtd/nand/spi/core.c +4 -0
@@ -378,6 +378,10 @@ static int spinand_write_to_cache_op(str } } +if (req->ooblen) +memcpy (req->oobbuf.in, spinand->oobbuf + req->ooboffs, + req->ooblen); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 324/346 mtd: parser: cmdline: Fix parsing of part-names with colons
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
commit 639a82434f16a6df0ce0e7c8595976f1293940fd upstream.
Some devices (especially QCA ones) are already using hardcoded partition names with colons in it. The OpenMesh A62 for example provides following mtd relevant information via cmdline:
root=31:11 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(custom),64k(0:KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) rootfsname=rootfs rootwait
The change to split only on the last colon between mtd-id and partitions will cause newpart to see following string for the first partition:
KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive)
Such a partition list cannot be parsed and thus the device fails to boot.
Avoid this behavior by making sure that the start of the first part-name ("(") will also be the last byte the mtd-id split algorithm is using for its colon search.
--- drivers/mtd/cmdlinepart.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/mtd/cmdlinepart.c +13 -1
@@ -231,7 +231,7 @@ static int mtdpart_setup_real(char *s)struct cmdline_mtd_partition *this_mtd;struct mtd_partition *parts;int mtd_id_len, num_parts; -char *p, *mtd_id, *semicol; +char *p, *mtd_id, *semicol, *open_parenth;/* * Replace the first ';' by a NULL char so strrchr can work
@@ -241,6 +241,14 @@ static int mtdpart_setup_real(char *s)if (semicol) *semicol ='\0' ; +/* +* make sure that part-names with ":" will not be handled as +* part of the mtd-id with an ":" +*/ + open_parenth =strchr (s,'(' ); +if (open_parenth) + *open_parenth ='\0' ; + mtd_id = s;/*
@@ -250,6 +258,10 @@ static int mtdpart_setup_real(char *s)*/ p =strrchr (s,':' ); +/* Restore the '(' now. */ +if (open_parenth) + *open_parenth ='(' ; +/* Restore the ';' now. */ if (semicol) *semicol =';' ;
Greg Kroah-Hartman
maintainerPATCH 325/346 mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
In reply to Greg Kroah-HartmanFrom: Praveenkumar I <[email protected]>
commit bc3686021122de953858a5be4cbf6e3f1d821e79 upstream.
After each codeword NAND_FLASH_STATUS is read for possible operational failures. But there is no DMA sync for CPU operation before reading it and this leads to incorrect or older copy of DMA buffer in reg_read_buf.
This patch adds the DMA sync on reg_read_buf for CPU before reading it.
--- drivers/mtd/nand/raw/qcom_nandc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/nand/raw/qcom_nandc.c +2 -0
@@ -1578,6 +1578,8 @@ static int check_flash_errors(struct qcostruct qcom_nand_controller *nandc =get_qcom_nand_controller (chip);int i; +nandc_read_buffer_sync (nandc, true); +for (i =0 ; i < cw_cnt; i++) {u32 flash =le32_to_cpu (nandc->reg_read_buf[i]);
Greg Kroah-Hartman
maintainerPATCH 326/346 scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
commit 62e3a931db60daf94fdb3159d685a5bc6ad4d0cf upstream.
The following calltrace was seen:
BUG: sleeping function called from invalid context at mm/slab.h:494 ... Call Trace: dump_stack+0x9a/0xf0 ___might_sleep.cold.63+0x13d/0x178 slab_pre_alloc_hook+0x6a/0x90 kmem_cache_alloc_trace+0x3a/0x2d0 lpfc_sli4_nvmet_alloc+0x4c/0x280 [lpfc] lpfc_post_rq_buffer+0x2e7/0xa60 [lpfc] lpfc_sli4_hba_setup+0x6b4c/0xa4b0 [lpfc] lpfc_pci_probe_one_s4.isra.15+0x14f8/0x2280 [lpfc] lpfc_pci_probe_one+0x260/0x2880 [lpfc] local_pci_probe+0xd4/0x180 work_for_cpu_fn+0x51/0xa0 process_one_work+0x8f0/0x17b0 worker_thread+0x536/0xb50 kthread+0x30c/0x3d0 ret_from_fork+0x3a/0x50
A prior patch introduced a spin_lock_irqsave(hbalock) in the lpfc_post_rq_buffer() routine. Call trace is seen as the hbalock is held with interrupts disabled during a GFP_KERNEL allocation in lpfc_sli4_nvmet_alloc().
Fix by reordering locking so that hbalock not held when calling sli4_nvmet_alloc() (aka rqb_buf_list()).
--- drivers/scsi/lpfc/lpfc_mem.c | 4 +--- drivers/scsi/lpfc/lpfc_sli.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 5 deletions(-)
drivers/scsi/lpfc/lpfc_mem.c +1 -3
@@ -560,8 +560,6 @@ lpfc_els_hbq_free(struct lpfc_hba *phba,* Description: Allocates a DMA-mapped receive buffer from the lpfc_hrb_pool PCI * pool along a non-DMA-mapped container for it. * -* Notes: Not interrupt-safe. Must be called with no locks held. -* * Returns: * pointer to HBQ on success * NULL on failure
@@ -631,7 +629,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *p {struct rqb_dmabuf *dma_buf; - dma_buf =kzalloc (sizeof (struct rqb_dmabuf ),GFP_KERNEL ); + dma_buf =kzalloc (sizeof (*dma_buf),GFP_KERNEL );if (!dma_buf)return NULL ;
drivers/scsi/lpfc/lpfc_sli.c +8 -2
@@ -6755,12 +6755,16 @@ lpfc_post_rq_buffer(struct lpfc_hba *phbstruct rqb_dmabuf *rqb_buffer;LIST_HEAD (rqb_buf_list); -spin_lock_irqsave (&phba->hbalock, flags); rqbp = hrq->rqbp;for (i =0 ; i < count; i++) { +spin_lock_irqsave (&phba->hbalock, flags);/* IF RQ is already full, don't bother */ -if (rqbp->buffer_count + i >= rqbp->entry_count -1 ) +if (rqbp->buffer_count + i >= rqbp->entry_count -1 ) { +spin_unlock_irqrestore (&phba->hbalock, flags);break ; + } +spin_unlock_irqrestore (&phba->hbalock, flags); + rqb_buffer = rqbp->rqb_alloc_buffer (phba);if (!rqb_buffer)break ;
@@ -6769,6 +6773,8 @@ lpfc_post_rq_buffer(struct lpfc_hba *phb rqb_buffer->idx = idx;list_add_tail (&rqb_buffer->hbuf.list, &rqb_buf_list); } + +spin_lock_irqsave (&phba->hbalock, flags);while (!list_empty (&rqb_buf_list)) { list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf, hbuf.list);
Greg Kroah-Hartman
maintainerPATCH 327/346 scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
commit e5785d3ec32f5f44dd88cd7b398e496742630469 upstream.
Commit 9816ef6ecbc1 ("scsi: lpfc: Use after free in lpfc_rq_buf_free()") was made to correct a use after free condition in lpfc_rq_buf_free(). Unfortunately, a subsequent patch cut on a tree without the fix inadvertently reverted the fix.
Put the fix back: Move the freeing of the rqb_entry to after the print function that references it.
--- drivers/scsi/lpfc/lpfc_mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_mem.c +1 -1
@@ -752,7 +752,6 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, drqe.address_hi =putPaddrHigh (rqb_entry->dbuf.phys); rc =lpfc_sli4_rq_put (rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);if (rc <0 ) { - (rqbp->rqb_free_buffer)(phba, rqb_entry); lpfc_printf_log(phba, KERN_ERR, LOG_INIT, "6409 Cannot post to HRQ %d: %x %x %x " "DRQ %x %x\n",
@@ -762,6 +761,7 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, rqb_entry->hrq->entry_count, rqb_entry->drq->host_index, rqb_entry->drq->hba_index); + (rqbp->rqb_free_buffer)(phba, rqb_entry); }else {list_add_tail (&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list); rqbp->buffer_count++;
Greg Kroah-Hartman
maintainerPATCH 328/346 iio: buffer: Fix demux update
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
commit 19ef7b70ca9487773c29b449adf0c70f540a0aab upstream.
When updating the buffer demux, we will skip a scan element from the device in the case in_ind != out_ind and we enter the while loop. in_ind should only be refreshed with find_next_bit() in the end of the loop.
Note, to cause problems we need a situation where we are skippig over an element (channel not enabled) that happens to not have the same size
as the next element. Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers have consistent channel storage sizes with the exception of the timestamp which is the last element and hence never skipped over.
--- drivers/iio/industrialio-buffer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/industrialio-buffer.c +3 -3
@@ -850,12 +850,12 @@ static int iio_buffer_update_demux(struc indio_dev->masklength, in_ind + 1);while (in_ind != out_ind) { - in_ind =find_next_bit (indio_dev->active_scan_mask, - indio_dev->masklength, - in_ind +1 ); length =iio_storage_bytes_for_si (indio_dev, in_ind);/* Make sure we are aligned */ in_loc =roundup (in_loc, length) + length; + in_ind =find_next_bit (indio_dev->active_scan_mask, + indio_dev->masklength, + in_ind +1 ); } length =iio_storage_bytes_for_si (indio_dev, in_ind); out_loc =roundup (out_loc, length);
Greg Kroah-Hartman
maintainerPATCH 329/346 iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
commit 560c6b914c6ec7d9d9a69fddbb5bf3bf71433e8b upstream.
Fix the missing clk_disable_unprepare() of info->pclk before return from rockchip_saradc_resume in the error handling case when fails to prepare and enable info->clk.
--- drivers/iio/adc/rockchip_saradc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/rockchip_saradc.c +1 -1
@@ -383,7 +383,7 @@ static int rockchip_saradc_resume(struct ret =clk_prepare_enable (info->clk);if (ret) -return ret; +clk_disable_unprepare (info->pclk);return ret; }
Greg Kroah-Hartman
maintainerPATCH 330/346 iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit a61817216bcc755eabbcb1cf281d84ccad267ed1 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc() so no data can leak apart from previous readings and in this case the status byte from the device.
The forced alignment of ts is not necessary in this case but it potentially makes the code less fragile.
Quoted 1 line
From personal communications with Mikko:
We could probably split the reading of the int register, but it would mean a significant performance cost of 20 i2c clock cycles.
--- drivers/iio/light/rpr0521.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/iio/light/rpr0521.c +13 -4
@@ -197,6 +197,17 @@ struct rpr0521_data {bool pxs_need_dis;struct regmap *regmap; + +/* +* Ensure correct naturally aligned timestamp. +* Note that the read will put garbage data into +* the padding but this should not be a problem +*/ +struct { +__le16 channels[3 ]; +u8 garbage; +s64 ts__aligned(8) ; + } scan; }; static IIO_CONST_ATTR(in_intensity_scale_available, RPR0521_ALS_SCALE_AVAIL);
@@ -452,8 +463,6 @@ static irqreturn_t rpr0521_trigger_consustruct rpr0521_data *data =iio_priv (indio_dev);int err; -u8 buffer[16 ];/* 3 16-bit channels + padding + ts */ -/* Use irq timestamp when reasonable. */ if (iio_trigger_using_own (indio_dev) && data->irq_timestamp) { pf->timestamp = data->irq_timestamp;
@@ -464,11 +473,11 @@ static irqreturn_t rpr0521_trigger_consu pf->timestamp =iio_get_time_ns (indio_dev); err =regmap_bulk_read (data->regmap,RPR0521_REG_PXS_DATA , - &buffer, + data->scan.channels, (3 *2 ) +1 );/* 3 * 16-bit + (discarded) int clear reg. */ if (!err)iio_push_to_buffers_with_timestamp (indio_dev, - buffer, pf->timestamp); + &data->scan, pf->timestamp);else dev_err (&data->client->dev,"Trigger consumer can't read from sensor.\n" );
Greg Kroah-Hartman
maintainerPATCH 331/346 iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit d837a996f57c29a985177bc03b0e599082047f27 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv()
This data is allocated with kzalloc() so no data can leak apart from previous readings.
A local unsigned int variable is used for the regmap call so it is clear there is no potential issue with writing into the padding of the structure.
--- drivers/iio/light/st_uvis25.h | 5 +++++ drivers/iio/light/st_uvis25_core.c | 8 +++++--- 2 files changed, 10 insertions(+), 3 deletions(-)
drivers/iio/light/st_uvis25.h +5 -0
@@ -28,6 +28,11 @@ struct st_uvis25_hw {struct iio_trigger *trig;bool enabled;int irq; +/* Ensure timestamp is naturally aligned */ +struct { +u8 chan; +s64 ts__aligned(8) ; + } scan; };extern const struct dev_pm_ops st_uvis25_pm_ops;
drivers/iio/light/st_uvis25_core.c +5 -3
@@ -235,17 +235,19 @@ static const struct iio_buffer_setup_opsstatic irqreturn_t st_uvis25_buffer_handler_thread (int irq,void *p) { -u8 buffer[ALIGN (sizeof (u8),sizeof (s64)) +sizeof (s64)];struct iio_poll_func *pf = p;struct iio_dev *iio_dev = pf->indio_dev;struct st_uvis25_hw *hw =iio_priv (iio_dev); +unsigned int val;int err; - err =regmap_read (hw->regmap,ST_UVIS25_REG_OUT_ADDR , (int *)buffer); + err =regmap_read (hw->regmap,ST_UVIS25_REG_OUT_ADDR , &val);if (err <0 ) goto out; -iio_push_to_buffers_with_timestamp (iio_dev, buffer, + hw->scan.chan = val; + +iio_push_to_buffers_with_timestamp (iio_dev, &hw->scan,iio_get_time_ns (iio_dev)); out:
Greg Kroah-Hartman
maintainerPATCH 332/346 iio:pressure:mpl3115: Force alignment of buffer
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 198cf32f0503d2ad60d320b95ef6fb8243db857f upstream.
Whilst this is another case of the issue Lars reported with an array of elements of smaller than 8 bytes being passed to iio_push_to_buffers_with_timestamp(), the solution here is a bit different from the other cases and relies on __aligned working on the stack (true since 4.6?)
This one is unusual. We have to do an explicit memset() each time as we are reading 3 bytes into a potential 4 byte channel which may sometimes be a 2 byte channel depending on what is enabled. As such, moving the buffer to the heap in the iio_priv structure doesn't save us much. We can't use a nice explicit structure on the stack either as the data channels have different storage sizes and are all separately controlled.
--- drivers/iio/pressure/mpl3115.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/iio/pressure/mpl3115.c +8 -1
@@ -147,7 +147,14 @@ static irqreturn_t mpl3115_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct mpl3115_data *data =iio_priv (indio_dev); -u8 buffer[16 ];/* 32-bit channel + 16-bit channel + padding + ts */ +/* +* 32-bit channel + 16-bit channel + padding + ts +* Note that it is possible for only one of the first 2 +* channels to be enabled. If that happens, the first element +* of the buffer may be either 16 or 32-bits. As such we cannot +* use a simple structure definition to express this data layout. +*/ +u8 buffer[16 ]__aligned(8) ;int ret, pos =0 ;mutex_lock (&data->lock);
Greg Kroah-Hartman
maintainerPATCH 333/346 iio:imu:bmi160: Fix too large a buffer.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit dc7de42d6b50a07b37feeba4c6b5136290fcee81 upstream.
The comment implies this device has 3 sensor types, but it only has an accelerometer and a gyroscope (both 3D). As such the buffer does not need to be as long as stated.
Note I've separated this from the following patch which fixes the alignment for passing to iio_push_to_buffers_with_timestamp() as they are different issues even if they affect the same line of code.
--- drivers/iio/imu/bmi160/bmi160_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/imu/bmi160/bmi160_core.c +2 -2
@@ -385,8 +385,8 @@ static irqreturn_t bmi160_trigger_handlestruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct bmi160_data *data =iio_priv (indio_dev); -__le16 buf[16 ]; -/* 3 sens x 3 axis x __le16 + 3 x __le16 pad + 4 x __le16 tstamp */ +__le16 buf[12 ]; +/* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */ int i, ret, j =0 , base =BMI160_REG_DATA_MAGN_XOUT_L ;__le16 sample;
Greg Kroah-Hartman
maintainerPATCH 334/346 md/cluster: block reshape with remote resync job
In reply to Greg Kroah-HartmanFrom: Zhao Heming <[email protected]>
commit a8da01f79c89755fad55ed0ea96e8d2103242a72 upstream.
Reshape request should be blocked with ongoing resync job. In cluster env, a node can start resync job even if the resync cmd isn't executed on it, e.g., user executes "mdadm --grow" on node A, sometimes node B will start resync job. However, current update_raid_disks() only check local recovery status, which is incomplete. As a result, we see user will execute "mdadm --grow" successfully on local, while the remote node deny to do reshape job when it doing resync job. The inconsistent handling cause array enter unexpected status. If user doesn't observe this issue and continue executing mdadm cmd, the array doesn't work at last.
Fix this issue by blocking reshape request. When node executes "--grow" and detects ongoing resync, it should stop and report error to user.
The following script reproduces the issue with ~100% probability. (two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB)
```
# on node1, node2 is the remote node.
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done
mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"
sleep 5
mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0
mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```--- drivers/md/md.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/md/md.c +6 -2
@@ -6895,6 +6895,7 @@ static int update_raid_disks(struct mddereturn -EINVAL ;if (mddev->sync_thread ||test_bit (MD_RECOVERY_RUNNING , &mddev->recovery) || +test_bit (MD_RESYNCING_REMOTE , &mddev->recovery) || mddev->reshape_position != MaxSector)return -EBUSY ;
@@ -9241,8 +9242,11 @@ static void check_sb_changes(struct mdde } } -if (mddev->raid_disks !=le32_to_cpu (sb->raid_disks)) -update_raid_disks (mddev,le32_to_cpu (sb->raid_disks)); +if (mddev->raid_disks !=le32_to_cpu (sb->raid_disks)) { + ret =update_raid_disks (mddev,le32_to_cpu (sb->raid_disks)); +if (ret) +pr_warn ("md: updating array disks failed. %d\n" , ret); + }/* Finally set the event to be up to date */ mddev->events =le64_to_cpu (sb->events);
Greg Kroah-Hartman
maintainerPATCH 335/346 md/cluster: fix deadlock when node is doing resync job
In reply to Greg Kroah-HartmanFrom: Zhao Heming <[email protected]>
commit bca5b0658020be90b6b504ca514fd80110204f71 upstream.
md-cluster uses MD_CLUSTER_SEND_LOCK to make node can exclusively send msg. During sending msg, node can concurrently receive msg from another node. When node does resync job, grab token_lockres:EX may trigger a deadlock:
```
nodeA nodeB
-------------------- --------------------
a.
send METADATA_UPDATED
held token_lockres:EX
b.
md_do_sync
resync_info_update
send RESYNCING
+ set MD_CLUSTER_SEND_LOCK
+ wait for holding token_lockres:EX
c.
mdadm /dev/md0 --remove /dev/sdg
+ held reconfig_mutex
+ send REMOVE
+ wait_event(MD_CLUSTER_SEND_LOCK)
d.
recv_daemon //METADATA_UPDATED from A
process_metadata_update
+ (mddev_trylock(mddev) ||
MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD)
//this time, both return false forever
```Explaination:
a. A send METADATA_UPDATED
This will block another node to send msg
b. B does sync jobs, which will send RESYNCING at intervals.
This will be block for holding token_lockres:EX lock.
c. B do "mdadm --remove", which will send REMOVE.
This will be blocked by step <b>: MD_CLUSTER_SEND_LOCK is 1.
d. B recv METADATA_UPDATED msg, which send from A in step <a>.
This will be blocked by step <c>: holding mddev lock, it makes wait_event can't hold mddev lock. (btw, MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD keep ZERO in this scenario.)
There is a similar deadlock in commit 0ba959774e93 ("md-cluster: use sync way to handle METADATA_UPDATED msg") In that commit, step c is "update sb". This patch step c is "mdadm --remove".
For fixing this issue, we can refer the solution of function:metadata_update_start. Which does the same grab lock_token action. lock_comm can use the same steps to avoid deadlock. By moving MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD from lock_token to lock_comm. It enlarge a little bit window of MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, but it is safe & can break deadlock.
Repro steps (I only triggered 3 times with hundreds tests):
two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB.
```
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done
mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh \
--bitmap-chunk=1M
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"
sleep 5
mkfs.xfs /dev/md0
mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0
mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```test script will hung when executing "mdadm --remove".
``` # dump stacks by "echo t > /proc/sysrq-trigger" md0_cluster_rec D 0 5329 2 0x80004000 Call Trace: __schedule+0x1f6/0x560 ? _cond_resched+0x2d/0x40 ? schedule+0x4a/0xb0 ? process_metadata_update.isra.0+0xdb/0x140 [md_cluster] ? wait_woken+0x80/0x80 ? process_recvd_msg+0x113/0x1d0 [md_cluster] ? recv_daemon+0x9e/0x120 [md_cluster] ? md_thread+0x94/0x160 [md_mod] ? wait_woken+0x80/0x80 ? md_congested+0x30/0x30 [md_mod] ? kthread+0x115/0x140 ? __kthread_bind_mask+0x60/0x60 ? ret_from_fork+0x1f/0x40 mdadm D 0 5423 1 0x00004004 Call Trace: __schedule+0x1f6/0x560 ? __schedule+0x1fe/0x560 ? schedule+0x4a/0xb0 ? lock_comm.isra.0+0x7b/0xb0 [md_cluster] ? wait_woken+0x80/0x80 ? remove_disk+0x4f/0x90 [md_cluster] ? hot_remove_disk+0xb1/0x1b0 [md_mod] ? md_ioctl+0x50c/0xba0 [md_mod] ? wait_woken+0x80/0x80 ? blkdev_ioctl+0xa2/0x2a0 ? block_ioctl+0x39/0x40 ? ksys_ioctl+0x82/0xc0 ? __x64_sys_ioctl+0x16/0x20 ? do_syscall_64+0x5f/0x150 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 md0_resync D 0 5425 2 0x80004000 Call Trace: __schedule+0x1f6/0x560 ? schedule+0x4a/0xb0 ? dlm_lock_sync+0xa1/0xd0 [md_cluster] ? wait_woken+0x80/0x80 ? lock_token+0x2d/0x90 [md_cluster] ? resync_info_update+0x95/0x100 [md_cluster] ? raid1_sync_request+0x7d3/0xa40 [raid1] ? md_do_sync.cold+0x737/0xc8f [md_mod] ? md_thread+0x94/0x160 [md_mod] ? md_congested+0x30/0x30 [md_mod] ? kthread+0x115/0x140 ? __kthread_bind_mask+0x60/0x60 ? ret_from_fork+0x1f/0x40 ```
At last, thanks for Xiao's solution.
--- drivers/md/md-cluster.c | 67 +++++++++++++++++++++++++++--------------------- drivers/md/md.c | 6 ++-- 2 files changed, 42 insertions(+), 31 deletions(-)
drivers/md/md-cluster.c +38 -29
@@ -669,9 +669,27 @@ out:* Takes the lock on the TOKEN lock resource so no other * node can communicate while the operation is underway. */ -static int lock_token (struct md_cluster_info *cinfo,bool mddev_locked) +static int lock_token (struct md_cluster_info *cinfo) { -int error, set_bit =0 ; +int error; + + error =dlm_lock_sync (cinfo->token_lockres,DLM_LOCK_EX ); +if (error) { +pr_err ("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n" , + __func__, __LINE__, error); + }else { +/* Lock the receive sequence */ +mutex_lock (&cinfo->recv_mutex); + } +return error; +} + +/* lock_comm() +* Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel. +*/ +static int lock_comm (struct md_cluster_info *cinfo,bool mddev_locked) +{ +int rv, set_bit =0 ;struct mddev *mddev = cinfo->mddev;/*
@@ -682,34 +700,19 @@ static int lock_token(struct md_cluster_*/ if (mddev_locked && !test_bit (MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD , &cinfo->state)) { - error =test_and_set_bit_lock (MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD , + rv =test_and_set_bit_lock (MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD , &cinfo->state); -WARN_ON_ONCE (error); +WARN_ON_ONCE (rv);md_wakeup_thread (mddev->thread); set_bit =1 ; } - error =dlm_lock_sync (cinfo->token_lockres,DLM_LOCK_EX ); -if (set_bit) -clear_bit_unlock (MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD , &cinfo->state); -if (error) -pr_err ("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n" , - __func__, __LINE__, error); - -/* Lock the receive sequence */ -mutex_lock (&cinfo->recv_mutex); -return error; -} - -/* lock_comm() -* Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel. -*/ -static int lock_comm (struct md_cluster_info *cinfo,bool mddev_locked) -{wait_event (cinfo->wait, !test_and_set_bit (MD_CLUSTER_SEND_LOCK , &cinfo->state)); - -return lock_token (cinfo, mddev_locked); + rv =lock_token (cinfo); +if (set_bit) +clear_bit_unlock (MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD , &cinfo->state); +return rv; }static void unlock_comm (struct md_cluster_info *cinfo)
@@ -789,9 +792,11 @@ static int sendmsg(struct md_cluster_inf {int ret; -lock_comm (cinfo, mddev_locked); - ret =__sendmsg (cinfo, cmsg); -unlock_comm (cinfo); + ret =lock_comm (cinfo, mddev_locked); +if (!ret) { + ret =__sendmsg (cinfo, cmsg); +unlock_comm (cinfo); + }return ret; }
@@ -1063,7 +1068,7 @@ static int metadata_update_start(structreturn 0 ; } - ret =lock_token (cinfo,1 ); + ret =lock_token (cinfo);clear_bit_unlock (MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD , &cinfo->state);return ret; }
@@ -1181,7 +1186,10 @@ static void update_size(struct mddev *mdint raid_slot =-1 ;md_update_sb (mddev,1 ); -lock_comm (cinfo,1 ); +if (lock_comm (cinfo,1 )) { +pr_err ("%s: lock_comm failed\n" , __func__); +return ; + }memset (&cmsg,0 ,sizeof (cmsg)); cmsg.type =cpu_to_le32 (METADATA_UPDATED );
@@ -1330,7 +1338,8 @@ static int add_new_disk(struct mddev *md cmsg.type =cpu_to_le32 (NEWDISK );memcpy (cmsg.uuid, uuid,16 ); cmsg.raid_slot =cpu_to_le32 (rdev->desc_nr); -lock_comm (cinfo,1 ); +if (lock_comm (cinfo,1 )) +return -EAGAIN ; ret =__sendmsg (cinfo, &cmsg);if (ret) {unlock_comm (cinfo);
drivers/md/md.c +4 -2
@@ -6564,8 +6564,10 @@ static int hot_remove_disk(struct mddev goto busy; kick_rdev: -if (mddev_is_clustered (mddev)) - md_cluster_ops->remove_disk (mddev, rdev); +if (mddev_is_clustered (mddev)) { +if (md_cluster_ops->remove_disk (mddev, rdev)) + goto busy; + }md_kick_rdev_from_array (rdev);set_bit (MD_SB_CHANGE_DEVS , &mddev->sb_flags);
Greg Kroah-Hartman
maintainerPATCH 336/346 pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
commit a1158e36f876f6269978a4176e3a1d48d27fe7a1 upstream.
It is found on many allwinner soc that there is a low probability that the interrupt status cannot be read in sunxi_pinctrl_irq_handler. This will cause the interrupt status of a gpio bank to always be active on gic, preventing gic from responding to other spi interrupts correctly.
So we should call the chained_irq_* each time enter sunxi_pinctrl_irq_handler().
--- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pinctrl/sunxi/pinctrl-sunxi.c +4 -2
@@ -1001,20 +1001,22 @@ static void sunxi_pinctrl_irq_handler(stif (bank == pctl->desc->irq_banks)return ; +chained_irq_enter (chip, desc); + reg =sunxi_irq_status_reg_from_bank (pctl->desc, bank); val =readl (pctl->membase + reg);if (val) {int irqoffset; -chained_irq_enter (chip, desc);for_each_set_bit (irqoffset, &val,IRQ_PER_BANK ) {int pin_irq =irq_find_mapping (pctl->domain, bank *IRQ_PER_BANK + irqoffset);generic_handle_irq (pin_irq); } -chained_irq_exit (chip, desc); } + +chained_irq_exit (chip, desc); } static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl,
Greg Kroah-Hartman
maintainerPATCH 337/346 clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
In reply to Greg Kroah-HartmanFrom: Terry Zhou <[email protected]>
commit 6f37689cf6b38fff96de52e7f0d3e78f22803ba0 upstream.
There is an error in the current code that the XTAL MODE pin was set to NB MPP1_31 which should be NB MPP1_9. The latch register of NB MPP1_9 has different offset of 0x8.
--- drivers/clk/mvebu/armada-37xx-xtal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/mvebu/armada-37xx-xtal.c +2 -2
@@ -15,8 +15,8 @@#include <linux/platform_device.h> #include <linux/regmap.h> -#define NB_GPIO1_LATCH 0xC -#define XTAL_MODE BIT(31) +#define NB_GPIO1_LATCH 0x8 +#define XTAL_MODE BIT(9)static int armada_3700_xtal_clock_probe (struct platform_device *pdev) {
Greg Kroah-Hartman
maintainerPATCH 338/346 xen-blkback: set ring->xenblkd to NULL after kthread_stop()
In reply to Greg Kroah-HartmanFrom: Pawel Wieczorkiewicz <[email protected]>
commit 1c728719a4da6e654afb9cc047164755072ed7c9 upstream.
When xen_blkif_disconnect() is called, the kernel thread behind the block interface is stopped by calling kthread_stop(ring->xenblkd). The ring->xenblkd thread pointer being non-NULL determines if the thread has been already stopped.
Normally, the thread's function xen_blkif_schedule() sets the ring->xenblkd to NULL, when the thread's main loop ends.
However, when the thread has not been started yet (i.e. wake_up_process() has not been called on it), the xen_blkif_schedule() function would not be called yet.
In such case the kthread_stop() call returns -EINTR and the ring->xenblkd remains dangling.
When this happens, any consecutive call to xen_blkif_disconnect (for example in frontend_changed() callback) leads to a kernel crash in kthread_stop() (e.g. NULL pointer dereference in exit_creds()).
This is XSA-350.
--- drivers/block/xen-blkback/xenbus.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/xen-blkback/xenbus.c +1 -0
@@ -264,6 +264,7 @@ static int xen_blkif_disconnect(struct xif (ring->xenblkd) {kthread_stop (ring->xenblkd); + ring->xenblkd =NULL ;wake_up (&ring->shutdown_wq); }
Greg Kroah-Hartman
maintainerPATCH 339/346 xen/xenbus: Allow watches discard events before queueing
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit fed1755b118147721f2c87b37b9d66e62c39b668 upstream.
If handling logics of watch events are slower than the events enqueue logic and the events can be created from the guests, the guests could trigger memory pressure by intensively inducing the events, because it will create a huge number of pending events that exhausting the memory.
Fortunately, some watch events could be ignored, depending on its handler callback. For example, if the callback has interest in only one single path, the watch wouldn't want multiple pending events. Or, some watches could ignore events to same path.
To let such watches to volutarily help avoiding the memory pressure situation, this commit introduces new watch callback, 'will_handle'. If it is not NULL, it will be called for each new event just before enqueuing it. Then, if the callback returns false, the event will be discarded. No watch is using the callback for now, though.
This is part of XSA-349
--- drivers/net/xen-netback/xenbus.c | 4 ++++ drivers/xen/xenbus/xenbus_client.c | 1 + drivers/xen/xenbus/xenbus_xs.c | 5 ++++- include/xen/xenbus.h | 7 +++++++ 4 files changed, 16 insertions(+), 1 deletion(-)
drivers/net/xen-netback/xenbus.c +4 -0
@@ -777,12 +777,14 @@ static int xen_register_credit_watch(strreturn -ENOMEM ;snprintf (node, maxlen,"%s/rate" , dev->nodename); vif->credit_watch.node = node; + vif->credit_watch.will_handle =NULL ; vif->credit_watch.callback = xen_net_rate_changed; err =register_xenbus_watch (&vif->credit_watch);if (err) {pr_err ("Failed to set watcher %s\n" , vif->credit_watch.node);kfree (node); vif->credit_watch.node =NULL ; + vif->credit_watch.will_handle =NULL ; vif->credit_watch.callback =NULL ; }return err;
@@ -829,6 +831,7 @@ static int xen_register_mcast_ctrl_watchsnprintf (node, maxlen,"%s/request-multicast-control" , dev->otherend); vif->mcast_ctrl_watch.node = node; + vif->mcast_ctrl_watch.will_handle =NULL ; vif->mcast_ctrl_watch.callback = xen_mcast_ctrl_changed; err =register_xenbus_watch (&vif->mcast_ctrl_watch);if (err) {
@@ -836,6 +839,7 @@ static int xen_register_mcast_ctrl_watch vif->mcast_ctrl_watch.node);kfree (node); vif->mcast_ctrl_watch.node =NULL ; + vif->mcast_ctrl_watch.will_handle =NULL ; vif->mcast_ctrl_watch.callback =NULL ; }return err;
drivers/xen/xenbus/xenbus_client.c +1 -0
@@ -120,6 +120,7 @@ int xenbus_watch_path(struct xenbus_deviint err; watch->node = path; + watch->will_handle =NULL ; watch->callback = callback; err =register_xenbus_watch (watch);
drivers/xen/xenbus/xenbus_xs.c +4 -1
@@ -705,7 +705,10 @@ int xs_watch_msg(struct xs_watch_event *spin_lock (&watches_lock); event->handle =find_watch (event->token); -if (event->handle !=NULL ) { +if (event->handle !=NULL && + (!event->handle->will_handle || + event->handle->will_handle (event->handle, + event->path, event->token))) {spin_lock (&watch_events_lock);list_add_tail (&event->list, &watch_events);wake_up (&watch_events_waitq);
include/xen/xenbus.h +7 -0
@@ -59,6 +59,13 @@ struct xenbus_watch/* Path being watched. */ const char *node; +/* +* Called just before enqueing new event while a spinlock is held. +* The event will be discarded if this callback returns false. +*/ +bool (*will_handle)(struct xenbus_watch *, +const char *path,const char *token); +/* Callback (executed in a process context with no locks held). */ void (*callback)(struct xenbus_watch *,const char *path,const char *token);
Greg Kroah-Hartman
maintainerPATCH 340/346 xen/xenbus: Add will_handle callback support in xenbus_watch_path()
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit 2e85d32b1c865bec703ce0c962221a5e955c52c2 upstream.
Some code does not directly make 'xenbus_watch' object and call 'register_xenbus_watch()' but use 'xenbus_watch_path()' instead. This commit adds support of 'will_handle' callback in the 'xenbus_watch_path()' and it's wrapper, 'xenbus_watch_pathfmt()'.
This is part of XSA-349
--- drivers/block/xen-blkback/xenbus.c | 3 ++- drivers/net/xen-netback/xenbus.c | 2 +- drivers/xen/xen-pciback/xenbus.c | 2 +- drivers/xen/xenbus/xenbus_client.c | 9 +++++++-- drivers/xen/xenbus/xenbus_probe.c | 2 +- include/xen/xenbus.h | 6 +++++- 6 files changed, 17 insertions(+), 7 deletions(-)
drivers/block/xen-blkback/xenbus.c +2 -1
@@ -652,7 +652,8 @@ static int xen_blkbk_probe(struct xenbus/* setup back pointer */ be->blkif->be = be; - err =xenbus_watch_pathfmt (dev, &be->backend_watch, backend_changed, + err =xenbus_watch_pathfmt (dev, &be->backend_watch,NULL , + backend_changed,"%s/%s" , dev->nodename,"physical-device" );if (err) goto fail;
drivers/net/xen-netback/xenbus.c +1 -1
@@ -1043,7 +1043,7 @@ static void connect(struct backend_infoxenvif_carrier_on (be->vif);unregister_hotplug_status_watch (be); - err =xenbus_watch_pathfmt (dev, &be->hotplug_status_watch, + err =xenbus_watch_pathfmt (dev, &be->hotplug_status_watch,NULL , hotplug_status_changed,"%s/%s" , dev->nodename,"hotplug-status" );if (!err)
drivers/xen/xen-pciback/xenbus.c +1 -1
@@ -688,7 +688,7 @@ static int xen_pcibk_xenbus_probe(struct/* watch the backend node for backend configuration information */ err =xenbus_watch_path (dev, dev->nodename, &pdev->be_watch, - xen_pcibk_be_watch); +NULL , xen_pcibk_be_watch);if (err) goto out;
drivers/xen/xenbus/xenbus_client.c +7 -2
@@ -114,19 +114,22 @@ EXPORT_SYMBOL_GPL(xenbus_strstate);*/ int xenbus_watch_path (struct xenbus_device *dev,const char *path,struct xenbus_watch *watch, +bool (*will_handle)(struct xenbus_watch *, +const char *,const char *),void (*callback)(struct xenbus_watch *,const char *,const char *)) {int err; watch->node = path; - watch->will_handle =NULL ; + watch->will_handle = will_handle; watch->callback = callback; err =register_xenbus_watch (watch);if (err) { watch->node =NULL ; + watch->will_handle =NULL ; watch->callback =NULL ;xenbus_dev_fatal (dev, err,"adding watch on %s" , path); }
@@ -153,6 +156,8 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path);*/ int xenbus_watch_pathfmt (struct xenbus_device *dev,struct xenbus_watch *watch, +bool (*will_handle)(struct xenbus_watch *, +const char *,const char *),void (*callback)(struct xenbus_watch *,const char *,const char *),const char *pathfmt, ...)
@@ -169,7 +174,7 @@ int xenbus_watch_pathfmt(struct xenbus_dxenbus_dev_fatal (dev, -ENOMEM ,"allocating path for watch" );return -ENOMEM ; } - err =xenbus_watch_path (dev, path, watch, callback); + err =xenbus_watch_path (dev, path, watch, will_handle, callback);if (err)kfree (path);
drivers/xen/xenbus/xenbus_probe.c +1 -1
@@ -136,7 +136,7 @@ static int watch_otherend(struct xenbus_ container_of(dev->dev.bus, struct xen_bus_type, bus);return xenbus_watch_pathfmt (dev, &dev->otherend_watch, - bus->otherend_changed, +NULL , bus->otherend_changed,"%s/%s" , dev->otherend,"state" ); }
include/xen/xenbus.h +5 -1
@@ -199,10 +199,14 @@ void xenbus_probe(struct work_struct *);int xenbus_watch_path (struct xenbus_device *dev,const char *path,struct xenbus_watch *watch, +bool (*will_handle)(struct xenbus_watch *, +const char *,const char *),void (*callback)(struct xenbus_watch *,const char *,const char *)); -__printf(4, 5) +__printf(5, 6)int xenbus_watch_pathfmt (struct xenbus_device *dev,struct xenbus_watch *watch, +bool (*will_handle)(struct xenbus_watch *, +const char *,const char *),void (*callback)(struct xenbus_watch *,const char *,const char *),const char *pathfmt, ...);
Greg Kroah-Hartman
maintainerPATCH 341/346 xen/xenbus/xen_bus_type: Support will_handle watch callback
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit be987200fbaceaef340872841d4f7af2c5ee8dc3 upstream.
This commit adds support of the 'will_handle' watch callback for 'xen_bus_type' users.
This is part of XSA-349
--- drivers/xen/xenbus/xenbus.h | 2 ++ drivers/xen/xenbus/xenbus_probe.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/xen/xenbus/xenbus.h +2 -0
@@ -44,6 +44,8 @@ struct xen_bus_type {int (*get_bus_id)(char bus_id[XEN_BUS_ID_SIZE ],const char *nodename);int (*probe)(struct xen_bus_type *bus,const char *type,const char *dir); +bool (*otherend_will_handle)(struct xenbus_watch *watch, +const char *path,const char *token);void (*otherend_changed)(struct xenbus_watch *watch,const char *path,const char *token);struct bus_type bus;
drivers/xen/xenbus/xenbus_probe.c +2 -1
@@ -136,7 +136,8 @@ static int watch_otherend(struct xenbus_ container_of(dev->dev.bus, struct xen_bus_type, bus);return xenbus_watch_pathfmt (dev, &dev->otherend_watch, -NULL , bus->otherend_changed, + bus->otherend_will_handle, + bus->otherend_changed,"%s/%s" , dev->otherend,"state" ); }
Greg Kroah-Hartman
maintainerPATCH 342/346 xen/xenbus: Count pending messages for each watch
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit 3dc86ca6b4c8cfcba9da7996189d1b5a358a94fc upstream.
This commit adds a counter of pending messages for each watch in the struct. It is used to skip unnecessary pending messages lookup in 'unregister_xenbus_watch()'. It could also be used in 'will_handle' callback.
This is part of XSA-349
--- drivers/xen/xenbus/xenbus_xs.c | 29 ++++++++++++++++++----------- include/xen/xenbus.h | 2 ++ 2 files changed, 20 insertions(+), 11 deletions(-)
drivers/xen/xenbus/xenbus_xs.c +18 -11
@@ -711,6 +711,7 @@ int xs_watch_msg(struct xs_watch_event * event->path, event->token))) {spin_lock (&watch_events_lock);list_add_tail (&event->list, &watch_events); + event->handle->nr_pending++;wake_up (&watch_events_waitq);spin_unlock (&watch_events_lock); } else
@@ -768,6 +769,8 @@ int register_xenbus_watch(struct xenbus_sprintf (token,"%lX" , (long )watch); + watch->nr_pending =0 ; +down_read (&xs_watch_rwsem);spin_lock (&watches_lock);
@@ -817,11 +820,14 @@ void unregister_xenbus_watch(struct xenb/* Cancel pending watch events. */ spin_lock (&watch_events_lock); -list_for_each_entry_safe (event, tmp, &watch_events, list) { -if (event->handle != watch) -continue ; -list_del (&event->list); -kfree (event); +if (watch->nr_pending) { +list_for_each_entry_safe (event, tmp, &watch_events, list) { +if (event->handle != watch) +continue ; +list_del (&event->list); +kfree (event); + } + watch->nr_pending =0 ; }spin_unlock (&watch_events_lock);
@@ -868,7 +874,6 @@ void xs_suspend_cancel(void)static int xenwatch_thread (void *unused) { -struct list_head *ent;struct xs_watch_event *event; xenwatch_pid = current->pid;
@@ -883,13 +888,15 @@ static int xenwatch_thread(void *unused)mutex_lock (&xenwatch_mutex);spin_lock (&watch_events_lock); - ent = watch_events.next; -if (ent != &watch_events) -list_del (ent); + event =list_first_entry_or_null (&watch_events, + struct xs_watch_event, list); +if (event) { +list_del (&event->list); + event->handle->nr_pending--; + }spin_unlock (&watch_events_lock); -if (ent != &watch_events) { - event = list_entry(ent, struct xs_watch_event, list); +if (event) { event->handle->callback (event->handle, event->path, event->token);kfree (event);
include/xen/xenbus.h +2 -0
@@ -59,6 +59,8 @@ struct xenbus_watch/* Path being watched. */ const char *node; +unsigned int nr_pending; +/* * Called just before enqueing new event while a spinlock is held. * The event will be discarded if this callback returns false.
Greg Kroah-Hartman
maintainerPATCH 343/346 xenbus/xenbus_backend: Disallow pending watch messages
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit 9996bd494794a2fe393e97e7a982388c6249aa76 upstream.
'xenbus_backend' watches 'state' of devices, which is writable by guests. Hence, if guests intensively updates it, dom0 will have lots of pending events that exhausting memory of dom0. In other words, guests can trigger dom0 memory pressure. This is known as XSA-349. However, the watch callback of it, 'frontend_changed()', reads only 'state', so doesn't need to have the pending events.
To avoid the problem, this commit disallows pending watch messages for 'xenbus_backend' using the 'will_handle()' watch callback.
This is part of XSA-349
--- drivers/xen/xenbus/xenbus_probe_backend.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/xen/xenbus/xenbus_probe_backend.c +7 -0
@@ -180,6 +180,12 @@ static int xenbus_probe_backend(struct xreturn err; } +static bool frontend_will_handle (struct xenbus_watch *watch, +const char *path,const char *token) +{ +return watch->nr_pending ==0 ; +} +static void frontend_changed (struct xenbus_watch *watch,const char *path,const char *token) {
@@ -191,6 +197,7 @@ static struct xen_bus_type xenbus_backen .levels = 3, /* backend/type/<frontend>/<id> */ .get_bus_id = backend_bus_id, .probe = xenbus_probe_backend, + .otherend_will_handle = frontend_will_handle, .otherend_changed = frontend_changed, .bus = { .name = "xen-backend",
Greg Kroah-Hartman
maintainerPATCH 344/346 libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
In reply to Greg Kroah-HartmanFrom: Dan Williams <[email protected]>
commit 2dd2a1740ee19cd2636d247276cf27bfa434b0e2 upstream.
A recent change to ndctl to attempt to reconfigure namespaces in place uncovered a label accounting problem in block-window-type namespaces. The ndctl "create.sh" test is able to trigger this signature:
WARNING: CPU: 34 PID: 9167 at drivers/nvdimm/label.c:1100 __blk_label_update+0x9a3/0xbc0 [libnvdimm] [..] RIP: 0010:__blk_label_update+0x9a3/0xbc0 [libnvdimm] [..] Call Trace: uuid_store+0x21b/0x2f0 [libnvdimm] kernfs_fop_write+0xcf/0x1c0 vfs_write+0xcc/0x380 ksys_write+0x68/0xe0
When allocated capacity for a namespace is renamed (new UUID) the labels with the old UUID need to be deleted. The ndctl behavior to always destroy namespaces on reconfiguration hid this problem.
The immediate impact of this bug is limited since block-window-type namespaces only seem to exist in the specification and not in any shipping products. However, the label handling code is being reused for other technologies like CXL region labels, so there is a benefit to making sure both vertical labels sets (block-window) and horizontal label sets (pmem) have a functional reference implementation in libnvdimm.
--- drivers/nvdimm/label.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/nvdimm/label.c +9 -0
@@ -861,6 +861,15 @@ static int __blk_label_update(struct nd_ } } +/* release slots associated with any invalidated UUIDs */ +mutex_lock (&nd_mapping->lock); +list_for_each_entry_safe (label_ent, e, &nd_mapping->labels, list) +if (test_and_clear_bit (ND_LABEL_REAP , &label_ent->flags)) { +reap_victim (nd_mapping, label_ent); +list_move (&label_ent->list, &list); + } +mutex_unlock (&nd_mapping->lock); +/* * Find the resource associated with the first label in the set * per the v1.2 namespace specification.
Greg Kroah-Hartman
maintainerPATCH 345/346 platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
In reply to Greg Kroah-HartmanFrom: Carlos Garnacho <[email protected]>
commit fe6000990394639ed374cb76c313be3640714f47 upstream.
This 2-in-1 model (Product name: Switch SA5-271) features a SW_TABLET_MODE that works as it would be expected, both when detaching the keyboard and when folding it behind the tablet body.
It used to work until the introduction of the allow list at commit 8169bd3e6e193 ("platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting"). Add this model to it, so that the Virtual Buttons device announces the EV_SW features again.
--- drivers/platform/x86/intel-vbtn.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/intel-vbtn.c +6 -0
@@ -203,6 +203,12 @@ static const struct dmi_system_id dmi_sw DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion 13 x360 PC"), }, }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271"), + }, + }, {}/* Array terminator */ };
Greg Kroah-Hartman
maintainerPATCH 346/346 PCI: Fix pci_slot_release() NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Jubin Zhong <[email protected]>
commit 4684709bf81a2d98152ed6b610e3d5c403f9bced upstream.
If kobject_init_and_add() fails, pci_slot_release() is called to delete slot->list from parent->slots. But slot->list hasn't been initialized yet, so we dereference a NULL pointer:
Unable to handle kernel NULL pointer dereference at virtual address 00000000 ... CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197 task: ffffeb398a45ef10 task.stack: ffffeb398a470000 PC is at __list_del_entry_valid+0x5c/0xb0 LR is at pci_slot_release+0x84/0xe4 ... __list_del_entry_valid+0x5c/0xb0 pci_slot_release+0x84/0xe4 kobject_put+0x184/0x1c4 pci_create_slot+0x17c/0x1b4 __pci_hp_initialize+0x68/0xa4 pciehp_probe+0x1a4/0x2fc pcie_port_probe_service+0x58/0x84 driver_probe_device+0x320/0x470
Initialize slot->list before calling kobject_init_and_add() to avoid this.
--- drivers/pci/slot.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/slot.c +3 -3
@@ -307,6 +307,9 @@ placeholder: goto err; } +INIT_LIST_HEAD (&slot->list); +list_add (&slot->list, &parent->slots); + err =kobject_init_and_add (&slot->kobj, &pci_slot_ktype,NULL ,"%s" , slot_name);if (err) {
@@ -314,9 +317,6 @@ placeholder: goto err; } -INIT_LIST_HEAD (&slot->list); -list_add (&slot->list, &parent->slots); -down_read (&pci_bus_sem);list_for_each_entry (dev, &parent->devices, bus_list)if (PCI_SLOT (dev->devfn) == slot_nr)
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.164 release. There are 346 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 155 fail: 0 Qemu test results: total: 418 pass: 418 fail: 0
Guenter