5.10.44-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.10.44-rc1 review
This is the start of the stable review cycle for the 5.10.44 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Jun 2021 10:26:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.44-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.44-rc1
Liangyan <[email protected]>
tracing: Correct the length check which causes memory corruption
Ming Lei <[email protected]>
scsi: core: Only put parent device if host state differs from SHOST_CREATED
Ming Lei <[email protected]>
scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
Ming Lei <[email protected]>
scsi: core: Fix failure handling of scsi_add_host_with_dma()
Ming Lei <[email protected]>
scsi: core: Fix error handling of scsi_host_alloc()
Dai Ngo <[email protected]>
NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
Trond Myklebust <[email protected]>
NFSv4: Fix second deadlock in nfs4_evict_inode()
Anna Schumaker <[email protected]>
NFS: Fix use-after-free in nfs4_init_client()
Paolo Bonzini <[email protected]>
kvm: fix previous commit for 32-bit builds
Leo Yan <[email protected]>
perf session: Correct buffer copying when peeking events
Trond Myklebust <[email protected]>
NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode()
Dan Carpenter <[email protected]>
NFS: Fix a potential NULL dereference in nfs_get_client()
Alaa Hleihel <[email protected]>
IB/mlx5: Fix initializing CQ fragments buffer
Sean Christopherson <[email protected]>
KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message
CodyYao-oc <[email protected]>
x86/nmi_watchdog: Fix old-style NMI watchdog regression on old Intel CPUs
Dietmar Eggemann <[email protected]>
sched/fair: Fix util_est UTIL_AVG_UNCHANGED handling
Vincent Guittot <[email protected]>
sched/fair: Make sure to update tg contrib for blocked load
Vincent Guittot <[email protected]>
sched/fair: Keep load_avg and load_sum synced
Marco Elver <[email protected]>
perf: Fix data race between pin_count increment/decrement
Srinivas Kandagatla <[email protected]>
gpio: wcd934x: Fix shift-out-of-bounds error
Yang Li <[email protected]>
phy: ti: Fix an error code in wiz_probe()
Jerome Brunet <[email protected]>
ASoC: meson: gx-card: fix sound-dai dt schema
Kefeng Wang <[email protected]>
ASoC: core: Fix Null-point-dereference in fmt_single_name()
Wang Wensheng <[email protected]>
phy: cadence: Sierra: Fix error return code in cdns_sierra_phy_probe()
Zhen Lei <[email protected]>
tools/bootconfig: Fix error return code in apply_xbc()
Nathan Chancellor <[email protected]>
vmlinux.lds.h: Avoid orphan section with !SMP
Arnd Bergmann <[email protected]>
ARM: cpuidle: Avoid orphan section warning
Shay Drory <[email protected]>
RDMA/mlx4: Do not map the core_clock page to user space unless enabled
Kamal Heib <[email protected]>
RDMA/ipoib: Fix warning caused by destroying non-initial netns
Jonathan Marek <[email protected]>
drm/msm/a6xx: avoid shadow NULL reference in failure path
Jonathan Marek <[email protected]>
drm/msm/a6xx: update/fix CP_PROTECT initialization
Jonathan Marek <[email protected]>
drm/msm/a6xx: fix incorrectly set uavflagprd_inv field for A650
Linus Walleij <[email protected]>
drm/mcde: Fix off by 10^3 in calculation
Bjorn Andersson <[email protected]>
usb: typec: mux: Fix copy-paste mistake in typec_mux_match
Wesley Cheng <[email protected]>
usb: dwc3: gadget: Disable gadget IRQ during pullup disable
Chen Li <[email protected]>
phy: usb: Fix misuse of IS_ENABLED
Axel Lin <[email protected]>
regulator: rtmv20: Fix .set_current_limit/.get_current_limit callbacks
Axel Lin <[email protected]>
regulator: bd71828: Fix .n_voltages settings
Axel Lin <[email protected]>
regulator: fan53880: Fix missing n_voltages setting
Matti Vaittinen <[email protected]>
regulator: bd718x7: Fix the BUCK7 voltage setting on BD71837
Dmitry Osipenko <[email protected]>
regulator: max77620: Use device_set_of_node_from_dev()
Dmitry Baryshkov <[email protected]>
regulator: core: resolve supply for boot-on/always-on regulators
Li Jun <[email protected]>
usb: typec: tcpm: cancel frs hrtimer when unregister tcpm port
Li Jun <[email protected]>
usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port
Maciej Żenczykowski <[email protected]>
usb: fix various gadget panics on 10gbps cabling
Maciej Żenczykowski <[email protected]>
usb: fix various gadgets null ptr deref on 10gbps cabling.
Linyu Yuan <[email protected]>
usb: gadget: eem: fix wrong eem header operation
Stefan Agner <[email protected]>
USB: serial: cp210x: fix alternate function for CP2102N QFN20
Johan Hovold <[email protected]>
USB: serial: quatech2: fix control-request directions
Alexandre GRIVEAUX <[email protected]>
USB: serial: omninet: add device id for Zyxel Omni 56K Plus
George McCollister <[email protected]>
USB: serial: ftdi_sio: add NovaTech OrionMX product ID
Wesley Cheng <[email protected]>
usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
Andy Shevchenko <[email protected]>
usb: typec: intel_pmc_mux: Add missed error check for devm_ioremap_resource()
Andy Shevchenko <[email protected]>
usb: typec: intel_pmc_mux: Put fwnode in error case during ->probe()
Mayank Rana <[email protected]>
usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
Andy Shevchenko <[email protected]>
usb: typec: wcove: Use LE to CPU conversion when accessing msg->header
Thomas Petazzoni <[email protected]>
usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling
Marian-Cristian Rotariu <[email protected]>
usb: dwc3: ep0: fix NULL pointer exception
Jack Pham <[email protected]>
usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
Jack Pham <[email protected]>
usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL
Christophe JAILLET <[email protected]>
usb: dwc3: meson-g12a: Disable the regulator in the error handling path of the probe
Neil Armstrong <[email protected]>
usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled
Kyle Tso <[email protected]>
usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms
Maciej Żenczykowski <[email protected]>
usb: f_ncm: only first packet of aggregate needs to start timer
Maciej Żenczykowski <[email protected]>
USB: f_ncm: ncm_bitrate (speed) is unsigned
Geert Uytterhoeven <[email protected]>
mmc: renesas_sdhi: Fix HS400 on R-Car M3-W+
Wolfram Sang <[email protected]>
mmc: renesas_sdhi: abort tuning when timeout detected
Steven Rostedt (VMware) <[email protected]>
ftrace: Do not blindly read the ip address in ftrace_bug()
Alexander Kuznetsov <[email protected]>
cgroup1: don't allow '\n' in renaming
Nikolay Borisov <[email protected]>
btrfs: promote debugging asserts to full-fledged checks in validate_super
Ritesh Harjani <[email protected]>
btrfs: return value from btrfs_mark_extent_written() in case of error
Xiao Ni <[email protected]>
async_xor: check src_offs is not NULL before updating it
Wenli Looi <[email protected]>
staging: rtl8723bs: Fix uninitialized variables
Paolo Bonzini <[email protected]>
kvm: avoid speculation-based attacks from out-of-range memslot accesses
Lai Jiangshan <[email protected]>
KVM: X86: MMU: Use the correct inherited permissions to get shadow page
Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server
Desmond Cheong Zhi Xi <[email protected]>
drm: Lock pointer access in drm_master_release()
Desmond Cheong Zhi Xi <[email protected]>
drm: Fix use-after-free read in drm_getunique()
Zhang Rui <[email protected]>
Revert "ACPI: sleep: Put the FACS table after using it"
Lukas Wunner <[email protected]>
spi: bcm2835: Fix out-of-bounds access with more than 4 slaves
Jeremy Szu <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
Jeremy Szu <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8
Jeremy Szu <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8
Jeremy Szu <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2
Hui Wang <[email protected]>
ALSA: hda/realtek: headphone and mic don't work on an Acer laptop
Takashi Sakamoto <[email protected]>
ALSA: firewire-lib: fix the context to call snd_pcm_stop_xrun()
Takashi Iwai <[email protected]>
ALSA: seq: Fix race of snd_seq_timer_open()
Chris Packham <[email protected]>
i2c: mpc: implement erratum A-004447 workaround
Chris Packham <[email protected]>
i2c: mpc: Make use of i2c_recover_bus()
Lukas Wunner <[email protected]>
spi: Cleanup on failure of initial setup
Saravana Kannan <[email protected]>
spi: Don't have controller clean up spi device before driver unbind
Chris Packham <[email protected]>
powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers
Chris Packham <[email protected]>
powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers
Sagi Grimberg <[email protected]>
nvmet: fix false keep-alive timeout when a controller is torn down
Sagi Grimberg <[email protected]>
nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
Jiapeng Chong <[email protected]>
bnx2x: Fix missing error code in bnx2x_iov_init_one()
John Keeping <[email protected]>
dm verity: fix require_signatures module_param permissions
Tiezhu Yang <[email protected]>
MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
Hannes Reinecke <[email protected]>
nvme-fabrics: decode host pathing error for connect
George McCollister <[email protected]>
net: dsa: microchip: enable phy errata workaround on 9567
Saubhik Mukherjee <[email protected]>
net: appletalk: cops: Fix data race in cops_probe1
Zong Li <[email protected]>
net: macb: ensure the device is available before accessing GEMGXL control registers
Dmitry Bogdanov <[email protected]>
scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
Yang Yingliang <[email protected]>
scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq
Matt Wang <[email protected]>
scsi: vmw_pvscsi: Set correct residual data length
Javed Hasan <[email protected]>
scsi: bnx2fc: Return failure if io_req is already in ABTS processing
Íñigo Huguet <[email protected]>
net:sfc: fix non-freed irq in legacy irq mode
Rao Shoaib <[email protected]>
RDS tcp loopback connection can hang
Zheyu Ma <[email protected]>
net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
Sergey Senozhatsky <[email protected]>
wq: handle VM suspension in stall detection
Shakeel Butt <[email protected]>
cgroup: disable controllers at parse time
Dan Carpenter <[email protected]>
net: mdiobus: get rid of a BUG_ON()
Johannes Berg <[email protected]>
netlink: disable IRQs for netlink_lock_table()
Johannes Berg <[email protected]>
bonding: init notify_work earlier to avoid uninitialized use
Zheyu Ma <[email protected]>
isdn: mISDN: netjet: Fix crash in nj_probe:
Li Jun <[email protected]>
usb: chipidea: udc: assign interrupt number to USB gadget structure
Chunyan Zhang <[email protected]>
spi: sprd: Add missing MODULE_DEVICE_TABLE
Zou Wei <[email protected]>
ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
Eric Farman <[email protected]>
vfio-ccw: Serialize FSM IDLE state with I/O completion
Eric Farman <[email protected]>
vfio-ccw: Reset FSM state to IDLE inside FSM
Jiri Olsa <[email protected]>
bpf: Add deny list of btf ids check for tracing programs
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet
Dinghao Liu <[email protected]>
usb: cdns3: Fix runtime PM imbalance on error
Jeimon <[email protected]>
net/nfc/rawsock.c: fix a permission check bug
Jiri Olsa <[email protected]>
bpf: Forbid trampoline attach for functions with variable arguments
Karen Dombroski <[email protected]>
spi: spi-zynq-qspi: Fix stack violation bug
Saravana Kannan <[email protected]>
spi: Fix spi device unregister flow
Vijendar Mukunda <[email protected]>
ASoC: amd: fix for pcm_read() error
Marco Felsch <[email protected]>
ASoC: max98088: fix ni clock divider calculation
Kees Cook <[email protected]>
proc: Track /proc/$pid/attr/ opener mm_struct
-------------
Diffstat:
.../bindings/sound/amlogic,gx-sound-card.yaml | 4 +- Documentation/virt/kvm/mmu.rst | 4 +- Makefile | 4 +- arch/arm/include/asm/cpuidle.h | 5 +- arch/mips/lib/mips-atomic.c | 12 +- arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 ++ arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 +++ arch/x86/events/intel/uncore_snbep.c | 3 +- arch/x86/kernel/cpu/perfctr-watchdog.c | 4 +- arch/x86/kvm/mmu/paging_tmpl.h | 14 +- arch/x86/kvm/trace.h | 6 +- crypto/async_tx/async_xor.c | 3 +- drivers/acpi/sleep.c | 4 +- drivers/gpio/gpio-wcd934x.c | 2 +- drivers/gpu/drm/drm_auth.c | 3 +- drivers/gpu/drm/drm_ioctl.c | 9 +- drivers/gpu/drm/mcde/mcde_dsi.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 155 +++++++++++++++------ drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 2 +- drivers/i2c/busses/i2c-mpc.c | 95 ++++++++++++- drivers/infiniband/hw/mlx4/main.c | 5 +- drivers/infiniband/hw/mlx5/cq.c | 9 +- drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 1 + drivers/isdn/hardware/mISDN/netjet.c | 1 - drivers/md/dm-verity-verify-sig.c | 2 +- drivers/mmc/host/renesas_sdhi_core.c | 9 +- drivers/net/appletalk/cops.c | 4 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/dsa/microchip/ksz9477.c | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +- drivers/net/ethernet/cadence/macb_main.c | 3 + drivers/net/ethernet/mellanox/mlx4/fw.c | 3 + drivers/net/ethernet/mellanox/mlx4/fw.h | 1 + drivers/net/ethernet/mellanox/mlx4/main.c | 6 + drivers/net/ethernet/qlogic/qla3xxx.c | 2 +- drivers/net/ethernet/sfc/nic.c | 1 + drivers/net/phy/mdio_bus.c | 3 +- drivers/nvme/host/Kconfig | 3 +- drivers/nvme/host/fabrics.c | 5 + drivers/nvme/target/core.c | 15 +- drivers/nvme/target/nvmet.h | 2 +- drivers/phy/broadcom/phy-brcm-usb-init.h | 4 +- drivers/phy/cadence/phy-cadence-sierra.c | 1 + drivers/phy/ti/phy-j721e-wiz.c | 1 + drivers/regulator/bd718x7-regulator.c | 2 +- drivers/regulator/core.c | 6 + drivers/regulator/fan53880.c | 3 + drivers/regulator/max77620-regulator.c | 7 + drivers/regulator/rtmv20-regulator.c | 42 +++++- drivers/s390/cio/vfio_ccw_drv.c | 12 +- drivers/s390/cio/vfio_ccw_fsm.c | 1 + drivers/s390/cio/vfio_ccw_ops.c | 2 - drivers/scsi/bnx2fc/bnx2fc_io.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 8 +- drivers/scsi/hosts.c | 47 ++++--- drivers/scsi/qla2xxx/qla_target.c | 2 + drivers/scsi/vmw_pvscsi.c | 8 +- drivers/spi/spi-bcm2835.c | 10 +- drivers/spi/spi-bitbang.c | 18 ++- drivers/spi/spi-fsl-spi.c | 4 + drivers/spi/spi-omap-uwire.c | 9 +- drivers/spi/spi-omap2-mcspi.c | 33 +++-- drivers/spi/spi-pxa2xx.c | 9 +- drivers/spi/spi-sprd.c | 1 + drivers/spi/spi-zynq-qspi.c | 7 +- drivers/spi/spi.c | 20 ++- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- drivers/usb/cdns3/gadget.c | 4 +- drivers/usb/chipidea/udc.c | 1 + drivers/usb/dwc3/debug.h | 3 + drivers/usb/dwc3/debugfs.c | 21 +-- drivers/usb/dwc3/dwc3-meson-g12a.c | 13 +- drivers/usb/dwc3/ep0.c | 3 + drivers/usb/dwc3/gadget.c | 18 ++- drivers/usb/gadget/config.c | 8 ++ drivers/usb/gadget/function/f_ecm.c | 2 +- drivers/usb/gadget/function/f_eem.c | 6 +- drivers/usb/gadget/function/f_fs.c | 3 + drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_loopback.c | 2 +- drivers/usb/gadget/function/f_ncm.c | 10 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/f_rndis.c | 2 +- drivers/usb/gadget/function/f_serial.c | 2 +- drivers/usb/gadget/function/f_sourcesink.c | 3 +- drivers/usb/gadget/function/f_subset.c | 2 +- drivers/usb/gadget/function/f_tcm.c | 3 +- drivers/usb/musb/musb_core.c | 3 +- drivers/usb/serial/cp210x.c | 20 ++- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/omninet.c | 2 + drivers/usb/serial/quatech2.c | 6 +- drivers/usb/typec/mux.c | 2 +- drivers/usb/typec/mux/intel_pmc_mux.c | 9 +- drivers/usb/typec/tcpm/tcpm.c | 4 + drivers/usb/typec/tcpm/wcove.c | 2 +- drivers/usb/typec/ucsi/ucsi.c | 1 + fs/btrfs/disk-io.c | 26 ++-- fs/btrfs/file.c | 4 +- fs/nfs/client.c | 2 +- fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4client.c | 2 +- fs/nfs/nfs4proc.c | 29 +++- fs/proc/base.c | 9 +- include/asm-generic/vmlinux.lds.h | 1 + include/linux/kvm_host.h | 10 +- include/linux/mfd/rohm-bd71828.h | 10 +- include/linux/mlx4/device.h | 1 + include/linux/sched.h | 8 ++ include/linux/usb/pd.h | 2 +- kernel/bpf/btf.c | 12 ++ kernel/bpf/verifier.c | 14 ++ kernel/cgroup/cgroup-v1.c | 4 + kernel/cgroup/cgroup.c | 13 +- kernel/events/core.c | 2 + kernel/sched/debug.c | 3 +- kernel/sched/fair.c | 18 +-- kernel/sched/pelt.h | 11 +- kernel/trace/ftrace.c | 8 +- kernel/trace/trace.c | 2 +- kernel/workqueue.c | 12 +- net/netlink/af_netlink.c | 6 +- net/nfc/rawsock.c | 2 +- net/rds/connection.c | 23 ++- net/rds/tcp.c | 4 +- net/rds/tcp.h | 3 +- net/rds/tcp_listen.c | 6 + sound/core/seq/seq_timer.c | 10 +- sound/firewire/amdtp-stream.c | 2 +- sound/pci/hda/patch_realtek.c | 16 +++ sound/soc/amd/raven/acp3x-pcm-dma.c | 10 -- sound/soc/amd/raven/acp3x.h | 1 + sound/soc/amd/raven/pci-acp3x.c | 15 ++ sound/soc/codecs/max98088.c | 13 +- sound/soc/codecs/sti-sas.c | 1 + sound/soc/intel/boards/bytcr_rt5640.c | 25 ++++ sound/soc/soc-core.c | 2 + tools/bootconfig/main.c | 1 + tools/perf/util/session.c | 1 + 140 files changed, 896 insertions(+), 309 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/131 proc: Track /proc/$pid/attr/ opener mm_struct
From: Kees Cook <[email protected]>
commit 591a22c14d3f45cc38bd1931c593c221df2f1881 upstream.
Commit bfb819ea20ce ("proc: Check /proc/$pid/attr/ writes against file opener") tried to make sure that there could not be a confusion between the opener of a /proc/$pid/attr/ file and the writer. It used struct cred to make sure the privileges didn't change. However, there were existing cases where a more privileged thread was passing the opened fd to a differently privileged thread (during container setup). Instead, use mm_struct to track whether the opener and writer are still the same process. (This is what several other proc files already do, though for different reasons.)
--- fs/proc/base.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/proc/base.c +8 -1
@@ -2675,6 +2675,11 @@ out: }#ifdef CONFIG_SECURITY +static int proc_pid_attr_open (struct inode *inode,struct file *file) +{ +return __mem_open (inode, file,PTRACE_MODE_READ_FSCREDS ); +} +static ssize_t proc_pid_attr_read (struct file * file,char __user * buf,size_t count,loff_t *ppos) {
@@ -2705,7 +2710,7 @@ static ssize_t proc_pid_attr_write(strucint rv;/* A task may only write when it was the opener. */ -if (file->f_cred !=current_real_cred ()) +if (file->private_data != current->mm)return -EPERM ;rcu_read_lock ();
@@ -2755,9 +2760,11 @@ out: }static const struct file_operations proc_pid_attr_operations = { + .open = proc_pid_attr_open, .read = proc_pid_attr_read, .write = proc_pid_attr_write, .llseek = generic_file_llseek, + .release = mem_release, };#define LSM_DIR_OPS (LSM ) \
Greg Kroah-Hartman
maintainerPATCH 2/131 ASoC: max98088: fix ni clock divider calculation
In reply to Greg Kroah-HartmanFrom: Marco Felsch <[email protected]>
[ Upstream commit 6c9762a78c325107dc37d20ee21002b841679209 ]
The ni1/ni2 ratio formula [1] uses the pclk which is the prescaled mclk. The max98088 datasheet [2] has no such formula but table-12 equals so we can assume that it is the same for both devices.
While on it make use of DIV_ROUND_CLOSEST_ULL().
[1] https://datasheets.maximintegrated.com/en/ds/MAX98089.pdf; page 86
[2] https://datasheets.maximintegrated.com/en/ds/MAX98088.pdf; page 82
--- sound/soc/codecs/max98088.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
sound/soc/codecs/max98088.c +11 -2
@@ -41,6 +41,7 @@ struct max98088_priv {enum max98088_type devtype;struct max98088_pdata *pdata;struct clk *mclk; +unsigned char mclk_prescaler;unsigned int sysclk;struct max98088_cdata dai[2 ];int eq_textcnt;
@@ -998,13 +999,16 @@ static int max98088_dai1_hw_params(struct snd_pcm_substream *substream,/* Configure NI when operating as master */ if (snd_soc_component_read (component,M98088_REG_14_DAI1_FORMAT ) &M98088_DAI_MAS ) { +unsigned long pclk; +if (max98088->sysclk ==0 ) {dev_err (component->dev,"Invalid system clock frequency\n" );return -EINVAL ; } ni =65536ULL * (rate <50000 ?96ULL :48ULL ) * (unsigned long long int )rate; -do_div (ni, (unsigned long long int )max98088->sysclk); + pclk =DIV_ROUND_CLOSEST (max98088->sysclk, max98088->mclk_prescaler); + ni =DIV_ROUND_CLOSEST_ULL (ni, pclk);snd_soc_component_write (component,M98088_REG_12_DAI1_CLKCFG_HI , (ni >>8 ) &0x7F ); snd_soc_component_write(component, M98088_REG_13_DAI1_CLKCFG_LO,
@@ -1065,13 +1069,16 @@ static int max98088_dai2_hw_params(struct snd_pcm_substream *substream,/* Configure NI when operating as master */ if (snd_soc_component_read (component,M98088_REG_1C_DAI2_FORMAT ) &M98088_DAI_MAS ) { +unsigned long pclk; +if (max98088->sysclk ==0 ) {dev_err (component->dev,"Invalid system clock frequency\n" );return -EINVAL ; } ni =65536ULL * (rate <50000 ?96ULL :48ULL ) * (unsigned long long int )rate; -do_div (ni, (unsigned long long int )max98088->sysclk); + pclk =DIV_ROUND_CLOSEST (max98088->sysclk, max98088->mclk_prescaler); + ni =DIV_ROUND_CLOSEST_ULL (ni, pclk);snd_soc_component_write (component,M98088_REG_1A_DAI2_CLKCFG_HI , (ni >>8 ) &0x7F ); snd_soc_component_write(component, M98088_REG_1B_DAI2_CLKCFG_LO,
@@ -1113,8 +1120,10 @@ static int max98088_dai_set_sysclk(struct snd_soc_dai *dai,*/ if ((freq >=10000000 ) && (freq <20000000 )) {snd_soc_component_write (component,M98088_REG_10_SYS_CLK ,0x10 ); + max98088->mclk_prescaler =1 ; }else if ((freq >=20000000 ) && (freq <30000000 )) {snd_soc_component_write (component,M98088_REG_10_SYS_CLK ,0x20 ); + max98088->mclk_prescaler =2 ; }else {dev_err (component->dev,"Invalid master clock frequency\n" );return -EINVAL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 3/131 ASoC: amd: fix for pcm_read() error
In reply to Greg Kroah-HartmanFrom: Vijendar Mukunda <[email protected]>
[ Upstream commit 6879e8e759bf9e05eaee85e32ca1a936e6b46da1 ]
Below phython script throwing pcm_read() error.
import subprocess
p = subprocess.Popen(["aplay -t raw -D plughw:1,0 /dev/zero"], shell=True) subprocess.call(["arecord -Dhw:1,0 --dump-hw-params"], shell=True) subprocess.call(["arecord -Dhw:1,0 -fdat -d1 /dev/null"], shell=True) p.kill()
Handling ACP global external interrupt enable register causing this issue.
This register got updated wrongly when there is active stream causing interrupts disabled for active stream. Refactored code to handle enabling and disabling external interrupts.
--- sound/soc/amd/raven/acp3x-pcm-dma.c | 10 ---------- sound/soc/amd/raven/acp3x.h | 1 + sound/soc/amd/raven/pci-acp3x.c | 15 +++++++++++++++ 3 files changed, 16 insertions(+), 10 deletions(-)
sound/soc/amd/raven/acp3x-pcm-dma.c +0 -10
@@ -237,10 +237,6 @@ static int acp3x_dma_open(struct snd_soc_component *component,return ret; } -if (!adata->play_stream && !adata->capture_stream && - !adata->i2ssp_play_stream && !adata->i2ssp_capture_stream) -rv_writel (1 , adata->acp3x_base + mmACP_EXTERNAL_INTR_ENB); - i2s_data->acp3x_base = adata->acp3x_base; runtime->private_data = i2s_data;return ret;
@@ -367,12 +363,6 @@ static int acp3x_dma_close(struct snd_soc_component *component, } } -/* Disable ACP irq, when the current stream is being closed and -* another stream is also not active. -*/ -if (!adata->play_stream && !adata->capture_stream && - !adata->i2ssp_play_stream && !adata->i2ssp_capture_stream) -rv_writel (0 , adata->acp3x_base + mmACP_EXTERNAL_INTR_ENB);return 0 ; }
sound/soc/amd/raven/acp3x.h +1 -0
@@ -77,6 +77,7 @@#define ACP_POWER_OFF_IN_PROGRESS 0x03#define ACP3x_ITER_IRER_SAMP_LEN_MASK 0x38 +#define ACP_EXT_INTR_STAT_CLEAR_MASK 0xFFFFFFFFstruct acp3x_platform_info {u16 play_i2s_instance;
sound/soc/amd/raven/pci-acp3x.c +15 -0
@@ -76,6 +76,19 @@ static int acp3x_reset(void __iomem *acp3x_base)return -ETIMEDOUT ; } +static void acp3x_enable_interrupts (void __iomem *acp_base) +{ +rv_writel (0x01 , acp_base + mmACP_EXTERNAL_INTR_ENB); +} + +static void acp3x_disable_interrupts (void __iomem *acp_base) +{ +rv_writel (ACP_EXT_INTR_STAT_CLEAR_MASK , acp_base + + mmACP_EXTERNAL_INTR_STAT); +rv_writel (0x00 , acp_base + mmACP_EXTERNAL_INTR_CNTL); +rv_writel (0x00 , acp_base + mmACP_EXTERNAL_INTR_ENB); +} +static int acp3x_init (struct acp3x_dev_data *adata) {void __iomem *acp3x_base = adata->acp3x_base;
@@ -93,6 +106,7 @@ static int acp3x_init(struct acp3x_dev_data *adata)pr_err ("ACP3x reset failed\n" );return ret; } +acp3x_enable_interrupts (acp3x_base);return 0 ; }
@@ -100,6 +114,7 @@ static int acp3x_deinit(void __iomem *acp3x_base) {int ret; +acp3x_disable_interrupts (acp3x_base);/* Reset */ ret =acp3x_reset (acp3x_base);if (ret) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 4/131 spi: Fix spi device unregister flow
In reply to Greg Kroah-HartmanFrom: Saravana Kannan <[email protected]>
[ Upstream commit c7299fea67696db5bd09d924d1f1080d894f92ef ]
When an SPI device is unregistered, the spi->controller->cleanup() is called in the device's release callback. That's wrong for a couple of reasons:
1. spi_dev_put() can be called before spi_add_device() is called. And it's spi_add_device() that calls spi_setup(). This will cause clean() to get called without the spi device ever being setup.
2. There's no guarantee that the controller's driver would be present by the time the spi device's release function gets called.
3. It also causes "sleeping in atomic context" stack dump[1] when device link deletion code does a put_device() on the spi device.
Fix these issues by simply moving the cleanup from the device release callback to the actual spi_unregister_device() function.
[1] - https://lore.kernel.org/lkml/CAHp75Vc=FCGcUyS0v6fnxme2YJ+qD+Y-hQDQLa2JhWNON9VmsQ@mail.gmail.com/
--- drivers/spi/spi.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/spi/spi.c +12 -6
@@ -47,10 +47,6 @@ static void spidev_release(struct device *dev) {struct spi_device *spi =to_spi_device (dev); -/* spi controllers may cleanup for released devices */ -if (spi->controller->cleanup) - spi->controller->cleanup (spi); -spi_controller_put (spi->controller);kfree (spi->driver_override);kfree (spi);
@@ -550,6 +546,12 @@ static int spi_dev_check(struct device *dev, void *data)return 0 ; } +static void spi_cleanup (struct spi_device *spi) +{ +if (spi->controller->cleanup) + spi->controller->cleanup (spi); +} +/** * spi_add_device - Add spi_device allocated with spi_alloc_device * @spi: spi_device to register
@@ -614,11 +616,13 @@ int spi_add_device(struct spi_device *spi)/* Device may be bound to an active driver when this returns */ status =device_add (&spi->dev); -if (status <0 ) +if (status <0 ) {dev_err (dev,"can't add %s, status %d\n" ,dev_name (&spi->dev), status); -else +spi_cleanup (spi); + }else {dev_dbg (dev,"registered child %s\n" ,dev_name (&spi->dev)); + } done:mutex_unlock (&spi_add_lock);
@@ -705,6 +709,8 @@ void spi_unregister_device(struct spi_device *spi)if (!spi)return ; +spi_cleanup (spi); +if (spi->dev.of_node) {of_node_clear_flag (spi->dev.of_node,OF_POPULATED );of_node_put (spi->dev.of_node);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 5/131 spi: spi-zynq-qspi: Fix stack violation bug
In reply to Greg Kroah-HartmanFrom: Karen Dombroski <[email protected]>
[ Upstream commit 6d5ff8e632a4f2389c331e5554cd1c2a9a28c7aa ]
When the number of bytes for the op is greater than one, the read could run off the end of the function stack and cause a crash.
This patch restores the behaviour of safely reading out of the original opcode location.
--- drivers/spi/spi-zynq-qspi.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/spi/spi-zynq-qspi.c +3 -4
@@ -528,18 +528,17 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,struct zynq_qspi *xqspi =spi_controller_get_devdata (mem->spi->master);int err =0 , i;u8 *tmpbuf; -u8 opcode = op->cmd.opcode;dev_dbg (xqspi->dev,"cmd:%#x mode:%d.%d.%d.%d\n" , - opcode, op->cmd.buswidth, op->addr.buswidth, + op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth, op->dummy.buswidth, op->data.buswidth);zynq_qspi_chipselect (mem->spi, true);zynq_qspi_config_op (xqspi, mem->spi); -if (op->cmd.nbytes) { +if (op->cmd.opcode) {reinit_completion (&xqspi->data_completion); - xqspi->txbuf = &opcode; + xqspi->txbuf = (u8 *)&op->cmd.opcode; xqspi->rxbuf =NULL ; xqspi->tx_bytes = op->cmd.nbytes; xqspi->rx_bytes = op->cmd.nbytes;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 6/131 bpf: Forbid trampoline attach for functions with variable arguments
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
[ Upstream commit 31379397dcc364a59ce764fabb131b645c43e340 ]
We can't currently allow to attach functions with variable arguments. The problem is that we should save all the registers for arguments, which is probably doable, but if caller uses more than 6 arguments, we need stack data, which will be wrong, because of the extra stack frame we do in bpf trampoline, so we could crash.
Also currently there's malformed trampoline code generated for such functions at the moment as described in:
https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/btf.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
kernel/bpf/btf.c +12 -0
@@ -4960,6 +4960,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, m->ret_size = ret;for (i =0 ; i < nargs; i++) { +if (i == nargs -1 && args[i].type ==0 ) { +bpf_log (log, +"The function %s with variable args is unsupported.\n" , + tname); +return -EINVAL ; + } ret =__get_type_size (btf, args[i].type, &t);if (ret <0 ) { bpf_log(log,
@@ -4967,6 +4973,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, tname, i, btf_kind_str[BTF_INFO_KIND(t->info)]);return -EINVAL ; } +if (ret ==0 ) { +bpf_log (log, +"The function %s has malformed void argument.\n" , + tname); +return -EINVAL ; + } m->arg_size[i] = ret; } m->nr_args = nargs;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 7/131 net/nfc/rawsock.c: fix a permission check bug
In reply to Greg Kroah-HartmanFrom: Jeimon <[email protected]>
[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ]
The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable().
--- net/nfc/rawsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/nfc/rawsock.c +1 -1
@@ -329,7 +329,7 @@ static int rawsock_create(struct net *net, struct socket *sock,return -ESOCKTNOSUPPORT ;if (sock->type ==SOCK_RAW ) { -if (!capable (CAP_NET_RAW )) +if (!ns_capable (net->user_ns,CAP_NET_RAW ))return -EPERM ; sock->ops = &rawsock_raw_ops; }else {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 8/131 usb: cdns3: Fix runtime PM imbalance on error
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 07adc0225484fc199e3dc15ec889f75f498c4fca ]
When cdns3_gadget_start() fails, a pairing PM usage counter decrement is needed to keep the counter balanced.
--- drivers/usb/cdns3/gadget.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/cdns3/gadget.c +3 -1
@@ -3255,8 +3255,10 @@ static int __cdns3_gadget_init(struct cdns3 *cdns)pm_runtime_get_sync (cdns->dev); ret =cdns3_gadget_start (cdns); -if (ret) +if (ret) { +pm_runtime_put_sync (cdns->dev);return ret; + }/* * Because interrupt line can be shared with other components in
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 9/131 ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 28c268d3acdd4cbcd2ac320b85609e77f84e74a7 ]
Add a quirk for the Glavey TM800A550L tablet, this BYTCR tablet has no CHAN package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which is the default for BYTCR devices.
--- sound/soc/intel/boards/bytcr_rt5640.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +11 -0
@@ -570,6 +570,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF1 | BYT_RT5640_MCLK_EN), }, + { /* Glavey TM800A550L */ + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AMI Corporation" ), +DMI_MATCH (DMI_BOARD_NAME ,"Aptio CRB" ), +/* Above strings are too generic, also match on BIOS version */ + DMI_MATCH(DMI_BIOS_VERSION, "ZY-8-BI-PX4S70VTR400-X423B-005-D"), + }, + .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, { .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 10/131 ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit f0353e1f53f92f7b3da91e6669f5d58ee222ebe8 ]
The Lenovo Miix 3-830 tablet has only 1 speaker, has an internal analog mic on IN1 and uses JD2 for jack-detect, add a quirk to automatically apply these settings on Lenovo Miix 3-830 tablets.
--- sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +14 -0
@@ -659,6 +659,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_MONO_SPEAKER | BYT_RT5640_MCLK_EN), }, + { /* Lenovo Miix 3-830 */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 3-830"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | +BYT_RT5640_JD_SRC_JD2_IN4N | +BYT_RT5640_OVCD_TH_2000UA | +BYT_RT5640_OVCD_SF_0P75 | +BYT_RT5640_MONO_SPEAKER | +BYT_RT5640_DIFF_MIC | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, { /* Linx Linx7 tablet */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LINX"),
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 11/131 bpf: Add deny list of btf ids check for tracing programs
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
[ Upstream commit 35e3815fa8102fab4dee75f3547472c66581125d ]
The recursion check in __bpf_prog_enter and __bpf_prog_exit leaves some (not inlined) functions unprotected:
In __bpf_prog_enter:
- migrate_disable is called before prog->active is checked
In __bpf_prog_exit:
- migrate_enable,rcu_read_unlock_strict are called after
prog->active is decreased
When attaching trampoline to them we get panic like:
traps: PANIC: double fault, error_code: 0x0 double fault: 0000 [#1] SMP PTI
RIP: 0010:__bpf_prog_enter+0x4/0x50 ... Call Trace: <IRQ> bpf_trampoline_6442466513_0+0x18/0x1000 migrate_disable+0x5/0x50 __bpf_prog_enter+0x9/0x50 bpf_trampoline_6442466513_0+0x18/0x1000 migrate_disable+0x5/0x50 __bpf_prog_enter+0x9/0x50 bpf_trampoline_6442466513_0+0x18/0x1000 migrate_disable+0x5/0x50 __bpf_prog_enter+0x9/0x50 bpf_trampoline_6442466513_0+0x18/0x1000 migrate_disable+0x5/0x50 ...
Fixing this by adding deny list of btf ids for tracing programs and checking btf id during program verification. Adding above functions to this list.
--- kernel/bpf/verifier.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
kernel/bpf/verifier.c +14 -0
@@ -12206,6 +12206,17 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,return 0 ; } +BTF_SET_START (btf_id_deny) +BTF_ID_UNUSED +#ifdef CONFIG_SMP +BTF_ID(func, migrate_disable) +BTF_ID(func, migrate_enable) +#endif +#if !definedCONFIG_PREEMPT_RCU && !definedCONFIG_TINY_RCU +BTF_ID(func, rcu_read_unlock_strict) +#endif +BTF_SET_END (btf_id_deny) + static int check_attach_btf_id(struct bpf_verifier_env *env) {struct bpf_prog *prog = env->prog;
@@ -12265,6 +12276,9 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) ret =bpf_lsm_verify_prog (&env->log, prog);if (ret <0 )return ret; + }else if (prog->type ==BPF_PROG_TYPE_TRACING && +btf_id_set_contains (&btf_id_deny, btf_id)) { +return -EINVAL ; } key =bpf_trampoline_compute_key (tgt_prog, btf_id);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 12/131 vfio-ccw: Reset FSM state to IDLE inside FSM
In reply to Greg Kroah-HartmanFrom: Eric Farman <[email protected]>
[ Upstream commit 6c02ac4c9211edabe17bda437ac97e578756f31b ]
When an I/O request is made, the fsm_io_request() routine moves the FSM state from IDLE to CP_PROCESSING, and then fsm_io_helper() moves it to CP_PENDING if the START SUBCHANNEL received a cc0. Yet, the error case to go from CP_PROCESSING back to IDLE is done after the FSM call returns.
Let's move this up into the FSM proper, to provide some better symmetry when unwinding in this case.
Message-Id: <[email protected]>
--- drivers/s390/cio/vfio_ccw_fsm.c | 1 + drivers/s390/cio/vfio_ccw_ops.c | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-)
drivers/s390/cio/vfio_ccw_fsm.c +1 -0
@@ -318,6 +318,7 @@ static void fsm_io_request(struct vfio_ccw_private *private, } err_out: + private->state =VFIO_CCW_STATE_IDLE ;trace_vfio_ccw_fsm_io_request (scsw->cmd.fctl, schid, io_region->ret_code, errstr); }
drivers/s390/cio/vfio_ccw_ops.c +0 -2
@@ -276,8 +276,6 @@ static ssize_t vfio_ccw_mdev_write_io_region(struct vfio_ccw_private *private, }vfio_ccw_fsm_event (private,VFIO_CCW_EVENT_IO_REQ ); -if (region->ret_code !=0 ) - private->state =VFIO_CCW_STATE_IDLE ; ret = (region->ret_code !=0 ) ? region->ret_code : count; out_unlock:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 13/131 vfio-ccw: Serialize FSM IDLE state with I/O completion
In reply to Greg Kroah-HartmanFrom: Eric Farman <[email protected]>
[ Upstream commit 2af7a834a435460d546f0cf0a8b8e4d259f1d910 ]
Today, the stacked call to vfio_ccw_sch_io_todo() does three things:
1) Update a solicited IRB with CP information, and release the CP if the interrupt was the end of a START operation.
2) Copy the IRB data into the io_region, under the protection of the io_mutex
3) Reset the vfio-ccw FSM state to IDLE to acknowledge that vfio-ccw can accept more work.
The trouble is that step 3 is (A) invoked for both solicited and unsolicited interrupts, and (B) sitting after the mutex for step 2. This second piece becomes a problem if it processes an interrupt for a CLEAR SUBCHANNEL while another thread initiates a START, thus allowing the CP and FSM states to get out of sync. That is:
CPU 1 CPU 2
fsm_do_clear()
fsm_irq()
fsm_io_request()
vfio_ccw_sch_io_todo()
fsm_io_helper()Since the FSM state and CP should be kept in sync, let's make a note when the CP is released, and rely on that as an indication that the FSM should also be reset at the end of this routine and open up the device for more work.
Message-Id: <[email protected]>
--- drivers/s390/cio/vfio_ccw_drv.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/s390/cio/vfio_ccw_drv.c +10 -2
@@ -86,6 +86,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)struct vfio_ccw_private *private;struct irb *irb;bool is_final; +bool cp_is_finished = false; private = container_of(work, struct vfio_ccw_private, io_work); irb = &private->irb;
@@ -94,14 +95,21 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));if (scsw_is_solicited (&irb->scsw)) {cp_update_scsw (&private->cp, &irb->scsw); -if (is_final && private->state ==VFIO_CCW_STATE_CP_PENDING ) +if (is_final && private->state ==VFIO_CCW_STATE_CP_PENDING ) {cp_free (&private->cp); + cp_is_finished = true; + } }mutex_lock (&private->io_mutex);memcpy (private->io_region->irb_area, irb,sizeof (*irb));mutex_unlock (&private->io_mutex); -if (private->mdev && is_final) +/* +* Reset to IDLE only if processing of a channel program +* has finished. Do not overwrite a possible processing +* state if the final interrupt was for HSCH or CSCH. +*/ +if (private->mdev && cp_is_finished) private->state =VFIO_CCW_STATE_IDLE ;if (private->io_trigger)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 14/131 ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-HartmanFrom: Zou Wei <[email protected]>
[ Upstream commit e072b2671606c77538d6a4dd5dda80b508cb4816 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this driver when it is built as an external module.
--- sound/soc/codecs/sti-sas.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/sti-sas.c +1 -0
@@ -411,6 +411,7 @@ static const struct of_device_id sti_sas_dev_match[] = { }, {}, }; +MODULE_DEVICE_TABLE (of, sti_sas_dev_match);static int sti_sas_driver_probe (struct platform_device *pdev) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 15/131 spi: sprd: Add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-HartmanFrom: Chunyan Zhang <[email protected]>
[ Upstream commit 7907cad7d07e0055789ec0c534452f19dfe1fc80 ]
MODULE_DEVICE_TABLE is used to extract the device information out of the driver and builds a table when being compiled. If using this macro, kernel can find the driver if available when the device is plugged in, and then loads that driver and initializes the device.
--- drivers/spi/spi-sprd.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-sprd.c +1 -0
@@ -1068,6 +1068,7 @@ static const struct of_device_id sprd_spi_of_match[] = { { .compatible = "sprd,sc9860-spi", }, {/* sentinel */ } }; +MODULE_DEVICE_TABLE (of, sprd_spi_of_match);static struct platform_driver sprd_spi_driver = { .driver = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 16/131 usb: chipidea: udc: assign interrupt number to USB gadget structure
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
[ Upstream commit 9e3927f6373da54cb17e17f4bd700907e1123d2f ]
Chipidea also need sync interrupt before unbind the udc while gadget remove driver, otherwise setup irq handling may happen while unbind, see below dump generated from android function switch stress test:
[ 4703.503056] android_work: sent uevent USB_STATE=CONNECTED [ 4703.514642] android_work: sent uevent USB_STATE=DISCONNECTED [ 4703.651339] android_work: sent uevent USB_STATE=CONNECTED [ 4703.661806] init: Control message: Processed ctl.stop for 'adbd' from pid: 561 (system_server) [ 4703.673469] init: processing action (init.svc.adbd=stopped) from (/system/etc/init/hw/init.usb.configfs.rc:14) [ 4703.676451] Unable to handle kernel read from unreadable memory at virtual address 0000000000000090 [ 4703.676454] Mem abort info: [ 4703.676458] ESR = 0x96000004 [ 4703.676461] EC = 0x25: DABT (current EL), IL = 32 bits [ 4703.676464] SET = 0, FnV = 0 [ 4703.676466] EA = 0, S1PTW = 0 [ 4703.676468] Data abort info: [ 4703.676471] ISV = 0, ISS = 0x00000004 [ 4703.676473] CM = 0, WnR = 0 [ 4703.676478] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004a867000 [ 4703.676481] [0000000000000090] pgd=0000000000000000, p4d=0000000000000000 [ 4703.676503] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 4703.758297] Modules linked in: synaptics_dsx_i2c moal(O) mlan(O) [ 4703.764327] CPU: 0 PID: 235 Comm: lmkd Tainted: G W O 5.10.9-00001-g3f5fd8487c38-dirty #63 [ 4703.773720] Hardware name: NXP i.MX8MNano EVK board (DT) [ 4703.779033] pstate: 60400085 (nZCv daIf +PAN -UAO -TCO BTYPE=--) [ 4703.785046] pc : _raw_write_unlock_bh+0xc0/0x2c8 [ 4703.789667] lr : android_setup+0x4c/0x168 [ 4703.793676] sp : ffff80001256bd80 [ 4703.796989] x29: ffff80001256bd80 x28: 00000000000000a8 [ 4703.802304] x27: ffff800012470000 x26: ffff80006d923000 [ 4703.807616] x25: ffff800012471000 x24: ffff00000b091140 [ 4703.812929] x23: ffff0000077dbd38 x22: ffff0000077da490 [ 4703.818242] x21: ffff80001256be30 x20: 0000000000000000 [ 4703.823554] x19: 0000000000000080 x18: ffff800012561048 [ 4703.828867] x17: 0000000000000000 x16: 0000000000000039 [ 4703.834180] x15: ffff8000106ad258 x14: ffff80001194c277 [ 4703.839493] x13: 0000000000003934 x12: 0000000000000000 [ 4703.844805] x11: 0000000000000000 x10: 0000000000000001 [ 4703.850117] x9 : 0000000000000000 x8 : 0000000000000090 [ 4703.855429] x7 : 6f72646e61203a70 x6 : ffff8000124f2450 [ 4703.860742] x5 : ffffffffffffffff x4 : 0000000000000009 [ 4703.866054] x3 : ffff8000108a290c x2 : ffff00007fb3a9c8 [ 4703.871367] x1 : 0000000000000000 x0 : 0000000000000090 [ 4703.876681] Call trace: [ 4703.879129] _raw_write_unlock_bh+0xc0/0x2c8 [ 4703.883397] android_setup+0x4c/0x168 [ 4703.887059] udc_irq+0x824/0xa9c [ 4703.890287] ci_irq+0x124/0x148 [ 4703.893429] __handle_irq_event_percpu+0x84/0x268 [ 4703.898131] handle_irq_event+0x64/0x14c [ 4703.902054] handle_fasteoi_irq+0x110/0x210 [ 4703.906236] __handle_domain_irq+0x8c/0xd4 [ 4703.910332] gic_handle_irq+0x6c/0x124 [ 4703.914081] el1_irq+0xdc/0x1c0 [ 4703.917221] _raw_spin_unlock_irq+0x20/0x54 [ 4703.921405] finish_task_switch+0x84/0x224 [ 4703.925502] __schedule+0x4a4/0x734 [ 4703.928990] schedule+0xa0/0xe8 [ 4703.932132] do_notify_resume+0x150/0x184 [ 4703.936140] work_pending+0xc/0x40c [ 4703.939633] Code: d5384613 521b0a69 d5184609 f9800111 (885ffd01) [ 4703.945732] ---[ end trace ba5c1875ae49d53c ]--- [ 4703.950350] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 4703.957223] SMP: stopping secondary CPUs [ 4703.961151] Kernel Offset: disabled [ 4703.964638] CPU features: 0x0240002,2000200c [ 4703.968905] Memory Limit: none [ 4703.971963] Rebooting in 5 seconds..
--- drivers/usb/chipidea/udc.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/chipidea/udc.c +1 -0
@@ -2055,6 +2055,7 @@ static int udc_start(struct ci_hdrc *ci) ci->gadget.name = ci->platdata->name; ci->gadget.otg_caps = otg_caps; ci->gadget.sg_supported =1 ; + ci->gadget.irq = ci->irq;if (ci->platdata->flags &CI_HDRC_REQUIRES_ALIGNED_DMA ) ci->gadget.quirk_avoids_skb_reserve =1 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 17/131 isdn: mISDN: netjet: Fix crash in nj_probe:
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 9f6f852550d0e1b7735651228116ae9d300f69b3 ]
'nj_setup' in netjet.c might fail with -EIO and in this case 'card->irq' is initialized and is bigger than zero. A subsequent call to 'nj_release' will free the irq that has not been requested.
Fix this bug by deleting the previous assignment to 'card->irq' and just keep the assignment before 'request_irq'.
The KASAN's log reveals it:
[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826free_irq+0x100/0x480
[ 3.355112 ] Modules linked in:
[ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
5.13.0-rc1-00144-g25a1298726e #13
[ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 3.356552 ] RIP: 0010:free_irq+0x100/0x480
[ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18
4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80
[ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082
[ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:
0000000000000000
[ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:00000000ffffffff
[ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:
0000000000000000
[ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:
0000000000000000
[ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:ffff888104dc80a8
[ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000)
knlGS:0000000000000000
[ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4:00000000000006f0
[ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ 3.362175 ] Call Trace: [ 3.362175 ] nj_release+0x51/0x1e0 [ 3.362175 ] nj_probe+0x450/0x950 [ 3.362175 ] ? pci_device_remove+0x110/0x110 [ 3.362175 ] local_pci_probe+0x45/0xa0 [ 3.362175 ] pci_device_probe+0x12b/0x1d0 [ 3.362175 ] really_probe+0x2a9/0x610 [ 3.362175 ] driver_probe_device+0x90/0x1d0 [ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 [ 3.362175 ] device_driver_attach+0x68/0x70 [ 3.362175 ] __driver_attach+0x124/0x1b0 [ 3.362175 ] ? device_driver_attach+0x70/0x70 [ 3.362175 ] bus_for_each_dev+0xbb/0x110 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] driver_attach+0x27/0x30 [ 3.362175 ] bus_add_driver+0x1eb/0x2a0 [ 3.362175 ] driver_register+0xa9/0x180 [ 3.362175 ] __pci_register_driver+0x82/0x90 [ 3.362175 ] ? w6692_init+0x38/0x38 [ 3.362175 ] nj_init+0x36/0x38 [ 3.362175 ] do_one_initcall+0x7f/0x3d0 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 [ 3.362175 ] kernel_init_freeable+0x2aa/0x301 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] kernel_init+0x18/0x190 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ret_from_fork+0x1f/0x30 [ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ... [ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00144-g25a1298726e #13 [ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.362175 ] Call Trace: [ 3.362175 ] dump_stack+0xba/0xf5 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] panic+0x15a/0x3f2 [ 3.362175 ] ? __warn+0xf2/0x150 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] __warn+0x108/0x150 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] report_bug+0x119/0x1c0 [ 3.362175 ] handle_bug+0x3b/0x80 [ 3.362175 ] exc_invalid_op+0x18/0x70 [ 3.362175 ] asm_exc_invalid_op+0x12/0x20 [ 3.362175 ] RIP: 0010:free_irq+0x100/0x480 [ 3.362175 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18
4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80
[ 3.362175 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082
[ 3.362175 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:
0000000000000000
[ 3.362175 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:00000000ffffffff
[ 3.362175 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:
0000000000000000
[ 3.362175 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:
0000000000000000
[ 3.362175 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:ffff888104dc80a8
[ 3.362175 ] ? vprintk+0x76/0x150 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] nj_release+0x51/0x1e0 [ 3.362175 ] nj_probe+0x450/0x950 [ 3.362175 ] ? pci_device_remove+0x110/0x110 [ 3.362175 ] local_pci_probe+0x45/0xa0 [ 3.362175 ] pci_device_probe+0x12b/0x1d0 [ 3.362175 ] really_probe+0x2a9/0x610 [ 3.362175 ] driver_probe_device+0x90/0x1d0 [ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 [ 3.362175 ] device_driver_attach+0x68/0x70 [ 3.362175 ] __driver_attach+0x124/0x1b0 [ 3.362175 ] ? device_driver_attach+0x70/0x70 [ 3.362175 ] bus_for_each_dev+0xbb/0x110 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] driver_attach+0x27/0x30 [ 3.362175 ] bus_add_driver+0x1eb/0x2a0 [ 3.362175 ] driver_register+0xa9/0x180 [ 3.362175 ] __pci_register_driver+0x82/0x90 [ 3.362175 ] ? w6692_init+0x38/0x38 [ 3.362175 ] nj_init+0x36/0x38 [ 3.362175 ] do_one_initcall+0x7f/0x3d0 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 [ 3.362175 ] kernel_init_freeable+0x2aa/0x301 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] kernel_init+0x18/0x190 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ret_from_fork+0x1f/0x30 [ 3.362175 ] Dumping ftrace buffer: [ 3.362175 ] (ftrace buffer empty) [ 3.362175 ] Kernel Offset: disabled [ 3.362175 ] Rebooting in 1 seconds..
--- drivers/isdn/hardware/mISDN/netjet.c | 1 - 1 file changed, 1 deletion(-)
drivers/isdn/hardware/mISDN/netjet.c +0 -1
@@ -1100,7 +1100,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent) card->typ =NETJET_S_TJ300 ; card->base =pci_resource_start (pdev,0 ); - card->irq = pdev->irq;pci_set_drvdata (pdev, card); err =setup_instance (card);if (err)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 18/131 bonding: init notify_work earlier to avoid uninitialized use
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 35d96e631860226d5dc4de0fad0a415362ec2457 ]
If bond_kobj_init() or later kzalloc() in bond_alloc_slave() fail, then we call kobject_put() on the slave->kobj. This in turn calls the release function slave_kobj_release() which will always try to cancel_delayed_work_sync(&slave->notify_work), which shouldn't be done on an uninitialized work struct.
Always initialize the work struct earlier to avoid problems here.
Syzbot bisected this down to a completely pointless commit, some fault injection may have been at work here that caused the alloc failure in the first place, which may interact badly with bisect.
--- drivers/net/bonding/bond_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +1 -1
@@ -1502,6 +1502,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond, slave->bond = bond; slave->dev = slave_dev; +INIT_DELAYED_WORK (&slave->notify_work, bond_netdev_notify_work);if (bond_kobj_init (slave))return NULL ;
@@ -1514,7 +1515,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond,return NULL ; } } -INIT_DELAYED_WORK (&slave->notify_work, bond_netdev_notify_work);return slave; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 19/131 netlink: disable IRQs for netlink_lock_table()
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 1d482e666b8e74c7555dbdfbfb77205eeed3ff2d ]
Syzbot reports that in mac80211 we have a potential deadlock between our "local->stop_queue_reasons_lock" (spinlock) and netlink's nl_table_lock (rwlock). This is because there's at least one situation in which we might try to send a netlink message with this spinlock held while it is also possible to take the spinlock from a hardirq context, resulting in the following deadlock scenario reported by lockdep:
CPU0 CPU1
---- ----
lock(nl_table_lock);
local_irq_disable();
lock(&local->queue_stop_reason_lock);
lock(nl_table_lock);
<Interrupt>
lock(&local->queue_stop_reason_lock);This seems valid, we can take the queue_stop_reason_lock in any kind of context ("CPU0"), and call ieee80211_report_ack_skb() with the spinlock held and IRQs disabled ("CPU1") in some code path (ieee80211_do_stop() via ieee80211_free_txskb()).
Short of disallowing netlink use in scenarios like these (which would be rather complex in mac80211's case due to the deep callchain), it seems the only fix for this is to disable IRQs while nl_table_lock is held to avoid hitting this scenario, this disallows the "CPU0" portion of the reported deadlock.
Note that the writer side (netlink_table_grab()) already disables IRQs for this lock.
Unfortunately though, this seems like a huge hammer, and maybe the whole netlink table locking should be reworked.
--- net/netlink/af_netlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netlink/af_netlink.c +4 -2
@@ -453,11 +453,13 @@ void netlink_table_ungrab(void)static inline void netlink_lock_table (void ) { +unsigned long flags; +/* read_lock() synchronizes us to netlink_table_grab */ -read_lock (&nl_table_lock); +read_lock_irqsave (&nl_table_lock, flags);atomic_inc (&nl_table_users); -read_unlock (&nl_table_lock); +read_unlock_irqrestore (&nl_table_lock, flags); } static inline void
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 20/131 net: mdiobus: get rid of a BUG_ON()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ]
We spotted a bug recently during a review where a driver was unregistering a bus that wasn't registered, which would trigger this BUG_ON(). Let's handle that situation more gracefully, and just print a warning and return.
--- drivers/net/phy/mdio_bus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/phy/mdio_bus.c +2 -1
@@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus)struct mdio_device *mdiodev;int i; -BUG_ON (bus->state !=MDIOBUS_REGISTERED ); +if (WARN_ON_ONCE (bus->state !=MDIOBUS_REGISTERED )) +return ; bus->state =MDIOBUS_UNREGISTERED ;for (i =0 ; i <PHY_MAX_ADDR ; i++) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 21/131 cgroup: disable controllers at parse time
In reply to Greg Kroah-HartmanFrom: Shakeel Butt <[email protected]>
[ Upstream commit 45e1ba40837ac2f6f4d4716bddb8d44bd7e4a251 ]
This patch effectively reverts the commit a3e72739b7a7 ("cgroup: fix too early usage of static_branch_disable()"). The commit 6041186a3258 ("init: initialize jump labels before command line option parsing") has moved the jump_label_init() before parse_args() which has made the commit a3e72739b7a7 unnecessary. On the other hand there are consequences of disabling the controllers later as there are subsystems doing the controller checks for different decisions. One such incident is reported [1] regarding the memory controller and its impact on memory reclaim code.
[1] https://lore.kernel.org/linux-mm/[email protected]
--- kernel/cgroup/cgroup.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
kernel/cgroup/cgroup.c +5 -8
@@ -5665,8 +5665,6 @@ int __init cgroup_init_early(void)return 0 ; } -static u16 cgroup_disable_mask__initdata ; -/** * cgroup_init - cgroup initialization *
@@ -5725,12 +5723,8 @@ int __init cgroup_init(void)* disabled flag and cftype registration needs kmalloc, * both of which aren't available during early_init. */ -if (cgroup_disable_mask & (1 << ssid)) { -static_branch_disable (cgroup_subsys_enabled_key[ssid]); -printk (KERN_INFO "Disabling %s control group subsystem\n" , - ss->name); +if (!cgroup_ssid_enabled (ssid))continue ; - }if (cgroup1_ssid_disabled (ssid)) printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n",
@@ -6245,7 +6239,10 @@ static int __init cgroup_disable(char *str)if (strcmp (token, ss->name) &&strcmp (token, ss->legacy_name))continue ; - cgroup_disable_mask |=1 << i; + +static_branch_disable (cgroup_subsys_enabled_key[i]); +pr_info ("Disabling %s control group subsystem\n" , + ss->name); } }return 1 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 22/131 wq: handle VM suspension in stall detection
In reply to Greg Kroah-HartmanFrom: Sergey Senozhatsky <[email protected]>
[ Upstream commit 940d71c6462e8151c78f28e4919aa8882ff2054e ]
If VCPU is suspended (VM suspend) in wq_watchdog_timer_fn() then once this VCPU resumes it will see the new jiffies value, while it may take a while before IRQ detects PVCLOCK_GUEST_STOPPED on this VCPU and updates all the watchdogs via pvclock_touch_watchdogs(). There is a small chance of misreported WQ stalls in the meantime, because new jiffies is time_after() old 'ts + thresh'.
wq_watchdog_timer_fn()
{
for_each_pool(pool, pi) {
if (time_after(jiffies, ts + thresh)) {
pr_emerg("BUG: workqueue lockup - pool");
}
}
}Save jiffies at the beginning of this function and use that value for stall detection. If VM gets suspended then we continue using "old" jiffies value and old WQ touch timestamps. If IRQ at some point restarts the stall detection cycle (pvclock_touch_watchdogs()) then old jiffies will always be before new 'ts + thresh'.
--- kernel/workqueue.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
kernel/workqueue.c +10 -2
@@ -50,6 +50,7 @@#include <linux/uaccess.h> #include <linux/sched/isolation.h> #include <linux/nmi.h> +#include <linux/kvm_para.h> #include "workqueue_internal.h"
@@ -5758,6 +5759,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) {unsigned long thresh =READ_ONCE (wq_watchdog_thresh) *HZ ;bool lockup_detected = false; +unsigned long now = jiffies;struct worker_pool *pool;int pi;
@@ -5772,6 +5774,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)if (list_empty (&pool->worklist))continue ; +/* +* If a virtual machine is stopped by the host it can look to +* the watchdog like a stall. +*/ +kvm_check_and_clear_guest_paused (); +/* get the latest of pool and touched timestamps */ pool_ts =READ_ONCE (pool->watchdog_ts); touched =READ_ONCE (wq_watchdog_touched);
@@ -5790,12 +5798,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) }/* did we stall? */ -if (time_after (jiffies, ts + thresh)) { +if (time_after (now, ts + thresh)) { lockup_detected = true;pr_emerg ("BUG: workqueue lockup - pool" );pr_cont_pool_info (pool);pr_cont (" stuck for %us!\n" , -jiffies_to_msecs (jiffies - pool_ts) /1000 ); +jiffies_to_msecs (now - pool_ts) /1000 ); } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 23/131 net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 13a6f3153922391e90036ba2267d34eed63196fc ]
When calling the 'ql_sem_spinlock', the driver has already acquired the spin lock, so the driver should not call 'ssleep' in atomic context.
This bug can be fixed by using 'mdelay' instead of 'ssleep'.
The KASAN's log reveals it:
[ 3.238124 ] BUG: scheduling while atomic: swapper/0/1/0x00000002
[ 3.238748 ] 2 locks held by swapper/0/1:
[ 3.239151 ] #0: ffff88810177b240 (&dev->mutex){....}-{3:3}, at:
__device_driver_lock+0x41/0x60
[ 3.240026 ] #1: ffff888107c60e28 (&qdev->hw_lock){....}-{2:2}, at:
ql3xxx_probe+0x2aa/0xea0
[ 3.240873 ] Modules linked in:
[ 3.241187 ] irq event stamp: 460854
[ 3.241541 ] hardirqs last enabled at (460853): [<ffffffff843051bf>]_raw_spin_unlock_irqrestore+0x4f/0x70
[ 3.242245 ] hardirqs last disabled at (460854): [<ffffffff843058ca>]_raw_spin_lock_irqsave+0x2a/0x70
[ 3.242245 ] softirqs last enabled at (446076): [<ffffffff846002e4>]__do_softirq+0x2e4/0x4b1
[ 3.242245 ] softirqs last disabled at (446069): [<ffffffff811ba5e0>]irq_exit_rcu+0x100/0x110
[ 3.242245 ] Preemption disabled at: [ 3.242245 ] [<ffffffff828ca5ba>] ql3xxx_probe+0x2aa/0xea0 [ 3.242245 ] Kernel panic - not syncing: scheduling while atomic [ 3.242245 ] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00145 -gee7dc339169-dirty #16 [ 3.242245 ] Call Trace: [ 3.242245 ] dump_stack+0xba/0xf5 [ 3.242245 ] ? ql3xxx_probe+0x1f0/0xea0 [ 3.242245 ] panic+0x15a/0x3f2 [ 3.242245 ] ? vprintk+0x76/0x150 [ 3.242245 ] ? ql3xxx_probe+0x2aa/0xea0 [ 3.242245 ] __schedule_bug+0xae/0xe0 [ 3.242245 ] __schedule+0x72e/0xa00 [ 3.242245 ] schedule+0x43/0xf0 [ 3.242245 ] schedule_timeout+0x28b/0x500 [ 3.242245 ] ? del_timer_sync+0xf0/0xf0 [ 3.242245 ] ? msleep+0x2f/0x70 [ 3.242245 ] msleep+0x59/0x70 [ 3.242245 ] ql3xxx_probe+0x307/0xea0 [ 3.242245 ] ? _raw_spin_unlock_irqrestore+0x3a/0x70 [ 3.242245 ] ? pci_device_remove+0x110/0x110 [ 3.242245 ] local_pci_probe+0x45/0xa0 [ 3.242245 ] pci_device_probe+0x12b/0x1d0 [ 3.242245 ] really_probe+0x2a9/0x610 [ 3.242245 ] driver_probe_device+0x90/0x1d0 [ 3.242245 ] ? mutex_lock_nested+0x1b/0x20 [ 3.242245 ] device_driver_attach+0x68/0x70 [ 3.242245 ] __driver_attach+0x124/0x1b0 [ 3.242245 ] ? device_driver_attach+0x70/0x70 [ 3.242245 ] bus_for_each_dev+0xbb/0x110 [ 3.242245 ] ? rdinit_setup+0x45/0x45 [ 3.242245 ] driver_attach+0x27/0x30 [ 3.242245 ] bus_add_driver+0x1eb/0x2a0 [ 3.242245 ] driver_register+0xa9/0x180 [ 3.242245 ] __pci_register_driver+0x82/0x90 [ 3.242245 ] ? yellowfin_init+0x25/0x25 [ 3.242245 ] ql3xxx_driver_init+0x23/0x25 [ 3.242245 ] do_one_initcall+0x7f/0x3d0 [ 3.242245 ] ? rdinit_setup+0x45/0x45 [ 3.242245 ] ? rcu_read_lock_sched_held+0x4f/0x80 [ 3.242245 ] kernel_init_freeable+0x2aa/0x301 [ 3.242245 ] ? rest_init+0x2c0/0x2c0 [ 3.242245 ] kernel_init+0x18/0x190 [ 3.242245 ] ? rest_init+0x2c0/0x2c0 [ 3.242245 ] ? rest_init+0x2c0/0x2c0 [ 3.242245 ] ret_from_fork+0x1f/0x30 [ 3.242245 ] Dumping ftrace buffer: [ 3.242245 ] (ftrace buffer empty) [ 3.242245 ] Kernel Offset: disabled [ 3.242245 ] Rebooting in 1 seconds.
--- drivers/net/ethernet/qlogic/qla3xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qla3xxx.c +1 -1
@@ -114,7 +114,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev, value =readl (&port_regs->CommonRegs.semaphoreReg);if ((value & (sem_mask >>16 )) == sem_bits)return 0 ; -ssleep (1 ); +mdelay (1000 ); }while (--seconds);return -1 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 24/131 RDS tcp loopback connection can hang
In reply to Greg Kroah-HartmanFrom: Rao Shoaib <[email protected]>
[ Upstream commit aced3ce57cd37b5ca332bcacd370d01f5a8c5371 ]
When TCP is used as transport and a program on the system connects to RDS port 16385, connection is accepted but denied per the rules of RDS. However, RDS connections object is left in the list. Next loopback connection will select that connection object as it is at the head of list. The connection attempt will hang as the connection object is set to connect over TCP which is not allowed
The issue can be reproduced easily, use rds-ping to ping a local IP address. After that use any program like ncat to connect to the same IP address and port 16385. This will hang so ctrl-c out. Now try rds-ping, it will hang.
To fix the issue this patch adds checks to disallow the connection object creation and destroys the connection object.
--- net/rds/connection.c | 23 +++++++++++++++++------ net/rds/tcp.c | 4 ++-- net/rds/tcp.h | 3 ++- net/rds/tcp_listen.c | 6 ++++++ 4 files changed, 27 insertions(+), 9 deletions(-)
net/rds/connection.c +17 -6
@@ -240,12 +240,23 @@ static struct rds_connection *__rds_conn_create(struct net *net,if (loop_trans) {rds_trans_put (loop_trans); conn->c_loopback =1 ; -if (is_outgoing && trans->t_prefer_loopback) { -/* "outgoing" connection - and the transport -* says it wants the connection handled by the -* loopback transport. This is what TCP does. -*/ - trans = &rds_loop_transport; +if (trans->t_prefer_loopback) { +if (likely (is_outgoing)) { +/* "outgoing" connection to local address. +* Protocol says it wants the connection +* handled by the loopback transport. +* This is what TCP does. +*/ + trans = &rds_loop_transport; + }else { +/* No transport currently in use +* should end up here, but if it +* does, reset/destroy the connection. +*/ +kmem_cache_free (rds_conn_slab, conn); + conn =ERR_PTR (-EOPNOTSUPP ); + goto out; + } } }
net/rds/tcp.c +2 -2
@@ -313,8 +313,8 @@ out: }#endif -static int rds_tcp_laddr_check (struct net *net,const struct in6_addr *addr, -__u32 scope_id) +int rds_tcp_laddr_check (struct net *net,const struct in6_addr *addr, +__u32 scope_id) {struct net_device *dev =NULL ;#if IS_ENABLED (CONFIG_IPV6 )
net/rds/tcp.h +2 -1
@@ -59,7 +59,8 @@ u32 rds_tcp_snd_una(struct rds_tcp_connection *tc);u64 rds_tcp_map_seq (struct rds_tcp_connection *tc,u32 seq);extern struct rds_transport rds_tcp_transport;void rds_tcp_accept_work (struct sock *sk); - +int rds_tcp_laddr_check (struct net *net,const struct in6_addr *addr, +__u32 scope_id);/* tcp_connect.c */ int rds_tcp_conn_path_connect (struct rds_conn_path *cp);void rds_tcp_conn_path_shutdown (struct rds_conn_path *conn);
net/rds/tcp_listen.c +6 -0
@@ -167,6 +167,12 @@ int rds_tcp_accept_one(struct socket *sock) }#endif +if (!rds_tcp_laddr_check (sock_net (sock->sk), peer_addr, dev_if)) { +/* local address connection is only allowed via loopback */ + ret = -EOPNOTSUPP ; + goto out; + } + conn =rds_conn_create (sock_net (sock->sk), my_addr, peer_addr, &rds_tcp_transport,0 ,GFP_KERNEL , dev_if);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 25/131 net:sfc: fix non-freed irq in legacy irq mode
In reply to Greg Kroah-HartmanFrom: Íñigo Huguet <[email protected]>
[ Upstream commit 8f03eeb6e0a0a0b8d617ee0a4bce729e47130036 ]
SFC driver can be configured via modparam to work using MSI-X, MSI or legacy IRQ interrupts. In the last one, the interrupt was not properly released on module remove.
It was not freed because the flag irqs_hooked was not set during initialization in the case of using legacy IRQ.
Example of (trimmed) trace during module remove without this fix:
remove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1'
WARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170 ...trimmed... Call Trace: unregister_irq_proc+0xe3/0x100 free_desc+0x29/0x70 irq_free_descs+0x47/0x70 mp_unmap_irq+0x58/0x60 acpi_unregister_gsi_ioapic+0x2a/0x40 acpi_pci_irq_disable+0x78/0xb0 pci_disable_device+0xd1/0x100 efx_pci_remove+0xa1/0x1e0 [sfc] pci_device_remove+0x38/0xa0 __device_release_driver+0x177/0x230 driver_detach+0xcb/0x110 bus_remove_driver+0x58/0xd0 pci_unregister_driver+0x2a/0xb0 efx_exit_module+0x24/0xf40 [sfc] __do_sys_delete_module.constprop.0+0x171/0x280 ? exit_to_user_mode_prepare+0x83/0x1d0 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f9f9385800b
...trimmed...
--- drivers/net/ethernet/sfc/nic.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/sfc/nic.c +1 -0
@@ -90,6 +90,7 @@ int efx_nic_init_interrupt(struct efx_nic *efx) efx->pci_dev->irq); goto fail1; } + efx->irqs_hooked = true;return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 26/131 scsi: bnx2fc: Return failure if io_req is already in ABTS processing
In reply to Greg Kroah-HartmanFrom: Javed Hasan <[email protected]>
[ Upstream commit 122c81c563b0c1c6b15ff76a9159af5ee1f21563 ]
Return failure from bnx2fc_eh_abort() if io_req is already in ABTS processing.
--- drivers/scsi/bnx2fc/bnx2fc_io.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/bnx2fc/bnx2fc_io.c +1 -0
@@ -1220,6 +1220,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd)was a result from the ABTS request rather than the CLEANUP request */ set_bit (BNX2FC_FLAG_IO_CLEANUP , &io_req->req_flags); + rc =FAILED ; goto done; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 27/131 scsi: vmw_pvscsi: Set correct residual data length
In reply to Greg Kroah-HartmanFrom: Matt Wang <[email protected]>
[ Upstream commit e662502b3a782d479e67736a5a1c169a703d853a ]
Some commands (such as INQUIRY) may return less data than the initiator requested. To avoid conducting useless information, set the right residual count to make upper layer aware of this.
Before (INQUIRY PAGE 0xB0 with 128B buffer):
$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 SCSI Status: Good
Received 128 bytes of data:
00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ 10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... 20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
After:
$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 SCSI Status: Good
Received 64 bytes of data:
00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ 10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... 20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[mkp: clarified description]
--- drivers/scsi/vmw_pvscsi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/vmw_pvscsi.c +7 -1
@@ -587,7 +587,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,case BTSTAT_SUCCESS :case BTSTAT_LINKED_COMMAND_COMPLETED :case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG : -/* If everything went fine, let's move on.. */ +/* +* Commands like INQUIRY may transfer less data than +* requested by the initiator via bufflen. Set residual +* count to make upper layer aware of the actual amount +* of data returned. +*/ +scsi_set_resid (cmd,scsi_bufflen (cmd) - e->dataLen); cmd->result = (DID_OK <<16 );break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 28/131 scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 7907a021e4bbfa29cccacd2ba2dade894d9a7d4c ]
irqs allocated with devm_request_irq() should not be freed using free_irq(). Doing so causes a dangling pointer and a subsequent double free.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +4 -4
@@ -3359,14 +3359,14 @@ hisi_sas_v3_destroy_irqs(struct pci_dev *pdev, struct hisi_hba *hisi_hba) {int i; -free_irq (pci_irq_vector (pdev,1 ), hisi_hba); -free_irq (pci_irq_vector (pdev,2 ), hisi_hba); -free_irq (pci_irq_vector (pdev,11 ), hisi_hba); +devm_free_irq (&pdev->dev,pci_irq_vector (pdev,1 ), hisi_hba); +devm_free_irq (&pdev->dev,pci_irq_vector (pdev,2 ), hisi_hba); +devm_free_irq (&pdev->dev,pci_irq_vector (pdev,11 ), hisi_hba);for (i =0 ; i < hisi_hba->cq_nvecs; i++) {struct hisi_sas_cq *cq = &hisi_hba->cq[i];int nr = hisi_sas_intr_conv ?16 :16 + i; -free_irq (pci_irq_vector (pdev, nr), cq); +devm_free_irq (&pdev->dev,pci_irq_vector (pdev, nr), cq); }pci_free_irq_vectors (pdev); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 29/131 scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
In reply to Greg Kroah-HartmanFrom: Dmitry Bogdanov <[email protected]>
[ Upstream commit 2ef7665dfd88830f15415ba007c7c9a46be7acd8 ]
Target de-configuration panics at high CPU load because TPGT and WWPN can be removed on separate threads.
TPGT removal requests a reset HBA on a separate thread and waits for reset complete (phase1). Due to high CPU load that HBA reset can be delayed for some time.
WWPN removal does qlt_stop_phase2(). There it is believed that phase1 has already completed and thus tgt.tgt_ops is subsequently cleared. However, tgt.tgt_ops is needed to process incoming traffic and therefore this will cause one of the following panics:
NIP qlt_reset+0x7c/0x220 [qla2xxx]
LR qlt_reset+0x68/0x220 [qla2xxx]
Call Trace: 0xc000003ffff63a78 (unreliable) qlt_handle_imm_notify+0x800/0x10c0 [qla2xxx] qlt_24xx_atio_pkt+0x208/0x590 [qla2xxx] qlt_24xx_process_atio_queue+0x33c/0x7a0 [qla2xxx] qla83xx_msix_atio_q+0x54/0x90 [qla2xxx]
or
NIP qlt_24xx_handle_abts+0xd0/0x2a0 [qla2xxx]
LR qlt_24xx_handle_abts+0xb4/0x2a0 [qla2xxx]
Call Trace: qlt_24xx_handle_abts+0x90/0x2a0 [qla2xxx] (unreliable) qlt_24xx_process_atio_queue+0x500/0x7a0 [qla2xxx] qla83xx_msix_atio_q+0x54/0x90 [qla2xxx]
or
NIP qlt_create_sess+0x90/0x4e0 [qla2xxx]
LR qla24xx_do_nack_work+0xa8/0x180 [qla2xxx]
Call Trace: 0xc0000000348fba30 (unreliable) qla24xx_do_nack_work+0xa8/0x180 [qla2xxx] qla2x00_do_work+0x674/0xbf0 [qla2xxx]
qla2x00_iocb_work_fn
The patch fixes the issue by serializing qlt_stop_phase1() and qlt_stop_phase2() functions to make WWPN removal wait for phase1 completion.
--- drivers/scsi/qla2xxx/qla_target.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/qla2xxx/qla_target.c +2 -0
@@ -1559,10 +1559,12 @@ void qlt_stop_phase2(struct qla_tgt *tgt)return ; } +mutex_lock (&tgt->ha->optrom_mutex);mutex_lock (&vha->vha_tgt.tgt_mutex); tgt->tgt_stop =0 ; tgt->tgt_stopped =1 ;mutex_unlock (&vha->vha_tgt.tgt_mutex); +mutex_unlock (&tgt->ha->optrom_mutex);ql_dbg (ql_dbg_tgt_mgt, vha,0xf00c ,"Stop of tgt %p finished\n" , tgt);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 30/131 net: macb: ensure the device is available before accessing GEMGXL control registers
In reply to Greg Kroah-HartmanFrom: Zong Li <[email protected]>
[ Upstream commit 5eff1461a6dec84f04fafa9128548bad51d96147 ]
If runtime power menagement is enabled, the gigabit ethernet PLL would be disabled after macb_probe(). During this period of time, the system would hang up if we try to access GEMGXL control registers.
We can't put runtime_pm_get/runtime_pm_put/ there due to the issue of sleep inside atomic section (7fa2955ff70ce453 ("sh_eth: Fix sleeping function called from invalid context"). Add netif_running checking to ensure the device is available before accessing GEMGXL device.
Changed in v2:
- Use netif_running instead of its own flag
--- drivers/net/ethernet/cadence/macb_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/cadence/macb_main.c +3 -0
@@ -2709,6 +2709,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp)struct gem_stats *hwstat = &bp->hw_stats.gem;struct net_device_stats *nstat = &bp->dev->stats; +if (!netif_running (bp->dev)) +return nstat; +gem_update_stats (bp); nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors +
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 31/131 net: appletalk: cops: Fix data race in cops_probe1
In reply to Greg Kroah-HartmanFrom: Saubhik Mukherjee <[email protected]>
[ Upstream commit a4dd4fc6105e54393d637450a11d4cddb5fabc4f ]
In cops_probe1(), there is a write to dev->base_addr after requesting an interrupt line and registering the interrupt handler cops_interrupt(). The handler might be called in parallel to handle an interrupt. cops_interrupt() tries to read dev->base_addr leading to a potential data race. So write to dev->base_addr before calling request_irq().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/appletalk/cops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/appletalk/cops.c +2 -2
@@ -327,6 +327,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)break ; } + dev->base_addr = ioaddr; +/* Reserve any actual interrupt. */ if (dev->irq) { retval =request_irq (dev->irq, cops_interrupt,0 , dev->name, dev);
@@ -334,8 +336,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) goto err_out; } - dev->base_addr = ioaddr; - lp =netdev_priv (dev);spin_lock_init (&lp->lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 32/131 net: dsa: microchip: enable phy errata workaround on 9567
In reply to Greg Kroah-HartmanFrom: George McCollister <[email protected]>
[ Upstream commit 8c42a49738f16af0061f9ae5c2f5a955f268d9e3 ]
Also enable phy errata workaround on 9567 since has the same errata as the 9477 according to the manufacture's documentation.
--- drivers/net/dsa/microchip/ksz9477.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/dsa/microchip/ksz9477.c +1 -0
@@ -1532,6 +1532,7 @@ static const struct ksz_chip_data ksz9477_switch_chips[] = { .num_statics = 16, .cpu_ports = 0x7F, /* can be configured as cpu port */ .port_cnt = 7, /* total physical port count */ + .phy_errata_9477 = true, }, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 33/131 nvme-fabrics: decode host pathing error for connect
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit 4d9442bf263ac45d495bb7ecf75009e59c0622b2 ]
Add an additional decoding for 'host pathing error' during connect.
--- drivers/nvme/host/fabrics.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/nvme/host/fabrics.c +5 -0
@@ -336,6 +336,11 @@ static void nvmf_log_connect_error(struct nvme_ctrl *ctrl, cmd->connect.recfmt);break ; +case NVME_SC_HOST_PATH_ERROR : +dev_err (ctrl->device, +"Connect command failed: host path error\n" ); +break ; +default : dev_err(ctrl->device, "Connect command failed, error wo/DNR bit: %d\n",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 34/131 MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit 78cf0eb926cb1abeff2106bae67752e032fe5f3e ]
When update the latest mainline kernel with the following three configs, the kernel hangs during startup:
(1) CONFIG_FUNCTION_GRAPH_TRACER=y
(2) CONFIG_PREEMPT_TRACER=y
(3) CONFIG_FTRACE_STARTUP_TEST=y
When update the latest mainline kernel with the above two configs (1) and (2), the kernel starts normally, but it still hangs when execute the following command:
echo "function_graph" > /sys/kernel/debug/tracing/current_tracer
Without CONFIG_PREEMPT_TRACER=y, the above two kinds of kernel hangs disappeared, so it seems that CONFIG_PREEMPT_TRACER has some influences with function_graph tracer at the first glance.
I use ejtag to find out the epc address is related with preempt_enable() in the file arch/mips/lib/mips-atomic.c, because function tracing can trace the preempt_{enable,disable} calls that are traced, replace them with preempt_{enable,disable}_notrace to prevent function tracing from going into an infinite loop, and then it can fix the kernel hang issue.
By the way, it seems that this commit is a complement and improvement of commit f93a1a00f2bd ("MIPS: Fix crash that occurs when function tracing is enabled").
--- arch/mips/lib/mips-atomic.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/mips/lib/mips-atomic.c +6 -6
@@ -37,7 +37,7 @@*/ notrace void arch_local_irq_disable(void) { -preempt_disable (); +preempt_disable_notrace (); __asm__ __volatile__( " .set push \n"
@@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void) : /* no inputs */ : "memory"); -preempt_enable (); +preempt_enable_notrace (); }EXPORT_SYMBOL (arch_local_irq_disable);
@@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void) {unsigned long flags; -preempt_disable (); +preempt_disable_notrace (); __asm__ __volatile__( " .set push \n"
@@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void) : /* no inputs */ : "memory"); -preempt_enable (); +preempt_enable_notrace ();return flags; }
@@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags) {unsigned long __tmp1; -preempt_disable (); +preempt_disable_notrace (); __asm__ __volatile__( " .set push \n"
@@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags) : "0" (flags) : "memory"); -preempt_enable (); +preempt_enable_notrace (); }EXPORT_SYMBOL (arch_local_irq_restore);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 35/131 dm verity: fix require_signatures module_param permissions
In reply to Greg Kroah-HartmanFrom: John Keeping <[email protected]>
[ Upstream commit 0c1f3193b1cdd21e7182f97dc9bca7d284d18a15 ]
The third parameter of module_param() is permissions for the sysfs node but it looks like it is being used as the initial value of the parameter here. In fact, false here equates to omitting the file from sysfs and does not affect the value of require_signatures.
Making the parameter writable is not simple because going from false->true is fine but it should not be possible to remove the requirement to verify a signature. But it can be useful to inspect the value of this parameter from userspace, so change the permissions to make a read-only file in sysfs.
--- drivers/md/dm-verity-verify-sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-verity-verify-sig.c +1 -1
@@ -15,7 +15,7 @@#define DM_VERITY_VERIFY_ERR (s) DM_VERITY_ROOT_HASH_VERIFICATION " " sstatic bool require_signatures; -module_param (require_signatures, bool, false); +module_param (require_signatures, bool,0444 );MODULE_PARM_DESC (require_signatures,"Verify the roothash of dm-verity hash tree" );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 36/131 bnx2x: Fix missing error code in bnx2x_iov_init_one()
In reply to Greg Kroah-HartmanFrom: Jiapeng Chong <[email protected]>
[ Upstream commit 65161c35554f7135e6656b3df1ce2c500ca0bdcf ]
Eliminate the follow smatch warning:
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1227 bnx2x_iov_init_one() warn: missing error code 'err'.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +3 -1
@@ -1224,8 +1224,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param, goto failed;/* SR-IOV capability was enabled but there are no VFs*/ -if (iov->total ==0 ) +if (iov->total ==0 ) { + err = -EINVAL ; goto failed; + } iov->nr_virtfn =min_t (u16, iov->total, num_vfs_param);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 37/131 nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 042a3eaad6daeabcfaf163aa44da8ea3cf8b5496 ]
We need to select NVME_CORE.
--- drivers/nvme/host/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/Kconfig +2 -1
@@ -71,7 +71,8 @@ config NVME_FC config NVME_TCP tristate "NVM Express over Fabrics TCP host driver" depends on INET - depends on BLK_DEV_NVME + depends on BLOCK + select NVME_CORE select NVME_FABRICS select CRYPTO select CRYPTO_CRC32C
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 38/131 nvmet: fix false keep-alive timeout when a controller is torn down
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit aaeadd7075dc9e184bc7876e9dd7b3bada771df2 ]
Controller teardown flow may take some time in case it has many I/O queues, and the host may not send us keep-alive during this period. Hence reset the traffic based keep-alive timer so we don't trigger a controller teardown as a result of a keep-alive expiration.
--- drivers/nvme/target/core.c | 15 +++++++++++---- drivers/nvme/target/nvmet.h | 2 +- 2 files changed, 12 insertions(+), 5 deletions(-)
drivers/nvme/target/core.c +11 -4
@@ -379,10 +379,10 @@ static void nvmet_keep_alive_timer(struct work_struct *work) {struct nvmet_ctrl *ctrl =container_of (to_delayed_work (work), struct nvmet_ctrl, ka_work); -bool cmd_seen = ctrl->cmd_seen; +bool reset_tbkas = ctrl->reset_tbkas; - ctrl->cmd_seen = false; -if (cmd_seen) { + ctrl->reset_tbkas = false; +if (reset_tbkas) {pr_debug ("ctrl %d reschedule traffic based keep-alive timer\n" , ctrl->cntlid);schedule_delayed_work (&ctrl->ka_work, ctrl->kato *HZ );
@@ -792,6 +792,13 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)percpu_ref_exit (&sq->ref);if (ctrl) { +/* +* The teardown flow may take some time, and the host may not +* send us keep-alive during this period, hence reset the +* traffic based keep-alive timer so we don't trigger a +* controller teardown as a result of a keep-alive expiration. +*/ + ctrl->reset_tbkas = true;nvmet_ctrl_put (ctrl); sq->ctrl =NULL ;/* allows reusing the queue later */ }
@@ -942,7 +949,7 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq, }if (sq->ctrl) - sq->ctrl->cmd_seen = true; + sq->ctrl->reset_tbkas = true;return true;
drivers/nvme/target/nvmet.h +1 -1
@@ -166,7 +166,7 @@ struct nvmet_ctrl {struct nvmet_subsys *subsys;struct nvmet_sq **sqs; -bool cmd_seen; +bool reset_tbkas;struct mutex lock;u64 cap;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 39/131 powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 7adc7b225cddcfd0f346d10144fd7a3d3d9f9ea7 ]
The i2c controllers on the P2040/P2041 have an erratum where the documented scheme for i2c bus recovery will not work (A-004447). A different mechanism is needed which is documented in the P2040 Chip Errata Rev Q (latest available at the time of writing).
--- arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/powerpc/boot/dts/fsl/p2041si-post.dtsi +16 -0
@@ -371,7 +371,23 @@ }; /include/ "qoriq-i2c-0.dtsi" + i2c@118000 { + fsl,i2c-erratum-a004447; + }; + + i2c@118100 { + fsl,i2c-erratum-a004447; + }; + /include/ "qoriq-i2c-1.dtsi" + i2c@119000 { + fsl,i2c-erratum-a004447; + }; + + i2c@119100 { + fsl,i2c-erratum-a004447; + }; + /include/ "qoriq-duart-0.dtsi" /include/ "qoriq-duart-1.dtsi" /include/ "qoriq-gpio-0.dtsi"
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 40/131 powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 19ae697a1e4edf1d755b413e3aa38da65e2db23b ]
The i2c controllers on the P1010 have an erratum where the documented scheme for i2c bus recovery will not work (A-004447). A different mechanism is needed which is documented in the P1010 Chip Errata Rev L.
--- arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/powerpc/boot/dts/fsl/p1010si-post.dtsi +8 -0
@@ -122,7 +122,15 @@ }; /include/ "pq3-i2c-0.dtsi" + i2c@3000 { + fsl,i2c-erratum-a004447; + }; + /include/ "pq3-i2c-1.dtsi" + i2c@3100 { + fsl,i2c-erratum-a004447; + }; + /include/ "pq3-duart-0.dtsi" /include/ "pq3-espi-0.dtsi" spi0: spi@7000 {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 41/131 spi: Dont have controller clean up spi device before driver unbind
In reply to Greg Kroah-HartmanFrom: Saravana Kannan <[email protected]>
[ Upstream commit 27e7db56cf3dffd302bd7ddfacb1d405cf671a2a ]
When a spi device is unregistered and triggers a driver unbind, the driver might need to access the spi device. So, don't have the controller clean up the spi device before the driver is unbound. Clean up the spi device after the driver is unbound.
--- drivers/spi/spi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi.c +3 -3
@@ -709,15 +709,15 @@ void spi_unregister_device(struct spi_device *spi)if (!spi)return ; -spi_cleanup (spi); -if (spi->dev.of_node) {of_node_clear_flag (spi->dev.of_node,OF_POPULATED );of_node_put (spi->dev.of_node); }if (ACPI_COMPANION (&spi->dev))acpi_device_clear_enumerated (ACPI_COMPANION (&spi->dev)); -device_unregister (&spi->dev); +device_del (&spi->dev); +spi_cleanup (spi); +put_device (&spi->dev); }EXPORT_SYMBOL_GPL (spi_unregister_device);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 42/131 spi: Cleanup on failure of initial setup
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
[ Upstream commit 2ec6f20b33eb4f62ab90bdcd620436c883ec3af6 ]
Commit c7299fea6769 ("spi: Fix spi device unregister flow") changed the SPI core's behavior if the ->setup() hook returns an error upon adding an spi_device: Before, the ->cleanup() hook was invoked to free any allocations that were made by ->setup(). With the commit, that's no longer the case, so the ->setup() hook is expected to free the allocations itself.
I've identified 5 drivers which depend on the old behavior and am fixing them up hereinafter: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c spi-omap2-mcspi.c spi-pxa2xx.c
Importantly, ->setup() is not only invoked on spi_device *addition*:
It may subsequently be called to *change* SPI parameters. If changing these SPI parameters fails, freeing memory allocations would be wrong. That should only be done if the spi_device is finally destroyed. I am therefore using a bool "initial_setup" in 4 of the affected drivers to differentiate between the invocation on *adding* the spi_device and any subsequent invocations: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c spi-omap2-mcspi.c
In spi-pxa2xx.c, it seems the ->setup() hook can only fail on spi_device addition, not any subsequent calls. It therefore doesn't need the bool.
It's worth noting that 5 other drivers already perform a cleanup if the ->setup() hook fails. Before c7299fea6769, they caused a double-free if ->setup() failed on spi_device addition. Since the commit, they're fine. These drivers are: spi-mpc512x-psc.c spi-pl022.c spi-s3c64xx.c spi-st-ssc4.c spi-tegra114.c
(spi-pxa2xx.c also already performs a cleanup, but only in one of several error paths.)
--- drivers/spi/spi-bitbang.c | 18 ++++++++++++++---- drivers/spi/spi-fsl-spi.c | 4 ++++ drivers/spi/spi-omap-uwire.c | 9 ++++++++- drivers/spi/spi-omap2-mcspi.c | 33 ++++++++++++++++++++------------- drivers/spi/spi-pxa2xx.c | 9 ++++++++- 5 files changed, 54 insertions(+), 19 deletions(-)
drivers/spi/spi-bitbang.c +14 -4
@@ -181,6 +181,8 @@ int spi_bitbang_setup(struct spi_device *spi) {struct spi_bitbang_cs *cs = spi->controller_state;struct spi_bitbang *bitbang; +bool initial_setup = false; +int retval; bitbang =spi_master_get_devdata (spi->master);
@@ -189,22 +191,30 @@ int spi_bitbang_setup(struct spi_device *spi)if (!cs)return -ENOMEM ; spi->controller_state = cs; + initial_setup = true; }/* per-word shift register access, in hardware or bitbanging */ cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL |SPI_CPHA )]; -if (!cs->txrx_word) -return -EINVAL ; +if (!cs->txrx_word) { + retval = -EINVAL ; + goto err_free; + }if (bitbang->setup_transfer) { -int retval = bitbang->setup_transfer (spi,NULL ); + retval = bitbang->setup_transfer (spi,NULL );if (retval <0 ) -return retval; + goto err_free; }dev_dbg (&spi->dev,"%s, %u nsec/bit\n" , __func__,2 * cs->nsecs);return 0 ; + +err_free: +if (initial_setup) +kfree (cs); +return retval; }EXPORT_SYMBOL_GPL (spi_bitbang_setup);
drivers/spi/spi-fsl-spi.c +4 -0
@@ -440,6 +440,7 @@ static int fsl_spi_setup(struct spi_device *spi) {struct mpc8xxx_spi *mpc8xxx_spi;struct fsl_spi_reg __iomem *reg_base; +bool initial_setup = false;int retval;u32 hw_mode;struct spi_mpc8xxx_cs *cs =spi_get_ctldata (spi);
@@ -452,6 +453,7 @@ static int fsl_spi_setup(struct spi_device *spi)if (!cs)return -ENOMEM ;spi_set_ctldata (spi, cs); + initial_setup = true; } mpc8xxx_spi =spi_master_get_devdata (spi->master);
@@ -475,6 +477,8 @@ static int fsl_spi_setup(struct spi_device *spi) retval =fsl_spi_setup_transfer (spi,NULL );if (retval <0 ) { cs->hw_mode = hw_mode;/* Restore settings */ +if (initial_setup) +kfree (cs);return retval; }
drivers/spi/spi-omap-uwire.c +8 -1
@@ -424,15 +424,22 @@ done:static int uwire_setup (struct spi_device *spi) {struct uwire_state *ust = spi->controller_state; +bool initial_setup = false; +int status;if (ust ==NULL ) { ust =kzalloc (sizeof (*ust),GFP_KERNEL );if (ust ==NULL )return -ENOMEM ; spi->controller_state = ust; + initial_setup = true; } -return uwire_setup_transfer (spi,NULL ); + status =uwire_setup_transfer (spi,NULL ); +if (status && initial_setup) +kfree (ust); + +return status; }static void uwire_cleanup (struct spi_device *spi)
drivers/spi/spi-omap2-mcspi.c +20 -13
@@ -1032,8 +1032,22 @@ static void omap2_mcspi_release_dma(struct spi_master *master) } } +static void omap2_mcspi_cleanup (struct spi_device *spi) +{ +struct omap2_mcspi_cs *cs; + +if (spi->controller_state) { +/* Unlink controller state from context save list */ + cs = spi->controller_state; +list_del (&cs->node); + +kfree (cs); + } +} +static int omap2_mcspi_setup (struct spi_device *spi) { +bool initial_setup = false;int ret;struct omap2_mcspi *mcspi =spi_master_get_devdata (spi->master);struct omap2_mcspi_regs *ctx = &mcspi->ctx;
@@ -1051,35 +1065,28 @@ static int omap2_mcspi_setup(struct spi_device *spi) spi->controller_state = cs;/* Link this to context save list */ list_add_tail (&cs->node, &ctx->cs); + initial_setup = true; } ret =pm_runtime_get_sync (mcspi->dev);if (ret <0 ) {pm_runtime_put_noidle (mcspi->dev); +if (initial_setup) +omap2_mcspi_cleanup (spi);return ret; } ret =omap2_mcspi_setup_transfer (spi,NULL ); +if (ret && initial_setup) +omap2_mcspi_cleanup (spi); +pm_runtime_mark_last_busy (mcspi->dev);pm_runtime_put_autosuspend (mcspi->dev);return ret; } -static void omap2_mcspi_cleanup (struct spi_device *spi) -{ -struct omap2_mcspi_cs *cs; - -if (spi->controller_state) { -/* Unlink controller state from context save list */ - cs = spi->controller_state; -list_del (&cs->node); - -kfree (cs); - } -} -static irqreturn_t omap2_mcspi_irq_handler (int irq,void *data) {struct omap2_mcspi *mcspi = data;
drivers/spi/spi-pxa2xx.c +8 -1
@@ -1254,6 +1254,8 @@ static int setup_cs(struct spi_device *spi, struct chip_data *chip, chip->gpio_cs_inverted = spi->mode &SPI_CS_HIGH ; err =gpiod_direction_output (gpiod, !chip->gpio_cs_inverted); +if (err) +gpiod_put (chip->gpiod_cs); }return err;
@@ -1267,6 +1269,7 @@ static int setup(struct spi_device *spi)struct driver_data *drv_data =spi_controller_get_devdata (spi->controller);uint tx_thres, tx_hi_thres, rx_thres; +int err;switch (drv_data->ssp_type) {case QUARK_X1000_SSP :
@@ -1413,7 +1416,11 @@ static int setup(struct spi_device *spi)if (drv_data->ssp_type ==CE4100_SSP )return 0 ; -return setup_cs (spi, chip, chip_info); + err =setup_cs (spi, chip, chip_info); +if (err) +kfree (chip); + +return err; }static void cleanup (struct spi_device *spi)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 43/131 i2c: mpc: Make use of i2c_recover_bus()
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 65171b2df15eb7545431d75c2729b5062da89b43 ]
Move the existing calls of mpc_i2c_fixup() to a recovery function registered via bus_recovery_info. This makes it more obvious that recovery is supported and allows for a future where recovery is triggered by the i2c core.
--- drivers/i2c/busses/i2c-mpc.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-mpc.c +16 -2
@@ -586,7 +586,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)if ((status & (CSR_MCF |CSR_MBB |CSR_RXAK )) !=0 ) {writeb (status & ~CSR_MAL , i2c->base +MPC_I2C_SR ); -mpc_i2c_fixup (i2c); +i2c_recover_bus (&i2c->adap); }return -EIO ; }
@@ -622,7 +622,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)if ((status & (CSR_MCF |CSR_MBB |CSR_RXAK )) !=0 ) {writeb (status & ~CSR_MAL , i2c->base +MPC_I2C_SR ); -mpc_i2c_fixup (i2c); +i2c_recover_bus (&i2c->adap); }return -EIO ; }
@@ -637,6 +637,15 @@ static u32 mpc_functionality(struct i2c_adapter *adap) | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL; } +static int fsl_i2c_bus_recovery (struct i2c_adapter *adap) +{ +struct mpc_i2c *i2c =i2c_get_adapdata (adap); + +mpc_i2c_fixup (i2c); + +return 0 ; +} +static const struct i2c_algorithm mpc_algo = { .master_xfer = mpc_xfer, .functionality = mpc_functionality,
@@ -648,6 +657,10 @@ static struct i2c_adapter mpc_ops = { .timeout = HZ, }; +static struct i2c_bus_recovery_info fsl_i2c_recovery_info = { + .recover_bus = fsl_i2c_bus_recovery, +}; +static const struct of_device_id mpc_i2c_of_match[];static int fsl_i2c_probe (struct platform_device *op) {
@@ -740,6 +753,7 @@ static int fsl_i2c_probe(struct platform_device *op)i2c_set_adapdata (&i2c->adap, i2c); i2c->adap.dev.parent = &op->dev; i2c->adap.dev.of_node =of_node_get (op->dev.of_node); + i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info; result =i2c_add_adapter (&i2c->adap);if (result <0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 44/131 i2c: mpc: implement erratum A-004447 workaround
In reply to Greg Kroah-HartmanFrom: Chris Packham <[email protected]>
[ Upstream commit 8f0cdec8b5fd94135d643662506ee94ae9e98785 ]
The P2040/P2041 has an erratum where the normal i2c recovery mechanism does not work. Implement the alternative recovery mechanism documented in the P2040 Chip Errata Rev Q.
--- drivers/i2c/busses/i2c-mpc.c | 79 +++++++++++++++++++++++++++++++++++- 1 file changed, 78 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-mpc.c +78 -1
@@ -23,6 +23,7 @@#include <linux/clk.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/fsl_devices.h> #include <linux/i2c.h> #include <linux/interrupt.h>
@@ -49,6 +50,7 @@#define CCR_MTX 0x10#define CCR_TXAK 0x08#define CCR_RSTA 0x04 +#define CCR_RSVD 0x02#define CSR_MCF 0x80#define CSR_MAAS 0x40
@@ -70,6 +72,7 @@ struct mpc_i2c {u8 fdr, dfsrr;#endif struct clk *clk_per; +bool has_errata_A004447; };struct mpc_i2c_divider {
@@ -176,6 +179,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)return 0 ; } +static int i2c_mpc_wait_sr (struct mpc_i2c *i2c,int mask) +{ +void __iomem *addr = i2c->base +MPC_I2C_SR ; +u8 val; + +return readb_poll_timeout (addr, val, val & mask,0 ,100 ); +} + +/* +* Workaround for Erratum A004447. From the P2040CE Rev Q +* +* 1. Set up the frequency divider and sampling rate. +* 2. I2CCR - a0h +* 3. Poll for I2CSR[MBB] to get set. +* 4. If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to +* step 5. If MAL is not set, then go to step 13. +* 5. I2CCR - 00h +* 6. I2CCR - 22h +* 7. I2CCR - a2h +* 8. Poll for I2CSR[MBB] to get set. +* 9. Issue read to I2CDR. +* 10. Poll for I2CSR[MIF] to be set. +* 11. I2CCR - 82h +* 12. Workaround complete. Skip the next steps. +* 13. Issue read to I2CDR. +* 14. Poll for I2CSR[MIF] to be set. +* 15. I2CCR - 80h +*/ +static void mpc_i2c_fixup_A004447 (struct mpc_i2c *i2c) +{ +int ret; +u32 val; + +writeccr (i2c,CCR_MEN |CCR_MSTA ); + ret =i2c_mpc_wait_sr (i2c,CSR_MBB ); +if (ret) { +dev_err (i2c->dev,"timeout waiting for CSR_MBB\n" ); +return ; + } + + val =readb (i2c->base +MPC_I2C_SR ); + +if (val &CSR_MAL ) { +writeccr (i2c,0x00 ); +writeccr (i2c,CCR_MSTA |CCR_RSVD ); +writeccr (i2c,CCR_MEN |CCR_MSTA |CCR_RSVD ); + ret =i2c_mpc_wait_sr (i2c,CSR_MBB ); +if (ret) { +dev_err (i2c->dev,"timeout waiting for CSR_MBB\n" ); +return ; + } + val =readb (i2c->base +MPC_I2C_DR ); + ret =i2c_mpc_wait_sr (i2c,CSR_MIF ); +if (ret) { +dev_err (i2c->dev,"timeout waiting for CSR_MIF\n" ); +return ; + } +writeccr (i2c,CCR_MEN |CCR_RSVD ); + }else { + val =readb (i2c->base +MPC_I2C_DR ); + ret =i2c_mpc_wait_sr (i2c,CSR_MIF ); +if (ret) { +dev_err (i2c->dev,"timeout waiting for CSR_MIF\n" ); +return ; + } +writeccr (i2c,CCR_MEN ); + } +} +#if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x)static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = { {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
@@ -641,7 +713,10 @@ static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) {struct mpc_i2c *i2c =i2c_get_adapdata (adap); -mpc_i2c_fixup (i2c); +if (i2c->has_errata_A004447) +mpc_i2c_fixup_A004447 (i2c); +else +mpc_i2c_fixup (i2c);return 0 ; }
@@ -745,6 +820,8 @@ static int fsl_i2c_probe(struct platform_device *op)dev_info (i2c->dev,"timeout %u us\n" , mpc_ops.timeout *1000000 /HZ );platform_set_drvdata (op, i2c); +if (of_property_read_bool (op->dev.of_node,"fsl,i2c-erratum-a004447" )) + i2c->has_errata_A004447 = true; i2c->adap = mpc_ops;of_address_to_resource (op->dev.of_node,0 , &res);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 45/131 ALSA: seq: Fix race of snd_seq_timer_open()
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 83e197a8414c0ba545e7e3916ce05f836f349273 upstream.
The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it's checking the already existing timer instance at the beginning, but it's not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently.
For avoiding the race, add a proper check at the assignment of tmr->timeri again, and return -EBUSY if it's been already registered.
--- sound/core/seq/seq_timer.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/core/seq/seq_timer.c +9 -1
@@ -297,8 +297,16 @@ int snd_seq_timer_open(struct snd_seq_qureturn err; }spin_lock_irq (&tmr->lock); - tmr->timeri = t; +if (tmr->timeri) + err = -EBUSY ; +else + tmr->timeri = t;spin_unlock_irq (&tmr->lock); +if (err <0 ) { +snd_timer_close (t); +snd_timer_instance_free (t); +return err; + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 46/131 ALSA: firewire-lib: fix the context to call snd_pcm_stop_xrun()
In reply to Greg Kroah-HartmanFrom: Takashi Sakamoto <[email protected]>
commit 9981b20a5e3694f4625ab5a1ddc98ce7503f6d12 upstream.
In the workqueue to queue wake-up event, isochronous context is not processed, thus it's useless to check context for the workqueue to switch status of runtime for PCM substream to XRUN. On the other hand, in software IRQ context of 1394 OHCI, it's needed.
This commit fixes the bug introduced when tasklet was replaced with workqueue.
--- sound/firewire/amdtp-stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/firewire/amdtp-stream.c +1 -1
@@ -804,7 +804,7 @@ static void generate_pkt_descs(struct amstatic inline void cancel_stream (struct amdtp_stream *s) { s->packet_index =-1 ; -if (current_work () == &s->period_work) +if (in_interrupt ())amdtp_stream_pcm_abort (s);WRITE_ONCE (s->pcm_buffer_pointer,SNDRV_PCM_POS_XRUN ); }
Greg Kroah-Hartman
maintainerPATCH 47/131 ALSA: hda/realtek: headphone and mic dont work on an Acer laptop
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
commit 57c9e21a49b1c196cda28f54de9a5d556ac93f20 upstream.
There are 2 issues on this machine, the 1st one is mic's plug/unplug can't be detected, that is because the mic is set to manual detecting mode, need to apply ALC255_FIXUP_XIAOMI_HEADSET_MIC to set it to auto detecting mode. The other one is headphone's plug/unplug can't be detected by pulseaudio, that is because the pulseaudio will use ucm2/sof-hda-dsp on this machine, and the ucm2 only handle 'Headphone Jack', but on this machine the headphone's pincfg sets the location to Front, then the alsa mixer name is "Front Headphone Jack" instead of "Headphone Jack", so override the pincfg to change location to Left.
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -6560,6 +6560,7 @@ enum {ALC285_FIXUP_HP_SPECTRE_X360 ,ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP ,ALC623_FIXUP_LENOVO_THINKSTATION_P340 , + ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, }; static const struct hda_fixup alc269_fixups[] = {
@@ -8132,6 +8133,15 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id = ALC283_FIXUP_HEADSET_MIC, }, + [ALC255_FIXUP_ACER_HEADPHONE_AND_MIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x21 ,0x03211030 },/* Change the Headphone location to Left */ + { } + }, + .chained = true, + .chain_id =ALC255_FIXUP_XIAOMI_HEADSET_MIC + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8168,6 +8178,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1025 ,0x132a ,"Acer TravelMate B114-21" ,ALC233_FIXUP_ACER_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x1330 ,"Acer TravelMate X514-51T" ,ALC255_FIXUP_ACER_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x1430 ,"Acer TravelMate B311R-31" ,ALC256_FIXUP_ACER_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1025 ,0x1466 ,"Acer Aspire A515-56" ,ALC255_FIXUP_ACER_HEADPHONE_AND_MIC ),SND_PCI_QUIRK (0x1028 ,0x0470 ,"Dell M101z" ,ALC269_FIXUP_DELL_M101Z ),SND_PCI_QUIRK (0x1028 ,0x054b ,"Dell XPS one 2710" ,ALC275_FIXUP_DELL_XPS ), SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
@@ -8722,6 +8733,7 @@ static const struct hda_model_fixup alc2 {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"}, + {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"}, {} };#define ALC225_STANDARD_PINS \
Greg Kroah-Hartman
maintainerPATCH 48/131 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2
In reply to Greg Kroah-HartmanFrom: Jeremy Szu <[email protected]>
commit 15d295b560e6dd45f839a53ae69e4f63b54eb32f upstream.
The HP Elite Dragonfly G2 using ALC285 codec which using 0x04 to control mute LED and 0x01 to control micmute LED.
In the other hand, there is no output from right channel of speaker. Therefore, add a quirk to make it works.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8307,6 +8307,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8519 ,"HP Spectre x360 15-df0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360 ),SND_PCI_QUIRK (0x103c ,0x869d ,"HP" ,ALC236_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x86c7 ,"HP Envy AiO 32" ,ALC274_FIXUP_HP_ENVY_GPIO ), +SND_PCI_QUIRK (0x103c ,0x8716 ,"HP Elite Dragonfly G2 Notebook PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8724 ,"HP EliteBook 850 G7" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8729 ,"HP" ,ALC285_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
Greg Kroah-Hartman
maintainerPATCH 49/131 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8
In reply to Greg Kroah-HartmanFrom: Jeremy Szu <[email protected]>
commit 61d3e87468fad82dc8e8cb6de7db563ada64b532 upstream.
The HP EliteBook x360 1040 G8 using ALC285 codec which using 0x04 to control mute LED and 0x01 to control micmute LED.
In the other hand, there is no output from right channel of speaker. Therefore, add a quirk to make it works.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8308,6 +8308,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x869d ,"HP" ,ALC236_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x86c7 ,"HP Envy AiO 32" ,ALC274_FIXUP_HP_ENVY_GPIO ),SND_PCI_QUIRK (0x103c ,0x8716 ,"HP Elite Dragonfly G2 Notebook PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), +SND_PCI_QUIRK (0x103c ,0x8720 ,"HP EliteBook x360 1040 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8724 ,"HP EliteBook 850 G7" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8729 ,"HP" ,ALC285_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
Greg Kroah-Hartman
maintainerPATCH 50/131 ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8
In reply to Greg Kroah-HartmanFrom: Jeremy Szu <[email protected]>
commit dfb06401b4cdfc71e2fc3e19b877ab845cc9f7f7 upstream.
The HP EliteBook 840 Aero G8 using ALC285 codec which using 0x04 to control mute LED and 0x01 to control micmute LED.
In the other hand, there is no output from right channel of speaker. Therefore, add a quirk to make it works.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8327,6 +8327,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x87f5 ,"HP" ,ALC287_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x87f7 ,"HP Spectre x360 14" ,ALC245_FIXUP_HP_X360_AMP ),SND_PCI_QUIRK (0x103c ,0x8846 ,"HP EliteBook 850 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x884b ,"HP EliteBook 840 Aero G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x884c ,"HP EliteBook 840 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x886d ,"HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), SND_PCI_QUIRK(0x103c, 0x8870, "HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
Greg Kroah-Hartman
maintainerPATCH 51/131 ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
In reply to Greg Kroah-HartmanFrom: Jeremy Szu <[email protected]>
commit 600dd2a7e8b62170d177381cc1303861f48f9780 upstream.
The HP ZBook Power G8 using ALC236 codec which using 0x02 to control mute LED and 0x01 to control micmute LED. Therefore, add a quirk to make it works.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8332,6 +8332,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x886d ,"HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8870 ,"HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8873 ,"HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), +SND_PCI_QUIRK (0x103c ,0x888d ,"HP ZBook Power 15.6 inch G8 Mobile Workstation PC" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8896 ,"HP EliteBook 855 G8 Notebook PC" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x1043 ,0x103e ,"ASUS X540SA" ,ALC256_FIXUP_ASUS_MIC ), SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
Greg Kroah-Hartman
maintainerPATCH 52/131 spi: bcm2835: Fix out-of-bounds access with more than 4 slaves
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 13817d466eb8713a1ffd254f537402f091d48444 upstream.
Commit 571e31fa60b3 ("spi: bcm2835: Cache CS register value for ->prepare_message()") limited the number of slaves to 3 at compile-time. The limitation was necessitated by a statically-sized array prepare_cs[] in the driver private data which contains a per-slave register value.
The commit sought to enforce the limitation at run-time by setting the controller's num_chipselect to 3: Slaves with a higher chipselect are rejected by spi_add_device().
However the commit neglected that num_chipselect only limits the number of *native* chipselects. If GPIO chipselects are specified in the device tree for more than 3 slaves, num_chipselect is silently raised by of_spi_get_gpio_numbers() and the result are out-of-bounds accesses to the statically-sized array prepare_cs[].
As a bandaid fix which is backportable to stable, raise the number of allowed slaves to 24 (which "ought to be enough for anybody"), enforce the limitation on slave ->setup and revert num_chipselect to 3 (which is the number of native chipselects supported by the controller). An upcoming for-next commit will allow an arbitrary number of slaves.
--- drivers/spi/spi-bcm2835.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/spi/spi-bcm2835.c +8 -2
@@ -68,7 +68,7 @@#define BCM2835_SPI_FIFO_SIZE 64#define BCM2835_SPI_FIFO_SIZE_3_4 48#define BCM2835_SPI_DMA_MIN_LENGTH 96 -#define BCM2835_SPI_NUM_CS 4/* raise as necessary */ +#define BCM2835_SPI_NUM_CS 24/* raise as necessary */ #define BCM2835_SPI_MODE_BITS (SPI_CPOL | SPI_CPHA | SPI_CS_HIGH \ | SPI_NO_CS | SPI_3WIRE)
@@ -1195,6 +1195,12 @@ static int bcm2835_spi_setup(struct spi_struct gpio_chip *chip;u32 cs; +if (spi->chip_select >=BCM2835_SPI_NUM_CS ) { +dev_err (&spi->dev,"only %d chip-selects supported\n" , +BCM2835_SPI_NUM_CS -1 ); +return -EINVAL ; + } +/* * Precalculate SPI slave's CS register value for ->prepare_message(): * The driver always uses software-controlled GPIO chip select, hence
@@ -1288,7 +1294,7 @@ static int bcm2835_spi_probe(struct plat ctlr->use_gpio_descriptors = true; ctlr->mode_bits =BCM2835_SPI_MODE_BITS ; ctlr->bits_per_word_mask =SPI_BPW_MASK (8 ); - ctlr->num_chipselect =BCM2835_SPI_NUM_CS ; + ctlr->num_chipselect =3 ; ctlr->setup = bcm2835_spi_setup; ctlr->transfer_one = bcm2835_spi_transfer_one; ctlr->handle_err = bcm2835_spi_handle_err;
Greg Kroah-Hartman
maintainerPATCH 53/131 Revert "ACPI: sleep: Put the FACS table after using it"
In reply to Greg Kroah-HartmanFrom: Zhang Rui <[email protected]>
commit f1ffa9d4cccc8fdf6c03fb1b3429154d22037988 upstream.
Commit 95722237cb2a ("ACPI: sleep: Put the FACS table after using it") puts the FACS table during initialization.
But the hardware signature bits in the FACS table need to be accessed, after every hibernation, to compare with the original hardware signature.
So there is no reason to release the FACS table mapping after initialization.
This reverts commit 95722237cb2ae4f7b73471058cdb19e8f4057c93.
An alternative solution is to use acpi_gbl_FACS variable instead, which is mapped by the ACPICA core and never released.
--- drivers/acpi/sleep.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/acpi/sleep.c +1 -3
@@ -1290,10 +1290,8 @@ static void acpi_sleep_hibernate_setup(vreturn ;acpi_get_table (ACPI_SIG_FACS ,1 , (struct acpi_table_header **)&facs); -if (facs) { +if (facs) s4_hardware_signature = facs->hardware_signature; -acpi_put_table ((struct acpi_table_header *)facs); - } }#else /* !CONFIG_HIBERNATION */ static inline void acpi_sleep_hibernate_setup (void ) {}
Greg Kroah-Hartman
maintainerPATCH 54/131 drm: Fix use-after-free read in drm_getunique()
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
commit b436acd1cf7fac0ba987abd22955d98025c80c2b upstream.
There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving file_priv->master prior to locking the device's master mutex.
An example can be seen in the crash report of the use-after-free error found by Syzbot:
https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
In the report, the master pointer was used after being freed. This is because another process had acquired the device's master mutex in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of fpriv->master was subsequently freed before the mutex was unlocked.
To fix this, we lock the device's master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot reproducer test.
--- drivers/gpu/drm/drm_ioctl.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_ioctl.c +5 -4
@@ -118,17 +118,18 @@ int drm_getunique(struct drm_device *dev struct drm_file *file_priv) {struct drm_unique *u = data; -struct drm_master *master = file_priv->master; +struct drm_master *master; -mutex_lock (&master->dev->master_mutex); +mutex_lock (&dev->master_mutex); + master = file_priv->master;if (u->unique_len >= master->unique_len) {if (copy_to_user (u->unique, master->unique, master->unique_len)) { -mutex_unlock (&master->dev->master_mutex); +mutex_unlock (&dev->master_mutex);return -EFAULT ; } } u->unique_len = master->unique_len; -mutex_unlock (&master->dev->master_mutex); +mutex_unlock (&dev->master_mutex);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 55/131 drm: Lock pointer access in drm_master_release()
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
commit c336a5ee984708db4826ef9e47d184e638e29717 upstream.
This patch eliminates the following smatch warning:drivers/gpu/drm/drm_auth.c:320 drm_master_release() warn: unlocked access 'master' (line 318) expected lock '&dev->master_mutex'
The 'file_priv->master' field should be protected by the mutex lock to '&dev->master_mutex'. This is because other processes can concurrently modify this field and free the current 'file_priv->master' pointer. This could result in a use-after-free error when 'master' is dereferenced in subsequent function calls to 'drm_legacy_lock_master_cleanup()' or to 'drm_lease_revoke()'.
An example of a scenario that would produce this error can be seen from a similar bug in 'drm_getunique()' that was reported by Syzbot:
https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
In the Syzbot report, another process concurrently acquired the device's master mutex in 'drm_setmaster_ioctl()', then overwrote 'fpriv->master' in 'drm_new_set_master()'. The old value of 'fpriv->master' was subsequently freed before the mutex was unlocked.
--- drivers/gpu/drm/drm_auth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_auth.c +2 -1
@@ -314,9 +314,10 @@ int drm_master_open(struct drm_file *filvoid drm_master_release (struct drm_file *file_priv) {struct drm_device *dev = file_priv->minor->dev; -struct drm_master *master = file_priv->master; +struct drm_master *master;mutex_lock (&dev->master_mutex); + master = file_priv->master;if (file_priv->magic)idr_remove (&file_priv->master->magic_map, file_priv->magic);
Greg Kroah-Hartman
maintainerPATCH 56/131 perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
commit 848ff3768684701a4ce73a2ec0e5d438d4e2b0da upstream.
Perf tool errors out with the latest event list for the Ice Lake server.
event syntax error: 'unc_m2m_imc_reads.to_pmm'
\___ value too big for format, maximum is 255
The same as the Snow Ridge server, the M2M uncore unit in the Ice Lake server has the unit mask extension field as well.
--- arch/x86/events/intel/uncore_snbep.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/events/intel/uncore_snbep.c +2 -1
@@ -5067,9 +5067,10 @@ static struct intel_uncore_type icx_unco .perf_ctr = SNR_M2M_PCI_PMON_CTR0, .event_ctl = SNR_M2M_PCI_PMON_CTL0, .event_mask = SNBEP_PMON_RAW_EVENT_MASK, + .event_mask_ext = SNR_M2M_PCI_PMON_UMASK_EXT, .box_ctl = SNR_M2M_PCI_PMON_BOX_CTL, .ops = &snr_m2m_uncore_pci_ops, - .format_group = &skx_uncore_format_group, + .format_group = &snr_m2m_uncore_format_group, };static struct attribute *icx_upi_uncore_formats_attr[] = {
Greg Kroah-Hartman
maintainerPATCH 57/131 KVM: X86: MMU: Use the correct inherited permissions to get shadow page
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
commit b1bd5cba3306691c771d558e94baa73e8b0b96b7 upstream.
When computing the access permissions of a shadow page, use the effective permissions of the walk up to that point, i.e. the logic AND of its parents' permissions. Two guest PxE entries that point at the same table gfn need to be shadowed with different shadow pages if their parents' permissions are different. KVM currently uses the effective permissions of the last non-leaf entry for all non-leaf entries. Because all non-leaf SPTEs have full ("uwx") permissions, and the effective permissions are recorded only in role.access and merged into the leaves, this can lead to incorrect reuse of a shadow page and eventually to a missing guest protection page fault.
For example, here is a shared pagetable:
pgd[] pud[] pmd[] virtual address pointers
/->pmd1(u--)->pte1(uw-)->page1 <- ptr1 (u--)
/->pud1(uw-)--->pmd2(uw-)->pte2(uw-)->page2 <- ptr2 (uw-)
pgd-| (shared pmd[] as above)
\->pud2(u--)--->pmd1(u--)->pte1(uw-)->page1 <- ptr3 (u--)
\->pmd2(uw-)->pte2(uw-)->page2 <- ptr4 (u--) pud1 and pud2 point to the same pmd table, so:
- ptr1 and ptr3 points to the same page.
- ptr2 and ptr4 points to the same page.
(pud1 and pud2 here are pud entries, while pmd1 and pmd2 here are pmd entries)
- First, the guest reads from ptr1 first and KVM prepares a shadow page table with role.access=u--, from ptr1's pud1 and ptr1's pmd1. "u--" comes from the effective permissions of pgd, pud1 and pmd1, which are stored in pt->access. "u--" is used also to get the pagetable for pud1, instead of "uw-".
- Then the guest writes to ptr2 and KVM reuses pud1 which is present. The hypervisor set up a shadow page for ptr2 with pt->access is "uw-" even though the pud1 pmd (because of the incorrect argument to kvm_mmu_get_page in the previous step) has role.access="u--".
- Then the guest reads from ptr3. The hypervisor reuses pud1's shadow pmd for pud2, because both use "u--" for their permissions. Thus, the shadow pmd already includes entries for both pmd1 and pmd2.
- At last, the guest writes to ptr4. This causes no vmexit or pagefault, because pud1's shadow page structures included an "uw-" page even though its role.access was "u--".
Any kind of shared pagetable might have the similar problem when in virtual machine without TDP enabled if the permissions are different from different ancestors.
In order to fix the problem, we change pt->access to be an array, and any access in it will not include permissions ANDed from child ptes.
The test code is: https://lore.kernel.org/kvm/[email protected]/
Remember to test it with TDP disabled.
The problem had existed long before the commit 41074d07c78b ("KVM: MMU:
Fix inherited permissions for emulated guest pte updates"), and it is hard to find which is the culprit. So there is no fixes tag here.
Message-Id: <[email protected]>
--- Documentation/virt/kvm/mmu.rst | 4 ++-- arch/x86/kvm/mmu/paging_tmpl.h | 14 +++++++++----- 2 files changed, 11 insertions(+), 7 deletions(-)
Documentation/virt/kvm/mmu.rst +2 -2
@@ -171,8 +171,8 @@ Shadow pages contain the following infor shadow pages) so role.quadrant takes values in the range 0..3. Each quadrant maps 1GB virtual address space. role.access: - Inherited guest access permissions in the form uwx. Note execute - permission is positive, not negative. + Inherited guest access permissions from the parent ptes in the form uwx. + Note execute permission is positive, not negative. role.invalid: The page is invalid and should not be used. It is a root page that is currently pinned (by a cpu hardware register pointing to it); once it is
arch/x86/kvm/mmu/paging_tmpl.h +9 -5
@@ -90,8 +90,8 @@ struct guest_walker {gpa_t pte_gpa[PT_MAX_FULL_LEVELS ];pt_element_t __user *ptep_user[PT_MAX_FULL_LEVELS ];bool pte_writable[PT_MAX_FULL_LEVELS ]; -unsigned pt_access; -unsigned pte_access; +unsigned int pt_access[PT_MAX_FULL_LEVELS ]; +unsigned int pte_access;gfn_t gfn;struct x86_exception fault; };
@@ -418,13 +418,15 @@ retry_walk: } walker->ptes[walker->level -1 ] = pte; + +/* Convert to ACC_*_MASK flags for struct guest_walker. */ + walker->pt_access[walker->level -1 ] =FNAME (gpte_access)(pt_access ^ walk_nx_mask); }while (!is_last_gpte (mmu, walker->level, pte)); pte_pkey =FNAME (gpte_pkeys)(vcpu, pte); accessed_dirty = have_ad ? pte_access &PT_GUEST_ACCESSED_MASK :0 ;/* Convert to ACC_*_MASK flags for struct guest_walker. */ - walker->pt_access =FNAME (gpte_access)(pt_access ^ walk_nx_mask); walker->pte_access =FNAME (gpte_access)(pte_access ^ walk_nx_mask); errcode =permission_fault (vcpu, mmu, walker->pte_access, pte_pkey, access);if (unlikely (errcode))
@@ -463,7 +465,8 @@ retry_walk: }pgprintk ("%s: pte %llx pte_access %x pt_access %x\n" , - __func__, (u64 )pte, walker->pte_access, walker->pt_access); + __func__, (u64 )pte, walker->pte_access, + walker->pt_access[walker->level -1 ]);return 1 ; error:
@@ -635,7 +638,7 @@ static int FNAME(fetch)(struct kvm_vcpubool huge_page_disallowed = exec && nx_huge_page_workaround_enabled;struct kvm_mmu_page *sp =NULL ;struct kvm_shadow_walk_iterator it; -unsigned direct_access, access = gw->pt_access; +unsigned int direct_access, access;int top_level, level, req_level, ret;gfn_t base_gfn = gw->gfn;
@@ -667,6 +670,7 @@ static int FNAME(fetch)(struct kvm_vcpu sp =NULL ;if (!is_shadow_present_pte (*it.sptep)) { table_gfn = gw->table_gfn[it.level -2 ]; + access = gw->pt_access[it.level -2 ]; sp =kvm_mmu_get_page (vcpu, table_gfn, addr, it.level-1 , false, access); }
Greg Kroah-Hartman
maintainerPATCH 58/131 kvm: avoid speculation-based attacks from out-of-range memslot accesses
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit da27a83fd6cc7780fea190e1f5c19e87019da65c upstream.
KVM's mechanism for accessing guest memory translates a guest physical address (gpa) to a host virtual address using the right-shifted gpa (also known as gfn) and a struct kvm_memory_slot. The translation is performed in __gfn_to_hva_memslot using the following formula:
hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE
It is expected that gfn falls within the boundaries of the guest's physical memory. However, a guest can access invalid physical addresses in such a way that the gfn is invalid.
__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first retrieves a memslot through __gfn_to_memslot. While __gfn_to_memslot does check that the gfn falls within the boundaries of the guest's physical memory or not, a CPU can speculate the result of the check and continue execution speculatively using an illegal gfn. The speculation can result in calculating an out-of-bounds hva. If the resulting host virtual address is used to load another guest physical address, this is effectively a Spectre gadget consisting of two consecutive reads, the second of which is data dependent on the first.
Right now it's not clear if there are any cases in which this is exploitable. One interesting case was reported by the original author of this patch, and involves visiting guest page tables on x86. Right now these are not vulnerable because the hva read goes through get_user(), which contains an LFENCE speculation barrier. However, there are patches in progress for x86 uaccess.h to mask kernel addresses instead of using LFENCE; once these land, a guest could use speculation to read from the VMM's ring 3 address space. Other architectures such as ARM already use the address masking method, and would be susceptible to this same kind of data-dependent access gadgets. Therefore, this patch proactively protects from these attacks by masking out-of-bounds gfns in __gfn_to_hva_memslot, which blocks speculation of invalid hvas.
Sean Christopherson noted that this patch does not cover kvm_read_guest_offset_cached. This however is limited to a few bytes past the end of the cache, and therefore it is unlikely to be useful in the context of building a chain of data dependent accesses.
--- include/linux/kvm_host.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
include/linux/kvm_host.h +9 -1
@@ -1104,7 +1104,15 @@ __gfn_to_memslot(struct kvm_memslots *slstatic inline unsigned long __gfn_to_hva_memslot (struct kvm_memory_slot *slot,gfn_t gfn) { -return slot->userspace_addr + (gfn - slot->base_gfn) *PAGE_SIZE ; +/* +* The index was checked originally in search_memslots. To avoid +* that a malicious guest builds a Spectre gadget out of e.g. page +* table walks, do not let the processor speculate loads outside +* the guest's registered memslots. +*/ +unsigned long offset =array_index_nospec (gfn - slot->base_gfn, + slot->npages); +return slot->userspace_addr + offset *PAGE_SIZE ; }static inline int memslot_id (struct kvm *kvm,gfn_t gfn)
Greg Kroah-Hartman
maintainerPATCH 59/131 staging: rtl8723bs: Fix uninitialized variables
In reply to Greg Kroah-HartmanFrom: Wenli Looi <[email protected]>
commit 43c85d770db80cb135f576f8fde6ff1a08e707a4 upstream.
The sinfo.pertid and sinfo.generation variables are not initialized and it causes a crash when we use this as a wireless access point.
[ 456.873025] ------------[ cut here ]------------ [ 456.878198] kernel BUG at mm/slub.c:3968! [ 456.882680] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
[ snip ]
[ 457.271004] Backtrace: [ 457.273733] [<c02b7ee4>] (kfree) from [<c0e2a470>] (nl80211_send_station+0x954/0xfc4) [ 457.282481] r9:eccca0c0 r8:e8edfec0 r7:00000000 r6:00000011 r5:e80a9480 r4:e8edfe00 [ 457.291132] [<c0e29b1c>] (nl80211_send_station) from [<c0e2b18c>] (cfg80211_new_sta+0x90/0x1cc) [ 457.300850] r10:e80a9480 r9:e8edfe00 r8:ea678cca r7:00000a20 r6:00000000 r5:ec46d000 [ 457.309586] r4:ec46d9e0 [ 457.312433] [<c0e2b0fc>] (cfg80211_new_sta) from [<bf086684>] (rtw_cfg80211_indicate_sta_assoc+0x80/0x9c [r8723bs]) [ 457.324095] r10:00009930 r9:e85b9d80 r8:bf091050 r7:00000000 r6:00000000 r5:0000001c [ 457.332831] r4:c1606788 [ 457.335692] [<bf086604>] (rtw_cfg80211_indicate_sta_assoc [r8723bs]) from [<bf03df38>] (rtw_stassoc_event_callback+0x1c8/0x1d4 [r8723bs]) [ 457.349489] r7:ea678cc0 r6:000000a1 r5:f1225f84 r4:f086b000 [ 457.355845] [<bf03dd70>] (rtw_stassoc_event_callback [r8723bs]) from [<bf048e4c>] (mlme_evt_hdl+0x8c/0xb4 [r8723bs]) [ 457.367601] r7:c1604900 r6:f086c4b8 r5:00000000 r4:f086c000 [ 457.373959] [<bf048dc0>] (mlme_evt_hdl [r8723bs]) from [<bf03693c>] (rtw_cmd_thread+0x198/0x3d8 [r8723bs]) [ 457.384744] r5:f086e000 r4:f086c000 [ 457.388754] [<bf0367a4>] (rtw_cmd_thread [r8723bs]) from [<c014a214>] (kthread+0x170/0x174) [ 457.398083] r10:ed7a57e8 r9:bf0367a4 r8:f086b000 r7:e8ede000 r6:00000000 r5:e9975200 [ 457.406828] r4:e8369900 [ 457.409653] [<c014a0a4>] (kthread) from [<c01010e8>] (ret_from_fork+0x14/0x2c) [ 457.417718] Exception stack(0xe8edffb0 to 0xe8edfff8) [ 457.423356] ffa0: 00000000 00000000 00000000 00000000 [ 457.432492] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 457.441618] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 457.449006] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c014a0a4 [ 457.457750] r4:e9975200 [ 457.460574] Code: 1a000003 e5953004 e3130001 1a000000 (e7f001f2) [ 457.467381] ---[ end trace 4acbc8c15e9e6aa7 ]---
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +1 -1
@@ -2384,7 +2384,7 @@ void rtw_cfg80211_indicate_sta_assoc(strDBG_871X (FUNC_ADPT_FMT "\n" ,FUNC_ADPT_ARG (padapter)); { -struct station_info sinfo; +struct station_info sinfo = {};u8 ie_offset;if (GetFrameSubType (pmgmt_frame) ==WIFI_ASSOCREQ ) ie_offset = _ASOCREQ_IE_OFFSET_;
Greg Kroah-Hartman
maintainerPATCH 60/131 async_xor: check src_offs is not NULL before updating it
In reply to Greg Kroah-HartmanFrom: Xiao Ni <[email protected]>
commit 9be148e408df7d361ec5afd6299b7736ff3928b0 upstream.
When PAGE_SIZE is greater than 4kB, multiple stripes may share the same page. Thus, src_offs is added to async_xor_offs() with array of offsets. However, async_xor() passes NULL src_offs to async_xor_offs(). In such case, src_offs should not be updated. Add a check before the update.
--- crypto/async_tx/async_xor.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
crypto/async_tx/async_xor.c +2 -1
@@ -233,7 +233,8 @@ async_xor_offs(struct page *dest, unsignif (submit->flags &ASYNC_TX_XOR_DROP_DST ) { src_cnt--; src_list++; - src_offs++; +if (src_offs) + src_offs++; }/* wait for any prerequisite operations */
Greg Kroah-Hartman
maintainerPATCH 61/131 btrfs: return value from btrfs_mark_extent_written() in case of error
In reply to Greg Kroah-HartmanFrom: Ritesh Harjani <[email protected]>
commit e7b2ec3d3d4ebeb4cff7ae45cf430182fa6a49fb upstream.
We always return 0 even in case of an error in btrfs_mark_extent_written(). Fix it to return proper error value in case of a failure. All callers handle it.
--- fs/btrfs/file.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/file.c +2 -2
@@ -1088,7 +1088,7 @@ int btrfs_mark_extent_written(struct btrint del_nr =0 ;int del_slot =0 ;int recow; -int ret; +int ret =0 ;u64 ino =btrfs_ino (inode); path =btrfs_alloc_path ();
@@ -1309,7 +1309,7 @@ again: } out:btrfs_free_path (path); -return 0 ; +return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 62/131 btrfs: promote debugging asserts to full-fledged checks in validate_super
In reply to Greg Kroah-HartmanFrom: Nikolay Borisov <[email protected]>
commit aefd7f7065567a4666f42c0fc8cdb379d2e036bf upstream.
Syzbot managed to trigger this assert while performing its fuzzing. Turns out it's better to have those asserts turned into full-fledged checks so that in case buggy btrfs images are mounted the users gets an error and mounting is stopped. Alternatively with CONFIG_BTRFS_ASSERT disabled such image would have been erroneously allowed to be mounted.
--- fs/btrfs/disk-io.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
fs/btrfs/disk-io.c +18 -8
@@ -2467,6 +2467,24 @@ static int validate_super(struct btrfs_f ret = -EINVAL ; } +if (memcmp (fs_info->fs_devices->fsid, fs_info->super_copy->fsid, +BTRFS_FSID_SIZE )) { +btrfs_err (fs_info, +"superblock fsid doesn't match fsid of fs_devices: %pU != %pU" , + fs_info->super_copy->fsid, fs_info->fs_devices->fsid); + ret = -EINVAL ; + } + +if (btrfs_fs_incompat (fs_info,METADATA_UUID ) && +memcmp (fs_info->fs_devices->metadata_uuid, + fs_info->super_copy->metadata_uuid,BTRFS_FSID_SIZE )) { +btrfs_err (fs_info, +"superblock metadata_uuid doesn't match metadata uuid of fs_devices: %pU != %pU" , + fs_info->super_copy->metadata_uuid, + fs_info->fs_devices->metadata_uuid); + ret = -EINVAL ; + } +if (memcmp (fs_info->fs_devices->metadata_uuid, sb->dev_item.fsid,BTRFS_FSID_SIZE ) !=0 ) { btrfs_err(fs_info,
@@ -2969,14 +2987,6 @@ int __cold open_ctree(struct super_block disk_super = fs_info->super_copy; -ASSERT (!memcmp (fs_info->fs_devices->fsid, fs_info->super_copy->fsid, -BTRFS_FSID_SIZE )); - -if (btrfs_fs_incompat (fs_info,METADATA_UUID )) { -ASSERT (!memcmp (fs_info->fs_devices->metadata_uuid, - fs_info->super_copy->metadata_uuid, -BTRFS_FSID_SIZE )); - } features =btrfs_super_flags (disk_super);if (features &BTRFS_SUPER_FLAG_CHANGING_FSID_V2 ) {
Greg Kroah-Hartman
maintainerPATCH 63/131 cgroup1: dont allow \n in renaming
In reply to Greg Kroah-HartmanFrom: Alexander Kuznetsov <[email protected]>
commit b7e24eb1caa5f8da20d405d262dba67943aedc42 upstream.
cgroup_mkdir() have restriction on newline usage in names:
$ mkdir $'/sys/fs/cgroup/cpu/test\ntest2' mkdir: cannot create directory '/sys/fs/cgroup/cpu/test\ntest2': Invalid argument
But in cgroup1_rename() such check is missed. This allows us to make /proc/<pid>/cgroup unparsable:
$ mkdir /sys/fs/cgroup/cpu/test $ mv /sys/fs/cgroup/cpu/test $'/sys/fs/cgroup/cpu/test\ntest2' $ echo $$ > $'/sys/fs/cgroup/cpu/test\ntest2' $ cat /proc/self/cgroup 11:pids:/ 10:freezer:/ 9:hugetlb:/ 8:cpuset:/ 7:blkio:/user.slice 6:memory:/user.slice 5:net_cls,net_prio:/ 4:perf_event:/ 3:devices:/user.slice 2:cpu,cpuacct:/test test2 1:name=systemd:/ 0::/
--- kernel/cgroup/cgroup-v1.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/cgroup/cgroup-v1.c +4 -0
@@ -820,6 +820,10 @@ static int cgroup1_rename(struct kernfs_struct cgroup *cgrp = kn->priv;int ret; +/* do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable */ +if (strchr (new_name_str,'\n' )) +return -EINVAL ; +if (kernfs_type (kn) !=KERNFS_DIR )return -ENOTDIR ;if (kn->parent != new_parent)
Greg Kroah-Hartman
maintainerPATCH 64/131 ftrace: Do not blindly read the ip address in ftrace_bug()
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 6c14133d2d3f768e0a35128faac8aa6ed4815051 upstream.
It was reported that a bug on arm64 caused a bad ip address to be used for updating into a nop in ftrace_init(), but the error path (rightfully) returned -EINVAL and not -EFAULT, as the bug caused more than one error to occur. But because -EINVAL was returned, the ftrace_bug() tried to report what was at the location of the ip address, and read it directly. This caused the machine to panic, as the ip was not pointing to a valid memory address.
Instead, read the ip address with copy_from_kernel_nofault() to safely access the memory, and if it faults, report that the address faulted, otherwise report what was in that location.
--- kernel/trace/ftrace.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/trace/ftrace.c +7 -1
@@ -1968,12 +1968,18 @@ static int ftrace_hash_ipmodify_update(sstatic void print_ip_ins (const char *fmt,const unsigned char *p) { +char ins[MCOUNT_INSN_SIZE ];int i; +if (copy_from_kernel_nofault (ins, p,MCOUNT_INSN_SIZE )) { +printk (KERN_CONT "%s[FAULT] %px\n" , fmt, p); +return ; + } +printk (KERN_CONT "%s" , fmt);for (i =0 ; i <MCOUNT_INSN_SIZE ; i++) -printk (KERN_CONT "%s%02x" , i ?":" :"" , p[i]); +printk (KERN_CONT "%s%02x" , i ?":" :"" , ins[i]); }enum ftrace_bug_type ftrace_bug_type;
Greg Kroah-Hartman
maintainerPATCH 65/131 mmc: renesas_sdhi: abort tuning when timeout detected
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
commit 2c9017d0b5d3fbf17e69577a42d9e610ca122810 upstream.
We have to bring the eMMC from sending-data state back to transfer state once we detected a CRC error (timeout) during tuning. So, send a stop command via mmc_abort_tuning().
Reported-by Yoshihiro Shimoda <[email protected]>
--- drivers/mmc/host/renesas_sdhi_core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mmc/host/renesas_sdhi_core.c +6 -1
@@ -660,14 +660,19 @@ static int renesas_sdhi_execute_tuning(s/* Issue CMD19 twice for each tap */ for (i =0 ; i <2 * priv->tap_num; i++) { +int cmd_error; +/* Set sampling clock position */ sd_scc_write32 (host, priv,SH_MOBILE_SDHI_SCC_TAPSET , i % priv->tap_num); -if (mmc_send_tuning (mmc, opcode,NULL ) ==0 ) +if (mmc_send_tuning (mmc, opcode, &cmd_error) ==0 )set_bit (i, priv->taps);if (sd_scc_read32 (host, priv,SH_MOBILE_SDHI_SCC_SMPCMP ) ==0 )set_bit (i, priv->smpcmp); + +if (cmd_error) +mmc_abort_tuning (mmc, opcode); } ret =renesas_sdhi_select_tuning (host);
Greg Kroah-Hartman
maintainerPATCH 66/131 mmc: renesas_sdhi: Fix HS400 on R-Car M3-W+
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 6687cd72aa9112a454a4646986e0402dd1b07d0e upstream.
R-Car M3-W ES3.0 is marketed as R-Car M3-W+ (R8A77961), and has its own compatible value "renesas,r8a77961".
Hence using soc_device_match() with soc_id = "r8a7796" and revision = "ES3.*" does not actually match running on an R-Car M3-W+ SoC.
Fix this by matching with soc_id = "r8a77961" instead.
--- drivers/mmc/host/renesas_sdhi_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/renesas_sdhi_core.c +1 -1
@@ -902,7 +902,7 @@ static const struct soc_device_attribute { .soc_id = "r8a7795", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps2367 }, { .soc_id = "r8a7796", .revision = "ES1.[012]", .data = &sdhi_quirks_4tap_nohs400 }, { .soc_id = "r8a7796", .revision = "ES1.*", .data = &sdhi_quirks_r8a7796_es13 }, - { .soc_id = "r8a7796", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps1357 }, + { .soc_id = "r8a77961", .data = &sdhi_quirks_bad_taps1357 }, { .soc_id = "r8a77965", .data = &sdhi_quirks_r8a77965 }, { .soc_id = "r8a77980", .data = &sdhi_quirks_nohs400 }, { .soc_id = "r8a77990", .data = &sdhi_quirks_r8a77990 },
Greg Kroah-Hartman
maintainerPATCH 67/131 USB: f_ncm: ncm_bitrate (speed) is unsigned
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
commit 3370139745853f7826895293e8ac3aec1430508e upstream.
[ 190.544755] configfs-gadget gadget: notify speed -44967296
This is because 4250000000 - 2**32 is -44967296.
--- drivers/usb/gadget/function/f_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +1 -1
@@ -583,7 +583,7 @@ static void ncm_do_notify(struct f_ncm * data[0 ] =cpu_to_le32 (ncm_bitrate (cdev->gadget)); data[1 ] = data[0 ]; -DBG (cdev,"notify speed %d\n" ,ncm_bitrate (cdev->gadget)); +DBG (cdev,"notify speed %u\n" ,ncm_bitrate (cdev->gadget)); ncm->notify_state =NCM_NOTIFY_CONNECT ;break ; }
Greg Kroah-Hartman
maintainerPATCH 68/131 usb: f_ncm: only first packet of aggregate needs to start timer
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
commit 1958ff5ad2d4908b44a72bcf564dfe67c981e7fe upstream.
The reasoning for this change is that if we already had a packet pending, then we also already had a pending timer, and as such there is no need to reschedule it.
This also prevents packets getting delayed 60 ms worst case under a tiny packet every 290us transmit load, by keeping the timeout always relative to the first queued up packet. (300us delay * 16KB max aggregation / 80 byte packet =~ 60 ms)
As such the first packet is now at most delayed by 300us.
Under low transmit load, this will simply result in us sending a shorter aggregate, as originally intended.
This patch has the benefit of greatly reducing (by ~10 factor with 1500 byte frames aggregated into 16 kiB) the number of (potentially pretty costly) updates to the hrtimer.
--- drivers/usb/gadget/function/f_ncm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_ncm.c +4 -4
@@ -1101,11 +1101,11 @@ static struct sk_buff *ncm_wrap_ntb(stru ncm->ndp_dgram_count =1 ;/* Note: we skip opts->next_ndp_index */ - } -/* Delay the timer. */ -hrtimer_start (&ncm->task_timer,TX_TIMEOUT_NSECS , -HRTIMER_MODE_REL_SOFT ); +/* Start the timer. */ +hrtimer_start (&ncm->task_timer,TX_TIMEOUT_NSECS , +HRTIMER_MODE_REL_SOFT ); + }/* Add the datagram position entries */ ntb_ndp =skb_put_zero (ncm->skb_tx_ndp, dgram_idx_len);
Greg Kroah-Hartman
maintainerPATCH 69/131 usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms
In reply to Greg Kroah-HartmanFrom: Kyle Tso <[email protected]>
commit 6490fa565534fa83593278267785a694fd378a2b upstream.
Current timer PD_T_SINK_WAIT_CAP is set to 240ms which will violate the SinkWaitCapTimer (tTypeCSinkWaitCap 310 - 620 ms) defined in the PD Spec if the port is faster enough when running the state machine. Set it to the lower bound 310ms to ensure the timeout is in Spec.
--- include/linux/usb/pd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/usb/pd.h +1 -1
@@ -459,7 +459,7 @@ static inline unsigned int rdo_max_power#define PD_T_RECEIVER_RESPONSE 15/* 15ms max */ #define PD_T_SOURCE_ACTIVITY 45#define PD_T_SINK_ACTIVITY 135 -#define PD_T_SINK_WAIT_CAP 240 +#define PD_T_SINK_WAIT_CAP 310/* 310 - 620 ms */ #define PD_T_PS_TRANSITION 500#define PD_T_SRC_TRANSITION 35#define PD_T_DRP_SNK 40
Greg Kroah-Hartman
maintainerPATCH 70/131 usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
commit 4d2aa178d2ad2fb156711113790dde13e9aa2376 upstream.
When only PHY1 is used (for example on Odroid-HC4), the regmap init code uses the usb2 ports when doesn't initialize the PHY1 regmap entry.
This fixes:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... pc : regmap_update_bits_base+0x40/0xa0 lr : dwc3_meson_g12a_usb2_init_phy+0x4c/0xf8 ... Call trace: regmap_update_bits_base+0x40/0xa0 dwc3_meson_g12a_usb2_init_phy+0x4c/0xf8 dwc3_meson_g12a_usb2_init+0x7c/0xc8 dwc3_meson_g12a_usb_init+0x28/0x48 dwc3_meson_g12a_probe+0x298/0x540 platform_probe+0x70/0xe0 really_probe+0xf0/0x4d8 driver_probe_device+0xfc/0x168
...
--- drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-meson-g12a.c +4 -1
@@ -651,7 +651,7 @@ static int dwc3_meson_g12a_setup_regmapsreturn PTR_ERR (priv->usb_glue_regmap);/* Create a regmap for each USB2 PHY control register set */ -for (i =0 ; i < priv->usb2_ports; i++) { +for (i =0 ; i < priv->drvdata->num_phys; i++) {struct regmap_config u2p_regmap_config = { .reg_bits =8 , .val_bits =32 ,
@@ -659,6 +659,9 @@ static int dwc3_meson_g12a_setup_regmaps .max_register = U2P_R1, }; +if (!strstr (priv->drvdata->phy_names[i],"usb2" )) +continue ; + u2p_regmap_config.name =devm_kasprintf (priv->dev,GFP_KERNEL ,"u2p-%d" , i);if (!u2p_regmap_config.name)
Greg Kroah-Hartman
maintainerPATCH 71/131 usb: dwc3: meson-g12a: Disable the regulator in the error handling path of the probe
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 1d0d3d818eafe1963ec1eaf302175cd14938188e upstream.
If an error occurs after a successful 'regulator_enable()' call, 'regulator_disable()' must be called.
Fix the error handling path of the probe accordingly.
The remove function doesn't need to be fixed, because the 'regulator_disable()' call is already hidden in 'dwc3_meson_g12a_suspend()' which is called via 'pm_runtime_set_suspended()' in the remove function.
--- drivers/usb/dwc3/dwc3-meson-g12a.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/dwc3/dwc3-meson-g12a.c +6 -2
@@ -775,13 +775,13 @@ static int dwc3_meson_g12a_probe(struct ret = priv->drvdata->usb_init (priv);if (ret) - goto err_disable_clks; + goto err_disable_regulator;/* Init PHYs */ for (i =0 ; i <PHY_COUNT ; ++i) { ret =phy_init (priv->phys[i]);if (ret) - goto err_disable_clks; + goto err_disable_regulator; }/* Set PHY Power */
@@ -819,6 +819,10 @@ err_phys_exit:for (i =0 ; i <PHY_COUNT ; ++i)phy_exit (priv->phys[i]); +err_disable_regulator: +if (priv->vbus) +regulator_disable (priv->vbus); + err_disable_clks:clk_bulk_disable_unprepare (priv->drvdata->num_clks, priv->drvdata->clks);
Greg Kroah-Hartman
maintainerPATCH 72/131 usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
commit 03715ea2e3dbbc56947137ce3b4ac18a726b2f87 upstream.
There exists a possible scenario in which dwc3_gadget_init() can fail:
during during host -> peripheral mode switch in dwc3_set_mode(), and a pending gadget driver fails to bind. Then, if the DRD undergoes another mode switch from peripheral->host the resulting dwc3_gadget_exit() will attempt to reference an invalid and dangling dwc->gadget pointer as well as call dma_free_coherent() on unmapped DMA pointers.
The exact scenario can be reproduced as follows:
- Start DWC3 in peripheral mode
- Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)
- Run FunctionFS userspace application (open EPs, write descriptors, etc)
- Bind gadget driver to DWC3's UDC
- Switch DWC3 to host mode
=> dwc3_gadget_exit() is called. usb_del_gadget() will put the
ConfigFS driver instance on the gadget_driver_pending_list
- Stop FunctionFS application (closes the ep files)
- Switch DWC3 to peripheral mode
=> dwc3_gadget_init() fails as usb_add_gadget() calls
check_pending_gadget_drivers() and attempts to rebind the UDC to the ConfigFS gadget but fails with -19 (-ENODEV) because the FFS instance is not in FFS_ACTIVE state (userspace has not re-opened and written the descriptors yet, i.e. desc_ready!=0).
- Switch DWC3 back to host mode
=> dwc3_gadget_exit() is called again, but this time dwc->gadget
is invalid.
Although it can be argued that userspace should take responsibility for ensuring that the FunctionFS application be ready prior to allowing the composite driver bind to the UDC, failure to do so should not result in a panic from the kernel driver.
Fix this by setting dwc->gadget to NULL in the failure path of dwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out unless the gadget pointer is valid.
--- drivers/usb/dwc3/gadget.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/gadget.c +4 -0
@@ -3936,6 +3936,7 @@ err5:dwc3_gadget_free_endpoints (dwc); err4:usb_put_gadget (dwc->gadget); + dwc->gadget =NULL ; err3:dma_free_coherent (dwc->sysdev,DWC3_BOUNCE_SIZE , dwc->bounce, dwc->bounce_addr);
@@ -3955,6 +3956,9 @@ err0:void dwc3_gadget_exit (struct dwc3 *dwc) { +if (!dwc->gadget) +return ; +usb_del_gadget (dwc->gadget);dwc3_gadget_free_endpoints (dwc);usb_put_gadget (dwc->gadget);
Greg Kroah-Hartman
maintainerPATCH 73/131 usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
commit 8d396bb0a5b62b326f6be7594d8bd46b088296bd upstream.
The DWC3 DebugFS directory and files are currently created once during probe. This includes creation of subdirectories for each of the gadget's endpoints. This works fine for peripheral-only controllers, as dwc3_core_init_mode() calls dwc3_gadget_init() just prior to calling dwc3_debugfs_init().
However, for dual-role controllers, dwc3_core_init_mode() will instead call dwc3_drd_init() which is problematic in a few ways. First, the initial state must be determined, then dwc3_set_mode() will have to schedule drd_work and by then dwc3_debugfs_init() could have already been invoked. Even if the initial mode is peripheral, dwc3_gadget_init() happens after the DebugFS files are created, and worse so if the initial state is host and the controller switches to peripheral much later. And secondly, even if the gadget endpoints' debug entries were successfully created, if the controller exits peripheral mode, its dwc3_eps are freed so the debug files would now hold stale references.
So it is best if the DebugFS endpoint entries are created and removed dynamically at the same time the underlying dwc3_eps are. Do this by calling dwc3_debugfs_create_endpoint_dir() as each endpoint is created, and conversely remove the DebugFS entry when the endpoint is freed.
--- drivers/usb/dwc3/debug.h | 3 +++ drivers/usb/dwc3/debugfs.c | 21 ++------------------- drivers/usb/dwc3/gadget.c | 3 +++ 3 files changed, 8 insertions(+), 19 deletions(-)
drivers/usb/dwc3/debug.h +3 -0
@@ -413,9 +413,12 @@ static inline const char *dwc3_gadget_ge#ifdef CONFIG_DEBUG_FS +extern void dwc3_debugfs_create_endpoint_dir (struct dwc3_ep *dep);extern void dwc3_debugfs_init (struct dwc3 *d);extern void dwc3_debugfs_exit (struct dwc3 *d);#else +static inline void dwc3_debugfs_create_endpoint_dir (struct dwc3_ep *dep) +{ }static inline void dwc3_debugfs_init (struct dwc3 *d) { }static inline void dwc3_debugfs_exit (struct dwc3 *d)
drivers/usb/dwc3/debugfs.c +2 -19
@@ -890,30 +890,14 @@ static void dwc3_debugfs_create_endpoint } } -static void dwc3_debugfs_create_endpoint_dir (struct dwc3_ep *dep, -struct dentry *parent) +void dwc3_debugfs_create_endpoint_dir (struct dwc3_ep *dep) {struct dentry *dir; - dir =debugfs_create_dir (dep->name, parent); + dir =debugfs_create_dir (dep->name, dep->dwc->root);dwc3_debugfs_create_endpoint_files (dep, dir); } -static void dwc3_debugfs_create_endpoint_dirs (struct dwc3 *dwc, -struct dentry *parent) -{ -int i; - -for (i =0 ; i < dwc->num_eps; i++) { -struct dwc3_ep *dep = dwc->eps[i]; - -if (!dep) -continue ; - -dwc3_debugfs_create_endpoint_dir (dep, parent); - } -} -void dwc3_debugfs_init (struct dwc3 *dwc) {struct dentry *root;
@@ -944,7 +928,6 @@ void dwc3_debugfs_init(struct dwc3 *dwc) &dwc3_testmode_fops);debugfs_create_file ("link_state" ,0644 , root, dwc, &dwc3_link_state_fops); -dwc3_debugfs_create_endpoint_dirs (dwc, root); } }
drivers/usb/dwc3/gadget.c +3 -0
@@ -2665,6 +2665,8 @@ static int dwc3_gadget_init_endpoint(strINIT_LIST_HEAD (&dep->started_list);INIT_LIST_HEAD (&dep->cancelled_list); +dwc3_debugfs_create_endpoint_dir (dep); +return 0 ; }
@@ -2708,6 +2710,7 @@ static void dwc3_gadget_free_endpoints(slist_del (&dep->endpoint.ep_list); } +debugfs_remove_recursive (debugfs_lookup (dep->name, dwc->root));kfree (dep); } }
Greg Kroah-Hartman
maintainerPATCH 74/131 usb: dwc3: ep0: fix NULL pointer exception
In reply to Greg Kroah-HartmanFrom: Marian-Cristian Rotariu <[email protected]>
commit d00889080ab60051627dab1d85831cd9db750e2a upstream.
There is no validation of the index from dwc3_wIndex_to_dep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer eps and the index might wrongly indicate a larger ep index than existing.
By adding this validation from the patch we can actually report a wrong index back to the caller.
In our usecase we are using a composite device on an older kernel, but upstream might use this fix also. Unfortunately, I cannot describe the hardware for others to reproduce the issue as it is a proprietary implementation.
[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4 [ 82.966891] Mem abort info: [ 82.969663] ESR = 0x96000006 [ 82.972703] Exception class = DABT (current EL), IL = 32 bits [ 82.978603] SET = 0, FnV = 0 [ 82.981642] EA = 0, S1PTW = 0 [ 82.984765] Data abort info: [ 82.987631] ISV = 0, ISS = 0x00000006 [ 82.991449] CM = 0, WnR = 0 [ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000 [ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c) [ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1 [ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c [ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94
...
[ 83.141788] Call trace: [ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c [ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94 [ 83.181546] ---[ end trace aac6b5267d84c32f ]---
--- drivers/usb/dwc3/ep0.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/dwc3/ep0.c +3 -0
@@ -292,6 +292,9 @@ static struct dwc3_ep *dwc3_wIndex_to_de epnum |=1 ; dep = dwc->eps[epnum]; +if (dep ==NULL ) +return NULL ; +if (dep->flags &DWC3_EP_ENABLED )return dep;
Greg Kroah-Hartman
maintainerPATCH 75/131 usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling
In reply to Greg Kroah-HartmanFrom: Thomas Petazzoni <[email protected]>
commit b65ba0c362be665192381cc59e3ac3ef6f0dd1e1 upstream.
In commit 92af4fc6ec33 ("usb: musb: Fix suspend with devices connected for a64"), the logic to support the MUSB_QUIRK_B_DISCONNECT_99 quirk was modified to only conditionally schedule the musb->irq_work delayed work.
This commit badly breaks ECM Gadget on AM335X. Indeed, with this commit, one can observe massive packet loss:
$ ping 192.168.0.100 ... 15 packets transmitted, 3 received, 80% packet loss, time 14316ms
Reverting this commit brings back a properly functioning ECM Gadget. An analysis of the commit seems to indicate that a mistake was
made: the previous code was not falling through into the MUSB_QUIRK_B_INVALID_VBUS_91, but now it is, unless the condition is taken.
Changing the logic to be as it was before the problematic commit *and* only conditionally scheduling musb->irq_work resolves the regression:
$ ping 192.168.0.100 ... 64 packets transmitted, 64 received, 0% packet loss, time 64475ms
--- drivers/usb/musb/musb_core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/musb/musb_core.c +1 -2
@@ -2009,9 +2009,8 @@ static void musb_pm_runtime_check_sessioschedule_delayed_work (&musb->irq_work,msecs_to_jiffies (1000 )); musb->quirk_retries--; -break ; } - fallthrough; +break ;case MUSB_QUIRK_B_INVALID_VBUS_91 :if (musb->quirk_retries && !musb->flush_irq_work) { musb_dbg(musb,
Greg Kroah-Hartman
maintainerPATCH 76/131 usb: typec: wcove: Use LE to CPU conversion when accessing msg->header
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit d5ab95da2a41567440097c277c5771ad13928dad upstream.
As LKP noticed the Sparse is not happy about strict type handling:
.../typec/tcpm/wcove.c:380:50: sparse: expected unsigned short [usertype] header
.../typec/tcpm/wcove.c:380:50: sparse: got restricted __le16 const [usertype] header
Fix this by switching to use pd_header_cnt_le() instead of pd_header_cnt() in the affected code.
--- drivers/usb/typec/tcpm/wcove.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tcpm/wcove.c +1 -1
@@ -377,7 +377,7 @@ static int wcove_pd_transmit(struct tcpcconst u8 *data = (void *)msg;int i; -for (i =0 ; i <pd_header_cnt (msg->header) *4 +2 ; i++) { +for (i =0 ; i <pd_header_cnt_le (msg->header) *4 +2 ; i++) { ret =regmap_write (wcove->regmap,USBC_TX_DATA + i, data[i]);if (ret)
Greg Kroah-Hartman
maintainerPATCH 77/131 usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
In reply to Greg Kroah-HartmanFrom: Mayank Rana <[email protected]>
commit f247f0a82a4f8c3bfed178d8fd9e069d1424ee4e upstream.
If ucsi_init() fails for some reason (e.g. ucsi_register_port() fails or general communication failure to the PPM), particularly at any point after the GET_CAPABILITY command had been issued, this results in unwinding the initialization and returning an error. However the ucsi structure's ucsi_capability member retains its current value, including likely a non-zero num_connectors. And because ucsi_init() itself is done in a workqueue a UCSI interface driver will be unaware that it failed and may think the ucsi_register() call was completely successful. Later, if ucsi_unregister() is called, due to this stale ucsi->cap value it would try to access the items in the ucsi->connector array which might not be in a proper state or not even allocated at all and results in NULL or invalid pointer dereference.
Fix this by clearing the ucsi->cap value to 0 during the error path of ucsi_init() in order to prevent a later ucsi_unregister() from entering the connector cleanup loop.
--- drivers/usb/typec/ucsi/ucsi.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/typec/ucsi/ucsi.c +1 -0
@@ -1118,6 +1118,7 @@ err_unregister: } err_reset: +memset (&ucsi->cap,0 ,sizeof (ucsi->cap));ucsi_reset_ppm (ucsi); err:return ret;
Greg Kroah-Hartman
maintainerPATCH 78/131 usb: typec: intel_pmc_mux: Put fwnode in error case during ->probe()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 1a85b350a7741776a406005b943e3dec02c424ed upstream.
device_get_next_child_node() bumps a reference counting of a returned variable. We have to balance it whenever we return to the caller.
--- drivers/usb/typec/mux/intel_pmc_mux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/typec/mux/intel_pmc_mux.c +3 -1
@@ -623,8 +623,10 @@ static int pmc_usb_probe(struct platformbreak ; ret =pmc_usb_register_port (pmc, i, fwnode); -if (ret) +if (ret) { +fwnode_handle_put (fwnode); goto err_remove_ports; + } }platform_set_drvdata (pdev, pmc);
Greg Kroah-Hartman
maintainerPATCH 79/131 usb: typec: intel_pmc_mux: Add missed error check for devm_ioremap_resource()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 843fabdd7623271330af07f1b7fbd7fabe33c8de upstream.
devm_ioremap_resource() can return an error, add missed check for it.
--- drivers/usb/typec/mux/intel_pmc_mux.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/typec/mux/intel_pmc_mux.c +5 -0
@@ -573,6 +573,11 @@ static int pmc_usb_probe_iom(struct pmc_return -ENOMEM ; } +if (IS_ERR (pmc->iom_base)) { +put_device (&adev->dev); +return PTR_ERR (pmc->iom_base); + } + pmc->iom_adev = adev;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 80/131 usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
commit 6fc1db5e6211e30fbb1cee8d7925d79d4ed2ae14 upstream.
During unbind, ffs_func_eps_disable() will be executed, resulting in completion callbacks for any pending USB requests. When using AIO, irrespective of the completion status, io_data work is queued to io_completion_wq to evaluate and handle the completed requests. Since work runs asynchronously to the unbind() routine, there can be a scenario where the work runs after the USB gadget has been fully removed, resulting in accessing of a resource which has been already freed. (i.e. usb_ep_free_request() accessing the USB ep structure)
Explicitly drain the io_completion_wq, instead of relying on the destroy_workqueue() (in ffs_data_put()) to make sure no pending completion work items are running.
--- drivers/usb/gadget/function/f_fs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/function/f_fs.c +3 -0
@@ -3566,6 +3566,9 @@ static void ffs_func_unbind(struct usb_c ffs->func =NULL ; } +/* Drain any pending AIO completions */ +drain_workqueue (ffs->io_completion_wq); +if (!--opts->refcnt)functionfs_unbind (ffs);
Greg Kroah-Hartman
maintainerPATCH 81/131 USB: serial: ftdi_sio: add NovaTech OrionMX product ID
In reply to Greg Kroah-HartmanFrom: George McCollister <[email protected]>
commit bc96c72df33ee81b24d87eab953c73f7bcc04f29 upstream.
Add PID for the NovaTech OrionMX so it can be automatically detected.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -611,6 +611,7 @@ static const struct usb_device_id id_tab .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) }, { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
drivers/usb/serial/ftdi_sio_ids.h +1 -0
@@ -581,6 +581,7 @@#define FTDI_NT_ORIONLXM_PID 0x7c90/* OrionLXm Substation Automation Platform */ #define FTDI_NT_ORIONLX_PLUS_PID 0x7c91/* OrionLX+ Substation Automation Platform */ #define FTDI_NT_ORION_IO_PID 0x7c92/* Orion I/O */ +#define FTDI_NT_ORIONMX_PID 0x7c93/* OrionMX */ /* * Synapse Wireless product ids (FTDI_VID)
Greg Kroah-Hartman
maintainerPATCH 82/131 USB: serial: omninet: add device id for Zyxel Omni 56K Plus
In reply to Greg Kroah-HartmanFrom: Alexandre GRIVEAUX <[email protected]>
commit fc0b3dc9a11771c3919eaaaf9d649138b095aa0f upstream.
Add device id for Zyxel Omni 56K Plus modem, this modem include:
USB chip:
NetChip
NET2888
Main chip:
901041A
F721501APGF
Another modem using the same chips is the Zyxel Omni 56K DUO/NEO, could be added with the right USB ID.
--- drivers/usb/serial/omninet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/omninet.c +2 -0
@@ -26,6 +26,7 @@#define ZYXEL_VENDOR_ID 0x0586#define ZYXEL_OMNINET_ID 0x1000 +#define ZYXEL_OMNI_56K_PLUS_ID 0x1500/* This one seems to be a re-branded ZyXEL device */ #define BT_IGNITIONPRO_ID 0x2000
@@ -40,6 +41,7 @@ static int omninet_port_remove(struct usstatic const struct usb_device_id id_table[] = { {USB_DEVICE (ZYXEL_VENDOR_ID ,ZYXEL_OMNINET_ID ) }, + {USB_DEVICE (ZYXEL_VENDOR_ID ,ZYXEL_OMNI_56K_PLUS_ID ) }, {USB_DEVICE (ZYXEL_VENDOR_ID ,BT_IGNITIONPRO_ID ) }, { }/* Terminating entry */ };
Greg Kroah-Hartman
maintainerPATCH 83/131 USB: serial: quatech2: fix control-request directions
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit eb8dbe80326c3d44c1e38ee4f40e0d8d3e06f2d0 upstream.
The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation.
Fix the three requests which erroneously used usb_rcvctrlpipe().
--- drivers/usb/serial/quatech2.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/serial/quatech2.c +3 -3
@@ -416,7 +416,7 @@ static void qt2_close(struct usb_serial_/* flush the port transmit buffer */ i =usb_control_msg (serial->dev, -usb_rcvctrlpipe (serial->dev,0 ), +usb_sndctrlpipe (serial->dev,0 ),QT2_FLUSH_DEVICE ,0x40 ,1 , port_priv->device_port,NULL ,0 ,QT2_USB_TIMEOUT );
@@ -426,7 +426,7 @@ static void qt2_close(struct usb_serial_/* flush the port receive buffer */ i =usb_control_msg (serial->dev, -usb_rcvctrlpipe (serial->dev,0 ), +usb_sndctrlpipe (serial->dev,0 ),QT2_FLUSH_DEVICE ,0x40 ,0 , port_priv->device_port,NULL ,0 ,QT2_USB_TIMEOUT );
@@ -654,7 +654,7 @@ static int qt2_attach(struct usb_serialint status;/* power on unit */ - status =usb_control_msg (serial->dev,usb_rcvctrlpipe (serial->dev,0 ), + status =usb_control_msg (serial->dev,usb_sndctrlpipe (serial->dev,0 ),0xc2 ,0x40 ,0x8000 ,0 ,NULL ,0 ,QT2_USB_TIMEOUT );if (status <0 ) {
Greg Kroah-Hartman
maintainerPATCH 84/131 USB: serial: cp210x: fix alternate function for CP2102N QFN20
In reply to Greg Kroah-HartmanFrom: Stefan Agner <[email protected]>
commit 6f7ec77cc8b64ff5037c1945e4650c65c458037d upstream.
The QFN20 part has a different GPIO/port function assignment. The configuration struct bit field ordered as TX/RX/RS485/WAKEUP/CLK which exactly matches GPIO0-3 for QFN24/28. However, QFN20 has a different GPIO to primary function assignment.
Special case QFN20 to follow to properly detect which GPIOs are available.
--- drivers/usb/serial/cp210x.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/usb/serial/cp210x.c +19 -1
@@ -533,6 +533,12 @@ struct cp210x_single_port_config {#define CP210X_2NCONFIG_GPIO_RSTLATCH_IDX 587#define CP210X_2NCONFIG_GPIO_CONTROL_IDX 600 +/* CP2102N QFN20 port configuration values */ +#define CP2102N_QFN20_GPIO2_TXLED_MODE BIT(2) +#define CP2102N_QFN20_GPIO3_RXLED_MODE BIT(3) +#define CP2102N_QFN20_GPIO1_RS485_MODE BIT(4) +#define CP2102N_QFN20_GPIO0_CLK_MODE BIT(6) +/* CP210X_VENDOR_SPECIFIC, CP210X_WRITE_LATCH call writes these 0x2 bytes. */ struct cp210x_gpio_write {u8 mask;
@@ -1884,7 +1890,19 @@ static int cp2102n_gpioconf_init(struct priv->gpio_pushpull = (gpio_pushpull >>3 ) &0x0f ;/* 0 indicates GPIO mode, 1 is alternate function */ - priv->gpio_altfunc = (gpio_ctrl >>2 ) &0x0f ; +if (priv->partnum ==CP210X_PARTNUM_CP2102N_QFN20 ) { +/* QFN20 is special... */ +if (gpio_ctrl &CP2102N_QFN20_GPIO0_CLK_MODE )/* GPIO 0 */ + priv->gpio_altfunc |=BIT (0 ); +if (gpio_ctrl &CP2102N_QFN20_GPIO1_RS485_MODE )/* GPIO 1 */ + priv->gpio_altfunc |=BIT (1 ); +if (gpio_ctrl &CP2102N_QFN20_GPIO2_TXLED_MODE )/* GPIO 2 */ + priv->gpio_altfunc |=BIT (2 ); +if (gpio_ctrl &CP2102N_QFN20_GPIO3_RXLED_MODE )/* GPIO 3 */ + priv->gpio_altfunc |=BIT (3 ); + }else { + priv->gpio_altfunc = (gpio_ctrl >>2 ) &0x0f ; + }if (priv->partnum ==CP210X_PARTNUM_CP2102N_QFN28 ) {/*
Greg Kroah-Hartman
maintainerPATCH 85/131 usb: gadget: eem: fix wrong eem header operation
In reply to Greg Kroah-HartmanFrom: Linyu Yuan <[email protected]>
commit 305f670846a31a261462577dd0b967c4fa796871 upstream.
when skb_clone() or skb_copy_expand() fail,
it should pull skb with lengh indicated by header, or not it will read network data and check it as header.
--- drivers/usb/gadget/function/f_eem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_eem.c +2 -2
@@ -495,7 +495,7 @@ static int eem_unwrap(struct gether *por skb2 =skb_clone (skb,GFP_ATOMIC );if (unlikely (!skb2)) {DBG (cdev,"unable to unframe EEM packet\n" ); -continue ; + goto next; }skb_trim (skb2, len -ETH_FCS_LEN );
@@ -505,7 +505,7 @@ static int eem_unwrap(struct gether *por GFP_ATOMIC);if (unlikely (!skb3)) {dev_kfree_skb_any (skb2); -continue ; + goto next; }dev_kfree_skb_any (skb2);skb_queue_tail (list, skb3);
Greg Kroah-Hartman
maintainerPATCH 86/131 usb: fix various gadgets null ptr deref on 10gbps cabling.
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
commit 90c4d05780d47e14a50e11a7f17373104cd47d25 upstream.
This avoids a null pointer dereference in f_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm} by simply reusing the 5gbps config for 10gbps.
--- drivers/usb/gadget/function/f_ecm.c | 2 +- drivers/usb/gadget/function/f_eem.c | 2 +- drivers/usb/gadget/function/f_hid.c | 3 ++- drivers/usb/gadget/function/f_loopback.c | 2 +- drivers/usb/gadget/function/f_printer.c | 3 ++- drivers/usb/gadget/function/f_rndis.c | 2 +- drivers/usb/gadget/function/f_serial.c | 2 +- drivers/usb/gadget/function/f_sourcesink.c | 3 ++- drivers/usb/gadget/function/f_subset.c | 2 +- drivers/usb/gadget/function/f_tcm.c | 3 ++- 10 files changed, 14 insertions(+), 10 deletions(-)
drivers/usb/gadget/function/f_ecm.c +1 -1
@@ -791,7 +791,7 @@ ecm_bind(struct usb_configuration *c, st fs_ecm_notify_desc.bEndpointAddress; status =usb_assign_descriptors (f, ecm_fs_function, ecm_hs_function, - ecm_ss_function,NULL ); + ecm_ss_function, ecm_ss_function);if (status) goto fail;
drivers/usb/gadget/function/f_eem.c +1 -1
@@ -302,7 +302,7 @@ static int eem_bind(struct usb_configura eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; status =usb_assign_descriptors (f, eem_fs_function, eem_hs_function, - eem_ss_function,NULL ); + eem_ss_function, eem_ss_function);if (status) goto fail;
drivers/usb/gadget/function/f_hid.c +2 -1
@@ -802,7 +802,8 @@ static int hidg_bind(struct usb_configur hidg_fs_out_ep_desc.bEndpointAddress; status =usb_assign_descriptors (f, hidg_fs_descriptors, - hidg_hs_descriptors, hidg_ss_descriptors,NULL ); + hidg_hs_descriptors, hidg_ss_descriptors, + hidg_ss_descriptors);if (status) goto fail;
drivers/usb/gadget/function/f_loopback.c +1 -1
@@ -207,7 +207,7 @@ autoconf_fail: ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress; ret =usb_assign_descriptors (f, fs_loopback_descs, hs_loopback_descs, - ss_loopback_descs,NULL ); + ss_loopback_descs, ss_loopback_descs);if (ret)return ret;
drivers/usb/gadget/function/f_printer.c +2 -1
@@ -1099,7 +1099,8 @@ autoconf_fail: ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress; ret =usb_assign_descriptors (f, fs_printer_function, - hs_printer_function, ss_printer_function,NULL ); + hs_printer_function, ss_printer_function, + ss_printer_function);if (ret)return ret;
drivers/usb/gadget/function/f_rndis.c +1 -1
@@ -789,7 +789,7 @@ rndis_bind(struct usb_configuration *c, ss_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress; status =usb_assign_descriptors (f, eth_fs_function, eth_hs_function, - eth_ss_function,NULL ); + eth_ss_function, eth_ss_function);if (status) goto fail;
drivers/usb/gadget/function/f_serial.c +1 -1
@@ -233,7 +233,7 @@ static int gser_bind(struct usb_configur gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress; status =usb_assign_descriptors (f, gser_fs_function, gser_hs_function, - gser_ss_function,NULL ); + gser_ss_function, gser_ss_function);if (status) goto fail; dev_dbg(&cdev->gadget->dev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n",
drivers/usb/gadget/function/f_sourcesink.c +2 -1
@@ -431,7 +431,8 @@ no_iso: ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress; ret =usb_assign_descriptors (f, fs_source_sink_descs, - hs_source_sink_descs, ss_source_sink_descs,NULL ); + hs_source_sink_descs, ss_source_sink_descs, + ss_source_sink_descs);if (ret)return ret;
drivers/usb/gadget/function/f_subset.c +1 -1
@@ -358,7 +358,7 @@ geth_bind(struct usb_configuration *c, s fs_subset_out_desc.bEndpointAddress; status =usb_assign_descriptors (f, fs_eth_function, hs_eth_function, - ss_eth_function,NULL ); + ss_eth_function, ss_eth_function);if (status) goto fail;
drivers/usb/gadget/function/f_tcm.c +2 -1
@@ -2061,7 +2061,8 @@ static int tcm_bind(struct usb_configura uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress; ret =usb_assign_descriptors (f, uasp_fs_function_desc, - uasp_hs_function_desc, uasp_ss_function_desc,NULL ); + uasp_hs_function_desc, uasp_ss_function_desc, + uasp_ss_function_desc);if (ret) goto ep_fail;
Greg Kroah-Hartman
maintainerPATCH 87/131 usb: fix various gadget panics on 10gbps cabling
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
commit 032e288097a553db5653af552dd8035cd2a0ba96 upstream.
usb_assign_descriptors() is called with 5 parameters,
the last 4 of which are the usb_descriptor_header for:
full-speed (USB1.1 - 12Mbps [including USB1.0 low-speed @ 1.5Mbps), high-speed (USB2.0 - 480Mbps),
super-speed (USB3.0 - 5Gbps),
super-speed-plus (USB3.1 - 10Gbps).
The differences between full/high/super-speed descriptors are usually substantial (due to changes in the maximum usb block size from 64 to 512 to 1024 bytes and other differences in the specs), while the difference between 5 and 10Gbps descriptors may be as little as nothing (in many cases the same tuning is simply good enough).
However if a gadget driver calls usb_assign_descriptors() with a NULL descriptor for super-speed-plus and is then used on a max 10gbps configuration, the kernel will crash with a null pointer dereference, when a 10gbps capable device port + cable + host port combination shows up. (This wouldn't happen if the gadget max-speed was set to 5gbps, but it of course defaults to the maximum, and there's no real reason to artificially limit it)
The fix is to simply use the 5gbps descriptor as the 10gbps descriptor, if a 10gbps descriptor wasn't provided.
Obviously this won't fix the problem if the 5gbps descriptor is also NULL, but such cases can't be so trivially solved (and any such gadgets are unlikely to be used with USB3 ports any way).
--- drivers/usb/gadget/config.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/gadget/config.c +8 -0
@@ -164,6 +164,14 @@ int usb_assign_descriptors(struct usb_fu {struct usb_gadget *g = f->config->cdev->gadget; +/* super-speed-plus descriptor falls back to super-speed one, +* if such a descriptor was provided, thus avoiding a NULL +* pointer dereference if a 5gbps capable gadget is used with +* a 10gbps capable config (device port + cable + host port) +*/ +if (!ssp) + ssp = ss; +if (fs) { f->fs_descriptors =usb_copy_descriptors (fs);if (!f->fs_descriptors)
Greg Kroah-Hartman
maintainerPATCH 88/131 usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
commit 3a13ff7ef4349d70d1d18378d661117dd5af8efe upstream.
A pending hrtimer may expire after the kthread_worker of tcpm port is destroyed, see below kernel dump when do module unload, fix it by cancel the 2 hrtimers.
[ 111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880 [ 111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 111.526594] Mem abort info: [ 111.526597] ESR = 0x96000047 [ 111.526600] EC = 0x25: DABT (current EL), IL = 32 bits [ 111.526604] SET = 0, FnV = 0 [ 111.526607] EA = 0, S1PTW = 0 [ 111.526610] Data abort info: [ 111.526612] ISV = 0, ISS = 0x00000047 [ 111.526615] CM = 0, WnR = 1 [ 111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000 [ 111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000 [ 111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP [ 111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci] [ 111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36 [ 111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT) [ 111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--) [ 111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390 [ 111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4 [ 111.526703] sp : ffff800010003e20 [ 111.526706] x29: ffff800010003e20 x28: ffff00017f380180 [ 111.537156] buffer_io_error: 6 callbacks suppressed [ 111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read [ 111.539932] x27: ffff00017f3801c0 [ 111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001 [ 111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0 [ 111.548304] [ 111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180 [ 111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read [ 111.554499] [ 111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000 [ 111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read [ 111.561218] [ 111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read [ 111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040 [ 111.570902] x11: ffff0000c05ac6d8 [ 111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read [ 111.588978] x10: 0000000000000000 x9 : 0000000000040000 [ 111.588988] x8 : 0000000000000000 [ 111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read [ 111.605766] x7 : ffff00017f384880 x6 : ffff8000118cb880 [ 111.605777] x5 : ffff00017f384880 [ 111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read [ 111.617086] x4 : 0000000000000000 x3 : ffff0000c2a9f184 [ 111.617096] x2 : ffff8000118cb880 [ 111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read [ 111.626927] x1 : ffff8000118cb880 x0 : ffff00017f384888 [ 111.626938] Call trace: [ 111.626942] queued_spin_lock_slowpath+0x1a0/0x390 [ 111.795809] kthread_queue_work+0x30/0xc0 [ 111.799828] state_machine_timer_handler+0x20/0x30 [ 111.804624] __hrtimer_run_queues+0x140/0x1e0 [ 111.808990] hrtimer_interrupt+0xec/0x2c0 [ 111.813004] arch_timer_handler_phys+0x38/0x50 [ 111.817456] handle_percpu_devid_irq+0x88/0x150 [ 111.821991] __handle_domain_irq+0x80/0xe0 [ 111.826093] gic_handle_irq+0xc0/0x140 [ 111.829848] el1_irq+0xbc/0x154 [ 111.832991] arch_cpu_idle+0x1c/0x2c [ 111.836572] default_idle_call+0x24/0x6c [ 111.840497] do_idle+0x238/0x2ac [ 111.843729] cpu_startup_entry+0x2c/0x70 [ 111.847657] rest_init+0xdc/0xec [ 111.850890] arch_call_rest_init+0x14/0x20 [ 111.854988] start_kernel+0x508/0x540 [ 111.858659] Code: 910020e0 8b0200c2 f861d884 aa0203e1 (f8246827) [ 111.864760] ---[ end trace 308b9a4a3dcb73ac ]--- [ 111.869381] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 111.876258] SMP: stopping secondary CPUs [ 111.880185] Kernel Offset: disabled [ 111.883673] CPU features: 0x00001001,20000846 [ 111.888031] Memory Limit: none [ 111.891090] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---
--- drivers/usb/typec/tcpm/tcpm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/typec/tcpm/tcpm.c +3 -0
@@ -5187,6 +5187,9 @@ void tcpm_unregister_port(struct tcpm_po {int i; +hrtimer_cancel (&port->vdm_state_machine_timer); +hrtimer_cancel (&port->state_machine_timer); +tcpm_reset_port (port);for (i =0 ; i <ARRAY_SIZE (port->port_altmode); i++)typec_unregister_altmode (port->port_altmode[i]);
Greg Kroah-Hartman
maintainerPATCH 89/131 usb: typec: tcpm: cancel frs hrtimer when unregister tcpm port
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
commit 7ade4805e296c8d1e40c842395bbe478c7210555 upstream.
Like the state_machine_timer, we should also cancel possible pending frs hrtimer when unregister tcpm port.
--- drivers/usb/typec/tcpm/tcpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/typec/tcpm/tcpm.c +1 -0
@@ -5187,6 +5187,7 @@ void tcpm_unregister_port(struct tcpm_po {int i; +hrtimer_cancel (&port->enable_frs_timer);hrtimer_cancel (&port->vdm_state_machine_timer);hrtimer_cancel (&port->state_machine_timer);
Greg Kroah-Hartman
maintainerPATCH 90/131 regulator: core: resolve supply for boot-on/always-on regulators
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
commit 98e48cd9283dbac0e1445ee780889f10b3d1db6a upstream.
For the boot-on/always-on regulators the set_machine_constrainst() is called before resolving rdev->supply. Thus the code would try to enable rdev before enabling supplying regulator. Enforce resolving supply regulator before enabling rdev.
--- drivers/regulator/core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/regulator/core.c +6 -0
@@ -1422,6 +1422,12 @@ static int set_machine_constraints(struc* and we have control then make sure it is enabled. */ if (rdev->constraints->always_on || rdev->constraints->boot_on) { +/* If we want to enable this regulator, make sure that we know +* the supplying regulator. +*/ +if (rdev->supply_name && !rdev->supply) +return -EPROBE_DEFER ; +if (rdev->supply) { ret =regulator_enable (rdev->supply);if (ret <0 ) {
Greg Kroah-Hartman
maintainerPATCH 91/131 regulator: max77620: Use device_set_of_node_from_dev()
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit 6f55c5dd1118b3076d11d9cb17f5c5f4bc3a1162 upstream.
The MAX77620 driver fails to re-probe on deferred probe because driver core tries to claim resources that are already claimed by the PINCTRL device. Use device_set_of_node_from_dev() helper which marks OF node as reused, skipping erroneous execution of pinctrl_bind_pins() for the PMIC device on the re-probe.
--- drivers/regulator/max77620-regulator.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/regulator/max77620-regulator.c +7 -0
@@ -814,6 +814,13 @@ static int max77620_regulator_probe(stru config.dev = dev; config.driver_data = pmic; +/* +* Set of_node_reuse flag to prevent driver core from attempting to +* claim any pinmux resources already claimed by the parent device. +* Otherwise PMIC driver will fail to re-probe. +*/ +device_set_of_node_from_dev (&pdev->dev, pdev->dev.parent); +for (id =0 ; id <MAX77620_NUM_REGS ; id++) {struct regulator_dev *rdev;struct regulator_desc *rdesc;
Greg Kroah-Hartman
maintainerPATCH 92/131 regulator: bd718x7: Fix the BUCK7 voltage setting on BD71837
In reply to Greg Kroah-HartmanFrom: Matti Vaittinen <[email protected]>
commit bc537e65b09a05923f98a31920d1ab170e648dba upstream.
Changing the BD71837 voltages for other regulators except the first 4 BUCKs should be forbidden when the regulator is enabled. There may be out-of-spec voltage spikes if the voltage of these "non DVS" bucks is changed when enabled. This restriction was accidentally removed when the LDO voltage change was allowed for BD71847. (It was not noticed that the BD71837 BUCK7 used same voltage setting function as LDOs).
Additionally this bug causes incorrect voltage monitoring register access. The voltage change function accidentally used for bd71837 BUCK7 is intended to only handle LDO voltage changes. A BD71847 LDO specific voltage monitoring disabling code gets executed on BD71837 and register offsets are wrongly calculated as regulator is assumed to be an LDO.
Prevent the BD71837 BUCK7 voltage change when BUCK7 is enabled by using the correct voltage setting operation.
--- drivers/regulator/bd718x7-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/bd718x7-regulator.c +1 -1
@@ -364,7 +364,7 @@ BD718XX_OPS(bd71837_buck_regulator_ops, NULL);BD718XX_OPS (bd71837_buck_regulator_nolinear_ops, regulator_list_voltage_table, - regulator_map_voltage_ascend, bd718xx_set_voltage_sel_restricted, + regulator_map_voltage_ascend, bd71837_set_voltage_sel_restricted, regulator_get_voltage_sel_regmap, regulator_set_voltage_time_sel,NULL );/*
Greg Kroah-Hartman
maintainerPATCH 93/131 regulator: fan53880: Fix missing n_voltages setting
In reply to Greg Kroah-HartmanFrom: Axel Lin <[email protected]>
commit 34991ee96fd8477479dd15adadceb6b28b30d9b0 upstream.
--- drivers/regulator/fan53880.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/regulator/fan53880.c +3 -0
@@ -51,6 +51,7 @@ static const struct regulator_ops fan538 REGULATOR_LINEAR_RANGE(800000, 0xf, 0x73, 25000), \ }, \ .n_linear_ranges = 2, \ + .n_voltages = 0x74, \ .vsel_reg = FAN53880_LDO ## _num ## VOUT, \ .vsel_mask = 0x7f, \ .enable_reg = FAN53880_ENABLE, \
@@ -76,6 +77,7 @@ static const struct regulator_desc fan53 REGULATOR_LINEAR_RANGE(600000, 0x1f, 0xf7, 12500), }, .n_linear_ranges = 2, + .n_voltages = 0xf8, .vsel_reg = FAN53880_BUCKVOUT, .vsel_mask = 0x7f, .enable_reg = FAN53880_ENABLE,
@@ -95,6 +97,7 @@ static const struct regulator_desc fan53 REGULATOR_LINEAR_RANGE(3000000, 0x4, 0x70, 25000), }, .n_linear_ranges = 2, + .n_voltages = 0x71, .vsel_reg = FAN53880_BOOSTVOUT, .vsel_mask = 0x7f, .enable_reg = FAN53880_ENABLE_BOOST,
Greg Kroah-Hartman
maintainerPATCH 94/131 regulator: bd71828: Fix .n_voltages settings
In reply to Greg Kroah-HartmanFrom: Axel Lin <[email protected]>
commit 4c668630bf8ea90a041fc69c9984486e0f56682d upstream.
Current .n_voltages settings do not cover the latest 2 valid selectors, so it fails to set voltage for the hightest voltage support. The latest linear range has step_uV = 0, so it does not matter if we count the .n_voltages to maximum selector + 1 or the first selector of latest linear range + 1.
To simplify calculating the n_voltages, let's just set the .n_voltages to maximum selector + 1.
--- include/linux/mfd/rohm-bd71828.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
include/linux/mfd/rohm-bd71828.h +5 -5
@@ -26,11 +26,11 @@ enum { BD71828_REGULATOR_AMOUNT, }; -#define BD71828_BUCK1267_VOLTS 0xEF -#define BD71828_BUCK3_VOLTS 0x10 -#define BD71828_BUCK4_VOLTS 0x20 -#define BD71828_BUCK5_VOLTS 0x10 -#define BD71828_LDO_VOLTS 0x32 +#define BD71828_BUCK1267_VOLTS 0x100 +#define BD71828_BUCK3_VOLTS 0x20 +#define BD71828_BUCK4_VOLTS 0x40 +#define BD71828_BUCK5_VOLTS 0x20 +#define BD71828_LDO_VOLTS 0x40/* LDO6 is fixed 1.8V voltage */ #define BD71828_LDO_6_VOLTAGE 1800000
Greg Kroah-Hartman
maintainerPATCH 95/131 regulator: rtmv20: Fix .set_current_limit/.get_current_limit callbacks
In reply to Greg Kroah-HartmanFrom: Axel Lin <[email protected]>
commit 86ab21cc39e6b99b7065ab9008c90bec5dec535a upstream.
Current code does not set .curr_table and .n_linear_ranges settings, so it cannot use the regulator_get/set_current_limit_regmap helpers. If we setup the curr_table, it will has 200 entries. Implement customized .set_current_limit/.get_current_limit callbacks instead.
--- drivers/regulator/rtmv20-regulator.c | 42 +++++++++++++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-)
drivers/regulator/rtmv20-regulator.c +40 -2
@@ -103,9 +103,47 @@ static int rtmv20_lsw_disable(struct regreturn 0 ; } +static int rtmv20_lsw_set_current_limit (struct regulator_dev *rdev,int min_uA, +int max_uA) +{ +int sel; + +if (min_uA >RTMV20_LSW_MAXUA || max_uA <RTMV20_LSW_MINUA ) +return -EINVAL ; + +if (max_uA >RTMV20_LSW_MAXUA ) + max_uA =RTMV20_LSW_MAXUA ; + + sel = (max_uA -RTMV20_LSW_MINUA ) /RTMV20_LSW_STEPUA ; + +/* Ensure the selected setting is still in range */ +if ((sel *RTMV20_LSW_STEPUA +RTMV20_LSW_MINUA ) < min_uA) +return -EINVAL ; + + sel <<=ffs (rdev->desc->csel_mask) -1 ; + +return regmap_update_bits (rdev->regmap, rdev->desc->csel_reg, + rdev->desc->csel_mask, sel); +} + +static int rtmv20_lsw_get_current_limit (struct regulator_dev *rdev) +{ +unsigned int val; +int ret; + + ret =regmap_read (rdev->regmap, rdev->desc->csel_reg, &val); +if (ret) +return ret; + + val &= rdev->desc->csel_mask; + val >>=ffs (rdev->desc->csel_mask) -1 ; + +return val *RTMV20_LSW_STEPUA +RTMV20_LSW_MINUA ; +} +static const struct regulator_ops rtmv20_regulator_ops = { - .set_current_limit = regulator_set_current_limit_regmap, - .get_current_limit = regulator_get_current_limit_regmap, + .set_current_limit = rtmv20_lsw_set_current_limit, + .get_current_limit = rtmv20_lsw_get_current_limit, .enable = rtmv20_lsw_enable, .disable = rtmv20_lsw_disable, .is_enabled = regulator_is_enabled_regmap,
Greg Kroah-Hartman
maintainerPATCH 96/131 phy: usb: Fix misuse of IS_ENABLED
In reply to Greg Kroah-HartmanFrom: Chen Li <[email protected]>
commit 7c2fc79250cafa1a29befeb60163028ec4720814 upstream.
While IS_ENABLED() is perfectly fine for CONFIG_* symbols, it is not for other symbols such as __BIG_ENDIAN that is provided directly by the compiler.
Switch to use CONFIG_CPU_BIG_ENDIAN instead of __BIG_ENDIAN.
--- drivers/phy/broadcom/phy-brcm-usb-init.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/phy/broadcom/phy-brcm-usb-init.h +2 -2
@@ -78,7 +78,7 @@ static inline u32 brcm_usb_readl(void __* Other architectures (e.g., ARM) either do not support big endian, or * else leave I/O in little endian mode. */ -if (IS_ENABLED (CONFIG_MIPS ) &&IS_ENABLED (__BIG_ENDIAN)) +if (IS_ENABLED (CONFIG_MIPS ) &&IS_ENABLED (CONFIG_CPU_BIG_ENDIAN ))return __raw_readl (addr);else return readl_relaxed (addr);
@@ -87,7 +87,7 @@ static inline u32 brcm_usb_readl(void __static inline void brcm_usb_writel (u32 val,void __iomem *addr) {/* See brcmnand_readl() comments */ -if (IS_ENABLED (CONFIG_MIPS ) &&IS_ENABLED (__BIG_ENDIAN)) +if (IS_ENABLED (CONFIG_MIPS ) &&IS_ENABLED (CONFIG_CPU_BIG_ENDIAN ))__raw_writel (val, addr);else writel_relaxed (val, addr);
Greg Kroah-Hartman
maintainerPATCH 97/131 usb: dwc3: gadget: Disable gadget IRQ during pullup disable
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
commit 8212937305f84ef73ea81036dafb80c557583d4b upstream.
Current sequence utilizes dwc3_gadget_disable_irq() alongside synchronize_irq() to ensure that no further DWC3 events are generated. However, the dwc3_gadget_disable_irq() API only disables device specific events. Endpoint events can still be generated. Briefly disable the interrupt line, so that the cleanup code can run to prevent device and endpoint events. (i.e. __dwc3_gadget_stop() and dwc3_stop_active_transfers() respectively)
Without doing so, it can lead to both the interrupt handler and the pullup disable routine both writing to the GEVNTCOUNT register, which will cause an incorrect count being read from future interrupts.
--- drivers/usb/dwc3/gadget.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/usb/dwc3/gadget.c +5 -6
@@ -2143,13 +2143,10 @@ static int dwc3_gadget_pullup(struct usb }/* -* Synchronize any pending event handling before executing the controller -* halt routine. +* Synchronize and disable any further event handling while controller +* is being enabled/disabled. */ -if (!is_on) { -dwc3_gadget_disable_irq (dwc); -synchronize_irq (dwc->irq_gadget); - } +disable_irq (dwc->irq_gadget);spin_lock_irqsave (&dwc->lock, flags);
@@ -2187,6 +2184,8 @@ static int dwc3_gadget_pullup(struct usb ret =dwc3_gadget_run_stop (dwc, is_on, false);spin_unlock_irqrestore (&dwc->lock, flags); +enable_irq (dwc->irq_gadget); +pm_runtime_put (dwc->dev);return ret;
Greg Kroah-Hartman
maintainerPATCH 98/131 usb: typec: mux: Fix copy-paste mistake in typec_mux_match
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
commit 142d0b24c1b17139f1aaaacae7542a38aa85640f upstream.
Fix the copy-paste mistake in the return path of typec_mux_match(), where dev is considered a member of struct typec_switch rather than struct typec_mux.
The two structs are identical in regards to having the struct device as the first entry, so this provides no functional change.
--- drivers/usb/typec/mux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/mux.c +1 -1
@@ -239,7 +239,7 @@ find_mux: dev =class_find_device (&typec_mux_class,NULL , fwnode, mux_fwnode_match); -return dev ?to_typec_switch (dev) :ERR_PTR (-EPROBE_DEFER ); +return dev ?to_typec_mux (dev) :ERR_PTR (-EPROBE_DEFER ); }/**
Greg Kroah-Hartman
maintainerPATCH 99/131 drm/mcde: Fix off by 10^3 in calculation
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit c8a570443943304cac2e4186dbce6989b6c2b8b5 upstream.
The calclulation of how many bytes we stuff into the DSI pipeline for video mode panels is off by three orders of magnitude because we did not account for the fact that the DRM mode clock is in kilohertz rather than hertz.
This used to be:drm_mode_vrefresh(mode) * mode->htotal * mode->vtotal which would become for example for s6e63m0:
60 x 514 x 831 = 25628040 Hz, but mode->clock is 25628 as it is in kHz.
This affects only the Samsung GT-I8190 "Golden" phone right now since it is the only MCDE device with a video mode display.
Curiously some specimen work with this code and wild settings in the EOL and empty packets at the end of the display, but I have noticed an eeire flicker until now. Others were not so lucky and got black screens.
--- drivers/gpu/drm/mcde/mcde_dsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/mcde/mcde_dsi.c +1 -1
@@ -577,7 +577,7 @@ static void mcde_dsi_setup_video_mode(st* porches and sync. */ /* (ps/s) / (pixels/s) = ps/pixels */ - pclk =DIV_ROUND_UP_ULL (1000000000000 , mode->clock); + pclk =DIV_ROUND_UP_ULL (1000000000000 , (mode->clock *1000 ));dev_dbg (d->dev,"picoseconds between two pixels: %llu\n" , pclk);
Greg Kroah-Hartman
maintainerPATCH 100/131 drm/msm/a6xx: fix incorrectly set uavflagprd_inv field for A650
In reply to Greg Kroah-HartmanFrom: Jonathan Marek <[email protected]>
commit b4387eaf3821a4c4241ac3a556e13244eb1fdaa5 upstream.
Value was shifted in the wrong direction, resulting in the field always being zero, which is incorrect for A650.
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +1 -1
@@ -486,7 +486,7 @@ static void a6xx_set_ubwc_config(struct rgb565_predicator << 11 | amsbc << 4 | lower_bit << 1);gpu_write (gpu,REG_A6XX_TPL1_NC_MODE_CNTL , lower_bit <<1 );gpu_write (gpu,REG_A6XX_SP_NC_MODE_CNTL , - uavflagprd_inv >>4 | lower_bit <<1 ); + uavflagprd_inv <<4 | lower_bit <<1 );gpu_write (gpu,REG_A6XX_UCHE_MODE_CNTL , lower_bit <<21 ); }
Greg Kroah-Hartman
maintainerPATCH 101/131 drm/msm/a6xx: update/fix CP_PROTECT initialization
In reply to Greg Kroah-HartmanFrom: Jonathan Marek <[email protected]>
commit 408434036958699a7f50ddec984f7ba33e11a8f5 upstream.
Update CP_PROTECT register programming based on downstream.
A6XX_PROTECT_RW is renamed to A6XX_PROTECT_NORDWR to make things aligned and also be more clear about what it does.
Note that this required switching to use the CP_ALWAYS_ON_COUNTER as the GMU counter is not accessible from the cmdstream. Which also means using the CPU counter for the msm_gpu_submit_flush() tracepoint (as catapult depends on being able to compare this to the start/end values captured in cmdstream). This may need to be revisited when IFPC is enabled.
Also, compared to downstream, this opens up CP_PERFCTR_CP_SEL as the userspace performance tooling (fdperf and pps-producer) expect to be able to configure the CP counters.
[switch to CP_ALWAYS_ON_COUNTER, open up CP_PERFCNTR_CP_SEL, and spiff
up commit msg]
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 151 +++++++++++++++++++++++++--------- drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 2 2 files changed, 113 insertions(+), 40 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +112 -39
@@ -154,7 +154,7 @@ static void a6xx_submit(struct msm_gpu ** GPU registers so we need to add 0x1a800 to the register value on A630 * to get the right value from PM4. */ -get_stats_counter (ring,REG_A6XX_GMU_ALWAYS_ON_COUNTER_L +0x1a800 , +get_stats_counter (ring,REG_A6XX_CP_ALWAYS_ON_COUNTER_LO ,rbmemptr_stats (ring, index, alwayson_start));/* Invalidate CCU depth and color */
@@ -184,7 +184,7 @@ static void a6xx_submit(struct msm_gpu *get_stats_counter (ring,REG_A6XX_RBBM_PERFCTR_CP_0_LO ,rbmemptr_stats (ring, index, cpcycles_end)); -get_stats_counter (ring,REG_A6XX_GMU_ALWAYS_ON_COUNTER_L +0x1a800 , +get_stats_counter (ring,REG_A6XX_CP_ALWAYS_ON_COUNTER_LO ,rbmemptr_stats (ring, index, alwayson_end));/* Write the fence to the scratch register */
@@ -203,8 +203,8 @@ static void a6xx_submit(struct msm_gpu *OUT_RING (ring, submit->seqno);trace_msm_gpu_submit_flush (submit, -gmu_read64 (&a6xx_gpu->gmu,REG_A6XX_GMU_ALWAYS_ON_COUNTER_L , -REG_A6XX_GMU_ALWAYS_ON_COUNTER_H )); +gpu_read64 (gpu,REG_A6XX_CP_ALWAYS_ON_COUNTER_LO , +REG_A6XX_CP_ALWAYS_ON_COUNTER_HI ));a6xx_flush (gpu, ring); }
@@ -459,6 +459,113 @@ static void a6xx_set_hwcg(struct msm_gpugpu_write (gpu,REG_A6XX_RBBM_CLOCK_CNTL , state ? clock_cntl_on :0 ); } +/* For a615, a616, a618, A619, a630, a640 and a680 */ +static const u32 a6xx_protect[] = { +A6XX_PROTECT_RDONLY (0x00000 ,0x04ff ), +A6XX_PROTECT_RDONLY (0x00501 ,0x0005 ), +A6XX_PROTECT_RDONLY (0x0050b ,0x02f4 ), +A6XX_PROTECT_NORDWR (0x0050e ,0x0000 ), +A6XX_PROTECT_NORDWR (0x00510 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x00534 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x00800 ,0x0082 ), +A6XX_PROTECT_NORDWR (0x008a0 ,0x0008 ), +A6XX_PROTECT_NORDWR (0x008ab ,0x0024 ), +A6XX_PROTECT_RDONLY (0x008de ,0x00ae ), +A6XX_PROTECT_NORDWR (0x00900 ,0x004d ), +A6XX_PROTECT_NORDWR (0x0098d ,0x0272 ), +A6XX_PROTECT_NORDWR (0x00e00 ,0x0001 ), +A6XX_PROTECT_NORDWR (0x00e03 ,0x000c ), +A6XX_PROTECT_NORDWR (0x03c00 ,0x00c3 ), +A6XX_PROTECT_RDONLY (0x03cc4 ,0x1fff ), +A6XX_PROTECT_NORDWR (0x08630 ,0x01cf ), +A6XX_PROTECT_NORDWR (0x08e00 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x08e08 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x08e50 ,0x001f ), +A6XX_PROTECT_NORDWR (0x09624 ,0x01db ), +A6XX_PROTECT_NORDWR (0x09e70 ,0x0001 ), +A6XX_PROTECT_NORDWR (0x09e78 ,0x0187 ), +A6XX_PROTECT_NORDWR (0x0a630 ,0x01cf ), +A6XX_PROTECT_NORDWR (0x0ae02 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x0ae50 ,0x032f ), +A6XX_PROTECT_NORDWR (0x0b604 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x0be02 ,0x0001 ), +A6XX_PROTECT_NORDWR (0x0be20 ,0x17df ), +A6XX_PROTECT_NORDWR (0x0f000 ,0x0bff ), +A6XX_PROTECT_RDONLY (0x0fc00 ,0x1fff ), +A6XX_PROTECT_NORDWR (0x11c00 ,0x0000 ),/* note: infinite range */ +}; + +/* These are for a620 and a650 */ +static const u32 a650_protect[] = { +A6XX_PROTECT_RDONLY (0x00000 ,0x04ff ), +A6XX_PROTECT_RDONLY (0x00501 ,0x0005 ), +A6XX_PROTECT_RDONLY (0x0050b ,0x02f4 ), +A6XX_PROTECT_NORDWR (0x0050e ,0x0000 ), +A6XX_PROTECT_NORDWR (0x00510 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x00534 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x00800 ,0x0082 ), +A6XX_PROTECT_NORDWR (0x008a0 ,0x0008 ), +A6XX_PROTECT_NORDWR (0x008ab ,0x0024 ), +A6XX_PROTECT_RDONLY (0x008de ,0x00ae ), +A6XX_PROTECT_NORDWR (0x00900 ,0x004d ), +A6XX_PROTECT_NORDWR (0x0098d ,0x0272 ), +A6XX_PROTECT_NORDWR (0x00e00 ,0x0001 ), +A6XX_PROTECT_NORDWR (0x00e03 ,0x000c ), +A6XX_PROTECT_NORDWR (0x03c00 ,0x00c3 ), +A6XX_PROTECT_RDONLY (0x03cc4 ,0x1fff ), +A6XX_PROTECT_NORDWR (0x08630 ,0x01cf ), +A6XX_PROTECT_NORDWR (0x08e00 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x08e08 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x08e50 ,0x001f ), +A6XX_PROTECT_NORDWR (0x08e80 ,0x027f ), +A6XX_PROTECT_NORDWR (0x09624 ,0x01db ), +A6XX_PROTECT_NORDWR (0x09e60 ,0x0011 ), +A6XX_PROTECT_NORDWR (0x09e78 ,0x0187 ), +A6XX_PROTECT_NORDWR (0x0a630 ,0x01cf ), +A6XX_PROTECT_NORDWR (0x0ae02 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x0ae50 ,0x032f ), +A6XX_PROTECT_NORDWR (0x0b604 ,0x0000 ), +A6XX_PROTECT_NORDWR (0x0b608 ,0x0007 ), +A6XX_PROTECT_NORDWR (0x0be02 ,0x0001 ), +A6XX_PROTECT_NORDWR (0x0be20 ,0x17df ), +A6XX_PROTECT_NORDWR (0x0f000 ,0x0bff ), +A6XX_PROTECT_RDONLY (0x0fc00 ,0x1fff ), +A6XX_PROTECT_NORDWR (0x18400 ,0x1fff ), +A6XX_PROTECT_NORDWR (0x1a800 ,0x1fff ), +A6XX_PROTECT_NORDWR (0x1f400 ,0x0443 ), +A6XX_PROTECT_RDONLY (0x1f844 ,0x007b ), +A6XX_PROTECT_NORDWR (0x1f887 ,0x001b ), +A6XX_PROTECT_NORDWR (0x1f8c0 ,0x0000 ),/* note: infinite range */ +}; + +static void a6xx_set_cp_protect (struct msm_gpu *gpu) +{ +struct adreno_gpu *adreno_gpu =to_adreno_gpu (gpu); +const u32 *regs = a6xx_protect; +unsigned i, count =ARRAY_SIZE (a6xx_protect), count_max =32 ; + +BUILD_BUG_ON (ARRAY_SIZE (a6xx_protect) >32 ); +BUILD_BUG_ON (ARRAY_SIZE (a650_protect) >48 ); + +if (adreno_is_a650 (adreno_gpu)) { + regs = a650_protect; + count =ARRAY_SIZE (a650_protect); + count_max =48 ; + } + +/* +* Enable access protection to privileged registers, fault on an access +* protect violation and select the last span to protect from the start +* address all the way to the end of the register address space +*/ +gpu_write (gpu,REG_A6XX_CP_PROTECT_CNTL ,BIT (0 ) |BIT (1 ) |BIT (3 )); + +for (i =0 ; i < count -1 ; i++) +gpu_write (gpu,REG_A6XX_CP_PROTECT (i), regs[i]); +/* last CP_PROTECT to have "infinite" length on the last entry */ +gpu_write (gpu,REG_A6XX_CP_PROTECT (count_max -1 ), regs[i]); +} +static void a6xx_set_ubwc_config (struct msm_gpu *gpu) {struct adreno_gpu *adreno_gpu =to_adreno_gpu (gpu);
@@ -722,41 +829,7 @@ static int a6xx_hw_init(struct msm_gpu * }/* Protect registers from the CP */ -gpu_write (gpu,REG_A6XX_CP_PROTECT_CNTL ,0x00000003 ); - -gpu_write (gpu,REG_A6XX_CP_PROTECT (0 ), -A6XX_PROTECT_RDONLY (0x600 ,0x51 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (1 ),A6XX_PROTECT_RW (0xae50 ,0x2 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (2 ),A6XX_PROTECT_RW (0x9624 ,0x13 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (3 ),A6XX_PROTECT_RW (0x8630 ,0x8 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (4 ),A6XX_PROTECT_RW (0x9e70 ,0x1 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (5 ),A6XX_PROTECT_RW (0x9e78 ,0x187 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (6 ),A6XX_PROTECT_RW (0xf000 ,0x810 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (7 ), -A6XX_PROTECT_RDONLY (0xfc00 ,0x3 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (8 ),A6XX_PROTECT_RW (0x50e ,0x0 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (9 ),A6XX_PROTECT_RDONLY (0x50f ,0x0 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (10 ),A6XX_PROTECT_RW (0x510 ,0x0 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (11 ), -A6XX_PROTECT_RDONLY (0x0 ,0x4f9 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (12 ), -A6XX_PROTECT_RDONLY (0x501 ,0xa )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (13 ), -A6XX_PROTECT_RDONLY (0x511 ,0x44 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (14 ),A6XX_PROTECT_RW (0xe00 ,0xe )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (15 ),A6XX_PROTECT_RW (0x8e00 ,0x0 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (16 ),A6XX_PROTECT_RW (0x8e50 ,0xf )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (17 ),A6XX_PROTECT_RW (0xbe02 ,0x0 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (18 ), -A6XX_PROTECT_RW (0xbe20 ,0x11f3 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (19 ),A6XX_PROTECT_RW (0x800 ,0x82 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (20 ),A6XX_PROTECT_RW (0x8a0 ,0x8 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (21 ),A6XX_PROTECT_RW (0x8ab ,0x19 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (22 ),A6XX_PROTECT_RW (0x900 ,0x4d )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (23 ),A6XX_PROTECT_RW (0x98d ,0x76 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (24 ), -A6XX_PROTECT_RDONLY (0x980 ,0x4 )); -gpu_write (gpu,REG_A6XX_CP_PROTECT (25 ),A6XX_PROTECT_RW (0xa630 ,0x0 )); +a6xx_set_cp_protect (gpu);/* Enable expanded apriv for targets that support it */ if (gpu->hw_apriv) {
drivers/gpu/drm/msm/adreno/a6xx_gpu.h +1 -1
@@ -37,7 +37,7 @@ struct a6xx_gpu {* REG_CP_PROTECT_REG(n) - this will block both reads and writes for _len * registers starting at _reg. */ -#define A6XX_PROTECT_RW (_reg, _len) \ +#define A6XX_PROTECT_NORDWR (_reg, _len) \ ((1 << 31) | \ (((_len) & 0x3FFF) << 18) | ((_reg) & 0x3FFFF))
Greg Kroah-Hartman
maintainerPATCH 102/131 drm/msm/a6xx: avoid shadow NULL reference in failure path
In reply to Greg Kroah-HartmanFrom: Jonathan Marek <[email protected]>
commit ce86c239e4d218ae6040bec18e6d19a58edb8b7c upstream.
If a6xx_hw_init() fails before creating the shadow_bo, the a6xx_pm_suspend code referencing it will crash. Change the condition to one that avoids this problem (note: creation of shadow_bo is behind this same condition)
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +1 -1
@@ -1128,7 +1128,7 @@ static int a6xx_pm_suspend(struct msm_gpif (ret)return ret; -if (adreno_gpu->base.hw_apriv || a6xx_gpu->has_whereami) +if (a6xx_gpu->shadow_bo)for (i =0 ; i < gpu->nr_rings; i++) a6xx_gpu->shadow[i] =0 ;
Greg Kroah-Hartman
maintainerPATCH 103/131 RDMA/ipoib: Fix warning caused by destroying non-initial netns
In reply to Greg Kroah-HartmanFrom: Kamal Heib <[email protected]>
commit a3e74fb9247cd530dca246699d5eb5a691884d32 upstream.
After the commit 5ce2dced8e95 ("RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces"), if the IPoIB device is moved to non-initial netns, destroying that netns lets the device vanish instead of moving it back to the initial netns, This is happening because default_device_exit() skips the interfaces due to having rtnl_link_ops set.
Steps to reporoduce:
ip netns add foo
ip link set mlx5_ib0 netns foo
ip netns delete foo
WARNING: CPU: 1 PID: 704 at net/core/dev.c:11435 netdev_exit+0x3f/0x50 Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun d fuse CPU: 1 PID: 704 Comm: kworker/u64:3 Tainted: G S W 5.13.0-rc1+ #1 Hardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.1.5 04/11/2016 Workqueue: netns cleanup_net RIP: 0010:netdev_exit+0x3f/0x50 Code: 48 8b bb 30 01 00 00 e8 ef 81 b1 ff 48 81 fb c0 3a 54 a1 74 13 48 8b 83 90 00 00 00 48 81 c3 90 00 00 00 48 39 d8 75 02 5b c3 <0f> 0b 5b c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00 RSP: 0018:ffffb297079d7e08 EFLAGS: 00010206 RAX: ffff8eb542c00040 RBX: ffff8eb541333150 RCX: 000000008010000d RDX: 000000008010000e RSI: 000000008010000d RDI: ffff8eb440042c00 RBP: ffffb297079d7e48 R08: 0000000000000001 R09: ffffffff9fdeac00 R10: ffff8eb5003be000 R11: 0000000000000001 R12: ffffffffa1545620 R13: ffffffffa1545628 R14: 0000000000000000 R15: ffffffffa1543b20 FS: 0000000000000000(0000) GS:ffff8ed37fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005601b5f4c2e8 CR3: 0000001fc8c10002 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ops_exit_list.isra.9+0x36/0x70 cleanup_net+0x234/0x390 process_one_work+0x1cb/0x360 ? process_one_work+0x360/0x360 worker_thread+0x30/0x370 ? process_one_work+0x360/0x360 kthread+0x116/0x130 ? kthread_park+0x80/0x80 ret_from_fork+0x22/0x30
To avoid the above warning and later on the kernel panic that could happen on shutdown due to a NULL pointer dereference, make sure to set the netns_refund flag that was introduced by commit 3a5ca857079e ("can: dev:
Move device back to init netns on owning netns delete") to properly restore the IPoIB interfaces to the initial netns.
--- drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/ulp/ipoib/ipoib_netlink.c +1 -0
@@ -163,6 +163,7 @@ static size_t ipoib_get_size(const strucstatic struct rtnl_link_ops ipoib_link_ops__read_mostly = { .kind ="ipoib" , + .netns_refund = true, .maxtype =IFLA_IPOIB_MAX , .policy = ipoib_policy, .priv_size =sizeof (struct ipoib_dev_priv ),
Greg Kroah-Hartman
maintainerPATCH 104/131 RDMA/mlx4: Do not map the core_clock page to user space unless enabled
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
commit 404e5a12691fe797486475fe28cc0b80cb8bef2c upstream.
Currently when mlx4 maps the hca_core_clock page to the user space there are read-modifiable registers, one of which is semaphore, on this page as well as the clock counter. If user reads the wrong offset, it can modify the semaphore and hang the device.
Do not map the hca_core_clock page to the user space unless the device has been put in a backwards compatibility mode to support this feature.
After this patch, mlx4 core_clock won't be mapped to user space on the majority of existing devices and the uverbs device time feature in ibv_query_rt_values_ex() will be disabled.
--- drivers/infiniband/hw/mlx4/main.c | 5 +---- drivers/net/ethernet/mellanox/mlx4/fw.c | 3 +++ drivers/net/ethernet/mellanox/mlx4/fw.h | 1 + drivers/net/ethernet/mellanox/mlx4/main.c | 6 ++++++ include/linux/mlx4/device.h | 1 + 5 files changed, 12 insertions(+), 4 deletions(-)
drivers/infiniband/hw/mlx4/main.c +1 -4
@@ -580,12 +580,9 @@ static int mlx4_ib_query_device(struct i props->cq_caps.max_cq_moderation_count =MLX4_MAX_CQ_COUNT ; props->cq_caps.max_cq_moderation_period =MLX4_MAX_CQ_PERIOD ; -if (!mlx4_is_slave (dev->dev)) - err =mlx4_get_internal_clock_params (dev->dev, &clock_params); -if (uhw->outlen >= resp.response_length +sizeof (resp.hca_core_clock_offset)) { resp.response_length +=sizeof (resp.hca_core_clock_offset); -if (!err && !mlx4_is_slave (dev->dev)) { +if (!mlx4_get_internal_clock_params (dev->dev, &clock_params)) { resp.comp_mask |=MLX4_IB_QUERY_DEV_RESP_MASK_CORE_CLOCK_OFFSET ; resp.hca_core_clock_offset = clock_params.offset %PAGE_SIZE ; }
drivers/net/ethernet/mellanox/mlx4/fw.c +3 -0
@@ -823,6 +823,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *#define QUERY_DEV_CAP_MAD_DEMUX_OFFSET 0xb0#define QUERY_DEV_CAP_DMFS_HIGH_RATE_QPN_BASE_OFFSET 0xa8#define QUERY_DEV_CAP_DMFS_HIGH_RATE_QPN_RANGE_OFFSET 0xac +#define QUERY_DEV_CAP_MAP_CLOCK_TO_USER 0xc1#define QUERY_DEV_CAP_QP_RATE_LIMIT_NUM_OFFSET 0xcc#define QUERY_DEV_CAP_QP_RATE_LIMIT_MAX_OFFSET 0xd0#define QUERY_DEV_CAP_QP_RATE_LIMIT_MIN_OFFSET 0xd2
@@ -841,6 +842,8 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *if (mlx4_is_mfunc (dev))disable_unsupported_roce_caps (outbox); +MLX4_GET (field, outbox,QUERY_DEV_CAP_MAP_CLOCK_TO_USER ); + dev_cap->map_clock_to_user = field &0x80 ;MLX4_GET (field, outbox,QUERY_DEV_CAP_RSVD_QP_OFFSET ); dev_cap->reserved_qps =1 << (field &0xf );MLX4_GET (field, outbox,QUERY_DEV_CAP_MAX_QP_OFFSET );
drivers/net/ethernet/mellanox/mlx4/fw.h +1 -0
@@ -131,6 +131,7 @@ struct mlx4_dev_cap {u32 health_buffer_addrs;struct mlx4_port_cap port_cap[MLX4_MAX_PORTS +1 ];bool wol_port[MLX4_MAX_PORTS +1 ]; +bool map_clock_to_user; };struct mlx4_func_cap {
drivers/net/ethernet/mellanox/mlx4/main.c +6 -0
@@ -498,6 +498,7 @@ static int mlx4_dev_cap(struct mlx4_dev } } + dev->caps.map_clock_to_user = dev_cap->map_clock_to_user; dev->caps.uar_page_size =PAGE_SIZE ; dev->caps.num_uars = dev_cap->uar_size /PAGE_SIZE ; dev->caps.local_ca_ack_delay = dev_cap->local_ca_ack_delay;
@@ -1948,6 +1949,11 @@ int mlx4_get_internal_clock_params(strucif (mlx4_is_slave (dev))return -EOPNOTSUPP ; +if (!dev->caps.map_clock_to_user) { +mlx4_dbg (dev,"Map clock to user is not supported.\n" ); +return -EOPNOTSUPP ; + } +if (!params)return -EINVAL ;
include/linux/mlx4/device.h +1 -0
@@ -631,6 +631,7 @@ struct mlx4_caps {bool wol_port[MLX4_MAX_PORTS +1 ];struct mlx4_rate_limit_caps rl_caps;u32 health_buffer_addrs; +bool map_clock_to_user; };struct mlx4_buf_list {
Greg Kroah-Hartman
maintainerPATCH 105/131 ARM: cpuidle: Avoid orphan section warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit d94b93a9101573eb75b819dee94b1417acff631b upstream.
Since commit 83109d5d5fba ("x86/build: Warn on orphan section placement"), we get a warning for objects in orphan sections. The cpuidle implementation for OMAP causes this when CONFIG_CPU_IDLE is disabled:
arm-linux-gnueabi-ld: warning: orphan section __cpuidle_method_of_table' from arch/arm/mach-omap2/pm33xx-core.o' being placed in section `__cpuidle_method_of_table'
arm-linux-gnueabi-ld: warning: orphan section __cpuidle_method_of_table' from arch/arm/mach-omap2/pm33xx-core.o' being placed in section `__cpuidle_method_of_table'
arm-linux-gnueabi-ld: warning: orphan section __cpuidle_method_of_table' from arch/arm/mach-omap2/pm33xx-core.o' being placed in section `__cpuidle_method_of_table'
Change the definition of CPUIDLE_METHOD_OF_DECLARE() to silently drop the table and all code referenced from it when CONFIG_CPU_IDLE is disabled.
--- arch/arm/include/asm/cpuidle.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm/include/asm/cpuidle.h +3 -2
@@ -7,9 +7,11 @@#ifdef CONFIG_CPU_IDLE extern int arm_cpuidle_simple_enter (struct cpuidle_device *dev,struct cpuidle_driver *drv,int index); +#define __cpuidle_method_section __used __section("__cpuidle_method_of_table")#else static inline int arm_cpuidle_simple_enter (struct cpuidle_device *dev,struct cpuidle_driver *drv,int index) {return -ENODEV ; } +#define __cpuidle_method_section __maybe_unused/* drop silently */ #endif /* Common ARM WFI state */
@@ -42,8 +44,7 @@ struct of_cpuidle_method {#define CPUIDLE_METHOD_OF_DECLARE (name, _method, _ops) \ static const struct of_cpuidle_method __cpuidle_method_of_table_##name \ - __used __section("__cpuidle_method_of_table") \ - = { .method = _method, .ops = _ops } + __cpuidle_method_section = { .method = _method, .ops = _ops }extern int arm_cpuidle_suspend (int index);
Greg Kroah-Hartman
maintainerPATCH 106/131 vmlinux.lds.h: Avoid orphan section with !SMP
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit d4c6399900364facd84c9e35ce1540b6046c345f upstream.
With x86_64_defconfig and the following configs, there is an orphan section warning:
CONFIG_SMP=nCONFIG_AMD_MEM_ENCRYPT=yCONFIG_HYPERVISOR_GUEST=yCONFIG_KVM=yCONFIG_PARAVIRT=y
ld: warning: orphan section .data..decrypted' from arch/x86/kernel/cpu/vmware.o' being placed in section `.data..decrypted'
ld: warning: orphan section .data..decrypted' from arch/x86/kernel/kvm.o' being placed in section `.data..decrypted'
These sections are created with DEFINE_PER_CPU_DECRYPTED, which ultimately turns into __PCPU_ATTRS, which in turn has a section attribute with a value of PER_CPU_BASE_SECTION + the section name. When CONFIG_SMP is not set, the base section is .data and that is not currently handled in any linker script.
Add .data..decrypted to PERCPU_DECRYPTED_SECTION, which is included in PERCPU_INPUT -> PERCPU_SECTION, which is include in the x86 linker script when either CONFIG_X86_64 or CONFIG_SMP is unset, taking care of the warning.
--- include/asm-generic/vmlinux.lds.h | 1 + 1 file changed, 1 insertion(+)
include/asm-generic/vmlinux.lds.h +1 -0
@@ -971,6 +971,7 @@#ifdef CONFIG_AMD_MEM_ENCRYPT #define PERCPU_DECRYPTED_SECTION \ . = ALIGN(PAGE_SIZE); \ + *(.data..decrypted) \ *(.data..percpu..decrypted) \ . = ALIGN(PAGE_SIZE);#else
Greg Kroah-Hartman
maintainerPATCH 107/131 tools/bootconfig: Fix error return code in apply_xbc()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
commit e8ba0b2b64126381643bb50df3556b139a60545a upstream.
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- tools/bootconfig/main.c | 1 + 1 file changed, 1 insertion(+)
tools/bootconfig/main.c +1 -0
@@ -399,6 +399,7 @@ static int apply_xbc(const char *path, c }/* TODO: Ensure the @path is initramfs/initrd image */ if (fstat (fd, &stat) <0 ) { + ret = -errno;pr_err ("Failed to get the size of %s\n" , path); goto out; }
Greg Kroah-Hartman
maintainerPATCH 108/131 phy: cadence: Sierra: Fix error return code in cdns_sierra_phy_probe()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
commit 6411e386db0a477217607015e7d2910d02f75426 upstream.
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/phy/cadence/phy-cadence-sierra.c | 1 + 1 file changed, 1 insertion(+)
drivers/phy/cadence/phy-cadence-sierra.c +1 -0
@@ -614,6 +614,7 @@ static int cdns_sierra_phy_probe(struct sp->nsubnodes = node;if (sp->num_lanes >SIERRA_MAX_LANES ) { + ret = -EINVAL ;dev_err (dev,"Invalid lane configuration\n" ); goto put_child2; }
Greg Kroah-Hartman
maintainerPATCH 109/131 ASoC: core: Fix Null-point-dereference in fmt_single_name()
In reply to Greg Kroah-HartmanFrom: Kefeng Wang <[email protected]>
commit 41daf6ba594d55f201c50280ebcd430590441da1 upstream.
Check the return value of devm_kstrdup() in case of Null-point-dereference.
--- sound/soc/soc-core.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/soc-core.c +2 -0
@@ -2231,6 +2231,8 @@ static char *fmt_single_name(struct devireturn NULL ; name =devm_kstrdup (dev, devname,GFP_KERNEL ); +if (!name) +return NULL ;/* are we a "%s.%d" name (platform and SPI components) */ found =strstr (name, dev->driver->name);
Greg Kroah-Hartman
maintainerPATCH 110/131 ASoC: meson: gx-card: fix sound-dai dt schema
In reply to Greg Kroah-HartmanFrom: Jerome Brunet <[email protected]>
commit d031d99b02eaf7363c33f5b27b38086cc8104082 upstream.
There is a fair amount of warnings when running 'make dtbs_check' with amlogic,gx-sound-card.yaml.
Ex:arch/arm64/boot/dts/amlogic/meson-gxm-q200.dt.yaml: sound: dai-link-0:sound-dai:0:1: missing phandle tag in 0 arch/arm64/boot/dts/amlogic/meson-gxm-q200.dt.yaml: sound: dai-link-0:sound-dai:0:2: missing phandle tag in 0 arch/arm64/boot/dts/amlogic/meson-gxm-q200.dt.yaml: sound: dai-link-0:sound-dai:0: [66, 0, 0] is too long
The reason is that the sound-dai phandle provided has cells, and in such case the schema should use 'phandle-array' instead of 'phandle'.
--- Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml +2 -2
@@ -57,7 +57,7 @@ patternProperties: rate sound-dai: - $ref: /schemas/types.yaml#/definitions/phandle + $ref: /schemas/types.yaml#/definitions/phandle-array description: phandle of the CPU DAI patternProperties:
@@ -71,7 +71,7 @@ patternProperties: properties: sound-dai: - $ref: /schemas/types.yaml#/definitions/phandle + $ref: /schemas/types.yaml#/definitions/phandle-array description: phandle of the codec DAI required:
Greg Kroah-Hartman
maintainerPATCH 111/131 phy: ti: Fix an error code in wiz_probe()
In reply to Greg Kroah-HartmanFrom: Yang Li <[email protected]>
commit b8203ec7f58ae925e10fadd3d136073ae7503a6e upstream.
When the code execute this if statement, the value of ret is 0. However, we can see from the dev_err() log that the value of ret should be -EINVAL.
Clean up smatch warning:
drivers/phy/ti/phy-j721e-wiz.c:1216 wiz_probe() warn: missing error code 'ret'
--- drivers/phy/ti/phy-j721e-wiz.c | 1 + 1 file changed, 1 insertion(+)
drivers/phy/ti/phy-j721e-wiz.c +1 -0
@@ -894,6 +894,7 @@ static int wiz_probe(struct platform_devif (wiz->typec_dir_delay <WIZ_TYPEC_DIR_DEBOUNCE_MIN || wiz->typec_dir_delay >WIZ_TYPEC_DIR_DEBOUNCE_MAX ) { + ret = -EINVAL ;dev_err (dev,"Invalid typec-dir-debounce property\n" ); goto err_addr_to_resource; }
Greg Kroah-Hartman
maintainerPATCH 112/131 gpio: wcd934x: Fix shift-out-of-bounds error
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
commit dbec64b11c65d74f31427e2b9d5746fbf17bf840 upstream.
bit-mask for pins 0 to 4 is BIT(0) to BIT(4) however we ended up with BIT(n - 1) which is not right, and this was caught by below usban check
UBSAN: shift-out-of-bounds in drivers/gpio/gpio-wcd934x.c:34:14
--- drivers/gpio/gpio-wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-wcd934x.c +1 -1
@@ -7,7 +7,7 @@#include <linux/slab.h> #include <linux/of_device.h> -#define WCD_PIN_MASK (p) BIT(p - 1) +#define WCD_PIN_MASK (p) BIT(p)#define WCD_REG_DIR_CTL_OFFSET 0x42#define WCD_REG_VAL_CTL_OFFSET 0x43#define WCD934X_NPINS 5
Greg Kroah-Hartman
maintainerPATCH 113/131 perf: Fix data race between pin_count increment/decrement
In reply to Greg Kroah-HartmanFrom: Marco Elver <[email protected]>
commit 6c605f8371159432ec61cbb1488dcf7ad24ad19a upstream.
KCSAN reports a data race between increment and decrement of pin_count:
write to 0xffff888237c2d4e0 of 4 bytes by task 15740 on cpu 1:
find_get_context kernel/events/core.c:4617
__do_sys_perf_event_open kernel/events/core.c:12097 [inline]
__se_sys_perf_event_open kernel/events/core.c:11933
...
read to 0xffff888237c2d4e0 of 4 bytes by task 15743 on cpu 0:
perf_unpin_context kernel/events/core.c:1525 [inline]
__do_sys_perf_event_open kernel/events/core.c:12328 [inline]
__se_sys_perf_event_open kernel/events/core.c:11933
...
Because neither read-modify-write here is atomic, this can lead to one of the operations being lost, resulting in an inconsistent pin_count. Fix it by adding the missing locking in the CPU-event case.
--- kernel/events/core.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/events/core.c +2 -0
@@ -4547,7 +4547,9 @@ find_get_context(struct pmu *pmu, struct cpuctx =per_cpu_ptr (pmu->pmu_cpu_context, cpu); ctx = &cpuctx->ctx;get_ctx (ctx); +raw_spin_lock_irqsave (&ctx->lock, flags); ++ctx->pin_count; +raw_spin_unlock_irqrestore (&ctx->lock, flags);return ctx; }
Greg Kroah-Hartman
maintainerPATCH 114/131 sched/fair: Keep load_avg and load_sum synced
In reply to Greg Kroah-HartmanFrom: Vincent Guittot <[email protected]>
commit 7c7ad626d9a0ff0a36c1e2a3cfbbc6a13828d5eb upstream.
when removing a cfs_rq from the list we only check _sum value so we must ensure that _avg and _sum stay synced so load_sum can't be null whereas load_avg is not after propagating load in the cgroup hierarchy.
Use load_avg to compute load_sum similarly to what is done for util_sum and runnable_sum.
--- kernel/sched/fair.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
kernel/sched/fair.c +5 -6
@@ -3501,10 +3501,9 @@ update_tg_cfs_runnable(struct cfs_rq *cfstatic inline void update_tg_cfs_load (struct cfs_rq *cfs_rq,struct sched_entity *se,struct cfs_rq *gcfs_rq) { -long delta_avg, running_sum, runnable_sum = gcfs_rq->prop_runnable_sum; +long delta, running_sum, runnable_sum = gcfs_rq->prop_runnable_sum;unsigned long load_avg;u64 load_sum =0 ; -s64 delta_sum;u32 divider;if (!runnable_sum)
@@ -3551,13 +3550,13 @@ update_tg_cfs_load(struct cfs_rq *cfs_rq load_sum = (s64 )se_weight (se) * runnable_sum; load_avg =div_s64 (load_sum, divider); - delta_sum = load_sum - (s64 )se_weight (se) * se->avg.load_sum; - delta_avg = load_avg - se->avg.load_avg; + delta = load_avg - se->avg.load_avg; se->avg.load_sum = runnable_sum; se->avg.load_avg = load_avg; -add_positive (&cfs_rq->avg.load_avg, delta_avg); -add_positive (&cfs_rq->avg.load_sum, delta_sum); + +add_positive (&cfs_rq->avg.load_avg, delta); + cfs_rq->avg.load_sum = cfs_rq->avg.load_avg * divider; }static inline void add_tg_cfs_propagate (struct cfs_rq *cfs_rq,long runnable_sum)
Greg Kroah-Hartman
maintainerPATCH 115/131 sched/fair: Make sure to update tg contrib for blocked load
In reply to Greg Kroah-HartmanFrom: Vincent Guittot <[email protected]>
commit 02da26ad5ed6ea8680e5d01f20661439611ed776 upstream.
During the update of fair blocked load (__update_blocked_fair()), we update the contribution of the cfs in tg->load_avg if cfs_rq's pelt has decayed. Nevertheless, the pelt values of a cfs_rq could have been recently updated while propagating the change of a child. In this case, cfs_rq's pelt will not decayed because it has already been updated and we don't update tg->load_avg.
__update_blocked_fair
...
for_each_leaf_cfs_rq_safe: child cfs_rq
update cfs_rq_load_avg() for child cfs_rq
...
update_load_avg(cfs_rq_of(se), se, 0)
...
update cfs_rq_load_avg() for parent cfs_rq
-propagation of child's load makes parent cfs_rq->load_sum
becoming null
-UPDATE_TG is not set so it doesn't update parent
cfs_rq->tg_load_avg_contrib ..
for_each_leaf_cfs_rq_safe: parent cfs_rq
update cfs_rq_load_avg() for parent cfs_rq
- nothing to do because parent cfs_rq has already been updated recently so cfs_rq->tg_load_avg_contrib is not updated
...
parent cfs_rq is decayed
list_del_leaf_cfs_rq parent cfs_rq
- but it still contibutes to tg->load_avg
we must set UPDATE_TG flags when propagting pending load to the parent
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -7960,7 +7960,7 @@ static bool __update_blocked_fair(struct/* Propagate pending load changes to the parent, if any: */ se = cfs_rq->tg->se[cpu];if (se && !skip_blocked_update (se)) -update_load_avg (cfs_rq_of (se), se,0 ); +update_load_avg (cfs_rq_of (se), se,UPDATE_TG );/* * There can be a lot of idle CPU cgroups. Don't let fully
Greg Kroah-Hartman
maintainerPATCH 116/131 sched/fair: Fix util_est UTIL_AVG_UNCHANGED handling
In reply to Greg Kroah-HartmanFrom: Dietmar Eggemann <[email protected]>
commit 68d7a190682aa4eb02db477328088ebad15acc83 upstream.
The util_est internal UTIL_AVG_UNCHANGED flag which is used to prevent unnecessary util_est updates uses the LSB of util_est.enqueued. It is exposed via _task_util_est() (and task_util_est()).
Commit 92a801e5d5b7 ("sched/fair: Mask UTIL_AVG_UNCHANGED usages") mentions that the LSB is lost for util_est resolution but find_energy_efficient_cpu() checks if task_util_est() returns 0 to return prev_cpu early.
_task_util_est() returns the max value of util_est.ewma and util_est.enqueued or'ed w/ UTIL_AVG_UNCHANGED.
So task_util_est() returning the max of task_util() and _task_util_est() will never return 0 under the default SCHED_FEAT(UTIL_EST, true).
To fix this use the MSB of util_est.enqueued instead and keep the flag util_est internal, i.e. don't export it via _task_util_est().
The maximal possible util_avg value for a task is 1024 so the MSB of 'unsigned int util_est.enqueued' isn't used to store a util value.
As a caveat the code behind the util_est_se trace point has to filter UTIL_AVG_UNCHANGED to see the real util_est.enqueued value which should be easy to do.
This also fixes an issue report by Xuewen Yan that util_est_update() only used UTIL_AVG_UNCHANGED for the subtrahend of the equation:
last_enqueued_diff = ue.enqueued - (task_util() | UTIL_AVG_UNCHANGED)
--- include/linux/sched.h | 8 ++++++++ kernel/sched/debug.c | 3 ++- kernel/sched/fair.c | 5 +++-- kernel/sched/pelt.h | 11 +---------- 4 files changed, 14 insertions(+), 13 deletions(-)
include/linux/sched.h +8 -0
@@ -348,11 +348,19 @@ struct load_weight {* Only for tasks we track a moving average of the past instantaneous * estimated utilization. This allows to absorb sporadic drops in utilization * of an otherwise almost periodic task. +* +* The UTIL_AVG_UNCHANGED flag is used to synchronize util_est with util_avg +* updates. When a task is dequeued, its util_est should not be updated if its +* util_avg has not been updated in the meantime. +* This information is mapped into the MSB bit of util_est.enqueued at dequeue +* time. Since max value of util_est.enqueued for a task is 1024 (PELT util_avg +* for a task) it is safe to use MSB. */ struct util_est {unsigned int enqueued;unsigned int ewma;#define UTIL_EST_WEIGHT_SHIFT 2 +#define UTIL_AVG_UNCHANGED 0x80000000 } __attribute__((__aligned__ (sizeof (u64))));/*
kernel/sched/debug.c +2 -1
@@ -888,6 +888,7 @@ __initcall(init_sched_debug_procfs);#define __PS (S ,F ) SEQ_printf(m, "%-45s:%21Ld\n", S, (long long)(F))#define __P (F ) __PS(#F, F)#define P (F ) __PS(#F, p->F) +#define PM (F ,M ) __PS(#F, p->F & (M))#define __PSN (S ,F ) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", S, SPLIT_NS((long long)(F)))#define __PN (F ) __PSN(#F, F)#define PN (F ) __PSN(#F, p->F)
@@ -1014,7 +1015,7 @@ void proc_sched_show_task(struct task_stP (se.avg.util_avg);P (se.avg.last_update_time);P (se.avg.util_est.ewma); -P (se.avg.util_est.enqueued); +PM (se.avg.util_est.enqueued, ~UTIL_AVG_UNCHANGED );#endif #ifdef CONFIG_UCLAMP_TASK __PS ("uclamp.min" , p->uclamp_req[UCLAMP_MIN ].value);
kernel/sched/fair.c +3 -2
@@ -3903,7 +3903,7 @@ static inline unsigned long _task_util_e {struct util_est ue =READ_ONCE (p->se.avg.util_est); -return (max (ue.ewma, ue.enqueued) |UTIL_AVG_UNCHANGED ); +return max (ue.ewma, (ue.enqueued & ~UTIL_AVG_UNCHANGED )); }static inline unsigned long task_util_est (struct task_struct *p)
@@ -4003,7 +4003,7 @@ static inline void util_est_update(struc* Reset EWMA on utilization increases, the moving average is used only * to smooth utilization decreases. */ - ue.enqueued = (task_util (p) |UTIL_AVG_UNCHANGED ); + ue.enqueued =task_util (p);if (sched_feat (UTIL_EST_FASTUP )) {if (ue.ewma < ue.enqueued) { ue.ewma = ue.enqueued;
@@ -4052,6 +4052,7 @@ static inline void util_est_update(struc ue.ewma += last_ewma_diff; ue.ewma >>=UTIL_EST_WEIGHT_SHIFT ; done: + ue.enqueued |=UTIL_AVG_UNCHANGED ;WRITE_ONCE (p->se.avg.util_est, ue);trace_sched_util_est_se_tp (&p->se);
kernel/sched/pelt.h +1 -10
@@ -42,15 +42,6 @@ static inline u32 get_pelt_divider(strucreturn LOAD_AVG_MAX -1024 + avg->period_contrib; } -/* -* When a task is dequeued, its estimated utilization should not be update if -* its util_avg has not been updated at least once. -* This flag is used to synchronize util_avg updates with util_est updates. -* We map this information into the LSB bit of the utilization saved at -* dequeue time (i.e. util_est.dequeued). -*/ -#define UTIL_AVG_UNCHANGED 0x1 -static inline void cfs_se_util_change (struct sched_avg *avg) {unsigned int enqueued;
@@ -58,7 +49,7 @@ static inline void cfs_se_util_change(stif (!sched_feat (UTIL_EST ))return ; -/* Avoid store if the flag has been already set */ +/* Avoid store if the flag has been already reset */ enqueued = avg->util_est.enqueued;if (!(enqueued &UTIL_AVG_UNCHANGED ))return ;
Greg Kroah-Hartman
maintainerPATCH 117/131 x86/nmi_watchdog: Fix old-style NMI watchdog regression on old Intel CPUs
In reply to Greg Kroah-HartmanFrom: CodyYao-oc <[email protected]>
commit a8383dfb2138742a1bb77b481ada047aededa2ba upstream.
The following commit:
3a4ac121c2ca ("x86/perf: Add hardware performance events support for Zhaoxin CPU.")
Got the old-style NMI watchdog logic wrong and broke it for basically every Intel CPU where it was active. Which is only truly old CPUs, so few people noticed.
On CPUs with perf events support we turn off the old-style NMI watchdog, so it was pretty pointless to add the logic for X86_VENDOR_ZHAOXIN to begin with ... :-/
Anyway, the fix is to restore the old logic and add a 'break'.
[ mingo: Wrote a new changelog. ]
--- arch/x86/kernel/cpu/perfctr-watchdog.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/perfctr-watchdog.c +2 -2
@@ -63,7 +63,7 @@ static inline unsigned int nmi_perfctr_mcase 15 :return msr -MSR_P4_BPU_PERFCTR0 ; } - fallthrough; +break ;case X86_VENDOR_ZHAOXIN :case X86_VENDOR_CENTAUR :return msr -MSR_ARCH_PERFMON_PERFCTR0 ;
@@ -96,7 +96,7 @@ static inline unsigned int nmi_evntsel_mcase 15 :return msr -MSR_P4_BSU_ESCR0 ; } - fallthrough; +break ;case X86_VENDOR_ZHAOXIN :case X86_VENDOR_CENTAUR :return msr -MSR_ARCH_PERFMON_EVENTSEL0 ;
Greg Kroah-Hartman
maintainerPATCH 118/131 KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit f31500b0d437a2464ca5972d8f5439e156b74960 upstream.
Use the __string() machinery provided by the tracing subystem to make a copy of the string literals consumed by the "nested VM-Enter failed" tracepoint. A complete copy is necessary to ensure that the tracepoint can't outlive the data/memory it consumes and deference stale memory.
Because the tracepoint itself is defined by kvm, if kvm-intel and/or kvm-amd are built as modules, the memory holding the string literals defined by the vendor modules will be freed when the module is unloaded, whereas the tracepoint and its data in the ring buffer will live until kvm is unloaded (or "indefinitely" if kvm is built-in).
This bug has existed since the tracepoint was added, but was recently exposed by a new check in tracing to detect exactly this type of bug.
fmt: '%s%s
' current_buffer: ' vmx_dirty_log_t-140127 [003] .... kvm_nested_vmenter_failed: '
WARNING: CPU: 3 PID: 140134 at kernel/trace/trace.c:3759 trace_check_vprintf+0x3be/0x3e0 CPU: 3 PID: 140134 Comm: less Not tainted 5.13.0-rc1-ce2e73ce600a-req #184 Hardware name: ASUS Q87M-E/Q87M-E, BIOS 1102 03/03/2014 RIP: 0010:trace_check_vprintf+0x3be/0x3e0 Code: <0f> 0b 44 8b 4c 24 1c e9 a9 fe ff ff c6 44 02 ff 00 49 8b 97 b0 20 RSP: 0018:ffffa895cc37bcb0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffa895cc37bd08 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 00000000ffffdfff RDI: ffff9766cfad74f8 RBP: ffffffffc0a041d4 R08: ffff9766cfad74f0 R09: ffffa895cc37bad8 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffffc0a041d4 R13: ffffffffc0f4dba8 R14: 0000000000000000 R15: ffff976409f2c000 FS: 00007f92fa200740(0000) GS:ffff9766cfac0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559bd11b0000 CR3: 000000019fbaa002 CR4: 00000000001726e0 Call Trace: trace_event_printf+0x5e/0x80 trace_raw_output_kvm_nested_vmenter_failed+0x3a/0x60 [kvm] print_trace_line+0x1dd/0x4e0 s_show+0x45/0x150 seq_read_iter+0x2d5/0x4c0 seq_read+0x106/0x150 vfs_read+0x98/0x180 ksys_read+0x5f/0xe0 do_syscall_64+0x40/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
Message-Id: <[email protected]>
--- arch/x86/kvm/trace.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kvm/trace.h +3 -3
@@ -1514,16 +1514,16 @@ TRACE_EVENT(kvm_nested_vmenter_failed,TP_ARGS (msg, err),TP_STRUCT__entry ( - __field(const char *, msg) + __string(msg, msg)__field (u32, err) ),TP_fast_assign ( - __entry->msg = msg; + __assign_str(msg, msg); __entry->err = err; ), -TP_printk ("%s%s" , __entry->msg, !__entry->err ?"" : +TP_printk ("%s%s" ,__get_str (msg), !__entry->err ?"" :__print_symbolic (__entry->err,VMX_VMENTER_INSTRUCTION_ERRORS )) );
Greg Kroah-Hartman
maintainerPATCH 119/131 IB/mlx5: Fix initializing CQ fragments buffer
In reply to Greg Kroah-HartmanFrom: Alaa Hleihel <[email protected]>
commit 2ba0aa2feebda680ecfc3c552e867cf4d1b05a3a upstream.
The function init_cq_frag_buf() can be called to initialize the current CQ fragments buffer cq->buf, or the temporary cq->resize_buf that is filled during CQ resize operation.
However, the offending commit started to use function get_cqe() for getting the CQEs, the issue with this change is that get_cqe() always returns CQEs from cq->buf, which leads us to initialize the wrong buffer, and in case of enlarging the CQ we try to access elements beyond the size of the current cq->buf and eventually hit a kernel panic.
[exception RIP: init_cq_frag_buf+103]
[ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib] [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core] [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt] [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt] [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt] [ffff9f799ddcbec8] kthread at ffffffffa66c5da1 [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd
Fix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that takes the correct source buffer as a parameter.
--- drivers/infiniband/hw/mlx5/cq.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/infiniband/hw/mlx5/cq.c +4 -5
@@ -838,15 +838,14 @@ static void destroy_cq_user(struct mlx5_ib_umem_release (cq->buf.umem); } -static void init_cq_frag_buf (struct mlx5_ib_cq *cq, -struct mlx5_ib_cq_buf *buf) +static void init_cq_frag_buf (struct mlx5_ib_cq_buf *buf) {int i;void *cqe;struct mlx5_cqe64 *cqe64;for (i =0 ; i < buf->nent; i++) { - cqe =get_cqe (cq, i); + cqe =mlx5_frag_buf_get_wqe (&buf->fbc, i); cqe64 = buf->cqe_size ==64 ? cqe : cqe +64 ; cqe64->op_own =MLX5_CQE_INVALID <<4 ; }
@@ -872,7 +871,7 @@ static int create_cq_kernel(struct mlx5_if (err) goto err_db; -init_cq_frag_buf (cq, &cq->buf); +init_cq_frag_buf (&cq->buf); *inlen =MLX5_ST_SZ_BYTES (create_cq_in) + MLX5_FLD_SZ_BYTES(create_cq_in, pas[0]) *
@@ -1177,7 +1176,7 @@ static int resize_kernel(struct mlx5_ib_if (err) goto ex; -init_cq_frag_buf (cq, cq->resize_buf); +init_cq_frag_buf (cq->resize_buf);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 120/131 NFS: Fix a potential NULL dereference in nfs_get_client()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 09226e8303beeec10f2ff844d2e46d1371dc58e0 ]
None of the callers are expecting NULL returns from nfs_get_client() so this code will lead to an Oops. It's better to return an error pointer. I expect that this is dead code so hopefully no one is affected.
--- fs/nfs/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/client.c +1 -1
@@ -406,7 +406,7 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init)if (cl_init->hostname ==NULL ) {WARN_ON (1 ); -return NULL ; +return ERR_PTR (-EINVAL ); }/* see if the client already exists */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 121/131 NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit dfe1fe75e00e4c724ede7b9e593f6f680e446c5f ]
If the inode is being evicted, but has to return a delegation first, then it can cause a deadlock in the corner case where the server reboots before the delegreturn completes, but while the call to iget5_locked() in nfs4_opendata_get_inode() is waiting for the inode free to complete. Since the open call still holds a session slot, the reboot recovery cannot proceed.
In order to break the logjam, we can turn the delegation return into a privileged operation for the case where we're evicting the inode. We know that in that case, there can be no other state recovery operation that conflicts.
--- fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4proc.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-)
fs/nfs/nfs4_fs.h +1 -0
@@ -205,6 +205,7 @@ struct nfs4_exception {struct inode *inode;nfs4_stateid *stateid;long timeout; + unsigned char task_is_privileged : 1; unsigned char delay : 1, recovering : 1, retry : 1;
fs/nfs/nfs4proc.c +11 -1
@@ -592,6 +592,8 @@ int nfs4_handle_exception(struct nfs_server *server, int errorcode, struct nfs4_ goto out_retry; }if (exception->recovering) { +if (exception->task_is_privileged) +return -EDEADLOCK ; ret =nfs4_wait_clnt_recover (clp);if (test_bit (NFS_MIG_FAILED , &server->mig_status))return -EIO ;
@@ -617,6 +619,8 @@ nfs4_async_handle_exception(struct rpc_task *task, struct nfs_server *server, goto out_retry; }if (exception->recovering) { +if (exception->task_is_privileged) +return -EDEADLOCK ;rpc_sleep_on (&clp->cl_rpcwaitq, task,NULL );if (test_bit (NFS4CLNT_MANAGER_RUNNING , &clp->cl_state) ==0 )rpc_wake_up_queued_task (&clp->cl_rpcwaitq, task);
@@ -6383,6 +6387,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)struct nfs4_exception exception = { .inode = data->inode, .stateid = &data->stateid, + .task_is_privileged = data->args.seq_args.sa_privileged, };if (!nfs4_sequence_done (task, &data->res.seq_res))
@@ -6506,7 +6511,6 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, data =kzalloc (sizeof (*data),GFP_NOFS );if (data ==NULL )return -ENOMEM ; -nfs4_init_sequence (&data->args.seq_args, &data->res.seq_res,1 ,0 ); nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_CLEANUP,
@@ -6537,6 +6541,12 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, } } +if (!data->inode) +nfs4_init_sequence (&data->args.seq_args, &data->res.seq_res,1 , +1 ); +else +nfs4_init_sequence (&data->args.seq_args, &data->res.seq_res,1 , +0 ); task_setup_data.callback_data = data; msg.rpc_argp = &data->args; msg.rpc_resp = &data->res;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 122/131 perf session: Correct buffer copying when peeking events
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit 197eecb6ecae0b04bd694432f640ff75597fed9c ]
When peeking an event, it has a short path and a long path. The short path uses the session pointer "one_mmap_addr" to directly fetch the event; and the long path needs to read out the event header and the following event data from file and fill into the buffer pointer passed through the argument "buf".
The issue is in the long path that it copies the event header and event data into the same destination address which pointer "buf", this means the event header is overwritten. We are just lucky to run into the short path in most cases, so we don't hit the issue in the long path.
This patch adds the offset "hdr_sz" to the pointer "buf" when copying the event data, so that it can reserve the event header which can be used properly by its caller.
--- tools/perf/util/session.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/session.c +1 -0
@@ -1699,6 +1699,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,if (event->header.size < hdr_sz || event->header.size > buf_sz)return -1 ; + buf += hdr_sz; rest = event->header.size - hdr_sz;if (readn (fd, buf, rest) != (ssize_t )rest)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 123/131 kvm: fix previous commit for 32-bit builds
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 4422829e8053068e0225e4d0ef42dc41ea7c9ef5 upstream.
array_index_nospec does not work for uint64_t on 32-bit builds. However, the size of a memory slot must be less than 20 bits wide on those system, since the memory slot must fit in the user address space. So just store it in an unsigned long.
--- include/linux/kvm_host.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/kvm_host.h +2 -2
@@ -1110,8 +1110,8 @@ __gfn_to_hva_memslot(struct kvm_memory_s* table walks, do not let the processor speculate loads outside * the guest's registered memslots. */ -unsigned long offset =array_index_nospec (gfn - slot->base_gfn, - slot->npages); +unsigned long offset = gfn - slot->base_gfn; + offset =array_index_nospec (offset, slot->npages);return slot->userspace_addr + offset *PAGE_SIZE ; }
Greg Kroah-Hartman
maintainerPATCH 124/131 NFS: Fix use-after-free in nfs4_init_client()
In reply to Greg Kroah-HartmanFrom: Anna Schumaker <[email protected]>
commit 476bdb04c501fc64bf3b8464ffddefc8dbe01577 upstream.
KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
--- fs/nfs/nfs4client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4client.c +1 -1
@@ -435,8 +435,8 @@ struct nfs_client *nfs4_init_client(stru*/ nfs_mark_client_ready (clp, -EPERM ); } -nfs_put_client (clp);clear_bit (NFS_CS_TSM_POSSIBLE , &clp->cl_flags); +nfs_put_client (clp);return old; error:
Greg Kroah-Hartman
maintainerPATCH 125/131 NFSv4: Fix second deadlock in nfs4_evict_inode()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit c3aba897c6e67fa464ec02b1f17911577d619713 upstream.
If the inode is being evicted but has to return a layout first, then that too can cause a deadlock in the corner case where the server reboots.
--- fs/nfs/nfs4proc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/nfs/nfs4proc.c +7 -2
@@ -9629,15 +9629,20 @@ int nfs4_proc_layoutreturn(struct nfs4_l &task_setup_data.rpc_client, &msg);dprintk ("--> %s\n" , __func__); + lrp->inode =nfs_igrab_and_active (lrp->args.inode);if (!sync) { - lrp->inode =nfs_igrab_and_active (lrp->args.inode);if (!lrp->inode) {nfs4_layoutreturn_release (lrp);return -EAGAIN ; } task_setup_data.flags |=RPC_TASK_ASYNC ; } -nfs4_init_sequence (&lrp->args.seq_args, &lrp->res.seq_res,1 ,0 ); +if (!lrp->inode) +nfs4_init_sequence (&lrp->args.seq_args, &lrp->res.seq_res,1 , +1 ); +else +nfs4_init_sequence (&lrp->args.seq_args, &lrp->res.seq_res,1 , +0 ); task =rpc_run_task (&task_setup_data);if (IS_ERR (task))return PTR_ERR (task);
Greg Kroah-Hartman
maintainerPATCH 126/131 NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
In reply to Greg Kroah-HartmanFrom: Dai Ngo <[email protected]>
commit f8849e206ef52b584cd9227255f4724f0cc900bb upstream.
Currently if __nfs4_proc_set_acl fails with NFS4ERR_BADOWNER it re-enables the idmapper by clearing NFS_CAP_UIDGID_NOMAP before retrying again. The NFS_CAP_UIDGID_NOMAP remains cleared even if the retry fails. This causes problem for subsequent setattr requests for v4 server that does not have idmapping configured.
This patch modifies nfs4_proc_set_acl to detect NFS4ERR_BADOWNER and NFS4ERR_BADNAME and skips the retry, since the kernel isn't involved in encoding the ACEs, and return -EINVAL.
Steps to reproduce the problem:
# mount -o vers=4.1,sec=sys server:/export/test /tmp/mnt # touch /tmp/mnt/file1 # chown 99 /tmp/mnt/file1 # nfs4_setfacl -a A::[email protected]:wrtncy /tmp/mnt/file1 Failed setxattr operation: Invalid argument # chown 99 /tmp/mnt/file1 chown: changing ownership of ‘/tmp/mnt/file1’: Invalid argument # umount /tmp/mnt # mount -o vers=4.1,sec=sys server:/export/test /tmp/mnt # chown 99 /tmp/mnt/file1 #
v2: detect NFS4ERR_BADOWNER and NFS4ERR_BADNAME and skip retry
in nfs4_proc_set_acl.
--- fs/nfs/nfs4proc.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/nfs/nfs4proc.c +8 -0
@@ -5946,6 +5946,14 @@ static int nfs4_proc_set_acl(struct inoddo { err =__nfs4_proc_set_acl (inode, buf, buflen);trace_nfs4_set_acl (inode, err); +if (err == -NFS4ERR_BADOWNER || err == -NFS4ERR_BADNAME ) { +/* +* no need to retry since the kernel +* isn't involved in encoding the ACEs. +*/ + err = -EINVAL ; +break ; + } err =nfs4_handle_exception (NFS_SERVER (inode), err, &exception); }while (exception.retry);
Greg Kroah-Hartman
maintainerPATCH 127/131 scsi: core: Fix error handling of scsi_host_alloc()
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 66a834d092930cf41d809c0e989b13cd6f9ca006 upstream.
After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name().
Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well.
--- drivers/scsi/hosts.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
drivers/scsi/hosts.c +13 -10
@@ -392,8 +392,10 @@ struct Scsi_Host *scsi_host_alloc(structmutex_init (&shost->scan_mutex); index =ida_simple_get (&host_index_ida,0 ,0 ,GFP_KERNEL ); -if (index <0 ) - goto fail_kfree; +if (index <0 ) { +kfree (shost); +return NULL ; + } shost->host_no = index; shost->dma_channel =0xff ;
@@ -486,7 +488,7 @@ struct Scsi_Host *scsi_host_alloc(structshost_printk (KERN_WARNING , shost,"error handler thread failed to spawn, error = %ld\n" ,PTR_ERR (shost->ehandler)); - goto fail_index_remove; + goto fail; } shost->tmf_work_q = alloc_workqueue("scsi_tmf_%d",
@@ -495,17 +497,18 @@ struct Scsi_Host *scsi_host_alloc(structif (!shost->tmf_work_q) {shost_printk (KERN_WARNING , shost,"failed to create tmf workq\n" ); - goto fail_kthread; + goto fail; }scsi_proc_hostdir_add (shost->hostt);return shost; + fail: +/* +* Host state is still SHOST_CREATED and that is enough to release +* ->shost_gendev. scsi_host_dev_release() will free +* dev_name(&shost->shost_dev). +*/ +put_device (&shost->shost_gendev); - fail_kthread: -kthread_stop (shost->ehandler); - fail_index_remove: -ida_simple_remove (&host_index_ida, shost->host_no); - fail_kfree: -kfree (shost);return NULL ; }EXPORT_SYMBOL (scsi_host_alloc);
Greg Kroah-Hartman
maintainerPATCH 128/131 scsi: core: Fix failure handling of scsi_add_host_with_dma()
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 3719f4ff047e20062b8314c23ec3cab84d74c908 upstream.
When scsi_add_host_with_dma() returns failure, the caller will call scsi_host_put(shost) to release everything allocated for this host instance. Consequently we can't also free allocated stuff in scsi_add_host_with_dma(), otherwise we will end up with a double free.
Strictly speaking, host resource allocations should have been done in scsi_host_alloc(). However, the allocations may need information which is not yet provided by the driver when that function is called. So leave the allocations where they are but rely on host device's release handler to free resources.
--- drivers/scsi/hosts.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/scsi/hosts.c +6 -8
@@ -278,23 +278,22 @@ int scsi_add_host_with_dma(struct Scsi_Hif (!shost->work_q) { error = -EINVAL ; - goto out_free_shost_data; + goto out_del_dev; } } error =scsi_sysfs_add_host (shost);if (error) - goto out_destroy_host; + goto out_del_dev;scsi_proc_host_add (shost);scsi_autopm_put_host (shost);return error; - out_destroy_host: -if (shost->work_q) -destroy_workqueue (shost->work_q); - out_free_shost_data: -kfree (shost->shost_data); +/* +* Any host allocation in this function will be freed in +* scsi_host_dev_release(). +*/ out_del_dev:device_del (&shost->shost_dev); out_del_gendev:
@@ -304,7 +303,6 @@ int scsi_add_host_with_dma(struct Scsi_Hpm_runtime_disable (&shost->shost_gendev);pm_runtime_set_suspended (&shost->shost_gendev);pm_runtime_put_noidle (&shost->shost_gendev); -scsi_mq_destroy_tags (shost); fail:return error; }
Greg Kroah-Hartman
maintainerPATCH 129/131 scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 11714026c02d613c30a149c3f4c4a15047744529 upstream.
scsi_host_dev_release() only frees dev_name when host state is SHOST_CREATED. After host state has changed to SHOST_RUNNING, scsi_host_dev_release() no longer cleans up.
Fix this by doing a put_device(&shost->shost_dev) in the failure path when host state is SHOST_RUNNING. Move get_device(&shost->shost_gendev) before device_add(&shost->shost_dev) so that scsi_host_cls_release() can do a put on this reference.
--- drivers/scsi/hosts.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/scsi/hosts.c +6 -2
@@ -254,12 +254,11 @@ int scsi_add_host_with_dma(struct Scsi_Hdevice_enable_async_suspend (&shost->shost_dev); +get_device (&shost->shost_gendev); error =device_add (&shost->shost_dev);if (error) goto out_del_gendev; -get_device (&shost->shost_gendev); -if (shost->transportt->host_size) { shost->shost_data =kzalloc (shost->transportt->host_size,GFP_KERNEL );
@@ -297,6 +296,11 @@ int scsi_add_host_with_dma(struct Scsi_H out_del_dev:device_del (&shost->shost_dev); out_del_gendev: +/* +* Host state is SHOST_RUNNING so we have to explicitly release +* ->shost_dev. +*/ +put_device (&shost->shost_dev);device_del (&shost->shost_gendev); out_disable_runtime_pm:device_disable_async_suspend (&shost->shost_gendev);
Greg Kroah-Hartman
maintainerPATCH 130/131 scsi: core: Only put parent device if host state differs from SHOST_CREATED
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 1e0d4e6225996f05271de1ebcb1a7c9381af0b27 upstream.
get_device(shost->shost_gendev.parent) is called after host state has switched to SHOST_RUNNING. scsi_host_dev_release() shouldn't release the parent device if host state is still SHOST_CREATED.
--- drivers/scsi/hosts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/hosts.c +1 -1
@@ -347,7 +347,7 @@ static void scsi_host_dev_release(structida_simple_remove (&host_index_ida, shost->host_no); -if (parent) +if (shost->shost_state !=SHOST_CREATED )put_device (parent);kfree (shost); }
Greg Kroah-Hartman
maintainerPATCH 131/131 tracing: Correct the length check which causes memory corruption
In reply to Greg Kroah-HartmanFrom: Liangyan <[email protected]>
commit 3e08a9f9760f4a70d633c328a76408e62d6f80a3 upstream.
We've suffered from severe kernel crashes due to memory corruption on our production environment, like,
Call Trace: [1640542.554277] general protection fault: 0000 [#1] SMP PTI [1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G [1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190 [1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286 [1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX: 0000000006e931bf [1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI: ffff9a45ff004300 [1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09: 0000000000000000 [1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff9a20608d [1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15: 696c662f65636976 [1640542.563128] FS: 00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000) knlGS:0000000000000000 [1640542.563937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4: 00000000003606e0 [1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1640542.566742] Call Trace: [1640542.567009] anon_vma_clone+0x5d/0x170 [1640542.567417] __split_vma+0x91/0x1a0 [1640542.567777] do_munmap+0x2c6/0x320 [1640542.568128] vm_munmap+0x54/0x70 [1640542.569990] __x64_sys_munmap+0x22/0x30 [1640542.572005] do_syscall_64+0x5b/0x1b0 [1640542.573724] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [1640542.575642] RIP: 0033:0x7f45d6e61e27
James Wang has reproduced it stably on the latest 4.19 LTS. After some debugging, we finally proved that it's due to ftrace buffer out-of-bound access using a debug tool as follows:
[ 86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000 [ 86.780806] no_context+0xdf/0x3c0 [ 86.784327] __do_page_fault+0x252/0x470 [ 86.788367] do_page_fault+0x32/0x140 [ 86.792145] page_fault+0x1e/0x30 [ 86.795576] strncpy_from_unsafe+0x66/0xb0 [ 86.799789] fetch_memory_string+0x25/0x40 [ 86.804002] fetch_deref_string+0x51/0x60 [ 86.808134] kprobe_trace_func+0x32d/0x3a0 [ 86.812347] kprobe_dispatcher+0x45/0x50 [ 86.816385] kprobe_ftrace_handler+0x90/0xf0 [ 86.820779] ftrace_ops_assist_func+0xa1/0x140 [ 86.825340] 0xffffffffc00750bf [ 86.828603] do_sys_open+0x5/0x1f0 [ 86.832124] do_syscall_64+0x5b/0x1b0 [ 86.835900] entry_SYSCALL_64_after_hwframe+0x44/0xa9
commit b220c049d519 ("tracing: Check length before giving out the filter buffer") adds length check to protect trace data overflow introduced in 0fc1b09ff1ff, seems that this fix can't prevent overflow entirely, the length check should also take the sizeof entry->array[0] into account, since this array[0] is filled the length of trace data and occupy addtional space and risk overflow.
--- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace.c +1 -1
@@ -2734,7 +2734,7 @@ trace_event_buffer_lock_reserve(struct t (entry = this_cpu_read(trace_buffered_event))) {/* Try to use the per cpu buffer first */ val =this_cpu_inc_return (trace_buffered_event_cnt); -if ((len < (PAGE_SIZE -sizeof (*entry))) && val ==1 ) { +if ((len < (PAGE_SIZE -sizeof (*entry) -sizeof (entry->array[0 ]))) && val ==1 ) {trace_event_setup (entry, type, flags, pc); entry->array[0 ] = len;return entry;
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Jun 2021 10:26:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.44-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
The following kernel crash reported on stable rc 5.10 arm64 db845c board. I have not bisected this problem yet.
But there is a crash like this reported and discussed on a mailing thread.
https://lore.kernel.org/linux-usb/[email protected]/
Crash log on dragonboard 845c:
[ 0.000000] Linux version 5.10.44-rc1 (tuxmake@7e2c3dff6c75) (aarch64-linux-gnu-gcc (Debian 9.3.0-22) 9.3.0, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP PREEMPT Mon Jun 14 11:22:34 UTC 2021 [ 0.000000] Machine model: Thundercomm Dragonboard 845c <> [ 5.095538] dwc3-qcom a6f8800.usb: failed to get usb-ddr path: -517 [ 5.113805] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000002 [ 5.122686] Mem abort info: [ 5.125531] ESR = 0x96000004 [ 5.128635] EC = 0x25: DABT (current EL), IL = 32 bits [ 5.134005] SET = 0, FnV = 0 [ 5.137106] EA = 0, S1PTW = 0 [ 5.140297] Data abort info: [ 5.143212] ISV = 0, ISS = 0x00000004 [ 5.147092] CM = 0, WnR = 0 [ 5.150103] [0000000000000002] user address but active_mm is swapper [ 5.156530] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 5.162151] Modules linked in: [ 5.165254] CPU: 7 PID: 251 Comm: kworker/7:3 Not tainted 5.10.44-rc1 #1 [ 5.172011] Hardware name: Thundercomm Dragonboard 845c (DT) [ 5.175959] ufshcd-qcom 1d84000.ufshc: ufshcd_print_pwr_info:[RX, TX]: gear=[3, 3], lane[2, 2], pwr[FAST MODE, FAST MODE], rate = 2 [ 5.177738] Workqueue: events deferred_probe_work_func [ 5.190098] ufshcd-qcom 1d84000.ufshc: ufshcd_find_max_sup_active_icc_level: Regulator capability was not set, actvIccLevel=0 [ 5.194832] pstate: 60c00005 (nZCv daif +PAN +UAO -TCO BTYPE=--) [ 5.194843] pc : inode_permission+0x2c/0x178 [ 5.194851] lr : lookup_one_len_common+0xac/0x100 [ 5.207380] scsi 1:0:0:49488: Well-known LUN SKhynix
H28S7Q302BMR A001 PQ: 0 ANSI: 6
ref:
https://lkft.validation.linaro.org/scheduler/job/2896831#L2835
metadata:
git branch: linux-5.10.y
git repo: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
git commit: 406cd5feace812b3715b6fc8114472b6e3bd6d1f
git describe: v5.10.43-132-g406cd5feace8
make_kernelversion: 5.10.44-rc1
kernel-config: https://builds.tuxbuild.com/1twAFGbHcDipBArvNuGfeOtyY9H/config
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Jun 2021 10:26:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.44-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
5.10.44-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Quoted 1 line · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release.
Hmm..I build my kernel with BTF for bpftrace and this gives me:
...
CC init/version.o AR init/built-in.a LD vmlinux.o MODPOST vmlinux.symvers MODINFO modules.builtin.modinfo GEN modules.builtin LD .tmp_vmlinux.btf BTF .btf.vmlinux.bin.o LD .tmp_vmlinux.kallsyms1 KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux BTFIDS vmlinux
FAILED unresolved symbol migrate_enable
thanks to:
Quoted 2 lines
Jiri Olsa <[email protected]>
bpf: Add deny list of btf ids check for tracing programs
When I revert this it builds fine, just like before. Maybe a missing requirement or followup fix? I didn't find anything with a quick search. Using gcc-11, if it matters.
-h
Greg Kroah-Hartman
maintainerQuoted 24 lines · Holger Hoffstätte
Quoted 1 line · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release.
Hmm..I build my kernel with BTF for bpftrace and this gives me:
...
CC init/version.o AR init/built-in.a LD vmlinux.o MODPOST vmlinux.symvers MODINFO modules.builtin.modinfo GEN modules.builtin LD .tmp_vmlinux.btf BTF .btf.vmlinux.bin.o LD .tmp_vmlinux.kallsyms1 KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux BTFIDS vmlinuxFAILED unresolved symbol
migrate_enable
Quoted 8 lines
thanks to:
Quoted 2 lines
Jiri Olsa <[email protected]>
bpf: Add deny list of btf ids check for tracing programsWhen I revert this it builds fine, just like before. Maybe a missing requirement or followup fix? I didn't find anything with a quick search. Using gcc-11, if it matters.
Looks like we need the change that exported this function, let me see if it's worth to add that, or to revert this one...
thanks,
greg k-h
Greg Kroah-Hartman
maintainerQuoted 30 lines · Greg Kroah-Hartman
Quoted 29 lines · Holger Hoffstätte
Quoted 1 line · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release.
Hmm..I build my kernel with BTF for bpftrace and this gives me:
...
CC init/version.o AR init/built-in.a LD vmlinux.o MODPOST vmlinux.symvers MODINFO modules.builtin.modinfo GEN modules.builtin LD .tmp_vmlinux.btf BTF .btf.vmlinux.bin.o LD .tmp_vmlinux.kallsyms1 KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux BTFIDS vmlinuxFAILED unresolved symbol
migrate_enablethanks to:
Quoted 2 lines
Jiri Olsa <[email protected]>
bpf: Add deny list of btf ids check for tracing programs
Quoted 6 lines
Quoted 3 lines
When I revert this it builds fine, just like before. Maybe a missing requirement or followup fix? I didn't find anything with a quick search. Using gcc-11, if it matters.
Looks like we need the change that exported this function, let me see if it's worth to add that, or to revert this one...
No, that's a mess, and the "bug" this commit was trying to fix, isn't there for 5.10 as migrate_enable is not a function in 5.10. So I'll go drop this patch and push out a -rc2 in a few minutes.
thanks for testing and letting me know.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Jun 2021 10:26:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.44-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
12 builds: 12 pass, 0 fail
28 boots: 28 pass, 0 fail
70 tests: 70 pass, 0 failLinux version: 5.10.44-rc1-g406cd5feace8
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Jun 2021 10:26:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.44-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit kernels:
Signature · 1 line
Florian
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 5.10.44 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.44 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Jun 2021 10:26:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.44-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Tested on arm64 and x86 for 5.10.44-rc1,
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.44-rc1
Commit: f48dbcaf0c6d8dc08e80ba109a1010953b5b9717
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8906
passed: 8906
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8906
passed: 8906
failed: 0
timeout: 0
--------------------------------------------------------------------