4.14.233-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 168/323 ACPI: CPPC: Replace cppc_attr with kobj_attribute
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 2bc6262c6117dd18106d5aa50d53e945b5d99c51 ]
All of the CPPC sysfs show functions are called via indirect call in kobj_attr_show(), where they should be of type
ssize_t (*show)(struct kobject *kobj, struct kobj_attribute *attr, char *buf);
because that is the type of the ->show() member in 'struct kobj_attribute' but they are actually of type
ssize_t (*show)(struct kobject *kobj, struct attribute *attr, char *buf);
because of the ->show() member in 'struct cppc_attr', resulting in a Control Flow Integrity violation [1].
$ cat /sys/devices/system/cpu/cpu0/acpi_cppc/highest_perf 3400
$ dmesg | grep "CFI failure" [ 175.970559] CFI failure (target: show_highest_perf+0x0/0x8):
As far as I can tell, the only difference between 'struct cppc_attr' and 'struct kobj_attribute' aside from the type of the attr parameter is the type of the count parameter in the ->store() member (ssize_t vs. size_t), which does not actually matter because all of these nodes are read-only.
Eliminate 'struct cppc_attr' in favor of 'struct kobj_attribute' to fix the violation.
[1]: https://lore.kernel.org/r/[email protected]/
--- drivers/acpi/cppc_acpi.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/acpi/cppc_acpi.c +3 -11
@@ -118,23 +118,15 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr);*/ #define NUM_RETRIES 500 -struct cppc_attr { -struct attribute attr; -ssize_t (*show)(struct kobject *kobj, -struct attribute *attr,char *buf); -ssize_t (*store)(struct kobject *kobj, -struct attribute *attr,const char *c,ssize_t count); -}; -#define define_one_cppc_ro (_name) \ -static struct cppc_attr _name = \ +static struct kobj_attribute _name = \ __ATTR(_name, 0444, show_##_name, NULL)#define to_cpc_desc (a) container_of(a, struct cpc_desc, kobj)#define show_cppc_data (access_fn, struct_name, member_name) \ static ssize_t show_##member_name(struct kobject *kobj, \ - struct attribute *attr, char *buf) \ + struct kobj_attribute *attr, char *buf) \ { \ struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); \ struct struct_name st_name = {0}; \
@@ -157,7 +149,7 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);show_cppc_data (cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);static ssize_t show_feedback_ctrs (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {struct cpc_desc *cpc_ptr =to_cpc_desc (kobj);struct cppc_perf_fb_ctrs fb_ctrs = {0 };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 169/323 crypto: qat - Fix a double free in adf_create_ring
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit f7cae626cabb3350b23722b78fe34dd7a615ca04 ]
In adf_create_ring, if the callee adf_init_ring() failed, the callee will free the ring->base_addr by dma_free_coherent() and return -EFAULT. Then adf_create_ring will goto err and the ring->base_addr will be freed again in adf_cleanup_ring().
My patch sets ring->base_addr to NULL after the first freed to avoid the double free.
--- drivers/crypto/qat/qat_common/adf_transport.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/qat/qat_common/adf_transport.c +1 -0
@@ -197,6 +197,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring)dev_err (&GET_DEV (accel_dev),"Ring address not aligned\n" );dma_free_coherent (&GET_DEV (accel_dev), ring_size_bytes, ring->base_addr, ring->dma_addr); + ring->base_addr =NULL ;return -EFAULT ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 170/323 usb: gadget: r8a66597: Add missing null check on return from platform_get_resource
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 9c2076090c2815fe7c49676df68dde7e60a9b9fc ]
The call to platform_get_resource can potentially return a NULL pointer on failure, so add this check and return -EINVAL if it fails.
Addresses-Coverity: ("Dereference null return")
--- drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/udc/r8a66597-udc.c +2 -0
@@ -1855,6 +1855,8 @@ static int r8a66597_probe(struct platform_device *pdev)return PTR_ERR (reg); ires =platform_get_resource (pdev,IORESOURCE_IRQ ,0 ); +if (!ires) +return -EINVAL ; irq = ires->start; irq_trigger = ires->flags &IRQF_TRIGGER_MASK ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 171/323 USB: cdc-acm: fix unprivileged TIOCCSERIAL
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit dd5619582d60007139f0447382d2839f4f9e339b ]
TIOCSSERIAL is a horrid, underspecified, legacy interface which for most serial devices is only useful for setting the close_delay and closing_wait parameters.
A non-privileged user has only ever been able to set the since long deprecated ASYNC_SPD flags and trying to change any other *supported* feature should result in -EPERM being returned. Setting the current values for any supported features should return success.
Fix the cdc-acm implementation which instead indicated that the TIOCSSERIAL ioctl was not even implemented when a non-privileged user set the current values.
--- drivers/usb/class/cdc-acm.c | 2 -- 1 file changed, 2 deletions(-)
drivers/usb/class/cdc-acm.c +0 -2
@@ -999,8 +999,6 @@ static int set_serial_info(struct acm *acm,if ((new_serial.close_delay != old_close_delay) || (new_serial.closing_wait != old_closing_wait)) retval = -EPERM ; -else - retval = -EOPNOTSUPP ; }else { acm->port.close_delay = close_delay; acm->port.closing_wait = closing_wait;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 172/323 tty: actually undefine superseded ASYNC flags
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit d09845e98a05850a8094ea8fd6dd09a8e6824fff ]
Some kernel-internal ASYNC flags have been superseded by tty-port flags and should no longer be used by kernel drivers.
Fix the misspelled "__KERNEL__" compile guards which failed their sole purpose to break out-of-tree drivers that have not yet been updated.
--- include/uapi/linux/tty_flags.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/uapi/linux/tty_flags.h +2 -2
@@ -39,7 +39,7 @@* WARNING: These flags are no longer used and have been superceded by the * TTY_PORT_ flags in the iflags field (and not userspace-visible) */ -#ifndef _KERNEL_ +#ifndef __KERNEL__#define ASYNCB_INITIALIZED 31/* Serial port was initialized */ #define ASYNCB_SUSPENDED 30/* Serial port is suspended */ #define ASYNCB_NORMAL_ACTIVE 29/* Normal device is active */
@@ -81,7 +81,7 @@#define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI)#define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI) -#ifndef _KERNEL_ +#ifndef __KERNEL__/* These flags are no longer used (and were always masked from userspace) */ #define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED)#define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 173/323 tty: fix return value for unsupported ioctls
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 1b8b20868a6d64cfe8174a21b25b74367bdf0560 ]
Drivers should return -ENOTTY ("Inappropriate I/O control operation") when an ioctl isn't supported, while -EINVAL is used for invalid arguments.
Fix up the TIOCMGET, TIOCMSET and TIOCGICOUNT helpers which returned -EINVAL when a tty driver did not implement the corresponding operations.
Note that the TIOCMGET and TIOCMSET helpers predate git and do not get a corresponding Fixes tag below.
--- drivers/tty/tty_io.c | 8 ++++---- include/linux/tty_driver.h | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/tty/tty_io.c +4 -4
@@ -2424,14 +2424,14 @@ out:* @p: pointer to result * * Obtain the modem status bits from the tty driver if the feature -* is supported. Return -EINVAL if it is not available. +* is supported. Return -ENOTTY if it is not available. * * Locking: none (up to the driver) */ static int tty_tiocmget (struct tty_struct *tty,int __user *p) { -int retval = -EINVAL ; +int retval = -ENOTTY ;if (tty->ops->tiocmget) { retval = tty->ops->tiocmget (tty);
@@ -2449,7 +2449,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p)* @p: pointer to desired bits * * Set the modem status bits from the tty driver if the feature -* is supported. Return -EINVAL if it is not available. +* is supported. Return -ENOTTY if it is not available. * * Locking: none (up to the driver) */
@@ -2461,7 +2461,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,unsigned int set, clear, val;if (tty->ops->tiocmset ==NULL ) -return -EINVAL ; +return -ENOTTY ; retval =get_user (val, p);if (retval)
include/linux/tty_driver.h +1 -1
@@ -236,7 +236,7 @@* * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel * structure to complete. This method is optional and will only be called -* if provided (otherwise EINVAL will be returned). +* if provided (otherwise ENOTTY will be returned). */ #include <linux/export.h>
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 174/323 firmware: qcom-scm: Fix QCOM_SCM configuration
In reply to Greg Kroah-HartmanFrom: He Ying <[email protected]>
[ Upstream commit 2954a6f12f250890ec2433cec03ba92784d613e8 ]
When CONFIG_QCOM_SCM is y and CONFIG_HAVE_ARM_SMCCC is not set, compiling errors are encountered as follows:
drivers/firmware/qcom_scm-smc.o: In function `__scm_smc_do_quirk':
qcom_scm-smc.c:(.text+0x36): undefined reference to __arm_smccc_smc' drivers/firmware/qcom_scm-legacy.o: In function scm_legacy_call':
qcom_scm-legacy.c:(.text+0xe2): undefined reference to __arm_smccc_smc' drivers/firmware/qcom_scm-legacy.o: In function scm_legacy_call_atomic':
qcom_scm-legacy.c:(.text+0x1f0): undefined reference to `__arm_smccc_smc'
Note that __arm_smccc_smc is defined when HAVE_ARM_SMCCC is y. So add dependency on HAVE_ARM_SMCCC in QCOM_SCM configuration.
--- drivers/firmware/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/Kconfig +1 -0
@@ -206,6 +206,7 @@ config FW_CFG_SYSFS_CMDLINE config QCOM_SCM bool depends on ARM || ARM64 + depends on HAVE_ARM_SMCCC select RESET_CONTROLLER config QCOM_SCM_32
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 175/323 platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table
In reply to Greg Kroah-HartmanFrom: Steffen Dirkwinkel <[email protected]>
[ Upstream commit d21e5abd3a005253eb033090aab2e43bce090d89 ]
pmc_plt_clk* clocks are used for ethernet controllers, so need to stay turned on. This adds the affected board family to critclk_systems DMI table, so the clocks are marked as CLK_CRITICAL and not turned off.
This replaces the previously listed boards with a match for the whole device family CBxx63. CBxx63 matches only baytrail devices. There are new affected boards that would otherwise need to be listed. There are unaffected boards in the family, but having the clocks turned on is not an issue.
--- drivers/platform/x86/pmc_atom.c | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-)
drivers/platform/x86/pmc_atom.c +2 -26
@@ -453,34 +453,10 @@ static const struct dmi_system_id critclk_systems[] = { }, {/* pmc_plt_clk* - are used for ethernet controllers */ - .ident = "Beckhoff CB3163", + .ident = "Beckhoff Baytrail", .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Beckhoff Automation" ), - DMI_MATCH(DMI_BOARD_NAME, "CB3163"), - }, - }, - { -/* pmc_plt_clk* - are used for ethernet controllers */ - .ident ="Beckhoff CB4063" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Beckhoff Automation" ), - DMI_MATCH(DMI_BOARD_NAME, "CB4063"), - }, - }, - { -/* pmc_plt_clk* - are used for ethernet controllers */ - .ident ="Beckhoff CB6263" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Beckhoff Automation" ), - DMI_MATCH(DMI_BOARD_NAME, "CB6263"), - }, - }, - { -/* pmc_plt_clk* - are used for ethernet controllers */ - .ident ="Beckhoff CB6363" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Beckhoff Automation" ), - DMI_MATCH(DMI_BOARD_NAME, "CB6363"), + DMI_MATCH(DMI_PRODUCT_FAMILY, "CBxx63"), }, }, {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 176/323 x86/platform/uv: Fix !KEXEC build failure
In reply to Greg Kroah-HartmanFrom: Ingo Molnar <[email protected]>
[ Upstream commit c2209ea55612efac75de0a58ef5f7394fae7fa0f ]
When KEXEC is disabled, the UV build fails:
arch/x86/platform/uv/uv_nmi.c:875:14: error: ‘uv_nmi_kexec_failed’ undeclared (first use in this function)
Since uv_nmi_kexec_failed is only defined in the KEXEC_CORE #ifdef branch, this code cannot ever have been build tested:
if (main)
pr_err("UV: NMI kdump: KEXEC not supported in this kernel\n");
atomic_set(&uv_nmi_kexec_failed, 1);Nor is this use possible in uv_handle_nmi():
atomic_set(&uv_nmi_kexec_failed, 0);
These bugs were introduced in this commit:
d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails")
Which added the uv_nmi_kexec_failed assignments to !KEXEC code, while making the definition KEXEC-only - apparently without testing the !KEXEC case.
Instead of complicating the #ifdef maze, simplify the code by requiring X86_UV to depend on KEXEC_CORE. This pattern is present in other architectures as well.
( We'll remove the untested, 7 years old !KEXEC complications from the file in a
separate commit. )
--- arch/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/x86/Kconfig +1 -0
@@ -526,6 +526,7 @@ config X86_UV depends on X86_EXTENDED_PLATFORM depends on NUMA depends on EFI + depends on KEXEC_CORE depends on X86_X2APIC depends on PCI ---help---
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 177/323 Drivers: hv: vmbus: Increase wait time for VMbus unload
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
[ Upstream commit 77db0ec8b7764cb9b09b78066ebfd47b2c0c1909 ]
When running in Azure, disks may be connected to a Linux VM with read/write caching enabled. If a VM panics and issues a VMbus UNLOAD request to Hyper-V, the response is delayed until all dirty data in the disk cache is flushed. In extreme cases, this flushing can take 10's of seconds, depending on the disk speed and the amount of dirty data. If kdump is configured for the VM, the current 10 second timeout in vmbus_wait_for_unload() may be exceeded, and the UNLOAD complete message may arrive well after the kdump kernel is already running, causing problems. Note that no problem occurs if kdump is not enabled because Hyper-V waits for the cache flush before doing a reboot through the BIOS/UEFI code.
Fix this problem by increasing the timeout in vmbus_wait_for_unload() to 100 seconds. Also output periodic messages so that if anyone is watching the serial console, they won't think the VM is completely hung.
--- drivers/hv/channel_mgmt.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-)
drivers/hv/channel_mgmt.c +25 -5
@@ -768,6 +768,12 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)free_cpumask_var (available_mask); } +#define UNLOAD_DELAY_UNIT_MS 10/* 10 milliseconds */ +#define UNLOAD_WAIT_MS (100*1000)/* 100 seconds */ +#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS) +#define UNLOAD_MSG_MS (5*1000)/* Every 5 seconds */ +#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS) +static void vmbus_wait_for_unload (void ) {int cpu;
@@ -785,12 +791,17 @@ static void vmbus_wait_for_unload(void)* vmbus_connection.unload_event. If not, the last thing we can do is * read message pages for all CPUs directly. * -* Wait no more than 10 seconds so that the panic path can't get -* hung forever in case the response message isn't seen. +* Wait up to 100 seconds since an Azure host must writeback any dirty +* data in its disk cache before the VMbus UNLOAD request will +* complete. This flushing has been empirically observed to take up +* to 50 seconds in cases with a lot of dirty data, so allow additional +* leeway and for inaccuracies in mdelay(). But eventually time out so +* that the panic path can't get hung forever in case the response +* message isn't seen. */ -for (i =0 ; i <1000 ; i++) { +for (i =1 ; i <=UNLOAD_WAIT_LOOPS ; i++) {if (completion_done (&vmbus_connection.unload_event)) -break ; + goto completed;for_each_online_cpu (cpu) {struct hv_per_cpu_context *hv_cpu
@@ -813,9 +824,18 @@ static void vmbus_wait_for_unload(void)vmbus_signal_eom (msg, message_type); } -mdelay (10 ); +/* +* Give a notice periodically so someone watching the +* serial output won't think it is completely hung. +*/ +if (!(i %UNLOAD_MSG_LOOPS )) +pr_notice ("Waiting for VMBus UNLOAD to complete\n" ); + +mdelay (UNLOAD_DELAY_UNIT_MS ); } +pr_err ("Continuing even though VMBus UNLOAD did not complete\n" ); +completed:/* * We're crashing and already got the UNLOAD_RESPONSE, cleanup all * maybe-pending messages on all CPUs to be able to receive new
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 178/323 ttyprintk: Add TTY hangup callback.
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ]
syzbot is reporting hung task due to flood of
tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
port->count);
message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from decrementing port->count due to tty_hung_up_p() == true.
----------
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <unistd.h>
int main(int argc, char *argv[])
{
int i;
int fd[10];
for (i = 0; i < 10; i++)
fd[i] = open("/dev/ttyprintk", O_WRONLY);
ioctl(fd[0], TIOCVHANGUP);
for (i = 0; i < 10; i++)
close(fd[i]);
close(open("/dev/ttyprintk", O_WRONLY));
return 0;
}----------
When TTY hangup happens, port->count needs to be reset via "struct tty_operations"->hangup callback.
[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
--- drivers/char/ttyprintk.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/char/ttyprintk.c +11 -0
@@ -159,12 +159,23 @@ static int tpk_ioctl(struct tty_struct *tty,return 0 ; } +/* +* TTY operations hangup function. +*/ +static void tpk_hangup (struct tty_struct *tty) +{ +struct ttyprintk_port *tpkp = tty->driver_data; + +tty_port_hangup (&tpkp->port); +} +static const struct tty_operations ttyprintk_ops = { .open = tpk_open, .close = tpk_close, .write = tpk_write, .write_room = tpk_write_room, .ioctl = tpk_ioctl, + .hangup = tpk_hangup, };static const struct tty_port_operations null_ops = { };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 179/323 media: vivid: fix assignment of dev->fbuf_out_flags
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 5cde22fcc7271812a7944c47b40100df15908358 ]
Currently the chroma_flags and alpha_flags are being zero'd with a bit-wise mask and the following statement should be bit-wise or'ing in the new flag bits but instead is making a direct assignment. Fix this by using the |= operator rather than an assignment.
Addresses-Coverity: ("Unused value")
--- drivers/media/platform/vivid/vivid-vid-out.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/vivid/vivid-vid-out.c +1 -1
@@ -1010,7 +1010,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh,return -EINVAL ; } dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags); - dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags); + dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 180/323 media: omap4iss: return error code when omap4iss_get() failed
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 8938c48fa25b491842ece9eb38f0bea0fcbaca44 ]
If omap4iss_get() failed, it need return error code in iss_probe().
--- drivers/staging/media/omap4iss/iss.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/media/omap4iss/iss.c +3 -1
@@ -1244,8 +1244,10 @@ static int iss_probe(struct platform_device *pdev)if (ret <0 ) goto error; -if (!omap4iss_get (iss)) +if (!omap4iss_get (iss)) { + ret = -EINVAL ; goto error; + } ret =iss_reset (iss);if (ret <0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 181/323 media: m88rs6000t: avoid potential out-of-bounds reads on arrays
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ]
There a 3 array for-loops that don't check the upper bounds of the index into arrays and this may lead to potential out-of-bounds reads. Fix this by adding array size upper bounds checks to be full safe.
Addresses-Coverity: ("Out-of-bounds read")
--- drivers/media/tuners/m88rs6000t.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/tuners/m88rs6000t.c +3 -3
@@ -534,7 +534,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) PGA2_cri =PGA2_GC >>2 ; PGA2_crf =PGA2_GC &0x03 ; -for (i =0 ; i <=RF_GC ; i++) +for (i =0 ; i <=RF_GC && i <ARRAY_SIZE (RFGS ); i++)RFG +=RFGS [i];if (RF_GC ==0 )
@@ -546,12 +546,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)if (RF_GC ==3 )RFG +=100 ; -for (i =0 ; i <=IF_GC ; i++) +for (i =0 ; i <=IF_GC && i <ARRAY_SIZE (IFGS ); i++)IFG +=IFGS [i];TIAG =TIA_GC *TIA_GS ; -for (i =0 ; i <=BB_GC ; i++) +for (i =0 ; i <=BB_GC && i <ARRAY_SIZE (BBGS ); i++)BBG +=BBGS [i];PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 182/323 x86/kprobes: Fix to check non boostable prefixes correctly
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit 6dd3b8c9f58816a1354be39559f630cd1bd12159 ]
There are 2 bugs in the can_boost() function because of using x86 insn decoder. Since the insn->opcode never has a prefix byte, it can not find CS override prefix in it. And the insn->attr is the attribute of the opcode, thus inat_is_address_size_prefix( insn->attr) always returns false.
Fix those by checking each prefix bytes with for_each_insn_prefix loop and getting the correct attribute for each prefix byte. Also, this removes unlikely, because this is a slow path.
--- arch/x86/kernel/kprobes/core.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
arch/x86/kernel/kprobes/core.c +12 -5
@@ -173,6 +173,8 @@ NOKPROBE_SYMBOL(skip_prefixes);int can_boost (struct insn *insn,void *addr) {kprobe_opcode_t opcode; +insn_byte_t prefix; +int i;if (search_exception_tables ((unsigned long )addr))return 0 ;/* Page fault may occur on this address. */
@@ -185,9 +187,14 @@ int can_boost(struct insn *insn, void *addr)if (insn->opcode.nbytes !=1 )return 0 ; -/* Can't boost Address-size override prefix */ -if (unlikely (inat_is_address_size_prefix (insn->attr))) -return 0 ; +for_each_insn_prefix (insn, i, prefix) { +insn_attr_t attr; + + attr =inat_get_opcode_attribute (prefix); +/* Can't boost Address-size override prefix and CS override prefix */ +if (prefix ==0x2e ||inat_is_address_size_prefix (attr)) +return 0 ; + } opcode = insn->opcode.bytes[0 ];
@@ -212,8 +219,8 @@ int can_boost(struct insn *insn, void *addr)/* clear and set flags are boostable */ return (opcode ==0xf5 || (0xf7 < opcode && opcode <0xfe ));default : -/* CS override prefix and call are not boostable */ -return (opcode !=0x2e && opcode !=0x9a ); +/* call is not boostable */ +return opcode !=0x9a ; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 183/323 pata_arasan_cf: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit c7e8f404d56b99c80990b19a402c3f640d74be05 ]
The driver's probe() method is written as if platform_get_irq() returns 0 on error, while actually it returns a negative error code (with all the other values considered valid IRQs). Rewrite the driver's IRQ checking code to pass the positive IRQ #s to ata_host_activate(), propagate upstream -EPROBE_DEFER, and set up the driver to polling mode on (negative) errors and IRQ0 (libata treats IRQ #0 as a polling mode anyway)...
--- drivers/ata/pata_arasan_cf.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/ata/pata_arasan_cf.c +11 -4
@@ -819,12 +819,19 @@ static int arasan_cf_probe(struct platform_device *pdev)else quirk =CF_BROKEN_UDMA ;/* as it is on spear1340 */ -/* if irq is 0, support only PIO */ - acdev->irq =platform_get_irq (pdev,0 ); -if (acdev->irq) +/* +* If there's an error getting IRQ (or we do get IRQ0), +* support only PIO +*/ + ret =platform_get_irq (pdev,0 ); +if (ret >0 ) { + acdev->irq = ret; irq_handler = arasan_cf_interrupt; -else + }else if (ret == -EPROBE_DEFER ) { +return ret; + }else { quirk |=CF_BROKEN_MWDMA |CF_BROKEN_UDMA ; + } acdev->pbase = res->start; acdev->vbase = devm_ioremap_nocache(&pdev->dev, res->start,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 184/323 pata_ipx4xx_cf: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit e379b40cc0f179403ce0b82b7e539f635a568da5 ]
The driver's probe() method is written as if platform_get_irq() returns 0 on error, while actually it returns a negative error code (with all the other values considered valid IRQs). Rewrite the driver's IRQ checking code to pass the positive IRQ #s to ata_host_activate(), propagate errors upstream, and treat IRQ0 as error, returning -EINVAL, as the libata code treats 0 as an indication that polling should be used anyway...
--- drivers/ata/pata_ixp4xx_cf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/ata/pata_ixp4xx_cf.c +5 -1
@@ -169,8 +169,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev)return -ENOMEM ; irq =platform_get_irq (pdev,0 ); -if (irq) +if (irq >0 )irq_set_irq_type (irq,IRQ_TYPE_EDGE_RISING ); +else if (irq <0 ) +return irq; +else +return -EINVAL ;/* Setup expansion bus chip selects */ *data->cs0_cfg = data->cs0_bits;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 185/323 sata_mv: add IRQ checks
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit e6471a65fdd5efbb8dd2732dd0f063f960685ceb ]
The function mv_platform_probe() neglects to check the results of the calls to platform_get_irq() and irq_of_parse_and_map() and blithely passes them to ata_host_activate() -- while the latter only checks for IRQ0 (treating it as a polling mode indicattion) and passes the negative values to devm_request_irq() causing it to fail as it takes unsigned values for the IRQ #...
Add to mv_platform_probe() the proper IRQ checks to pass the positive IRQ #s to ata_host_activate(), propagate upstream the negative error codes, and override the IRQ0 with -EINVAL (as we don't want the polling mode).
--- drivers/ata/sata_mv.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/ata/sata_mv.c +4 -0
@@ -4112,6 +4112,10 @@ static int mv_platform_probe(struct platform_device *pdev) n_ports = mv_platform_data->n_ports; irq =platform_get_irq (pdev,0 ); } +if (irq <0 ) +return irq; +if (!irq) +return -EINVAL ; host =ata_host_alloc_pinfo (&pdev->dev, ppi, n_ports); hpriv =devm_kzalloc (&pdev->dev,sizeof (*hpriv),GFP_KERNEL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 186/323 ata: libahci_platform: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit b30d0040f06159de97ad9c0b1536f47250719d7d ]
Iff platform_get_irq() returns 0, ahci_platform_init_host() would return 0 early (as if the call was successful). Override IRQ0 with -EINVAL instead as the 'libata' regards 0 as "no IRQ" (thus polling) anyway...
--- drivers/ata/libahci_platform.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ata/libahci_platform.c +3 -1
@@ -518,11 +518,13 @@ int ahci_platform_init_host(struct platform_device *pdev,int i, irq, n_ports, rc; irq =platform_get_irq (pdev,0 ); -if (irq <=0 ) { +if (irq <0 ) {if (irq != -EPROBE_DEFER )dev_err (dev,"no irq\n" );return irq; } +if (!irq) +return -EINVAL ; hpriv->irq = irq;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 187/323 vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit b5a1f8921d5040bb788492bf33a66758021e4be5 ]
There is a small race where the parent is NULL even though the kobj has already been made visible in sysfs.
For instance the attribute_group is made visible in sysfs_create_files() and the mdev_type_attr_show() does:
ret = attr->show(kobj, type->parent->dev, buf);
Which will crash on NULL parent. Move the parent setup to before the type pointer leaves the stack frame.
Message-Id: <[email protected]>
--- drivers/vfio/mdev/mdev_sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/mdev/mdev_sysfs.c +1 -1
@@ -108,6 +108,7 @@ struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,return ERR_PTR (-ENOMEM ); type->kobj.kset = parent->mdev_types_kset; + type->parent = parent; ret = kobject_init_and_add(&type->kobj, &mdev_type_ktype, NULL, "%s-%s", dev_driver_string(parent->dev),
@@ -135,7 +136,6 @@ struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent, } type->group = group; - type->parent = parent;return type; attrs_failed:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 188/323 clk: uniphier: Fix potential infinite loop
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit f6b1340dc751a6caa2a0567b667d0f4f4172cd58 ]
The for-loop iterates with a u8 loop counter i and compares this with the loop upper limit of num_parents that is an int type. There is a potential infinite loop if num_parents is larger than the u8 loop counter. Fix this by making the loop counter the same type as num_parents. Also make num_parents an unsigned int to match the return type of the call to clk_hw_get_num_parents.
Addresses-Coverity: ("Infinite loop")
--- drivers/clk/uniphier/clk-uniphier-mux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/uniphier/clk-uniphier-mux.c +2 -2
@@ -40,10 +40,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw, u8 index)static u8 uniphier_clk_mux_get_parent (struct clk_hw *hw) {struct uniphier_clk_mux *mux =to_uniphier_clk_mux (hw); -int num_parents =clk_hw_get_num_parents (hw); +unsigned int num_parents =clk_hw_get_num_parents (hw);int ret;unsigned int val; -u8 i; +unsigned int i; ret =regmap_read (mux->regmap, mux->reg, &val);if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 189/323 scsi: jazz_esp: Add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 38fca15c29db6ed06e894ac194502633e2a7d1fb ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real error code. Stop calling request_irq() with the invalid IRQ #s.
--- drivers/scsi/jazz_esp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/jazz_esp.c +3 -1
@@ -170,7 +170,9 @@ static int esp_jazz_probe(struct platform_device *dev)if (!esp->command_block) goto fail_unmap_regs; - host->irq =platform_get_irq (dev,0 ); + host->irq = err =platform_get_irq (dev,0 ); +if (err <0 ) + goto fail_unmap_command_block; err =request_irq (host->irq, scsi_esp_intr,IRQF_SHARED ,"ESP" , esp);if (err <0 ) goto fail_unmap_command_block;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 190/323 scsi: sun3x_esp: Add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 14b321380eb333c82853d7d612d0995f05f88fdc ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real error code. Stop calling request_irq() with the invalid IRQ #s.
--- drivers/scsi/sun3x_esp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/sun3x_esp.c +3 -1
@@ -233,7 +233,9 @@ static int esp_sun3x_probe(struct platform_device *dev)if (!esp->command_block) goto fail_unmap_regs_dma; - host->irq =platform_get_irq (dev,0 ); + host->irq = err =platform_get_irq (dev,0 ); +if (err <0 ) + goto fail_unmap_command_block; err =request_irq (host->irq, scsi_esp_intr,IRQF_SHARED ,"SUN3X ESP" , esp);if (err <0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 191/323 scsi: sni_53c710: Add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 1160d61bc51e87e509cfaf9da50a0060f67b6de4 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_irq() (which takes *unsigned* IRQ #s), causing it to fail with -EINVAL (overridden by -ENODEV further below). Stop calling request_irq() with the invalid IRQ #s.
--- drivers/scsi/sni_53c710.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/scsi/sni_53c710.c +4 -1
@@ -71,6 +71,7 @@ static int snirm710_probe(struct platform_device *dev)struct NCR_700_Host_Parameters *hostdata;struct Scsi_Host *host;struct resource *res; +int rc; res =platform_get_resource (dev,IORESOURCE_MEM ,0 );if (!res)
@@ -96,7 +97,9 @@ static int snirm710_probe(struct platform_device *dev) goto out_kfree; host->this_id =7 ; host->base = base; - host->irq =platform_get_irq (dev,0 ); + host->irq = rc =platform_get_irq (dev,0 ); +if (rc <0 ) + goto out_put_host;if (request_irq (host->irq, NCR_700_intr,IRQF_SHARED ,"snirm710" , host)) {printk (KERN_ERR "snirm710: request_irq failed!\n" ); goto out_put_host;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 192/323 mfd: stm32-timers: Avoid clearing auto reload register
In reply to Greg Kroah-HartmanFrom: Fabrice Gasnier <[email protected]>
[ Upstream commit 4917e498c6894ba077867aff78f82cffd5ffbb5c ]
The ARR register is cleared unconditionally upon probing, after the maximum value has been read. This initial condition is rather not intuitive, when considering the counter child driver. It rather expects the maximum value by default:
- The counter interface shows a zero value by default for 'ceiling' attribute.
- Enabling the counter without any prior configuration makes it doesn't count.
The reset value of ARR register is the maximum. So Choice here is to backup it, and restore it then, instead of clearing its value. It also fixes the initial condition seen by the counter driver.
--- drivers/mfd/stm32-timers.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mfd/stm32-timers.c +6 -1
@@ -20,13 +20,18 @@ static const struct regmap_config stm32_timers_regmap_cfg = {static void stm32_timers_get_arr_size (struct stm32_timers *ddata) { +u32 arr; + +/* Backup ARR to restore it after getting the maximum value */ +regmap_read (ddata->regmap,TIM_ARR , &arr); +/* * Only the available bits will be written so when readback * we get the maximum value of auto reload register */ regmap_write (ddata->regmap,TIM_ARR , ~0L );regmap_read (ddata->regmap,TIM_ARR , &ddata->max_arr); -regmap_write (ddata->regmap,TIM_ARR ,0x0 ); +regmap_write (ddata->regmap,TIM_ARR , arr); }static int stm32_timers_probe (struct platform_device *pdev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 193/323 HSI: core: fix resource leaks in hsi_add_client_from_dt()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ]
If some of the allocations fail between the dev_set_name() and the device_register() then the name will not be freed. Fix this by moving dev_set_name() directly in front of the call to device_register().
--- drivers/hsi/hsi_core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/hsi/hsi_core.c +1 -2
@@ -223,8 +223,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port,if (err) goto err; -dev_set_name (&cl->device,"%s" , name); - err =hsi_of_property_parse_mode (client,"hsi-mode" , &mode);if (err) { err = hsi_of_property_parse_mode(client, "hsi-rx-mode",
@@ -306,6 +304,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port, cl->device.release = hsi_client_release; cl->device.of_node = client; +dev_set_name (&cl->device,"%s" , name);if (device_register (&cl->device) <0 ) {pr_err ("hsi: failed to register client: %s\n" , name);put_device (&cl->device);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 194/323 x86/events/amd/iommu: Fix sysfs type mismatch
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit de5bc7b425d4c27ae5faa00ea7eb6b9780b9a355 ]
dev_attr_show() calls _iommu_event_show() via an indirect call but _iommu_event_show()'s type does not currently match the type of the show() member in 'struct device_attribute', resulting in a Control Flow Integrity violation.
$ cat /sys/devices/amd_iommu_1/events/mem_dte_hit csource=0x0a
$ dmesg | grep "CFI failure" [ 3526.735140] CFI failure (target: _iommu_event_show...):
Change _iommu_event_show() and 'struct amd_iommu_event_desc' to 'struct device_attribute' so that there is no more CFI violation.
--- arch/x86/events/amd/iommu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/events/amd/iommu.c +3 -3
@@ -84,12 +84,12 @@ static struct attribute_group amd_iommu_events_group = { };struct amd_iommu_event_desc { -struct kobj_attribute attr; +struct device_attribute attr;const char *event; }; -static ssize_t _iommu_event_show (struct kobject *kobj, -struct kobj_attribute *attr,char *buf) +static ssize_t _iommu_event_show (struct device *dev, +struct device_attribute *attr,char *buf) {struct amd_iommu_event_desc *event = container_of(attr, struct amd_iommu_event_desc, attr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 195/323 HID: plantronics: Workaround for double volume key presses
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ]
Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice for each volume key press. This patch adds a quirk to hid-plantronics for this product ID, which will ignore the second volume key press if it happens within 5 ms from the last one that was handled.
The patch was tested on the mentioned model only, it shouldn't affect other models, however, this quirk might be needed for them too. Auto-repeat (when a key is held pressed) is not affected, because the rate is about 3 times per second, which is far less frequent than once in 5 ms.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-plantronics.c | 60 +++++++++++++++++++++++++++++++++-- include/linux/hid.h | 2 ++ 3 files changed, 61 insertions(+), 2 deletions(-)
drivers/hid/hid-ids.h +1 -0
@@ -859,6 +859,7 @@#define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003#define USB_VENDOR_ID_PLANTRONICS 0x047f +#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056#define USB_VENDOR_ID_PANASONIC 0x04da#define USB_DEVICE_ID_PANABOARD_UBT780 0x1044
drivers/hid/hid-plantronics.c +58 -2
113 lines not on this page · raw message
include/linux/hid.h +2 -0
@@ -263,6 +263,8 @@ struct hid_item {#define HID_CP_SELECTION 0x000c0080#define HID_CP_MEDIASELECTION 0x000c0087#define HID_CP_SELECTDISC 0x000c00ba +#define HID_CP_VOLUMEUP 0x000c00e9 +#define HID_CP_VOLUMEDOWN 0x000c00ea#define HID_CP_PLAYBACKSPEED 0x000c00f1#define HID_CP_PROXIMITY 0x000c0109#define HID_CP_SPEAKERSYSTEM 0x000c0160
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 196/323 perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars
In reply to Greg Kroah-HartmanFrom: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 210e4c89ef61432040c6cd828fefa441f4887186 ]
The 'ret' variable was initialized to zero but then it was not updated from the fprintf() return, fix it.
--- tools/perf/util/symbol_fprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/symbol_fprintf.c +1 -1
@@ -66,7 +66,7 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso,for (nd =rb_first (&dso->symbol_names[type]); nd; nd =rb_next (nd)) { pos = rb_entry(nd, struct symbol_name_rb_node, rb_node); -fprintf (fp,"%s\n" , pos->sym.name); + ret +=fprintf (fp,"%s\n" , pos->sym.name); }return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 197/323 net: lapbether: Prevent racing when checking whether the netif is running
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 5acd0cfbfbb5a688da1bfb1a2152b0c855115a35 ]
There are two "netif_running" checks in this driver. One is in "lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make sure that the LAPB APIs called in these functions are called before "lapb_unregister" is called by the "ndo_stop" function.
However, these "netif_running" checks are unreliable, because it's possible that immediately after "netif_running" returns true, "ndo_stop" is called (which causes "lapb_unregister" to be called).
This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can reliably check and ensure the netif is running while doing their work.
--- drivers/net/wan/lapbether.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
drivers/net/wan/lapbether.c +25 -7
@@ -56,6 +56,8 @@ struct lapbethdev {struct list_head node;struct net_device *ethdev;/* link to ethernet device */ struct net_device *axdev;/* lapbeth device (lapb#) */ +bool up; +spinlock_t up_lock;/* Protects "up" */ };static LIST_HEAD (lapbeth_devices);
@@ -103,8 +105,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packercu_read_lock (); lapbeth =lapbeth_get_x25_dev (dev);if (!lapbeth) - goto drop_unlock; -if (!netif_running (lapbeth->axdev)) + goto drop_unlock_rcu; +spin_lock_bh (&lapbeth->up_lock); +if (!lapbeth->up) goto drop_unlock; len = skb->data[0 ] + skb->data[1 ] *256 ;
@@ -119,11 +122,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe goto drop_unlock; } out: +spin_unlock_bh (&lapbeth->up_lock);rcu_read_unlock ();return 0 ; drop_unlock:kfree_skb (skb); goto out; +drop_unlock_rcu: +rcu_read_unlock (); drop:kfree_skb (skb);return 0 ;
@@ -151,13 +157,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)static netdev_tx_t lapbeth_xmit (struct sk_buff *skb,struct net_device *dev) { +struct lapbethdev *lapbeth =netdev_priv (dev);int err; -/* -* Just to be *really* sure not to send anything if the interface -* is down, the ethernet device may have gone. -*/ -if (!netif_running (dev)) +spin_lock_bh (&lapbeth->up_lock); +if (!lapbeth->up) goto drop;/* There should be a pseudo header of 1 byte added by upper layers.
@@ -188,6 +192,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, goto drop; } out: +spin_unlock_bh (&lapbeth->up_lock);return NETDEV_TX_OK ; drop:kfree_skb (skb);
@@ -279,6 +284,7 @@ static const struct lapb_register_struct lapbeth_callbacks = {*/ static int lapbeth_open (struct net_device *dev) { +struct lapbethdev *lapbeth =netdev_priv (dev);int err;if ((err =lapb_register (dev, &lapbeth_callbacks)) !=LAPB_OK ) {
@@ -286,13 +292,22 @@ static int lapbeth_open(struct net_device *dev)return -ENODEV ; } +spin_lock_bh (&lapbeth->up_lock); + lapbeth->up = true; +spin_unlock_bh (&lapbeth->up_lock); +return 0 ; }static int lapbeth_close (struct net_device *dev) { +struct lapbethdev *lapbeth =netdev_priv (dev);int err; +spin_lock_bh (&lapbeth->up_lock); + lapbeth->up = false; +spin_unlock_bh (&lapbeth->up_lock); +if ((err =lapb_unregister (dev)) !=LAPB_OK )pr_err ("lapb_unregister error: %d\n" , err);
@@ -350,6 +365,9 @@ static int lapbeth_new_device(struct net_device *dev)dev_hold (dev); lapbeth->ethdev = dev; + lapbeth->up = false; +spin_lock_init (&lapbeth->up_lock); + rc = -EIO ;if (register_netdevice (ndev)) goto fail;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 198/323 powerpc/prom: Mark identical_pvr_fixup as __init
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ]
If identical_pvr_fixup() is not inlined, there are two modpost warnings:
WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference from the function identical_pvr_fixup() to the function .init.text:of_get_flat_dt_prop()
The function identical_pvr_fixup() references
the function __init of_get_flat_dt_prop().
This is often because identical_pvr_fixup lacks a __init annotation or the annotation of of_get_flat_dt_prop is wrong.
WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference from the function identical_pvr_fixup() to the function .init.text:identify_cpu()
The function identical_pvr_fixup() references
the function __init identify_cpu().
This is often because identical_pvr_fixup lacks a __init annotation or the annotation of identify_cpu is wrong.
identical_pvr_fixup() calls two functions marked as __init and is only called by a function marked as __init so it should be marked as __init as well. At the same time, remove the inline keywork as it is not necessary to inline this function. The compiler is still free to do so if it feels it is worthwhile since commit 889b3c1245de ("compiler:
remove CONFIG_OPTIMIZE_INLINING entirely").
--- arch/powerpc/kernel/prom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/prom.c +1 -1
@@ -265,7 +265,7 @@ static struct feature_property { };#if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU ) -static inline void identical_pvr_fixup (unsigned long node) +static __init void identical_pvr_fixup (unsigned long node) {unsigned int pvr;const char *model =of_get_flat_dt_prop (node,"model" ,NULL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 199/323 powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
In reply to Greg Kroah-HartmanFrom: Chen Huang <[email protected]>
[ Upstream commit 4fe529449d85e78972fa327999961ecc83a0b6db ]
When compiling the powerpc with the SMP disabled, it shows the issue:
arch/powerpc/kernel/watchdog.c: In function ‘watchdog_smp_panic’:arch/powerpc/kernel/watchdog.c:177:4: error: implicit declaration of function ‘smp_send_nmi_ipi’; did you mean ‘smp_send_stop’? [-Werror=implicit-function-declaration]
177 | smp_send_nmi_ipi(c, wd_lockup_ipi, 1000000);
| ^~~~~~~~~~~~~~~~
| smp_send_stopcc1: all warnings being treated as errors
make[2]: *** [scripts/Makefile.build:273: arch/powerpc/kernel/watchdog.o] Error 1 make[1]: *** [scripts/Makefile.build:534: arch/powerpc/kernel] Error 2
make: *** [Makefile:1980: arch/powerpc] Error 2
make: *** Waiting for unfinished jobs....
We found that powerpc used ipi to implement hardlockup watchdog, so the HAVE_HARDLOCKUP_DETECTOR_ARCH should depend on the SMP.
--- arch/powerpc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/Kconfig +1 -1
@@ -208,7 +208,7 @@ config PPC select HAVE_MEMBLOCK_NODE_MAP select HAVE_MOD_ARCH_SPECIFIC select HAVE_NMI if PERF_EVENTS || (PPC64 && PPC_BOOK3S) - select HAVE_HARDLOCKUP_DETECTOR_ARCH if (PPC64 && PPC_BOOK3S) + select HAVE_HARDLOCKUP_DETECTOR_ARCH if PPC64 && PPC_BOOK3S && SMP select HAVE_OPROFILE select HAVE_OPTPROBES if PPC64 select HAVE_PERF_EVENTS
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 200/323 ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
In reply to Greg Kroah-HartmanFrom: Jia Zhou <[email protected]>
[ Upstream commit abc21649b3e5c34b143bf86f0c78e33d5815e250 ]
modification in commit 2a3f7221acdd ("ALSA: core: Fix card races between register and disconnect") resulting in this problem.
--- sound/core/init.c | 2 -- 1 file changed, 2 deletions(-)
sound/core/init.c +0 -2
@@ -404,10 +404,8 @@ int snd_card_disconnect(struct snd_card *card)return 0 ; } card->shutdown =1 ; -spin_unlock (&card->files_lock);/* replace file->f_op with special dummy operations */ -spin_lock (&card->files_lock);list_for_each_entry (mfile, &card->files_list, list) {/* it's critical part, use endless loop */ /* we have no room to fail */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 201/323 bug: Remove redundant condition check in report_bug
In reply to Greg Kroah-HartmanFrom: Andrew Scull <[email protected]>
[ Upstream commit 3ad1a6cb0abc63d036fc866bd7c2c5983516dec5 ]
report_bug() will return early if it cannot find a bug corresponding to the provided address. The subsequent test for the bug will always be true so remove it.
--- lib/bug.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-)
lib/bug.c +15 -18
@@ -155,30 +155,27 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) file =NULL ; line =0 ; - warning =0 ; -if (bug) {#ifdef CONFIG_DEBUG_BUGVERBOSE #ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS - file = bug->file; + file = bug->file;#else - file = (const char *)bug + bug->file_disp; + file = (const char *)bug + bug->file_disp;#endif - line = bug->line; + line = bug->line;#endif - warning = (bug->flags &BUGFLAG_WARNING ) !=0 ; - once = (bug->flags &BUGFLAG_ONCE ) !=0 ; - done = (bug->flags &BUGFLAG_DONE ) !=0 ; - -if (warning && once) { -if (done) -return BUG_TRAP_TYPE_WARN ; - -/* -* Since this is the only store, concurrency is not an issue. -*/ - bug->flags |=BUGFLAG_DONE ; - } + warning = (bug->flags &BUGFLAG_WARNING ) !=0 ; + once = (bug->flags &BUGFLAG_ONCE ) !=0 ; + done = (bug->flags &BUGFLAG_DONE ) !=0 ; + +if (warning && once) { +if (done) +return BUG_TRAP_TYPE_WARN ; + +/* +* Since this is the only store, concurrency is not an issue. +*/ + bug->flags |=BUGFLAG_DONE ; }if (warning) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 202/323 nfc: pn533: prevent potential memory corruption
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ]
If the "type_a->nfcid_len" is too large then it would lead to memory corruption in pn533_target_found_type_a() when we do:
memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);
--- drivers/nfc/pn533/pn533.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/nfc/pn533/pn533.c +3 -0
@@ -692,6 +692,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,if (PN533_TYPE_A_SEL_CASCADE (type_a->sel_res) !=0 )return false; +if (type_a->nfcid_len >NFC_NFCID1_MAXSIZE ) +return false; +return true; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 203/323 ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ]
There are a few calls of usb_driver_claim_interface() but all of those miss the proper error checks, as reported by Coverity. This patch adds those missing checks.
Along with it, replace the magic pointer with -1 with a constant USB_AUDIO_IFACE_UNUSED for better readability.
Addresses-Coverity-ID: 1475943 ("Error handling issues")
Addresses-Coverity-ID: 1475944 ("Error handling issues")
Addresses-Coverity-ID: 1475945 ("Error handling issues")
--- sound/usb/card.c | 14 +++++++------- sound/usb/quirks.c | 16 ++++++++++++---- sound/usb/usbaudio.h | 2 ++ 3 files changed, 21 insertions(+), 11 deletions(-)
sound/usb/card.c +7 -7
@@ -183,9 +183,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int ctrlif, interface);return -EINVAL ; } -usb_driver_claim_interface (&usb_audio_driver, iface, (void *)-1L ); - -return 0 ; +return usb_driver_claim_interface (&usb_audio_driver, iface, +USB_AUDIO_IFACE_UNUSED ); } if ((altsd->bInterfaceClass != USB_CLASS_AUDIO &&
@@ -205,7 +204,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int intif (!snd_usb_parse_audio_interface (chip, interface)) {usb_set_interface (dev, interface,0 );/* reset the current interface */ -usb_driver_claim_interface (&usb_audio_driver, iface, (void *)-1L ); +return usb_driver_claim_interface (&usb_audio_driver, iface, +USB_AUDIO_IFACE_UNUSED ); }return 0 ;
@@ -665,7 +665,7 @@ static void usb_audio_disconnect(struct usb_interface *intf)struct snd_card *card;struct list_head *p; -if (chip == (void *)-1L ) +if (chip ==USB_AUDIO_IFACE_UNUSED )return ; card = chip->card;
@@ -765,7 +765,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)struct usb_mixer_interface *mixer;struct list_head *p; -if (chip == (void *)-1L ) +if (chip ==USB_AUDIO_IFACE_UNUSED )return 0 ;if (!chip->num_suspended_intf++) {
@@ -795,7 +795,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)struct list_head *p;int err =0 ; -if (chip == (void *)-1L ) +if (chip ==USB_AUDIO_IFACE_UNUSED )return 0 ;atomic_inc (&chip->active);/* avoid autopm */
sound/usb/quirks.c +12 -4
@@ -66,8 +66,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip,if (!iface)continue ;if (quirk->ifnum != probed_ifnum && - !usb_interface_claimed (iface)) -usb_driver_claim_interface (driver, iface, (void *)-1L ); + !usb_interface_claimed (iface)) { + err =usb_driver_claim_interface (driver, iface, +USB_AUDIO_IFACE_UNUSED ); +if (err <0 ) +return err; + } }return 0 ;
@@ -398,8 +402,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip,continue ; err =create_autodetect_quirk (chip, iface, driver); -if (err >=0 ) -usb_driver_claim_interface (driver, iface, (void *)-1L ); +if (err >=0 ) { + err =usb_driver_claim_interface (driver, iface, +USB_AUDIO_IFACE_UNUSED ); +if (err <0 ) +return err; + } }return 0 ;
sound/usb/usbaudio.h +2 -0
@@ -63,6 +63,8 @@ struct snd_usb_audio {struct usb_host_interface *ctrl_intf;/* the audio control interface */ }; +#define USB_AUDIO_IFACE_UNUSED ((void *)-1L) + #define usb_audio_err(chip, fmt, args...) \ dev_err(&(chip)->dev->dev, fmt, ##args) #define usb_audio_warn(chip, fmt, args...) \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 204/323 liquidio: Fix unintented sign extension of a left shift of a u16
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 298b58f00c0f86868ea717426beb5c1198772f81 ]
The macro CN23XX_PEM_BAR1_INDEX_REG is being used to shift oct->pcie_port (a u16) left 24 places. There are two subtle issues here, first the shift gets promoted to an signed int and then sign extended to a u64. If oct->pcie_port is 0x80 or more then the upper bits get sign extended to 1. Secondly shfiting a u16 24 bits will lead to an overflow so it needs to be cast to a u64 for all the bits to not overflow.
It is entirely possible that the u16 port value is never large enough for this to fail, but it is useful to fix unintended overflows such as this.
Fix this by casting the port parameter to the macro to a u64 before the shift.
Addresses-Coverity: ("Unintended sign extension")
--- drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +1 -1
@@ -521,7 +521,7 @@#define CN23XX_BAR1_INDEX_OFFSET 3#define CN23XX_PEM_BAR1_INDEX_REG (port, idx) \ - (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \ + (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \ ((idx) << CN23XX_BAR1_INDEX_OFFSET))/*############################ DPI #########################*/
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 205/323 powerpc/perf: Fix PMU constraint check for EBB events
In reply to Greg Kroah-HartmanFrom: Athira Rajeev <[email protected]>
[ Upstream commit 10f8f96179ecc7f69c927f6d231f6d02736cea83 ]
The power PMU group constraints includes check for EBB events to make sure all events in a group must agree on EBB. This will prevent scheduling EBB and non-EBB events together. But in the existing check, settings for constraint mask and value is interchanged. Patch fixes the same.
Before the patch, PMU selftest "cpu_event_pinned_vs_ebb_test" fails with below in dmesg logs. This happens because EBB event gets enabled along with a non-EBB cpu event.
[35600.453346] cpu_event_pinne[41326]: illegal instruction (4) at 10004a18 nip 10004a18 lr 100049f8 code 1 in cpu_event_pinned_vs_ebb_test[10000000+10000]
Test results after the patch:
$ ./pmu/ebb/cpu_event_pinned_vs_ebb_test test: cpu_event_pinned_vs_ebb tags: git_version:v5.12-rc5-93-gf28c3125acd3-dirty Binding to cpu 8 EBB Handler is at 0x100050c8 read error on event 0x7fffe6bd4040! PM_RUN_INST_CMPL: result 9872 running/enabled 37930432 success: cpu_event_pinned_vs_ebb
This bug was hidden by other logic until commit 1908dc911792 (perf:
Tweak perf_event_attr::exclusive semantics).
--- arch/powerpc/perf/isa207-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/perf/isa207-common.c +2 -2
@@ -361,8 +361,8 @@ ebb_bhrb:* EBB events are pinned & exclusive, so this should never actually * hit, but we leave it as a fallback in case. */ - mask |=CNST_EBB_VAL (ebb); - value |=CNST_EBB_MASK ; + mask |=CNST_EBB_MASK ; + value |=CNST_EBB_VAL (ebb); *maskp = mask; *valp = value;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 206/323 powerpc: iommu: fix build when neither PCI or IBMVIO is set
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ]
When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a build error. The fault injection code is not useful in that kernel config, so make the FAIL_IOMMU option depend on PCI || IBMVIO.
Prevents this build error (warning escalated to error):../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable]
178 | static struct notifier_block fail_iommu_bus_notifier = {
--- arch/powerpc/Kconfig.debug | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/Kconfig.debug +1 -0
@@ -349,6 +349,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR config FAIL_IOMMU bool "Fault-injection capability for IOMMU" depends on FAULT_INJECTION + depends on PCI || IBMVIO help Provide fault-injection capability for IOMMU. Each device can be selectively enabled via the fail_iommu property.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 207/323 mac80211: bail out if cipher schemes are invalid
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ]
If any of the cipher schemes specified by the driver are invalid, bail out and fail the registration rather than just warning. Otherwise, we might later crash when we try to use the invalid cipher scheme, e.g. if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd have an out-of-bounds access in RX validation.
--- net/mac80211/main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/mac80211/main.c +5 -2
@@ -1043,8 +1043,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)if (local->hw.wiphy->max_scan_ie_len) local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len; -WARN_ON (!ieee80211_cs_list_valid (local->hw.cipher_schemes, - local->hw.n_cipher_schemes)); +if (WARN_ON (!ieee80211_cs_list_valid (local->hw.cipher_schemes, + local->hw.n_cipher_schemes))) { + result = -EINVAL ; + goto fail_workqueue; + } result =ieee80211_init_cipher_suites (local);if (result <0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 208/323 mt7601u: fix always true expression
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ]
Currently the expression ~nic_conf1 is always true because nic_conf1 is a u16 and according to 6.5.3.3 of the C standard the ~ operator promotes the u16 to an integer before flipping all the bits. Thus the top 16 bits of the integer result are all set so the expression is always true. If the intention was to flip all the bits of nic_conf1 then casting the integer result back to a u16 is a suitabel fix.
Interestingly static analyzers seem to thing a bitwise ! should be used instead of ~ for this scenario, so I think the original intent of the expression may need some extra consideration.
Addresses-Coverity: ("Logical vs. bitwise operator")
--- drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt7601u/eeprom.c +1 -1
@@ -106,7 +106,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom) {u16 nic_conf1 =get_unaligned_le16 (eeprom +MT_EE_NIC_CONF_1 ); -return ~nic_conf1 && (nic_conf1 &MT_EE_NIC_CONF_1_TX_ALC_EN ); +return (u16 )~nic_conf1 && (nic_conf1 &MT_EE_NIC_CONF_1_TX_ALC_EN ); } static void
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 209/323 IB/hfi1: Fix error return code in parse_platform_config()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 4c7d9c69adadfc31892c7e8e134deb3546552106 ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/hw/hfi1/firmware.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hfi1/firmware.c +1 -0
@@ -1885,6 +1885,7 @@ int parse_platform_config(struct hfi1_devdata *dd)dd_dev_err (dd,"%s: Failed CRC check at offset %ld\n" , __func__, (ptr - (u32 *)dd->platform_config.data)); + ret = -EINVAL ; goto bail; }/* Jump the CRC DWORD */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 210/323 net: thunderx: Fix unintentional sign extension issue
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ]
The shifting of the u8 integers rq->caching by 26 bits to the left will be promoted to a 32 bit signed int and then sign-extended to a u64. In the event that rq->caching is greater than 0x1f then all then all the upper 32 bits of the u64 end up as also being set because of the int sign-extension. Fix this by casting the u8 values to a u64 before the 26 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
--- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/thunder/nicvf_queues.c +1 -1
@@ -775,7 +775,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, mbx.rq.msg =NIC_MBOX_MSG_RQ_CFG ; mbx.rq.qs_num = qs->vnic_id; mbx.rq.rq_num = qidx; - mbx.rq.cfg = (rq->caching <<26 ) | (rq->cq_qs <<19 ) | + mbx.rq.cfg = ((u64 )rq->caching <<26 ) | (rq->cq_qs <<19 ) | (rq->cq_idx <<16 ) | (rq->cont_rbdr_qs <<9 ) | (rq->cont_qs_rbdr_idx <<8 ) | (rq->start_rbdr_qs <<1 ) | (rq->start_qs_rbdr_idx);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 211/323 i2c: cadence: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-cadence.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-cadence.c +4 -1
@@ -906,7 +906,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)if (IS_ERR (id->membase))return PTR_ERR (id->membase); - id->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; + id->irq = ret; id->adap.owner =THIS_MODULE ; id->adap.dev.of_node = pdev->dev.of_node;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 212/323 i2c: emev2: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit bb6129c32867baa7988f7fd2066cf18ed662d240 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-emev2.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-emev2.c +4 -1
@@ -400,7 +400,10 @@ static int em_i2c_probe(struct platform_device *pdev)em_i2c_reset (&priv->adap); - priv->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto err_clk; + priv->irq = ret; ret =devm_request_irq (&pdev->dev, priv->irq, em_i2c_irq_handler,0 ,"em_i2c" , priv);if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 213/323 i2c: jz4780: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-jz4780.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-jz4780.c +4 -1
@@ -760,7 +760,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev)jz4780_i2c_writew (i2c,JZ4780_I2C_INTM ,0x0 ); - i2c->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto err; + i2c->irq = ret; ret =devm_request_irq (&pdev->dev, i2c->irq, jz4780_i2c_irq,0 ,dev_name (&pdev->dev), i2c);if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 214/323 i2c: sh7760: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-sh7760.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-sh7760.c +4 -1
@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) goto out2; } - id->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; + id->irq = ret; id->adap.nr = pdev->id; id->adap.algo = &sh7760_i2c_algo;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 215/323 MIPS: pci-legacy: stop using of_pci_range_to_resource
In reply to Greg Kroah-HartmanFrom: Ilya Lipnitskiy <[email protected]>
[ Upstream commit 3ecb9dc1581eebecaee56decac70e35365260866 ]
Mirror commit aeba3731b150 ("powerpc/pci: Fix IO space breakage after of_pci_range_to_resource() change").
Most MIPS platforms do not define PCI_IOBASE, nor implement pci_address_to_pio(). Moreover, IO_SPACE_LIMIT is 0xffff for most MIPS platforms. of_pci_range_to_resource passes the _start address_ of the IO range into pci_address_to_pio, which then checks it against IO_SPACE_LIMIT and fails, because for MIPS platforms that use pci-legacy (pci-lantiq, pci-rt3883, pci-mt7620), IO ranges start much higher than 0xffff.
In fact, pci-mt7621 in staging already works around this problem, see commit 09dd629eeabb ("staging: mt7621-pci: fix io space and properly set resource limits")
So just stop using of_pci_range_to_resource, which does not work for MIPS.
Fixes PCI errors like:
pci_bus 0000:00: root bus resource [io 0xffffffff]
--- arch/mips/pci/pci-legacy.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/mips/pci/pci-legacy.c +7 -2
@@ -169,8 +169,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node) res = hose->mem_resource;break ; } -if (res !=NULL ) -of_pci_range_to_resource (&range, node, res); +if (res !=NULL ) { + res->name = node->full_name; + res->flags = range.flags; + res->start = range.cpu_addr; + res->end = range.cpu_addr + range.size -1 ; + res->parent = res->child = res->sibling =NULL ; + } } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 216/323 powerpc/pseries: extract host bridge from pci_bus prior to bus removal
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ]
The pci_bus->bridge reference may no longer be valid after pci_bus_remove() resulting in passing a bad value to device_unregister() for the associated bridge device.
Store the host_bridge reference in a separate variable prior to pci_bus_remove().
--- arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/pci_dlpar.c +3 -1
@@ -66,6 +66,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic);int remove_phb_dynamic (struct pci_controller *phb) {struct pci_bus *b = phb->bus; +struct pci_host_bridge *host_bridge =to_pci_host_bridge (b->bridge);struct resource *res;int rc, i;
@@ -92,7 +93,8 @@ int remove_phb_dynamic(struct pci_controller *phb)/* Remove the PCI bus and unregister the bridge device from sysfs */ phb->bus =NULL ;pci_remove_bus (b); -device_unregister (b->bridge); + host_bridge->bus =NULL ; +device_unregister (&host_bridge->dev);/* Now release the IO resource */ if (res->flags &IORESOURCE_IO )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 217/323 rtlwifi: 8821ae: upgrade PHY and RF parameters
In reply to Greg Kroah-HartmanFrom: Ping-Ke Shih <[email protected]>
[ Upstream commit 18fb0bedb5fc2fddc057dbe48b7360a6ffda34b3 ]
The signal strength of 5G is quite low, so user can't connect to an AP far away. New parameters with new format and its parser are updated by the commit 84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser."), but some parameters are missing. Use this commit to update to the novel parameters that use new format.
--- .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++----- 1 file changed, 370 insertions(+), 130 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +370 -130
@@ -273,7 +273,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {0x824 ,0x00030FE0 ,0x828 ,0x00000000 ,0x82C ,0x002081DD , -0x830 ,0x2AAA8E24 , +0x830 ,0x2AAAEEC8 ,0x834 ,0x0037A706 ,0x838 ,0x06489B44 , 0x83C, 0x0000095B,
@@ -348,10 +348,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {0x9D8 ,0x00000000 ,0x9DC ,0x00000000 ,0x9E0 ,0x00005D00 , -0x9E4 ,0x00000002 , +0x9E4 ,0x00000003 ,0x9E8 ,0x00000001 ,0xA00 ,0x00D047C8 , -0xA04 ,0x01FF000C , +0xA04 ,0x01FF800C ,0xA08 ,0x8C8A8300 ,0xA0C ,0x2E68000F , 0xA10, 0x9500BB78,
@@ -1347,7 +1347,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x083 ,0x00021800 ,0x084 ,0x00028000 ,0x085 ,0x00048000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x086 ,0x0009483A , +0xA0000000 ,0x00000000 ,0x086 ,0x00094838 , +0xB0000000 ,0x00000000 ,0x087 ,0x00044980 ,0x088 ,0x00048000 , 0x089, 0x0000D480,
@@ -1436,36 +1440,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x03C ,0x000CA000 ,0x0EF ,0x00000000 ,0x0EF ,0x00001100 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF3 ,0x034 ,0x00049DF0 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF3 ,0x034 ,0x00049DF0 , -0xFF0F0404 ,0xCDEF , -0x034 ,0x0004ADF3 , -0x034 ,0x00049DF0 , -0xFF0F0200 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF5 ,0x034 ,0x00049DF2 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004A0F3 , +0x034 ,0x000490B1 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004A0F3 ,0x034 ,0x000490B1 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004ADF5 , +0x034 ,0x00049DF2 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004ADF3 , +0x034 ,0x00049DF0 , +0xA0000000 ,0x00000000 ,0x034 ,0x0004ADF7 ,0x034 ,0x00049DF3 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00048DED , -0x034 ,0x00047DEA , -0x034 ,0x00046DE7 , -0x034 ,0x00045CE9 , -0x034 ,0x00044CE6 , -0x034 ,0x000438C6 , -0x034 ,0x00042886 , -0x034 ,0x00041486 , -0x034 ,0x00040447 , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00048DED ,0x034 ,0x00047DEA , 0x034, 0x00046DE7,
@@ -1475,7 +1475,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042886 ,0x034 ,0x00041486 ,0x034 ,0x00040447 , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00048DED ,0x034 ,0x00047DEA , 0x034, 0x00046DE7,
@@ -1485,7 +1485,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042886 ,0x034 ,0x00041486 ,0x034 ,0x00040447 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000480AE , +0x034 ,0x000470AB , +0x034 ,0x0004608B , +0x034 ,0x00045069 , +0x034 ,0x00044048 , +0x034 ,0x00043045 , +0x034 ,0x00042026 , +0x034 ,0x00041023 , +0x034 ,0x00040002 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000480AE ,0x034 ,0x000470AB , 0x034, 0x0004608B,
@@ -1495,7 +1505,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042026 ,0x034 ,0x00041023 ,0x034 ,0x00040002 , -0xCDCDCDCD ,0xCDCD , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00048DED , +0x034 ,0x00047DEA , +0x034 ,0x00046DE7 , +0x034 ,0x00045CE9 , +0x034 ,0x00044CE6 , +0x034 ,0x000438C6 , +0x034 ,0x00042886 , +0x034 ,0x00041486 , +0x034 ,0x00040447 , +0xA0000000 ,0x00000000 ,0x034 ,0x00048DEF ,0x034 ,0x00047DEC , 0x034, 0x00046DE9,
@@ -1505,38 +1525,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x0004248A ,0x034 ,0x0004108D ,0x034 ,0x0004008A , -0xFF0F0104 ,0xDEAD , -0xFF0F0200 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0002ADF4 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0002A0F3 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0002A0F3 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0002ADF4 , +0xA0000000 ,0x00000000 ,0x034 ,0x0002ADF7 , -0xFF0F0200 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00029DF4 , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF4 , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF4 , -0xFF0F0200 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF1 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000290F0 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000290F0 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00029DF1 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00029DF4 , +0xA0000000 ,0x00000000 ,0x034 ,0x00029DF2 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00028DF1 , -0x034 ,0x00027DEE , -0x034 ,0x00026DEB , -0x034 ,0x00025CEC , -0x034 ,0x00024CE9 , -0x034 ,0x000238CA , -0x034 ,0x00022889 , -0x034 ,0x00021489 , -0x034 ,0x0002044A , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00028DF1 ,0x034 ,0x00027DEE , 0x034, 0x00026DEB,
@@ -1546,7 +1564,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022889 ,0x034 ,0x00021489 ,0x034 ,0x0002044A , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00028DF1 ,0x034 ,0x00027DEE , 0x034, 0x00026DEB,
@@ -1556,7 +1574,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022889 ,0x034 ,0x00021489 ,0x034 ,0x0002044A , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000280AF ,0x034 ,0x000270AC , 0x034, 0x0002608B,
@@ -1566,7 +1584,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022026 ,0x034 ,0x00021023 ,0x034 ,0x00020002 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000280AF , +0x034 ,0x000270AC , +0x034 ,0x0002608B , +0x034 ,0x00025069 , +0x034 ,0x00024048 , +0x034 ,0x00023045 , +0x034 ,0x00022026 , +0x034 ,0x00021023 , +0x034 ,0x00020002 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00028DF1 , +0x034 ,0x00027DEE , +0x034 ,0x00026DEB , +0x034 ,0x00025CEC , +0x034 ,0x00024CE9 , +0x034 ,0x000238CA , +0x034 ,0x00022889 , +0x034 ,0x00021489 , +0x034 ,0x0002044A , +0xA0000000 ,0x00000000 ,0x034 ,0x00028DEE ,0x034 ,0x00027DEB , 0x034, 0x00026CCD,
@@ -1576,27 +1614,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022849 ,0x034 ,0x00021449 ,0x034 ,0x0002004D , -0xFF0F0104 ,0xDEAD , -0xFF0F02C0 ,0xABCD , +0xB0000000 ,0x00000000 , +0x8000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0000A0D7 , +0x034 ,0x000090D3 , +0x034 ,0x000080B1 , +0x034 ,0x000070AE , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0000A0D7 ,0x034 ,0x000090D3 ,0x034 ,0x000080B1 ,0x034 ,0x000070AE , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x034 ,0x0000ADF7 ,0x034 ,0x00009DF4 ,0x034 ,0x00008DF1 ,0x034 ,0x00007DEE , -0xFF0F02C0 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00006DEB , -0x034 ,0x00005CEC , -0x034 ,0x00004CE9 , -0x034 ,0x000038CA , -0x034 ,0x00002889 , -0x034 ,0x00001489 , -0x034 ,0x0000044A , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00006DEB ,0x034 ,0x00005CEC , 0x034, 0x00004CE9,
@@ -1604,7 +1639,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002889 ,0x034 ,0x00001489 ,0x034 ,0x0000044A , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00006DEB ,0x034 ,0x00005CEC , 0x034, 0x00004CE9,
@@ -1612,7 +1647,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002889 ,0x034 ,0x00001489 ,0x034 ,0x0000044A , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0000608D ,0x034 ,0x0000506B , 0x034, 0x0000404A,
@@ -1620,7 +1655,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002044 ,0x034 ,0x00001025 ,0x034 ,0x00000004 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0000608D , +0x034 ,0x0000506B , +0x034 ,0x0000404A , +0x034 ,0x00003047 , +0x034 ,0x00002044 , +0x034 ,0x00001025 , +0x034 ,0x00000004 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00006DEB , +0x034 ,0x00005CEC , +0x034 ,0x00004CE9 , +0x034 ,0x000038CA , +0x034 ,0x00002889 , +0x034 ,0x00001489 , +0x034 ,0x0000044A , +0xA0000000 ,0x00000000 ,0x034 ,0x00006DCD ,0x034 ,0x00005CCD , 0x034, 0x00004CCA,
@@ -1628,11 +1679,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002888 ,0x034 ,0x00001488 ,0x034 ,0x00000486 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000040 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1642,7 +1693,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1652,7 +1703,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000128 , +0x035 ,0x00008128 , +0x035 ,0x00010128 , +0x035 ,0x000201C8 , +0x035 ,0x000281C8 , +0x035 ,0x000301C8 , +0x035 ,0x000401C8 , +0x035 ,0x000481C8 , +0x035 ,0x000501C8 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000145 , +0x035 ,0x00008145 , +0x035 ,0x00010145 , +0x035 ,0x00020196 , +0x035 ,0x00028196 , +0x035 ,0x00030196 , +0x035 ,0x000401C7 , +0x035 ,0x000481C7 , +0x035 ,0x000501C7 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000128 , +0x035 ,0x00008128 , +0x035 ,0x00010128 , +0x035 ,0x000201C8 , +0x035 ,0x000281C8 , +0x035 ,0x000301C8 , +0x035 ,0x000401C8 , +0x035 ,0x000481C8 , +0x035 ,0x000501C8 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1662,7 +1743,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x035 ,0x00000145 ,0x035 ,0x00008145 , 0x035, 0x00010145,
@@ -1672,11 +1753,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x000401C7 ,0x035 ,0x000481C7 ,0x035 ,0x000501C7 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000010 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1689,7 +1770,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1702,7 +1783,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000063B5 , +0x036 ,0x0000E3B5 , +0x036 ,0x000163B5 , +0x036 ,0x0001E3B5 , +0x036 ,0x000263B5 , +0x036 ,0x0002E3B5 , +0x036 ,0x000363B5 , +0x036 ,0x0003E3B5 , +0x036 ,0x000463B5 , +0x036 ,0x0004E3B5 , +0x036 ,0x000563B5 , +0x036 ,0x0005E3B5 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000056B3 , +0x036 ,0x0000D6B3 , +0x036 ,0x000156B3 , +0x036 ,0x0001D6B3 , +0x036 ,0x00026634 , +0x036 ,0x0002E634 , +0x036 ,0x00036634 , +0x036 ,0x0003E634 , +0x036 ,0x000467B4 , +0x036 ,0x0004E7B4 , +0x036 ,0x000567B4 , +0x036 ,0x0005E7B4 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000063B5 , +0x036 ,0x0000E3B5 , +0x036 ,0x000163B5 , +0x036 ,0x0001E3B5 , +0x036 ,0x000263B5 , +0x036 ,0x0002E3B5 , +0x036 ,0x000363B5 , +0x036 ,0x0003E3B5 , +0x036 ,0x000463B5 , +0x036 ,0x0004E3B5 , +0x036 ,0x000563B5 , +0x036 ,0x0005E3B5 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1715,7 +1835,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x036 ,0x000056B3 ,0x036 ,0x0000D6B3 , 0x036, 0x000156B3,
@@ -1728,103 +1848,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x0004E7B4 ,0x036 ,0x000567B4 ,0x036 ,0x0005E7B4 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x0EF ,0x00000008 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x000001B6 , +0x03C ,0x00000492 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x0000022A , +0x03C ,0x00000594 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x000001B6 , +0x03C ,0x00000492 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x03C ,0x0000022A ,0x03C ,0x00000594 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000820 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000820 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000800 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000800 , +0xA0000000 ,0x00000000 ,0x03C ,0x00000900 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000002 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x008 ,0x00002000 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x0DF ,0x000000C0 , -0x01F ,0x00040064 , -0xFF0F0104 ,0xABCD , +0x01F ,0x00000064 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xFF0F0404 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x058 ,0x00081184 ,0x059 ,0x0006016C , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EFD83 , +0x062 ,0x00093FCC , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EAD53 , +0x062 ,0x00093BC4 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EFD83 , +0x062 ,0x00093FCC , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x061 ,0x000EAD53 ,0x062 ,0x00093BC4 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110EB , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0200 ,0xCDEF , -0x063 ,0x000710E9 , -0xFF0F02C0 ,0xCDEF , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110EB , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110E9 , +0xA0000000 ,0x00000000 ,0x063 ,0x000714E9 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C27C , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C27C , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xFF0F0204 ,0xCDEF , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C67C , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xFF0F0404 ,0xCDEF , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x064 ,0x0001C67C , -0xFF0F0104 ,0xDEAD , -0xFF0F0200 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00091016 , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00091016 , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x065 ,0x00093016 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x065 ,0x00093015 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00093015 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00093016 , +0xA0000000 ,0x00000000 ,0x065 ,0x00091016 , -0xFF0F0200 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x018 ,0x00000006 ,0x0EF ,0x00002000 , 0x03B, 0x0003824B,
@@ -1922,9 +2101,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x0B4 ,0x0001214C ,0x0B7 ,0x0003000C ,0x01C ,0x000539D2 , +0x0C4 ,0x000AFE00 ,0x018 ,0x0001F12A , -0x0FE ,0x00000000 , -0x0FE ,0x00000000 , +0xFFE ,0x00000000 , +0xFFE ,0x00000000 , 0x018, 0x0001712A, };
@@ -2044,6 +2224,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = {u32 RTL8812AE_MAC_1T_ARRAYLEN =sizeof (RTL8812AE_MAC_REG_ARRAY ) /sizeof (u32);u32 RTL8821AE_MAC_REG_ARRAY [] = { +0x421 ,0x0000000F ,0x428 ,0x0000000A ,0x429 ,0x00000010 ,0x430 ,0x00000000 ,
@@ -2513,7 +2694,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0xA6360001 ,0x81C ,0xA5380001 ,0x81C ,0xA43A0001 , -0x81C ,0xA33C0001 , +0x81C ,0x683C0001 ,0x81C ,0x673E0001 ,0x81C ,0x66400001 , 0x81C, 0x65420001,
@@ -2547,7 +2728,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x017A0001 ,0x81C ,0x017C0001 ,0x81C ,0x017E0001 , -0xFF0F02C0 ,0xABCD , +0x8000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x81C ,0xFB000101 , +0x81C ,0xFA020101 , +0x81C ,0xF9040101 , +0x81C ,0xF8060101 , +0x81C ,0xF7080101 , +0x81C ,0xF60A0101 , +0x81C ,0xF50C0101 , +0x81C ,0xF40E0101 , +0x81C ,0xF3100101 , +0x81C ,0xF2120101 , +0x81C ,0xF1140101 , +0x81C ,0xF0160101 , +0x81C ,0xEF180101 , +0x81C ,0xEE1A0101 , +0x81C ,0xED1C0101 , +0x81C ,0xEC1E0101 , +0x81C ,0xEB200101 , +0x81C ,0xEA220101 , +0x81C ,0xE9240101 , +0x81C ,0xE8260101 , +0x81C ,0xE7280101 , +0x81C ,0xE62A0101 , +0x81C ,0xE52C0101 , +0x81C ,0xE42E0101 , +0x81C ,0xE3300101 , +0x81C ,0xA5320101 , +0x81C ,0xA4340101 , +0x81C ,0xA3360101 , +0x81C ,0x87380101 , +0x81C ,0x863A0101 , +0x81C ,0x853C0101 , +0x81C ,0x843E0101 , +0x81C ,0x69400101 , +0x81C ,0x68420101 , +0x81C ,0x67440101 , +0x81C ,0x66460101 , +0x81C ,0x49480101 , +0x81C ,0x484A0101 , +0x81C ,0x474C0101 , +0x81C ,0x2A4E0101 , +0x81C ,0x29500101 , +0x81C ,0x28520101 , +0x81C ,0x27540101 , +0x81C ,0x26560101 , +0x81C ,0x25580101 , +0x81C ,0x245A0101 , +0x81C ,0x235C0101 , +0x81C ,0x055E0101 , +0x81C ,0x04600101 , +0x81C ,0x03620101 , +0x81C ,0x02640101 , +0x81C ,0x01660101 , +0x81C ,0x01680101 , +0x81C ,0x016A0101 , +0x81C ,0x016C0101 , +0x81C ,0x016E0101 , +0x81C ,0x01700101 , +0x81C ,0x01720101 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x81C ,0xFB000101 ,0x81C ,0xFA020101 , 0x81C, 0xF9040101,
@@ -2606,7 +2846,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x016E0101 ,0x81C ,0x01700101 ,0x81C ,0x01720101 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x81C ,0xFF000101 ,0x81C ,0xFF020101 , 0x81C, 0xFE040101,
@@ -2665,7 +2905,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x046E0101 ,0x81C ,0x03700101 ,0x81C ,0x02720101 , -0xFF0F02C0 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x81C ,0x01740101 ,0x81C ,0x01760101 , 0x81C, 0x01780101,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 218/323 i2c: sh7760: fix IRQ error path
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ]
While adding the invalid IRQ check after calling platform_get_irq(), I managed to overlook that the driver has a complex error path in its probe() method, thus a simple *return* couldn't be used. Use a proper *goto* instead!
--- drivers/i2c/busses/i2c-sh7760.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-sh7760.c +1 -1
@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) ret =platform_get_irq (pdev,0 );if (ret <0 ) -return ret; + goto out3; id->irq = ret; id->adap.nr = pdev->id;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 219/323 mwl8k: Fix a double Free in mwl8k_probe_hw
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ]
In mwl8k_probe_hw, hw->priv->txq is freed at the first time by dma_free_coherent() in the call chain:
if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i).
Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent().
My patch set txq->txd to NULL after the first free to avoid the double free.
--- drivers/net/wireless/marvell/mwl8k.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/mwl8k.c +1 -0
@@ -1464,6 +1464,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index) txq->skb =kcalloc (MWL8K_TX_DESCS ,sizeof (*txq->skb),GFP_KERNEL );if (txq->skb ==NULL ) {pci_free_consistent (priv->pdev, size, txq->txd, txq->txd_dma); + txq->txd =NULL ;return -ENOMEM ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 220/323 vsock/vmci: log once the failed queue pair allocation
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ]
VMCI feature is not supported in conjunction with the vSphere Fault Tolerance (FT) feature.
VMware Tools can repeatedly try to create a vsock connection. If FT is enabled the kernel logs is flooded with the following messages:
qp_alloc_hypercall result = -20
Could not attach to queue pair with -20
"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307 ("VMCI: Stop log spew when qp allocation isn't possible"), but "Could not attach to queue pair with -20" is still there flooding the log.
Since the error message can be useful in some cases, print it only once.
--- net/vmw_vsock/vmci_transport.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/vmw_vsock/vmci_transport.c +1 -2
@@ -585,8 +585,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, peer, flags, VMCI_NO_PRIVILEGE_FLAGS); out:if (err <0 ) { -pr_err ("Could not attach to queue pair with %d\n" , - err); +pr_err_once ("Could not attach to queue pair with %d\n" , err); err =vmci_transport_error_to_vsock_error (err); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 221/323 RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
In reply to Greg Kroah-HartmanFrom: Sindhu Devale <[email protected]>
[ Upstream commit 783a11bf2400e5d5c42a943c3083dc0330751842 ]
When i40iw_hmc_sd_one fails, chunk is freed without the deletion of chunk entry in the PBLE info list.
Fix it by adding the chunk entry to the PBLE info list only after successful addition of SD in i40iw_hmc_sd_one.
This fixes a static checker warning reported here:
https://lore.kernel.org/linux-rdma/YHV4CFXzqTm23AOZ@mwanda/
--- drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/infiniband/hw/i40iw/i40iw_pble.c +2 -4
@@ -392,12 +392,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,i40iw_debug (dev,I40IW_DEBUG_PBLE ,"next_fpm_addr = %llx chunk_size[%u] = 0x%x\n" , pble_rsrc->next_fpm_addr, chunk->size, chunk->size); pble_rsrc->unallocated_pble -= (chunk->size >>3 ); -list_add (&chunk->list, &pble_rsrc->pinfo.clist); sd_reg_val = (sd_entry_type ==I40IW_SD_TYPE_PAGED ) ? sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa; -if (sd_entry->valid) -return 0 ; -if (dev->is_pf) { +if (dev->is_pf && !sd_entry->valid) { ret_code =i40iw_hmc_sd_one (dev, hmc_info->hmc_fn_id, sd_reg_val, idx->sd_idx, sd_entry->entry_type, true);
@@ -408,6 +405,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, } sd_entry->valid = true; +list_add (&chunk->list, &pble_rsrc->pinfo.clist);return 0 ; error:kfree (chunk);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 222/323 net: davinci_emac: Fix incorrect masking of tx and rx error channel
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ]
The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels) are incorrect and always lead to a zero result. The mask values are currently the incorrect post-right shifted values, fix this by setting them to the currect values.
(I double checked these against the TMS320TCI6482 data sheet, section 5.30, page 127 to ensure I had the correct mask values for the TXERRCH and RXERRCH fields in the MACSTATUS register).
Addresses-Coverity: ("Operands don't affect result")
--- drivers/net/ethernet/ti/davinci_emac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/davinci_emac.c +2 -2
@@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1";/* EMAC mac_status register */ #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000)#define EMAC_MACSTATUS_TXERRCODE_SHIFT (20) -#define EMAC_MACSTATUS_TXERRCH_MASK (0x7) +#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000)#define EMAC_MACSTATUS_TXERRCH_SHIFT (16)#define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000)#define EMAC_MACSTATUS_RXERRCODE_SHIFT (12) -#define EMAC_MACSTATUS_RXERRCH_MASK (0x7) +#define EMAC_MACSTATUS_RXERRCH_MASK (0x700)#define EMAC_MACSTATUS_RXERRCH_SHIFT (8)/* EMAC RX register masks */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 223/323 ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
In reply to Greg Kroah-HartmanFrom: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ]
When the error check in ath9k_hw_read_revisions() was added, it checked for -EIO which is what ath9k_regread() in the ath9k_htc driver uses. However, for plain ath9k, the register read function uses ioread32(), which just returns -1 on error. So if such a read fails, it still gets passed through and ends up as a weird mac revision in the log output.
Fix this by changing ath9k_regread() to return -1 on error like ioread32() does, and fix the error check to look for that instead of -EIO.
--- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- drivers/net/wireless/ath/ath9k/hw.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/htc_drv_init.c +1 -1
@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)if (unlikely (r)) {ath_dbg (common,WMI ,"REGISTER READ FAILED: (0x%04x, %d)\n" , reg_offset, r); -return -EIO ; +return -1 ; }return be32_to_cpu (val);
drivers/net/wireless/ath/ath9k/hw.c +1 -1
@@ -285,7 +285,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) srev =REG_READ (ah,AR_SREV ); -if (srev == -EIO ) { +if (srev ==-1 ) {ath_err (ath9k_hw_common (ah),"Failed to read SREV register" );return false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 224/323 powerpc/52xx: Fix an invalid ASM expression (addi used instead of add)
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ]
AS arch/powerpc/platforms/52xx/lite5200_sleep.oarch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages:arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression
In the following code, 'addi' is wrong, has to be 'add'
/* local udelay in sram is needed */ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ mullw r12, r12, r11 mftb r13 /* start */ addi r12, r13, r12 /* end */
--- arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/52xx/lite5200_sleep.S +1 -1
@@ -181,7 +181,7 @@ sram_code: udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ mullw r12, r12, r11 mftb r13 /* start */ - addi r12, r13, r12 /* end */ + add r12, r13, r12 /* end */ 1: mftb r13 /* current */ cmp cr0, r13, r12
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 225/323 net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ]
In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).
If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).
As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later.
--- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/emac/emac-mac.c +3 -1
@@ -1458,6 +1458,7 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q, {struct emac_tpd tpd;u32 prod_idx; +int len;memset (&tpd,0 ,sizeof (tpd));
@@ -1477,9 +1478,10 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q,if (skb_network_offset (skb) !=ETH_HLEN )TPD_TYP_SET (&tpd,1 ); + len = skb->len;emac_tx_fill_tpd (adpt, tx_q, skb, &tpd); -netdev_sent_queue (adpt->netdev, skb->len); +netdev_sent_queue (adpt->netdev, len);/* Make sure the are enough free descriptors to hold one * maximum-sized SKB. We need one desc for each fragment,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 226/323 net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ]
In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp). If nfc_tm_data_received() failed, the callee will free the resp via kfree_skb() and return error. But in the exit branch, the resp will be freed again.
My patch sets resp to NULL if nfc_tm_data_received() failed, to avoid the double free.
--- net/nfc/digital_dep.c | 2 ++ 1 file changed, 2 insertions(+)
net/nfc/digital_dep.c +2 -0
@@ -1285,6 +1285,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, } rc =nfc_tm_data_received (ddev->nfc_dev, resp); +if (rc) + resp =NULL ; exit:kfree_skb (ddev->chaining_skb);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 227/323 kfifo: fix ternary sign extension bugs
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ]
The intent with this code was to return negative error codes but instead it returns positives.
The problem is how type promotion works with ternary operations. These functions return long, "ret" is an int and "copied" is a u32. The negative error code is first cast to u32 so it becomes a high positive and then cast to long where it's still a positive.
We could fix this by declaring "ret" as a ssize_t but let's just get rid of the ternaries instead.
--- samples/kfifo/bytestream-example.c | 8 ++++++-- samples/kfifo/inttype-example.c | 8 ++++++-- samples/kfifo/record-example.c | 8 ++++++-- 3 files changed, 18 insertions(+), 6 deletions(-)
samples/kfifo/bytestream-example.c +6 -2
@@ -124,8 +124,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -140,8 +142,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct file_operations fifo_fops = {
samples/kfifo/inttype-example.c +6 -2
@@ -117,8 +117,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -133,8 +135,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct file_operations fifo_fops = {
samples/kfifo/record-example.c +6 -2
@@ -131,8 +131,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -147,8 +149,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct file_operations fifo_fops = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 228/323 smp: Fix smp_call_function_single_async prototype
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 1139aeb1c521eb4a050920ce6c64c36c4f2a3ab7 upstream.
As of commit 966a967116e6 ("smp: Avoid using two cache lines for struct call_single_data"), the smp code prefers 32-byte aligned call_single_data objects for performance reasons, but the block layer includes an instance of this structure in the main 'struct request' that is more senstive to size than to performance here, see 4ccafe032005 ("block: unalign call_single_data in struct request").
The result is a violation of the calling conventions that clang correctly points out:
block/blk-mq.c:630:39: warning: passing 8-byte aligned argument to 32-byte aligned parameter 2 of 'smp_call_function_single_async' may result in an unaligned pointer access [-Walign-mismatch]
smp_call_function_single_async(cpu, &rq->csd);
It does seem that the usage of the call_single_data without cache line alignment should still be allowed by the smp code, so just change the function prototype so it accepts both, but leave the default alignment unchanged for the other users. This seems better to me than adding a local hack to shut up an otherwise correct warning in the caller.
--- include/linux/smp.h | 2 +- kernel/smp.c | 10 +++++----- kernel/up.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-)
include/linux/smp.h +1 -1
@@ -53,7 +53,7 @@ void on_each_cpu_cond(bool (*cond_func)( smp_call_func_t func, void *info, bool wait, gfp_t gfp_flags); -int smp_call_function_single_async (int cpu,call_single_data_t *csd); +int smp_call_function_single_async (int cpu,struct __call_single_data *csd);#ifdef CONFIG_SMP
kernel/smp.c +5 -5
@@ -103,12 +103,12 @@ void __init call_function_init(void)* previous function call. For multi-cpu calls its even more interesting * as we'll have to ensure no other cpu is observing our csd. */ -static __always_inline void csd_lock_wait(call_single_data_t *csd) +static __always_inline void csd_lock_wait(struct __call_single_data *csd) {smp_cond_load_acquire (&csd->flags, !(VAL &CSD_FLAG_LOCK )); } -static __always_inline void csd_lock(call_single_data_t *csd) +static __always_inline void csd_lock(struct __call_single_data *csd) {csd_lock_wait (csd); csd->flags |=CSD_FLAG_LOCK ;
@@ -121,7 +121,7 @@ static __always_inline void csd_lock(calsmp_wmb (); } -static __always_inline void csd_unlock(call_single_data_t *csd) +static __always_inline void csd_unlock(struct __call_single_data *csd) {WARN_ON (!(csd->flags &CSD_FLAG_LOCK ));
@@ -138,7 +138,7 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(cal* for execution on the given CPU. data must already have * ->func, ->info, and ->flags set. */ -static int generic_exec_single (int cpu,call_single_data_t *csd, +static int generic_exec_single (int cpu,struct __call_single_data *csd,smp_call_func_t func,void *info) {if (cpu ==smp_processor_id ()) {
@@ -323,7 +323,7 @@ EXPORT_SYMBOL(smp_call_function_single);* NOTE: Be careful, there is unfortunately no current debugging facility to * validate the correctness of this serialization. */ -int smp_call_function_single_async (int cpu,call_single_data_t *csd) +int smp_call_function_single_async (int cpu,struct __call_single_data *csd) {int err =0 ;
kernel/up.c +1 -1
@@ -23,7 +23,7 @@ int smp_call_function_single(int cpu, vo }EXPORT_SYMBOL (smp_call_function_single); -int smp_call_function_single_async (int cpu,call_single_data_t *csd) +int smp_call_function_single_async (int cpu,struct __call_single_data *csd) {unsigned long flags;
Greg Kroah-Hartman
maintainerPATCH 229/323 Revert "net/sctp: fix race condition in sctp_destroy_sock"
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 01bfe5e8e428b475982a98a46cca5755726f3f7f upstream.
This reverts commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b.
This one has to be reverted as it introduced a dead lock, as syzbot reported:
CPU0 CPU1
---- ----
lock(&net->sctp.addr_wq_lock);
lock(slock-AF_INET6);
lock(&net->sctp.addr_wq_lock); lock(slock-AF_INET6);
CPU0 is the thread of sctp_addr_wq_timeout_handler(), and CPU1 is that of sctp_close().
The original issue this commit fixed will be fixed in the next patch.
--- net/sctp/socket.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/sctp/socket.c +8 -5
@@ -1586,9 +1586,11 @@ static void sctp_close(struct sock *sk,/* Supposedly, no process has access to the socket, but * the net layers still may. +* Also, sctp_destroy_sock() needs to be called with addr_wq_lock +* held and that should be grabbed before socket lock. */ -local_bh_disable (); -bh_lock_sock (sk); +spin_lock_bh (&net->sctp.addr_wq_lock); +bh_lock_sock_nested (sk);/* Hold the sock, since sk_common_release() will put sock_put() * and we have just a little more cleanup.
@@ -1597,7 +1599,7 @@ static void sctp_close(struct sock *sk,sk_common_release (sk);bh_unlock_sock (sk); -local_bh_enable (); +spin_unlock_bh (&net->sctp.addr_wq_lock);sock_put (sk);
@@ -4447,6 +4449,9 @@ static int sctp_init_sock(struct sock *ssk_sockets_allocated_inc (sk);sock_prot_inuse_add (net, sk->sk_prot,1 ); +/* Nothing can fail after this block, otherwise +* sctp_destroy_sock() will be called without addr_wq_lock held +*/ if (net->sctp.default_auto_asconf) {spin_lock (&sock_net (sk)->sctp.addr_wq_lock); list_add_tail(&sp->auto_asconf_list,
@@ -4481,9 +4486,7 @@ static void sctp_destroy_sock(struct socif (sp->do_auto_asconf) { sp->do_auto_asconf =0 ; -spin_lock_bh (&sock_net (sk)->sctp.addr_wq_lock);list_del (&sp->auto_asconf_list); -spin_unlock_bh (&sock_net (sk)->sctp.addr_wq_lock); }sctp_endpoint_free (sp->ep);local_bh_disable ();
Greg Kroah-Hartman
maintainerPATCH 230/323 sctp: delay auto_asconf init until binding the first addr
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 34e5b01186858b36c4d7c87e1a025071e8e2401f upstream.
As Or Cohen described:
If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock held and sp->do_auto_asconf is true, then an element is removed from the auto_asconf_splist without any proper locking.
This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program attached to BPF_CGROUP_INET_SOCK_CREATE which denies creation of the sctp socket.
This patch is to fix it by moving the auto_asconf init out of sctp_init_sock(), by which inet_create()/inet6_create() won't need to operate it in sctp_destroy_sock() when calling sk_common_release().
It also makes more sense to do auto_asconf init while binding the first addr, as auto_asconf actually requires an ANY addr bind, see it in sctp_addr_wq_timeout_handler().
This addresses CVE-2021-23133.
--- net/sctp/socket.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-)
net/sctp/socket.c +17 -14
@@ -369,6 +369,18 @@ static struct sctp_af *sctp_sockaddr_af(return af; } +static void sctp_auto_asconf_init (struct sctp_sock *sp) +{ +struct net *net =sock_net (&sp->inet.sk); + +if (net->sctp.default_auto_asconf) { +spin_lock (&net->sctp.addr_wq_lock); +list_add_tail (&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); +spin_unlock (&net->sctp.addr_wq_lock); + sp->do_auto_asconf =1 ; + } +} +/* Bind a local address either to an endpoint or to an association. */ static int sctp_do_bind (struct sock *sk,union sctp_addr *addr,int len) {
@@ -431,8 +443,10 @@ static int sctp_do_bind(struct sock *sk, }/* Refresh ephemeral port. */ -if (!bp->port) +if (!bp->port) { bp->port =inet_sk (sk)->inet_num; +sctp_auto_asconf_init (sp); + }/* Add the address to the bind address list. * Use GFP_ATOMIC since BHs will be disabled.
@@ -4449,19 +4463,6 @@ static int sctp_init_sock(struct sock *ssk_sockets_allocated_inc (sk);sock_prot_inuse_add (net, sk->sk_prot,1 ); -/* Nothing can fail after this block, otherwise -* sctp_destroy_sock() will be called without addr_wq_lock held -*/ -if (net->sctp.default_auto_asconf) { -spin_lock (&sock_net (sk)->sctp.addr_wq_lock); -list_add_tail (&sp->auto_asconf_list, - &net->sctp.auto_asconf_splist); - sp->do_auto_asconf =1 ; -spin_unlock (&sock_net (sk)->sctp.addr_wq_lock); - }else { - sp->do_auto_asconf =0 ; - } -local_bh_enable ();return 0 ;
@@ -8219,6 +8220,8 @@ static void sctp_sock_migrate(struct socsctp_bind_addr_dup (&newsp->ep->base.bind_addr, &oldsp->ep->base.bind_addr,GFP_KERNEL ); +sctp_auto_asconf_init (newsp); +/* Move any messages in the old socket's receive queue that are for the * peeled off association to the new socket's receive queue. */
Greg Kroah-Hartman
maintainerPATCH 231/323 Revert "of/fdt: Make sure no-map does not remove already reserved regions"
In reply to Greg Kroah-HartmanFrom: Quentin Perret <[email protected]>
This reverts commit 6793433fc8f263eaba1621d3724b6aeba511c6c5. It is not really a fix, and the backport misses dependencies, which breaks existing platforms.
--- drivers/of/fdt.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
drivers/of/fdt.c +1 -9
@@ -1212,16 +1212,8 @@ int __init __weak early_init_dt_mark_hotint __init __weak early_init_dt_reserve_memory_arch (phys_addr_t base,phys_addr_t size,bool nomap) { -if (nomap) { -/* -* If the memory is already reserved (by another region), we -* should not allow it to be marked nomap. -*/ -if (memblock_is_region_reserved (base, size)) -return -EBUSY ; - +if (nomap)return memblock_mark_nomap (base, size); - }return memblock_reserve (base, size); }
Greg Kroah-Hartman
maintainerPATCH 232/323 Revert "fdt: Properly handle "no-map" field in the memory region"
In reply to Greg Kroah-HartmanFrom: Quentin Perret <[email protected]>
This reverts commit 71bc5d496725f7f923904d2f41cd39e32c647fdf. It is not really a fix, and the backport misses dependencies, which breaks existing platforms.
--- drivers/of/fdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/fdt.c +1 -1
@@ -1213,7 +1213,7 @@ int __init __weak early_init_dt_reserve_ phys_addr_t size, bool nomap) { if (nomap) - return memblock_mark_nomap(base, size); + return memblock_remove(base, size);return memblock_reserve (base, size); }
Greg Kroah-Hartman
maintainerPATCH 233/323 tpm: fix error return code in tpm2_get_cc_attrs_tbl()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
commit 1df83992d977355177810c2b711afc30546c81ce upstream.
If the total number of commands queried through TPM2_CAP_COMMANDS is different from that queried through TPM2_CC_GET_CAPABILITY, it indicates an unknown error. In this case, an appropriate error code -EFAULT should be returned. However, we currently do not explicitly assign this error code to 'rc'. As a result, 0 was incorrectly returned.
--- drivers/char/tpm/tpm2-cmd.c | 1 + 1 file changed, 1 insertion(+)
drivers/char/tpm/tpm2-cmd.c +1 -0
@@ -1051,6 +1051,7 @@ static int tpm2_get_cc_attrs_tbl(structif (nr_commands !=be32_to_cpup ((__be32 *)&buf.data[TPM_HEADER_SIZE +5 ])) { + rc = -EFAULT ;tpm_buf_destroy (&buf); goto out; }
Greg Kroah-Hartman
maintainerPATCH 234/323 fs: dlm: fix debugfs dump
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 92c48950b43f4a767388cf87709d8687151a641f ]
This patch fixes the following message which randomly pops up during glocktop call:
seq_file: buggy .next function table_seq_next did not update position index
The issue is that seq_read_iter() in fs/seq_file.c also needs an increment of the index in an non next record case as well which this patch fixes otherwise seq_read_iter() will print out the above message.
--- fs/dlm/debug_fs.c | 1 + 1 file changed, 1 insertion(+)
fs/dlm/debug_fs.c +1 -0
@@ -544,6 +544,7 @@ static void *table_seq_next(struct seq_file *seq, void *iter_ptr, loff_t *pos)if (bucket >= ls->ls_rsbtbl_size) {kfree (ri); + ++*pos;return NULL ; } tree = toss ? &ls->ls_rsbtbl[bucket].toss : &ls->ls_rsbtbl[bucket].keep;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 235/323 tipc: convert dest nodes address to network order
In reply to Greg Kroah-HartmanFrom: Hoang Le <[email protected]>
[ Upstream commit 1980d37565061ab44bdc2f9e4da477d3b9752e81 ]
(struct tipc_link_info)->dest is in network order (__be32), so we must convert the value to network order before assigning. The problem detected by sparse:
net/tipc/netlink_compat.c:699:24: warning: incorrect type in assignment (different base types)net/tipc/netlink_compat.c:699:24: expected restricted __be32 [usertype] destnet/tipc/netlink_compat.c:699:24: got int
--- net/tipc/netlink_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/netlink_compat.c +1 -1
@@ -662,7 +662,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,if (err)return err; - link_info.dest =nla_get_flag (link[TIPC_NLA_LINK_DEST ]); + link_info.dest =htonl (nla_get_flag (link[TIPC_NLA_LINK_DEST ])); link_info.up =htonl (nla_get_flag (link[TIPC_NLA_LINK_UP ]));nla_strlcpy (link_info.str, link[TIPC_NLA_LINK_NAME ],TIPC_MAX_LINK_NAME );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 236/323 net: stmmac: Set FIFO sizes for ipq806x
In reply to Greg Kroah-HartmanFrom: Jonathan McDowell <[email protected]>
[ Upstream commit e127906b68b49ddb3ecba39ffa36a329c48197d3 ]
Commit eaf4fac47807 ("net: stmmac: Do not accept invalid MTU values") started using the TX FIFO size to verify what counts as a valid MTU request for the stmmac driver. This is unset for the ipq806x variant. Looking at older patches for this it seems the RX + TXs buffers can be up to 8k, so set appropriately.
(I sent this as an RFC patch in June last year, but received no replies. I've been running with this on my hardware (a MikroTik RB3011) since then with larger MTUs to support both the internal qca8k switch and VLANs with no problems. Without the patch it's impossible to set the larger MTU required to support this.)
--- drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +2 -0
@@ -363,6 +363,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) plat_dat->bsp_priv = gmac; plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; plat_dat->multicast_filter_bins =0 ; + plat_dat->tx_fifo_size =8192 ; + plat_dat->rx_fifo_size =8192 ; err =stmmac_dvr_probe (&pdev->dev, plat_dat, &stmmac_res);if (err)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 237/323 ALSA: hdsp: dont disable if not enabled
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 507cdb9adba006a7798c358456426e1aea3d9c4f ]
hdsp wants to disable a not enabled pci device, which makes kernel throw a warning. Make sure the device is enabled before calling disable.
[ 1.758292] snd_hdsp 0000:00:03.0: disabling already-disabled device [ 1.758327] WARNING: CPU: 0 PID: 180 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 [ 1.766985] Call Trace: [ 1.767121] snd_hdsp_card_free+0x94/0xf0 [snd_hdsp] [ 1.767388] release_card_device+0x4b/0x80 [snd] [ 1.767639] device_release+0x3b/0xa0 [ 1.767838] kobject_put+0x94/0x1b0 [ 1.768027] put_device+0x13/0x20 [ 1.768207] snd_card_free+0x61/0x90 [snd] [ 1.768430] snd_hdsp_probe+0x524/0x5e0 [snd_hdsp]
--- sound/pci/rme9652/hdsp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/rme9652/hdsp.c +2 -1
@@ -5343,7 +5343,8 @@ static int snd_hdsp_free(struct hdsp *hdsp)if (hdsp->port)pci_release_regions (hdsp->pci); -pci_disable_device (hdsp->pci); +if (pci_is_enabled (hdsp->pci)) +pci_disable_device (hdsp->pci);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 238/323 ALSA: hdspm: dont disable if not enabled
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 790f5719b85e12e10c41753b864e74249585ed08 ]
hdspm wants to disable a not enabled pci device, which makes kernel throw a warning. Make sure the device is enabled before calling disable.
[ 1.786391] snd_hdspm 0000:00:03.0: disabling already-disabled device [ 1.786400] WARNING: CPU: 0 PID: 182 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 [ 1.795181] Call Trace: [ 1.795320] snd_hdspm_card_free+0x58/0xa0 [snd_hdspm] [ 1.795595] release_card_device+0x4b/0x80 [snd] [ 1.795860] device_release+0x3b/0xa0 [ 1.796072] kobject_put+0x94/0x1b0 [ 1.796260] put_device+0x13/0x20 [ 1.796438] snd_card_free+0x61/0x90 [snd] [ 1.796659] snd_hdspm_probe+0x97b/0x1440 [snd_hdspm]
--- sound/pci/rme9652/hdspm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/rme9652/hdspm.c +2 -1
@@ -6913,7 +6913,8 @@ static int snd_hdspm_free(struct hdspm * hdspm)if (hdspm->port)pci_release_regions (hdspm->pci); -pci_disable_device (hdspm->pci); +if (pci_is_enabled (hdspm->pci)) +pci_disable_device (hdspm->pci);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 239/323 ALSA: rme9652: dont disable if not enabled
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit f57a741874bb6995089020e97a1dcdf9b165dcbe ]
rme9652 wants to disable a not enabled pci device, which makes kernel throw a warning. Make sure the device is enabled before calling disable.
[ 1.751595] snd_rme9652 0000:00:03.0: disabling already-disabled device [ 1.751605] WARNING: CPU: 0 PID: 174 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 [ 1.759968] Call Trace: [ 1.760145] snd_rme9652_card_free+0x76/0xa0 [snd_rme9652] [ 1.760434] release_card_device+0x4b/0x80 [snd] [ 1.760679] device_release+0x3b/0xa0 [ 1.760874] kobject_put+0x94/0x1b0 [ 1.761059] put_device+0x13/0x20 [ 1.761235] snd_card_free+0x61/0x90 [snd] [ 1.761454] snd_rme9652_probe+0x3be/0x700 [snd_rme9652]
--- sound/pci/rme9652/rme9652.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/rme9652/rme9652.c +2 -1
@@ -1761,7 +1761,8 @@ static int snd_rme9652_free(struct snd_rme9652 *rme9652)if (rme9652->port)pci_release_regions (rme9652->pci); -pci_disable_device (rme9652->pci); +if (pci_is_enabled (rme9652->pci)) +pci_disable_device (rme9652->pci);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 240/323 Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
[ Upstream commit 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a ]
Currently l2cap_chan_set_defaults() reset chan->conf_state to zero. However, there is a flag CONF_NOT_COMPLETE which is set when creating the l2cap_chan. It is suggested that the flag should be cleared when l2cap_chan is ready, but when l2cap_chan_set_defaults() is called, l2cap_chan is not yet ready. Therefore, we must set this flag as the default.
Example crash call trace:
__dump_stack lib/dump_stack.c:15 [inline] dump_stack+0xc4/0x118 lib/dump_stack.c:56 panic+0x1c6/0x38b kernel/panic.c:117 __warn+0x170/0x1b9 kernel/panic.c:471 warn_slowpath_fmt+0xc7/0xf8 kernel/panic.c:494 debug_print_object+0x175/0x193 lib/debugobjects.c:260 debug_object_assert_init+0x171/0x1bf lib/debugobjects.c:614 debug_timer_assert_init kernel/time/timer.c:629 [inline] debug_assert_init kernel/time/timer.c:677 [inline] del_timer+0x7c/0x179 kernel/time/timer.c:1034 try_to_grab_pending+0x81/0x2e5 kernel/workqueue.c:1230 cancel_delayed_work+0x7c/0x1c4 kernel/workqueue.c:2929 l2cap_clear_timer+0x1e/0x41 include/net/bluetooth/l2cap.h:834 l2cap_chan_del+0x2d8/0x37e net/bluetooth/l2cap_core.c:640 l2cap_chan_close+0x532/0x5d8 net/bluetooth/l2cap_core.c:756 l2cap_sock_shutdown+0x806/0x969 net/bluetooth/l2cap_sock.c:1174 l2cap_sock_release+0x64/0x14d net/bluetooth/l2cap_sock.c:1217 __sock_release+0xda/0x217 net/socket.c:580 sock_close+0x1b/0x1f net/socket.c:1039 __fput+0x322/0x55c fs/file_table.c:208 ____fput+0x17/0x19 fs/file_table.c:244 task_work_run+0x19b/0x1d3 kernel/task_work.c:115 exit_task_work include/linux/task_work.h:21 [inline] do_exit+0xe4c/0x204a kernel/exit.c:766 do_group_exit+0x291/0x291 kernel/exit.c:891 get_signal+0x749/0x1093 kernel/signal.c:2396 do_signal+0xa5/0xcdb arch/x86/kernel/signal.c:737 exit_to_usermode_loop arch/x86/entry/common.c:243 [inline] prepare_exit_to_usermode+0xed/0x235 arch/x86/entry/common.c:277 syscall_return_slowpath+0x3a7/0x3b3 arch/x86/entry/common.c:348 int_ret_from_sys_call+0x25/0xa3
--- net/bluetooth/l2cap_core.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/l2cap_core.c +2 -0
@@ -510,7 +510,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan) chan->flush_to =L2CAP_DEFAULT_FLUSH_TO ; chan->retrans_timeout =L2CAP_DEFAULT_RETRANS_TO ; chan->monitor_timeout =L2CAP_DEFAULT_MONITOR_TO ; + chan->conf_state =0 ; +set_bit (CONF_NOT_COMPLETE , &chan->conf_state);set_bit (FLAG_FORCE_ACTIVE , &chan->flags); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 241/323 Bluetooth: initialize skb_queue_head at l2cap_chan_create()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit be8597239379f0f53c9710dd6ab551bbf535bec6 ]
syzbot is hitting "INFO: trying to register non-static key." message [1], for "struct l2cap_chan"->tx_q.lock spinlock is not yet initialized when l2cap_chan_del() is called due to e.g. timeout.
Since "struct l2cap_chan"->lock mutex is initialized at l2cap_chan_create() immediately after "struct l2cap_chan" is allocated using kzalloc(), let's as well initialize "struct l2cap_chan"->{tx_q,srej_q}.lock spinlocks there.
[1] https://syzkaller.appspot.com/bug?extid=fadfba6a911f6bf71842
--- net/bluetooth/l2cap_core.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/l2cap_core.c +2 -0
@@ -445,6 +445,8 @@ struct l2cap_chan *l2cap_chan_create(void)if (!chan)return NULL ; +skb_queue_head_init (&chan->tx_q); +skb_queue_head_init (&chan->srej_q);mutex_init (&chan->lock);/* Set default lock nesting level */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 242/323 Bluetooth: check for zapped sk before connecting
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
[ Upstream commit 3af70b39fa2d415dc86c370e5b24ddb9fdacbd6f ]
There is a possibility of receiving a zapped sock on l2cap_sock_connect(). This could lead to interesting crashes, one such case is tearing down an already tore l2cap_sock as is happened with this call trace:
__dump_stack lib/dump_stack.c:15 [inline] dump_stack+0xc4/0x118 lib/dump_stack.c:56 register_lock_class kernel/locking/lockdep.c:792 [inline] register_lock_class+0x239/0x6f6 kernel/locking/lockdep.c:742 __lock_acquire+0x209/0x1e27 kernel/locking/lockdep.c:3105 lock_acquire+0x29c/0x2fb kernel/locking/lockdep.c:3599 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline] _raw_spin_lock_bh+0x38/0x47 kernel/locking/spinlock.c:175 spin_lock_bh include/linux/spinlock.h:307 [inline] lock_sock_nested+0x44/0xfa net/core/sock.c:2518 l2cap_sock_teardown_cb+0x88/0x2fb net/bluetooth/l2cap_sock.c:1345 l2cap_chan_del+0xa3/0x383 net/bluetooth/l2cap_core.c:598 l2cap_chan_close+0x537/0x5dd net/bluetooth/l2cap_core.c:756 l2cap_chan_timeout+0x104/0x17e net/bluetooth/l2cap_core.c:429 process_one_work+0x7e3/0xcb0 kernel/workqueue.c:2064 worker_thread+0x5a5/0x773 kernel/workqueue.c:2196 kthread+0x291/0x2a6 kernel/kthread.c:211 ret_from_fork+0x4e/0x80 arch/x86/entry/entry_64.S:604
--- net/bluetooth/l2cap_sock.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/bluetooth/l2cap_sock.c +8 -0
@@ -179,9 +179,17 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,struct l2cap_chan *chan =l2cap_pi (sk)->chan;struct sockaddr_l2 la;int len, err =0 ; +bool zapped;BT_DBG ("sk %p" , sk); +lock_sock (sk); + zapped =sock_flag (sk,SOCK_ZAPPED ); +release_sock (sk); + +if (zapped) +return -EINVAL ; + if (!addr || alen < offsetofend(struct sockaddr, sa_family) || addr->sa_family !=AF_BLUETOOTH )return -EINVAL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 243/323 ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 40cb881b5aaa0b69a7d93dec8440d5c62dae299f ]
After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger a warning [1]
Issue here is that:
- all dev_put() should be paired with a corresponding prior dev_hold().
- A driver doing a dev_put() in its ndo_uninit() MUST also do a dev_hold() in its ndo_init(), only when ndo_init() is returning 0.
Otherwise, register_netdevice() would call ndo_uninit() in its error path and release a refcount too soon.
Therefore, we need to move dev_hold() call fromvti6_tnl_create2() to vti6_dev_init_gen()
[1]
WARNING: CPU: 0 PID: 15951 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31 Modules linked in: CPU: 0 PID: 15951 Comm: syz-executor.3 Not tainted 5.12.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31 Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58 RSP: 0018:ffffc90001eaef28 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815c51f5 RDI: fffff520003d5dd7 RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff88801bb1c568 R13: ffff88801f69e800 R14: 00000000ffffffff R15: ffff888050889d40 FS: 00007fc79314e700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1c1ff47108 CR3: 0000000020fd5000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_dec include/linux/refcount.h:344 [inline] refcount_dec include/linux/refcount.h:359 [inline] dev_put include/linux/netdevice.h:4135 [inline] vti6_dev_uninit+0x31a/0x360 net/ipv6/ip6_vti.c:297 register_netdevice+0xadf/0x1500 net/core/dev.c:10308 vti6_tnl_create2+0x1b5/0x400 net/ipv6/ip6_vti.c:190 vti6_newlink+0x9d/0xd0 net/ipv6/ip6_vti.c:1020 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3443 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3491 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x331/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmmsg+0x195/0x470 net/socket.c:2490 __do_sys_sendmmsg net/socket.c:2519 [inline] __se_sys_sendmmsg net/socket.c:2516 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2516
--- net/ipv6/ip6_vti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_vti.c +1 -1
@@ -196,7 +196,6 @@ static int vti6_tnl_create2(struct net_device *dev)strcpy (t->parms.name, dev->name); -dev_hold (dev);vti6_tnl_link (ip6n, t);return 0 ;
@@ -903,6 +902,7 @@ static inline int vti6_dev_init_gen(struct net_device *dev) dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);if (!dev->tstats)return -ENOMEM ; +dev_hold (dev);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 244/323 mac80211: clear the beacons CRC after channel switch
In reply to Greg Kroah-HartmanFrom: Emmanuel Grumbach <[email protected]>
[ Upstream commit d6843d1ee283137723b4a8c76244607ce6db1951 ]
After channel switch, we should consider any beacon with a CSA IE as a new switch. If the CSA IE is a leftover from before the switch that the AP forgot to remove, we'll get a CSA-to-Self.
This caused issues in iwlwifi where the firmware saw a beacon with a CSA-to-Self with mode = 1 on the new channel after a switch. The firmware considered this a new switch and closed its queues. Since the beacon didn't change between before and after the switch, we wouldn't handle it (the CRC is the same) and we wouldn't let the firmware open its queues again or disconnect if the CSA IE stays for too long.
Clear the CRC valid state after we switch to make sure that we handle the beacon and handle the CSA IE as required.
--- net/mac80211/mlme.c | 5 +++++ 1 file changed, 5 insertions(+)
net/mac80211/mlme.c +5 -0
@@ -1100,6 +1100,11 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata) sdata->vif.csa_active = false; ifmgd->csa_waiting_bcn = false; +/* +* If the CSA IE is still present on the beacon after the switch, +* we need to consider it as a new CSA (possibly to self). +*/ + ifmgd->beacon_crc_valid = false; ret =drv_post_channel_switch (sdata);if (ret) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 245/323 pinctrl: samsung: use int for register masks in Exynos
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fa0c10a5f3a49130dd11281aa27e7e1c8654abc7 ]
The Special Function Registers on all Exynos SoC, including ARM64, are 32-bit wide, so entire driver uses matching functions like readl() or writel(). On 64-bit ARM using unsigned long for register masks:
1. makes little sense as immediately after bitwise operation it will be cast to 32-bit value when calling writel(),
2. is actually error-prone because it might promote other operands to 64-bit.
Addresses-Coverity: Unintentional integer overflow
--- drivers/pinctrl/samsung/pinctrl-exynos.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/pinctrl/samsung/pinctrl-exynos.c +5 -5
@@ -55,7 +55,7 @@ static void exynos_irq_mask(struct irq_data *irqd)struct exynos_irq_chip *our_chip =to_exynos_irq_chip (chip);struct samsung_pin_bank *bank =irq_data_get_irq_chip_data (irqd);unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; -unsigned long mask; +unsigned int mask;unsigned long flags;spin_lock_irqsave (&bank->slock, flags);
@@ -83,7 +83,7 @@ static void exynos_irq_unmask(struct irq_data *irqd)struct exynos_irq_chip *our_chip =to_exynos_irq_chip (chip);struct samsung_pin_bank *bank =irq_data_get_irq_chip_data (irqd);unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; -unsigned long mask; +unsigned int mask;unsigned long flags;/*
@@ -409,7 +409,7 @@ static void exynos_irq_eint0_15(struct irq_desc *desc)chained_irq_exit (chip, desc); } -static inline void exynos_irq_demux_eint (unsigned long pend, +static inline void exynos_irq_demux_eint (unsigned int pend,struct irq_domain *domain) {unsigned int irq;
@@ -426,8 +426,8 @@ static void exynos_irq_demux_eint16_31(struct irq_desc *desc) {struct irq_chip *chip =irq_desc_get_chip (desc);struct exynos_muxed_weint_data *eintd =irq_desc_get_handler_data (desc); -unsigned long pend; -unsigned long mask; +unsigned int pend; +unsigned int mask;int i;chained_irq_enter (chip, desc);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 246/323 cuse: prevent clone
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
[ Upstream commit 8217673d07256b22881127bf50dce874d0e51653 ]
For cloned connections cuse_channel_release() will be called more than once, resulting in use after free.
Prevent device cloning for CUSE, which does not make sense at this point, and highly unlikely to be used in real life.
--- fs/fuse/cuse.c | 2 ++ 1 file changed, 2 insertions(+)
fs/fuse/cuse.c +2 -0
@@ -616,6 +616,8 @@ static int __init cuse_init(void) cuse_channel_fops.owner =THIS_MODULE ; cuse_channel_fops.open = cuse_channel_open; cuse_channel_fops.release = cuse_channel_release; +/* CUSE is not prepared for FUSE_DEV_IOC_CLONE */ + cuse_channel_fops.unlocked_ioctl =NULL ; cuse_class =class_create (THIS_MODULE ,"cuse" );if (IS_ERR (cuse_class))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 247/323 selftests: Set CC to clang in lib.mk if LLVM is set
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 26e6dd1072763cd5696b75994c03982dde952ad9 ]
selftests/bpf/Makefile includes lib.mk. With the following command
make -j60 LLVM=1 LLVM_IAS=1 <=== compile kernel
make -j60 -C tools/testing/selftests/bpf LLVM=1 LLVM_IAS=1 V=1
some files are still compiled with gcc. This patch fixed lib.mk issue which sets CC to gcc in all cases.
--- tools/testing/selftests/lib.mk | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/lib.mk +4 -0
@@ -1,6 +1,10 @@ # This mimics the top-level Makefile. We do it explicitly here so that this # Makefile can operate with or without the kbuild infrastructure. +ifneq ($(LLVM),) +CC := clang +else CC := $(CROSS_COMPILE)gcc +endif ifeq (0,$(MAKELEVEL)) OUTPUT := $(shell pwd)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 248/323 kconfig: nconf: stop endless search loops
In reply to Greg Kroah-HartmanFrom: Mihai Moldovan <[email protected]>
[ Upstream commit 8c94b430b9f6213dec84e309bb480a71778c4213 ]
If the user selects the very first entry in a page and performs a search-up operation, or selects the very last entry in a page and performs a search-down operation that will not succeed (e.g., via [/]asdfzzz[Up Arrow]), nconf will never terminate searching the page.
The reason is that in this case, the starting point will be set to -1 or n, which is then translated into (n - 1) (i.e., the last entry of the page) or 0 (i.e., the first entry of the page) and finally the search begins. This continues to work fine until the index reaches 0 or (n - 1), at which point it will be decremented to -1 or incremented to n, but not checked against the starting point right away. Instead, it's wrapped around to the bottom or top again, after which the starting point check occurs... and naturally fails.
My original implementation added another check for -1 before wrapping the running index variable around, but Masahiro Yamada pointed out that the actual issue is that the comparison point (starting point) exceeds bounds (i.e., the [0,n-1] interval) in the first place and that, instead, the starting point should be fixed.
This has the welcome side-effect of also fixing the case where the starting point was n while searching down, which also lead to an infinite loop.
OTOH, this code is now essentially all his work.
Amazingly, nobody seems to have been hit by this for 11 years - or at the very least nobody bothered to debug and fix this.
--- scripts/kconfig/nconf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/kconfig/nconf.c +1 -1
@@ -504,8 +504,8 @@ static int get_mext_match(const char *match_str, match_f flag)else if (flag ==FIND_NEXT_MATCH_UP ) --match_start; + match_start = (match_start + items_num) % items_num; index = match_start; - index = (index + items_num) % items_num;while (true) {char *str = k_menu_items[index].str;if (strcasestr (str, match_str) !=NULL )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 249/323 sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit e5272ad4aab347dde5610c0aedb786219e3ff793 ]
Fix the following out-of-bounds warning:
net/sctp/sm_make_chunk.c:3150:4: warning: 'memcpy' offset [17, 28] from the object at 'addr' is out of the bounds of referenced subobject 'v4' with type 'struct sockaddr_in' at offset 0 [-Warray-bounds]
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- net/sctp/sm_make_chunk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sm_make_chunk.c +1 -1
@@ -3128,7 +3128,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,* primary. */ if (af->is_any (&addr)) -memcpy (&addr.v4,sctp_source (asconf),sizeof (addr)); +memcpy (&addr,sctp_source (asconf),sizeof (addr)); peer =sctp_assoc_lookup_paddr (asoc, &addr);if (!peer)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 250/323 powerpc/smp: Set numa node before updating mask
In reply to Greg Kroah-HartmanFrom: Srikar Dronamraju <[email protected]>
[ Upstream commit 6980d13f0dd189846887bbbfa43793d9a41768d3 ]
Geethika reported a trace when doing a dlpar CPU add.
------------[ cut here ]------------ WARNING: CPU: 152 PID: 1134 at kernel/sched/topology.c:2057 CPU: 152 PID: 1134 Comm: kworker/152:1 Not tainted 5.12.0-rc5-master #5 Workqueue: events cpuset_hotplug_workfn NIP: c0000000001cfc14 LR: c0000000001cfc10 CTR: c0000000007e3420 REGS: c0000034a08eb260 TRAP: 0700 Not tainted (5.12.0-rc5-master+) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28828422 XER: 00000020
CFAR: c0000000001fd888 IRQMASK: 0 #012GPR00: c0000000001cfc10 c0000034a08eb500 c000000001f35400 0000000000000027 #012GPR04:c0000035abaa8010 c0000035abb30a00 0000000000000027 c0000035abaa8018 #012GPR08: 0000000000000023 c0000035abaaef48 00000035aa540000 c0000035a49dffe8 #012GPR12: 0000000028828424 c0000035bf1a1c80 0000000000000497 0000000000000004 #012GPR16: c00000000347a258 0000000000000140 c00000000203d468 c000000001a1a490 #012GPR20:c000000001f9c160 c0000034adf70920 c0000034aec9fd20 0000000100087bd3 #012GPR24: 0000000100087bd3 c0000035b3de09f8 0000000000000030 c0000035b3de09f8 #012GPR28: 0000000000000028 c00000000347a280 c0000034aefe0b00 c0000000010a2a68
NIP [c0000000001cfc14] build_sched_domains+0x6a4/0x1500 LR [c0000000001cfc10] build_sched_domains+0x6a0/0x1500
Call Trace: [c0000034a08eb500] [c0000000001cfc10] build_sched_domains+0x6a0/0x1500 (unreliable) [c0000034a08eb640] [c0000000001d1e6c] partition_sched_domains_locked+0x3ec/0x530 [c0000034a08eb6e0] [c0000000002936d4] rebuild_sched_domains_locked+0x524/0xbf0 [c0000034a08eb7e0] [c000000000296bb0] rebuild_sched_domains+0x40/0x70 [c0000034a08eb810] [c000000000296e74] cpuset_hotplug_workfn+0x294/0xe20 [c0000034a08ebc30] [c000000000178dd0] process_one_work+0x300/0x670 [c0000034a08ebd10] [c0000000001791b8] worker_thread+0x78/0x520 [c0000034a08ebda0] [c000000000185090] kthread+0x1a0/0x1b0 [c0000034a08ebe10] [c00000000000ccec] ret_from_kernel_thread+0x5c/0x70 Instruction dump: 7d2903a6 4e800421 e8410018 7f67db78 7fe6fb78 7f45d378 7f84e378 7c681b78 3c62ff1a 3863c6f8 4802dc35 60000000 <0fe00000> 3920fff4 f9210070 e86100a0 ---[ end trace 532d9066d3d4d7ec ]---
Some of the per-CPU masks use cpu_cpu_mask as a filter to limit the search for related CPUs. On a dlpar add of a CPU, update cpu_cpu_mask before updating the per-CPU masks. This will ensure the cpu_cpu_mask is updated correctly before its used in setting the masks. Setting the numa_node will ensure that when cpu_cpu_mask() gets called, the correct node number is used. This code movement helped fix the above call trace.
--- arch/powerpc/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/kernel/smp.c +3 -3
@@ -985,6 +985,9 @@ void start_secondary(void *unused)vdso_getcpu_init ();#endif +set_numa_node (numa_cpu_lookup_table[cpu]); +set_numa_mem (local_memory_node (numa_cpu_lookup_table[cpu])); +/* Update topology CPU masks */ add_cpu_to_masks (cpu);
@@ -995,9 +998,6 @@ void start_secondary(void *unused)if (!cpumask_equal (cpu_l2_cache_mask (cpu),cpu_sibling_mask (cpu))) shared_caches = true; -set_numa_node (numa_cpu_lookup_table[cpu]); -set_numa_mem (local_memory_node (numa_cpu_lookup_table[cpu])); -smp_wmb ();notify_cpu_starting (cpu);set_cpu_online (cpu, true);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 251/323 ASoC: rt286: Generalize support for ALC3263 codec
In reply to Greg Kroah-HartmanFrom: David Ward <[email protected]>
[ Upstream commit aa2f9c12821e6a4ba1df4fb34a3dbc6a2a1ee7fe ]
The ALC3263 codec on the XPS 13 9343 is also found on the Latitude 13 7350 and Venue 11 Pro 7140. They require the same handling for the combo jack to work with a headset: GPIO pin 6 must be set.
The HDA driver always sets this pin on the ALC3263, which it distinguishes by the codec vendor/device ID 0x10ec0288 and PCI subsystem vendor ID 0x1028 (Dell). The ASoC driver does not use PCI, so adapt this check to use DMI to determine if Dell is the system vendor.
--- sound/soc/codecs/rt286.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
sound/soc/codecs/rt286.c +10 -10
@@ -1119,12 +1119,11 @@ static const struct dmi_system_id force_combo_jack_table[] = { { } }; -static const struct dmi_system_id dmi_dell_dino[] = { +static const struct dmi_system_id dmi_dell[] = { { - .ident ="Dell Dino" , + .ident ="Dell" , .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"XPS 13 9343" ) } }, { }
@@ -1135,7 +1134,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, {struct rt286_platform_data *pdata =dev_get_platdata (&i2c->dev);struct rt286_priv *rt286; -int i, ret, val; +int i, ret, vendor_id; rt286 =devm_kzalloc (&i2c->dev,sizeof (*rt286),GFP_KERNEL );
@@ -1151,14 +1150,15 @@ static int rt286_i2c_probe(struct i2c_client *i2c, } ret =regmap_read (rt286->regmap, -RT286_GET_PARAM (AC_NODE_ROOT ,AC_PAR_VENDOR_ID ), &val); +RT286_GET_PARAM (AC_NODE_ROOT ,AC_PAR_VENDOR_ID ), &vendor_id);if (ret !=0 ) {dev_err (&i2c->dev,"I2C error %d\n" , ret);return ret; } -if (val !=RT286_VENDOR_ID && val !=RT288_VENDOR_ID ) { +if (vendor_id !=RT286_VENDOR_ID && vendor_id !=RT288_VENDOR_ID ) {dev_err (&i2c->dev, -"Device with ID register %#x is not rt286\n" , val); +"Device with ID register %#x is not rt286\n" , + vendor_id);return -ENODEV ; }
@@ -1182,8 +1182,8 @@ static int rt286_i2c_probe(struct i2c_client *i2c,if (pdata) rt286->pdata = *pdata; -if (dmi_check_system (force_combo_jack_table) || -dmi_check_system (dmi_dell_dino)) +if ((vendor_id ==RT288_VENDOR_ID &&dmi_check_system (dmi_dell)) || +dmi_check_system (force_combo_jack_table)) rt286->pdata.cbj_en = true;regmap_write (rt286->regmap,RT286_SET_AUDIO_POWER ,AC_PWRST_D3 );
@@ -1222,7 +1222,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c,regmap_update_bits (rt286->regmap,RT286_DEPOP_CTRL3 ,0xf777 ,0x4737 );regmap_update_bits (rt286->regmap,RT286_DEPOP_CTRL4 ,0x00ff ,0x003f ); -if (dmi_check_system (dmi_dell_dino)) { +if (vendor_id ==RT288_VENDOR_ID &&dmi_check_system (dmi_dell)) {regmap_update_bits (rt286->regmap,RT286_SET_GPIO_MASK ,0x40 ,0x40 ); regmap_update_bits(rt286->regmap,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 252/323 samples/bpf: Fix broken tracex1 due to kprobe argument change
In reply to Greg Kroah-HartmanFrom: Yaqi Chen <[email protected]>
[ Upstream commit 137733d08f4ab14a354dacaa9a8fc35217747605 ]
Quoted 1 line
From commit
c0bbbdc32feb("__netif_receive_skb_core: pass skb by
reference"), the first argument passed into __netif_receive_skb_core has changed to reference of a skb pointer.
This commit fixes by using bpf_probe_read_kernel.
--- samples/bpf/tracex1_kern.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
samples/bpf/tracex1_kern.c +2 -2
@@ -20,7 +20,7 @@ SEC("kprobe/__netif_receive_skb_core")int bpf_prog1 (struct pt_regs *ctx) { -/* attaches to kprobe netif_receive_skb, +/* attaches to kprobe __netif_receive_skb_core, * looks for packets on loobpack device and prints them */ char devname[IFNAMSIZ ];
@@ -29,7 +29,7 @@ int bpf_prog1(struct pt_regs *ctx)int len;/* non-portable! works for the given kernel only */ - skb = (struct sk_buff *)PT_REGS_PARM1 (ctx); +bpf_probe_read_kernel (&skb,sizeof (skb), (void *)PT_REGS_PARM1 (ctx)); dev =_ (skb->dev); len =_ (skb->len);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 253/323 powerpc/pseries: Stop calling printk in rtas_stop_self()
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit ed8029d7b472369a010a1901358567ca3b6dbb0d ]
RCU complains about us calling printk() from an offline CPU:
=============================
WARNING: suspicious RCU usage
5.12.0-rc7-02874-g7cf90e481cb8 #1 Not tainted
-----------------------------
kernel/locking/lockdep.c:3568 RCU-list traversed in non-reader section!!
other info that might help us debug this:
RCU used illegally from offline CPU!
rcu_scheduler_active = 2, debug_locks = 1
no locks held by swapper/0/0.
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7-02874-g7cf90e481cb8 #1
Call Trace:
dump_stack+0xec/0x144 (unreliable)
lockdep_rcu_suspicious+0x124/0x144
__lock_acquire+0x1098/0x28b0
lock_acquire+0x128/0x600
_raw_spin_lock_irqsave+0x6c/0xc0
down_trylock+0x2c/0x70
__down_trylock_console_sem+0x60/0x140
vprintk_emit+0x1a8/0x4b0
vprintk_func+0xcc/0x200
printk+0x40/0x54
pseries_cpu_offline_self+0xc0/0x120
arch_cpu_idle_dead+0x54/0x70
do_idle+0x174/0x4a0
cpu_startup_entry+0x38/0x40
rest_init+0x268/0x388
start_kernel+0x748/0x790
start_here_common+0x1c/0x614Which happens because by the time we get to rtas_stop_self() we are already offline. In addition the message can be spammy, and is not that helpful for users, so remove it.
--- arch/powerpc/platforms/pseries/hotplug-cpu.c | 3 --- 1 file changed, 3 deletions(-)
arch/powerpc/platforms/pseries/hotplug-cpu.c +0 -3
@@ -95,9 +95,6 @@ static void rtas_stop_self(void)BUG_ON (rtas_stop_self_token ==RTAS_UNKNOWN_SERVICE ); -printk ("cpu %u (hwid %u) Ready to die...\n" , -smp_processor_id (),hard_smp_processor_id ()); -rtas_call_unlocked (&args, rtas_stop_self_token,0 ,1 ,NULL );panic ("Alas, I survived.\n" );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 254/323 wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 820aa37638a252b57967bdf4038a514b1ab85d45 ]
Fix the following out-of-bounds warnings by enclosing structure members daddr and saddr into new struct addr, in structures wl3501_md_req and wl3501_md_ind:
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds]
Refactor the code, accordingly:
$ pahole -C wl3501_md_req drivers/net/wireless/wl3501_cs.o
struct wl3501_md_req {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 routing; /* 3 1 */
u16 data; /* 4 2 */
u16 size; /* 6 2 */
u8 pri; /* 8 1 */
u8 service_class; /* 9 1 */
struct {
u8 daddr[6]; /* 10 6 */
u8 saddr[6]; /* 16 6 */
} addr; /* 10 12 *//* size: 22, cachelines: 1, members: 8 */ /* last cacheline: 22 bytes */ };
$ pahole -C wl3501_md_ind drivers/net/wireless/wl3501_cs.o
struct wl3501_md_ind {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 routing; /* 3 1 */
u16 data; /* 4 2 */
u16 size; /* 6 2 */
u8 reception; /* 8 1 */
u8 pri; /* 9 1 */
u8 service_class; /* 10 1 */
struct {
u8 daddr[6]; /* 11 6 */
u8 saddr[6]; /* 17 6 */
} addr; /* 11 12 *//* size: 24, cachelines: 1, members: 9 */ /* padding: 1 */ /* last cacheline: 24 bytes */ };
The problem is that the original code is trying to copy data into a couple of arrays adjacent to each other in a single call to memcpy(). Now that a new struct _addr_ enclosing those two adjacent arrays is introduced, memcpy() doesn't overrun the length of &sig.daddr[0] and &sig.daddr, because the address of the new struct object _addr_ is used, instead.
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- drivers/net/wireless/wl3501.h | 12 ++++++++---- drivers/net/wireless/wl3501_cs.c | 10 ++++++---- 2 files changed, 14 insertions(+), 8 deletions(-)
drivers/net/wireless/wl3501.h +8 -4
@@ -471,8 +471,10 @@ struct wl3501_md_req {u16 size;u8 pri;u8 service_class; -u8 daddr[ETH_ALEN ]; -u8 saddr[ETH_ALEN ]; +struct { +u8 daddr[ETH_ALEN ]; +u8 saddr[ETH_ALEN ]; + } addr; };struct wl3501_md_ind {
@@ -484,8 +486,10 @@ struct wl3501_md_ind {u8 reception;u8 pri;u8 service_class; -u8 daddr[ETH_ALEN ]; -u8 saddr[ETH_ALEN ]; +struct { +u8 daddr[ETH_ALEN ]; +u8 saddr[ETH_ALEN ]; + } addr; };struct wl3501_md_confirm {
drivers/net/wireless/wl3501_cs.c +6 -4
@@ -468,6 +468,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)struct wl3501_md_req sig = { .sig_id =WL3501_SIG_MD_REQ , }; +size_t sig_addr_len =sizeof (sig.addr);u8 *pdata = (char *)data;int rc = -EIO ;
@@ -483,9 +484,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) goto out; } rc =0 ; -memcpy (&sig.daddr[0 ], pdata,12 ); - pktlen = len -12 ; - pdata +=12 ; +memcpy (&sig.addr, pdata, sig_addr_len); + pktlen = len - sig_addr_len; + pdata += sig_addr_len; sig.data = bf;if (((*pdata) *256 + (*(pdata +1 ))) >1500 ) {u8 addr4[ETH_ALEN ] = {
@@ -979,7 +980,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev, }else { skb->dev = dev;skb_reserve (skb,2 );/* IP headers on 16 bytes boundaries */ -skb_copy_to_linear_data (skb, (unsigned char *)&sig.daddr,12 ); +skb_copy_to_linear_data (skb, (unsigned char *)&sig.addr, +sizeof (sig.addr));wl3501_receive (this, skb->data, pkt_len);skb_put (skb, pkt_len); skb->protocol =eth_type_trans (skb, dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 255/323 wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit bb43e5718d8f1b46e7a77e7b39be3c691f293050 ]
Fix the following out-of-bounds warnings by adding a new structure wl3501_req instead of duplicating the same members in structure wl3501_join_req and wl3501_scan_confirm:
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [39, 108] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 36 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [25, 95] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 22 [-Warray-bounds]
Refactor the code, accordingly:
$ pahole -C wl3501_req drivers/net/wireless/wl3501_cs.o
struct wl3501_req {
u16 beacon_period; /* 0 2 */
u16 dtim_period; /* 2 2 */
u16 cap_info; /* 4 2 */
u8 bss_type; /* 6 1 */
u8 bssid[6]; /* 7 6 */
struct iw_mgmt_essid_pset ssid; /* 13 34 */
struct iw_mgmt_ds_pset ds_pset; /* 47 3 */
struct iw_mgmt_cf_pset cf_pset; /* 50 8 */
struct iw_mgmt_ibss_pset ibss_pset; /* 58 4 */
struct iw_mgmt_data_rset bss_basic_rset; /* 62 10 */ /* size: 72, cachelines: 2, members: 10 */
/* last cacheline: 8 bytes */
};$ pahole -C wl3501_join_req drivers/net/wireless/wl3501_cs.o
struct wl3501_join_req {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 reserved; /* 3 1 */
struct iw_mgmt_data_rset operational_rset; /* 4 10 */
u16 reserved2; /* 14 2 */
u16 timeout; /* 16 2 */
u16 probe_delay; /* 18 2 */
u8 timestamp[8]; /* 20 8 */
u8 local_time[8]; /* 28 8 */
struct wl3501_req req; /* 36 72 */ /* size: 108, cachelines: 2, members: 10 */
/* last cacheline: 44 bytes */
};$ pahole -C wl3501_scan_confirm drivers/net/wireless/wl3501_cs.o
struct wl3501_scan_confirm {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 reserved; /* 3 1 */
u16 status; /* 4 2 */
char timestamp[8]; /* 6 8 */
char localtime[8]; /* 14 8 */
struct wl3501_req req; /* 22 72 */
/* --- cacheline 1 boundary (64 bytes) was 30 bytes ago --- */
u8 rssi; /* 94 1 */ /* size: 96, cachelines: 2, members: 8 */
/* padding: 1 */
/* last cacheline: 32 bytes */
};The problem is that the original code is trying to copy data into a bunch of struct members adjacent to each other in a single call to memcpy(). Now that a new struct wl3501_req enclosing all those adjacent members is introduced, memcpy() doesn't overrun the length of &sig.beacon_period and &this->bss_set[i].beacon_period, because the address of the new struct object _req_ is used as the destination, instead.
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- drivers/net/wireless/wl3501.h | 35 +++++++++++-------------- drivers/net/wireless/wl3501_cs.c | 44 +++++++++++++++++--------------- 2 files changed, 38 insertions(+), 41 deletions(-)
drivers/net/wireless/wl3501.h +15 -20
@@ -379,16 +379,7 @@ struct wl3501_get_confirm {u8 mib_value[100 ]; }; -struct wl3501_join_req { -u16 next_blk; -u8 sig_id; -u8 reserved; -struct iw_mgmt_data_rset operational_rset; -u16 reserved2; -u16 timeout; -u16 probe_delay; -u8 timestamp[8 ]; -u8 local_time[8 ]; +struct wl3501_req {u16 beacon_period;u16 dtim_period;u16 cap_info;
@@ -401,6 +392,19 @@ struct wl3501_join_req {struct iw_mgmt_data_rset bss_basic_rset; }; +struct wl3501_join_req { +u16 next_blk; +u8 sig_id; +u8 reserved; +struct iw_mgmt_data_rset operational_rset; +u16 reserved2; +u16 timeout; +u16 probe_delay; +u8 timestamp[8 ]; +u8 local_time[8 ]; +struct wl3501_req req; +}; +struct wl3501_join_confirm {u16 next_blk;u8 sig_id;
@@ -443,16 +447,7 @@ struct wl3501_scan_confirm {u16 status;char timestamp[8 ];char localtime[8 ]; -u16 beacon_period; -u16 dtim_period; -u16 cap_info; -u8 bss_type; -u8 bssid[ETH_ALEN ]; -struct iw_mgmt_essid_pset ssid; -struct iw_mgmt_ds_pset ds_pset; -struct iw_mgmt_cf_pset cf_pset; -struct iw_mgmt_ibss_pset ibss_pset; -struct iw_mgmt_data_rset bss_basic_rset; +struct wl3501_req req;u8 rssi; };
drivers/net/wireless/wl3501_cs.c +23 -21
121 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 256/323 powerpc/iommu: Annotate nested lock for lockdep
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
[ Upstream commit cc7130bf119add37f36238343a593b71ef6ecc1e ]
The IOMMU table is divided into pools for concurrent mappings and each pool has a separate spinlock. When taking the ownership of an IOMMU group to pass through a device to a VM, we lock these spinlocks which triggers a false negative warning in lockdep (below).
This fixes it by annotating the large pool's spinlock as a nest lock which makes lockdep not complaining when locking nested locks if the nest lock is locked already.
===
WARNING: possible recursive locking detected 5.11.0-le_syzkaller_a+fstn1 #100 Not tainted
--------------------------------------------
qemu-system-ppc/4129 is trying to acquire lock:c0000000119bddb0 (&(p->lock)/1){....}-{2:2}, at: iommu_take_ownership+0xac/0x1e0
but task is already holding lock:c0000000119bdd30 (&(p->lock)/1){....}-{2:2}, at: iommu_take_ownership+0xac/0x1e0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&(p->lock)/1);
lock(&(p->lock)/1);
===
--- arch/powerpc/kernel/iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kernel/iommu.c +2 -2
@@ -1055,7 +1055,7 @@ int iommu_take_ownership(struct iommu_table *tbl)spin_lock_irqsave (&tbl->large_pool.lock, flags);for (i =0 ; i < tbl->nr_pools; i++) -spin_lock (&tbl->pools[i].lock); +spin_lock_nest_lock (&tbl->pools[i].lock, &tbl->large_pool.lock);if (tbl->it_offset ==0 )clear_bit (0 , tbl->it_map);
@@ -1084,7 +1084,7 @@ void iommu_release_ownership(struct iommu_table *tbl)spin_lock_irqsave (&tbl->large_pool.lock, flags);for (i =0 ; i < tbl->nr_pools; i++) -spin_lock (&tbl->pools[i].lock); +spin_lock_nest_lock (&tbl->pools[i].lock, &tbl->large_pool.lock);memset (tbl->it_map,0 , sz);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 257/323 net: ethernet: mtk_eth_soc: fix RX VLAN offload
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 3f57d8c40fea9b20543cab4da12f4680d2ef182c ]
The VLAN ID in the rx descriptor is only valid if the RX_DMA_VTAG bit is set. Fixes frames wrongly marked with VLAN tags.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +1 -1
@@ -1041,7 +1041,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, skb->protocol =eth_type_trans (skb, netdev);if (netdev->features &NETIF_F_HW_VLAN_CTAG_RX && -RX_DMA_VID (trxd.rxd3)) + (trxd.rxd2 &RX_DMA_VTAG ))__vlan_hwaccel_put_tag (skb,htons (ETH_P_8021Q ),RX_DMA_VID (trxd.rxd3));skb_record_rx_queue (skb,0 );
drivers/net/ethernet/mediatek/mtk_eth_soc.h +1 -0
@@ -283,6 +283,7 @@#define RX_DMA_DONE BIT(31)#define RX_DMA_PLEN0 (_x) (((_x) & 0x3fff) << 16)#define RX_DMA_GET_PLEN0 (_x) (((_x) >> 16) & 0x3fff) +#define RX_DMA_VTAG BIT(15)/* QDMA descriptor rxd3 */ #define RX_DMA_VID (_x) ((_x) & 0xfff)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 258/323 ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
In reply to Greg Kroah-HartmanFrom: David Ward <[email protected]>
[ Upstream commit cd8499d5c03ba260e3191e90236d0e5f6b147563 ]
The GPIO configuration cannot be applied if the registers are inaccessible. This prevented the headset mic from working on the Dell XPS 13 9343.
--- sound/soc/codecs/rt286.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/codecs/rt286.c +3 -0
@@ -174,6 +174,9 @@ static bool rt286_readable_register(struct device *dev, unsigned int reg)case RT286_PROC_COEF :case RT286_SET_AMP_GAIN_ADC_IN1 :case RT286_SET_AMP_GAIN_ADC_IN2 : +case RT286_SET_GPIO_MASK : +case RT286_SET_GPIO_DIRECTION : +case RT286_SET_GPIO_DATA :case RT286_SET_POWER (RT286_DAC_OUT1 ):case RT286_SET_POWER (RT286_DAC_OUT2 ):case RT286_SET_POWER (RT286_ADC_IN1 ):
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 259/323 f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 28e18ee636ba28532dbe425540af06245a0bbecb ]
The uninitialized variable dn.node_changed does not get set when a call to f2fs_get_node_page fails. This uninitialized value gets used in the call to f2fs_balance_fs() that may or not may not balances dirty node and dentry pages depending on the uninitialized state of the variable. Fix this by only calling f2fs_balance_fs if err is not set.
Thanks to Jaegeuk Kim for suggesting an appropriate fix.
Addresses-Coverity: ("Uninitialized scalar variable")
--- fs/f2fs/inline.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/inline.c +2 -1
@@ -203,7 +203,8 @@ out:f2fs_put_page (page,1 ); -f2fs_balance_fs (sbi, dn.node_changed); +if (!err) +f2fs_balance_fs (sbi, dn.node_changed);return err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 260/323 PCI: Release OF node in pci_scan_device()s error path
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit c99e755a4a4c165cad6effb39faffd0f3377c02d ]
In pci_scan_device(), if pci_setup_device() fails for any reason, the code will not release device's of_node by calling pci_release_of_node(). Fix that by calling the release function.
--- drivers/pci/probe.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/probe.c +1 -0
@@ -2014,6 +2014,7 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn)pci_set_of_node (dev);if (pci_setup_device (dev)) { +pci_release_of_node (dev);pci_bus_put (dev->bus);kfree (dev);return NULL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 261/323 ARM: 9064/1: hw_breakpoint: Do not directly check the events overflow_handler hook
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit a506bd5756290821a4314f502b4bafc2afcf5260 ]
The commit 1879445dfa7b ("perf/core: Set event's default ::overflow_handler()") set a default event->overflow_handler in perf_event_alloc(), and replace the check event->overflow_handler with is_default_overflow_handler(), but one is missing.
Currently, the bp->overflow_handler can not be NULL. As a result, enable_single_step() is always not invoked.
Comments from Zhen Lei:
https://patchwork.kernel.org/project/linux-arm-kernel/patch/[email protected]/
--- arch/arm/kernel/hw_breakpoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kernel/hw_breakpoint.c +1 -1
@@ -891,7 +891,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs) info->trigger = addr;pr_debug ("breakpoint fired: address = 0x%x\n" , addr);perf_bp_event (bp, regs); -if (!bp->overflow_handler) +if (is_default_overflow_handler (bp))enable_single_step (bp, addr); goto unlock; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 262/323 rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 26594c6bbb60c6bc87e3762a86ceece57d164c66 ]
When idr_find() returns NULL to intent, no error return code of qcom_glink_rx_data() is assigned.
To fix this bug, ret is assigned with -ENOENT in this case.
--- drivers/rpmsg/qcom_glink_native.c | 1 + 1 file changed, 1 insertion(+)
drivers/rpmsg/qcom_glink_native.c +1 -0
@@ -856,6 +856,7 @@ static int qcom_glink_rx_data(struct qcom_glink *glink, size_t avail)dev_err (glink->dev,"no intent found for channel %s intent %d" , channel->name, liid); + ret = -ENOENT ; goto advance_rx; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 263/323 NFSv4.2: Always flush out writes in nfs42_proc_fallocate()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 99f23783224355e7022ceea9b8d9f62c0fd01bd8 ]
Whether we're allocating or delallocating space, we should flush out the pending writes in order to avoid races with attribute updates.
--- fs/nfs/nfs42proc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
fs/nfs/nfs42proc.c +9 -7
@@ -58,7 +58,8 @@ static int _nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep,static int nfs42_proc_fallocate (struct rpc_message *msg,struct file *filep,loff_t offset,loff_t len) { -struct nfs_server *server =NFS_SERVER (file_inode (filep)); +struct inode *inode =file_inode (filep); +struct nfs_server *server =NFS_SERVER (inode);struct nfs4_exception exception = { };struct nfs_lock_context *lock;int err;
@@ -67,9 +68,13 @@ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep,if (IS_ERR (lock))return PTR_ERR (lock); - exception.inode =file_inode (filep); + exception.inode = inode; exception.state = lock->open_context->state; + err =nfs_sync_inode (inode); +if (err) + goto out; + do { err = _nfs42_proc_fallocate(msg, filep, lock, offset, len); if (err == -ENOTSUPP) {
@@ -78,7 +83,7 @@ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep, } err =nfs4_handle_exception (server, err, &exception); }while (exception.retry); - +out:nfs_put_lock_context (lock);return err; }
@@ -116,16 +121,13 @@ int nfs42_proc_deallocate(struct file *filep, loff_t offset, loff_t len)return -EOPNOTSUPP ;inode_lock (inode); - err =nfs_sync_inode (inode); -if (err) - goto out_unlock; err =nfs42_proc_fallocate (&msg, filep, offset, len);if (err ==0 )truncate_pagecache_range (inode, offset, (offset + len) -1 );if (err == -EOPNOTSUPP )NFS_SERVER (inode)->caps &= ~NFS_CAP_DEALLOCATE ; -out_unlock: +inode_unlock (inode);return err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 264/323 NFS: Deal correctly with attribute generation counter overflow
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 9fdbfad1777cb4638f489eeb62d85432010c0031 ]
We need to use unsigned long subtraction and then convert to signed in order to deal correcly with C overflow rules.
--- fs/nfs/inode.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/nfs/inode.c +4 -4
@@ -1533,10 +1533,10 @@ EXPORT_SYMBOL_GPL(_nfs_display_fhandle);*/ static int nfs_inode_attrs_need_update (const struct inode *inode,const struct nfs_fattr *fattr) { -const struct nfs_inode *nfsi =NFS_I (inode); +unsigned long attr_gencount =NFS_I (inode)->attr_gencount; -return ((long )fattr->gencount - (long )nfsi->attr_gencount) >0 || - ((long )nfsi->attr_gencount - (long )nfs_read_attr_generation_counter () >0 ); +return (long )(fattr->gencount - attr_gencount) >0 || + (long )(attr_gencount -nfs_read_attr_generation_counter ()) >0 ; }static int nfs_refresh_inode_locked (struct inode *inode,struct nfs_fattr *fattr)
@@ -1939,7 +1939,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) nfsi->attrtimeo_timestamp = now; }/* Set the barrier to be more recent than this fattr */ -if ((long )fattr->gencount - (long )nfsi->attr_gencount >0 ) +if ((long )(fattr->gencount - nfsi->attr_gencount) >0 ) nfsi->attr_gencount = fattr->gencount; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 265/323 pNFS/flexfiles: fix incorrect size check in decode_nfs_fh()
In reply to Greg Kroah-HartmanFrom: Nikola Livic <[email protected]>
[ Upstream commit ed34695e15aba74f45247f1ee2cf7e09d449f925 ]
We (adam zabrocki, alexander matrosov, alexander tereshkin, maksym bazalii) observed the check:
if (fh->size > sizeof(struct nfs_fh))
should not use the size of the nfs_fh struct which includes an extra two bytes from the size field.
struct nfs_fh {
unsigned short size;
unsigned char data[NFS_MAXFHSIZE];
}but should determine the size from data[NFS_MAXFHSIZE] so the memcpy will not write 2 bytes beyond destination. The proposed fix is to compare against the NFS_MAXFHSIZE directly, as is done elsewhere in fs code base.
--- fs/nfs/flexfilelayout/flexfilelayout.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/flexfilelayout/flexfilelayout.c +1 -1
@@ -101,7 +101,7 @@ static int decode_nfs_fh(struct xdr_stream *xdr, struct nfs_fh *fh)if (unlikely (!p))return -ENOBUFS ; fh->size =be32_to_cpup (p++); -if (fh->size >sizeof (struct nfs_fh )) { +if (fh->size >NFS_MAXFHSIZE ) {printk (KERN_ERR "NFS flexfiles: Too big fh received %d\n" , fh->size);return -EOVERFLOW ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 266/323 NFSv4.2 fix handling of sr_eof in SEEKs reply
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
[ Upstream commit 73f5c88f521a630ea1628beb9c2d48a2e777a419 ]
Currently the client ignores the value of the sr_eof of the SEEK operation. According to the spec, if the server didn't find the requested extent and reached the end of the file, the server would return sr_eof=true. In case the request for DATA and no data was found (ie in the middle of the hole), then the lseek expects that ENXIO would be returned.
--- fs/nfs/nfs42proc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/nfs/nfs42proc.c +4 -1
@@ -305,7 +305,10 @@ static loff_t _nfs42_proc_llseek(struct file *filep,if (status)return status; -return vfs_setpos (filep, res.sr_offset, inode->i_sb->s_maxbytes); +if (whence ==SEEK_DATA && res.sr_eof) +return -NFS4ERR_NXIO ; +else +return vfs_setpos (filep, res.sr_offset, inode->i_sb->s_maxbytes); }loff_t nfs42_proc_llseek (struct file *filep,loff_t offset,int whence)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 267/323 rtc: ds1307: Fix wday settings for rx8130
In reply to Greg Kroah-HartmanFrom: Nobuhiro Iwamatsu <[email protected]>
[ Upstream commit 204756f016726a380bafe619438ed979088bd04a ]
rx8130 wday specifies the bit position, not BCD.
--- drivers/rtc/rtc-ds1307.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/rtc/rtc-ds1307.c +10 -2
@@ -417,7 +417,11 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t) t->tm_min =bcd2bin (regs[DS1307_REG_MIN ] &0x7f ); tmp = regs[DS1307_REG_HOUR ] &0x3f ; t->tm_hour =bcd2bin (tmp); - t->tm_wday =bcd2bin (regs[DS1307_REG_WDAY ] &0x07 ) -1 ; +/* rx8130 is bit position, not BCD */ +if (ds1307->type == rx_8130) + t->tm_wday =fls (regs[DS1307_REG_WDAY ] &0x7f ); +else + t->tm_wday =bcd2bin (regs[DS1307_REG_WDAY ] &0x07 ) -1 ; t->tm_mday =bcd2bin (regs[DS1307_REG_MDAY ] &0x3f ); tmp = regs[DS1307_REG_MONTH ] &0x1f ; t->tm_mon =bcd2bin (tmp) -1 ;
@@ -465,7 +469,11 @@ static int ds1307_set_time(struct device *dev, struct rtc_time *t) regs[DS1307_REG_SECS ] =bin2bcd (t->tm_sec); regs[DS1307_REG_MIN ] =bin2bcd (t->tm_min); regs[DS1307_REG_HOUR ] =bin2bcd (t->tm_hour); - regs[DS1307_REG_WDAY ] =bin2bcd (t->tm_wday +1 ); +/* rx8130 is bit position, not BCD */ +if (ds1307->type == rx_8130) + regs[DS1307_REG_WDAY ] =1 << t->tm_wday; +else + regs[DS1307_REG_WDAY ] =bin2bcd (t->tm_wday +1 ); regs[DS1307_REG_MDAY ] =bin2bcd (t->tm_mday); regs[DS1307_REG_MONTH ] =bin2bcd (t->tm_mon +1 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 268/323 sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit f282df0391267fb2b263da1cc3233aa6fb81defc ]
Normally SCTP_MIB_CURRESTAB is always incremented once asoc enter into ESTABLISHED from the state < ESTABLISHED and decremented when the asoc is being deleted.
However, in sctp_sf_do_dupcook_b(), the asoc's state can be changed to ESTABLISHED from the state >= ESTABLISHED where it shouldn't increment SCTP_MIB_CURRESTAB. Otherwise, one asoc may increment MIB_CURRESTAB multiple times but only decrement once at the end.
I was able to reproduce it by using scapy to do the 4-way shakehands, after that I replayed the COOKIE-ECHO chunk with 'peer_vtag' field changed to different values, and SCTP_MIB_CURRESTAB was incremented multiple times and never went back to 0 even when the asoc was freed.
This patch is to fix it by only incrementing SCTP_MIB_CURRESTAB when the state < ESTABLISHED in sctp_sf_do_dupcook_b().
--- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/sm_statefuns.c +2 -1
@@ -1888,7 +1888,8 @@ static enum sctp_disposition sctp_sf_do_dupcook_b(sctp_add_cmd_sf (commands,SCTP_CMD_UPDATE_ASSOC ,SCTP_ASOC (new_asoc));sctp_add_cmd_sf (commands,SCTP_CMD_NEW_STATE ,SCTP_STATE (SCTP_STATE_ESTABLISHED )); -SCTP_INC_STATS (net,SCTP_MIB_CURRESTAB ); +if (asoc->state <SCTP_STATE_ESTABLISHED ) +SCTP_INC_STATS (net,SCTP_MIB_CURRESTAB );sctp_add_cmd_sf (commands,SCTP_CMD_HB_TIMERS_START ,SCTP_NULL ()); repl =sctp_make_cookie_ack (new_asoc, chunk);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 269/323 drm/radeon: Fix off-by-one power_state index heap overwrite
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 5bbf219328849e83878bddb7c226d8d42e84affc ]
An out of bounds write happens when setting the default power state. KASAN sees this as:
[drm] radeon: 512M of GTT memory ready.
[drm] GART: num cpu pages 131072, num gpu pages 131072
==================================================================
BUG: KASAN: slab-out-of-bounds in radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon] Write of size 4 at addr ffff88810178d858 by task systemd-udevd/157 CPU: 0 PID: 157 Comm: systemd-udevd Not tainted 5.12.0-E620 #50 Hardware name: eMachines eMachines E620 /Nile , BIOS V1.03 09/30/2008 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x18/0x239 kasan_report+0x170/0x1a8 radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon] radeon_atombios_get_power_modes+0x144/0x1888 [radeon] radeon_pm_init+0x1019/0x1904 [radeon] rs690_init+0x76e/0x84a [radeon] radeon_device_init+0x1c1a/0x21e5 [radeon] radeon_driver_load_kms+0xf5/0x30b [radeon] drm_dev_register+0x255/0x4a0 [drm] radeon_pci_probe+0x246/0x2f6 [radeon] pci_device_probe+0x1aa/0x294 really_probe+0x30e/0x850 driver_probe_device+0xe6/0x135 device_driver_attach+0xc1/0xf8 __driver_attach+0x13f/0x146 bus_for_each_dev+0xfa/0x146 bus_add_driver+0x2b3/0x447 driver_register+0x242/0x2c1 do_one_initcall+0x149/0x2fd do_init_module+0x1ae/0x573 load_module+0x4dee/0x5cca __do_sys_finit_module+0xf1/0x140 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae
Without KASAN, this will manifest later when the kernel attempts to allocate memory that was stomped, since it collides with the inline slab freelist pointer:
invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 PID: 781 Comm: openrc-run.sh Tainted: G W 5.10.12-gentoo-E620 #2 Hardware name: eMachines eMachines E620 /Nile , BIOS V1.03 09/30/2008 RIP: 0010:kfree+0x115/0x230 Code: 89 c5 e8 75 ea ff ff 48 8b 00 0f ba e0 09 72 63 e8 1f f4 ff ff 41 89 c4 48 8b 45 00 0f ba e0 10 72 0a 48 8b 45 08 a8 01 75 02 <0f> 0b 44 89 e1 48 c7 c2 00 f0 ff ff be 06 00 00 00 48 d3 e2 48 c7 RSP: 0018:ffffb42f40267e10 EFLAGS: 00010246 RAX: ffffd61280ee8d88 RBX: 0000000000000004 RCX: 000000008010000d RDX: 4000000000000000 RSI: ffffffffba1360b0 RDI: ffffd61280ee8d80 RBP: ffffd61280ee8d80 R08: ffffffffb91bebdf R09: 0000000000000000 R10: ffff8fe2c1047ac8 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000100 FS: 00007fe80eff6b68(0000) GS:ffff8fe339c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe80eec7bc0 CR3: 0000000038012000 CR4: 00000000000006f0 Call Trace: __free_fdtable+0x16/0x1f put_files_struct+0x81/0x9b do_exit+0x433/0x94d do_group_exit+0xa6/0xa6 __x64_sys_exit_group+0xf/0xf do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fe80ef64bea Code: Unable to access opcode bytes at RIP 0x7fe80ef64bc0. RSP: 002b:00007ffdb1c47528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe80ef64bea RDX: 00007fe80ef64f60 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 00007fe80ee2c620 R11: 0000000000000246 R12: 00007fe80eff41e0 R13: 00000000ffffffff R14: 0000000000000024 R15: 00007fe80edf9cd0 Modules linked in: radeon(+) ath5k(+) snd_hda_codec_realtek ...
Use a valid power_state index when initializing the "flags" and "misc" and "misc2" fields.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +3 -3
@@ -2260,10 +2260,10 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev) rdev->pm.default_power_state_index = state_index -1 ; rdev->pm.power_state[state_index -1 ].default_clock_mode = &rdev->pm.power_state[state_index -1 ].clock_info[0 ]; - rdev->pm.power_state[state_index].flags &= + rdev->pm.power_state[state_index -1 ].flags &= ~RADEON_PM_STATE_SINGLE_DISPLAY_ONLY ; - rdev->pm.power_state[state_index].misc =0 ; - rdev->pm.power_state[state_index].misc2 =0 ; + rdev->pm.power_state[state_index -1 ].misc =0 ; + rdev->pm.power_state[state_index -1 ].misc2 =0 ; }return state_index; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 270/323 khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate()
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit 74e579bf231a337ab3786d59e64bc94f45ca7b3f ]
In writable and !referenced case, the result value should be SCAN_LACK_REFERENCED_PAGE for trace_mm_collapse_huge_page_isolate() instead of default 0 (SCAN_FAIL) here.
--- mm/khugepaged.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
mm/khugepaged.c +9 -9
@@ -597,17 +597,17 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma, mmu_notifier_test_young(vma->vm_mm, address)) referenced++; } -if (likely (writable)) { -if (likely (referenced)) { - result =SCAN_SUCCEED ; -trace_mm_collapse_huge_page_isolate (page, none_or_zero, - referenced, writable, result); -return 1 ; - } - }else { + +if (unlikely (!writable)) { result =SCAN_PAGE_RO ; + }else if (unlikely (!referenced)) { + result =SCAN_LACK_REFERENCED_PAGE ; + }else { + result =SCAN_SUCCEED ; +trace_mm_collapse_huge_page_isolate (page, none_or_zero, + referenced, writable, result); +return 1 ; } - out:release_pte_pages (pte, _pte); trace_mm_collapse_huge_page_isolate(page, none_or_zero,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 271/323 mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts()
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit da56388c4397878a65b74f7fe97760f5aa7d316b ]
A rare out of memory error would prevent removal of the reserve map region for a page. hugetlb_fix_reserve_counts() handles this rare case to avoid dangling with incorrect counts. Unfortunately, hugepage_subpool_get_pages and hugetlb_acct_memory could possibly fail too. We should correctly handle these cases.
--- mm/hugetlb.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
mm/hugetlb.c +9 -2
@@ -589,13 +589,20 @@ void hugetlb_fix_reserve_counts(struct inode *inode) {struct hugepage_subpool *spool =subpool_inode (inode);long rsv_adjust; +bool reserved = false; rsv_adjust =hugepage_subpool_get_pages (spool,1 ); -if (rsv_adjust) { +if (rsv_adjust >0 ) {struct hstate *h =hstate_inode (inode); -hugetlb_acct_memory (h,1 ); +if (!hugetlb_acct_memory (h,1 )) + reserved = true; + }else if (!rsv_adjust) { + reserved = true; } + +if (!reserved) +pr_warn ("hugetlb: Huge Page Reserved count may go negative.\n" ); }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 272/323 ksm: fix potential missing rmap_item for stable_node
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit c89a384e2551c692a9fe60d093fd7080f50afc51 ]
When removing rmap_item from stable tree, STABLE_FLAG of rmap_item is cleared with head reserved. So the following scenario might happen: For ksm page with rmap_item1:
cmp_and_merge_page
stable_node->head = &migrate_nodes; remove_rmap_item_from_tree, but head still equal to stable_node; try_to_merge_with_ksm_page failed;
return;
For the same ksm page with rmap_item2, stable node migration succeed this time. The stable_node->head does not equal to migrate_nodes now. For ksm page with rmap_item1 again:
cmp_and_merge_page
stable_node->head != &migrate_nodes && rmap_item->head == stable_node return;
We would miss the rmap_item for stable_node and might result in failed rmap_walk_ksm(). Fix this by set rmap_item->head to NULL when rmap_item is removed from stable tree.
--- mm/ksm.c | 1 + 1 file changed, 1 insertion(+)
mm/ksm.c +1 -0
@@ -768,6 +768,7 @@ static void remove_rmap_item_from_tree(struct rmap_item *rmap_item) stable_node->rmap_hlist_len--;put_anon_vma (rmap_item->anon_vma); + rmap_item->head =NULL ; rmap_item->address &=PAGE_MASK ; }else if (rmap_item->address &UNSTABLE_FLAG ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 273/323 net: fix nla_strcmp to handle more then one trailing null character
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
[ Upstream commit 2c16db6c92b0ee4aa61e88366df82169e83c3f7e ]
Android userspace has been using TCA_KIND with a char[IFNAMESIZ] many-null-terminated buffer containing the string 'bpf'.
This works on 4.19 and ceases to work on 5.10.
I'm not entirely sure what fixes tag to use, but I think the issue was likely introduced in the below mentioned 5.4 commit.
--- lib/nlattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/nlattr.c +1 -1
@@ -379,7 +379,7 @@ int nla_strcmp(const struct nlattr *nla, const char *str)int attrlen =nla_len (nla);int d; -if (attrlen >0 && buf[attrlen -1 ] =='\0' ) +while (attrlen >0 && buf[attrlen -1 ] =='\0' ) attrlen--; d = attrlen - len;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 274/323 kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 31d82c2c787d5cf65fedd35ebbc0c1bd95c1a679 ]
When vzalloc() returns NULL to sha_regions, no error return code of kexec_calculate_store_digests() is assigned. To fix this bug, ret is assigned with -ENOMEM in this case.
--- kernel/kexec_file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/kexec_file.c +3 -1
@@ -554,8 +554,10 @@ static int kexec_calculate_store_digests(struct kimage *image) sha_region_sz =KEXEC_SEGMENT_MAX *sizeof (struct kexec_sha_region ); sha_regions =vzalloc (sha_region_sz); -if (!sha_regions) +if (!sha_regions) { + ret = -ENOMEM ; goto out_free_desc; + } desc->tfm = tfm; desc->flags =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 275/323 netfilter: nftables: avoid overflows in nft_hash_buckets()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a54754ec9891830ba548e2010c889e3c8146e449 ]
Number of buckets being stored in 32bit variables, we have to ensure that no overflows occur in nft_hash_buckets()
syzbot injected a size == 0x40000000 and reported:
UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 29539 Comm: syz-executor.4 Not tainted 5.12.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 __roundup_pow_of_two include/linux/log2.h:57 [inline] nft_hash_buckets net/netfilter/nft_set_hash.c:411 [inline] nft_hash_estimate.cold+0x19/0x1e net/netfilter/nft_set_hash.c:652 nft_select_set_ops net/netfilter/nf_tables_api.c:3586 [inline] nf_tables_newset+0xe62/0x3110 net/netfilter/nf_tables_api.c:4322 nfnetlink_rcv_batch+0xa09/0x24b0 net/netfilter/nfnetlink.c:488 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:612 [inline] nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:630 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
--- net/netfilter/nft_set_hash.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/netfilter/nft_set_hash.c +9 -1
@@ -364,9 +364,17 @@ static void nft_rhash_destroy(const struct nft_set *set) (void *)set); } +/* Number of buckets is stored in u32, so cap our result to 1U<<31 */ +#define NFT_MAX_BUCKETS (1U << 31) +static u32 nft_hash_buckets (u32 size) { -return roundup_pow_of_two (size *4 /3 ); +u64 val =div_u64 ((u64 )size *4 ,3 ); + +if (val >=NFT_MAX_BUCKETS ) +return NFT_MAX_BUCKETS ; + +return roundup_pow_of_two (val); } static bool nft_rhash_estimate(const struct nft_set_desc *desc, u32 features,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 276/323 ARC: entry: fix off-by-one error in syscall number validation
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
commit 3433adc8bd09fc9f29b8baddf33b4ecd1ecd2cdc upstream.
We have NR_syscall syscalls from [0 .. NR_syscall-1]. However the check for invalid syscall number is "> NR_syscall" as opposed to >=. This off-by-one error erronesously allows "NR_syscall" to be treated as valid syscall causeing out-of-bounds access into syscall-call table ensuing a crash (holes within syscall table have a invalid-entry handler but this is beyond the array implementing the table).
This problem showed up on v5.6 kernel when testing glibc 2.33 (v5.10 kernel capable, includng faccessat2 syscall 439). The v5.6 kernel has NR_syscalls=439 (0 to 438). Due to the bug, 439 passed by glibc was not handled as -ENOSYS but processed leading to a crash.
--- arch/arc/kernel/entry.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arc/kernel/entry.S +2 -2
@@ -169,7 +169,7 @@ tracesys: ; Do the Sys Call as we normally would. ; Validate the Sys Call number - cmp r8, NR_syscalls + cmp r8, NR_syscalls - 1 mov.hi r0, -ENOSYS bhi tracesys_exit
@@ -252,7 +252,7 @@ ENTRY(EV_Trap) ;============ Normal syscall case ; syscall num shd not exceed the total system calls avail - cmp r8, NR_syscalls + cmp r8, NR_syscalls - 1 mov.hi r0, -ENOSYS bhi .Lret_from_system_call
Greg Kroah-Hartman
maintainerPATCH 277/323 powerpc/64s: Fix crashes when toggling stf barrier
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 8ec7791bae1327b1c279c5cd6e929c3b12daaf0a upstream.
The STF (store-to-load forwarding) barrier mitigation can be enabled/disabled at runtime via a debugfs file (stf_barrier), which causes the kernel to patch itself to enable/disable the relevant mitigations.
However depending on which mitigation we're using, it may not be safe to do that patching while other CPUs are active. For example the following crash:
User access of kernel address (c00000003fff5af0) - exploit attempt? (uid: 0) segfault (11) at c00000003fff5af0 nip 7fff8ad12198 lr 7fff8ad121f8 code 1
code: 40820128 e93c00d0 e9290058 7c292840 40810058 38600000 4bfd9a81 e8410018
code: 2c030006 41810154 3860ffb6 e9210098 <e94d8ff0> 7d295279 39400000 40820a3c
Shows that we returned to userspace without restoring the user r13 value, due to executing the partially patched STF exit code.
Fix it by doing the patching under stop machine. The CPUs that aren't doing the patching will be spinning in the core of the stop machine logic. That is currently sufficient for our purposes, because none of the patching we do is to that code or anywhere in the vicinity.
--- arch/powerpc/lib/feature-fixups.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
arch/powerpc/lib/feature-fixups.c +17 -2
@@ -18,6 +18,7 @@#include <linux/string.h> #include <linux/init.h> #include <linux/sched/mm.h> +#include <linux/stop_machine.h> #include <asm/cputable.h> #include <asm/code-patching.h> #include <asm/page.h>
@@ -225,11 +226,25 @@ void do_stf_exit_barrier_fixups(enum stf : "unknown"); } +static int __do_stf_barrier_fixups (void *data) +{ +enum stf_barrier_type *types = data; + +do_stf_entry_barrier_fixups (*types); +do_stf_exit_barrier_fixups (*types); + +return 0 ; +}void do_stf_barrier_fixups (enum stf_barrier_type types) { -do_stf_entry_barrier_fixups (types); -do_stf_exit_barrier_fixups (types); +/* +* The call to the fallback entry flush, and the fallback/sync-ori exit +* flush can not be safely patched in/out while other CPUs are executing +* them. So call __do_stf_barrier_fixups() on one CPU while all other CPUs +* spin in the stop machine core with interrupts hard disabled. +*/ +stop_machine (__do_stf_barrier_fixups, &types,NULL ); }void do_uaccess_flush_fixups (enum l1d_flush_type types)
Greg Kroah-Hartman
maintainerPATCH 278/323 powerpc/64s: Fix crashes when toggling entry flush barrier
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit aec86b052df6541cc97c5fca44e5934cbea4963b upstream.
The entry flush mitigation can be enabled/disabled at runtime via a debugfs file (entry_flush), which causes the kernel to patch itself to enable/disable the relevant mitigations.
However depending on which mitigation we're using, it may not be safe to do that patching while other CPUs are active. For example the following crash:
sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20
Shows that we returned to userspace with a corrupted LR that points into the kernel, due to executing the partially patched call to the fallback entry flush (ie. we missed the LR restore).
Fix it by doing the patching under stop machine. The CPUs that aren't doing the patching will be spinning in the core of the stop machine logic. That is currently sufficient for our purposes, because none of the patching we do is to that code or anywhere in the vicinity.
--- arch/powerpc/lib/feature-fixups.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
arch/powerpc/lib/feature-fixups.c +15 -1
@@ -297,8 +297,9 @@ void do_uaccess_flush_fixups(enum l1d_fl : "unknown"); } -void do_entry_flush_fixups (enum l1d_flush_type types) +static int __do_entry_flush_fixups (void *data) { +enum l1d_flush_type types = *(enum l1d_flush_type *)data;unsigned int instrs[3 ], *dest;long *start, *end;int i;
@@ -349,6 +350,19 @@ void do_entry_flush_fixups(enum l1d_flus : "ori type" : (types &L1D_FLUSH_MTTRIG ) ?"mttrig type" : "unknown"); + +return 0 ; +} + +void do_entry_flush_fixups (enum l1d_flush_type types) +{ +/* +* The call to the fallback flush can not be safely patched in/out while +* other CPUs are executing it. So call __do_entry_flush_fixups() on one +* CPU while all other CPUs spin in the stop machine core with interrupts +* hard disabled. +*/ +stop_machine (__do_entry_flush_fixups, &types,NULL ); }void do_rfi_flush_fixups (enum l1d_flush_type types)
Greg Kroah-Hartman
maintainerPATCH 279/323 squashfs: fix divide error in calculate_skip()
In reply to Greg Kroah-HartmanFrom: Phillip Lougher <[email protected]>
commit d6e621de1fceb3b098ebf435ef7ea91ec4838a1a upstream.
Sysbot has reported a "divide error" which has been identified as being caused by a corrupted file_size value within the file inode. This value has been corrupted to a much larger value than expected.
Calculate_skip() is passed i_size_read(inode) >> msblk->block_log. Due to the file_size value corruption this overflows the int argument/variable in that function, leading to the divide error.
This patch changes the function to use u64. This will accommodate any unexpectedly large values due to corruption.
The value returned from calculate_skip() is clamped to be never more than SQUASHFS_CACHED_BLKS - 1, or 7. So file_size corruption does not lead to an unexpectedly large return result here.
--- fs/squashfs/file.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/squashfs/file.c +3 -3
@@ -224,11 +224,11 @@ failure:* If the skip factor is limited in this way then the file will use multiple * slots. */ -static inline int calculate_skip (int blocks) +static inline int calculate_skip (u64 blocks) { -int skip = blocks / ((SQUASHFS_META_ENTRIES +1 ) +u64 skip = blocks / ((SQUASHFS_META_ENTRIES +1 ) *SQUASHFS_META_INDEXES ); -return min (SQUASHFS_CACHED_BLKS -1 , skip +1 ); +return min ((u64 )SQUASHFS_CACHED_BLKS -1 , skip +1 ); }
Greg Kroah-Hartman
maintainerPATCH 280/323 userfaultfd: release page in error path to avoid BUG_ON
In reply to Greg Kroah-HartmanFrom: Axel Rasmussen <[email protected]>
commit 7ed9d238c7dbb1fdb63ad96a6184985151b0171c upstream.
Consider the following sequence of events:
1. Userspace issues a UFFD ioctl, which ends up calling into shmem_mfill_atomic_pte(). We successfully account the blocks, we shmem_alloc_page(), but then the copy_from_user() fails. We return -ENOENT. We don't release the page we allocated.
2. Our caller detects this error code, tries the copy_from_user() after dropping the mmap_lock, and retries, calling back into shmem_mfill_atomic_pte().
3. Meanwhile, let's say another process filled up the tmpfs being used.
4. So shmem_mfill_atomic_pte() fails to account blocks this time, and immediately returns - without releasing the page.
This triggers a BUG_ON in our caller, which asserts that the page should always be consumed, unless -ENOENT is returned.
To fix this, detect if we have such a "dangling" page when accounting fails, and if so, release it before returning.
--- mm/shmem.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
mm/shmem.c +11 -1
@@ -2251,8 +2251,18 @@ static int shmem_mfill_atomic_pte(structpgoff_t offset, max_off; ret = -ENOMEM ; -if (!shmem_inode_acct_block (inode,1 )) +if (!shmem_inode_acct_block (inode,1 )) { +/* +* We may have got a page, returned -ENOENT triggering a retry, +* and now we find ourselves with -ENOMEM. Release the page, to +* avoid a BUG_ON in our caller. +*/ +if (unlikely (*pagep)) { +put_page (*pagep); + *pagep =NULL ; + } goto out; + }if (!*pagep) { page =shmem_alloc_page (gfp, info, pgoff);
Greg Kroah-Hartman
maintainerPATCH 281/323 drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit 227545b9a08c68778ddd89428f99c351fc9315ac upstream.
Screen flickers rapidly when two 4K 60Hz monitors are in use. This issue doesn't happen when one monitor is 4K 60Hz (pixelclock 594MHz) and another one is 4K 30Hz (pixelclock 297MHz).
The issue is gone after setting "power_dpm_force_performance_level" to "high". Following the indication, we found that the issue occurs when sclk is too low.
So resolve the issue by disabling sclk switching when there are two monitors requires high pixelclock (> 297MHz).
v2:
- Only apply the fix to Oland.
--- drivers/gpu/drm/radeon/radeon.h | 1 + drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++++++ drivers/gpu/drm/radeon/si_dpm.c | 3 +++ 3 files changed, 12 insertions(+)
drivers/gpu/drm/radeon/radeon.h +1 -0
@@ -1562,6 +1562,7 @@ struct radeon_dpm {void *priv;u32 new_active_crtcs;int new_active_crtc_count; +int high_pixelclock_count;u32 current_active_crtcs;int current_active_crtc_count;bool single_display;
drivers/gpu/drm/radeon/radeon_pm.c +8 -0
@@ -1715,6 +1715,7 @@ static void radeon_pm_compute_clocks_dpmstruct drm_device *ddev = rdev->ddev;struct drm_crtc *crtc;struct radeon_crtc *radeon_crtc; +struct radeon_connector *radeon_connector;if (!rdev->pm.dpm_enabled)return ;
@@ -1724,6 +1725,7 @@ static void radeon_pm_compute_clocks_dpm/* update active crtc counts */ rdev->pm.dpm.new_active_crtcs =0 ; rdev->pm.dpm.new_active_crtc_count =0 ; + rdev->pm.dpm.high_pixelclock_count =0 ;if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {list_for_each_entry (crtc, &ddev->mode_config.crtc_list, head) {
@@ -1731,6 +1733,12 @@ static void radeon_pm_compute_clocks_dpmif (crtc->enabled) { rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id); rdev->pm.dpm.new_active_crtc_count++; +if (!radeon_crtc->connector) +continue ; + + radeon_connector =to_radeon_connector (radeon_crtc->connector); +if (radeon_connector->pixelclock_for_modeset >297000 ) + rdev->pm.dpm.high_pixelclock_count++; } } }
drivers/gpu/drm/radeon/si_dpm.c +3 -0
@@ -3000,6 +3000,9 @@ static void si_apply_state_adjust_rules( (rdev->pdev->device == 0x6605)) { max_sclk =75000 ; } + +if (rdev->pm.dpm.high_pixelclock_count >1 ) + disable_sclk_switching = true; }if (rps->vce_active) {
Greg Kroah-Hartman
maintainerPATCH 282/323 iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit a2fa9242e89f27696515699fe0f0296bf1ac1815 ]
When lidar_write_control() fails, a pairing PM usage counter decrement is needed to keep the counter balanced.
--- drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +1 -0
@@ -166,6 +166,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg) ret =lidar_write_control (data,LIDAR_REG_CONTROL_ACQUIRE );if (ret <0 ) {dev_err (&client->dev,"cannot send start measurement command" ); +pm_runtime_put_noidle (&client->dev);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 283/323 usb: fotg210-hcd: Fix an error message
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit a60a34366e0d09ca002c966dd7c43a68c28b1f82 ]
'retval' is known to be -ENODEV here.
This is a hard-coded default error code which is not useful in the error message. Moreover, another error message is printed at the end of the error handling path. The corresponding error code (-ENOMEM) is more informative.
So remove simplify the first error message.
While at it, also remove the useless initialization of 'retval'.
--- drivers/usb/host/fotg210-hcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/fotg210-hcd.c +2 -2
@@ -5598,7 +5598,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)struct usb_hcd *hcd;struct resource *res;int irq; -int retval = -ENODEV ; +int retval;struct fotg210_hcd *fotg210;if (usb_disabled ())
@@ -5618,7 +5618,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) hcd =usb_create_hcd (&fotg210_fotg210_hc_driver, dev,dev_name (dev));if (!hcd) { -dev_err (dev,"failed to create hcd with err %d\n" , retval); +dev_err (dev,"failed to create hcd\n" ); retval = -ENOMEM ; goto fail_create_hcd; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 284/323 ACPI: scan: Fix a memory leak in an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 0c8bd174f0fc131bc9dfab35cd8784f59045da87 ]
If 'acpi_device_set_name()' fails, we must free 'acpi_device_bus_id->bus_id' or there is a (potential) memory leak.
--- drivers/acpi/scan.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/scan.c +1 -0
@@ -704,6 +704,7 @@ int acpi_device_add(struct acpi_device *device, result =acpi_device_set_name (device, acpi_device_bus_id);if (result) { +kfree_const (acpi_device_bus_id->bus_id);kfree (acpi_device_bus_id); goto err_unlock; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 285/323 blk-mq: Swap two calls in blk_mq_exit_queue()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 630ef623ed26c18a457cdc070cf24014e50129c2 ]
If a tag set is shared across request queues (e.g. SCSI LUNs) then the block layer core keeps track of the number of active request queues in tags->active_queues. blk_mq_tag_busy() and blk_mq_tag_idle() update that atomic counter if the hctx flag BLK_MQ_F_TAG_QUEUE_SHARED is set. Make sure that blk_mq_exit_queue() calls blk_mq_tag_idle() before that flag is cleared by blk_mq_del_queue_tag_set().
--- block/blk-mq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
block/blk-mq.c +4 -2
@@ -2489,10 +2489,12 @@ EXPORT_SYMBOL(blk_mq_init_allocated_queue);void blk_mq_free_queue (struct request_queue *q) { -struct blk_mq_tag_set *set = q->tag_set; +struct blk_mq_tag_set *set = q->tag_set; -blk_mq_del_queue_tag_set (q); +/* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */ blk_mq_exit_hw_queues (q, set, set->nr_hw_queues); +/* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */ +blk_mq_del_queue_tag_set (q); }/* Basically redo blk_mq_init_queue with queue frozen */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 286/323 usb: dwc3: omap: improve extcon initialization
In reply to Greg Kroah-HartmanFrom: Marcel Hamer <[email protected]>
commit e17b02d4970913233d543c79c9c66e72cac05bdd upstream.
When extcon is used in combination with dwc3, it is assumed that the dwc3 registers are untouched and as such are only configured if VBUS is valid or ID is tied to ground.
In case VBUS is not valid or ID is floating, the registers are not configured as such during driver initialization, causing a wrong default state during boot.
If the registers are not in a default state, because they are for instance touched by a boot loader, this can cause for a kernel error.
--- drivers/usb/dwc3/dwc3-omap.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/dwc3/dwc3-omap.c +5 -0
@@ -440,8 +440,13 @@ static int dwc3_omap_extcon_register(strif (extcon_get_state (edev,EXTCON_USB ) == true)dwc3_omap_set_mailbox (omap,OMAP_DWC3_VBUS_VALID ); +else +dwc3_omap_set_mailbox (omap,OMAP_DWC3_VBUS_OFF ); +if (extcon_get_state (edev,EXTCON_USB_HOST ) == true)dwc3_omap_set_mailbox (omap,OMAP_DWC3_ID_GROUND ); +else +dwc3_omap_set_mailbox (omap,OMAP_DWC3_ID_FLOAT ); omap->edev = edev; }
Greg Kroah-Hartman
maintainerPATCH 287/323 usb: xhci: Increase timeout for HC halt
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
commit ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 upstream.
On some devices (specifically the SC8180x based Surface Pro X with QCOM04A6) HC halt / xhci_halt() times out during boot. Manually binding the xhci-hcd driver at some point later does not exhibit this behavior. To work around this, double XHCI_MAX_HALT_USEC, which also resolves this issue.
--- drivers/usb/host/xhci-ext-caps.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ext-caps.h +3 -2
@@ -19,8 +19,9 @@* along with this program; if not, write to the Free Software Foundation, * Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -/* Up to 16 ms to halt an HC */ -#define XHCI_MAX_HALT_USEC (16*1000) + +/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */ +#define XHCI_MAX_HALT_USEC (32 * 1000)/* HC not running - set to 1 when run/stop bit is cleared. */ #define XHCI_STS_HALT (1<<0)
Greg Kroah-Hartman
maintainerPATCH 288/323 usb: dwc2: Fix gadget DMA unmap direction
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
commit 75a41ce46bae6cbe7d3bb2584eb844291d642874 upstream.
The dwc2 gadget support maps and unmaps DMA buffers as necessary. When mapping and unmapping it uses the direction of the endpoint to select the direction of the DMA transfer, but this fails for Control OUT transfers because the unmap occurs after the endpoint direction has been reversed for the status phase.
A possible solution would be to unmap the buffer before the direction is changed, but a safer, less invasive fix is to remember the buffer direction independently of the endpoint direction.
--- drivers/usb/dwc2/core.h | 2 ++ drivers/usb/dwc2/gadget.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/usb/dwc2/core.h +2 -0
@@ -166,6 +166,7 @@ struct dwc2_hsotg_req;* @lock: State lock to protect contents of endpoint. * @dir_in: Set to true if this endpoint is of the IN direction, which * means that it is sending data to the Host. +* @map_dir: Set to the value of dir_in when the DMA buffer is mapped. * @index: The index for the endpoint registers. * @mc: Multi Count - number of transactions per microframe * @interval - Interval for periodic endpoints, in frames or microframes.
@@ -214,6 +215,7 @@ struct dwc2_hsotg_ep {unsigned short fifo_index;unsigned char dir_in; +unsigned char map_dir;unsigned char index;unsigned char mc;u16 interval;
drivers/usb/dwc2/gadget.c +2 -1
@@ -413,7 +413,7 @@ static void dwc2_hsotg_unmap_dma(struct {struct usb_request *req = &hs_req->req; -usb_gadget_unmap_request (&hsotg->gadget, req, hs_ep->dir_in); +usb_gadget_unmap_request (&hsotg->gadget, req, hs_ep->map_dir); }/*
@@ -1213,6 +1213,7 @@ static int dwc2_hsotg_map_dma(struct dwc {int ret; + hs_ep->map_dir = hs_ep->dir_in; ret =usb_gadget_map_request (&hsotg->gadget, req, hs_ep->dir_in);if (ret) goto dma_error;
Greg Kroah-Hartman
maintainerPATCH 289/323 usb: core: hub: fix race condition about TRSMRCY of resume
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit 975f94c7d6c306b833628baa9aec3f79db1eb3a1 upstream.
This may happen if the port becomes resume status exactly when usb_port_resume() gets port status, it still need provide a TRSMCRY time before access the device.
--- drivers/usb/core/hub.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/core/hub.c +3 -3
@@ -3496,9 +3496,6 @@ int usb_port_resume(struct usb_device *u* sequence. */ status =hub_port_status (hub, port1, &portstatus, &portchange); - -/* TRSMRCY = 10 msec */ -msleep (10 ); } SuspendCleared:
@@ -3513,6 +3510,9 @@ int usb_port_resume(struct usb_device *uusb_clear_port_feature (hub->hdev, port1,USB_PORT_FEAT_C_SUSPEND ); } + +/* TRSMRCY = 10 msec */ +msleep (10 ); }if (udev->persist_enabled)
Greg Kroah-Hartman
maintainerPATCH 290/323 iio: gyro: mpu3050: Fix reported temperature value
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit f73c730774d88a14d7b60feee6d0e13570f99499 upstream.
The raw temperature value is a 16-bit signed integer. The sign casting is missing in the code, which results in a wrong temperature reported by userspace tools, fix it.
Datasheet: https://www.cdiweb.com/datasheets/invensense/mpu-3000a.pdf
--- drivers/iio/gyro/mpu3050-core.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/iio/gyro/mpu3050-core.c +11 -2
@@ -270,7 +270,16 @@ static int mpu3050_read_raw(struct iio_dcase IIO_CHAN_INFO_OFFSET :switch (chan->type) {case IIO_TEMP : -/* The temperature scaling is (x+23000)/280 Celsius */ +/* +* The temperature scaling is (x+23000)/280 Celsius +* for the "best fit straight line" temperature range +* of -30C..85C. The 23000 includes room temperature +* offset of +35C, 280 is the precision scale and x is +* the 16-bit signed integer reported by hardware. +* +* Temperature value itself represents temperature of +* the sensor die. +*/ *val =23000 ;return IIO_VAL_INT ;default :
@@ -327,7 +336,7 @@ static int mpu3050_read_raw(struct iio_d goto out_read_raw_unlock; } - *val =be16_to_cpu (raw_val); + *val = (s16 )be16_to_cpu (raw_val); ret =IIO_VAL_INT ; goto out_read_raw_unlock;
Greg Kroah-Hartman
maintainerPATCH 291/323 iio: tsl2583: Fix division by a zero lux_val
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit af0e1871d79cfbb91f732d2c6fa7558e45c31038 upstream.
The lux_val returned from tsl2583_get_lux can potentially be zero, so check for this to avoid a division by zero and an overflowed gain_trim_val.
Fixes clang scan-build warning:
drivers/iio/light/tsl2583.c:345:40: warning: Either the condition 'lux_val<0' is redundant or there is division by zero at line 345. [zerodivcond]
--- drivers/iio/light/tsl2583.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iio/light/tsl2583.c +8 -0
@@ -350,6 +350,14 @@ static int tsl2583_als_calibrate(structreturn lux_val; } +/* Avoid division by zero of lux_value later on */ +if (lux_val ==0 ) { +dev_err (&chip->client->dev, +"%s: lux_val of 0 will produce out of range trim_value\n" , + __func__); +return -ENODATA ; + } + gain_trim_val = (unsigned int )(((chip->als_settings.als_cal_target) * chip->als_settings.als_gain_trim) / lux_val);if ((gain_trim_val <250 ) || (gain_trim_val >4000 )) {
Greg Kroah-Hartman
maintainerPATCH 292/323 KVM: x86: Cancel pvclock_gtod_work on module removal
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 594b27e677b35f9734b1969d175ebc6146741109 upstream.
Nothing prevents the following:
pvclock_gtod_notify()
queue_work(system_long_wq, &pvclock_gtod_work);
...
remove_module(kvm);
...
work_queue_run()
pvclock_gtod_work() <- UAFDitto for any other operation on that workqueue list head which touches pvclock_gtod_work after module removal.
Cancel the work in kvm_arch_exit() to prevent that.
Message-Id: <[email protected]>
--- arch/x86/kvm/x86.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/x86.c +1 -0
@@ -6420,6 +6420,7 @@ void kvm_arch_exit(void)cpuhp_remove_state_nocalls (CPUHP_AP_X86_KVM_CLK_ONLINE );#ifdef CONFIG_X86_64 pvclock_gtod_unregister_notifier (&pvclock_gtod_notifier); +cancel_work_sync (&pvclock_gtod_work);#endif kvm_x86_ops =NULL ;kvm_mmu_module_exit ();
Greg Kroah-Hartman
maintainerPATCH 293/323 FDDI: defxx: Make MMIO the configuration default except for EISA
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 193ced4a79599352d63cb8c9e2f0c6043106eb6a upstream.
Recent versions of the PCI Express specification have deprecated support for I/O transactions and actually some PCIe host bridges, such as Power Systems Host Bridge 4 (PHB4), do not implement them.
The default kernel configuration choice for the defxx driver is the use of I/O ports rather than MMIO for PCI and EISA systems. It may have made sense as a conservative backwards compatible choice back when MMIO operation support was added to the driver as a part of TURBOchannel bus support. However nowadays this configuration choice makes the driver unusable with systems that do not implement I/O transactions for PCIe.
Make DEFXX_MMIO the configuration default then, except where configured for EISA. This exception is because an EISA adapter can have its MMIO decoding disabled with ECU (EISA Configuration Utility) and therefore not available with the resource allocation infrastructure we implement, while port I/O is always readily available as it uses slot-specific addressing, directly mapped to the slot an option card has been placed in and handled with our EISA bus support core. Conversely a kernel that supports modern systems which may not have I/O transactions implemented for PCIe will usually not be expected to handle legacy EISA systems.
The change of the default will make it easier for people, including but not limited to distribution packagers, to make a working choice for the driver.
Update the option description accordingly and while at it replace the potentially ambiguous PIO acronym with IOP for "port I/O" vs "I/O ports" according to our nomenclature used elsewhere.
--- drivers/net/fddi/Kconfig | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/net/fddi/Kconfig +9 -6
@@ -28,17 +28,20 @@ config DEFXX config DEFXX_MMIO bool - prompt "Use MMIO instead of PIO" if PCI || EISA + prompt "Use MMIO instead of IOP" if PCI || EISA depends on DEFXX - default n if PCI || EISA + default n if EISA default y ---help--- This instructs the driver to use EISA or PCI memory-mapped I/O - (MMIO) as appropriate instead of programmed I/O ports (PIO). + (MMIO) as appropriate instead of programmed I/O ports (IOP). Enabling this gives an improvement in processing time in parts - of the driver, but it may cause problems with EISA (DEFEA) - adapters. TURBOchannel does not have the concept of I/O ports, - so MMIO is always used for these (DEFTA) adapters. + of the driver, but it requires a memory window to be configured + for EISA (DEFEA) adapters that may not always be available. + Conversely some PCIe host bridges do not support IOP, so MMIO + may be required to access PCI (DEFPA) adapters on downstream PCI + buses with some systems. TURBOchannel does not have the concept + of I/O ports, so MMIO is always used for these (DEFTA) adapters. If unsure, say N.
Greg Kroah-Hartman
maintainerPATCH 294/323 MIPS: Reinstate platform `__div64_32 handler
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit c49f71f60754acbff37505e1d16ca796bf8a8140 upstream.
Our current MIPS platform __div64_32' handler is inactive, because it is incorrectly only enabled for 64-bit configurations, for which generic do_div' code does not call it anyway.
The handler is not suitable for being called from there though as it only calculates 32 bits of the quotient under the assumption the 64-bit divident has been suitably reduced. Code for such reduction used to be there, however it has been incorrectly removed with commit c21004cd5b4c ("MIPS: Rewrite <asm/div64.h> to work with gcc 4.4.0."), which should have only updated an obsoleted constraint for an inline asm involving $hi and $lo register outputs, while possibly wiring the original MIPS variant of the do_div' macro as __div64_32' handler for the generic `do_div' implementation
Correct the handler as follows then:
- Revert most of the commit referred, however retaining the current formatting, except for the final two instructions of the inline asm sequence, which the original commit missed. Omit the original 64-bit parts though.
- Rename the original do_div' macro to __div64_32'. Use the combined x' constraint referring to the MD accumulator as a whole, replacing the original individual h' and l' constraints used for $hi and $lo registers respectively, of which h' has been obsoleted with GCC 4.4. Update surrounding code accordingly.
We have since removed support for GCC versions before 4.9, so no need for a special arrangement here; GCC has supported the `x' constraint since forever anyway, or at least going back to 1991.
- Rename the __base' local variable in __div64_32' to __radix' to avoid a conflict with a local variable in do_div'.
- Actually enable this code for 32-bit rather than 64-bit configurations by qualifying it with BITS_PER_LONG being 32 instead of 64. Include <asm/bitsperlong.h> for this macro rather than <linux/types.h> as we don't need anything else.
- Finally include <asm-generic/div64.h> last rather than first.
This has passed correctness verification with test_div64 and reduced the module's average execution time down to 1.0668s and 0.2629s from 2.1529s and 0.5647s respectively for an R3400 CPU @40MHz and a 5Kc CPU @160MHz. For a reference 64-bit `do_div' code where we have the DDIVU instruction available to do the whole calculation right away averages at 0.0660s for the latter CPU.
--- arch/mips/include/asm/div64.h | 57 ++++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 16 deletions(-)
arch/mips/include/asm/div64.h +41 -16
@@ -1,5 +1,5 @@/* -* Copyright (C) 2000, 2004 Maciej W. Rozycki +* Copyright (C) 2000, 2004, 2021 Maciej W. Rozycki * Copyright (C) 2003, 07 Ralf Baechle ([email protected]) * * This file is subject to the terms and conditions of the GNU General Public
@@ -9,25 +9,18 @@#ifndef __ASM_DIV64_H#define __ASM_DIV64_H -#include <asm-generic/div64.h> - -#if BITS_PER_LONG ==64 +#include <asm/bitsperlong.h> -#include <linux/types.h> +#if BITS_PER_LONG ==32 /* * No traps on overflows for any of these... */ -#define __div64_32 (n, base) \ -({ \ +#define do_div64_32 (res, high, low, base) ({ \ unsigned long __cf, __tmp, __tmp2, __i; \ unsigned long __quot32, __mod32; \ - unsigned long __high, __low; \ - unsigned long long __n; \ \ - __high = *__n >> 32; \ - __low = __n; \ __asm__( \ " .set push \n" \ " .set noat \n" \
@@ -51,18 +44,50 @@" subu %0, %0, %z6 \n" \" addiu %2, %2, 1 \n" \"3: \n" \ - " bnez %4, 0b\n\t" \ - " srl %5, %1, 0x1f\n\t" \ +" bnez %4, 0b \n" \ +" srl %5, %1, 0x1f \n" \" .set pop" \ : "=&r" (__mod32), "=&r" (__tmp), \ "=&r" (__quot32), "=&r" (__cf), \ "=&r" (__i), "=&r" (__tmp2) \ - : "Jr" (base), "0" (__high), "1" (__low)); \ + : "Jr" (base), "0" (high), "1" (low)); \ \ - (__n) = __quot32; \ + (res) = __quot32; \ __mod32; \ }) -#endif /* BITS_PER_LONG == 64 */ +#define __div64_32(n, base) ({ \ +unsigned long __upper, __low, __high, __radix; \ +unsigned long long __modquot; \ +unsigned long long __quot; \ +unsigned long long __div; \ +unsigned long __mod; \ + \ + __div = (*n); \ + __radix = (base); \ + \ + __high = __div >>32 ; \ + __low = __div; \ + __upper = __high; \ + \ +if (__high) { \ + __asm__("divu $0, %z1, %z2" \ + :"=x" (__modquot) \ + :"Jr" (__high),"Jr" (__radix)); \ + __upper = __modquot >>32 ; \ + __high = __modquot; \ + } \ + \ + __mod =do_div64_32 (__low, __upper, __low, __radix); \ + \ + __quot = __high; \ + __quot = __quot <<32 | __low; \ + (*n) = __quot; \ + __mod; \ +}) + +#endif /* BITS_PER_LONG == 32 */ + +#include <asm-generic/div64.h> #endif /* __ASM_DIV64_H */
Greg Kroah-Hartman
maintainerPATCH 295/323 MIPS: Avoid DIVU in `__div64_32 is result would be zero
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit c1d337d45ec0a802299688e17d568c4e3a585895 upstream.
We already check the high part of the divident against zero to avoid the costly DIVU instruction in that case, needed to reduce the high part of the divident, so we may well check against the divisor instead and set the high part of the quotient to zero right away. We need to treat the high part the divident in that case though as the remainder that would be calculated by the DIVU instruction we avoided.
This has passed correctness verification with test_div64 and reduced the module's average execution time down to 1.0445s and 0.2619s from 1.0668s and 0.2629s respectively for an R3400 CPU @40MHz and a 5Kc CPU @160MHz.
--- arch/mips/include/asm/div64.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/mips/include/asm/div64.h +4 -2
@@ -68,9 +68,11 @@ \ __high = __div >>32 ; \ __low = __div; \ - __upper = __high; \ \ -if (__high) { \ +if (__high < __radix) { \ + __upper = __high; \ + __high =0 ; \ + }else { \ __asm__("divu $0, %z1, %z2" \ :"=x" (__modquot) \ :"Jr" (__high),"Jr" (__radix)); \
Greg Kroah-Hartman
maintainerPATCH 296/323 MIPS: Avoid handcoded DIVU in `__div64_32 altogether
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 25ab14cbe9d1b66fda44c71a2db7582a31b6f5cd upstream.
Remove the inline asm with a DIVU instruction from `__div64_32' and use plain C code for the intended DIVMOD calculation instead. GCC is smart enough to know that both the quotient and the remainder are calculated with single DIVU, so with ISAs up to R5 the same instruction is actually produced with overall similar code.
For R6 compiled code will work, but separate DIVU and MODU instructions will be produced, which are also interlocked, so scalar implementations will likely not perform as well as older ISAs with their asynchronous MD unit. Likely still faster then the generic algorithm though.
This removes a compilation error for R6 however where the original DIVU instruction is not supported anymore and the MDU accumulator registers have been removed and consequently GCC complains as to a constraint it cannot find a register for:
In file included from ./include/linux/math.h:5,
from ./include/linux/kernel.h:13,
from mm/page-writeback.c:15:
./include/linux/math64.h: In function 'div_u64_rem':
./arch/mips/include/asm/div64.h:76:17: error: inconsistent operand constraints in an 'asm'
76 | __asm__("divu $0, %z1, %z2" \
| ^~~~~~~
./include/asm-generic/div64.h:245:25: note: in expansion of macro '__div64_32'
245 | __rem = __div64_32(&(n), __base); \
| ^~~~~~~~~~./include/linux/math64.h:91:22: note: in expansion of macro 'do_div'
91 | *remainder = do_div(dividend, divisor);
| ^~~~~~
This has passed correctness verification with test_div64 and reduced the module's average execution time down to 1.0404s from 1.0445s with R3400 @40MHz. The module's MIPS I machine code has also shrunk by 12 bytes or 3 instructions.
--- arch/mips/include/asm/div64.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/mips/include/asm/div64.h +2 -6
@@ -58,7 +58,6 @@#define __div64_32 (n, base) ({ \ unsigned long __upper, __low, __high, __radix; \ - unsigned long long __modquot; \ unsigned long long __quot; \ unsigned long long __div; \ unsigned long __mod; \
@@ -73,11 +72,8 @@ __upper = __high; \ __high =0 ; \ }else { \ - __asm__("divu $0, %z1, %z2" \ - :"=x" (__modquot) \ - :"Jr" (__high),"Jr" (__radix)); \ - __upper = __modquot >>32 ; \ - __high = __modquot; \ + __upper = __high % __radix; \ + __high /= __radix; \ } \ \ __mod =do_div64_32 (__low, __upper, __low, __radix); \
Greg Kroah-Hartman
maintainerPATCH 297/323 thermal/core/fair share: Lock the thermal zone while looping over instances
In reply to Greg Kroah-HartmanFrom: Lukasz Luba <[email protected]>
commit fef05776eb02238dcad8d5514e666a42572c3f32 upstream.
The tz->lock must be hold during the looping over the instances in that thermal zone. This lock was missing in the governor code since the beginning, so it's hard to point into a particular commit.
--- drivers/thermal/fair_share.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/thermal/fair_share.c +4 -0
@@ -94,6 +94,8 @@ static int fair_share_throttle(struct thint total_instance =0 ;int cur_trip_level =get_trip_level (tz); +mutex_lock (&tz->lock); +list_for_each_entry (instance, &tz->thermal_instances, tz_node) {if (instance->trip != trip)continue ;
@@ -122,6 +124,8 @@ static int fair_share_throttle(struct thmutex_unlock (&instance->cdev->lock);thermal_cdev_update (cdev); } + +mutex_unlock (&tz->lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 298/323 RDMA/i40iw: Avoid panic when reading back the IRQ affinity hint
In reply to Greg Kroah-HartmanFrom: Andrew Boyer <[email protected]>
commit 43731753c4b7d832775cf6b2301dd0447a5a1851 upstream.
The current code sets an affinity hint with a cpumask_t stored on the stack. This value can then be accessed through /proc/irq/*/affinity_hint/, causing a segfault or returning corrupt data.
Move the cpumask_t into struct i40iw_msix_vector so it is available later.
Backtrace: BUG: unable to handle kernel paging request at ffffb16e600e7c90 IP: irq_affinity_hint_proc_show+0x60/0xf0
PGD 17c0c6d067
PUD 17c0c6e067
PMD 15d4a0e067
PTE 0
Oops: 0000 [#1] SMP Modules linked in: ... CPU: 3 PID: 172543 Comm: grep Tainted: G OE ... #1 Hardware name: ... task: ffff9a5caee08000 task.stack: ffffb16e659d8000 RIP: 0010:irq_affinity_hint_proc_show+0x60/0xf0 RSP: 0018:ffffb16e659dbd20 EFLAGS: 00010086 RAX: 0000000000000246 RBX: ffffb16e659dbd20 RCX: 0000000000000000 RDX: ffffb16e600e7c90 RSI: 0000000000000003 RDI: 0000000000000046 RBP: ffffb16e659dbd88 R08: 0000000000000038 R09: 0000000000000001 R10: 0000000070803079 R11: 0000000000000000 R12: ffff9a59d1d97a00 R13: ffff9a5da47a6cd8 R14: ffff9a5da47a6c00 R15: ffff9a59d1d97a00 FS: 00007f946c31d740(0000) GS:ffff9a5dc1800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffb16e600e7c90 CR3: 00000016a4339000 CR4: 00000000007406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: seq_read+0x12d/0x430 ? sched_clock_cpu+0x11/0xb0 proc_reg_read+0x48/0x70 __vfs_read+0x37/0x140 ? security_file_permission+0xa0/0xc0 vfs_read+0x96/0x140 SyS_read+0x58/0xc0 do_syscall_64+0x5a/0x190 entry_SYSCALL64_slow_path+0x25/0x25 RIP: 0033:0x7f946bbc97e0 RSP: 002b:00007ffdd0c4ae08 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000000000096b000 RCX: 00007f946bbc97e0 RDX: 000000000096b000 RSI: 00007f946a2f0000 RDI: 0000000000000004 RBP: 0000000000001000 R08: 00007f946a2ef011 R09: 000000000000000a R10: 0000000000001000 R11: 0000000000000246 R12: 00007f946a2f0000 R13: 0000000000000004 R14: 0000000000000000 R15: 00007f946a2f0000 Code: b9 08 00 00 00 49 89 c6 48 89 df 31 c0 4d 8d ae d8 00 00 00 f3 48 ab 4c 89 ef e8 6c 9a 56 00 49 8b 96 30 01 00 00 48 85 d2 74 3f <48> 8b 0a 48 89 4d 98 48 8b 4a 08 48 89 4d a0 48 8b 4a 10 48 89 RIP: irq_affinity_hint_proc_show+0x60/0xf0 RSP: ffffb16e659dbd20
CR2: ffffb16e600e7c90
--- drivers/infiniband/hw/i40iw/i40iw.h | 1 + drivers/infiniband/hw/i40iw/i40iw_main.c | 7 +++---- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/infiniband/hw/i40iw/i40iw.h +1 -0
@@ -210,6 +210,7 @@ struct i40iw_msix_vector {u32 irq;u32 cpu_affinity;u32 ceq_id; +cpumask_t mask; };struct l2params_work {
drivers/infiniband/hw/i40iw/i40iw_main.c +3 -4
@@ -676,7 +676,6 @@ static enum i40iw_status_code i40iw_conf struct i40iw_msix_vector *msix_vec) {enum i40iw_status_code status; -cpumask_t mask;if (iwdev->msix_shared && !ceq_id) {tasklet_init (&iwdev->dpc_tasklet, i40iw_dpc, (unsigned long )iwdev);
@@ -686,9 +685,9 @@ static enum i40iw_status_code i40iw_conf status =request_irq (msix_vec->irq, i40iw_ceq_handler,0 ,"CEQ" , iwceq); } -cpumask_clear (&mask); -cpumask_set_cpu (msix_vec->cpu_affinity, &mask); -irq_set_affinity_hint (msix_vec->irq, &mask); +cpumask_clear (&msix_vec->mask); +cpumask_set_cpu (msix_vec->cpu_affinity, &msix_vec->mask); +irq_set_affinity_hint (msix_vec->irq, &msix_vec->mask);if (status) {i40iw_pr_err ("ceq irq config fail\n" );
Greg Kroah-Hartman
maintainerPATCH 299/323 kobject_uevent: remove warning in init_uevent_argv()
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit b4104180a2efb85f55e1ba1407885c9421970338 upstream.
syzbot can trigger the WARN() in init_uevent_argv() which isn't the nicest as the code does properly recover and handle the error. So change the WARN() call to pr_warn() and provide some more information on what the buffer size that was needed.
--- lib/kobject_uevent.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
lib/kobject_uevent.c +5 -4
@@ -271,12 +271,13 @@ static int kobj_usermode_filter(struct kstatic int init_uevent_argv (struct kobj_uevent_env *env,const char *subsystem) { +int buffer_size =sizeof (env->buf) - env->buflen;int len; - len =strlcpy (&env->buf[env->buflen], subsystem, -sizeof (env->buf) - env->buflen); -if (len >= (sizeof (env->buf) - env->buflen)) { -WARN (1 ,KERN_ERR "init_uevent_argv: buffer size too small\n" ); + len =strlcpy (&env->buf[env->buflen], subsystem, buffer_size); +if (len >= buffer_size) { +pr_warn ("init_uevent_argv: buffer size of %d too small, needed %d\n" , + buffer_size, len);return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 300/323 netfilter: conntrack: Make global sysctls readonly in non-init netns
In reply to Greg Kroah-HartmanFrom: Jonathon Reinhart <[email protected]>
commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.
These sysctls point to global variables:
- NF_SYSCTL_CT_MAX (&nf_conntrack_max)
- NF_SYSCTL_CT_EXPECT_MAX (&nf_ct_expect_max)
- NF_SYSCTL_CT_BUCKETS (&nf_conntrack_htable_size_user)
Because their data pointers are not updated to point to per-netns structures, they must be marked read-only in a non-init_net ns. Otherwise, changes in any net namespace are reflected in (leaked into) all other net namespaces. This problem has existed since the introduction of net namespaces.
The current logic marks them read-only only if the net namespace is owned by an unprivileged user (other than init_user_ns).
Commit d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces") "exposes all sysctls even if the namespace is unpriviliged." Since we need to mark them readonly in any case, we can forego the unprivileged user check altogether.
--- net/netfilter/nf_conntrack_standalone.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_standalone.c +4 -1
@@ -631,8 +631,11 @@ static int nf_conntrack_standalone_init_if (net->user_ns != &init_user_ns) table[0 ].procname =NULL ; -if (!net_eq (&init_net, net)) +if (!net_eq (&init_net, net)) { + table[0 ].mode =0444 ; table[2 ].mode =0444 ; + table[5 ].mode =0444 ; + } net->ct.sysctl_header =register_net_sysctl (net,"net/netfilter" , table);if (!net->ct.sysctl_header)
Greg Kroah-Hartman
maintainerPATCH 301/323 clk: exynos7: Mark aclk_fsys1_200 as critical
In reply to Greg Kroah-HartmanFrom: Paweł Chmiel <[email protected]>
commit 34138a59b92c1a30649a18ec442d2e61f3bc34dd upstream.
This clock must be always enabled to allow access to any registers in fsys1 CMU. Until proper solution based on runtime PM is applied (similar to what was done for Exynos5433), mark that clock as critical so it won't be disabled.
It was observed on Samsung Galaxy S6 device (based on Exynos7420), where UFS module is probed before pmic used to power that device. In this case defer probe was happening and that clock was disabled by UFS driver, causing whole boot to hang on next CMU access.
--- drivers/clk/samsung/clk-exynos7.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/clk/samsung/clk-exynos7.c +6 -1
@@ -541,8 +541,13 @@ static const struct samsung_gate_clock tGATE (CLK_ACLK_FSYS0_200 ,"aclk_fsys0_200" ,"dout_aclk_fsys0_200" ,ENABLE_ACLK_TOP13 ,28 ,CLK_SET_RATE_PARENT |CLK_IS_CRITICAL ,0 ), +/* +* This clock is required for the CMU_FSYS1 registers access, keep it +* enabled permanently until proper runtime PM support is added. +*/ GATE (CLK_ACLK_FSYS1_200 ,"aclk_fsys1_200" ,"dout_aclk_fsys1_200" , -ENABLE_ACLK_TOP13 ,24 ,CLK_SET_RATE_PARENT ,0 ), +ENABLE_ACLK_TOP13 ,24 ,CLK_SET_RATE_PARENT | +CLK_IS_CRITICAL ,0 ), GATE(CLK_SCLK_PHY_FSYS1_26M, "sclk_phy_fsys1_26m", "dout_sclk_phy_fsys1_26m", ENABLE_SCLK_TOP1_FSYS11,
Greg Kroah-Hartman
maintainerPATCH 302/323 x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 396a66aa1172ef2b78c21651f59b40b87b2e5e1e upstream.
gcc-11 warns about mismatched prototypes here:
arch/x86/lib/msr-smp.c:255:51: error: argument 2 of type ‘u32 *’ {aka ‘unsigned int *’} declared as a pointer [-Werror=array-parameter=]
255 | int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
| ~~~~~^~~~
arch/x86/include/asm/msr.h:347:50: note: previously declared as an array ‘u32[8]’ {aka ‘unsigned int[8]’}
GCC is right here - fix up the types.
[ mingo: Twiddled the changelog. ]
--- arch/x86/lib/msr-smp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/lib/msr-smp.c +2 -2
@@ -240,7 +240,7 @@ static void __wrmsr_safe_regs_on_cpu(voi rv->err =wrmsr_safe_regs (rv->regs); } -int rdmsr_safe_regs_on_cpu (unsigned int cpu,u32 *regs) +int rdmsr_safe_regs_on_cpu (unsigned int cpu,u32 regs[8 ]) {int err;struct msr_regs_info rv;
@@ -253,7 +253,7 @@ int rdmsr_safe_regs_on_cpu(unsigned int }EXPORT_SYMBOL (rdmsr_safe_regs_on_cpu); -int wrmsr_safe_regs_on_cpu (unsigned int cpu,u32 *regs) +int wrmsr_safe_regs_on_cpu (unsigned int cpu,u32 regs[8 ]) {int err;struct msr_regs_info rv;
Greg Kroah-Hartman
maintainerPATCH 303/323 kgdb: fix gcc-11 warning on indentation
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 40cc3a80bb42587db1e6ae21d6f3090582d33e89 upstream.
gcc-11 starts warning about misleading indentation inside of macros:
drivers/misc/kgdbts.c: In function ‘kgdbts_break_test’:drivers/misc/kgdbts.c:103:9: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
103 | if (verbose > 1) \
| ^~
drivers/misc/kgdbts.c:200:9: note: in expansion of macro ‘v2printk’
200 | v2printk("kgdbts: breakpoint complete\n");
| ^~~~~~~~
drivers/misc/kgdbts.c:105:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’
105 | touch_nmi_watchdog(); \
| ^~~~~~~~~~~~~~~~~~The code looks correct to me, so just reindent it for readability.
--- drivers/misc/kgdbts.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/misc/kgdbts.c +13 -13
@@ -107,19 +107,19 @@#include <asm/sections.h> -#define v1printk(a...) do { \ - if (verbose) \ - printk(KERN_INFO a); \ - } while (0) -#define v2printk(a...) do { \ - if (verbose > 1) \ - printk(KERN_INFO a); \ - touch_nmi_watchdog(); \ - } while (0) -#define eprintk(a...) do { \ - printk(KERN_ERR a); \ - WARN_ON(1); \ - } while (0) +#define v1printk(a...) do { \ + if (verbose) \ + printk(KERN_INFO a); \ +} while (0) +#define v2printk(a...) do { \ + if (verbose > 1) \ + printk(KERN_INFO a); \ + touch_nmi_watchdog(); \ +} while (0) +#define eprintk(a...) do { \ + printk(KERN_ERR a); \ + WARN_ON(1); \ +} while (0)#define MAX_CONFIG_LEN 40static struct kgdb_io kgdbts_io_ops;
Greg Kroah-Hartman
maintainerPATCH 304/323 usb: sl811-hcd: improve misleading indentation
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 8460f6003a1d2633737b89c4f69d6f4c0c7c65a3 upstream.
gcc-11 now warns about a confusingly indented code block:
drivers/usb/host/sl811-hcd.c: In function ‘sl811h_hub_control’:drivers/usb/host/sl811-hcd.c:1291:9: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
1291 | if (*(u16*)(buf+2)) /* only if wPortChange is interesting */
| ^~drivers/usb/host/sl811-hcd.c:1295:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’
1295 | break;
Rewrite this to use a single if() block with the __is_defined() macro.
--- drivers/usb/host/sl811-hcd.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/usb/host/sl811-hcd.c +4 -5
@@ -1286,11 +1286,10 @@ sl811h_hub_control( goto error;put_unaligned_le32 (sl811->port1, buf); -#ifndef VERBOSE - if (*(u16*)(buf+2)) /* only if wPortChange is interesting */ -#endif -dev_dbg (hcd->self.controller,"GetPortStatus %08x\n" , - sl811->port1); +if (__is_defined (VERBOSE ) || + *(u16 *)(buf+2 ))/* only if wPortChange is interesting */ +dev_dbg (hcd->self.controller,"GetPortStatus %08x\n" , + sl811->port1);break ;case SetPortFeature:if (wIndex !=1 || wLength !=0 )
Greg Kroah-Hartman
maintainerPATCH 305/323 cxgb4: Fix the -Wmisleading-indentation warning
In reply to Greg Kroah-HartmanFrom: Kaixu Xia <[email protected]>
commit ea8146c6845799142aa4ee2660741c215e340cdf upstream.
Fix the gcc warning:
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c:2673:9: warning: this 'for' clause does not guard... [-Wmisleading-indentation]
2673 | for (i = 0; i < n; ++i) \
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +1 -1
@@ -2446,7 +2446,7 @@ do { \seq_printf (seq,"%-12s" , s); \for (i =0 ; i < n; ++i) \seq_printf (seq," %16" fmt_spec, v); \ -seq_putc (seq,'\n' ); \ +seq_putc (seq,'\n' ); \ } while (0)#define S (s, v) S3("s", s, v)#define T3 (fmt_spec, s, v) S3(fmt_spec, s, tx[i].v)
Greg Kroah-Hartman
maintainerPATCH 306/323 isdn: capi: fix mismatched prototypes
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 5ee7d4c7fbc9d3119a20b1c77d34003d1f82ac26 upstream.
gcc-11 complains about a prototype declaration that is different from the function definition:
drivers/isdn/capi/kcapi.c:724:44: error: argument 2 of type ‘u8 *’ {aka ‘unsigned char *’} declared as a pointer [-Werror=array-parameter=]
724 | u16 capi20_get_manufacturer(u32 contr, u8 *buf)
| ~~~~^~~
In file included from drivers/isdn/capi/kcapi.c:13:drivers/isdn/capi/kcapi.h:62:43: note: previously declared as an array ‘u8[64]’ {aka ‘unsigned char[64]’}
62 | u16 capi20_get_manufacturer(u32 contr, u8 buf[CAPI_MANUFACTURER_LEN]);
| ~~~^~~~~~~~~~~~~~~~~~~~~~~~~~drivers/isdn/capi/kcapi.c:790:38: error: argument 2 of type ‘u8 *’ {aka ‘unsigned char *’} declared as a pointer [-Werror=array-parameter=]
790 | u16 capi20_get_serial(u32 contr, u8 *serial)
| ~~~~^~~~~~
In file included from drivers/isdn/capi/kcapi.c:13:drivers/isdn/capi/kcapi.h:64:37: note: previously declared as an array ‘u8[8]’ {aka ‘unsigned char[8]’}
64 | u16 capi20_get_serial(u32 contr, u8 serial[CAPI_SERIAL_LEN]);
| ~~~^~~~~~~~~~~~~~~~~~~~~~~Change the definition to make them match.
--- drivers/isdn/capi/kcapi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/isdn/capi/kcapi.c +2 -2
@@ -845,7 +845,7 @@ EXPORT_SYMBOL(capi20_put_message);* Return value: CAPI result code */ -u16 capi20_get_manufacturer (u32 contr,u8 *buf) +u16 capi20_get_manufacturer (u32 contr,u8 buf[CAPI_MANUFACTURER_LEN ]) {struct capi_ctr *ctr;u16 ret;
@@ -915,7 +915,7 @@ EXPORT_SYMBOL(capi20_get_version);* Return value: CAPI result code */ -u16 capi20_get_serial (u32 contr,u8 *serial) +u16 capi20_get_serial (u32 contr,u8 serial[CAPI_SERIAL_LEN ]) {struct capi_ctr *ctr;u16 ret;
Greg Kroah-Hartman
maintainerPATCH 307/323 ARM: 9058/1: cache-v7: refactor v7_invalidate_l1 to avoid clobbering r5/r6
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit f9e7a99fb6b86aa6a00e53b34ee6973840e005aa ]
The cache invalidation code in v7_invalidate_l1 can be tweaked to re-read the associativity from CCSIDR, and keep the way identifier component in a single register that is assigned in the outer loop. This way, we need 2 registers less.
Given that the number of sets is typically much larger than the associativity, rearrange the code so that the outer loop has the fewer number of iterations, ensuring that the re-read of CCSIDR only occurs a handful of times in practice.
Fix the whitespace while at it, and update the comment to indicate that this code is no longer a clone of anything else.
--- arch/arm/mm/cache-v7.S | 51 +++++++++++++++++++++--------------------- 1 file changed, 25 insertions(+), 26 deletions(-)
arch/arm/mm/cache-v7.S +25 -26
@@ -27,41 +27,40 @@ * processor. We fix this by performing an invalidate, rather than a * clean + invalidate, before jumping into the kernel. * - * This function is cloned from arch/arm/mach-tegra/headsmp.S, and needs - * to be called for both secondary cores startup and primary core resume - * procedures. + * This function needs to be called for both secondary cores startup and + * primary core resume procedures. */ ENTRY(v7_invalidate_l1) mov r0, #0 mcr p15, 2, r0, c0, c0, 0 mrc p15, 1, r0, c0, c0, 0 - movw r1, #0x7fff - and r2, r1, r0, lsr #13 + movw r3, #0x3ff + and r3, r3, r0, lsr #3 @ 'Associativity' in CCSIDR[12:3] + clz r1, r3 @ WayShift + mov r2, #1 + mov r3, r3, lsl r1 @ NumWays-1 shifted into bits [31:...] + movs r1, r2, lsl r1 @ #1 shifted left by same amount + moveq r1, #1 @ r1 needs value > 0 even if only 1 way - movw r1, #0x3ff + and r2, r0, #0x7 + add r2, r2, #4 @ SetShift - and r3, r1, r0, lsr #3 @ NumWays - 1 - add r2, r2, #1 @ NumSets +1: movw r4, #0x7fff + and r0, r4, r0, lsr #13 @ 'NumSets' in CCSIDR[27:13] - and r0, r0, #0x7 - add r0, r0, #4 @ SetShift - - clz r1, r3 @ WayShift - add r4, r3, #1 @ NumWays -1: sub r2, r2, #1 @ NumSets-- - mov r3, r4 @ Temp = NumWays -2: subs r3, r3, #1 @ Temp-- - mov r5, r3, lsl r1 - mov r6, r2, lsl r0 - orr r5, r5, r6 @ Reg = (Temp<<WayShift)|(NumSets<<SetShift) - mcr p15, 0, r5, c7, c6, 2 - bgt 2b - cmp r2, #0 - bgt 1b - dsb st - isb - ret lr +2: mov r4, r0, lsl r2 @ NumSet << SetShift + orr r4, r4, r3 @ Reg = (Temp<<WayShift)|(NumSets<<SetShift) + mcr p15, 0, r4, c7, c6, 2 + subs r0, r0, #1 @ Set-- + bpl 2b + subs r3, r3, r1 @ Way-- + bcc 3f + mrc p15, 1, r0, c0, c0, 0 @ re-read cache geometry from CCSIDR + b 1b +3: dsb st + isb + ret lr ENDPROC(v7_invalidate_l1) /*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 308/323 PCI: thunder: Fix compile testing
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 16f7ae5906dfbeff54f74ec75d0563bb3a87ab0b ]
Compile-testing these drivers is currently broken. Enabling it causes a couple of build failures though:
drivers/pci/controller/pci-thunder-ecam.c:119:30: error: shift count >= width of type [-Werror,-Wshift-count-overflow] drivers/pci/controller/pci-thunder-pem.c:54:2: error: implicit declaration of function 'writeq' [-Werror,-Wimplicit-function-declaration] drivers/pci/controller/pci-thunder-pem.c:392:8: error: implicit declaration of function 'acpi_get_rc_resources' [-Werror,-Wimplicit-function-declaration]
Fix them with the obvious one-line changes.
--- drivers/pci/host/pci-thunder-ecam.c | 2 +- drivers/pci/host/pci-thunder-pem.c | 13 +++++++------ drivers/pci/pci.h | 6 ++++++ 3 files changed, 14 insertions(+), 7 deletions(-)
drivers/pci/host/pci-thunder-ecam.c +1 -1
@@ -119,7 +119,7 @@ static int thunder_ecam_p2_config_read(struct pci_bus *bus, unsigned int devfn,* the config space access window. Since we are working with * the high-order 32 bits, shift everything down by 32 bits. */ - node_bits = (cfg->res.start >>32 ) & (1 <<12 ); + node_bits =upper_32_bits (cfg->res.start) & (1 <<12 ); v |= node_bits;set_val (v, where, size, val);
drivers/pci/host/pci-thunder-pem.c +7 -6
@@ -22,6 +22,7 @@#include <linux/pci-acpi.h> #include <linux/pci-ecam.h> #include <linux/platform_device.h> +#include <linux/io-64-nonatomic-lo-hi.h> #include "../pci.h" #if defined(CONFIG_PCI_HOST_THUNDER_PEM ) || (defined(CONFIG_ACPI ) && defined(CONFIG_PCI_QUIRKS ))
@@ -325,9 +326,9 @@ static int thunder_pem_init(struct device *dev, struct pci_config_window *cfg,* structure here for the BAR. */ bar4_start = res_pem->start +0xf00000 ; - pem_pci->ea_entry[0 ] = (u32 )bar4_start |2 ; - pem_pci->ea_entry[1 ] = (u32)(res_pem->end - bar4_start) & ~3u ; - pem_pci->ea_entry[2 ] = (u32)(bar4_start >>32 ); + pem_pci->ea_entry[0 ] =lower_32_bits (bar4_start) |2 ; + pem_pci->ea_entry[1 ] =lower_32_bits (res_pem->end - bar4_start) & ~3u ; + pem_pci->ea_entry[2 ] =upper_32_bits (bar4_start); cfg->priv = pem_pci;return 0 ;
@@ -335,9 +336,9 @@ static int thunder_pem_init(struct device *dev, struct pci_config_window *cfg,#if defined(CONFIG_ACPI ) && defined(CONFIG_PCI_QUIRKS ) -#define PEM_RES_BASE 0x87e0c0000000UL -#define PEM_NODE_MASK GENMASK(45, 44) -#define PEM_INDX_MASK GENMASK(26, 24) +#define PEM_RES_BASE 0x87e0c0000000ULL +#define PEM_NODE_MASK GENMASK_ULL(45, 44) +#define PEM_INDX_MASK GENMASK_ULL(26, 24)#define PEM_MIN_DOM_IN_NODE 4#define PEM_MAX_DOM_IN_NODE 10
drivers/pci/pci.h +6 -0
@@ -365,6 +365,12 @@ static inline int pci_dev_specific_reset(struct pci_dev *dev, int probe)#if defined(CONFIG_PCI_QUIRKS ) && defined(CONFIG_ARM64 )int acpi_get_rc_resources (struct device *dev,const char *hid,u16 segment,struct resource *res); +#else +static inline int acpi_get_rc_resources (struct device *dev,const char *hid, +u16 segment,struct resource *res) +{ +return -ENODEV ; +}#endif #endif /* DRIVERS_PCI_H */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 309/323 ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend()
In reply to Greg Kroah-HartmanFrom: louis.wang <[email protected]>
[ Upstream commit 8252ca87c7a2111502ee13994956f8c309faad7f ]
Enabling function_graph tracer on ARM causes kernel panic, because the function graph tracer updates the "return address" of a function in order to insert a trace callback on function exit, it saves the function's original return address in a return trace stack, but cpu_suspend() may not return through the normal return path.
cpu_suspend() will resume directly via the cpu_resume path, but the return trace stack has been set-up by the subfunctions of cpu_suspend(), which makes the "return address" inconsistent with cpu_suspend().
This patch refers to Commit de818bd4522c40ea02a81b387d2fa86f989c9623 ("arm64: kernel: pause/unpause function graph tracer in cpu_suspend()"),
fixes the issue by pausing/resuming the function graph tracer on the thread executing cpu_suspend(), so that the function graph tracer state is kept consistent across functions that enter power down states and never return by effectively disabling graph tracer while they are executing.
--- arch/arm/kernel/suspend.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
arch/arm/kernel/suspend.c +18 -1
@@ -1,4 +1,5 @@// SPDX-License-Identifier: GPL-2.0 +#include <linux/ftrace.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/mm_types.h>
@@ -26,6 +27,13 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))if (!idmap_pgd)return -EINVAL ; +/* +* Function graph tracer state gets incosistent when the kernel +* calls functions that never return (aka suspend finishers) hence +* disable graph tracing during their execution. +*/ +pause_graph_tracing (); +/* * Provide a temporary page table with an identity mapping for * the MMU-enable code, required for resuming. On successful
@@ -33,6 +41,9 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))* back to the correct page tables. */ ret =__cpu_suspend (arg, fn, __mpidr); + +unpause_graph_tracing (); +if (ret ==0 ) {cpu_switch_mm (mm->pgd, mm);local_flush_bp_all ();
@@ -46,7 +57,13 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))int cpu_suspend (unsigned long arg,int (*fn)(unsigned long )) {u32 __mpidr =cpu_logical_map (smp_processor_id ()); -return __cpu_suspend (arg, fn, __mpidr); +int ret; + +pause_graph_tracing (); + ret =__cpu_suspend (arg, fn, __mpidr); +unpause_graph_tracing (); + +return ret; }#define idmap_pgd NULL#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 310/323 ACPI / hotplug / PCI: Fix reference count leak in enable_slot()
In reply to Greg Kroah-HartmanFrom: Feilong Lin <[email protected]>
[ Upstream commit 3bbfd319034ddce59e023837a4aa11439460509b ]
In enable_slot(), if pci_get_slot() returns NULL, we clear the SLOT_ENABLED flag. When pci_get_slot() finds a device, it increments the device's reference count. In this case, we did not call pci_dev_put() to decrement the reference count, so the memory of the device (struct pci_dev type) will eventually leak.
Call pci_dev_put() to decrement its reference count when pci_get_slot() returns a PCI device.
--- drivers/pci/hotplug/acpiphp_glue.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/hotplug/acpiphp_glue.c +1 -0
@@ -509,6 +509,7 @@ static void enable_slot(struct acpiphp_slot *slot) slot->flags &= (~SLOT_ENABLED );continue ; } +pci_dev_put (dev); } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 311/323 Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 65299e8bfb24774e6340e93ae49f6626598917c8 ]
Several users have been reporting that elants_i2c gives several errors during probe and that their touchscreen does not work on their Lenovo AMD based laptops with a touchscreen with a ELAN0001 ACPI hardware-id:
[ 0.550596] elants_i2c i2c-ELAN0001:00: i2c-ELAN0001:00 supply vcc33 not found, using dummy regulator [ 0.551836] elants_i2c i2c-ELAN0001:00: i2c-ELAN0001:00 supply vccio not found, using dummy regulator [ 0.560932] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 [ 0.562427] elants_i2c i2c-ELAN0001:00: software reset failed: -121 [ 0.595925] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 [ 0.597974] elants_i2c i2c-ELAN0001:00: software reset failed: -121 [ 0.621893] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (77 77 77 77): -121 [ 0.622504] elants_i2c i2c-ELAN0001:00: software reset failed: -121 [ 0.632650] elants_i2c i2c-ELAN0001:00: elants_i2c_send failed (4d 61 69 6e): -121 [ 0.634256] elants_i2c i2c-ELAN0001:00: boot failed: -121 [ 0.699212] elants_i2c i2c-ELAN0001:00: invalid 'hello' packet: 00 00 ff ff [ 1.630506] elants_i2c i2c-ELAN0001:00: Failed to read fw id: -121 [ 1.645508] elants_i2c i2c-ELAN0001:00: unknown packet 00 00 ff ff
Despite these errors, the elants_i2c driver stays bound to the device (it returns 0 from its probe method despite the errors), blocking the i2c-hid driver from binding.
Manually unbinding the elants_i2c driver and binding the i2c-hid driver makes the touchscreen work.
Check if the ACPI-fwnode for the touchscreen contains one of the i2c-hid compatiblity-id strings and if it has the I2C-HID spec's DSM to get the HID descriptor address, If it has both then make elants_i2c not bind, so that the i2c-hid driver can bind.
This assumes that non of the (older) elan touchscreens which actually need the elants_i2c driver falsely advertise an i2c-hid compatiblity-id
+ DSM in their ACPI-fwnodes. If some of them actually do have this false advertising, then this change may lead to regressions.
While at it also drop the unnecessary DEVICE_NAME prefixing of the "I2C check functionality error", dev_err already outputs the driver-name.
--- drivers/input/touchscreen/elants_i2c.c | 44 ++++++++++++++++++++++++-- 1 file changed, 42 insertions(+), 2 deletions(-)
drivers/input/touchscreen/elants_i2c.c +42 -2
@@ -40,6 +40,7 @@#include <linux/of.h> #include <linux/gpio/consumer.h> #include <linux/regulator/consumer.h> +#include <linux/uuid.h> #include <asm/unaligned.h> /* Device, Driver information */
@@ -1138,6 +1139,40 @@ static void elants_i2c_power_off(void *_data) } } +#ifdef CONFIG_ACPI +static const struct acpi_device_id i2c_hid_ids[] = { + {"ACPI0C50" ,0 }, + {"PNP0C50" ,0 }, + { }, +}; + +static const guid_t i2c_hid_guid = +GUID_INIT (0x3CDFF6F7 ,0x4267 ,0x4555 , +0xAD ,0x05 ,0xB3 ,0x0A ,0x3D ,0x89 ,0x38 ,0xDE ); + +static bool elants_acpi_is_hid_device (struct device *dev) +{ +acpi_handle handle =ACPI_HANDLE (dev); +union acpi_object *obj; + +if (acpi_match_device_ids (ACPI_COMPANION (dev), i2c_hid_ids)) +return false; + + obj =acpi_evaluate_dsm_typed (handle, &i2c_hid_guid,1 ,1 ,NULL ,ACPI_TYPE_INTEGER ); +if (obj) { +ACPI_FREE (obj); +return true; + } + +return false; +} +#else +static bool elants_acpi_is_hid_device (struct device *dev) +{ +return false; +} +#endif +static int elants_i2c_probe (struct i2c_client *client,const struct i2c_device_id *id) {
@@ -1146,9 +1181,14 @@ static int elants_i2c_probe(struct i2c_client *client,unsigned long irqflags;int error; +/* Don't bind to i2c-hid compatible devices, these are handled by the i2c-hid drv. */ +if (elants_acpi_is_hid_device (&client->dev)) { +dev_warn (&client->dev,"This device appears to be an I2C-HID device, not binding\n" ); +return -ENODEV ; + } +if (!i2c_check_functionality (client->adapter,I2C_FUNC_I2C )) { -dev_err (&client->dev, -"%s: i2c check functionality error\n" ,DEVICE_NAME ); +dev_err (&client->dev,"I2C check functionality error\n" );return -ENXIO ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 312/323 Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit e479187748a8f151a85116a7091c599b121fdea5 ]
Some buggy BIOS-es bring up the touchscreen-controller in a stuck state where it blocks the I2C bus. Specifically this happens on the Jumper EZpad 7 tablet model.
After much poking at this problem I have found that the following steps are necessary to unstuck the chip / bus:
1. Turn off the Silead chip.
2. Try to do an I2C transfer with the chip, this will fail in response to which the I2C-bus-driver will call: i2c_recover_bus() which will unstuck the I2C-bus. Note the unstuck-ing of the I2C bus only works if we first drop the chip of the bus by turning it off.
3. Turn the chip back on.
On the x86/ACPI systems were this problem is seen, step 1. and 3. require making ACPI calls and dealing with ACPI Power Resources. This commit adds a workaround which runtime-suspends the chip to turn it off, leaving it up to the ACPI subsystem to deal with all the ACPI specific details.
There is no good way to detect this bug, so the workaround gets activated by a new "silead,stuck-controller-bug" boolean device-property. Since this is only used on x86/ACPI, this will be set by model specific device-props set by drivers/platform/x86/touchscreen_dmi.c. Therefor this new device-property is not documented in the DT-bindings.
Dmesg will contain the following messages on systems where the workaround is activated:
[ 54.309029] silead_ts i2c-MSSL1680:00: [Firmware Bug]: Stuck I2C bus: please ignore the next 'controller timed out' error [ 55.373593] i2c_designware 808622C1:04: controller timed out [ 55.582186] silead_ts i2c-MSSL1680:00: Silead chip ID: 0x80360000
--- drivers/input/touchscreen/silead.c | 44 +++++++++++++++++++++++++++--- 1 file changed, 40 insertions(+), 4 deletions(-)
drivers/input/touchscreen/silead.c +40 -4
@@ -28,6 +28,7 @@#include <linux/input/mt.h> #include <linux/input/touchscreen.h> #include <linux/pm.h> +#include <linux/pm_runtime.h> #include <linux/irq.h> #include <linux/regulator/consumer.h>
@@ -319,10 +320,8 @@ static int silead_ts_get_id(struct i2c_client *client) error =i2c_smbus_read_i2c_block_data (client,SILEAD_REG_ID ,sizeof (chip_id), (u8 *)&chip_id); -if (error <0 ) { -dev_err (&client->dev,"Chip ID read error %d\n" , error); +if (error <0 )return error; - } data->chip_id =le32_to_cpu (chip_id);dev_info (&client->dev,"Silead chip ID: 0x%8X" , data->chip_id);
@@ -335,12 +334,49 @@ static int silead_ts_setup(struct i2c_client *client)int error;u32 status; +/* +* Some buggy BIOS-es bring up the chip in a stuck state where it +* blocks the I2C bus. The following steps are necessary to +* unstuck the chip / bus: +* 1. Turn off the Silead chip. +* 2. Try to do an I2C transfer with the chip, this will fail in +* response to which the I2C-bus-driver will call: +* i2c_recover_bus() which will unstuck the I2C-bus. Note the +* unstuck-ing of the I2C bus only works if we first drop the +* chip off the bus by turning it off. +* 3. Turn the chip back on. +* +* On the x86/ACPI systems were this problem is seen, step 1. and +* 3. require making ACPI calls and dealing with ACPI Power +* Resources. The workaround below runtime-suspends the chip to +* turn it off, leaving it up to the ACPI subsystem to deal with +* this. +*/ + +if (device_property_read_bool (&client->dev, +"silead,stuck-controller-bug" )) { +pm_runtime_set_active (&client->dev); +pm_runtime_enable (&client->dev); +pm_runtime_allow (&client->dev); + +pm_runtime_suspend (&client->dev); + +dev_warn (&client->dev,FW_BUG "Stuck I2C bus: please ignore the next 'controller timed out' error\n" ); +silead_ts_get_id (client); + +/* The forbid will also resume the device */ +pm_runtime_forbid (&client->dev); +pm_runtime_disable (&client->dev); + } +silead_ts_set_power (client,SILEAD_POWER_OFF );silead_ts_set_power (client,SILEAD_POWER_ON ); error =silead_ts_get_id (client); -if (error) +if (error) { +dev_err (&client->dev,"Chip ID read error %d\n" , error);return error; + } error =silead_ts_init (client);if (error)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 313/323 um: Mark all kernel symbols as local
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit d5027ca63e0e778b641cf23e3f5c6d6212cf412b ]
Ritesh reported a bug [1] against UML, noting that it crashed on startup. The backtrace shows the following (heavily redacted):
(gdb) bt
...
#26 0x0000000060015b5d in sem_init () at ipc/sem.c:268
#27 0x00007f89906d92f7 in ?? () from /lib/x86_64-linux-gnu/libcom_err.so.2 #28 0x00007f8990ab8fb2 in call_init (...) at dl-init.c:72
...
#40 0x00007f89909bf3a6 in nss_load_library (...) at nsswitch.c:359
...
#44 0x00007f8990895e35 in _nss_compat_getgrnam_r (...) at nss_compat/compat-grp.c:486 #45 0x00007f8990968b85 in __getgrnam_r [...]
#46 0x00007f89909d6b77 in grantpt [...]
#47 0x00007f8990a9394e in __GI_openpty [...]
#48 0x00000000604a1f65 in openpty_cb (...) at arch/um/os-Linux/sigio.c:407 #49 0x00000000604a58d0 in start_idle_thread (...) at arch/um/os-Linux/skas/process.c:598 #50 0x0000000060004a3d in start_uml () at arch/um/kernel/skas/process.c:45 #51 0x00000000600047b2 in linux_main (...) at arch/um/kernel/um_arch.c:334 #52 0x000000006000574f in main (...) at arch/um/os-Linux/main.c:144
indicating that the UML function openpty_cb() calls openpty(), which internally calls __getgrnam_r(), which causes the nsswitch machinery to get started.
This loads, through lots of indirection that I snipped, the libcom_err.so.2 library, which (in an unknown function, "??") calls sem_init().
Now, of course it wants to get libpthread's sem_init(), since it's linked against libpthread. However, the dynamic linker looks up that symbol against the binary first, and gets the kernel's sem_init().
Hajime Tazaki noted that "objcopy -L" can localize a symbol, so the dynamic linker wouldn't do the lookup this way. I tried, but for some reason that didn't seem to work.
Doing the same thing in the linker script instead does seem to work, though I cannot entirely explain - it *also* works if I just add "VERSION { { global: *; }; }" instead, indicating that something else is happening that I don't really understand. It may be that explicitly doing that marks them with some kind of empty version, and that's different from the default.
Explicitly marking them with a version breaks kallsyms, so that doesn't seem to be possible.
Marking all the symbols as local seems correct, and does seem to address the issue, so do that. Also do it for static link, nsswitch libraries could still be loaded there.
[1] https://bugs.debian.org/983379
--- arch/um/kernel/dyn.lds.S | 6 ++++++ arch/um/kernel/uml.lds.S | 6 ++++++ 2 files changed, 12 insertions(+)
arch/um/kernel/dyn.lds.S +6 -0
@@ -7,6 +7,12 @@ OUTPUT_ARCH(ELF_ARCH) ENTRY(_start) jiffies = jiffies_64; +VERSION { + { + local: *; + }; +} + SECTIONS { PROVIDE (__executable_start = START);
arch/um/kernel/uml.lds.S +6 -0
@@ -7,6 +7,12 @@ OUTPUT_ARCH(ELF_ARCH) ENTRY(_start) jiffies = jiffies_64; +VERSION { + { + local: *; + }; +} + SECTIONS { /* This must contain the right address - not quite the default ELF one.*/
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 314/323 ceph: fix fscache invalidation
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
[ Upstream commit 10a7052c7868bc7bc72d947f5aac6f768928db87 ]
Ensure that we invalidate the fscache whenever we invalidate the pagecache.
--- fs/ceph/caps.c | 1 + fs/ceph/inode.c | 1 + 2 files changed, 2 insertions(+)
fs/ceph/caps.c +1 -0
@@ -1662,6 +1662,7 @@ static int try_nonblocking_invalidate(struct inode *inode)u32 invalidating_gen = ci->i_rdcache_gen;spin_unlock (&ci->i_ceph_lock); +ceph_fscache_invalidate (inode);invalidate_mapping_pages (&inode->i_data,0 ,-1 );spin_lock (&ci->i_ceph_lock);
fs/ceph/inode.c +1 -0
@@ -1757,6 +1757,7 @@ static void ceph_invalidate_work(struct work_struct *work) orig_gen = ci->i_rdcache_gen;spin_unlock (&ci->i_ceph_lock); +ceph_fscache_invalidate (inode);if (invalidate_inode_pages2 (inode->i_mapping) <0 ) {pr_err ("invalidate_pages %p fails\n" , inode); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 315/323 gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit da91ece226729c76f60708efc275ebd4716ad089 ]
Like some other Bay and Cherry Trail SoC based devices the Dell Venue 10 Pro 5055 has an embedded-controller which uses ACPI GPIO events to report events instead of using the standard ACPI EC interface for this.
The EC interrupt is only used to report battery-level changes and it keeps doing this while the system is suspended, causing the system to not stay suspended.
Add an ignore-wake quirk for the GPIO pin used by the EC to fix the spurious wakeups from suspend.
--- drivers/gpio/gpiolib-acpi.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpio/gpiolib-acpi.c +14 -0
@@ -1404,6 +1404,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = { .no_edge_events_on_boot = true, }, }, + { +/* +* The Dell Venue 10 Pro 5055, with Bay Trail SoC + TI PMIC uses an +* external embedded-controller connected via I2C + an ACPI GPIO +* event handler on INT33FFC:02 pin 12, causing spurious wakeups. +*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Venue 10 Pro 5055"), + }, + .driver_data = &(struct acpi_gpiolib_dmi_quirk ) { + .ignore_wake ="INT33FC:02@12" , + }, + }, {/* * HP X2 10 models with Cherry Trail SoC + TI PMIC use an
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 316/323 ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
[ Upstream commit f48652bbe3ae62ba2835a396b7e01f063e51c4cd ]
Without this change, the DAC ctl's name could be changed only when the machine has both Speaker and Headphone, but we met some machines which only has Lineout and Headhpone, and the Lineout and Headphone share the Audio Mixer0 and DAC0, the ctl's name is set to "Front".
On most of machines, the "Front" is used for Speaker only or Lineout only, but on this machine it is shared by Lineout and Headphone, This introduces an issue in the pipewire and pulseaudio, suppose users want the Headphone to be on and the Speaker/Lineout to be off, they could turn off the "Front", this works on most of the machines, but on this machine, the "Front" couldn't be turned off otherwise the headphone will be off too. Here we do some change to let the ctl's name change to "Headphone+LO" on this machine, and pipewire and pulseaudio already could handle "Headphone+LO" and "Speaker+LO".
(https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/747)
--- sound/pci/hda/hda_generic.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
sound/pci/hda/hda_generic.c +11 -5
@@ -1212,11 +1212,17 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch, *index = ch;return "Headphone" ;case AUTO_PIN_LINE_OUT : -/* This deals with the case where we have two DACs and -* one LO, one HP and one Speaker */ -if (!ch && cfg->speaker_outs && cfg->hp_outs) { -bool hp_lo_shared = !path_has_mixer (codec, spec->hp_paths[0 ], ctl_type); -bool spk_lo_shared = !path_has_mixer (codec, spec->speaker_paths[0 ], ctl_type); +/* This deals with the case where one HP or one Speaker or +* one HP + one Speaker need to share the DAC with LO +*/ +if (!ch) { +bool hp_lo_shared = false, spk_lo_shared = false; + +if (cfg->speaker_outs) + spk_lo_shared = !path_has_mixer (codec, + spec->speaker_paths[0 ], ctl_type); +if (cfg->hp_outs) + hp_lo_shared = !path_has_mixer (codec, spec->hp_paths[0 ], ctl_type);if (hp_lo_shared && spk_lo_shared)return spec->vmaster_mute.hook ?"PCM" :"Master" ;if (hp_lo_shared)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 317/323 block: reexpand iov_iter after read/write
In reply to Greg Kroah-HartmanFrom: yangerkun <[email protected]>
[ Upstream commit cf7b39a0cbf6bf57aa07a008d46cf695add05b4c ]
We get a bug:
BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x11c/0x404 lib/iov_iter.c:1139 Read of size 8 at addr ffff0000d3fb11f8 by task CPU: 0 PID: 12582 Comm: syz-executor.2 Not tainted 5.10.0-00843-g352c8610ccd2 #2 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x110/0x164 lib/dump_stack.c:118 print_address_description+0x78/0x5c8 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report+0x148/0x1e4 mm/kasan/report.c:562 check_memory_region_inline mm/kasan/generic.c:183 [inline] __asan_load8+0xb4/0xbc mm/kasan/generic.c:252 iov_iter_revert+0x11c/0x404 lib/iov_iter.c:1139 io_read fs/io_uring.c:3421 [inline] io_issue_sqe+0x2344/0x2d64 fs/io_uring.c:5943 __io_queue_sqe+0x19c/0x520 fs/io_uring.c:6260 io_queue_sqe+0x2a4/0x590 fs/io_uring.c:6326 io_submit_sqe fs/io_uring.c:6395 [inline] io_submit_sqes+0x4c0/0xa04 fs/io_uring.c:6624 __do_sys_io_uring_enter fs/io_uring.c:9013 [inline] __se_sys_io_uring_enter fs/io_uring.c:8960 [inline] __arm64_sys_io_uring_enter+0x190/0x708 fs/io_uring.c:8960 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common arch/arm64/kernel/syscall.c:158 [inline] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:227 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Allocated by task 12570: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475 __kmalloc+0x23c/0x334 mm/slub.c:3970 kmalloc include/linux/slab.h:557 [inline] __io_alloc_async_data+0x68/0x9c fs/io_uring.c:3210 io_setup_async_rw fs/io_uring.c:3229 [inline] io_read fs/io_uring.c:3436 [inline] io_issue_sqe+0x2954/0x2d64 fs/io_uring.c:5943 __io_queue_sqe+0x19c/0x520 fs/io_uring.c:6260 io_queue_sqe+0x2a4/0x590 fs/io_uring.c:6326 io_submit_sqe fs/io_uring.c:6395 [inline] io_submit_sqes+0x4c0/0xa04 fs/io_uring.c:6624 __do_sys_io_uring_enter fs/io_uring.c:9013 [inline] __se_sys_io_uring_enter fs/io_uring.c:8960 [inline] __arm64_sys_io_uring_enter+0x190/0x708 fs/io_uring.c:8960 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common arch/arm64/kernel/syscall.c:158 [inline] do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:227 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670 Freed by task 12570: stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track+0x38/0x6c mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422 kasan_slab_free+0x10/0x1c mm/kasan/common.c:431 slab_free_hook mm/slub.c:1544 [inline] slab_free_freelist_hook mm/slub.c:1577 [inline] slab_free mm/slub.c:3142 [inline] kfree+0x104/0x38c mm/slub.c:4124 io_dismantle_req fs/io_uring.c:1855 [inline] __io_free_req+0x70/0x254 fs/io_uring.c:1867 io_put_req_find_next fs/io_uring.c:2173 [inline] __io_queue_sqe+0x1fc/0x520 fs/io_uring.c:6279 __io_req_task_submit+0x154/0x21c fs/io_uring.c:2051 io_req_task_submit+0x2c/0x44 fs/io_uring.c:2063 task_work_run+0xdc/0x128 kernel/task_work.c:151 get_signal+0x6f8/0x980 kernel/signal.c:2562 do_signal+0x108/0x3a4 arch/arm64/kernel/signal.c:658 do_notify_resume+0xbc/0x25c arch/arm64/kernel/signal.c:722 work_pending+0xc/0x180
blkdev_read_iter can truncate iov_iter's count since the count + pos may exceed the size of the blkdev. This will confuse io_read that we have consume the iovec. And once we do the iov_iter_revert in io_read, we will trigger the slab-out-of-bounds. Fix it by reexpand the count with size has been truncated.
blkdev_write_iter can trigger the problem too.
--- fs/block_dev.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
fs/block_dev.c +17 -3
@@ -1906,6 +1906,7 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)struct inode *bd_inode =bdev_file_inode (file);loff_t size =i_size_read (bd_inode);struct blk_plug plug; +size_t shorted =0 ;ssize_t ret;if (bdev_read_only (I_BDEV (bd_inode)))
@@ -1920,12 +1921,17 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)if ((iocb->ki_flags & (IOCB_NOWAIT |IOCB_DIRECT )) ==IOCB_NOWAIT )return -EOPNOTSUPP ; -iov_iter_truncate (from, size - iocb->ki_pos); + size -= iocb->ki_pos; +if (iov_iter_count (from) > size) { + shorted =iov_iter_count (from) - size; +iov_iter_truncate (from, size); + }blk_start_plug (&plug); ret =__generic_file_write_iter (iocb, from);if (ret >0 ) ret =generic_write_sync (iocb, ret); +iov_iter_reexpand (from,iov_iter_count (from) + shorted);blk_finish_plug (&plug);return ret; }
@@ -1937,13 +1943,21 @@ ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)struct inode *bd_inode =bdev_file_inode (file);loff_t size =i_size_read (bd_inode);loff_t pos = iocb->ki_pos; +size_t shorted =0 ; +ssize_t ret;if (pos >= size)return 0 ; size -= pos; -iov_iter_truncate (to, size); -return generic_file_read_iter (iocb, to); +if (iov_iter_count (to) > size) { + shorted =iov_iter_count (to) - size; +iov_iter_truncate (to, size); + } + + ret =generic_file_read_iter (iocb, to); +iov_iter_reexpand (to,iov_iter_count (to) + shorted); +return ret; }EXPORT_SYMBOL_GPL (blkdev_read_iter);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 318/323 lib: stackdepot: turn depot_lock spinlock to raw_spinlock
In reply to Greg Kroah-HartmanFrom: Zqiang <[email protected]>
[ Upstream commit 78564b9434878d686c5f88c4488b20cccbcc42bc ]
In RT system, the spin_lock will be replaced by sleepable rt_mutex lock, in __call_rcu(), disable interrupts before calling kasan_record_aux_stack(), will trigger this calltrace:
BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:951
in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 19, name: pgdatinit0
Call Trace:
___might_sleep.cold+0x1b2/0x1f1
rt_spin_lock+0x3b/0xb0
stack_depot_save+0x1b9/0x440
kasan_save_stack+0x32/0x40
kasan_record_aux_stack+0xa5/0xb0
__call_rcu+0x117/0x880
__exit_signal+0xafb/0x1180
release_task+0x1d6/0x480
exit_notify+0x303/0x750
do_exit+0x678/0xcf0
kthread+0x364/0x4f0
ret_from_fork+0x22/0x30Replace spinlock with raw_spinlock.
--- lib/stackdepot.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/stackdepot.c +3 -3
@@ -78,7 +78,7 @@ static void *stack_slabs[STACK_ALLOC_MAX_SLABS];static int depot_index;static int next_slab_inited;static size_t depot_offset; -static DEFINE_SPINLOCK (depot_lock); +static DEFINE_RAW_SPINLOCK (depot_lock);static bool init_stack_slab (void **prealloc) {
@@ -253,7 +253,7 @@ depot_stack_handle_t depot_save_stack(struct stack_trace *trace, prealloc =page_address (page); } -spin_lock_irqsave (&depot_lock, flags); +raw_spin_lock_irqsave (&depot_lock, flags); found =find_stack (*bucket, trace->entries, trace->nr_entries, hash);if (!found) {
@@ -277,7 +277,7 @@ depot_stack_handle_t depot_save_stack(struct stack_trace *trace,WARN_ON (!init_stack_slab (&prealloc)); } -spin_unlock_irqrestore (&depot_lock, flags); +raw_spin_unlock_irqrestore (&depot_lock, flags); exit:if (prealloc) {/* Nobody used this memory, ok to free it. */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 319/323 serial: 8250: fix potential deadlock in rs485-mode
In reply to Greg Kroah-HartmanFrom: Tomas Melin <[email protected]>
[ Upstream commit b86f86e8e7c5264bb8f5835d60f9ec840d9f5a7a ]
Canceling hrtimer when holding uart spinlock can deadlock.
CPU0: syscall write
-> get uart port spinlock
-> write uart
-> start_tx_rs485
-> hrtimer_cancel
-> wait for hrtimer callback to finishCPU1: hrtimer IRQ
-> run hrtimer
-> em485_handle_stop_tx
-> get uart port spinlockCPU0 is waiting for the hrtimer callback to finish, but the hrtimer callback running on CPU1 is waiting to get the uart port spinlock.
This deadlock can be avoided by not canceling the hrtimers in these paths. Setting active_timer=NULL can be done without accessing hrtimer, and that will effectively cancel operations that would otherwise have been performed by the hrtimer callback.
--- drivers/tty/serial/8250/8250_port.c | 3 --- 1 file changed, 3 deletions(-)
drivers/tty/serial/8250/8250_port.c +0 -3
@@ -1527,7 +1527,6 @@ static inline void __stop_tx(struct uartreturn ; em485->active_timer =NULL ; -hrtimer_cancel (&em485->start_tx_timer);__stop_tx_rs485 (p); }
@@ -1591,8 +1590,6 @@ static inline void start_tx_rs485(structserial8250_stop_rx (&up->port); em485->active_timer =NULL ; -if (hrtimer_is_queued (&em485->stop_tx_timer)) -hrtimer_cancel (&em485->stop_tx_timer); mcr =serial8250_in_MCR (up); if (!!(up->port.rs485.flags & SER_RS485_RTS_ON_SEND) !=
Greg Kroah-Hartman
maintainerPATCH 320/323 sit: proper dev_{hold|put} in ndo_[un]init methods
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 6289a98f0817a4a457750d6345e754838eae9439 upstream.
After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger a warning [1]
Issue here is that:
- all dev_put() should be paired with a corresponding prior dev_hold().
- A driver doing a dev_put() in its ndo_uninit() MUST also do a dev_hold() in its ndo_init(), only when ndo_init() is returning 0.
Otherwise, register_netdevice() would call ndo_uninit() in its error path and release a refcount too soon.
--- net/ipv6/sit.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/ipv6/sit.c +1 -3
@@ -209,8 +209,6 @@ static int ipip6_tunnel_create(struct neipip6_tunnel_clone_6rd (dev, sitn); -dev_hold (dev); -ipip6_tunnel_link (sitn, t);return 0 ;
@@ -1393,7 +1391,7 @@ static int ipip6_tunnel_init(struct net_ dev->tstats =NULL ;return err; } - +dev_hold (dev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 321/323 ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 48bb5697269a7cbe5194dbb044dc38c517e34c58 upstream.
Same reasons than for the previous commits :6289a98f0817 ("sit: proper dev_{hold|put} in ndo_[un]init methods") 40cb881b5aaa ("ip6_vti: proper dev_{hold|put} in ndo_[un]init methods") 7f700334be9a ("ip6_gre: proper dev_{hold|put} in ndo_[un]init methods")
After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger a warning [1]
Issue here is that:
- all dev_put() should be paired with a corresponding prior dev_hold().
- A driver doing a dev_put() in its ndo_uninit() MUST also do a dev_hold() in its ndo_init(), only when ndo_init() is returning 0.
Otherwise, register_netdevice() would call ndo_uninit() in its error path and release a refcount too soon.
[1]
WARNING: CPU: 1 PID: 21059 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31 Modules linked in: CPU: 1 PID: 21059 Comm: syz-executor.4 Not tainted 5.12.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31 Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58 RSP: 0018:ffffc900025aefe8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815c51f5 RDI: fffff520004b5def RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff888023488568 R13: ffff8880254e9000 R14: 00000000dfd82cfd R15: ffff88802ee2d7c0 FS: 00007f13bc590700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0943e74000 CR3: 0000000025273000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_dec include/linux/refcount.h:344 [inline] refcount_dec include/linux/refcount.h:359 [inline] dev_put include/linux/netdevice.h:4135 [inline] ip6_tnl_dev_uninit+0x370/0x3d0 net/ipv6/ip6_tunnel.c:387 register_netdevice+0xadf/0x1500 net/core/dev.c:10308 ip6_tnl_create2+0x1b5/0x400 net/ipv6/ip6_tunnel.c:263 ip6_tnl_newlink+0x312/0x580 net/ipv6/ip6_tunnel.c:2052 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3443 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3491 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_tunnel.c +1 -1
@@ -272,7 +272,6 @@ static int ip6_tnl_create2(struct net_destrcpy (t->parms.name, dev->name); -dev_hold (dev);ip6_tnl_link (ip6n, t);return 0 ;
@@ -1862,6 +1861,7 @@ ip6_tnl_dev_init_gen(struct net_device * dev->min_mtu =ETH_MIN_MTU ; dev->max_mtu =IP6_MAX_MTU - dev->hard_header_len; +dev_hold (dev);return 0 ; destroy_dst:
Greg Kroah-Hartman
maintainerPATCH 322/323 xhci: Do not use GFP_KERNEL in (potentially) atomic context
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit dda32c00c9a0fa103b5d54ef72c477b7aa993679 upstream.
'xhci_urb_enqueue()' is passed a 'mem_flags' argument, because "URBs may be submitted in interrupt context" (see comment related to 'usb_submit_urb()' in 'drivers/usb/core/urb.c')
So this flag should be used in all the calling chain. Up to now, 'xhci_check_maxpacket()' which is only called from 'xhci_urb_enqueue()', uses GFP_KERNEL.
Be safe and pass the mem_flags to this function as well.
--- drivers/usb/host/xhci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/host/xhci.c +3 -3
@@ -1308,7 +1308,7 @@ static int xhci_configure_endpoint(struc* we need to issue an evaluate context command and wait on it. */ static int xhci_check_maxpacket (struct xhci_hcd *xhci,unsigned int slot_id, -unsigned int ep_index,struct urb *urb) +unsigned int ep_index,struct urb *urb,gfp_t mem_flags) {struct xhci_container_ctx *out_ctx;struct xhci_input_control_ctx *ctrl_ctx;
@@ -1339,7 +1339,7 @@ static int xhci_check_maxpacket(struct x* changes max packet sizes. */ - command =xhci_alloc_command (xhci, false, true,GFP_KERNEL ); + command =xhci_alloc_command (xhci, false, true, mem_flags);if (!command)return -ENOMEM ;
@@ -1430,7 +1430,7 @@ static int xhci_urb_enqueue(struct usb_h*/ if (urb->dev->speed ==USB_SPEED_FULL ) { ret =xhci_check_maxpacket (xhci, slot_id, - ep_index, urb); + ep_index, urb, mem_flags);if (ret <0 ) {xhci_urb_free_priv (urb_priv); urb->hcpriv =NULL ;
Greg Kroah-Hartman
maintainerPATCH 323/323 ipv6: remove extra dev_hold() for fallback tunnels
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 0d7a7b2014b1a499a0fe24c9f3063d7856b5aaaf upstream.
My previous commits added a dev_hold() in tunnels ndo_init(), but forgot to remove it from special functions setting up fallback tunnels.
Fallback tunnels do call their respective ndo_init()
This leads to various reports like :
unregister_netdevice: waiting for ip6gre0 to become free. Usage count = 2
--- net/ipv6/ip6_gre.c | 3 --- net/ipv6/ip6_tunnel.c | 1 - net/ipv6/ip6_vti.c | 1 - net/ipv6/sit.c | 1 - 4 files changed, 6 deletions(-)
net/ipv6/ip6_gre.c +0 -3
@@ -350,7 +350,6 @@ static struct ip6_tnl *ip6gre_tunnel_locif (!(nt->parms.o_flags &TUNNEL_SEQ )) dev->features |=NETIF_F_LLTX ; -dev_hold (dev);ip6gre_tunnel_link (ign, nt);return nt;
@@ -1124,8 +1123,6 @@ static void ip6gre_fb_tunnel_init(structstrcpy (tunnel->parms.name, dev->name); tunnel->hlen =sizeof (struct ipv6hdr ) +4 ; - -dev_hold (dev); }
net/ipv6/ip6_tunnel.c +0 -1
@@ -1905,7 +1905,6 @@ static int __net_init ip6_fb_tnl_dev_inistruct ip6_tnl_net *ip6n =net_generic (net, ip6_tnl_net_id); t->parms.proto =IPPROTO_IPV6 ; -dev_hold (dev);rcu_assign_pointer (ip6n->tnls_wc[0 ], t);return 0 ;
net/ipv6/ip6_vti.c +0 -1
@@ -934,7 +934,6 @@ static int __net_init vti6_fb_tnl_dev_instruct vti6_net *ip6n =net_generic (net, vti6_net_id); t->parms.proto =IPPROTO_IPV6 ; -dev_hold (dev);rcu_assign_pointer (ip6n->tnls_wc[0 ], t);return 0 ;
net/ipv6/sit.c +0 -1
@@ -1407,7 +1407,6 @@ static void __net_init ipip6_fb_tunnel_i iph->ihl =5 ; iph->ttl =64 ; -dev_hold (dev);rcu_assign_pointer (sitn->tunnels_wc[0 ], tunnel); }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.233 release. There are 323 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 May 2021 09:20:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.233-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
32 tests: 32 pass, 0 failLinux version: 4.14.233-rc1-g7c5a6946da44
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.233 release. There are 323 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 May 2021 09:20:38 +0000. Anything received after that time might be too late.
Build results:
total: 168 pass: 168 fail: 0 Qemu test results: total: 406 pass: 406 fail: 0
Guenter
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.233 release. There are 323 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 May 2021 09:20:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.233-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 4.14.233-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-4.14.y
* git commit: 7c5a6946da4494648bedd0ff4d3282d2c96f3ff2
* git describe: v4.14.232-324-g7c5a6946da44
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.232-324-g7c5a6946da44
## No Regressions (compared to v4.14.232-301-g6b85a7ccd6ab)
## No fixes (compared to v4.14.232-301-g6b85a7ccd6ab)
## Test result summary
total: 62446, pass: 49885, fail: 1550, skip: 10128, xfail: 883,
## Build Summary
* arm: 97 total, 97 passed, 0 failed
* arm64: 24 total, 24 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 14 total, 14 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 36 total, 36 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 14 total, 14 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org