4.19.199-rc1 review
Greg Kroah-Hartman
maintainercover 4.19.199-rc1 review
This is the start of the stable review cycle for the 4.19.199 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 28 Jul 2021 15:38:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.199-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.199-rc1
Mathias Nyman <[email protected]>
xhci: add xhci_get_virt_ep() helper
Christophe JAILLET <[email protected]>
spi: spi-fsl-dspi: Fix a resource leak in an error handling path
Evan Quan <[email protected]>
PCI: Mark AMD Navi14 GPU ATS as broken
David Sterba <[email protected]>
btrfs: compression: don't try to compress if we don't have enough pages
Stephan Gerhold <[email protected]>
iio: accel: bma180: Fix BMA25x bandwidth register values
Linus Walleij <[email protected]>
iio: accel: bma180: Use explicit member assignment
Doug Berger <[email protected]>
net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
Nicholas Piggin <[email protected]>
KVM: do not allow mapping valid but non-reference-counted pages
Paolo Bonzini <[email protected]>
KVM: do not assume PTE is writable after follow_pfn
Charles Baylis <[email protected]>
drm: Return -ENOTTY for non-drm ioctls
Greg Kroah-Hartman <[email protected]>
nds32: fix up stack guard gap
Peter Collingbourne <[email protected]>
selftest: use mmap instead of posix_memalign to allocate memory
Markus Boehme <[email protected]>
ixgbe: Fix packet corruption due to missing DMA sync
Gustavo A. R. Silva <[email protected]>
media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
Haoran Luo <[email protected]>
tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
Minas Harutyunyan <[email protected]>
usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
John Keeping <[email protected]>
USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
Ian Ray <[email protected]>
USB: serial: cp210x: fix comments for GE CS1000
Marco De Marco <[email protected]>
USB: serial: option: add support for u-blox LARA-R6 family
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
Mark Tomlinson <[email protected]>
usb: max-3421: Prevent corruption of freed memory
Julian Sikorski <[email protected]>
USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
Mathias Nyman <[email protected]>
usb: hub: Fix link power management max exit latency (MEL) calculations
Mathias Nyman <[email protected]>
usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
Nicholas Piggin <[email protected]>
KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
Mathias Nyman <[email protected]>
xhci: Fix lost USB 2 remote wake
Takashi Iwai <[email protected]>
ALSA: sb: Fix potential ABBA deadlock in CSP driver
Alexander Tsoy <[email protected]>
ALSA: usb-audio: Add registration quirk for JBL Quantum headsets
Vasily Gorbik <[email protected]>
s390/ftrace: fix ftrace_update_ftrace_func implementation
Huang Pei <[email protected]>
Revert "MIPS: add PMD table accounting into MIPS'pmd_alloc_one"
Marcelo Henrique Cerri <[email protected]>
proc: Avoid mixing integer types in mem_rw()
Maxime Ripard <[email protected]>
drm/panel: raspberrypi-touchscreen: Prevent double-free
Yajun Deng <[email protected]>
net: sched: cls_api: Fix the the wrong parameter
Xin Long <[email protected]>
sctp: update active_key for asoc when old key is being replaced
Vincent Palatin <[email protected]>
Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
Zhihao Cheng <[email protected]>
nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
Peilin Ye <[email protected]>
net/sched: act_skbmod: Skip non-Ethernet packets
Eric Dumazet <[email protected]>
net/tcp_fastopen: fix data races around tfo_active_disable_stamp
Marek Vasut <[email protected]>
spi: cadence: Correct initialisation of runtime PM again
Dmitry Bogdanov <[email protected]>
scsi: target: Fix protect handling in WRITE SAME(32)
Mike Christie <[email protected]>
scsi: iscsi: Fix iface sysfs attr detection
Nguyen Dinh Phi <[email protected]>
netrom: Decrease sock refcount when sock timers expire
Nicholas Piggin <[email protected]>
KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
Yajun Deng <[email protected]>
net: decnet: Fix sleeping inside in af_decnet
Ziyang Xuan <[email protected]>
net: fix uninit-value in caif_seqpkt_sendmsg
Tobias Klauser <[email protected]>
bpftool: Check malloc return value in mount_bpffs_for_pin
Colin Ian King <[email protected]>
s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
Colin Ian King <[email protected]>
liquidio: Fix unintentional sign extension issue on left shift of u16
Peter Hess <[email protected]>
spi: mediatek: fix fifo rx mode
Riccardo Mancini <[email protected]>
perf probe-file: Delete namelist in del_events() on the error path
Riccardo Mancini <[email protected]>
perf test bpf: Free obj_buf
Riccardo Mancini <[email protected]>
perf lzma: Close lzma stream on exit
Riccardo Mancini <[email protected]>
perf script: Fix memory 'threads' and 'cpus' leaks on exit
Riccardo Mancini <[email protected]>
perf dso: Fix memory leak in dso__new_map()
Riccardo Mancini <[email protected]>
perf test session_topology: Delete session->evlist
Riccardo Mancini <[email protected]>
perf probe: Fix dso->nsinfo refcounting
Riccardo Mancini <[email protected]>
perf map: Fix dso->nsinfo refcounting
Casey Chen <[email protected]>
nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
Nicolas Dichtel <[email protected]>
ipv6: fix 'disable_policy' for fwd packets
Jedrzej Jagielski <[email protected]>
igb: Fix position of assignment to *ring
Aleksandr Loktionov <[email protected]>
igb: Check if num of q_vectors is smaller than max before array access
Christophe JAILLET <[email protected]>
iavf: Fix an error handling path in 'iavf_probe()'
Christophe JAILLET <[email protected]>
e1000e: Fix an error handling path in 'e1000_probe()'
Christophe JAILLET <[email protected]>
fm10k: Fix an error handling path in 'fm10k_probe()'
Christophe JAILLET <[email protected]>
igb: Fix an error handling path in 'igb_probe()'
Christophe JAILLET <[email protected]>
ixgbe: Fix an error handling path in 'ixgbe_probe()'
Vinicius Costa Gomes <[email protected]>
igb: Fix use-after-free error during reset
Hangbin Liu <[email protected]>
net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
Eric Dumazet <[email protected]>
udp: annotate data races around unix_sk(sk)->gso_size
Gu Shengxian <[email protected]>
bpftool: Properly close va_list 'ap' by va_end() on error
Eric Dumazet <[email protected]>
ipv6: tcp: drop silly ICMPv6 packet too big messages
Eric Dumazet <[email protected]>
tcp: annotate data races around tp->mtu_info
Jason Ekstrand <[email protected]>
dma-buf/sync_file: Don't leak fences on merge failure
Taehee Yoo <[email protected]>
net: validate lwtstate->data before returning from skb_tunnel_info()
Alexander Ovechkin <[email protected]>
net: send SYNACK packet with accepted fwmark
Pavel Skripkin <[email protected]>
net: ti: fix UAF in tlan_remove_one
Pavel Skripkin <[email protected]>
net: qcom/emac: fix UAF in emac_remove
Pavel Skripkin <[email protected]>
net: moxa: fix UAF in moxart_mac_probe
Florian Fainelli <[email protected]>
net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
Wolfgang Bumiller <[email protected]>
net: bridge: sync fdb to new unicast-filtering ports
Vasily Averin <[email protected]>
netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
Vadim Fedorenko <[email protected]>
net: ipv6: fix return value of ip6_skb_dst_mtu
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz
Mikulas Patocka <[email protected]>
dm writecache: fix writing beyond end of underlying device when shrinking
Mikulas Patocka <[email protected]>
dm writecache: return the exact table values that were set
Nanyong Sun <[email protected]>
mm: slab: fix kmem_cache_create failed when sysfs node not destroyed
Odin Ugedal <[email protected]>
sched/fair: Fix CFS bandwidth hrtimer expiry type
Javed Hasan <[email protected]>
scsi: libfc: Fix array index out of bound exception
Yufen Yu <[email protected]>
scsi: libsas: Add LUN number check in .slave_alloc callback
Colin Ian King <[email protected]>
scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
Krzysztof Kozlowski <[email protected]>
rtc: max77686: Do not enforce (incorrect) interrupt trigger type
Matthias Maennich <[email protected]>
kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
Yang Yingliang <[email protected]>
thermal/core: Correct function name thermal_zone_device_unregister()
Mian Yousaf Kaukab <[email protected]>
arm64: dts: ls208xa: remove bus-num from dspi node
Thierry Reding <[email protected]>
soc/tegra: fuse: Fix Tegra234-only builds
Alexandre Torgue <[email protected]>
ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15
Alexandre Torgue <[email protected]>
ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings
Johan Jonker <[email protected]>
ARM: dts: rockchip: fix supply properties in io-domains nodes
Sudeep Holla <[email protected]>
arm64: dts: juno: Update SCPI nodes as per the YAML schema
Alexandre Torgue <[email protected]>
ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings
Alexandre Torgue <[email protected]>
ARM: dts: stm32: fix RCC node name on stm32f429 MCU
Alexandre Torgue <[email protected]>
ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards
Bixuan Cui <[email protected]>
rtc: mxc_v2: add missing MODULE_DEVICE_TABLE
Jonathan Neuschäfer <[email protected]>
ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
Primoz Fiser <[email protected]>
ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
Rafał Miłecki <[email protected]>
ARM: dts: Hurricane 2: Fix NAND nodes names
Rafał Miłecki <[email protected]>
ARM: dts: BCM63xx: Fix NAND nodes names
Rafał Miłecki <[email protected]>
ARM: NSP: dts: fix NAND nodes names
Rafał Miłecki <[email protected]>
ARM: Cygnus: dts: fix NAND nodes names
Rafał Miłecki <[email protected]>
ARM: brcmstb: dts: fix NAND nodes names
Philipp Zabel <[email protected]>
reset: ti-syscon: fix to_ti_syscon_reset_data macro
Elaine Zhang <[email protected]>
arm64: dts: rockchip: Fix power-controller node names for rk3328
Elaine Zhang <[email protected]>
ARM: dts: rockchip: Fix power-controller node names for rk3288
Benjamin Gaignard <[email protected]>
ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x
Ezequiel Garcia <[email protected]>
ARM: dts: rockchip: Fix the timer clocks order
Johan Jonker <[email protected]>
arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
Johan Jonker <[email protected]>
ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
Corentin Labbe <[email protected]>
ARM: dts: gemini: add device_type on pci
Corentin Labbe <[email protected]>
ARM: dts: gemini: rename mdio to the right name
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/bcm-cygnus.dtsi | 2 +- arch/arm/boot/dts/bcm-hr2.dtsi | 2 +- arch/arm/boot/dts/bcm-nsp.dtsi | 2 +- arch/arm/boot/dts/bcm63138.dtsi | 2 +- arch/arm/boot/dts/bcm7445-bcm97445svmb.dts | 4 +- arch/arm/boot/dts/bcm7445.dtsi | 2 +- arch/arm/boot/dts/bcm911360_entphn.dts | 4 +- arch/arm/boot/dts/bcm958300k.dts | 4 +- arch/arm/boot/dts/bcm958305k.dts | 4 +- arch/arm/boot/dts/bcm958522er.dts | 4 +- arch/arm/boot/dts/bcm958525er.dts | 4 +- arch/arm/boot/dts/bcm958525xmc.dts | 4 +- arch/arm/boot/dts/bcm958622hr.dts | 4 +- arch/arm/boot/dts/bcm958623hr.dts | 4 +- arch/arm/boot/dts/bcm958625hr.dts | 4 +- arch/arm/boot/dts/bcm958625k.dts | 4 +- arch/arm/boot/dts/bcm963138dvt.dts | 4 +- arch/arm/boot/dts/bcm988312hr.dts | 4 +- arch/arm/boot/dts/gemini-dlink-dns-313.dts | 2 +- arch/arm/boot/dts/gemini-nas4220b.dts | 2 +- arch/arm/boot/dts/gemini-rut1xx.dts | 2 +- arch/arm/boot/dts/gemini-wbd111.dts | 2 +- arch/arm/boot/dts/gemini-wbd222.dts | 2 +- arch/arm/boot/dts/gemini.dtsi | 1 + arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 5 +- arch/arm/boot/dts/rk3036-kylin.dts | 2 +- arch/arm/boot/dts/rk3188.dtsi | 8 +- arch/arm/boot/dts/rk322x.dtsi | 10 +- arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +- arch/arm/boot/dts/rk3288-vyasa.dts | 4 +- arch/arm/boot/dts/rk3288.dtsi | 14 +-- arch/arm/boot/dts/stm32429i-eval.dts | 8 +- arch/arm/boot/dts/stm32746g-eval.dts | 6 +- arch/arm/boot/dts/stm32f429-disco.dts | 6 +- arch/arm/boot/dts/stm32f429.dtsi | 10 +- arch/arm/boot/dts/stm32f469-disco.dts | 6 +- arch/arm/boot/dts/stm32f746.dtsi | 12 +-- arch/arm/boot/dts/stm32f769-disco.dts | 6 +- arch/arm/boot/dts/stm32h743.dtsi | 4 - arch/arm/boot/dts/stm32mp157c.dtsi | 12 +-- arch/arm/mach-imx/suspend-imx53.S | 4 +- arch/arm64/boot/dts/arm/juno-base.dtsi | 6 +- arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 1 - arch/arm64/boot/dts/rockchip/rk3328.dtsi | 6 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- arch/mips/include/asm/pgalloc.h | 10 +- arch/nds32/mm/mmap.c | 2 +- arch/powerpc/kvm/book3s_rtas.c | 25 ++++- arch/powerpc/kvm/powerpc.c | 4 +- arch/s390/include/asm/ftrace.h | 1 + arch/s390/kernel/ftrace.c | 2 + arch/s390/kernel/mcount.S | 4 +- arch/s390/net/bpf_jit_comp.c | 2 +- drivers/dma-buf/sync_file.c | 13 +-- drivers/gpu/drm/drm_ioctl.c | 3 + .../gpu/drm/panel/panel-raspberrypi-touchscreen.c | 1 - drivers/iio/accel/bma180.c | 75 ++++++++----- drivers/md/dm-writecache.c | 50 ++++++--- drivers/media/pci/ngene/ngene-core.c | 2 +- drivers/media/pci/ngene/ngene.h | 14 +-- drivers/net/dsa/mv88e6xxx/chip.c | 6 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 22 ++-- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 6 -- .../ethernet/cavium/liquidio/cn23xx_pf_device.c | 2 +- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 1 + drivers/net/ethernet/intel/i40evf/i40evf_main.c | 1 + drivers/net/ethernet/intel/igb/igb_main.c | 15 ++- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4 +- drivers/net/ethernet/moxa/moxart_ether.c | 4 +- drivers/net/ethernet/qualcomm/emac/emac.c | 3 +- drivers/net/ethernet/ti/tlan.c | 3 +- drivers/nvme/host/pci.c | 5 +- drivers/pci/quirks.c | 4 +- drivers/reset/reset-ti-syscon.c | 4 +- drivers/rtc/rtc-max77686.c | 4 +- drivers/rtc/rtc-mxc_v2.c | 1 + drivers/scsi/aic7xxx/aic7xxx_core.c | 2 +- drivers/scsi/aic94xx/aic94xx_init.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + drivers/scsi/isci/init.c | 1 + drivers/scsi/libfc/fc_rport.c | 13 ++- drivers/scsi/libsas/sas_scsi_host.c | 9 ++ drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm8001_init.c | 1 + drivers/scsi/scsi_transport_iscsi.c | 90 ++++++---------- drivers/soc/tegra/fuse/fuse-tegra30.c | 3 +- drivers/spi/spi-cadence.c | 14 ++- drivers/spi/spi-fsl-dspi.c | 4 +- drivers/spi/spi-mt65xx.c | 16 ++- drivers/target/target_core_sbc.c | 35 +++--- drivers/thermal/thermal_core.c | 2 +- drivers/usb/core/hub.c | 120 ++++++++++++++------- drivers/usb/core/quirks.c | 4 - drivers/usb/dwc2/gadget.c | 10 +- drivers/usb/host/max3421-hcd.c | 44 +++----- drivers/usb/host/xhci-hub.c | 3 +- drivers/usb/host/xhci-ring.c | 58 +++++++--- drivers/usb/host/xhci.h | 3 +- drivers/usb/renesas_usbhs/fifo.c | 7 ++ drivers/usb/serial/cp210x.c | 5 +- drivers/usb/serial/option.c | 3 + drivers/usb/storage/unusual_uas.h | 7 ++ fs/btrfs/inode.c | 2 +- fs/proc/base.c | 2 +- include/drm/drm_ioctl.h | 1 + include/net/dst_metadata.h | 4 +- include/net/ip6_route.h | 2 +- kernel/sched/fair.c | 4 +- kernel/trace/ring_buffer.c | 28 ++++- mm/slab_common.c | 18 ++-- net/bridge/br_if.c | 17 ++- net/caif/caif_socket.c | 3 +- net/decnet/af_decnet.c | 27 +++-- net/ipv4/ip_tunnel.c | 22 +++- net/ipv4/tcp_fastopen.c | 19 +++- net/ipv4/tcp_ipv4.c | 4 +- net/ipv4/tcp_output.c | 1 + net/ipv4/udp.c | 6 +- net/ipv6/ip6_output.c | 4 +- net/ipv6/tcp_ipv6.c | 22 +++- net/ipv6/udp.c | 2 +- net/ipv6/xfrm6_output.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 3 + net/netrom/nr_timer.c | 20 ++-- net/sched/act_skbmod.c | 12 ++- net/sched/cls_api.c | 2 +- net/sctp/auth.c | 2 + scripts/mkcompile_h | 14 ++- sound/isa/sb/sb16_csp.c | 4 + sound/usb/quirks.c | 3 + tools/bpf/bpftool/common.c | 5 + tools/bpf/bpftool/jit_disasm.c | 6 +- tools/perf/builtin-script.c | 7 ++ tools/perf/tests/bpf.c | 2 + tools/perf/tests/topology.c | 1 + tools/perf/util/dso.c | 4 +- tools/perf/util/lzma.c | 8 +- tools/perf/util/map.c | 2 + tools/perf/util/probe-event.c | 4 +- tools/perf/util/probe-file.c | 4 +- tools/testing/selftests/vm/userfaultfd.c | 6 +- virt/kvm/kvm_main.c | 34 +++++- 146 files changed, 796 insertions(+), 501 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/120 ARM: dts: gemini: rename mdio to the right name
From: Corentin Labbe <[email protected]>
[ Upstream commit fc5b59b945b546e27977e99a5ca6fe61179ff0d2 ]
ethernet-phy is not the right name for mdio, fix it.
--- arch/arm/boot/dts/gemini-dlink-dns-313.dts | 2 +- arch/arm/boot/dts/gemini-nas4220b.dts | 2 +- arch/arm/boot/dts/gemini-rut1xx.dts | 2 +- arch/arm/boot/dts/gemini-wbd111.dts | 2 +- arch/arm/boot/dts/gemini-wbd222.dts | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-)
arch/arm/boot/dts/gemini-dlink-dns-313.dts +1 -1
@@ -140,7 +140,7 @@ }; }; - mdio0: ethernet-phy { + mdio0: mdio { compatible = "virtual,mdio-gpio"; /* Uses MDC and MDIO */ gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */
arch/arm/boot/dts/gemini-nas4220b.dts +1 -1
@@ -62,7 +62,7 @@ }; }; - mdio0: ethernet-phy { + mdio0: mdio { compatible = "virtual,mdio-gpio"; gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
arch/arm/boot/dts/gemini-rut1xx.dts +1 -1
@@ -56,7 +56,7 @@ }; }; - mdio0: ethernet-phy { + mdio0: mdio { compatible = "virtual,mdio-gpio"; gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
arch/arm/boot/dts/gemini-wbd111.dts +1 -1
@@ -68,7 +68,7 @@ }; }; - mdio0: ethernet-phy { + mdio0: mdio { compatible = "virtual,mdio-gpio"; gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
arch/arm/boot/dts/gemini-wbd222.dts +1 -1
@@ -67,7 +67,7 @@ }; }; - mdio0: ethernet-phy { + mdio0: mdio { compatible = "virtual,mdio-gpio"; gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 2/120 ARM: dts: gemini: add device_type on pci
In reply to Greg Kroah-HartmanFrom: Corentin Labbe <[email protected]>
[ Upstream commit 483f3645b3f7acfd1c78a19d51b80c0656161974 ]
Fixes DT warning on pci node by adding the missing device_type.
--- arch/arm/boot/dts/gemini.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/gemini.dtsi +1 -0
@@ -286,6 +286,7 @@ clock-names = "PCLK", "PCICLK"; pinctrl-names = "default"; pinctrl-0 = <&pci_default_pins>; + device_type = "pci"; #address-cells = <3>; #size-cells = <2>; #interrupt-cells = <1>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 3/120 ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
In reply to Greg Kroah-HartmanFrom: Johan Jonker <[email protected]>
[ Upstream commit dfbfb86a43f9a5bbd166d88bca9e07ee4e1bff31 ]
A test with the command below aimed at powerpc generates notifications in the Rockchip ARM tree.
Fix pinctrl "sleep" nodename by renaming it to "suspend" for rk3036-kylin and rk3288
make ARCH=arm dtbs_check DT_SCHEMA_FILES=Documentation/devicetree/bindings/powerpc/sleep.yaml
--- arch/arm/boot/dts/rk3036-kylin.dts | 2 +- arch/arm/boot/dts/rk3288.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/rk3036-kylin.dts +1 -1
@@ -391,7 +391,7 @@ }; }; - sleep { + suspend { global_pwroff: global-pwroff { rockchip,pins = <2 7 RK_FUNC_1 &pcfg_pull_none>; };
arch/arm/boot/dts/rk3288.dtsi +1 -1
@@ -1541,7 +1541,7 @@ drive-strength = <12>; }; - sleep { + suspend { global_pwroff: global-pwroff { rockchip,pins = <0 0 RK_FUNC_1 &pcfg_pull_none>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 4/120 arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
In reply to Greg Kroah-HartmanFrom: Johan Jonker <[email protected]>
[ Upstream commit a7ecfad495f8af63a5cb332c91f60ab2018897f5 ]
A test with the command below aimed at powerpc generates notifications in the Rockchip arm64 tree.
Fix pinctrl "sleep" nodename by renaming it to "suspend" for rk3399.dtsi
make ARCH=arm64 dtbs_check DT_SCHEMA_FILES=Documentation/devicetree/bindings/powerpc/sleep.yaml
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +1 -1
@@ -2253,7 +2253,7 @@ }; }; - sleep { + suspend { ap_pwroff: ap-pwroff { rockchip,pins = <1 5 RK_FUNC_1 &pcfg_pull_none>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 5/120 ARM: dts: rockchip: Fix the timer clocks order
In reply to Greg Kroah-HartmanFrom: Ezequiel Garcia <[email protected]>
[ Upstream commit 7b46d674ac000b101fdad92cf16cc11d90b72f86 ]
Fixed order is the device-tree convention. The timer driver currently gets clocks by name, so no changes are needed there.
--- arch/arm/boot/dts/rk3188.dtsi | 8 ++++---- arch/arm/boot/dts/rk3288.dtsi | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/arm/boot/dts/rk3188.dtsi +4 -4
@@ -73,16 +73,16 @@ compatible = "rockchip,rk3188-timer", "rockchip,rk3288-timer"; reg = <0x2000e000 0x20>; interrupts = <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&cru SCLK_TIMER3>, <&cru PCLK_TIMER3>; - clock-names = "timer", "pclk"; + clocks = <&cru PCLK_TIMER3>, <&cru SCLK_TIMER3>; + clock-names = "pclk", "timer"; }; timer6: timer@200380a0 { compatible = "rockchip,rk3188-timer", "rockchip,rk3288-timer"; reg = <0x200380a0 0x20>; interrupts = <GIC_SPI 64 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&cru SCLK_TIMER6>, <&cru PCLK_TIMER0>; - clock-names = "timer", "pclk"; + clocks = <&cru PCLK_TIMER0>, <&cru SCLK_TIMER6>; + clock-names = "pclk", "timer"; }; i2s0: i2s@1011a000 {
arch/arm/boot/dts/rk3288.dtsi +2 -2
@@ -234,8 +234,8 @@ compatible = "rockchip,rk3288-timer"; reg = <0x0 0xff810000 0x0 0x20>; interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&xin24m>, <&cru PCLK_TIMER>; - clock-names = "timer", "pclk"; + clocks = <&cru PCLK_TIMER>, <&xin24m>; + clock-names = "pclk", "timer"; }; display-subsystem {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 6/120 ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x
In reply to Greg Kroah-HartmanFrom: Benjamin Gaignard <[email protected]>
[ Upstream commit 6b023929666f0be5df75f5e0278d1b70effadf42 ]
Add '#" to iommu-cells properties.
Remove useless interrupt-names properties
--- arch/arm/boot/dts/rk322x.dtsi | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
arch/arm/boot/dts/rk322x.dtsi +3 -7
@@ -548,10 +548,9 @@ compatible = "rockchip,iommu"; reg = <0x20020800 0x100>; interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "vpu_mmu"; clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>; clock-names = "aclk", "iface"; - iommu-cells = <0>; + #iommu-cells = <0>; status = "disabled"; };
@@ -559,10 +558,9 @@ compatible = "rockchip,iommu"; reg = <0x20030480 0x40>, <0x200304c0 0x40>; interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "vdec_mmu"; clocks = <&cru ACLK_RKVDEC>, <&cru HCLK_RKVDEC>; clock-names = "aclk", "iface"; - iommu-cells = <0>; + #iommu-cells = <0>; status = "disabled"; };
@@ -570,7 +568,6 @@ compatible = "rockchip,iommu"; reg = <0x20053f00 0x100>; interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "vop_mmu"; clocks = <&cru ACLK_VOP>, <&cru HCLK_VOP>; clock-names = "aclk", "iface"; iommu-cells = <0>;
@@ -581,10 +578,9 @@ compatible = "rockchip,iommu"; reg = <0x20070800 0x100>; interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "iep_mmu"; clocks = <&cru ACLK_IEP>, <&cru HCLK_IEP>; clock-names = "aclk", "iface"; - iommu-cells = <0>; + #iommu-cells = <0>; status = "disabled"; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 7/120 ARM: dts: rockchip: Fix power-controller node names for rk3288
In reply to Greg Kroah-HartmanFrom: Elaine Zhang <[email protected]>
[ Upstream commit 970cdc53cb1afa73602028c103dbfb6a230080be ]
Use more generic names (as recommended in the device tree specification or the binding documentation)
--- arch/arm/boot/dts/rk3288.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/rk3288.dtsi +4 -4
@@ -759,7 +759,7 @@ * *_HDMI HDMI * *_MIPI_* MIPI */ - pd_vio@RK3288_PD_VIO { + power-domain@RK3288_PD_VIO { reg = <RK3288_PD_VIO>; clocks = <&cru ACLK_IEP>, <&cru ACLK_ISP>,
@@ -801,7 +801,7 @@ * Note: The following 3 are HEVC(H.265) clocks, * and on the ACLK_HEVC_NIU (NOC). */ - pd_hevc@RK3288_PD_HEVC { + power-domain@RK3288_PD_HEVC { reg = <RK3288_PD_HEVC>; clocks = <&cru ACLK_HEVC>, <&cru SCLK_HEVC_CABAC>,
@@ -815,7 +815,7 @@ * (video endecoder & decoder) clocks that on the * ACLK_VCODEC_NIU and HCLK_VCODEC_NIU (NOC). */ - pd_video@RK3288_PD_VIDEO { + power-domain@RK3288_PD_VIDEO { reg = <RK3288_PD_VIDEO>; clocks = <&cru ACLK_VCODEC>, <&cru HCLK_VCODEC>;
@@ -826,7 +826,7 @@ * Note: ACLK_GPU is the GPU clock, * and on the ACLK_GPU_NIU (NOC). */ - pd_gpu@RK3288_PD_GPU { + power-domain@RK3288_PD_GPU { reg = <RK3288_PD_GPU>; clocks = <&cru ACLK_GPU>; pm_qos = <&qos_gpu_r>,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 8/120 arm64: dts: rockchip: Fix power-controller node names for rk3328
In reply to Greg Kroah-HartmanFrom: Elaine Zhang <[email protected]>
[ Upstream commit 6e6a282b49c6db408d27231e3c709fbdf25e3c1b ]
Use more generic names (as recommended in the device tree specification or the binding documentation)
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +3 -3
@@ -255,13 +255,13 @@ #address-cells = <1>; #size-cells = <0>; - pd_hevc@RK3328_PD_HEVC { + power-domain@RK3328_PD_HEVC { reg = <RK3328_PD_HEVC>; }; - pd_video@RK3328_PD_VIDEO { + power-domain@RK3328_PD_VIDEO { reg = <RK3328_PD_VIDEO>; }; - pd_vpu@RK3328_PD_VPU { + power-domain@RK3328_PD_VPU { reg = <RK3328_PD_VPU>; }; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 9/120 reset: ti-syscon: fix to_ti_syscon_reset_data macro
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
[ Upstream commit 05cf8fffcdeb47aef1203c08cbec5224fd3a0e1c ]
The to_ti_syscon_reset_data macro currently only works if the parameter passed into it is called 'rcdev'.
Fixes a checkpatch --strict issue:
CHECK: Macro argument reuse 'rcdev' - possible side-effects? #53: FILE: drivers/reset/reset-ti-syscon.c:53:
+#define to_ti_syscon_reset_data(rcdev) \
+ container_of(rcdev, struct ti_syscon_reset_data, rcdev)
--- drivers/reset/reset-ti-syscon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/reset/reset-ti-syscon.c +2 -2
@@ -58,8 +58,8 @@ struct ti_syscon_reset_data {unsigned int nr_controls; }; -#define to_ti_syscon_reset_data (rcdev) \ - container_of(rcdev, struct ti_syscon_reset_data, rcdev) +#define to_ti_syscon_reset_data (_rcdev) \ + container_of(_rcdev, struct ti_syscon_reset_data, rcdev)/** * ti_syscon_reset_assert() - assert device reset
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 10/120 ARM: brcmstb: dts: fix NAND nodes names
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit 9a800ce1aada6e0f56b78e4713f4858c8990c1f7 ]
This matches nand-controller.yaml requirements.
--- arch/arm/boot/dts/bcm7445-bcm97445svmb.dts | 4 ++-- arch/arm/boot/dts/bcm7445.dtsi | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/bcm7445-bcm97445svmb.dts +2 -2
@@ -14,10 +14,10 @@ }; }; -&nand { +&nand_controller { status = "okay"; - nandcs@1 { + nand@1 { compatible = "brcm,nandcs"; reg = <1>; nand-ecc-step-size = <512>;
arch/arm/boot/dts/bcm7445.dtsi +1 -1
@@ -150,7 +150,7 @@ reg-names = "aon-ctrl", "aon-sram"; }; - nand: nand@3e2800 { + nand_controller: nand-controller@3e2800 { status = "disabled"; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 11/120 ARM: Cygnus: dts: fix NAND nodes names
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit e256b48a3b07ee1ae4bfa60abbf509ba8e386862 ]
This matches nand-controller.yaml requirements.
--- arch/arm/boot/dts/bcm-cygnus.dtsi | 2 +- arch/arm/boot/dts/bcm911360_entphn.dts | 4 ++-- arch/arm/boot/dts/bcm958300k.dts | 4 ++-- arch/arm/boot/dts/bcm958305k.dts | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-)
arch/arm/boot/dts/bcm-cygnus.dtsi +1 -1
@@ -455,7 +455,7 @@ status = "disabled"; }; - nand: nand@18046000 { + nand_controller: nand-controller@18046000 { compatible = "brcm,nand-iproc", "brcm,brcmnand-v6.1"; reg = <0x18046000 0x600>, <0xf8105408 0x600>, <0x18046f00 0x20>;
arch/arm/boot/dts/bcm911360_entphn.dts +2 -2
@@ -84,8 +84,8 @@ status = "okay"; }; -&nand { - nandcs@1 { +&nand_controller { + nand@1 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958300k.dts +2 -2
@@ -60,8 +60,8 @@ status = "okay"; }; -&nand { - nandcs@1 { +&nand_controller { + nand@1 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958305k.dts +2 -2
@@ -68,8 +68,8 @@ status = "okay"; }; -&nand { - nandcs@1 { +&nand_controller { + nand@1 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 12/120 ARM: NSP: dts: fix NAND nodes names
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit 0484594be733d5cdf976f55a2d4e8d887f351b69 ]
This matches nand-controller.yaml requirements.
--- arch/arm/boot/dts/bcm-nsp.dtsi | 2 +- arch/arm/boot/dts/bcm958522er.dts | 4 ++-- arch/arm/boot/dts/bcm958525er.dts | 4 ++-- arch/arm/boot/dts/bcm958525xmc.dts | 4 ++-- arch/arm/boot/dts/bcm958622hr.dts | 4 ++-- arch/arm/boot/dts/bcm958623hr.dts | 4 ++-- arch/arm/boot/dts/bcm958625hr.dts | 4 ++-- arch/arm/boot/dts/bcm958625k.dts | 4 ++-- arch/arm/boot/dts/bcm988312hr.dts | 4 ++-- 9 files changed, 17 insertions(+), 17 deletions(-)
arch/arm/boot/dts/bcm-nsp.dtsi +1 -1
@@ -259,7 +259,7 @@ dma-coherent; }; - nand: nand@26000 { + nand_controller: nand-controller@26000 { compatible = "brcm,nand-iproc", "brcm,brcmnand-v6.1"; reg = <0x026000 0x600>, <0x11b408 0x600>,
arch/arm/boot/dts/bcm958522er.dts +2 -2
@@ -74,8 +74,8 @@ status = "okay"; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958525er.dts +2 -2
@@ -74,8 +74,8 @@ status = "okay"; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958525xmc.dts +2 -2
@@ -90,8 +90,8 @@ }; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958622hr.dts +2 -2
@@ -78,8 +78,8 @@ status = "okay"; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958623hr.dts +2 -2
@@ -78,8 +78,8 @@ status = "okay"; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958625hr.dts +2 -2
@@ -76,8 +76,8 @@ status = "okay"; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm958625k.dts +2 -2
@@ -69,8 +69,8 @@ status = "okay"; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
arch/arm/boot/dts/bcm988312hr.dts +2 -2
@@ -78,8 +78,8 @@ status = "okay"; }; -&nand { - nandcs@0 { +&nand_controller { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-on-flash-bbt;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 13/120 ARM: dts: BCM63xx: Fix NAND nodes names
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit 75e2f012f6e34b93124d1d86eaa8f27df48e9ea0 ]
This matches nand-controller.yaml requirements.
--- arch/arm/boot/dts/bcm63138.dtsi | 2 +- arch/arm/boot/dts/bcm963138dvt.dts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/bcm63138.dtsi +1 -1
@@ -175,7 +175,7 @@ status = "disabled"; }; - nand: nand@2000 { + nand_controller: nand-controller@2000 { #address-cells = <1>; #size-cells = <0>; compatible = "brcm,nand-bcm63138", "brcm,brcmnand-v7.0", "brcm,brcmnand";
arch/arm/boot/dts/bcm963138dvt.dts +2 -2
@@ -30,10 +30,10 @@ status = "okay"; }; -&nand { +&nand_controller { status = "okay"; - nandcs@0 { + nand@0 { compatible = "brcm,nandcs"; reg = <0>; nand-ecc-strength = <4>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 14/120 ARM: dts: Hurricane 2: Fix NAND nodes names
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit a4528d9029e2eda16e4fc9b9da1de1fbec10ab26 ]
This matches nand-controller.yaml requirements.
--- arch/arm/boot/dts/bcm-hr2.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/bcm-hr2.dtsi +1 -1
@@ -179,7 +179,7 @@ status = "disabled"; }; - nand: nand@26000 { + nand_controller: nand-controller@26000 { compatible = "brcm,nand-iproc", "brcm,brcmnand-v6.1"; reg = <0x26000 0x600>, <0x11b408 0x600>,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 15/120 ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
In reply to Greg Kroah-HartmanFrom: Primoz Fiser <[email protected]>
[ Upstream commit 14cdc1f243d79e0b46be150502b7dba9c5a6bdfd ]
Serial interface uart3 on phyFLEX board is capable of 5-wire connection including signals RTS and CTS for hardware flow control.
Fix signals UART3_CTS_B and UART3_RTS_B padmux assignments and add missing property "uart-has-rtscts" to allow serial interface to be configured and used with the hardware flow control.
--- arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi +3 -2
@@ -306,8 +306,8 @@ fsl,pins = < MX6QDL_PAD_EIM_D24__UART3_TX_DATA 0x1b0b1 MX6QDL_PAD_EIM_D25__UART3_RX_DATA 0x1b0b1 - MX6QDL_PAD_EIM_D30__UART3_RTS_B 0x1b0b1 - MX6QDL_PAD_EIM_D31__UART3_CTS_B 0x1b0b1 + MX6QDL_PAD_EIM_D31__UART3_RTS_B 0x1b0b1 + MX6QDL_PAD_EIM_D30__UART3_CTS_B 0x1b0b1 >; };
@@ -394,6 +394,7 @@ &uart3 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_uart3>; + uart-has-rtscts; status = "disabled"; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 16/120 ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
In reply to Greg Kroah-HartmanFrom: Jonathan Neuschäfer <[email protected]>
[ Upstream commit 89b759469d525f4d5f9c29cd3b1f490311c67f85 ]
The name of the struct, as defined in arch/arm/mach-imx/pm-imx5.c, is imx5_cpu_suspend_info.
--- arch/arm/mach-imx/suspend-imx53.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-imx/suspend-imx53.S +2 -2
@@ -33,11 +33,11 @@ * ^ * ^ * imx53_suspend code - * PM_INFO structure(imx53_suspend_info) + * PM_INFO structure(imx5_cpu_suspend_info) * ======================== low address ======================= */ -/* Offsets of members of struct imx53_suspend_info */ +/* Offsets of members of struct imx5_cpu_suspend_info */ #define SUSPEND_INFO_MX53_M4IF_V_OFFSET 0x0 #define SUSPEND_INFO_MX53_IOMUXC_V_OFFSET 0x4 #define SUSPEND_INFO_MX53_IO_COUNT_OFFSET 0x8
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 17/120 rtc: mxc_v2: add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-HartmanFrom: Bixuan Cui <[email protected]>
[ Upstream commit 206e04ec7539e7bfdde9aa79a7cde656c9eb308e ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates correct modalias for automatic loading of this driver when it is built as an external module.
--- drivers/rtc/rtc-mxc_v2.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-mxc_v2.c +1 -0
@@ -395,6 +395,7 @@ static const struct of_device_id mxc_ids[] = { { .compatible = "fsl,imx53-rtc", }, {} }; +MODULE_DEVICE_TABLE (of, mxc_ids);static struct platform_driver mxc_rtc_driver = { .driver = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 18/120 ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards
In reply to Greg Kroah-HartmanFrom: Alexandre Torgue <[email protected]>
[ Upstream commit bf24b91f4baf7e421c770a1d9c7d381b10206ac9 ]
Fix following warning observed with "make dtbs_check W=1" command. It concerns f429 eval and disco boards, f769 disco board.
Warning (unit_address_vs_reg): /gpio_keys/button@0: node has a unit name, but no reg or ranges property
--- arch/arm/boot/dts/stm32429i-eval.dts | 8 +++----- arch/arm/boot/dts/stm32746g-eval.dts | 6 ++---- arch/arm/boot/dts/stm32f429-disco.dts | 6 ++---- arch/arm/boot/dts/stm32f469-disco.dts | 6 ++---- arch/arm/boot/dts/stm32f769-disco.dts | 6 ++---- 5 files changed, 11 insertions(+), 21 deletions(-)
arch/arm/boot/dts/stm32429i-eval.dts +3 -5
@@ -111,17 +111,15 @@ }; }; - gpio_keys { + gpio-keys { compatible = "gpio-keys"; - #address-cells = <1>; - #size-cells = <0>; autorepeat; - button@0 { + button-0 { label = "Wake up"; linux,code = <KEY_WAKEUP>; gpios = <&gpioa 0 0>; }; - button@1 { + button-1 { label = "Tamper"; linux,code = <KEY_RESTART>; gpios = <&gpioc 13 0>;
arch/arm/boot/dts/stm32746g-eval.dts +2 -4
@@ -73,12 +73,10 @@ }; }; - gpio_keys { + gpio-keys { compatible = "gpio-keys"; - #address-cells = <1>; - #size-cells = <0>; autorepeat; - button@0 { + button-0 { label = "Wake up"; linux,code = <KEY_WAKEUP>; gpios = <&gpioc 13 0>;
arch/arm/boot/dts/stm32f429-disco.dts +2 -4
@@ -78,12 +78,10 @@ }; }; - gpio_keys { + gpio-keys { compatible = "gpio-keys"; - #address-cells = <1>; - #size-cells = <0>; autorepeat; - button@0 { + button-0 { label = "User"; linux,code = <KEY_HOME>; gpios = <&gpioa 0 0>;
arch/arm/boot/dts/stm32f469-disco.dts +2 -4
@@ -103,12 +103,10 @@ }; }; - gpio_keys { + gpio-keys { compatible = "gpio-keys"; - #address-cells = <1>; - #size-cells = <0>; autorepeat; - button@0 { + button-0 { label = "User"; linux,code = <KEY_WAKEUP>; gpios = <&gpioa 0 GPIO_ACTIVE_HIGH>;
arch/arm/boot/dts/stm32f769-disco.dts +2 -4
@@ -74,12 +74,10 @@ }; }; - gpio_keys { + gpio-keys { compatible = "gpio-keys"; - #address-cells = <1>; - #size-cells = <0>; autorepeat; - button@0 { + button-0 { label = "User"; linux,code = <KEY_HOME>; gpios = <&gpioa 0 GPIO_ACTIVE_HIGH>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 19/120 ARM: dts: stm32: fix RCC node name on stm32f429 MCU
In reply to Greg Kroah-HartmanFrom: Alexandre Torgue <[email protected]>
[ Upstream commit e4b948415a89a219d13e454011cdcf9e63ecc529 ]
This prevent warning observed with "make dtbs_check W=1"
Warning (simple_bus_reg): /soc/rcc@40023810: simple-bus unit address format error, expected "40023800"
--- arch/arm/boot/dts/stm32f429.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/stm32f429.dtsi +1 -1
@@ -609,7 +609,7 @@ status = "disabled"; }; - rcc: rcc@40023810 { + rcc: rcc@40023800 { #reset-cells = <1>; #clock-cells = <2>; compatible = "st,stm32f42xx-rcc", "st,stm32-rcc";
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 20/120 ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings
In reply to Greg Kroah-HartmanFrom: Alexandre Torgue <[email protected]>
[ Upstream commit 2388f14d8747f8304e26ee870790e188c9431efd ]
Prevent warning seen with "make dtbs_check W=1" command:
Warning (avoid_unnecessary_addr_size): /soc/timers@40001c00: unnecessary address-cells/size-cells without "ranges" or child "reg" property
--- arch/arm/boot/dts/stm32f429.dtsi | 8 -------- arch/arm/boot/dts/stm32f746.dtsi | 8 -------- arch/arm/boot/dts/stm32h743.dtsi | 4 ---- 3 files changed, 20 deletions(-)
arch/arm/boot/dts/stm32f429.dtsi +0 -8
@@ -263,8 +263,6 @@ }; timers13: timers@40001c00 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40001C00 0x400>; clocks = <&rcc 0 STM32F4_APB1_CLOCK(TIM13)>;
@@ -278,8 +276,6 @@ }; timers14: timers@40002000 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40002000 0x400>; clocks = <&rcc 0 STM32F4_APB1_CLOCK(TIM14)>;
@@ -558,8 +554,6 @@ }; timers10: timers@40014400 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40014400 0x400>; clocks = <&rcc 0 STM32F4_APB2_CLOCK(TIM10)>;
@@ -573,8 +567,6 @@ }; timers11: timers@40014800 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40014800 0x400>; clocks = <&rcc 0 STM32F4_APB2_CLOCK(TIM11)>;
arch/arm/boot/dts/stm32f746.dtsi +0 -8
@@ -258,8 +258,6 @@ }; timers13: timers@40001c00 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40001C00 0x400>; clocks = <&rcc 0 STM32F7_APB1_CLOCK(TIM13)>;
@@ -273,8 +271,6 @@ }; timers14: timers@40002000 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40002000 0x400>; clocks = <&rcc 0 STM32F7_APB1_CLOCK(TIM14)>;
@@ -521,8 +517,6 @@ }; timers10: timers@40014400 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40014400 0x400>; clocks = <&rcc 0 STM32F7_APB2_CLOCK(TIM10)>;
@@ -536,8 +530,6 @@ }; timers11: timers@40014800 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-timers"; reg = <0x40014800 0x400>; clocks = <&rcc 0 STM32F7_APB2_CLOCK(TIM11)>;
arch/arm/boot/dts/stm32h743.dtsi +0 -4
@@ -422,8 +422,6 @@ }; lptimer4: timer@58002c00 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-lptimer"; reg = <0x58002c00 0x400>; clocks = <&rcc LPTIM4_CK>;
@@ -438,8 +436,6 @@ }; lptimer5: timer@58003000 { - #address-cells = <1>; - #size-cells = <0>; compatible = "st,stm32-lptimer"; reg = <0x58003000 0x400>; clocks = <&rcc LPTIM5_CK>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 21/120 arm64: dts: juno: Update SCPI nodes as per the YAML schema
In reply to Greg Kroah-HartmanFrom: Sudeep Holla <[email protected]>
[ Upstream commit 70010556b158a0fefe43415fb0c58347dcce7da0 ]
The SCPI YAML schema expects standard node names for clocks and power domain controllers. Fix those as per the schema for Juno platforms.
--- arch/arm64/boot/dts/arm/juno-base.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/arm/juno-base.dtsi +3 -3
@@ -533,13 +533,13 @@ clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: scpi-dvfs { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>, <1>, <2>; clock-output-names = "atlclk", "aplclk","gpuclk"; }; - scpi_clk: scpi-clk { + scpi_clk: clocks-1 { compatible = "arm,scpi-variable-clocks"; #clock-cells = <1>; clock-indices = <3>;
@@ -547,7 +547,7 @@ }; }; - scpi_devpd: scpi-power-domains { + scpi_devpd: power-controller { compatible = "arm,scpi-power-domains"; num-domains = <2>; #power-domain-cells = <1>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 22/120 ARM: dts: rockchip: fix supply properties in io-domains nodes
In reply to Greg Kroah-HartmanFrom: Johan Jonker <[email protected]>
[ Upstream commit f07edc41220b14ce057a4e6d7161b30688ddb8a2 ]
A test with rockchip-io-domain.yaml gives notifications for supply properties in io-domains nodes.
Fix them all into ".*-supply$" format.
--- arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +- arch/arm/boot/dts/rk3288-vyasa.dts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/rk3288-rock2-som.dtsi +1 -1
@@ -218,7 +218,7 @@ flash0-supply = <&vcc_flash>; flash1-supply = <&vccio_pmu>; gpio30-supply = <&vccio_pmu>; - gpio1830 = <&vcc_io>; + gpio1830-supply = <&vcc_io>; lcdc-supply = <&vcc_io>; sdcard-supply = <&vccio_sd>; wifi-supply = <&vcc_18>;
arch/arm/boot/dts/rk3288-vyasa.dts +2 -2
@@ -358,10 +358,10 @@ audio-supply = <&vcc_18>; bb-supply = <&vcc_io>; dvp-supply = <&vcc_io>; - flash0-suuply = <&vcc_18>; + flash0-supply = <&vcc_18>; flash1-supply = <&vcc_lan>; gpio30-supply = <&vcc_io>; - gpio1830 = <&vcc_io>; + gpio1830-supply = <&vcc_io>; lcdc-supply = <&vcc_io>; sdcard-supply = <&vccio_sd>; wifi-supply = <&vcc_18>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 23/120 ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings
In reply to Greg Kroah-HartmanFrom: Alexandre Torgue <[email protected]>
[ Upstream commit ad0ed10ba5792064fc3accbf8f0341152a57eecb ]
Replace upper case by lower case in i2c nodes name.
--- arch/arm/boot/dts/stm32f746.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/stm32f746.dtsi +2 -2
@@ -353,9 +353,9 @@ status = "disabled"; }; - i2c3: i2c@40005C00 { + i2c3: i2c@40005c00 { compatible = "st,stm32f7-i2c"; - reg = <0x40005C00 0x400>; + reg = <0x40005c00 0x400>; interrupts = <72>, <73>; resets = <&rcc STM32F7_APB1_RESET(I2C3)>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 24/120 ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15
In reply to Greg Kroah-HartmanFrom: Alexandre Torgue <[email protected]>
[ Upstream commit fb1406335c067be074eab38206cf9abfdce2fb0b ]
It fixes the following warning seen running "make dtbs_check W=1"
Warning (simple_bus_reg): /soc/stmmac-axi-config: missing or empty reg/ranges property
--- arch/arm/boot/dts/stm32mp157c.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm/boot/dts/stm32mp157c.dtsi +6 -6
@@ -964,12 +964,6 @@ status = "disabled"; }; - stmmac_axi_config_0: stmmac-axi-config { - snps,wr_osr_lmt = <0x7>; - snps,rd_osr_lmt = <0x7>; - snps,blen = <0 0 0 0 16 8 4>; - }; - ethernet0: ethernet@5800a000 { compatible = "st,stm32mp1-dwmac", "snps,dwmac-4.20a"; reg = <0x5800a000 0x2000>;
@@ -992,6 +986,12 @@ snps,axi-config = <&stmmac_axi_config_0>; snps,tso; status = "disabled"; + + stmmac_axi_config_0: stmmac-axi-config { + snps,wr_osr_lmt = <0x7>; + snps,rd_osr_lmt = <0x7>; + snps,blen = <0 0 0 0 16 8 4>; + }; }; usbh_ohci: usbh-ohci@5800c000 {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 25/120 soc/tegra: fuse: Fix Tegra234-only builds
In reply to Greg Kroah-HartmanFrom: Thierry Reding <[email protected]>
[ Upstream commit e2d0ee225e49a5553986f3138dd2803852a31fd5 ]
The tegra30_fuse_read() symbol is used on Tegra234, so make sure it's available.
--- drivers/soc/tegra/fuse/fuse-tegra30.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/soc/tegra/fuse/fuse-tegra30.c +2 -1
@@ -48,7 +48,8 @@defined (CONFIG_ARCH_TEGRA_132_SOC ) || \defined (CONFIG_ARCH_TEGRA_210_SOC ) || \defined (CONFIG_ARCH_TEGRA_186_SOC ) || \ - defined(CONFIG_ARCH_TEGRA_194_SOC) +defined (CONFIG_ARCH_TEGRA_194_SOC ) || \ + defined(CONFIG_ARCH_TEGRA_234_SOC)static u32 tegra30_fuse_read_early (struct tegra_fuse *fuse,unsigned int offset) {if (WARN_ON (!fuse->base))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 26/120 arm64: dts: ls208xa: remove bus-num from dspi node
In reply to Greg Kroah-HartmanFrom: Mian Yousaf Kaukab <[email protected]>
[ Upstream commit 8240c972c1798ea013cbb407722295fc826b3584 ]
On LS2088A-RDB board, if the spi-fsl-dspi driver is built as module then its probe fails with the following warning:
[ 10.471363] couldn't get idr [ 10.471381] WARNING: CPU: 4 PID: 488 at drivers/spi/spi.c:2689 spi_register_controller+0x73c/0x8d0 ... [ 10.471651] fsl-dspi 2100000.spi: Problem registering DSPI ctlr [ 10.471708] fsl-dspi: probe of 2100000.spi failed with error -16
Reason for the failure is that bus-num property is set for dspi node. However, bus-num property is not set for the qspi node. If probe for spi-fsl-qspi happens first then id 0 is dynamically allocated to it. Call to spi_register_controller() from spi-fsl-dspi driver then fails. Since commit 29d2daf2c33c ("spi: spi-fsl-dspi: Make bus-num property optional") bus-num property is optional. Remove bus-num property from dspi node to fix the issue.
--- arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +0 -1
@@ -479,7 +479,6 @@ clocks = <&clockgen 4 3>; clock-names = "dspi"; spi-num-chipselects = <5>; - bus-num = <0>; }; esdhc: esdhc@2140000 {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 27/120 thermal/core: Correct function name thermal_zone_device_unregister()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a052b5118f13febac1bd901fe0b7a807b9d6b51c ]
Fix the following make W=1 kernel build warning:
drivers/thermal/thermal_core.c:1376: warning: expecting prototype for thermal_device_unregister(). Prototype was for thermal_zone_device_unregister() instead
--- drivers/thermal/thermal_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/thermal_core.c +1 -1
@@ -1303,7 +1303,7 @@ free_tz:EXPORT_SYMBOL_GPL (thermal_zone_device_register);/** -* thermal_device_unregister - removes the registered thermal zone device +* thermal_zone_device_unregister - removes the registered thermal zone device * @tz: the thermal zone device to remove */ void thermal_zone_device_unregister (struct thermal_zone_device *tz)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 28/120 kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
In reply to Greg Kroah-HartmanFrom: Matthias Maennich <[email protected]>
[ Upstream commit a979522a1a88556e42a22ce61bccc58e304cb361 ]
To avoid unnecessary recompilations, mkcompile_h does not regenerate compile.h if just the timestamp changed.
Though, if KBUILD_BUILD_TIMESTAMP is set, an explicit timestamp for the build was requested, in which case we should not ignore it.
If a user follows the documentation for reproducible builds [1] and defines KBUILD_BUILD_TIMESTAMP as the git commit timestamp, a clean build will have the correct timestamp. A subsequent cherry-pick (or amend) changes the commit timestamp and if an incremental build is done with a different KBUILD_BUILD_TIMESTAMP now, that new value is not taken into consideration. But it should for reproducibility.
Hence, whenever KBUILD_BUILD_TIMESTAMP is explicitly set, do not ignore UTS_VERSION when making a decision about whether the regenerated version of compile.h should be moved into place.
[1] https://www.kernel.org/doc/html/latest/kbuild/reproducible-builds.html
--- scripts/mkcompile_h | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
scripts/mkcompile_h +11 -3
@@ -78,15 +78,23 @@ UTS_TRUNCATE="cut -b -$UTS_LEN" # Only replace the real compile.h if the new one is different, # in order to preserve the timestamp and avoid unnecessary # recompilations. -# We don't consider the file changed if only the date/time changed. +# We don't consider the file changed if only the date/time changed, +# unless KBUILD_BUILD_TIMESTAMP was explicitly set (e.g. for +# reproducible builds with that value referring to a commit timestamp). # A kernel config change will increase the generation number, thus # causing compile.h to be updated (including date/time) due to the # changed comment in the # first line. +if [ -z "$KBUILD_BUILD_TIMESTAMP" ]; then + IGNORE_PATTERN="UTS_VERSION" +else + IGNORE_PATTERN="NOT_A_PATTERN_TO_BE_MATCHED" +fi + if [ -r $TARGET ] && \ - grep -v 'UTS_VERSION' $TARGET > .tmpver.1 && \ - grep -v 'UTS_VERSION' .tmpcompile > .tmpver.2 && \ + grep -v $IGNORE_PATTERN $TARGET > .tmpver.1 && \ + grep -v $IGNORE_PATTERN .tmpcompile > .tmpver.2 && \ cmp -s .tmpver.1 .tmpver.2; then rm -f .tmpcompile else
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 29/120 rtc: max77686: Do not enforce (incorrect) interrupt trigger type
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 742b0d7e15c333303daad4856de0764f4bc83601 ]
Interrupt line can be configured on different hardware in different way, even inverted. Therefore driver should not enforce specific trigger type - edge falling - but instead rely on Devicetree to configure it.
The Maxim 77686 datasheet describes the interrupt line as active low with a requirement of acknowledge from the CPU therefore the edge falling is not correct.
The interrupt line is shared between PMIC and RTC driver, so using level sensitive interrupt is here especially important to avoid races. With an edge configuration in case if first PMIC signals interrupt followed shortly after by the RTC, the interrupt might not be yet cleared/acked thus the second one would not be noticed.
--- drivers/rtc/rtc-max77686.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/rtc/rtc-max77686.c +2 -2
@@ -710,8 +710,8 @@ static int max77686_init_rtc_regmap(struct max77686_rtc_info *info) add_rtc_irq: ret =regmap_add_irq_chip (info->rtc_regmap, info->rtc_irq, -IRQF_TRIGGER_FALLING |IRQF_ONESHOT | -IRQF_SHARED ,0 , info->drv_data->rtc_irq_chip, +IRQF_ONESHOT |IRQF_SHARED , +0 , info->drv_data->rtc_irq_chip, &info->rtc_irq_data);if (ret <0 ) {dev_err (info->dev,"Failed to add RTC irq chip: %d\n" , ret);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 30/120 scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 332a9dd1d86f1e7203fc7f0fd7e82f0b304200fe ]
The shifting of the u8 integer returned fom ahc_inb(ahc, port+3) by 24 bits to the left will be promoted to a 32 bit signed int and then sign-extended to a u64. In the event that the top bit of the u8 is set then all then all the upper 32 bits of the u64 end up as also being set because of the sign-extension. Fix this by casting the u8 values to a u64 before the 24 bit left shift.
[ This dates back to 2002, I found the offending commit from the git history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git,
commit f58eb66c0b0a ("Update aic7xxx driver to 6.2.10...") ]
Addresses-Coverity: ("Unintended sign extension")
--- drivers/scsi/aic7xxx/aic7xxx_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/aic7xxx/aic7xxx_core.c +1 -1
@@ -500,7 +500,7 @@ ahc_inq(struct ahc_softc *ahc, u_int port)return ((ahc_inb (ahc, port)) | (ahc_inb (ahc, port+1 ) <<8 ) | (ahc_inb (ahc, port+2 ) <<16 ) - | (ahc_inb (ahc, port+3 ) <<24 ) + | (((uint64_t )ahc_inb (ahc, port+3 )) <<24 ) | (((uint64_t )ahc_inb (ahc, port+4 )) <<32 ) | (((uint64_t )ahc_inb (ahc, port+5 )) <<40 ) | (((uint64_t)ahc_inb(ahc, port+6)) << 48)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 31/120 scsi: libsas: Add LUN number check in .slave_alloc callback
In reply to Greg Kroah-HartmanFrom: Yufen Yu <[email protected]>
[ Upstream commit 49da96d77938db21864dae6b7736b71e96c1d203 ]
Offlining a SATA device connected to a hisi SAS controller and then scanning the host will result in detecting 255 non-existent devices:
# lsscsi [2:0:0:0] disk ATA Samsung SSD 860 2B6Q /dev/sda [2:0:1:0] disk ATA WDC WD2003FYYS-3 1D01 /dev/sdb [2:0:2:0] disk SEAGATE ST600MM0006 B001 /dev/sdc # echo "offline" > /sys/block/sdb/device/state # echo "- - -" > /sys/class/scsi_host/host2/scan # lsscsi [2:0:0:0] disk ATA Samsung SSD 860 2B6Q /dev/sda [2:0:1:0] disk ATA WDC WD2003FYYS-3 1D01 /dev/sdb [2:0:1:1] disk ATA WDC WD2003FYYS-3 1D01 /dev/sdh ... [2:0:1:255] disk ATA WDC WD2003FYYS-3 1D01 /dev/sdjb
After a REPORT LUN command issued to the offline device fails, the SCSI midlayer tries to do a sequential scan of all devices whose LUN number is not 0. However, SATA does not support LUN numbers at all.
Introduce a generic sas_slave_alloc() handler which will return -ENXIO for SATA devices if the requested LUN number is larger than 0 and make libsas drivers use this function as their .slave_alloc callback.
--- drivers/scsi/aic94xx/aic94xx_init.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 1 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + drivers/scsi/isci/init.c | 1 + drivers/scsi/libsas/sas_scsi_host.c | 9 +++++++++ drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm8001_init.c | 1 + 8 files changed, 16 insertions(+)
drivers/scsi/aic94xx/aic94xx_init.c +1 -0
@@ -71,6 +71,7 @@ static struct scsi_host_template aic94xx_sht = { .use_clustering = ENABLE_CLUSTERING, .eh_device_reset_handler = sas_eh_device_reset_handler, .eh_target_reset_handler = sas_eh_target_reset_handler, + .slave_alloc = sas_slave_alloc, .target_destroy = sas_target_destroy, .ioctl = sas_ioctl, .track_queue_depth = 1,
drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +1 -0
@@ -1814,6 +1814,7 @@ static struct scsi_host_template sht_v1_hw = { .use_clustering = ENABLE_CLUSTERING, .eh_device_reset_handler = sas_eh_device_reset_handler, .eh_target_reset_handler = sas_eh_target_reset_handler, + .slave_alloc = sas_slave_alloc, .target_destroy = sas_target_destroy, .ioctl = sas_ioctl, .shost_attrs = host_attrs,
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +1 -0
@@ -3565,6 +3565,7 @@ static struct scsi_host_template sht_v2_hw = { .use_clustering = ENABLE_CLUSTERING, .eh_device_reset_handler = sas_eh_device_reset_handler, .eh_target_reset_handler = sas_eh_target_reset_handler, + .slave_alloc = sas_slave_alloc, .target_destroy = sas_target_destroy, .ioctl = sas_ioctl, .shost_attrs = host_attrs,
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -0
@@ -2115,6 +2115,7 @@ static struct scsi_host_template sht_v3_hw = { .use_clustering = ENABLE_CLUSTERING, .eh_device_reset_handler = sas_eh_device_reset_handler, .eh_target_reset_handler = sas_eh_target_reset_handler, + .slave_alloc = sas_slave_alloc, .target_destroy = sas_target_destroy, .ioctl = sas_ioctl, .shost_attrs = host_attrs,
drivers/scsi/isci/init.c +1 -0
@@ -167,6 +167,7 @@ static struct scsi_host_template isci_sht = { .eh_abort_handler = sas_eh_abort_handler, .eh_device_reset_handler = sas_eh_device_reset_handler, .eh_target_reset_handler = sas_eh_target_reset_handler, + .slave_alloc = sas_slave_alloc, .target_destroy = sas_target_destroy, .ioctl = sas_ioctl, .shost_attrs = isci_host_attrs,
drivers/scsi/libsas/sas_scsi_host.c +9 -0
@@ -942,6 +942,14 @@ void sas_task_abort(struct sas_task *task) } } +int sas_slave_alloc (struct scsi_device *sdev) +{ +if (dev_is_sata (sdev_to_domain_dev (sdev)) && sdev->lun) +return -ENXIO ; + +return 0 ; +} +void sas_target_destroy (struct scsi_target *starget) {struct domain_device *found_dev = starget->hostdata;
@@ -988,5 +996,6 @@ EXPORT_SYMBOL_GPL(sas_task_abort);EXPORT_SYMBOL_GPL (sas_phy_reset);EXPORT_SYMBOL_GPL (sas_eh_device_reset_handler);EXPORT_SYMBOL_GPL (sas_eh_target_reset_handler); +EXPORT_SYMBOL_GPL (sas_slave_alloc);EXPORT_SYMBOL_GPL (sas_target_destroy);EXPORT_SYMBOL_GPL (sas_ioctl);
drivers/scsi/mvsas/mv_init.c +1 -0
@@ -62,6 +62,7 @@ static struct scsi_host_template mvs_sht = { .use_clustering = ENABLE_CLUSTERING, .eh_device_reset_handler = sas_eh_device_reset_handler, .eh_target_reset_handler = sas_eh_target_reset_handler, + .slave_alloc = sas_slave_alloc, .target_destroy = sas_target_destroy, .ioctl = sas_ioctl, .shost_attrs = mvst_host_attrs,
drivers/scsi/pm8001/pm8001_init.c +1 -0
@@ -87,6 +87,7 @@ static struct scsi_host_template pm8001_sht = { .use_clustering = ENABLE_CLUSTERING, .eh_device_reset_handler = sas_eh_device_reset_handler, .eh_target_reset_handler = sas_eh_target_reset_handler, + .slave_alloc = sas_slave_alloc, .target_destroy = sas_target_destroy, .ioctl = sas_ioctl, .shost_attrs = pm8001_host_attrs,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 32/120 scsi: libfc: Fix array index out of bound exception
In reply to Greg Kroah-HartmanFrom: Javed Hasan <[email protected]>
[ Upstream commit b27c4577557045f1ab3cdfeabfc7f3cd24aca1fe ]
Fix array index out of bound exception in fc_rport_prli_resp().
--- drivers/scsi/libfc/fc_rport.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/scsi/libfc/fc_rport.c +8 -5
@@ -1169,6 +1169,7 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp, resp_code = (pp->spp.spp_flags &FC_SPP_RESP_MASK );FC_RPORT_DBG (rdata,"PRLI spp_flags = 0x%x spp_type 0x%x\n" , pp->spp.spp_flags, pp->spp.spp_type); + rdata->spp_type = pp->spp.spp_type;if (resp_code !=FC_SPP_RESP_ACK ) {if (resp_code ==FC_SPP_RESP_CONF )
@@ -1189,11 +1190,13 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,/* * Call prli provider if we should act as a target */ - prov = fc_passive_prov[rdata->spp_type]; -if (prov) { -memset (&temp_spp,0 ,sizeof (temp_spp)); - prov->prli (rdata, pp->prli.prli_spp_len, - &pp->spp, &temp_spp); +if (rdata->spp_type <FC_FC4_PROV_SIZE ) { + prov = fc_passive_prov[rdata->spp_type]; +if (prov) { +memset (&temp_spp,0 ,sizeof (temp_spp)); + prov->prli (rdata, pp->prli.prli_spp_len, + &pp->spp, &temp_spp); + } }/* * Check if the image pair could be established
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 33/120 sched/fair: Fix CFS bandwidth hrtimer expiry type
In reply to Greg Kroah-HartmanFrom: Odin Ugedal <[email protected]>
[ Upstream commit 72d0ad7cb5bad265adb2014dbe46c4ccb11afaba ]
The time remaining until expiry of the refresh_timer can be negative. Casting the type to an unsigned 64-bit value will cause integer underflow, making the runtime_refresh_within return false instead of true. These situations are rare, but they do happen.
This does not cause user-facing issues or errors; other than possibly unthrottling cfs_rq's using runtime from the previous period(s), making the CFS bandwidth enforcement less strict in those (special) situations.
--- kernel/sched/fair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/sched/fair.c +2 -2
@@ -4714,7 +4714,7 @@ static const u64 cfs_bandwidth_slack_period = 5 * NSEC_PER_MSEC;static int runtime_refresh_within (struct cfs_bandwidth *cfs_b,u64 min_expire) {struct hrtimer *refresh_timer = &cfs_b->period_timer; -u64 remaining; +s64 remaining;/* if the call-back is running a quota refresh is already occurring */ if (hrtimer_callback_running (refresh_timer))
@@ -4722,7 +4722,7 @@ static int runtime_refresh_within(struct cfs_bandwidth *cfs_b, u64 min_expire)/* is a quota refresh about to occur? */ remaining =ktime_to_ns (hrtimer_expires_remaining (refresh_timer)); -if (remaining < min_expire) +if (remaining < (s64 )min_expire)return 1 ;return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 34/120 mm: slab: fix kmem_cache_create failed when sysfs node not destroyed
In reply to Greg Kroah-HartmanFrom: Nanyong Sun <[email protected]>
The commit d38a2b7a9c93 ("mm: memcg/slab: fix memory leak at non-root kmem_cache destroy") introduced a problem: If one thread destroy a kmem_cache A and another thread concurrently create a kmem_cache B, which is mergeable with A and has same size with A, the B may fail to create due to the duplicate sysfs node.
The scenario in detail:
1) Thread 1 uses kmem_cache_destroy() to destroy kmem_cache A which is mergeable, it decreases A's refcount and if refcount is 0, then call memcg_set_kmem_cache_dying() which set A->memcg_params.dying = true, then unlock the slab_mutex and call flush_memcg_workqueue(), it may cost a while.
Note: now the sysfs node(like '/kernel/slab/:0000248') of A is still present, it will be deleted in shutdown_cache() which will be called after flush_memcg_workqueue() is done and lock the slab_mutex again.
2) Now if thread 2 is coming, it use kmem_cache_create() to create B, which is mergeable with A(their size is same), it gain the lock of slab_mutex, then call __kmem_cache_alias() trying to find a mergeable node, because of the below added code in commit d38a2b7a9c93 ("mm: memcg/slab: fix memory leak at non-root kmem_cache destroy"), B is not mergeable with A whose memcg_params.dying is true.
int slab_unmergeable(struct kmem_cache *s)
if (s->refcount < 0)
return 1;
/* * Skip the dying kmem_cache. */ if (s->memcg_params.dying) return 1;
return 0;
}
So B has to create its own sysfs node by calling:
create_cache->
__kmem_cache_create-> sysfs_slab_add-> kobject_init_and_add
Because B is mergeable itself, its filename of sysfs node is based on its size, like '/kernel/slab/:0000248', which is duplicate with A, and the sysfs node of A is still present now, so kobject_init_and_add() will return fail and result in kmem_cache_create() fail.
Concurrently modprobe and rmmod the two modules below can reproduce the issue
quickly: nf_conntrack_expect, se_sess_cache. See call trace in the end.
LTS versions of v4.19.y and v5.4.y have this problem, whereas linux versions after v5.9 do not have this problem because the patchset: ("The new cgroup slab memory controller") almost refactored memcg slab.
A potential solution(this patch belongs): Just let the dying kmem_cache be mergeable, the slab_mutex lock can prevent the race between alias kmem_cache creating thread and root kmem_cache destroying thread. In the destroying thread, after flush_memcg_workqueue() is done, judge the refcount again, if someone reference it again during un-lock time, we don't need to destroy the kmem_cache completely, we can reuse it.
Another potential solution: revert the commit d38a2b7a9c93 ("mm: memcg/slab:
fix memory leak at non-root kmem_cache destroy"), compare to the fail of kmem_cache_create, the memory leak in special scenario seems less harmful.
Call trace: sysfs: cannot create duplicate filename '/kernel/slab/:0000248' Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: dump_backtrace+0x0/0x198 show_stack+0x24/0x30 dump_stack+0xb0/0x100 sysfs_warn_dup+0x6c/0x88 sysfs_create_dir_ns+0x104/0x120 kobject_add_internal+0xd0/0x378 kobject_init_and_add+0x90/0xd8 sysfs_slab_add+0x16c/0x2d0 __kmem_cache_create+0x16c/0x1d8 create_cache+0xbc/0x1f8 kmem_cache_create_usercopy+0x1a0/0x230 kmem_cache_create+0x50/0x68 init_se_kmem_caches+0x38/0x258 [target_core_mod] target_core_init_configfs+0x8c/0x390 [target_core_mod] do_one_initcall+0x54/0x230 do_init_module+0x64/0x1ec load_module+0x150c/0x16f0 __se_sys_finit_module+0xf0/0x108 __arm64_sys_finit_module+0x24/0x30 el0_svc_common+0x80/0x1c0 el0_svc_handler+0x78/0xe0 el0_svc+0x10/0x260 kobject_add_internal failed for :0000248 with -EEXIST, don't try to register things with the same name in the same directory. kmem_cache_create(se_sess_cache) failed with error -17 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: dump_backtrace+0x0/0x198 show_stack+0x24/0x30 dump_stack+0xb0/0x100 kmem_cache_create_usercopy+0xa8/0x230 kmem_cache_create+0x50/0x68 init_se_kmem_caches+0x38/0x258 [target_core_mod] target_core_init_configfs+0x8c/0x390 [target_core_mod] do_one_initcall+0x54/0x230 do_init_module+0x64/0x1ec load_module+0x150c/0x16f0 __se_sys_finit_module+0xf0/0x108 __arm64_sys_finit_module+0x24/0x30 el0_svc_common+0x80/0x1c0 el0_svc_handler+0x78/0xe0 el0_svc+0x10/0x260
--- mm/slab_common.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
mm/slab_common.c +10 -8
@@ -311,14 +311,6 @@ int slab_unmergeable(struct kmem_cache *if (s->refcount <0 )return 1 ; -#ifdef CONFIG_MEMCG_KMEM -/* -* Skip the dying kmem_cache. -*/ -if (s->memcg_params.dying) -return 1 ; -#endif -return 0 ; }
@@ -918,6 +910,16 @@ void kmem_cache_destroy(struct kmem_cachget_online_mems ();mutex_lock (&slab_mutex); + +/* +* Another thread referenced it again +*/ +if (READ_ONCE (s->refcount)) { +spin_lock_irq (&memcg_kmem_wq_lock); + s->memcg_params.dying = false; +spin_unlock_irq (&memcg_kmem_wq_lock); + goto out_unlock; + }#endif err =shutdown_memcg_caches (s);
Greg Kroah-Hartman
maintainerPATCH 35/120 dm writecache: return the exact table values that were set
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 054bee16163df023e2589db09fd27d81f7ad9e72 upstream.
LVM doesn't like it when the target returns different values from what was set in the constructor. Fix dm-writecache so that the returned table values are exactly the same as requested values.
--- drivers/md/dm-writecache.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-)
drivers/md/dm-writecache.c +16 -16
@@ -153,6 +153,7 @@ struct dm_writecache { bool overwrote_committed:1; bool memory_vmapped:1; + bool start_sector_set:1; bool high_wm_percent_set:1; bool low_wm_percent_set:1; bool max_writeback_jobs_set:1;
@@ -161,6 +162,10 @@ struct dm_writecache { bool writeback_fua_set:1; bool flush_on_suspend:1; +unsigned high_wm_percent_value; +unsigned low_wm_percent_value; +unsigned autocommit_time_value; +unsigned writeback_all;struct workqueue_struct *writeback_wq;struct work_struct writeback_work;
@@ -2045,6 +2050,7 @@ static int writecache_ctr(struct dm_targif (sscanf (string,"%llu%c" , &start_sector, &dummy) !=1 ) goto invalid_optional; wc->start_sector = start_sector; + wc->start_sector_set = true;if (wc->start_sector != start_sector || wc->start_sector >= wc->memory_map_size >>SECTOR_SHIFT ) goto invalid_optional;
@@ -2054,6 +2060,7 @@ static int writecache_ctr(struct dm_targ goto invalid_optional;if (high_wm_percent <0 || high_wm_percent >100 ) goto invalid_optional; + wc->high_wm_percent_value = high_wm_percent; wc->high_wm_percent_set = true; }else if (!strcasecmp (string,"low_watermark" ) && opt_params >=1 ) { string =dm_shift_arg (&as), opt_params--;
@@ -2061,6 +2068,7 @@ static int writecache_ctr(struct dm_targ goto invalid_optional;if (low_wm_percent <0 || low_wm_percent >100 ) goto invalid_optional; + wc->low_wm_percent_value = low_wm_percent; wc->low_wm_percent_set = true; }else if (!strcasecmp (string,"writeback_jobs" ) && opt_params >=1 ) { string =dm_shift_arg (&as), opt_params--;
@@ -2080,6 +2088,7 @@ static int writecache_ctr(struct dm_targif (autocommit_msecs >3600000 ) goto invalid_optional; wc->autocommit_jiffies =msecs_to_jiffies (autocommit_msecs); + wc->autocommit_time_value = autocommit_msecs; wc->autocommit_time_set = true; }else if (!strcasecmp (string,"fua" )) {if (WC_MODE_PMEM (wc)) {
@@ -2275,7 +2284,6 @@ static void writecache_status(struct dm_struct dm_writecache *wc = ti->private;unsigned extra_args;unsigned sz =0 ; -uint64_t x;switch (type) {case STATUSTYPE_INFO :
@@ -2287,7 +2295,7 @@ static void writecache_status(struct dm_DMEMIT ("%c %s %s %u " ,WC_MODE_PMEM (wc) ?'p' :'s' , wc->dev->name, wc->ssd_dev->name, wc->block_size); extra_args =0 ; -if (wc->start_sector) +if (wc->start_sector_set) extra_args +=2 ;if (wc->high_wm_percent_set) extra_args +=2 ;
@@ -2303,26 +2311,18 @@ static void writecache_status(struct dm_ extra_args++;DMEMIT ("%u" , extra_args); -if (wc->start_sector) +if (wc->start_sector_set)DMEMIT (" start_sector %llu" , (unsigned long long )wc->start_sector); -if (wc->high_wm_percent_set) { - x = (uint64_t )wc->freelist_high_watermark *100 ; - x += wc->n_blocks /2 ; -do_div (x, (size_t )wc->n_blocks); -DMEMIT (" high_watermark %u" ,100 - (unsigned )x); - } -if (wc->low_wm_percent_set) { - x = (uint64_t )wc->freelist_low_watermark *100 ; - x += wc->n_blocks /2 ; -do_div (x, (size_t )wc->n_blocks); -DMEMIT (" low_watermark %u" ,100 - (unsigned )x); - } +if (wc->high_wm_percent_set) +DMEMIT (" high_watermark %u" , wc->high_wm_percent_value); +if (wc->low_wm_percent_set) +DMEMIT (" low_watermark %u" , wc->low_wm_percent_value);if (wc->max_writeback_jobs_set)DMEMIT (" writeback_jobs %u" , wc->max_writeback_jobs);if (wc->autocommit_blocks_set)DMEMIT (" autocommit_blocks %u" , wc->autocommit_blocks);if (wc->autocommit_time_set) -DMEMIT (" autocommit_time %u" ,jiffies_to_msecs (wc->autocommit_jiffies)); +DMEMIT (" autocommit_time %u" , wc->autocommit_time_value);if (wc->writeback_fua_set)DMEMIT (" %sfua" , wc->writeback_fua ?"" :"no" );break ;
Greg Kroah-Hartman
maintainerPATCH 36/120 dm writecache: fix writing beyond end of underlying device when shrinking
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 4134455f2aafdfeab50cabb4cccb35e916034b93 upstream.
Do not attempt to write any data beyond the end of the underlying data device while shrinking it.
The DM writecache device must be suspended when the underlying data device is shrunk.
--- drivers/md/dm-writecache.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/md/dm-writecache.c +18 -0
@@ -142,6 +142,7 @@ struct dm_writecache {size_t metadata_sectors;size_t n_blocks;uint64_t seq_count; +sector_t data_device_sectors;void *block_start;struct wc_entry *entries;unsigned block_size;
@@ -929,6 +930,8 @@ static void writecache_resume(struct dm_wc_lock (wc); + wc->data_device_sectors =i_size_read (wc->dev->bdev->bd_inode) >>SECTOR_SHIFT ; +if (WC_MODE_PMEM (wc)) {persistent_memory_invalidate_cache (wc->memory_map, wc->memory_map_size); }else {
@@ -1499,6 +1502,10 @@ static bool wc_add_block(struct writebacvoid *address =memory_data (wc, e);persistent_memory_flush_cache (address, block_size); + +if (unlikely (bio_end_sector (&wb->bio) >= wc->data_device_sectors)) +return true; +return bio_add_page (&wb->bio,persistent_memory_page (address), block_size,persistent_memory_page_offset (address)) !=0 ; }
@@ -1571,6 +1578,9 @@ static void __writecache_writeback_pmem(if (writecache_has_error (wc)) { bio->bi_status =BLK_STS_IOERR ;bio_endio (&wb->bio); + }else if (unlikely (!bio_sectors (&wb->bio))) { + bio->bi_status =BLK_STS_OK ; +bio_endio (&wb->bio); }else {submit_bio (&wb->bio); }
@@ -1614,6 +1624,14 @@ static void __writecache_writeback_ssd(s e = f; } +if (unlikely (to.sector + to.count > wc->data_device_sectors)) { +if (to.sector >= wc->data_device_sectors) { +writecache_copy_endio (0 ,0 , c); +continue ; + } + from.count = to.count = wc->data_device_sectors - to.sector; + } +dm_kcopyd_copy (wc->dm_kcopyd, &from,1 , &to,0 , writecache_copy_endio, c);__writeback_throttle (wc, wbl);
Greg Kroah-Hartman
maintainerPATCH 37/120 net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit 3709488790022c85720f991bff50d48ed5a36e6a upstream.
Commit 9e5baf9b36367 ("net: dsa: mv88e6xxx: add RMU disable op") introduced .rmu_disable() method with implementation for several models, but forgot to add Topaz, which can use the Peridot implementation.
Use the Peridot implementation of .rmu_disable() on Topaz.
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/dsa/mv88e6xxx/chip.c +2 -0
@@ -3682,6 +3682,7 @@ static const struct mv88e6xxx_ops mv88e6 .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu, .pot_clear = mv88e6xxx_g2_pot_clear, .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, .vtu_getnext = mv88e6352_g1_vtu_getnext, .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, .serdes_power = mv88e6341_serdes_power,
@@ -3764,6 +3765,7 @@ static const struct mv88e6xxx_ops mv88e6 .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, .pot_clear = mv88e6xxx_g2_pot_clear, .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6390_g1_rmu_disable, .vtu_getnext = mv88e6352_g1_vtu_getnext, .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, .avb_ops = &mv88e6352_avb_ops,
Greg Kroah-Hartman
maintainerPATCH 38/120 net: ipv6: fix return value of ip6_skb_dst_mtu
In reply to Greg Kroah-HartmanFrom: Vadim Fedorenko <[email protected]>
commit 40fc3054b45820c28ea3c65e2c86d041dc244a8a upstream.
Commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE") introduced ip6_skb_dst_mtu with return value of signed int which is inconsistent with actually returned values. Also 2 users of this function actually assign its value to unsigned int variable and only __xfrm6_output assigns result of this function to signed variable but actually uses as unsigned in further comparisons and calls. Change this function to return unsigned int value.
--- include/net/ip6_route.h | 2 +- net/ipv6/xfrm6_output.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/net/ip6_route.h +1 -1
@@ -241,7 +241,7 @@ static inline bool ipv6_anycast_destinatint ip6_fragment (struct net *net,struct sock *sk,struct sk_buff *skb,int (*output)(struct net *,struct sock *,struct sk_buff *)); -static inline int ip6_skb_dst_mtu (struct sk_buff *skb) +static inline unsigned int ip6_skb_dst_mtu (struct sk_buff *skb) {int mtu;
net/ipv6/xfrm6_output.c +1 -1
@@ -146,7 +146,7 @@ static int __xfrm6_output(struct net *ne {struct dst_entry *dst =skb_dst (skb);struct xfrm_state *x = dst->xfrm; -int mtu; +unsigned int mtu;bool toobig;#ifdef CONFIG_NETFILTER
Greg Kroah-Hartman
maintainerPATCH 39/120 netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
commit c23a9fd209bc6f8c1fa6ee303fdf037d784a1627 upstream.
Two patches listed below removed ctnetlink_dump_helpinfo call from under rcu_read_lock. Now its rcu_dereference generates following warning:
=============================
WARNING: suspicious RCU usage
5.13.0+ #5 Not tainted
-----------------------------net/netfilter/nf_conntrack_netlink.c:221 suspicious rcu_dereference_check() usage!
other info that might help us debug this:rcu_scheduler_active = 2, debug_locks = 1
stack backtrace: CPU: 1 PID: 2251 Comm: conntrack Not tainted 5.13.0+ #5 Call Trace: dump_stack+0x7f/0xa1 ctnetlink_dump_helpinfo+0x134/0x150 [nf_conntrack_netlink] ctnetlink_fill_info+0x2c2/0x390 [nf_conntrack_netlink] ctnetlink_dump_table+0x13f/0x370 [nf_conntrack_netlink] netlink_dump+0x10c/0x370 __netlink_dump_start+0x1a7/0x260 ctnetlink_get_conntrack+0x1e5/0x250 [nf_conntrack_netlink] nfnetlink_rcv_msg+0x613/0x993 [nfnetlink] netlink_rcv_skb+0x50/0x100 nfnetlink_rcv+0x55/0x120 [nfnetlink] netlink_unicast+0x181/0x260 netlink_sendmsg+0x23f/0x460 sock_sendmsg+0x5b/0x60 __sys_sendto+0xf1/0x160 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x36/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- net/netfilter/nf_conntrack_netlink.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_conntrack_netlink.c +3 -0
@@ -213,6 +213,7 @@ static int ctnetlink_dump_helpinfo(strucif (!help)return 0 ; +rcu_read_lock (); helper =rcu_dereference (help->helper);if (!helper) goto out;
@@ -228,9 +229,11 @@ static int ctnetlink_dump_helpinfo(strucnla_nest_end (skb, nest_helper); out: +rcu_read_unlock ();return 0 ; nla_put_failure: +rcu_read_unlock ();return -1 ; }
Greg Kroah-Hartman
maintainerPATCH 40/120 net: bridge: sync fdb to new unicast-filtering ports
In reply to Greg Kroah-HartmanFrom: Wolfgang Bumiller <[email protected]>
commit a019abd8022061b917da767cd1a66ed823724eab upstream.
Since commit 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
bridges with vlan_filtering 1 and only 1 auto-port don't set IFF_PROMISC for unicast-filtering-capable ports.
Normally on port changes br_manage_promisc is called to update the promisc flags and unicast filters if necessary, but it cannot distinguish between *new* ports and ones losing their promisc flag, and new ports end up not receiving the MAC address list.
Fix this by calling br_fdb_sync_static in br_add_if after the port promisc flags are updated and the unicast filter was supposed to have been filled.
--- net/bridge/br_if.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/bridge/br_if.c +16 -1
@@ -564,7 +564,7 @@ int br_add_if(struct net_bridge *br, strstruct net_bridge_port *p;int err =0 ;unsigned br_hr, dev_hr; -bool changed_addr; +bool changed_addr, fdb_synced = false;/* Don't allow bridging non-ethernet like devices, or DSA-enabled * master network devices since the bridge layer rx_handler prevents
@@ -640,6 +640,19 @@ int br_add_if(struct net_bridge *br, strlist_add_rcu (&p->list, &br->port_list);nbp_update_port_count (br); +if (!br_promisc_port (p) && (p->dev->priv_flags &IFF_UNICAST_FLT )) { +/* When updating the port count we also update all ports' +* promiscuous mode. +* A port leaving promiscuous mode normally gets the bridge's +* fdb synced to the unicast filter (if supported), however, +* `br_port_clear_promisc` does not distinguish between +* non-promiscuous ports and *new* ports, so we need to +* sync explicitly here. +*/ + fdb_synced =br_fdb_sync_static (br, p) ==0 ; +if (!fdb_synced) +netdev_err (dev,"failed to sync bridge static fdb addresses to this port\n" ); + }netdev_update_features (br->dev);
@@ -680,6 +693,8 @@ int br_add_if(struct net_bridge *br, strreturn 0 ; err7: +if (fdb_synced) +br_fdb_unsync_static (br, p);list_del_rcu (&p->list);br_fdb_delete_by_port (br, p,0 ,1 );nbp_update_port_count (br);
Greg Kroah-Hartman
maintainerPATCH 41/120 net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 2b452550a203d88112eaf0ba9fc4b750a000b496 upstream.
Make sure that we disable each of the TX and RX queues in the TDMA and RDMA control registers. This is a correctness change to be symmetrical with the code that enables the TX and RX queues.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +6 -0
@@ -2790,15 +2790,21 @@ static void bcmgenet_set_hw_addr(struct/* Returns a reusable dma control register value */ static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv) { +unsigned int i;u32 reg;u32 dma_ctrl;/* disable DMA */ dma_ctrl =1 << (DESC_INDEX +DMA_RING_BUF_EN_SHIFT ) |DMA_EN ; +for (i =0 ; i < priv->hw_params->tx_queues; i++) + dma_ctrl |= (1 << (i +DMA_RING_BUF_EN_SHIFT )); reg =bcmgenet_tdma_readl (priv,DMA_CTRL ); reg &= ~dma_ctrl;bcmgenet_tdma_writel (priv, reg,DMA_CTRL ); + dma_ctrl =1 << (DESC_INDEX +DMA_RING_BUF_EN_SHIFT ) |DMA_EN ; +for (i =0 ; i < priv->hw_params->rx_queues; i++) + dma_ctrl |= (1 << (i +DMA_RING_BUF_EN_SHIFT )); reg =bcmgenet_rdma_readl (priv,DMA_CTRL ); reg &= ~dma_ctrl;bcmgenet_rdma_writel (priv, reg,DMA_CTRL );
Greg Kroah-Hartman
maintainerPATCH 42/120 net: moxa: fix UAF in moxart_mac_probe
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit c78eaeebe855fd93f2e77142ffd0404a54070d84 upstream.
In case of netdev registration failure the code path will jump to init_fail label:
init_fail:
netdev_err(ndev, "init failed\n"); moxart_mac_free_memory(ndev); irq_map_fail: free_netdev(ndev); return ret;
So, there is no need to call free_netdev() before jumping to error handling path, since it can cause UAF or double-free bug.
--- drivers/net/ethernet/moxa/moxart_ether.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/moxa/moxart_ether.c +1 -3
@@ -538,10 +538,8 @@ static int moxart_mac_probe(struct platfSET_NETDEV_DEV (ndev, &pdev->dev); ret =register_netdev (ndev); -if (ret) { -free_netdev (ndev); +if (ret) goto init_fail; - }netdev_dbg (ndev,"%s: IRQ=%d address=%pM\n" , __func__, ndev->irq, ndev->dev_addr);
Greg Kroah-Hartman
maintainerPATCH 43/120 net: qcom/emac: fix UAF in emac_remove
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit ad297cd2db8953e2202970e9504cab247b6c7cb4 upstream.
adpt is netdev private data and it cannot be
used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function.
--- drivers/net/ethernet/qualcomm/emac/emac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/emac/emac.c +2 -1
@@ -759,12 +759,13 @@ static int emac_remove(struct platform_dput_device (&adpt->phydev->mdio.dev);mdiobus_unregister (adpt->mii_bus); -free_netdev (netdev);if (adpt->phy.digital)iounmap (adpt->phy.digital);iounmap (adpt->phy.base); +free_netdev (netdev); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 44/120 net: ti: fix UAF in tlan_remove_one
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit 0336f8ffece62f882ab3012820965a786a983f70 upstream.
priv is netdev private data and it cannot be
used after free_netdev() call. Using priv after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function.
--- drivers/net/ethernet/ti/tlan.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/ti/tlan.c +1 -2
@@ -312,9 +312,8 @@ static void tlan_remove_one(struct pci_dpci_release_regions (pdev);#endif -free_netdev (dev); -cancel_work_sync (&priv->tlan_tqueue); +free_netdev (dev); }static void tlan_start (struct net_device *dev)
Greg Kroah-Hartman
maintainerPATCH 45/120 net: send SYNACK packet with accepted fwmark
In reply to Greg Kroah-HartmanFrom: Alexander Ovechkin <[email protected]>
commit 43b90bfad34bcb81b8a5bc7dc650800f4be1787e upstream.
commit e05a90ec9e16 ("net: reflect mark on tcp syn ack packets") fixed IPv4 only.
This part is for the IPv6 side.
--- net/ipv6/tcp_ipv6.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/tcp_ipv6.c +2 -1
@@ -503,7 +503,8 @@ static int tcp_v6_send_synack(const stru opt = ireq->ipv6_opt;if (!opt) opt =rcu_dereference (np->opt); - err =ip6_xmit (sk, skb, fl6, sk->sk_mark, opt, np->tclass); + err =ip6_xmit (sk, skb, fl6, skb->mark ? : sk->sk_mark, opt, + np->tclass);rcu_read_unlock (); err =net_xmit_eval (err); }
Greg Kroah-Hartman
maintainerPATCH 46/120 net: validate lwtstate->data before returning from skb_tunnel_info()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
commit 67a9c94317402b826fc3db32afc8f39336803d97 upstream.
skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info type without validation. lwtstate->data can have various types such as mpls_iptunnel_encap, etc and these are not compatible.
So skb_tunnel_info() should validate before returning that pointer.
Splat looks like:
BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] Read of size 2 at addr ffff888106ec2698 by task ping/811 CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 Call Trace: dump_stack_lvl+0x56/0x7b print_address_description.constprop.8.cold.13+0x13/0x2ee ? vxlan_get_route+0x418/0x4b0 [vxlan] ? vxlan_get_route+0x418/0x4b0 [vxlan] kasan_report.cold.14+0x83/0xdf ? vxlan_get_route+0x418/0x4b0 [vxlan] vxlan_get_route+0x418/0x4b0 [vxlan] [ ... ] vxlan_xmit_one+0x148b/0x32b0 [vxlan] [ ... ] vxlan_xmit+0x25c5/0x4780 [vxlan] [ ... ] dev_hard_start_xmit+0x1ae/0x6e0 __dev_queue_xmit+0x1f39/0x31a0 [ ... ] neigh_xmit+0x2f9/0x940 mpls_xmit+0x911/0x1600 [mpls_iptunnel] lwtunnel_xmit+0x18f/0x450 ip_finish_output2+0x867/0x2040 [ ... ]
--- include/net/dst_metadata.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/net/dst_metadata.h +3 -1
@@ -45,7 +45,9 @@ skb_tunnel_info(const struct sk_buff *skreturn &md_dst->u.tun_info; dst =skb_dst (skb); -if (dst && dst->lwtstate) +if (dst && dst->lwtstate && + (dst->lwtstate->type ==LWTUNNEL_ENCAP_IP || + dst->lwtstate->type ==LWTUNNEL_ENCAP_IP6 ))return lwt_tun_info (dst->lwtstate);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 47/120 dma-buf/sync_file: Dont leak fences on merge failure
In reply to Greg Kroah-HartmanFrom: Jason Ekstrand <[email protected]>
commit ffe000217c5068c5da07ccb1c0f8cce7ad767435 upstream.
Each add_fence() call does a dma_fence_get() on the relevant fence. In the error path, we weren't calling dma_fence_put() so all those fences got leaked. Also, in the krealloc_array failure case, we weren't freeing the fences array. Instead, ensure that i and fences are always zero-initialized and dma_fence_put() all the fences and kfree(fences) on every error path.
--- drivers/dma-buf/sync_file.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/dma-buf/sync_file.c +7 -6
@@ -220,8 +220,8 @@ static struct sync_file *sync_file_merge struct sync_file *b) {struct sync_file *sync_file; -struct dma_fence **fences, **nfences, **a_fences, **b_fences; -int i, i_a, i_b, num_fences, a_num_fences, b_num_fences; +struct dma_fence **fences =NULL , **nfences, **a_fences, **b_fences; +int i =0 , i_a, i_b, num_fences, a_num_fences, b_num_fences; sync_file =sync_file_alloc ();if (!sync_file)
@@ -245,7 +245,7 @@ static struct sync_file *sync_file_merge* If a sync_file can only be created with sync_file_merge * and sync_file_create, this is a reasonable assumption. */ -for (i = i_a = i_b =0 ; i_a < a_num_fences && i_b < b_num_fences; ) { +for (i_a = i_b =0 ; i_a < a_num_fences && i_b < b_num_fences; ) {struct dma_fence *pt_a = a_fences[i_a];struct dma_fence *pt_b = b_fences[i_b];
@@ -286,15 +286,16 @@ static struct sync_file *sync_file_merge fences = nfences; } -if (sync_file_set_fence (sync_file, fences, i) <0 ) { -kfree (fences); +if (sync_file_set_fence (sync_file, fences, i) <0 ) goto err; - }strlcpy (sync_file->user_name, name,sizeof (sync_file->user_name));return sync_file; err: +while (i) +dma_fence_put (fences[--i]); +kfree (fences);fput (sync_file->file);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 48/120 tcp: annotate data races around tp->mtu_info
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 561022acb1ce62e50f7a8258687a21b84282a4cb upstream.
While tp->mtu_info is read while socket is owned, the write sides happen from err handlers (tcp_v[46]_mtu_reduced) which only own the socket spinlock.
--- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv6/tcp_ipv6.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/tcp_ipv4.c +2 -2
@@ -348,7 +348,7 @@ void tcp_v4_mtu_reduced(struct sock *sk)if ((1 << sk->sk_state) & (TCPF_LISTEN |TCPF_CLOSE ))return ; - mtu =tcp_sk (sk)->mtu_info; + mtu =READ_ONCE (tcp_sk (sk)->mtu_info); dst =inet_csk_update_pmtu (sk, mtu);if (!dst)return ;
@@ -516,7 +516,7 @@ void tcp_v4_err(struct sk_buff *icmp_skbif (sk->sk_state ==TCP_LISTEN ) goto out; - tp->mtu_info = info; +WRITE_ONCE (tp->mtu_info, info);if (!sock_owned_by_user (sk)) {tcp_v4_mtu_reduced (sk); }else {
net/ipv6/tcp_ipv6.c +2 -2
@@ -340,7 +340,7 @@ static void tcp_v6_mtu_reduced(struct soif ((1 << sk->sk_state) & (TCPF_LISTEN |TCPF_CLOSE ))return ; - dst =inet6_csk_update_pmtu (sk,tcp_sk (sk)->mtu_info); + dst =inet6_csk_update_pmtu (sk,READ_ONCE (tcp_sk (sk)->mtu_info));if (!dst)return ;
@@ -429,7 +429,7 @@ static void tcp_v6_err(struct sk_buff *sif (!ip6_sk_accept_pmtu (sk)) goto out; - tp->mtu_info =ntohl (info); +WRITE_ONCE (tp->mtu_info,ntohl (info));if (!sock_owned_by_user (sk))tcp_v6_mtu_reduced (sk); else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
Greg Kroah-Hartman
maintainerPATCH 49/120 ipv6: tcp: drop silly ICMPv6 packet too big messages
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit c7bb4b89033b764eb07db4e060548a6311d801ee upstream.
While TCP stack scales reasonably well, there is still one part that can be used to DDOS it.
IPv6 Packet too big messages have to lookup/insert a new route, and if abused by attackers, can easily put hosts under high stress, with many cpus contending on a spinlock while one is stuck in fib6_run_gc()
ip6_protocol_deliver_rcu()
icmpv6_rcv()
icmpv6_notify()
tcp_v6_err()
tcp_v6_mtu_reduced()
inet6_csk_update_pmtu()
ip6_rt_update_pmtu()
__ip6_rt_update_pmtu()
ip6_rt_cache_alloc()
ip6_dst_alloc()
dst_alloc()
ip6_dst_gc()
fib6_run_gc()
spin_lock_bh() ...Some of our servers have been hit by malicious ICMPv6 packets trying to _increase_ the MTU/MSS of TCP flows.
We believe these ICMPv6 packets are a result of a bug in one ISP stack, since they were blindly sent back for _every_ (small) packet sent to them.
These packets are for one TCP flow:
09:24:36.266491 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240 09:24:36.266509 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240 09:24:36.316688 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240 09:24:36.316704 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240 09:24:36.608151 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240
TCP stack can filter some silly requests :
1) MTU below IPV6_MIN_MTU can be filtered early in tcp_v6_err()
2) tcp_v6_mtu_reduced() can drop requests trying to increase current MSS.
This tests happen before the IPv6 routing stack is entered, thus removing the potential contention and route exhaustion.
Note that IPv6 stack was performing these checks, but too late (ie : after the route has been added, and after the potential garbage collect war)
v2: fix typo caught by Martin, thanks !
v3: exports tcp_mtu_to_mss(), caught by David, thanks !
--- net/ipv4/tcp_output.c | 1 + net/ipv6/tcp_ipv6.c | 19 +++++++++++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-)
net/ipv4/tcp_output.c +1 -0
@@ -1472,6 +1472,7 @@ int tcp_mtu_to_mss(struct sock *sk, intreturn __tcp_mtu_to_mss (sk, pmtu) - (tcp_sk (sk)->tcp_header_len -sizeof (struct tcphdr )); } +EXPORT_SYMBOL (tcp_mtu_to_mss);/* Inverse of above */ int tcp_mss_to_mtu (struct sock *sk,int mss)
net/ipv6/tcp_ipv6.c +17 -2
@@ -336,11 +336,20 @@ failure:static void tcp_v6_mtu_reduced (struct sock *sk) {struct dst_entry *dst; +u32 mtu;if ((1 << sk->sk_state) & (TCPF_LISTEN |TCPF_CLOSE ))return ; - dst =inet6_csk_update_pmtu (sk,READ_ONCE (tcp_sk (sk)->mtu_info)); + mtu =READ_ONCE (tcp_sk (sk)->mtu_info); + +/* Drop requests trying to increase our current mss. +* Check done in __ip6_rt_update_pmtu() is too late. +*/ +if (tcp_mtu_to_mss (sk, mtu) >=tcp_sk (sk)->mss_cache) +return ; + + dst =inet6_csk_update_pmtu (sk, mtu);if (!dst)return ;
@@ -419,6 +428,8 @@ static void tcp_v6_err(struct sk_buff *s }if (type ==ICMPV6_PKT_TOOBIG ) { +u32 mtu =ntohl (info); +/* We are not interested in TCP_LISTEN and open_requests * (SYN-ACKs send out by Linux are always <576bytes so * they should go through unfragmented).
@@ -429,7 +440,11 @@ static void tcp_v6_err(struct sk_buff *sif (!ip6_sk_accept_pmtu (sk)) goto out; -WRITE_ONCE (tp->mtu_info,ntohl (info)); +if (mtu <IPV6_MIN_MTU ) + goto out; + +WRITE_ONCE (tp->mtu_info, mtu); +if (!sock_owned_by_user (sk))tcp_v6_mtu_reduced (sk); else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
Greg Kroah-Hartman
maintainerPATCH 50/120 bpftool: Properly close va_list ap by va_end() on error
In reply to Greg Kroah-HartmanFrom: Gu Shengxian <[email protected]>
commit bc832065b60f973771ff3e657214bb21b559833c upstream.
va_list 'ap' was opened but not closed by va_end() in error case. It should be closed by va_end() before the return.
--- tools/bpf/bpftool/jit_disasm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/bpf/bpftool/jit_disasm.c +4 -2
@@ -51,11 +51,13 @@ static int fprintf_json(void *out, const {va_list ap;char *s; +int err;va_start (ap, fmt); -if (vasprintf (&s, fmt, ap) <0 ) -return -1 ; + err =vasprintf (&s, fmt, ap);va_end (ap); +if (err <0 ) +return -1 ;if (!oper_count) {int i;
Greg Kroah-Hartman
maintainerPATCH 51/120 udp: annotate data races around unix_sk(sk)->gso_size
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 18a419bad63b7f68a1979e28459782518e7b6bbe upstream.
Accesses to unix_sk(sk)->gso_size are lockless.
Add READ_ONCE()/WRITE_ONCE() around them.
BUG: KCSAN: data-race in udp_lib_setsockopt / udpv6_sendmsg
write to 0xffff88812d78f47c of 2 bytes by task 10849 on cpu 1:
udp_lib_setsockopt+0x3b3/0x710 net/ipv4/udp.c:2696 udpv6_setsockopt+0x63/0x90 net/ipv6/udp.c:1630 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3265 __sys_setsockopt+0x18f/0x200 net/socket.c:2104 __do_sys_setsockopt net/socket.c:2115 [inline] __se_sys_setsockopt net/socket.c:2112 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2112 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff88812d78f47c of 2 bytes by task 10852 on cpu 0:
udpv6_sendmsg+0x161/0x16b0 net/ipv6/udp.c:1299 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:642 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2337 ___sys_sendmsg net/socket.c:2391 [inline] __sys_sendmmsg+0x315/0x4b0 net/socket.c:2477 __do_sys_sendmmsg net/socket.c:2506 [inline] __se_sys_sendmmsg net/socket.c:2503 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2503 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x0000 -> 0x0005
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10852 Comm: syz-executor.0 Not tainted 5.13.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- net/ipv4/udp.c | 6 +++--- net/ipv6/udp.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/udp.c +3 -3
@@ -997,7 +997,7 @@ int udp_sendmsg(struct sock *sk, struct }ipcm_init_sk (&ipc, inet); - ipc.gso_size = up->gso_size; + ipc.gso_size =READ_ONCE (up->gso_size);if (msg->msg_controllen) { err =udp_cmsg_send (sk, msg, &ipc.gso_size);
@@ -2505,7 +2505,7 @@ int udp_lib_setsockopt(struct sock *sk,case UDP_SEGMENT :if (val <0 || val >USHRT_MAX )return -EINVAL ; - up->gso_size = val; +WRITE_ONCE (up->gso_size, val);break ;/*
@@ -2599,7 +2599,7 @@ int udp_lib_getsockopt(struct sock *sk,break ;case UDP_SEGMENT : - val = up->gso_size; + val =READ_ONCE (up->gso_size);break ;/* The following two cannot be changed on UDP sockets, the return is
net/ipv6/udp.c +1 -1
@@ -1175,7 +1175,7 @@ int udpv6_sendmsg(struct sock *sk, strucint (*getfrag)(void *,char *,int ,int ,int ,struct sk_buff *);ipcm6_init (&ipc6); - ipc6.gso_size = up->gso_size; + ipc6.gso_size =READ_ONCE (up->gso_size); ipc6.sockc.tsflags = sk->sk_tsflags;/* destination address check */
Greg Kroah-Hartman
maintainerPATCH 52/120 net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
commit 9992a078b1771da354ac1f9737e1e639b687caa2 upstream.
Commit 28e104d00281 ("net: ip_tunnel: fix mtu calculation") removed dev->hard_header_len subtraction when calculate MTU for tunnel devices as there is an overhead for device that has header_ops.
But there are ETHER tunnel devices, like gre_tap or erspan, which don't have header_ops but set dev->hard_header_len during setup. This makes pkts greater than (MTU - ETH_HLEN) could not be xmited. Fix it by subtracting the ETHER tunnel devices' dev->hard_header_len for MTU calculation.
--- net/ipv4/ip_tunnel.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
net/ipv4/ip_tunnel.c +18 -4
@@ -330,7 +330,7 @@ static int ip_tunnel_bind_dev(struct net } dev->needed_headroom = t_hlen + hlen; - mtu -= t_hlen; + mtu -= t_hlen + (dev->type ==ARPHRD_ETHER ? dev->hard_header_len :0 );if (mtu <IPV4_MIN_MTU ) mtu =IPV4_MIN_MTU ;
@@ -361,6 +361,9 @@ static struct ip_tunnel *ip_tunnel_creat t_hlen = nt->hlen +sizeof (struct iphdr ); dev->min_mtu =ETH_MIN_MTU ; dev->max_mtu =IP_MAX_MTU - t_hlen; +if (dev->type ==ARPHRD_ETHER ) + dev->max_mtu -= dev->hard_header_len; +ip_tunnel_add (itn, nt);return nt;
@@ -502,13 +505,18 @@ static int tnl_update_pmtu(struct net_de const struct iphdr *inner_iph) {struct ip_tunnel *tunnel =netdev_priv (dev); -int pkt_size = skb->len - tunnel->hlen; +int pkt_size;int mtu; -if (df) + pkt_size = skb->len - tunnel->hlen; + pkt_size -= dev->type ==ARPHRD_ETHER ? dev->hard_header_len :0 ; + +if (df) { mtu =dst_mtu (&rt->dst) - (sizeof (struct iphdr ) + tunnel->hlen); -else + mtu -= dev->type ==ARPHRD_ETHER ? dev->hard_header_len :0 ; + }else { mtu =skb_dst (skb) ?dst_mtu (skb_dst (skb)) : dev->mtu; + }skb_dst_update_pmtu_no_confirm (skb, mtu);
@@ -936,6 +944,9 @@ int __ip_tunnel_change_mtu(struct net_deint t_hlen = tunnel->hlen +sizeof (struct iphdr );int max_mtu =IP_MAX_MTU - t_hlen; +if (dev->type ==ARPHRD_ETHER ) + max_mtu -= dev->hard_header_len; +if (new_mtu <ETH_MIN_MTU )return -EINVAL ;
@@ -1113,6 +1124,9 @@ int ip_tunnel_newlink(struct net_deviceif (tb[IFLA_MTU ]) {unsigned int max =IP_MAX_MTU - (nt->hlen +sizeof (struct iphdr )); +if (dev->type ==ARPHRD_ETHER ) + max -= dev->hard_header_len; + mtu =clamp (dev->mtu, (unsigned int )ETH_MIN_MTU , max); }
Greg Kroah-Hartman
maintainerPATCH 53/120 igb: Fix use-after-free error during reset
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit 7b292608db23ccbbfbfa50cdb155d01725d7a52e ]
Cleans the next descriptor to watch (next_to_watch) when cleaning the TX ring.
Failure to do so can cause invalid memory accesses. If igb_poll() runs while the controller is reset this can lead to the driver try to free a skb that was already freed.
(The crash is harder to reproduce with the igb driver, but the same potential problem exists as the code is identical to igc)
--- drivers/net/ethernet/intel/igb/igb_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/igb/igb_main.c +2 -0
@@ -4684,6 +4684,8 @@ static void igb_clean_tx_ring(struct igb_ring *tx_ring) DMA_TO_DEVICE); } + tx_buffer->next_to_watch =NULL ; +/* move us one more past the eop_desc for start of next pkt */ tx_buffer++; i++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 54/120 ixgbe: Fix an error handling path in ixgbe_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit dd2aefcd5e37989ae5f90afdae44bbbf3a2990da ]
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it must be undone by a corresponding 'pci_disable_pcie_error_reporting()' call, as already done in the remove function.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +1 -0
@@ -10925,6 +10925,7 @@ err_ioremap: disable_dev = !test_and_set_bit (__IXGBE_DISABLED, &adapter->state);free_netdev (netdev); err_alloc_etherdev: +pci_disable_pcie_error_reporting (pdev);pci_release_mem_regions (pdev); err_pci_reg: err_dma:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/120 igb: Fix an error handling path in igb_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit fea03b1cebd653cd095f2e9a58cfe1c85661c363 ]
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it must be undone by a corresponding 'pci_disable_pcie_error_reporting()' call, as already done in the remove function.
--- drivers/net/ethernet/intel/igb/igb_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/igb/igb_main.c +1 -0
@@ -3495,6 +3495,7 @@ err_sw_init: err_ioremap:free_netdev (netdev); err_alloc_etherdev: +pci_disable_pcie_error_reporting (pdev);pci_release_mem_regions (pdev); err_pci_reg: err_dma:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/120 fm10k: Fix an error handling path in fm10k_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit e85e14d68f517ef12a5fb8123fff65526b35b6cd ]
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it must be undone by a corresponding 'pci_disable_pcie_error_reporting()' call, as already done in the remove function.
--- drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/fm10k/fm10k_pci.c +1 -0
@@ -2228,6 +2228,7 @@ err_sw_init: err_ioremap:free_netdev (netdev); err_alloc_netdev: +pci_disable_pcie_error_reporting (pdev);pci_release_mem_regions (pdev); err_pci_reg: err_dma:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/120 e1000e: Fix an error handling path in e1000_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 4589075608420bc49fcef6e98279324bf2bb91ae ]
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it must be undone by a corresponding 'pci_disable_pcie_error_reporting()' call, as already done in the remove function.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/e1000e/netdev.c +1 -0
@@ -7369,6 +7369,7 @@ err_flashmap: err_ioremap:free_netdev (netdev); err_alloc_etherdev: +pci_disable_pcie_error_reporting (pdev);pci_release_mem_regions (pdev); err_pci_reg: err_dma:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/120 iavf: Fix an error handling path in iavf_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit af30cbd2f4d6d66a9b6094e0aa32420bc8b20e08 ]
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it must be undone by a corresponding 'pci_disable_pcie_error_reporting()' call, as already done in the remove function.
--- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/i40evf/i40evf_main.c +1 -0
@@ -3735,6 +3735,7 @@ static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_ioremap:free_netdev (netdev); err_alloc_etherdev: +pci_disable_pcie_error_reporting (pdev);pci_release_regions (pdev); err_pci_reg: err_dma:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 59/120 igb: Check if num of q_vectors is smaller than max before array access
In reply to Greg Kroah-HartmanFrom: Aleksandr Loktionov <[email protected]>
[ Upstream commit 6c19d772618fea40d9681f259368f284a330fd90 ]
Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed beyond its size. It was fixed by using a local variable num_q_vectors as a limit for loop index, and ensure that num_q_vectors is not bigger than MAX_Q_VECTORS.
--- drivers/net/ethernet/intel/igb/igb_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/igb/igb_main.c +8 -1
@@ -938,6 +938,7 @@ static void igb_configure_msix(struct igb_adapter *adapter)**/ static int igb_request_msix (struct igb_adapter *adapter) { +unsigned int num_q_vectors = adapter->num_q_vectors;struct net_device *netdev = adapter->netdev;int i, err =0 , vector =0 , free_vector =0 ;
@@ -946,7 +947,13 @@ static int igb_request_msix(struct igb_adapter *adapter)if (err) goto err_out; -for (i =0 ; i < adapter->num_q_vectors; i++) { +if (num_q_vectors >MAX_Q_VECTORS ) { + num_q_vectors =MAX_Q_VECTORS ; +dev_warn (&adapter->pdev->dev, +"The number of queue vectors (%d) is higher than max allowed (%d)\n" , + adapter->num_q_vectors,MAX_Q_VECTORS ); + } +for (i =0 ; i < num_q_vectors; i++) {struct igb_q_vector *q_vector = adapter->q_vector[i]; vector++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/120 igb: Fix position of assignment to *ring
In reply to Greg Kroah-HartmanFrom: Jedrzej Jagielski <[email protected]>
[ Upstream commit 382a7c20d9253bcd5715789b8179528d0f3de72c ]
Assignment to *ring should be done after correctness check of the argument queue.
--- drivers/net/ethernet/intel/igb/igb_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/igb/igb_main.c +2 -1
@@ -1692,14 +1692,15 @@ static bool is_any_txtime_enabled(struct igb_adapter *adapter)**/ static void igb_config_tx_modes (struct igb_adapter *adapter,int queue) { -struct igb_ring *ring = adapter->tx_ring[queue];struct net_device *netdev = adapter->netdev;struct e1000_hw *hw = &adapter->hw; +struct igb_ring *ring;u32 tqavcc, tqavctrl;u16 value;WARN_ON (hw->mac.type != e1000_i210);WARN_ON (queue <0 || queue >1 ); + ring = adapter->tx_ring[queue];/* If any of the Qav features is enabled, configure queues as SR and * with HIGH PRIO. If none is, then configure them with LOW PRIO and
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/120 ipv6: fix disable_policy for fwd packets
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
[ Upstream commit ccd27f05ae7b8ebc40af5b004e94517a919aa862 ]
The goal of commit df789fe75206 ("ipv6: Provide ipv6 version of "disable_policy" sysctl") was to have the disable_policy from ipv4 available on ipv6.
However, it's not exactly the same mechanism. On IPv4, all packets coming from an interface, which has disable_policy set, bypass the policy check. For ipv6, this is done only for local packets, ie for packets destinated to an address configured on the incoming interface.
Let's align ipv6 with ipv4 so that the 'disable_policy' sysctl has the same effect for both protocols.
My first approach was to create a new kind of route cache entries, to be able to set DST_NOPOLICY without modifying routes. This would have added a lot of code. Because the local delivery path is already handled, I choose to focus on the forwarding path to minimize code churn.
--- net/ipv6/ip6_output.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/ip6_output.c +3 -1
@@ -459,7 +459,9 @@ int ip6_forward(struct sk_buff *skb)if (skb_warn_if_lro (skb)) goto drop; -if (!xfrm6_policy_check (NULL ,XFRM_POLICY_FWD , skb)) { +if (!net->ipv6.devconf_all->disable_policy && + !idev->cnf.disable_policy && + !xfrm6_policy_check (NULL ,XFRM_POLICY_FWD , skb)) {__IP6_INC_STATS (net, idev,IPSTATS_MIB_INDISCARDS ); goto drop; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/120 nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
In reply to Greg Kroah-HartmanFrom: Casey Chen <[email protected]>
[ Upstream commit 251ef6f71be2adfd09546a26643426fe62585173 ]
nvme_dev_remove_admin could free dev->admin_q and the admin_tagset while they are being accessed by nvme_dev_disable(), which can be called by nvme_reset_work via nvme_remove_dead_ctrl.
Commit cb4bfda62afa ("nvme-pci: fix hot removal during error handling") intended to avoid requests being stuck on a removed controller by killing the admin queue. But the later fix c8e9e9b7646e ("nvme-pci: unquiesce admin queue on shutdown"), together with nvme_dev_disable(dev, true) right before nvme_dev_remove_admin() could help dispatch requests and fail them early, so we don't need nvme_dev_remove_admin() any more.
--- drivers/nvme/host/pci.c | 1 - 1 file changed, 1 deletion(-)
drivers/nvme/host/pci.c +0 -1
@@ -2605,7 +2605,6 @@ static void nvme_remove(struct pci_dev *pdev)if (!pci_device_is_present (pdev)) {nvme_change_ctrl_state (&dev->ctrl,NVME_CTRL_DEAD );nvme_dev_disable (dev, true); -nvme_dev_remove_admin (dev); }flush_work (&dev->ctrl.reset_work);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/120 perf map: Fix dso->nsinfo refcounting
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit 2d6b74baa7147251c30a46c4996e8cc224aa2dc5 ]
ASan reports a memory leak of nsinfo during the execution of
# perf test "31: Lookup mmap thread"
The leak is caused by a refcounted variable being replaced without dropping the refcount.
This patch makes sure that the refcnt of nsinfo is decreased whenever a refcounted variable is replaced with a new value.
--- tools/perf/util/map.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/util/map.c +2 -0
@@ -209,6 +209,8 @@ struct map *map__new(struct machine *machine, u64 start, u64 len,if (!(prot &PROT_EXEC ))dso__set_loaded (dso); } + +nsinfo__put (dso->nsinfo); dso->nsinfo = nsi;dso__put (dso); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/120 perf probe: Fix dso->nsinfo refcounting
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit dedeb4be203b382ba7245d13079bc3b0f6d40c65 ]
ASan reports a memory leak of nsinfo during the execution of:
# perf test "31: Lookup mmap thread".
The leak is caused by a refcounted variable being replaced without dropping the refcount.
This patch makes sure that the refcnt of nsinfo is decreased whenever a refcounted variable is replaced with a new value.
--- tools/perf/util/probe-event.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/perf/util/probe-event.c +3 -1
@@ -184,8 +184,10 @@ struct map *get_target_map(const char *target, struct nsinfo *nsi, bool user)struct map *map; map =dso__new_map (target); -if (map && map->dso) +if (map && map->dso) { +nsinfo__put (map->dso->nsinfo); map->dso->nsinfo =nsinfo__get (nsi); + }return map; }else {return kernel_get_module_map (target);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/120 perf test session_topology: Delete session->evlist
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit 233f2dc1c284337286f9a64c0152236779a42f6c ]
ASan reports a memory leak related to session->evlist while running:
# perf test "41: Session topology".
When perf_data is in write mode, session->evlist is owned by the caller, which should also take care of deleting it.
This patch adds the missing evlist__delete().
--- tools/perf/tests/topology.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/tests/topology.c +1 -0
@@ -52,6 +52,7 @@ static int session_write_header(char *path)TEST_ASSERT_VAL ("failed to write header" , !perf_session__write_header (session, session->evlist, data.file.fd, true)); +evlist__delete (session->evlist);perf_session__delete (session);return 0 ;
Signature · 1 line
2.30.2
Re: [PATCH 4.19 065/120] perf test session_topology: Delete session->evlist
Quoted 14 lines · Greg Kroah-Hartman
From: Riccardo Mancini <[email protected]>
[ Upstream commit
233f2dc1c284337286f9a64c0152236779a42f6c]ASan reports a memory leak related to
session->evlistwhile running:# perf test "41: Session topology".When
perf_datais in write mode,session->evlistis owned by the caller, which should also take care of deleting it.This patch adds the missing
evlist__delete().
Quoted 11 lines
Signed-off-by Riccardo Mancini <[email protected]>Fixes c84974ed9fb67293 ("perf test: Add entry to test cpu topology")Cc Ian Rogers <[email protected]>Cc Jiri Olsa <[email protected]>Cc Kan Liang <[email protected]>Cc Mark Rutland <[email protected]>Cc Namhyung Kim <[email protected]>Cc Peter Zijlstra <[email protected]>Link http://lore.kernel.org/lkml/822f741f06eb25250fb60686cf30a35f447e9e91.1626343282.git.rickyman7@gmail.com open hereSigned-off-by Arnaldo Carvalho de Melo <[email protected]>Signed-off-by Sasha Levin <[email protected]>
perf build failed on 4.19, 4.14, 4.9 and 4.4 due to these warnings / errors for all the architectures.
tools/perf/tests/topology.c static int session_write_header(char *path) · line 55
Quoted 12 lines
tools/perf/tests/topology.c | 1 + 1 file changed, 1 insertion(+)tools/perf/tests/topology.c +1
-0@@ -52,6 +52,7 @@ static int session_write_header(char *path)TEST_ASSERT_VAL ("failed to write header" , !perf_session__write_header (session, session->evlist, data.file.fd, true)); +evlist__delete (session->evlist);
perf-in.o: In function `session_write_header':tools/perf/tests/topology.c:55: undefined reference to `evlist__delete'
collect2: error: ld returned 1 exit status
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerRe: [PATCH 4.19 065/120] perf test session_topology: Delete session->evlist
Quoted 29 lines · Naresh Kamboju
Quoted 14 lines · Greg Kroah-Hartman
From: Riccardo Mancini <[email protected]>
[ Upstream commit
233f2dc1c284337286f9a64c0152236779a42f6c]ASan reports a memory leak related to
session->evlistwhile running:# perf test "41: Session topology".When
perf_datais in write mode,session->evlistis owned by the caller, which should also take care of deleting it.This patch adds the missing
evlist__delete().Quoted 11 lines
Signed-off-by Riccardo Mancini <[email protected]>Fixes c84974ed9fb67293 ("perf test: Add entry to test cpu topology")Cc Ian Rogers <[email protected]>Cc Jiri Olsa <[email protected]>Cc Kan Liang <[email protected]>Cc Mark Rutland <[email protected]>Cc Namhyung Kim <[email protected]>Cc Peter Zijlstra <[email protected]>Link http://lore.kernel.org/lkml/822f741f06eb25250fb60686cf30a35f447e9e91.1626343282.git.rickyman7@gmail.com open hereSigned-off-by Arnaldo Carvalho de Melo <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 2 lines
perf build failed on 4.19, 4.14, 4.9 and 4.4 due to these warnings / errors for all the architectures.
Now dropped from all of these trees. Let me go push out -rc2 for all of them as well...
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 66/120 perf dso: Fix memory leak in dso__new_map()
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit 581e295a0f6b5c2931d280259fbbfff56959faa9 ]
ASan reports a memory leak when running:
# perf test "65: maps__merge_in".
The causes of the leaks are two, this patch addresses only the first one, which is related to dso__new_map().
The bug is that dso__new_map() creates a new dso but never decreases the refcount it gets from creating it.
This patch adds the missing dso__put().
--- tools/perf/util/dso.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/perf/util/dso.c +3 -1
@@ -1025,8 +1025,10 @@ struct map *dso__new_map(const char *name)struct map *map =NULL ;struct dso *dso =dso__new (name); -if (dso) +if (dso) { map =map__new2 (0 , dso); +dso__put (dso); + }return map; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/120 perf script: Fix memory threads and cpus leaks on exit
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit faf3ac305d61341c74e5cdd9e41daecce7f67bfe ]
ASan reports several memory leaks while running:
# perf test "82: Use vfs_getname probe to get syscall args filenames"
Two of these are caused by some refcounts not being decreased on perf-script exit, namely script.threads and script.cpus.
This patch adds the missing __put calls in a new perf_script__exit function, which is called at the end of cmd_script.
This patch concludes the fixes of all remaining memory leaks in perf test "82: Use vfs_getname probe to get syscall args filenames".
--- tools/perf/builtin-script.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/perf/builtin-script.c +7 -0
@@ -2207,6 +2207,12 @@ static void perf_script__exit_per_event_dump_stats(struct perf_script *script) } } +static void perf_script__exit (struct perf_script *script) +{ +perf_thread_map__put (script->threads); +perf_cpu_map__put (script->cpus); +} +static int __cmd_script (struct perf_script *script) {int ret;
@@ -3534,6 +3540,7 @@ out_delete:perf_evlist__free_stats (session->evlist);perf_session__delete (session); +perf_script__exit (&script);if (script_started)cleanup_scripting ();
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/120 perf lzma: Close lzma stream on exit
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit f8cbb0f926ae1e1fb5f9e51614e5437560ed4039 ]
ASan reports memory leaks when running:
# perf test "88: Check open filename arg using perf trace + vfs_getname"
One of these is caused by the lzma stream never being closed inside lzma_decompress_to_file().
This patch adds the missing lzma_end().
--- tools/perf/util/lzma.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
tools/perf/util/lzma.c +5 -3
@@ -68,7 +68,7 @@ int lzma_decompress_to_file(const char *input, int output_fd)if (ferror (infile)) {pr_err ("lzma: read error: %s\n" ,strerror (errno)); - goto err_fclose; + goto err_lzma_end; }if (feof (infile))
@@ -82,7 +82,7 @@ int lzma_decompress_to_file(const char *input, int output_fd)if (writen (output_fd, buf_out, write_size) != write_size) {pr_err ("lzma: write error: %s\n" ,strerror (errno)); - goto err_fclose; + goto err_lzma_end; } strm.next_out = buf_out;
@@ -94,11 +94,13 @@ int lzma_decompress_to_file(const char *input, int output_fd)break ;pr_err ("lzma: failed %s\n" ,lzma_strerror (ret)); - goto err_fclose; + goto err_lzma_end; } } err =0 ; +err_lzma_end: +lzma_end (&strm); err_fclose:fclose (infile);return err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/120 perf test bpf: Free obj_buf
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit 937654ce497fb6e977a8c52baee5f7d9616302d9 ]
ASan reports some memory leaks when running:
# perf test "42: BPF filter"
The first of these leaks is caused by obj_buf never being deallocated in __test__bpf.
This patch adds the missing free.
--- tools/perf/tests/bpf.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/tests/bpf.c +2 -0
@@ -1,5 +1,6 @@#include <errno.h> #include <stdio.h> +#include <stdlib.h> #include <sys/epoll.h> #include <sys/types.h> #include <sys/stat.h>
@@ -277,6 +278,7 @@ static int __test__bpf(int idx) } out: +free (obj_buf);bpf__clear ();return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/120 perf probe-file: Delete namelist in del_events() on the error path
In reply to Greg Kroah-HartmanFrom: Riccardo Mancini <[email protected]>
[ Upstream commit e0fa7ab42232e742dcb3de9f3c1f6127b5adc019 ]
ASan reports some memory leaks when running:
# perf test "42: BPF filter"
This second leak is caused by a strlist not being dellocated on error inside probe_file__del_events.
This patch adds a goto label before the deallocation and makes the error path jump to it.
--- tools/perf/util/probe-file.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/probe-file.c +2 -2
@@ -342,11 +342,11 @@ int probe_file__del_events(int fd, struct strfilter *filter) ret =probe_file__get_events (fd, filter, namelist);if (ret <0 ) -return ret; + goto out; ret =probe_file__del_strlist (fd, namelist); +out:strlist__delete (namelist); -return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/120 spi: mediatek: fix fifo rx mode
In reply to Greg Kroah-HartmanFrom: Peter Hess <[email protected]>
[ Upstream commit 3a70dd2d050331ee4cf5ad9d5c0a32d83ead9a43 ]
In FIFO mode were two problems:
- RX mode was never handled and
- in this case the tx_buf pointer was NULL and caused an exception
fix this by handling RX mode in mtk_spi_fifo_transfer
--- drivers/spi/spi-mt65xx.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/spi/spi-mt65xx.c +13 -3
@@ -392,13 +392,23 @@ static int mtk_spi_fifo_transfer(struct spi_master *master,mtk_spi_setup_packet (master); cnt = xfer->len /4 ; -iowrite32_rep (mdata->base +SPI_TX_DATA_REG , xfer->tx_buf, cnt); +if (xfer->tx_buf) +iowrite32_rep (mdata->base +SPI_TX_DATA_REG , xfer->tx_buf, cnt); + +if (xfer->rx_buf) +ioread32_rep (mdata->base +SPI_RX_DATA_REG , xfer->rx_buf, cnt); remainder = xfer->len %4 ;if (remainder >0 ) { reg_val =0 ; -memcpy (®_val, xfer->tx_buf + (cnt *4 ), remainder); -writel (reg_val, mdata->base +SPI_TX_DATA_REG ); +if (xfer->tx_buf) { +memcpy (®_val, xfer->tx_buf + (cnt *4 ), remainder); +writel (reg_val, mdata->base +SPI_TX_DATA_REG ); + } +if (xfer->rx_buf) { + reg_val =readl (mdata->base +SPI_RX_DATA_REG ); +memcpy (xfer->rx_buf + (cnt *4 ), ®_val, remainder); + } }mtk_spi_enable_transfer (master);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/120 liquidio: Fix unintentional sign extension issue on left shift of u16
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e7efc2ce3d0789cd7c21b70ff00cd7838d382639 ]
Shifting the u16 integer oct->pcie_port by CN23XX_PKT_INPUT_CTL_MAC_NUM_POS
(29) bits will be promoted to a 32 bit signed int and then sign-extended to a u64. In the cases where oct->pcie_port where bit 2 is set (e.g. 3..7) the shifted value will be sign extended and the top 32 bits of the result will be set.
Fix this by casting the u16 values to a u64 before the 29 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
--- drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +1 -1
@@ -420,7 +420,7 @@ static int cn23xx_pf_setup_global_input_regs(struct octeon_device *oct)* bits 32:47 indicate the PVF num. */ for (q_no =0 ; q_no < ern; q_no++) { - reg_val = oct->pcie_port <<CN23XX_PKT_INPUT_CTL_MAC_NUM_POS ; + reg_val = (u64 )oct->pcie_port <<CN23XX_PKT_INPUT_CTL_MAC_NUM_POS ;/* for VF assigned queues. */ if (q_no < oct->sriov_info.pf_srn) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/120 s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 91091656252f5d6d8c476e0c92776ce9fae7b445 ]
Currently array jit->seen_reg[r1] is being accessed before the range checking of index r1. The range changing on r1 should be performed first since it will avoid any potential out-of-range accesses on the array seen_reg[] and also it is more optimal to perform checks on r1 before fetching data from the array. Fix this by swapping the order of the checks before the array access.
--- arch/s390/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/net/bpf_jit_comp.c +1 -1
@@ -113,7 +113,7 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) {u32 r1 = reg2hex[b1]; -if (!jit->seen_reg[r1] && r1 >=6 && r1 <=15 ) +if (r1 >=6 && r1 <=15 && !jit->seen_reg[r1]) jit->seen_reg[r1] =1 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/120 bpftool: Check malloc return value in mount_bpffs_for_pin
In reply to Greg Kroah-HartmanFrom: Tobias Klauser <[email protected]>
[ Upstream commit d444b06e40855219ef38b5e9286db16d435f06dc ]
Fix and add a missing NULL check for the prior malloc() call.
--- tools/bpf/bpftool/common.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/bpf/bpftool/common.c +5 -0
@@ -182,6 +182,11 @@ int do_pin_fd(int fd, const char *name) goto out; file =malloc (strlen (name) +1 ); +if (!file) { +p_err ("mem alloc failed" ); +return -1 ; + } +strcpy (file, name); dir =dirname (file);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/120 net: fix uninit-value in caif_seqpkt_sendmsg
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
[ Upstream commit 991e634360f2622a683b48dfe44fe6d9cb765a09 ]
When nr_segs equal to zero in iovec_from_user, the object msg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg which is defined in ___sys_sendmsg. So we cann't just judge msg->msg_iter.iov->base directlly. We can use nr_segs to judge msg in caif_seqpkt_sendmsg whether has data buffers.
=====================================================
BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343 ___sys_sendmsg net/socket.c:2397 [inline] __sys_sendmmsg+0x808/0xc90 net/socket.c:2480 __compat_sys_sendmmsg net/compat.c:656 [inline]
--- net/caif/caif_socket.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/caif/caif_socket.c +2 -1
@@ -539,7 +539,8 @@ static int caif_seqpkt_sendmsg(struct socket *sock, struct msghdr *msg, goto err; ret = -EINVAL ; -if (unlikely (msg->msg_iter.iov->iov_base ==NULL )) +if (unlikely (msg->msg_iter.nr_segs ==0 ) || +unlikely (msg->msg_iter.iov->iov_base ==NULL )) goto err; noblock = msg->msg_flags &MSG_DONTWAIT ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/120 net: decnet: Fix sleeping inside in af_decnet
In reply to Greg Kroah-HartmanFrom: Yajun Deng <[email protected]>
[ Upstream commit 5f119ba1d5771bbf46d57cff7417dcd84d3084ba ]
The release_sock() is blocking function, it would change the state after sleeping. use wait_woken() instead.
--- net/decnet/af_decnet.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-)
net/decnet/af_decnet.c +12 -15
@@ -823,7 +823,7 @@ static int dn_auto_bind(struct socket *sock)static int dn_confirm_accept (struct sock *sk,long *timeo,gfp_t allocation) {struct dn_scp *scp =DN_SK (sk); -DEFINE_WAIT (wait); +DEFINE_WAIT_FUNC (wait, woken_wake_function);int err;if (scp->state !=DN_CR )
@@ -833,11 +833,11 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation) scp->segsize_loc =dst_metric_advmss (__sk_dst_get (sk));dn_send_conn_conf (sk, allocation); -prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); +add_wait_queue (sk_sleep (sk), &wait);for (;;) {release_sock (sk);if (scp->state ==DN_CC ) - *timeo =schedule_timeout (*timeo); + *timeo =wait_woken (&wait,TASK_INTERRUPTIBLE , *timeo);lock_sock (sk); err =0 ;if (scp->state ==DN_RUN )
@@ -851,9 +851,8 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation) err = -EAGAIN ;if (!*timeo)break ; -prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); } -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait);if (err ==0 ) { sk->sk_socket->state =SS_CONNECTED ; }else if (scp->state !=DN_CC ) {
@@ -865,7 +864,7 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)static int dn_wait_run (struct sock *sk,long *timeo) {struct dn_scp *scp =DN_SK (sk); -DEFINE_WAIT (wait); +DEFINE_WAIT_FUNC (wait, woken_wake_function);int err =0 ;if (scp->state ==DN_RUN )
@@ -874,11 +873,11 @@ static int dn_wait_run(struct sock *sk, long *timeo)if (!*timeo)return -EALREADY ; -prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); +add_wait_queue (sk_sleep (sk), &wait);for (;;) {release_sock (sk);if (scp->state ==DN_CI || scp->state ==DN_CC ) - *timeo =schedule_timeout (*timeo); + *timeo =wait_woken (&wait,TASK_INTERRUPTIBLE , *timeo);lock_sock (sk); err =0 ;if (scp->state ==DN_RUN )
@@ -892,9 +891,8 @@ static int dn_wait_run(struct sock *sk, long *timeo) err = -ETIMEDOUT ;if (!*timeo)break ; -prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); } -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait); out:if (err ==0 ) { sk->sk_socket->state =SS_CONNECTED ;
@@ -1039,16 +1037,16 @@ static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)static struct sk_buff *dn_wait_for_connect (struct sock *sk,long *timeo) { -DEFINE_WAIT (wait); +DEFINE_WAIT_FUNC (wait, woken_wake_function);struct sk_buff *skb =NULL ;int err =0 ; -prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); +add_wait_queue (sk_sleep (sk), &wait);for (;;) {release_sock (sk); skb =skb_dequeue (&sk->sk_receive_queue);if (skb ==NULL ) { - *timeo =schedule_timeout (*timeo); + *timeo =wait_woken (&wait,TASK_INTERRUPTIBLE , *timeo); skb =skb_dequeue (&sk->sk_receive_queue); }lock_sock (sk);
@@ -1063,9 +1061,8 @@ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo) err = -EAGAIN ;if (!*timeo)break ; -prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); } -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait);return skb ==NULL ?ERR_PTR (err) : skb; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/120 KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit bc4188a2f56e821ea057aca6bf444e138d06c252 ]
vcpu_put is not called if the user copy fails. This can result in preempt notifier corruption and crashes, among other issues.
--- arch/powerpc/kvm/powerpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kvm/powerpc.c +2 -2
@@ -1995,9 +1995,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, {struct kvm_enable_cap cap; r = -EFAULT ; -vcpu_load (vcpu);if (copy_from_user (&cap, argp,sizeof (cap))) goto out; +vcpu_load (vcpu); r =kvm_vcpu_ioctl_enable_cap (vcpu, &cap);vcpu_put (vcpu);break ;
@@ -2021,9 +2021,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,case KVM_DIRTY_TLB : {struct kvm_dirty_tlb dirty; r = -EFAULT ; -vcpu_load (vcpu);if (copy_from_user (&dirty, argp,sizeof (dirty))) goto out; +vcpu_load (vcpu); r =kvm_vcpu_ioctl_dirty_tlb (vcpu, &dirty);vcpu_put (vcpu);break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/120 netrom: Decrease sock refcount when sock timers expire
In reply to Greg Kroah-HartmanFrom: Nguyen Dinh Phi <[email protected]>
[ Upstream commit 517a16b1a88bdb6b530f48d5d153478b2552d9a8 ]
Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use sock timer API. It replaces mod_timer() by sk_reset_timer(), and del_timer() by sk_stop_timer().
Function sk_reset_timer() will increase the refcount of sock if it is called on an inactive timer, hence, in case the timer expires, we need to decrease the refcount ourselves in the handler, otherwise, the sock refcount will be unbalanced and the sock will never be freed.
--- net/netrom/nr_timer.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
net/netrom/nr_timer.c +11 -9
@@ -124,11 +124,9 @@ static void nr_heartbeat_expiry(struct timer_list *t)is accepted() it isn't 'dead' so doesn't get removed. */ if (sock_flag (sk,SOCK_DESTROY ) || (sk->sk_state ==TCP_LISTEN &&sock_flag (sk,SOCK_DEAD ))) { -sock_hold (sk);bh_unlock_sock (sk);nr_destroy_socket (sk); -sock_put (sk); -return ; + goto out; }break ;
@@ -149,6 +147,8 @@ static void nr_heartbeat_expiry(struct timer_list *t)nr_start_heartbeat (sk);bh_unlock_sock (sk); +out: +sock_put (sk); }static void nr_t2timer_expiry (struct timer_list *t)
@@ -162,6 +162,7 @@ static void nr_t2timer_expiry(struct timer_list *t)nr_enquiry_response (sk); }bh_unlock_sock (sk); +sock_put (sk); }static void nr_t4timer_expiry (struct timer_list *t)
@@ -172,6 +173,7 @@ static void nr_t4timer_expiry(struct timer_list *t)bh_lock_sock (sk);nr_sk (sk)->condition &= ~NR_COND_PEER_RX_BUSY ;bh_unlock_sock (sk); +sock_put (sk); }static void nr_idletimer_expiry (struct timer_list *t)
@@ -200,6 +202,7 @@ static void nr_idletimer_expiry(struct timer_list *t)sock_set_flag (sk,SOCK_DEAD ); }bh_unlock_sock (sk); +sock_put (sk); }static void nr_t1timer_expiry (struct timer_list *t)
@@ -212,8 +215,7 @@ static void nr_t1timer_expiry(struct timer_list *t)case NR_STATE_1 :if (nr->n2count == nr->n2) {nr_disconnect (sk,ETIMEDOUT ); -bh_unlock_sock (sk); -return ; + goto out; }else { nr->n2count++;nr_write_internal (sk,NR_CONNREQ );
@@ -223,8 +225,7 @@ static void nr_t1timer_expiry(struct timer_list *t)case NR_STATE_2 :if (nr->n2count == nr->n2) {nr_disconnect (sk,ETIMEDOUT ); -bh_unlock_sock (sk); -return ; + goto out; }else { nr->n2count++;nr_write_internal (sk,NR_DISCREQ );
@@ -234,8 +235,7 @@ static void nr_t1timer_expiry(struct timer_list *t)case NR_STATE_3 :if (nr->n2count == nr->n2) {nr_disconnect (sk,ETIMEDOUT ); -bh_unlock_sock (sk); -return ; + goto out; }else { nr->n2count++;nr_requeue_frames (sk);
@@ -244,5 +244,7 @@ static void nr_t1timer_expiry(struct timer_list *t) }nr_start_t1timer (sk); +out:bh_unlock_sock (sk); +sock_put (sk); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 79/120 scsi: iscsi: Fix iface sysfs attr detection
In reply to Greg Kroah-HartmanFrom: Mike Christie <[email protected]>
[ Upstream commit e746f3451ec7f91dcc9fd67a631239c715850a34 ]
A ISCSI_IFACE_PARAM can have the same value as a ISCSI_NET_PARAM so when iscsi_iface_attr_is_visible tries to figure out the type by just checking the value, we can collide and return the wrong type. When we call into the driver we might not match and return that we don't want attr visible in sysfs. The patch fixes this by setting the type when we figure out what the param is.
--- drivers/scsi/scsi_transport_iscsi.c | 90 +++++++++++------------------ 1 file changed, 34 insertions(+), 56 deletions(-)
drivers/scsi/scsi_transport_iscsi.c +34 -56
@@ -427,39 +427,10 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, struct device *dev = container_of(kobj, struct device, kobj);struct iscsi_iface *iface =iscsi_dev_to_iface (dev);struct iscsi_transport *t = iface->transport; -int param; -int param_type; +int param =-1 ;if (attr == &dev_attr_iface_enabled.attr) param =ISCSI_NET_PARAM_IFACE_ENABLE ; -else if (attr == &dev_attr_iface_vlan_id.attr) - param =ISCSI_NET_PARAM_VLAN_ID ; -else if (attr == &dev_attr_iface_vlan_priority.attr) - param =ISCSI_NET_PARAM_VLAN_PRIORITY ; -else if (attr == &dev_attr_iface_vlan_enabled.attr) - param =ISCSI_NET_PARAM_VLAN_ENABLED ; -else if (attr == &dev_attr_iface_mtu.attr) - param =ISCSI_NET_PARAM_MTU ; -else if (attr == &dev_attr_iface_port.attr) - param =ISCSI_NET_PARAM_PORT ; -else if (attr == &dev_attr_iface_ipaddress_state.attr) - param =ISCSI_NET_PARAM_IPADDR_STATE ; -else if (attr == &dev_attr_iface_delayed_ack_en.attr) - param =ISCSI_NET_PARAM_DELAYED_ACK_EN ; -else if (attr == &dev_attr_iface_tcp_nagle_disable.attr) - param =ISCSI_NET_PARAM_TCP_NAGLE_DISABLE ; -else if (attr == &dev_attr_iface_tcp_wsf_disable.attr) - param =ISCSI_NET_PARAM_TCP_WSF_DISABLE ; -else if (attr == &dev_attr_iface_tcp_wsf.attr) - param =ISCSI_NET_PARAM_TCP_WSF ; -else if (attr == &dev_attr_iface_tcp_timer_scale.attr) - param =ISCSI_NET_PARAM_TCP_TIMER_SCALE ; -else if (attr == &dev_attr_iface_tcp_timestamp_en.attr) - param =ISCSI_NET_PARAM_TCP_TIMESTAMP_EN ; -else if (attr == &dev_attr_iface_cache_id.attr) - param =ISCSI_NET_PARAM_CACHE_ID ; -else if (attr == &dev_attr_iface_redirect_en.attr) - param =ISCSI_NET_PARAM_REDIRECT_EN ;else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) param =ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO ;else if (attr == &dev_attr_iface_header_digest.attr)
@@ -496,6 +467,38 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, param =ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN ; else if (attr == &dev_attr_iface_initiator_name.attr) param =ISCSI_IFACE_PARAM_INITIATOR_NAME ; + +if (param !=-1 ) +return t->attr_is_visible (ISCSI_IFACE_PARAM , param); + +if (attr == &dev_attr_iface_vlan_id.attr) + param =ISCSI_NET_PARAM_VLAN_ID ; +else if (attr == &dev_attr_iface_vlan_priority.attr) + param =ISCSI_NET_PARAM_VLAN_PRIORITY ; +else if (attr == &dev_attr_iface_vlan_enabled.attr) + param =ISCSI_NET_PARAM_VLAN_ENABLED ; +else if (attr == &dev_attr_iface_mtu.attr) + param =ISCSI_NET_PARAM_MTU ; +else if (attr == &dev_attr_iface_port.attr) + param =ISCSI_NET_PARAM_PORT ; +else if (attr == &dev_attr_iface_ipaddress_state.attr) + param =ISCSI_NET_PARAM_IPADDR_STATE ; +else if (attr == &dev_attr_iface_delayed_ack_en.attr) + param =ISCSI_NET_PARAM_DELAYED_ACK_EN ; +else if (attr == &dev_attr_iface_tcp_nagle_disable.attr) + param =ISCSI_NET_PARAM_TCP_NAGLE_DISABLE ; +else if (attr == &dev_attr_iface_tcp_wsf_disable.attr) + param =ISCSI_NET_PARAM_TCP_WSF_DISABLE ; +else if (attr == &dev_attr_iface_tcp_wsf.attr) + param =ISCSI_NET_PARAM_TCP_WSF ; +else if (attr == &dev_attr_iface_tcp_timer_scale.attr) + param =ISCSI_NET_PARAM_TCP_TIMER_SCALE ; +else if (attr == &dev_attr_iface_tcp_timestamp_en.attr) + param =ISCSI_NET_PARAM_TCP_TIMESTAMP_EN ; +else if (attr == &dev_attr_iface_cache_id.attr) + param =ISCSI_NET_PARAM_CACHE_ID ; +else if (attr == &dev_attr_iface_redirect_en.attr) + param =ISCSI_NET_PARAM_REDIRECT_EN ;else if (iface->iface_type ==ISCSI_IFACE_TYPE_IPV4 ) {if (attr == &dev_attr_ipv4_iface_ipaddress.attr) param =ISCSI_NET_PARAM_IPV4_ADDR ;
@@ -586,32 +589,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,return 0 ; } -switch (param) { -case ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO : -case ISCSI_IFACE_PARAM_HDRDGST_EN : -case ISCSI_IFACE_PARAM_DATADGST_EN : -case ISCSI_IFACE_PARAM_IMM_DATA_EN : -case ISCSI_IFACE_PARAM_INITIAL_R2T_EN : -case ISCSI_IFACE_PARAM_DATASEQ_INORDER_EN : -case ISCSI_IFACE_PARAM_PDU_INORDER_EN : -case ISCSI_IFACE_PARAM_ERL : -case ISCSI_IFACE_PARAM_MAX_RECV_DLENGTH : -case ISCSI_IFACE_PARAM_FIRST_BURST : -case ISCSI_IFACE_PARAM_MAX_R2T : -case ISCSI_IFACE_PARAM_MAX_BURST : -case ISCSI_IFACE_PARAM_CHAP_AUTH_EN : -case ISCSI_IFACE_PARAM_BIDI_CHAP_EN : -case ISCSI_IFACE_PARAM_DISCOVERY_AUTH_OPTIONAL : -case ISCSI_IFACE_PARAM_DISCOVERY_LOGOUT_EN : -case ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN : -case ISCSI_IFACE_PARAM_INITIATOR_NAME : - param_type =ISCSI_IFACE_PARAM ; -break ; -default : - param_type =ISCSI_NET_PARAM ; - } - -return t->attr_is_visible (param_type, param); +return t->attr_is_visible (ISCSI_NET_PARAM , param); }static struct attribute *iscsi_iface_attrs[] = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 80/120 scsi: target: Fix protect handling in WRITE SAME(32)
In reply to Greg Kroah-HartmanFrom: Dmitry Bogdanov <[email protected]>
[ Upstream commit 6d8e7e7c932162bccd06872362751b0e1d76f5af ]
WRITE SAME(32) command handling reads WRPROTECT at the wrong offset in 1st byte instead of 10th byte.
--- drivers/target/target_core_sbc.c | 35 ++++++++++++++++---------------- 1 file changed, 17 insertions(+), 18 deletions(-)
drivers/target/target_core_sbc.c +17 -18
@@ -38,7 +38,7 @@#include "target_core_alua.h" static sense_reason_t -sbc_check_prot (struct se_device *,struct se_cmd *,unsigned char *,u32 ,bool ); +sbc_check_prot (struct se_device *,struct se_cmd *,unsigned char ,u32 ,bool );static sense_reason_t sbc_execute_unmap (struct se_cmd *cmd); static sense_reason_t
@@ -292,14 +292,14 @@ static inline unsigned long long transport_lba_64_ext(unsigned char *cdb) }static sense_reason_t -sbc_setup_write_same (struct se_cmd *cmd,unsigned char *flags,struct sbc_ops *ops) +sbc_setup_write_same (struct se_cmd *cmd,unsigned char flags,struct sbc_ops *ops) {struct se_device *dev = cmd->se_dev;sector_t end_lba = dev->transport->get_blocks (dev) +1 ;unsigned int sectors =sbc_get_write_same_sectors (cmd);sense_reason_t ret; -if ((flags[0 ] &0x04 ) || (flags[0 ] &0x02 )) { +if ((flags &0x04 ) || (flags &0x02 )) {pr_err ("WRITE_SAME PBDATA and LBDATA" " bits not supported for Block Discard" " Emulation\n" );
@@ -321,7 +321,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o }/* We always have ANC_SUP == 0 so setting ANCHOR is always an error */ -if (flags[0 ] &0x10 ) { +if (flags &0x10 ) {pr_warn ("WRITE SAME with ANCHOR not supported\n" );return TCM_INVALID_CDB_FIELD ; }
@@ -329,7 +329,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o* Special case for WRITE_SAME w/ UNMAP=1 that ends up getting * translated into block discard requests within backend code. */ -if (flags[0 ] &0x08 ) { +if (flags &0x08 ) {if (!ops->execute_unmap)return TCM_UNSUPPORTED_SCSI_OPCODE ;
@@ -344,7 +344,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *oif (!ops->execute_write_same)return TCM_UNSUPPORTED_SCSI_OPCODE ; - ret =sbc_check_prot (dev, cmd, &cmd->t_task_cdb[0 ], sectors, true); + ret =sbc_check_prot (dev, cmd, flags >>5 , sectors, true);if (ret)return ret;
@@ -702,10 +702,9 @@ sbc_set_prot_op_checks(u8 protect, bool fabric_prot, enum target_prot_type prot_ }static sense_reason_t -sbc_check_prot (struct se_device *dev,struct se_cmd *cmd,unsigned char *cdb, +sbc_check_prot (struct se_device *dev,struct se_cmd *cmd,unsigned char protect,u32 sectors,bool is_write) { -u8 protect = cdb[1 ] >>5 ;int sp_ops = cmd->se_sess->sup_prot_ops;int pi_prot_type = dev->dev_attrib.pi_prot_type;bool fabric_prot = false;
@@ -753,7 +752,7 @@ sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb,/* Fallthrough */ default :pr_err ("Unable to determine pi_prot_type for CDB: 0x%02x " -"PROTECT: 0x%02x\n" , cdb[0 ], protect); +"PROTECT: 0x%02x\n" , cmd->t_task_cdb[0 ], protect);return TCM_INVALID_CDB_FIELD ; }
@@ -828,7 +827,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)if (sbc_check_dpofua (dev, cmd, cdb))return TCM_INVALID_CDB_FIELD ; - ret =sbc_check_prot (dev, cmd, cdb, sectors, false); + ret =sbc_check_prot (dev, cmd, cdb[1 ] >>5 , sectors, false);if (ret)return ret;
@@ -842,7 +841,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)if (sbc_check_dpofua (dev, cmd, cdb))return TCM_INVALID_CDB_FIELD ; - ret =sbc_check_prot (dev, cmd, cdb, sectors, false); + ret =sbc_check_prot (dev, cmd, cdb[1 ] >>5 , sectors, false);if (ret)return ret;
@@ -856,7 +855,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)if (sbc_check_dpofua (dev, cmd, cdb))return TCM_INVALID_CDB_FIELD ; - ret =sbc_check_prot (dev, cmd, cdb, sectors, false); + ret =sbc_check_prot (dev, cmd, cdb[1 ] >>5 , sectors, false);if (ret)return ret;
@@ -877,7 +876,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)if (sbc_check_dpofua (dev, cmd, cdb))return TCM_INVALID_CDB_FIELD ; - ret =sbc_check_prot (dev, cmd, cdb, sectors, true); + ret =sbc_check_prot (dev, cmd, cdb[1 ] >>5 , sectors, true);if (ret)return ret;
@@ -891,7 +890,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)if (sbc_check_dpofua (dev, cmd, cdb))return TCM_INVALID_CDB_FIELD ; - ret =sbc_check_prot (dev, cmd, cdb, sectors, true); + ret =sbc_check_prot (dev, cmd, cdb[1 ] >>5 , sectors, true);if (ret)return ret;
@@ -906,7 +905,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)if (sbc_check_dpofua (dev, cmd, cdb))return TCM_INVALID_CDB_FIELD ; - ret =sbc_check_prot (dev, cmd, cdb, sectors, true); + ret =sbc_check_prot (dev, cmd, cdb[1 ] >>5 , sectors, true);if (ret)return ret;
@@ -965,7 +964,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) size =sbc_get_size (cmd,1 ); cmd->t_task_lba =get_unaligned_be64 (&cdb[12 ]); - ret =sbc_setup_write_same (cmd, &cdb[10 ], ops); + ret =sbc_setup_write_same (cmd, cdb[10 ], ops);if (ret)return ret;break ;
@@ -1064,7 +1063,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) size =sbc_get_size (cmd,1 ); cmd->t_task_lba =get_unaligned_be64 (&cdb[2 ]); - ret =sbc_setup_write_same (cmd, &cdb[1 ], ops); + ret =sbc_setup_write_same (cmd, cdb[1 ], ops);if (ret)return ret;break ;
@@ -1082,7 +1081,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)* Follow sbcr26 with WRITE_SAME (10) and check for the existence * of byte 1 bit 3 UNMAP instead of original reserved field */ - ret =sbc_setup_write_same (cmd, &cdb[1 ], ops); + ret =sbc_setup_write_same (cmd, cdb[1 ], ops);if (ret)return ret;break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 81/120 spi: cadence: Correct initialisation of runtime PM again
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 56912da7a68c8356df6a6740476237441b0b792a ]
The original implementation of RPM handling in probe() was mostly correct, except it failed to call pm_runtime_get_*() to activate the hardware. The subsequent fix, 734882a8bf98 ("spi: cadence: Correct initialisation of runtime PM"), breaks the implementation further, to the point where the system using this hard IP on ZynqMP hangs on boot, because it accesses hardware which is gated off.
Undo 734882a8bf98 ("spi: cadence: Correct initialisation of runtime PM") and instead add missing pm_runtime_get_noresume() and move the RPM disabling all the way to the end of probe(). That makes ZynqMP not hang on boot yet again.
--- drivers/spi/spi-cadence.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/spi/spi-cadence.c +9 -5
@@ -585,6 +585,12 @@ static int cdns_spi_probe(struct platform_device *pdev) goto clk_dis_apb; } +pm_runtime_use_autosuspend (&pdev->dev); +pm_runtime_set_autosuspend_delay (&pdev->dev,SPI_AUTOSUSPEND_TIMEOUT ); +pm_runtime_get_noresume (&pdev->dev); +pm_runtime_set_active (&pdev->dev); +pm_runtime_enable (&pdev->dev); + ret =of_property_read_u32 (pdev->dev.of_node,"num-cs" , &num_cs);if (ret <0 ) master->num_chipselect =CDNS_SPI_DEFAULT_NUM_CS ;
@@ -599,11 +605,6 @@ static int cdns_spi_probe(struct platform_device *pdev)/* SPI controller initializations */ cdns_spi_init_hw (xspi); -pm_runtime_set_active (&pdev->dev); -pm_runtime_enable (&pdev->dev); -pm_runtime_use_autosuspend (&pdev->dev); -pm_runtime_set_autosuspend_delay (&pdev->dev,SPI_AUTOSUSPEND_TIMEOUT ); - irq =platform_get_irq (pdev,0 );if (irq <=0 ) { ret = -ENXIO ;
@@ -636,6 +637,9 @@ static int cdns_spi_probe(struct platform_device *pdev) master->bits_per_word_mask =SPI_BPW_MASK (8 ); +pm_runtime_mark_last_busy (&pdev->dev); +pm_runtime_put_autosuspend (&pdev->dev); + ret =spi_register_master (master);if (ret) {dev_err (&pdev->dev,"spi_register_master failed\n" );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 82/120 net/tcp_fastopen: fix data races around tfo_active_disable_stamp
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 6f20c8adb1813467ea52c1296d52c4e95978cb2f ]
tfo_active_disable_stamp is read and written locklessly. We need to annotate these accesses appropriately.
Then, we need to perform the atomic_inc(tfo_active_disable_times) after the timestamp has been updated, and thus add barriers to make sure tcp_fastopen_active_should_disable() wont read a stale timestamp.
--- net/ipv4/tcp_fastopen.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
net/ipv4/tcp_fastopen.c +16 -3
@@ -454,8 +454,15 @@ void tcp_fastopen_active_disable(struct sock *sk) {struct net *net =sock_net (sk); +/* Paired with READ_ONCE() in tcp_fastopen_active_should_disable() */ +WRITE_ONCE (net->ipv4.tfo_active_disable_stamp, jiffies); + +/* Paired with smp_rmb() in tcp_fastopen_active_should_disable(). +* We want net->ipv4.tfo_active_disable_stamp to be updated first. +*/ +smp_mb__before_atomic ();atomic_inc (&net->ipv4.tfo_active_disable_times); - net->ipv4.tfo_active_disable_stamp = jiffies; +NET_INC_STATS (net,LINUX_MIB_TCPFASTOPENBLACKHOLE ); }
@@ -473,10 +480,16 @@ bool tcp_fastopen_active_should_disable(struct sock *sk)if (!tfo_da_times)return false; +/* Paired with smp_mb__before_atomic() in tcp_fastopen_active_disable() */ +smp_rmb (); +/* Limit timout to max: 2^6 * initial timeout */ multiplier =1 <<min (tfo_da_times -1 ,6 ); - timeout = multiplier * tfo_bh_timeout *HZ ; -if (time_before (jiffies,sock_net (sk)->ipv4.tfo_active_disable_stamp + timeout)) + +/* Paired with the WRITE_ONCE() in tcp_fastopen_active_disable(). */ + timeout =READ_ONCE (sock_net (sk)->ipv4.tfo_active_disable_stamp) + + multiplier * tfo_bh_timeout *HZ ; +if (time_before (jiffies, timeout))return true;/* Mark check bit so we can check for successful active TFO
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 83/120 net/sched: act_skbmod: Skip non-Ethernet packets
In reply to Greg Kroah-HartmanFrom: Peilin Ye <[email protected]>
[ Upstream commit 727d6a8b7ef3d25080fad228b2c4a1d4da5999c6 ]
Currently tcf_skbmod_act() assumes that packets use Ethernet as their L2 protocol, which is not always the case. As an example, for CAN devices:
$ ip link add dev vcan0 type vcan $ ip link set up vcan0 $ tc qdisc add dev vcan0 root handle 1: htb $ tc filter add dev vcan0 parent 1: protocol ip prio 10 \ matchall action skbmod swap mac
Doing the above silently corrupts all the packets. Do not perform skbmod actions for non-Ethernet packets.
--- net/sched/act_skbmod.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/sched/act_skbmod.c +8 -4
@@ -10,6 +10,7 @@*/ #include <linux/module.h> +#include <linux/if_arp.h> #include <linux/init.h> #include <linux/kernel.h> #include <linux/skbuff.h>
@@ -36,6 +37,13 @@ static int tcf_skbmod_act(struct sk_buff *skb, const struct tc_action *a,tcf_lastuse_update (&d->tcf_tm);bstats_cpu_update (this_cpu_ptr (d->common.cpu_bstats), skb); + action =READ_ONCE (d->tcf_action); +if (unlikely (action ==TC_ACT_SHOT )) + goto drop; + +if (!skb->dev || skb->dev->type !=ARPHRD_ETHER ) +return action; +/* XXX: if you are going to edit more fields beyond ethernet header * (example when you add IP header replacement or vlan swap) * then MAX_EDIT_LEN needs to change appropriately
@@ -44,10 +52,6 @@ static int tcf_skbmod_act(struct sk_buff *skb, const struct tc_action *a,if (unlikely (err))/* best policy is to drop on the floor */ goto drop; - action =READ_ONCE (d->tcf_action); -if (unlikely (action ==TC_ACT_SHOT )) - goto drop; - p =rcu_dereference_bh (d->skbmod_p); flags = p->flags;if (flags &SKBMOD_F_DMAC )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 84/120 nvme-pci: dont WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 7764656b108cd308c39e9a8554353b8f9ca232a3 ]
Followling process:nvme_probe
nvme_reset_ctrl
nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING)
queue_work(nvme_reset_wq, &ctrl->reset_work)--------------> nvme_remove
nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING)
worker_thread
process_one_work
nvme_reset_work
WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING), which will trigger WARN_ON in nvme_reset_work():
[ 127.534298] WARNING: CPU: 0 PID: 139 at drivers/nvme/host/pci.c:2594 [ 127.536161] CPU: 0 PID: 139 Comm: kworker/u8:7 Not tainted 5.13.0 [ 127.552518] Call Trace: [ 127.552840] ? kvm_sched_clock_read+0x25/0x40 [ 127.553936] ? native_send_call_func_single_ipi+0x1c/0x30 [ 127.555117] ? send_call_function_single_ipi+0x9b/0x130 [ 127.556263] ? __smp_call_single_queue+0x48/0x60 [ 127.557278] ? ttwu_queue_wakelist+0xfa/0x1c0 [ 127.558231] ? try_to_wake_up+0x265/0x9d0 [ 127.559120] ? ext4_end_io_rsv_work+0x160/0x290 [ 127.560118] process_one_work+0x28c/0x640 [ 127.561002] worker_thread+0x39a/0x700 [ 127.561833] ? rescuer_thread+0x580/0x580 [ 127.562714] kthread+0x18c/0x1e0 [ 127.563444] ? set_kthread_struct+0x70/0x70 [ 127.564347] ret_from_fork+0x1f/0x30
The preceding problem can be easily reproduced by executing following script (based on blktests suite):test() {
pdev="$(_get_pci_dev_from_blkdev)" sysfs="/sys/bus/pci/devices/${pdev}"
for ((i = 0; i < 10; i++)); do
echo 1 > "$sysfs/remove"
echo 1 > /sys/bus/pci/rescan
done
}
Since the device ctrl could be updated as an non-RESETTING state by repeating probe/remove in userspace (which is a normal situation), we can replace stack dumping WARN_ON with a warnning message.
--- drivers/nvme/host/pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +3 -1
@@ -2273,7 +2273,9 @@ static void nvme_reset_work(struct work_struct *work)int result;enum nvme_ctrl_state new_state =NVME_CTRL_LIVE ; -if (WARN_ON (dev->ctrl.state !=NVME_CTRL_RESETTING )) { +if (dev->ctrl.state !=NVME_CTRL_RESETTING ) { +dev_warn (dev->ctrl.device,"ctrl state %d is not RESETTING\n" , + dev->ctrl.state); result = -ENODEV ; goto out; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 85/120 Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
In reply to Greg Kroah-HartmanFrom: Vincent Palatin <[email protected]>
[ Upstream commit f3a1a937f7b240be623d989c8553a6d01465d04f ]
This reverts commit 0bd860493f81eb2a46173f6f5e44cc38331c8dbd.
While the patch was working as stated,ie preventing the L850-GL LTE modem from crashing on some U3 wake-ups due to a race condition between the host wake-up and the modem-side wake-up, when using the MBIM interface, this would force disabling the USB runtime PM on the device.
The increased power consumption is significant for LTE laptops, and given that with decently recent modem firmwares, when the modem hits the bug, it automatically recovers (ie it drops from the bus, but automatically re-enumerates after less than half a second, rather than being stuck until a power cycle as it was doing with ancient firmware), for most people, the trade-off now seems in favor of re-enabling it by default.
For people with access to the platform code, the bug can also be worked-around successfully by changing the USB3 LFPM polling off-time for the XHCI controller in the BIOS code.
--- drivers/usb/core/quirks.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/usb/core/quirks.c +0 -4
@@ -502,10 +502,6 @@ static const struct usb_device_id usb_quirk_list[] = {/* DJI CineSSD */ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, - /* Fibocom L850-GL LTE Modem */ - { USB_DEVICE(0x2cb7, 0x0007), .driver_info = - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, - /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 86/120 sctp: update active_key for asoc when old key is being replaced
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 58acd10092268831e49de279446c314727101292 ]
syzbot reported a call trace:
BUG: KASAN: use-after-free in sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 Call Trace: sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:131 [inline] sctp_sendmsg_to_asoc+0x152e/0x2180 net/sctp/socket.c:1865 sctp_sendmsg+0x103b/0x1d30 net/sctp/socket.c:2027 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:723
This is an use-after-free issue caused by not updating asoc->shkey after it was replaced in the key list asoc->endpoint_shared_keys, and the old key was freed.
This patch is to fix by also updating active_key for asoc when old key is being replaced with a new one. Note that this issue doesn't exist in sctp_auth_del_key_id(), as it's not allowed to delete the active_key from the asoc.
--- net/sctp/auth.c | 2 ++ 1 file changed, 2 insertions(+)
net/sctp/auth.c +2 -0
@@ -883,6 +883,8 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,if (replace) {list_del_init (&shkey->key_list);sctp_auth_shkey_release (shkey); +if (asoc && asoc->active_key_id == auth_key->sca_keynumber) +sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL ); }list_add (&cur_key->key_list, sh_keys);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 87/120 net: sched: cls_api: Fix the the wrong parameter
In reply to Greg Kroah-HartmanFrom: Yajun Deng <[email protected]>
[ Upstream commit 9d85a6f44bd5585761947f40f7821c9cd78a1bbe ]
The 4th parameter in tc_chain_notify() should be flags rather than seq. Let's change it back correctly.
--- net/sched/cls_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/cls_api.c +1 -1
@@ -1918,7 +1918,7 @@ replay:break ;case RTM_GETCHAIN : err =tc_chain_notify (chain, skb, n->nlmsg_seq, - n->nlmsg_seq, n->nlmsg_type, true); + n->nlmsg_flags, n->nlmsg_type, true);if (err <0 )NL_SET_ERR_MSG (extack,"Failed to send chain notify message" );break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 88/120 drm/panel: raspberrypi-touchscreen: Prevent double-free
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 7bbcb919e32d776ca8ddce08abb391ab92eef6a9 ]
The mipi_dsi_device allocated by mipi_dsi_device_register_full() is already free'd on release.
--- drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +0 -1
@@ -454,7 +454,6 @@ static int rpi_touchscreen_remove(struct i2c_client *i2c)drm_panel_remove (&ts->base);mipi_dsi_device_unregister (ts->dsi); -kfree (ts->dsi);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 89/120 proc: Avoid mixing integer types in mem_rw()
In reply to Greg Kroah-HartmanFrom: Marcelo Henrique Cerri <[email protected]>
[ Upstream commit d238692b4b9f2c36e35af4c6e6f6da36184aeb3e ]
Use size_t when capping the count argument received by mem_rw(). Since count is size_t, using min_t(int, ...) can lead to a negative value that will later be passed to access_remote_vm(), which can cause unexpected behavior.
Since we are capping the value to at maximum PAGE_SIZE, the conversion from size_t to int when passing it to access_remote_vm() as "len" shouldn't be a problem.
--- fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/base.c +1 -1
@@ -835,7 +835,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf, flags =FOLL_FORCE | (write ?FOLL_WRITE :0 );while (count >0 ) { -int this_len =min_t (int, count,PAGE_SIZE ); +size_t this_len =min_t (size_t, count,PAGE_SIZE );if (write &©_from_user (page, buf, this_len)) { copied = -EFAULT ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 90/120 Revert "MIPS: add PMD table accounting into MIPSpmd_alloc_one"
In reply to Greg Kroah-HartmanFrom: Huang Pei <[email protected]>
This reverts commit 68046cc531577b8f0ebe67ccf18b9c70106d7937 which is commit ed914d48b6a1040d1039d371b56273d422c0081e upstream.
Commit b2b29d6d011944 (mm: account PMD tables like PTE tables) is introduced between v5.9 and v5.10, so this fix (commit 002d8b395fa1) should NOT apply to any pre-5.10 branch.
--- arch/mips/include/asm/pgalloc.h | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
arch/mips/include/asm/pgalloc.h +3 -7
@@ -93,15 +93,11 @@ do { \static inline pmd_t *pmd_alloc_one (struct mm_struct *mm,unsigned long address) { -pmd_t *pmd =NULL ; -struct page *pg; +pmd_t *pmd; - pg =alloc_pages (GFP_KERNEL | __GFP_ACCOUNT,PMD_ORDER ); -if (pg) { -pgtable_pmd_page_ctor (pg); - pmd = (pmd_t *)page_address (pg); + pmd = (pmd_t *)__get_free_pages (GFP_KERNEL ,PMD_ORDER ); +if (pmd)pmd_init ((unsigned long )pmd, (unsigned long )invalid_pte_table); - }return pmd; }
Greg Kroah-Hartman
maintainerPATCH 91/120 s390/ftrace: fix ftrace_update_ftrace_func implementation
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
commit f8c2602733c953ed7a16e060640b8e96f9d94b9b upstream.
s390 enforces DYNAMIC_FTRACE if FUNCTION_TRACER is selected. At the same time implementation of ftrace_caller is not compliant with HAVE_DYNAMIC_FTRACE since it doesn't provide implementation of ftrace_update_ftrace_func() and calls ftrace_trace_function() directly.
The subtle difference is that during ftrace code patching ftrace replaces function tracer via ftrace_update_ftrace_func() and activates it back afterwards. Unexpected direct calls to ftrace_trace_function() during ftrace code patching leads to nullptr-dereferences when tracing is activated for one of functions which are used during code patching. Those function currently are:copy_from_kernel_nofault() copy_from_kernel_nofault_allowed()preempt_count_sub() [with debug_defconfig] preempt_count_add() [with debug_defconfig]
Corresponding KASAN report:
BUG: KASAN: nullptr-dereference in function_trace_call+0x316/0x3b0
Read of size 4 at addr 0000000000001e08 by task migration/0/15
CPU: 0 PID: 15 Comm: migration/0 Tainted: G B 5.13.0-41423-g08316af3644d
Hardware name: IBM 3906 M04 704 (LPAR)
Stopper: multi_cpu_stop+0x0/0x3e0 <- stop_machine_cpuslocked+0x1e4/0x218
Call Trace:
[<0000000001f77caa>] show_stack+0x16a/0x1d0
[<0000000001f8de42>] dump_stack+0x15a/0x1b0
[<0000000001f81d56>] print_address_description.constprop.0+0x66/0x2e0
[<000000000082b0ca>] kasan_report+0x152/0x1c0
[<00000000004cfd8e>] function_trace_call+0x316/0x3b0
[<0000000001fb7082>] ftrace_caller+0x7a/0x7e
[<00000000006bb3e6>] copy_from_kernel_nofault_allowed+0x6/0x10
[<00000000006bb42e>] copy_from_kernel_nofault+0x3e/0xd0
[<000000000014605c>] ftrace_make_call+0xb4/0x1f8
[<000000000047a1b4>] ftrace_replace_code+0x134/0x1d8
[<000000000047a6e0>] ftrace_modify_all_code+0x120/0x1d0
[<000000000047a7ec>] __ftrace_modify_code+0x5c/0x78
[<000000000042395c>] multi_cpu_stop+0x224/0x3e0
[<0000000000423212>] cpu_stopper_thread+0x33a/0x5a0
[<0000000000243ff2>] smpboot_thread_fn+0x302/0x708
[<00000000002329ea>] kthread+0x342/0x408
[<00000000001066b2>] __ret_from_fork+0x92/0xf0
[<0000000001fb57fa>] ret_from_fork+0xa/0x30
The buggy address belongs to the page:
page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1
flags: 0x1ffff00000001000(reserved|node=0|zone=0|lastcpupid=0x1ffff)
raw: 1ffff00000001000 0000040000000048 0000040000000048 0000000000000000
raw: 0000000000000000 0000000000000000 ffffffff00000001 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
0000000000001d00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0000000000001d80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
>0000000000001e00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
^
0000000000001e80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0000000000001f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
==================================================================To fix that introduce ftrace_func callback to be called from ftrace_caller and update it in ftrace_update_ftrace_func().
--- arch/s390/include/asm/ftrace.h | 1 + arch/s390/kernel/ftrace.c | 2 ++ arch/s390/kernel/mcount.S | 4 ++-- 3 files changed, 5 insertions(+), 2 deletions(-)
arch/s390/include/asm/ftrace.h +1 -0
@@ -20,6 +20,7 @@ void ftrace_caller(void);extern char ftrace_graph_caller_end;extern unsigned long ftrace_plt; +extern void *ftrace_func;struct dyn_arch_ftrace { };
arch/s390/kernel/ftrace.c +2 -0
@@ -57,6 +57,7 @@* > brasl %r0,ftrace_caller # offset 0 */ +void *ftrace_func__read_mostly = ftrace_stub;unsigned long ftrace_plt;static inline void ftrace_generate_orig_insn (struct ftrace_insn *insn)
@@ -166,6 +167,7 @@ int ftrace_make_call(struct dyn_ftrace *int ftrace_update_ftrace_func (ftrace_func_t func) { + ftrace_func = func;return 0 ; }
arch/s390/kernel/mcount.S +2 -2
@@ -60,13 +60,13 @@ ENTRY(ftrace_caller) #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES aghik %r2,%r0,-MCOUNT_INSN_SIZE lgrl %r4,function_trace_op - lgrl %r1,ftrace_trace_function + lgrl %r1,ftrace_func #else lgr %r2,%r0 aghi %r2,-MCOUNT_INSN_SIZE larl %r4,function_trace_op lg %r4,0(%r4) - larl %r1,ftrace_trace_function + larl %r1,ftrace_func lg %r1,0(%r1) #endif lgr %r3,%r14
Greg Kroah-Hartman
maintainerPATCH 92/120 ALSA: usb-audio: Add registration quirk for JBL Quantum headsets
In reply to Greg Kroah-HartmanFrom: Alexander Tsoy <[email protected]>
commit b0084afde27fe8a504377dee65f55bc6aa776937 upstream.
These devices has two interfaces, but only the second interface contains the capture endpoint, thus quirk is required to delay the registration until the second interface appears.
--- sound/usb/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
sound/usb/quirks.c +3 -0
@@ -1553,6 +1553,9 @@ static const struct registration_quirk rREG_QUIRK_ENTRY (0x0951 ,0x16d8 ,2 ),/* Kingston HyperX AMP */ REG_QUIRK_ENTRY (0x0951 ,0x16ed ,2 ),/* Kingston HyperX Cloud Alpha S */ REG_QUIRK_ENTRY (0x0951 ,0x16ea ,2 ),/* Kingston HyperX Cloud Flight S */ +REG_QUIRK_ENTRY (0x0ecb ,0x1f46 ,2 ),/* JBL Quantum 600 */ +REG_QUIRK_ENTRY (0x0ecb ,0x2039 ,2 ),/* JBL Quantum 400 */ +REG_QUIRK_ENTRY (0x0ecb ,0x203e ,2 ),/* JBL Quantum 800 */ { 0 } /* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 93/120 ALSA: sb: Fix potential ABBA deadlock in CSP driver
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 1c2b9519159b470ef24b2638f4794e86e2952ab7 upstream.
SB16 CSP driver may hit potentially a typical ABBA deadlock in two code paths:
In snd_sb_csp_stop():
spin_lock_irqsave(&p->chip->mixer_lock, flags);
spin_lock(&p->chip->reg_lock); In snd_sb_csp_load():
spin_lock_irqsave(&p->chip->reg_lock, flags);
spin_lock(&p->chip->mixer_lock);Also the similar pattern is seen in snd_sb_csp_start().
Although the practical impact is very small (those states aren't triggered in the same running state and this happens only on a real hardware, decades old ISA sound boards -- which must be very difficult to find nowadays), it's a real scenario and has to be fixed.
This patch addresses those deadlocks by splitting the locks in snd_sb_csp_start() and snd_sb_csp_stop() for avoiding the nested locks.
--- sound/isa/sb/sb16_csp.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/isa/sb/sb16_csp.c +4 -0
@@ -828,6 +828,7 @@ static int snd_sb_csp_start(struct snd_s mixR =snd_sbmixer_read (p->chip,SB_DSP4_PCM_DEV +1 );snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV , mixL &0x7 );snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV +1 , mixR &0x7 ); +spin_unlock_irqrestore (&p->chip->mixer_lock, flags);spin_lock (&p->chip->reg_lock);set_mode_register (p->chip,0xc0 );/* c0 = STOP */
@@ -867,6 +868,7 @@ static int snd_sb_csp_start(struct snd_sspin_unlock (&p->chip->reg_lock);/* restore PCM volume */ +spin_lock_irqsave (&p->chip->mixer_lock, flags);snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV , mixL);snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV +1 , mixR);spin_unlock_irqrestore (&p->chip->mixer_lock, flags);
@@ -892,6 +894,7 @@ static int snd_sb_csp_stop(struct snd_sb mixR =snd_sbmixer_read (p->chip,SB_DSP4_PCM_DEV +1 );snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV , mixL &0x7 );snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV +1 , mixR &0x7 ); +spin_unlock_irqrestore (&p->chip->mixer_lock, flags);spin_lock (&p->chip->reg_lock);if (p->running &SNDRV_SB_CSP_ST_QSOUND ) {
@@ -906,6 +909,7 @@ static int snd_sb_csp_stop(struct snd_sbspin_unlock (&p->chip->reg_lock);/* restore PCM volume */ +spin_lock_irqsave (&p->chip->mixer_lock, flags);snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV , mixL);snd_sbmixer_write (p->chip,SB_DSP4_PCM_DEV +1 , mixR);spin_unlock_irqrestore (&p->chip->mixer_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 94/120 xhci: Fix lost USB 2 remote wake
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 72f68bf5c756f5ce1139b31daae2684501383ad5 upstream.
There's a small window where a USB 2 remote wake may be left unhandled due to a race between hub thread and xhci port event interrupt handler.
When the resume event is detected in the xhci interrupt handler it kicks the hub timer, which should move the port from resume to U0 once resume has been signalled for long enough.
To keep the hub "thread" running we set a bus_state->resuming_ports flag. This flag makes sure hub timer function kicks itself.
checking this flag was not properly protected by the spinlock. Flag was copied to a local variable before lock was taken. The local variable was then checked later with spinlock held.
If interrupt is handled right after copying the flag to the local variable we end up stopping the hub thread before it can handle the USB 2 resume.
CPU0 CPU1
(hub thread) (xhci event handler)
xhci_hub_status_data()
status = bus_state->resuming_ports; <Interrupt> handle_port_status() spin_lock() bus_state->resuming_ports = 1 set_flag(HCD_FLAG_POLL_RH) spin_unlock()
spin_lock()
if (!status)
clear_flag(HCD_FLAG_POLL_RH)spin_unlock()
Fix this by taking the lock a bit earlier so that it covers the resuming_ports flag copy in the hub thread
--- drivers/usb/host/xhci-hub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-hub.c +2 -1
@@ -1458,11 +1458,12 @@ int xhci_hub_status_data(struct usb_hcd* Inform the usbcore about resume-in-progress by returning * a non-zero value even if there are no status changes. */ +spin_lock_irqsave (&xhci->lock, flags); + status = bus_state->resuming_ports; mask =PORT_CSC |PORT_PEC |PORT_OCC |PORT_PLC |PORT_WRC |PORT_CEC ; -spin_lock_irqsave (&xhci->lock, flags);/* For each port, did anything change? If so, set that bit in buf. */ for (i =0 ; i < max_ports; i++) { temp =readl (ports[i]->addr);
Greg Kroah-Hartman
maintainerPATCH 95/120 KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
commit f62f3c20647ebd5fb6ecb8f0b477b9281c44c10a upstream.
The kvmppc_rtas_hcall() sets the host rtas_args.rets pointer based on the rtas_args.nargs that was provided by the guest. That guest nargs value is not range checked, so the guest can cause the host rets pointer to be pointed outside the args array. The individual rtas function handlers check the nargs and nrets values to ensure they are correct, but if they are not, the handlers store a -3 (0xfffffffd) failure indication in rets[0] which corrupts host memory.
Fix this by testing up front whether the guest supplied nargs and nret would exceed the array size, and fail the hcall directly without storing a failure indication to rets[0].
Also expand on a comment about why we kill the guest and try not to return errors directly if we have a valid rets[0] pointer.
--- arch/powerpc/kvm/book3s_rtas.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-)
arch/powerpc/kvm/book3s_rtas.c +22 -3
@@ -243,6 +243,17 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *v* value so we can restore it on the way out. */ orig_rets = args.rets; +if (be32_to_cpu (args.nargs) >=ARRAY_SIZE (args.args)) { +/* +* Don't overflow our args array: ensure there is room for +* at least rets[0] (even if the call specifies 0 nret). +* +* Each handler must then check for the correct nargs and nret +* values, but they may always return failure in rets[0]. +*/ + rc = -EINVAL ; + goto fail; + } args.rets = &args.args[be32_to_cpu (args.nargs)];mutex_lock (&vcpu->kvm->arch.rtas_token_lock);
@@ -270,9 +281,17 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *v fail:/* * We only get here if the guest has called RTAS with a bogus -* args pointer. That means we can't get to the args, and so we -* can't fail the RTAS call. So fail right out to userspace, -* which should kill the guest. +* args pointer or nargs/nret values that would overflow the +* array. That means we can't get to the args, and so we can't +* fail the RTAS call. So fail right out to userspace, which +* should kill the guest. +* +* SLOF should actually pass the hcall return value from the +* rtas handler call in r3, so enter_rtas could be modified to +* return a failure indication in r3 and we could return such +* errors to the guest rather than failing to host userspace. +* However old guests that don't test for failure could then +* continue silently after errors, so for now we won't do this. */ return rc; }
Greg Kroah-Hartman
maintainerPATCH 96/120 usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 1b7f56fbc7a1b66967b6114d1b5f5a257c3abae6 upstream.
The device initiated link power management U1/U2 states should not be enabled in case the system exit latency plus one bus interval (125us) is greater than the shortest service interval of any periodic endpoint.
This is the case for both U1 and U2 sytstem exit latencies and link states.
See USB 3.2 section 9.4.9 "Set Feature" for more details
Note, before this patch the host and device initiated U1/U2 lpm states were both enabled with lpm. After this patch it's possible to end up with only host inititated U1/U2 lpm in case the exit latencies won't allow device initiated lpm.
If this case we still want to set the udev->usb3_lpm_ux_enabled flag so that sysfs users can see the link may go to U1/U2.
--- drivers/usb/core/hub.c | 68 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 56 insertions(+), 12 deletions(-)
drivers/usb/core/hub.c +56 -12
@@ -3989,6 +3989,47 @@ static int usb_set_lpm_timeout(struct us }/* +* Don't allow device intiated U1/U2 if the system exit latency + one bus +* interval is greater than the minimum service interval of any active +* periodic endpoint. See USB 3.2 section 9.4.9 +*/ +static bool usb_device_may_initiate_lpm (struct usb_device *udev, +enum usb3_link_state state) +{ +unsigned int sel;/* us */ +int i, j; + +if (state ==USB3_LPM_U1 ) + sel =DIV_ROUND_UP (udev->u1_params.sel,1000 ); +else if (state ==USB3_LPM_U2 ) + sel =DIV_ROUND_UP (udev->u2_params.sel,1000 ); +else +return false; + +for (i =0 ; i < udev->actconfig->desc.bNumInterfaces; i++) { +struct usb_interface *intf; +struct usb_endpoint_descriptor *desc; +unsigned int interval; + + intf = udev->actconfig->interface[i]; +if (!intf) +continue ; + +for (j =0 ; j < intf->cur_altsetting->desc.bNumEndpoints; j++) { + desc = &intf->cur_altsetting->endpoint[j].desc; + +if (usb_endpoint_xfer_int (desc) || +usb_endpoint_xfer_isoc (desc)) { + interval = (1 << (desc->bInterval -1 )) *125 ; +if (sel +125 > interval) +return false; + } + } + } +return true; +} + +/* * Enable the hub-initiated U1/U2 idle timeouts, and enable device-initiated * U1/U2 entry. *
@@ -4060,20 +4101,23 @@ static void usb_enable_link_state(struct* U1/U2_ENABLE */ if (udev->actconfig && -usb_set_device_initiated_lpm (udev, state, true) ==0 ) { -if (state ==USB3_LPM_U1 ) - udev->usb3_lpm_u1_enabled =1 ; -else if (state ==USB3_LPM_U2 ) - udev->usb3_lpm_u2_enabled =1 ; - }else { -/* Don't request U1/U2 entry if the device -* cannot transition to U1/U2. -*/ -usb_set_lpm_timeout (udev, state,0 ); - hcd->driver->disable_usb3_lpm_timeout (hcd, udev, state); +usb_device_may_initiate_lpm (udev, state)) { +if (usb_set_device_initiated_lpm (udev, state, true)) { +/* +* Request to enable device initiated U1/U2 failed, +* better to turn off lpm in this case. +*/ +usb_set_lpm_timeout (udev, state,0 ); + hcd->driver->disable_usb3_lpm_timeout (hcd, udev, state); +return ; + } } -} +if (state ==USB3_LPM_U1 ) + udev->usb3_lpm_u1_enabled =1 ; +else if (state ==USB3_LPM_U2 ) + udev->usb3_lpm_u2_enabled =1 ; +}/* * Disable the hub-initiated U1/U2 idle timeouts, and disable device-initiated * U1/U2 entry.
Greg Kroah-Hartman
maintainerPATCH 97/120 usb: hub: Fix link power management max exit latency (MEL) calculations
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 1bf2761c837571a66ec290fb66c90413821ffda2 upstream.
Maximum Exit Latency (MEL) value is used by host to know how much in advance it needs to start waking up a U1/U2 suspended link in order to service a periodic transfer in time.
Current MEL calculation only includes the time to wake up the path from U1/U2 to U0. This is called tMEL1 in USB 3.1 section C 1.5.2
Total MEL = tMEL1 + tMEL2 +tMEL3 + tMEL4 which should additinally include:
- tMEL2 which is the time it takes for PING message to reach device
- tMEL3 time for device to process the PING and submit a PING_RESPONSE
- tMEL4 time for PING_RESPONSE to traverse back upstream to host.
Add the missing tMEL2, tMEL3 and tMEL4 to MEL calculation.
--- drivers/usb/core/hub.c | 52 ++++++++++++++++++++++++++----------------------- 1 file changed, 28 insertions(+), 24 deletions(-)
drivers/usb/core/hub.c +28 -24
@@ -45,6 +45,7 @@#define USB_TP_TRANSMISSION_DELAY 40/* ns */ #define USB_TP_TRANSMISSION_DELAY_MAX 65535/* ns */ +#define USB_PING_RESPONSE_TIME 400/* ns */ /* Protect struct usb_device->state and ->children members * Note: Both are also protected by ->dev.sem, except that ->state can
@@ -179,8 +180,9 @@ int usb_device_supports_lpm(struct usb_d }/* -* Set the Maximum Exit Latency (MEL) for the host to initiate a transition from -* either U1 or U2. +* Set the Maximum Exit Latency (MEL) for the host to wakup up the path from +* U1/U2, send a PING to the device and receive a PING_RESPONSE. +* See USB 3.1 section C.1.5.2 */ static void usb_set_lpm_mel(struct usb_device *udev, struct usb3_lpm_parameters *udev_lpm_params,
@@ -190,35 +192,37 @@ static void usb_set_lpm_mel(struct usb_d unsigned int hub_exit_latency) {unsigned int total_mel; -unsigned int device_mel; -unsigned int hub_mel;/* -* Calculate the time it takes to transition all links from the roothub -* to the parent hub into U0. The parent hub must then decode the -* packet (hub header decode latency) to figure out which port it was -* bound for. -* -* The Hub Header decode latency is expressed in 0.1us intervals (0x1 -* means 0.1us). Multiply that by 100 to get nanoseconds. +* tMEL1. time to transition path from host to device into U0. +* MEL for parent already contains the delay up to parent, so only add +* the exit latency for the last link (pick the slower exit latency), +* and the hub header decode latency. See USB 3.1 section C 2.2.1 +* Store MEL in nanoseconds */ total_mel = hub_lpm_params->mel + - (hub->descriptor->u.ss.bHubHdrDecLat *100 ); +max (udev_exit_latency, hub_exit_latency) *1000 + + hub->descriptor->u.ss.bHubHdrDecLat *100 ;/* -* How long will it take to transition the downstream hub's port into -* U0? The greater of either the hub exit latency or the device exit -* latency. -* -* The BOS U1/U2 exit latencies are expressed in 1us intervals. -* Multiply that by 1000 to get nanoseconds. +* tMEL2. Time to submit PING packet. Sum of tTPTransmissionDelay for +* each link + wHubDelay for each hub. Add only for last link. +* tMEL4, the time for PING_RESPONSE to traverse upstream is similar. +* Multiply by 2 to include it as well. */ - device_mel = udev_exit_latency *1000 ; - hub_mel = hub_exit_latency *1000 ; -if (device_mel > hub_mel) - total_mel += device_mel; -else - total_mel += hub_mel; + total_mel += (__le16_to_cpu (hub->descriptor->u.ss.wHubDelay) + +USB_TP_TRANSMISSION_DELAY ) *2 ; + +/* +* tMEL3, tPingResponse. Time taken by device to generate PING_RESPONSE +* after receiving PING. Also add 2100ns as stated in USB 3.1 C 1.5.2.4 +* to cover the delay if the PING_RESPONSE is queued behind a Max Packet +* Size DP. +* Note these delays should be added only once for the entire path, so +* add them to the MEL of the device connected to the roothub. +*/ +if (!hub->hdev->parent) + total_mel +=USB_PING_RESPONSE_TIME +2100 ; udev_lpm_params->mel = total_mel; }
Greg Kroah-Hartman
maintainerPATCH 98/120 USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
In reply to Greg Kroah-HartmanFrom: Julian Sikorski <[email protected]>
commit 6abf2fe6b4bf6e5256b80c5817908151d2d33e9f upstream.
LaCie Rugged USB3-FW appears to be incompatible with UAS. It generates errors like:
[ 1151.582598] sd 14:0:0:0: tag#16 uas_eh_abort_handler 0 uas-tag 1 inflight: IN [ 1151.582602] sd 14:0:0:0: tag#16 CDB: Report supported operation codes a3 0c 01 12 00 00 00 00 02 00 00 00 [ 1151.588594] scsi host14: uas_eh_device_reset_handler start [ 1151.710482] usb 2-4: reset SuperSpeed Gen 1 USB device number 2 using xhci_hcd [ 1151.741398] scsi host14: uas_eh_device_reset_handler success [ 1181.785534] scsi host14: uas_eh_device_reset_handler start
--- drivers/usb/storage/unusual_uas.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_uas.h +7 -0
@@ -45,6 +45,13 @@ UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x99 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME), +/* Reported-by: Julian Sikorski <[email protected]> */ +UNUSUAL_DEV (0x059f ,0x1061 ,0x0000 ,0x9999 , +"LaCie" , +"Rugged USB3-FW" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , + US_FL_IGNORE_UAS), +/* * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI * commands in UAS mode. Observed with the 1.28 firmware; are there others?
Greg Kroah-Hartman
maintainerPATCH 99/120 usb: max-3421: Prevent corruption of freed memory
In reply to Greg Kroah-HartmanFrom: Mark Tomlinson <[email protected]>
commit b5fdf5c6e6bee35837e160c00ac89327bdad031b upstream.
The MAX-3421 USB driver remembers the state of the USB toggles for a device/endpoint. To save SPI writes, this was only done when a new device/endpoint was being used. Unfortunately, if the old device was removed, this would cause writes to freed memory.
To fix this, a simpler scheme is used. The toggles are read from hardware when a URB is completed, and the toggles are always written to hardware when any URB transaction is started. This will cause a few more SPI transactions, but no causes kernel panics.
--- drivers/usb/host/max3421-hcd.c | 44 +++++++++++++---------------------------- 1 file changed, 14 insertions(+), 30 deletions(-)
drivers/usb/host/max3421-hcd.c +14 -30
@@ -153,8 +153,6 @@ struct max3421_hcd {*/ struct urb *curr_urb;enum scheduling_pass sched_pass; -struct usb_device *loaded_dev;/* dev that's loaded into the chip */ -int loaded_epnum;/* epnum whose toggles are loaded */ int urb_done;/* > 0 -> no errors, < 0: errno */ size_t curr_len;u8 hien;
@@ -492,39 +490,17 @@ max3421_set_speed(struct usb_hcd *hcd, s* Caller must NOT hold HCD spinlock. */ static void -max3421_set_address (struct usb_hcd *hcd,struct usb_device *dev,int epnum, -int force_toggles) +max3421_set_address (struct usb_hcd *hcd,struct usb_device *dev,int epnum) { -struct max3421_hcd *max3421_hcd =hcd_to_max3421 (hcd); -int old_epnum, same_ep, rcvtog, sndtog; -struct usb_device *old_dev; +int rcvtog, sndtog;u8 hctl; - old_dev = max3421_hcd->loaded_dev; - old_epnum = max3421_hcd->loaded_epnum; - - same_ep = (dev == old_dev && epnum == old_epnum); -if (same_ep && !force_toggles) -return ; - -if (old_dev && !same_ep) { -/* save the old end-points toggles: */ -u8 hrsl =spi_rd8 (hcd,MAX3421_REG_HRSL ); - - rcvtog = (hrsl >>MAX3421_HRSL_RCVTOGRD_BIT ) &1 ; - sndtog = (hrsl >>MAX3421_HRSL_SNDTOGRD_BIT ) &1 ; - -/* no locking: HCD (i.e., we) own toggles, don't we? */ -usb_settoggle (old_dev, old_epnum,0 , rcvtog); -usb_settoggle (old_dev, old_epnum,1 , sndtog); - }/* setup new endpoint's toggle bits: */ rcvtog =usb_gettoggle (dev, epnum,0 ); sndtog =usb_gettoggle (dev, epnum,1 ); hctl = (BIT (rcvtog +MAX3421_HCTL_RCVTOG0_BIT ) |BIT (sndtog +MAX3421_HCTL_SNDTOG0_BIT )); - max3421_hcd->loaded_epnum = epnum;spi_wr8 (hcd,MAX3421_REG_HCTL , hctl);/*
@@ -532,7 +508,6 @@ max3421_set_address(struct usb_hcd *hcd,* address-assignment so it's best to just always load the * address whenever the end-point changed/was forced. */ - max3421_hcd->loaded_dev = dev;spi_wr8 (hcd,MAX3421_REG_PERADDR , dev->devnum); }
@@ -667,7 +642,7 @@ max3421_select_and_start_urb(struct usb_struct max3421_hcd *max3421_hcd =hcd_to_max3421 (hcd);struct urb *urb, *curr_urb =NULL ;struct max3421_ep *max3421_ep; -int epnum, force_toggles =0 ; +int epnum;struct usb_host_endpoint *ep;struct list_head *pos;unsigned long flags;
@@ -777,7 +752,6 @@ done:usb_settoggle (urb->dev, epnum,0 ,1 );usb_settoggle (urb->dev, epnum,1 ,1 ); max3421_ep->pkt_state =PKT_STATE_SETUP ; - force_toggles =1 ; }else max3421_ep->pkt_state =PKT_STATE_TRANSFER ; }
@@ -785,7 +759,7 @@ done:spin_unlock_irqrestore (&max3421_hcd->lock, flags); max3421_ep->last_active = max3421_hcd->frame_number; -max3421_set_address (hcd, urb->dev, epnum, force_toggles); +max3421_set_address (hcd, urb->dev, epnum);max3421_set_speed (hcd, urb->dev);max3421_next_transfer (hcd,0 );return 1 ;
@@ -1380,6 +1354,16 @@ max3421_urb_done(struct usb_hcd *hcd) status =0 ; urb = max3421_hcd->curr_urb;if (urb) { +/* save the old end-points toggles: */ +u8 hrsl =spi_rd8 (hcd,MAX3421_REG_HRSL ); +int rcvtog = (hrsl >>MAX3421_HRSL_RCVTOGRD_BIT ) &1 ; +int sndtog = (hrsl >>MAX3421_HRSL_SNDTOGRD_BIT ) &1 ; +int epnum =usb_endpoint_num (&urb->ep->desc); + +/* no locking: HCD (i.e., we) own toggles, don't we? */ +usb_settoggle (urb->dev, epnum,0 , rcvtog); +usb_settoggle (urb->dev, epnum,1 , sndtog); + max3421_hcd->curr_urb =NULL ;spin_lock_irqsave (&max3421_hcd->lock, flags);usb_hcd_unlink_urb_from_ep (hcd, urb);
Greg Kroah-Hartman
maintainerPATCH 100/120 usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
commit 5719df243e118fb343725e8b2afb1637e1af1373 upstream.
This driver has a potential issue which this driver is possible to cause superfluous irqs after usb_pkt_pop() is called. So, after the commit 3af32605289e ("usb: renesas_usbhs: fix error return code of usbhsf_pkt_handler()") had been applied, we could observe the following error happened when we used g_audio.
renesas_usbhs e6590000.usb: irq_ready run_error 1 : -22
To fix the issue, disable the tx or rx interrupt in usb_pkt_pop().
--- drivers/usb/renesas_usbhs/fifo.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/renesas_usbhs/fifo.c +7 -0
@@ -101,6 +101,8 @@ static struct dma_chan *usbhsf_dma_chan_#define usbhsf_dma_map (p) __usbhsf_dma_map_ctrl(p, 1)#define usbhsf_dma_unmap (p) __usbhsf_dma_map_ctrl(p, 0)static int __usbhsf_dma_map_ctrl (struct usbhs_pkt *pkt,int map); +static void usbhsf_tx_irq_ctrl (struct usbhs_pipe *pipe,int enable); +static void usbhsf_rx_irq_ctrl (struct usbhs_pipe *pipe,int enable);struct usbhs_pkt *usbhs_pkt_pop (struct usbhs_pipe *pipe,struct usbhs_pkt *pkt) {struct usbhs_priv *priv =usbhs_pipe_to_priv (pipe);
@@ -123,6 +125,11 @@ struct usbhs_pkt *usbhs_pkt_pop(struct uif (chan) {dmaengine_terminate_all (chan);usbhsf_dma_unmap (pkt); + }else { +if (usbhs_pipe_is_dir_in (pipe)) +usbhsf_rx_irq_ctrl (pipe,0 ); +else +usbhsf_tx_irq_ctrl (pipe,0 ); }usbhs_pipe_clear_without_sequence (pipe,0 ,0 );
Greg Kroah-Hartman
maintainerPATCH 101/120 USB: serial: option: add support for u-blox LARA-R6 family
In reply to Greg Kroah-HartmanFrom: Marco De Marco <[email protected]>
commit 94b619a07655805a1622484967754f5848640456 upstream.
The patch is meant to support LARA-R6 Cat 1 module family.
Module USB ID:
Vendor ID: 0x05c6
Product ID: 0x90fA
Interface layout:
If 0: Diagnostic
If 1: AT parser
If 2: AT parser
If 3: QMI wwan (not available in all versions)
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -238,6 +238,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_UC15 0x9090/* These u-blox products use Qualcomm's vendor ID */ #define UBLOX_PRODUCT_R410M 0x90b2 +#define UBLOX_PRODUCT_R6XX 0x90fa/* These Yuga products use Qualcomm's vendor ID */ #define YUGA_PRODUCT_CLM920_NC5 0x9625
@@ -1101,6 +1102,8 @@ static const struct usb_device_id option/* u-blox products using Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M), .driver_info = RSVD(1) | RSVD(3) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX), + .driver_info = RSVD(3) }, /* Quectel products using Quectel vendor ID */ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff), .driver_info = NUMEP2 },
Greg Kroah-Hartman
maintainerPATCH 102/120 USB: serial: cp210x: fix comments for GE CS1000
In reply to Greg Kroah-HartmanFrom: Ian Ray <[email protected]>
commit e9db418d4b828dd049caaf5ed65dc86f93bb1a0c upstream.
Fix comments for GE CS1000 CP210x USB ID assignments.
--- drivers/usb/serial/cp210x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/serial/cp210x.c +2 -2
@@ -203,8 +203,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */ { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */ - { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */ - { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */ + { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 M.2 Key E serial interface */ + { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 Display serial interface */ { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
Greg Kroah-Hartman
maintainerPATCH 103/120 USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
In reply to Greg Kroah-HartmanFrom: John Keeping <[email protected]>
commit d6a206e60124a9759dd7f6dfb86b0e1d3b1df82e upstream.
Add the USB serial device ID for the CEL ZigBee EM3588 radio stick.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -156,6 +156,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */ { USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0x8A5B) }, /* CEL EM3588 ZigBee USB Stick */ { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
Greg Kroah-Hartman
maintainerPATCH 104/120 usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
In reply to Greg Kroah-HartmanFrom: Minas Harutyunyan <[email protected]>
commit d53dc38857f6dbefabd9eecfcbf67b6eac9a1ef4 upstream.
Sending zero length packet in DDMA mode perform by DMA descriptor by setting SP (short packet) flag.
For DDMA in function dwc2_hsotg_complete_in() does not need to send zlp.
Tested by USBCV MSC tests.
--- drivers/usb/dwc2/gadget.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/usb/dwc2/gadget.c +6 -4
@@ -2645,12 +2645,14 @@ static void dwc2_hsotg_complete_in(strucreturn ; } -/* Zlp for all endpoints, for ep0 only in DATA IN stage */ +/* Zlp for all endpoints in non DDMA, for ep0 only in DATA IN stage */ if (hs_ep->send_zlp) { -dwc2_hsotg_program_zlp (hsotg, hs_ep); hs_ep->send_zlp =0 ; -/* transfer will be completed on next complete interrupt */ -return ; +if (!using_desc_dma (hsotg)) { +dwc2_hsotg_program_zlp (hsotg, hs_ep); +/* transfer will be completed on next complete interrupt */ +return ; + } }if (hs_ep->index ==0 && hsotg->ep0_state ==DWC2_EP0_DATA_IN ) {
Greg Kroah-Hartman
maintainerPATCH 105/120 tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
In reply to Greg Kroah-HartmanFrom: Haoran Luo <[email protected]>
commit 67f0d6d9883c13174669f88adac4f0ee656cc16a upstream.
The "rb_per_cpu_empty()" misinterpret the condition (as not-empty) when "head_page" and "commit_page" of "struct ring_buffer_per_cpu" points to the same buffer page, whose "buffer_data_page" is empty and "read" field is non-zero.
An error scenario could be constructed as followed (kernel perspective):
1. All pages in the buffer has been accessed by reader(s) so that all of them will have non-zero "read" field.
2. Read and clear all buffer pages so that "rb_num_of_entries()" will return 0 rendering there's no more data to read. It is also required that the "read_page", "commit_page" and "tail_page" points to the same page, while "head_page" is the next page of them.
3. Invoke "ring_buffer_lock_reserve()" with large enough "length" so that it shot pass the end of current tail buffer page. Now the "head_page", "commit_page" and "tail_page" points to the same page.
4. Discard current event with "ring_buffer_discard_commit()", so that "head_page", "commit_page" and "tail_page" points to a page whose buffer data page is now empty.
When the error scenario has been constructed, "tracing_read_pipe" will be trapped inside a deadloop: "trace_empty()" returns 0 since "rb_per_cpu_empty()" returns 0 when it hits the CPU containing such constructed ring buffer. Then "trace_find_next_entry_inc()" always return NULL since "rb_num_of_entries()" reports there's no more entry to read. Finally "trace_seq_to_user()" returns "-EBUSY" spanking "tracing_read_pipe" back to the start of the "waitagain" loop.
I've also written a proof-of-concept script to construct the scenario and trigger the bug automatically, you can use it to trace and validate my reasoning above:
https://github.com/aegistudio/RingBufferDetonator.git
Tests has been carried out on linux kernel 5.14-rc2 (2734d6c1b1a089fb593ef6a23d4b70903526fe0c), my fixed version of kernel (for testing whether my update fixes the bug) and some older kernels (for range of affected kernels). Test result is also attached to the proof-of-concept repository.
--- kernel/trace/ring_buffer.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
kernel/trace/ring_buffer.c +24 -4
@@ -3172,10 +3172,30 @@ static bool rb_per_cpu_empty(struct ringif (unlikely (!head))return true; -return reader->read ==rb_page_commit (reader) && - (commit == reader || - (commit == head && - head->read ==rb_page_commit (commit))); +/* Reader should exhaust content in reader page */ +if (reader->read !=rb_page_commit (reader)) +return false; + +/* +* If writers are committing on the reader page, knowing all +* committed content has been read, the ring buffer is empty. +*/ +if (commit == reader) +return true; + +/* +* If writers are committing on a page other than reader page +* and head page, there should always be content to read. +*/ +if (commit != head) +return false; + +/* +* Writers are committing on the head page, we just need +* to care about there're committed data, and the reader will +* swap reader page with head page when it is to read data. +*/ +return rb_page_commit (commit) ==0 ; }/**
Greg Kroah-Hartman
maintainerPATCH 106/120 media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 8d4abca95ecc82fc8c41912fa0085281f19cc29f upstream.
Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds:
arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]
The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above).
Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy().
This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- drivers/media/pci/ngene/ngene-core.c | 2 +- drivers/media/pci/ngene/ngene.h | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-)
drivers/media/pci/ngene/ngene-core.c +1 -1
@@ -398,7 +398,7 @@ static int ngene_command_config_free_buf com.cmd.hdr.Opcode =CMD_CONFIGURE_FREE_BUFFER ; com.cmd.hdr.Length =6 ; -memcpy (&com.cmd.ConfigureBuffers.config, config,6 ); +memcpy (&com.cmd.ConfigureFreeBuffers.config, config,6 ); com.in_len =6 ; com.out_len =0 ;
drivers/media/pci/ngene/ngene.h +8 -6
@@ -419,12 +419,14 @@ enum _BUFFER_CONFIGS {struct FW_CONFIGURE_FREE_BUFFERS {struct FW_HEADER hdr; -u8 UVI1_BufferLength; -u8 UVI2_BufferLength; -u8 TVO_BufferLength; -u8 AUD1_BufferLength; -u8 AUD2_BufferLength; -u8 TVA_BufferLength; +struct { +u8 UVI1_BufferLength; +u8 UVI2_BufferLength; +u8 TVO_BufferLength; +u8 AUD1_BufferLength; +u8 AUD2_BufferLength; +u8 TVA_BufferLength; + } __packed config; } __attribute__ ((__packed__ ));struct FW_CONFIGURE_UART {
Greg Kroah-Hartman
maintainerPATCH 107/120 ixgbe: Fix packet corruption due to missing DMA sync
In reply to Greg Kroah-HartmanFrom: Markus Boehme <[email protected]>
commit 09cfae9f13d51700b0fecf591dcd658fc5375428 upstream.
When receiving a packet with multiple fragments, hardware may still touch the first fragment until the entire packet has been received. The driver therefore keeps the first fragment mapped for DMA until end of packet has been asserted, and delays its dma_sync call until then.
The driver tries to fit multiple receive buffers on one page. When using 3K receive buffers (e.g. using Jumbo frames and legacy-rx is turned off/build_skb is being used) on an architecture with 4K pages, the driver allocates an order 1 compound page and uses one page per receive buffer. To determine the correct offset for a delayed DMA sync of the first fragment of a multi-fragment packet, the driver then cannot just use PAGE_MASK on the DMA address but has to construct a mask based on the actual size of the backing page.
Using PAGE_MASK in the 3K RX buffer/4K page architecture configuration will always sync the first page of a compound page. With the SWIOTLB enabled this can lead to corrupted packets (zeroed out first fragment, re-used garbage from another packet) and various consequences, such as slow/stalling data transfers and connection resets. For example, testing on a link with MTU exceeding 3058 bytes on a host with SWIOTLB enabled (e.g. "iommu=soft swiotlb=262144,force") TCP transfers quickly fizzle out without this patch.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +2 -1
@@ -1823,7 +1823,8 @@ static void ixgbe_dma_sync_frag(struct i struct sk_buff *skb) {if (ring_uses_build_skb (rx_ring)) { -unsigned long offset = (unsigned long )(skb->data) & ~PAGE_MASK ; +unsigned long mask = (unsigned long )ixgbe_rx_pg_size (rx_ring) -1 ; +unsigned long offset = (unsigned long )(skb->data) & mask; dma_sync_single_range_for_cpu(rx_ring->dev, IXGBE_CB(skb)->dma,
Greg Kroah-Hartman
maintainerPATCH 108/120 selftest: use mmap instead of posix_memalign to allocate memory
In reply to Greg Kroah-HartmanFrom: Peter Collingbourne <[email protected]>
commit 0db282ba2c12c1515d490d14a1ff696643ab0f1b upstream.
This test passes pointers obtained from anon_allocate_area to the userfaultfd and mremap APIs. This causes a problem if the system allocator returns tagged pointers because with the tagged address ABI the kernel rejects tagged addresses passed to these APIs, which would end up causing the test to fail. To make this test compatible with such system allocators, stop using the system allocator to allocate memory in anon_allocate_area, and instead just use mmap.
--- tools/testing/selftests/vm/userfaultfd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/selftests/vm/userfaultfd.c +4 -2
@@ -129,8 +129,10 @@ static int anon_release_pages(char *rel_static void anon_allocate_area (void **alloc_area) { -if (posix_memalign (alloc_area, page_size, nr_pages * page_size)) { -fprintf (stderr,"out of memory\n" ); + *alloc_area =mmap (NULL , nr_pages * page_size,PROT_READ |PROT_WRITE , +MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); +if (*alloc_area ==MAP_FAILED ) +fprintf (stderr,"mmap of anonymous memory failed" ); *alloc_area =NULL ; } }
Greg Kroah-Hartman
maintainerPATCH 109/120 nds32: fix up stack guard gap
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit c453db6cd96418c79702eaf38259002755ab23ff upstream.
Commit 1be7107fbe18 ("mm: larger stack guard gap, between vmas") fixed up all architectures to deal with the stack guard gap. But when nds32 was added to the tree, it forgot to do the same thing.
Resolve this by properly fixing up the nsd32's version of arch_get_unmapped_area()
--- arch/nds32/mm/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/nds32/mm/mmap.c +1 -1
@@ -59,7 +59,7 @@ arch_get_unmapped_area(struct file *filp vma =find_vma (mm, addr);if (TASK_SIZE - len >= addr && - (!vma || addr + len <= vma->vm_start)) + (!vma || addr + len <=vm_start_gap (vma)))return addr; }
Greg Kroah-Hartman
maintainerPATCH 110/120 drm: Return -ENOTTY for non-drm ioctls
In reply to Greg Kroah-HartmanFrom: Charles Baylis <[email protected]>
commit 3abab27c322e0f2acf981595aa8040c9164dc9fb upstream.
drm: Return -ENOTTY for non-drm ioctls
Return -ENOTTY from drm_ioctl() when userspace passes in a cmd number which doesn't relate to the drm subsystem.
Glibc uses the TCGETS ioctl to implement isatty(), and without this change isatty() returns it incorrectly returns true for drm devices.
To test run this command:
$ if [ -t 0 ]; then echo is a tty; fi < /dev/dri/card0 which shows "is a tty" without this patch.
This may also modify memory which the userspace application is not expecting.
--- drivers/gpu/drm/drm_ioctl.c | 3 +++ include/drm/drm_ioctl.h | 1 + 2 files changed, 4 insertions(+)
drivers/gpu/drm/drm_ioctl.c +3 -0
@@ -797,6 +797,9 @@ long drm_ioctl(struct file *filp,if (drm_dev_is_unplugged (dev))return -ENODEV ; +if (DRM_IOCTL_TYPE (cmd) !=DRM_IOCTL_BASE ) +return -ENOTTY ; + is_driver_ioctl = nr >=DRM_COMMAND_BASE && nr <DRM_COMMAND_END ;if (is_driver_ioctl) {
include/drm/drm_ioctl.h +1 -0
@@ -68,6 +68,7 @@ typedef int drm_ioctl_compat_t(struct fi unsigned long arg);#define DRM_IOCTL_NR (n) _IOC_NR(n) +#define DRM_IOCTL_TYPE (n) _IOC_TYPE(n)#define DRM_MAJOR 226/**
Greg Kroah-Hartman
maintainerPATCH 111/120 KVM: do not assume PTE is writable after follow_pfn
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit bd2fae8da794b55bf2ac02632da3a151b10e664c upstream.
In order to convert an HVA to a PFN, KVM usually tries to use the get_user_pages family of functinso. This however is not possible for VM_IO vmas; in that case, KVM instead uses follow_pfn.
In doing this however KVM loses the information on whether the PFN is writable. That is usually not a problem because the main use of VM_IO vmas with KVM is for BARs in PCI device assignment, however it is a bug. To fix it, use follow_pte and check pte_write while under the protection of the PTE lock. The information can be used to fail hva_to_pfn_remapped or passed back to the caller via *writable.
Usage of follow_pfn was introduced in commit add6a0cd1c5b ("KVM: MMU: try to fix up page faults before giving up", 2016-07-05); however, even older version have the same issue, all the way back to commit 2e2e3738af33 ("KVM:
Handle vma regions with no backing page", 2008-07-20), as they also did not check whether the PFN was writable.
--- virt/kvm/kvm_main.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
virt/kvm/kvm_main.c +12 -3
@@ -1495,9 +1495,11 @@ static int hva_to_pfn_remapped(struct vm kvm_pfn_t *p_pfn) {unsigned long pfn; +pte_t *ptep; +spinlock_t *ptl;int r; - r =follow_pfn (vma, addr, &pfn); + r =follow_pte_pmd (vma->vm_mm, addr,NULL ,NULL , &ptep,NULL , &ptl);if (r) {/* * get_user_pages fails for VM_IO and VM_PFNMAP vmas and does
@@ -1512,14 +1514,19 @@ static int hva_to_pfn_remapped(struct vmif (r)return r; - r =follow_pfn (vma, addr, &pfn); + r =follow_pte_pmd (vma->vm_mm, addr,NULL ,NULL , &ptep,NULL , &ptl);if (r)return r; + } +if (write_fault && !pte_write (*ptep)) { + pfn =KVM_PFN_ERR_RO_FAULT ; + goto out; }if (writable) - *writable = true; + *writable =pte_write (*ptep); + pfn =pte_pfn (*ptep);/* * Get a reference here because callers of *hva_to_pfn* and
@@ -1534,6 +1541,8 @@ static int hva_to_pfn_remapped(struct vm*/ kvm_get_pfn (pfn); +out: +pte_unmap_unlock (ptep, ptl); *p_pfn = pfn;return 0 ; }
Re: [PATCH 4.19 111/120] KVM: do not assume PTE is writable after follow_pfn
Hi Greg,
Quoted 4 lines · Greg Kroah-Hartman
From: Paolo Bonzini <[email protected]>
commit
bd2fae8da794b55bf2ac02632da3a151b10e664cupstream.
The build of mips malta_kvm_defconfig fails with the error:
In file included from arch/mips/kvm/../../../virt/kvm/kvm_main.c:21:arch/mips/kvm/../../../virt/kvm/kvm_main.c: In function 'hva_to_pfn_remapped':./include/linux/kvm_host.h:70:33: error: conversion from 'long long unsigned int' to 'long unsigned int' changes value from '9218868437227405314' to '2' [-Werror=overflow]
70 | #define KVM_PFN_ERR_RO_FAULT (KVM_PFN_ERR_MASK + 2)
| ^arch/mips/kvm/../../../virt/kvm/kvm_main.c:1530:23: note: in expansion of macro 'KVM_PFN_ERR_RO_FAULT'
1530 | pfn = KVM_PFN_ERR_RO_FAULT;
It built fine after reverting this patch.
gcc version 11.1.1 20210723
Signature · 2 lines
Regards Sudip
Re: [PATCH 4.19 111/120] KVM: do not assume PTE is writable after follow_pfn
Quoted 15 lines · Sudip Mukherjee
Hi Greg,
Quoted 4 lines · Greg Kroah-Hartman
From: Paolo Bonzini <[email protected]>
commit
bd2fae8da794b55bf2ac02632da3a151b10e664cupstream.The build of mips
malta_kvm_defconfigfails with the error:
In file included fromarch/mips/kvm/../../../virt/kvm/kvm_main.c:21:arch/mips/kvm/../../../virt/kvm/kvm_main.c: In function 'hva_to_pfn_remapped':./include/linux/kvm_host.h:70:33: error: conversion from 'long long unsigned int' to 'long unsigned int' changes value from '9218868437227405314' to '2' [-Werror=overflow]
Quoted 8 lines
70 | #define KVM_PFN_ERR_RO_FAULT (KVM_PFN_ERR_MASK + 2) | ^
arch/mips/kvm/../../../virt/kvm/kvm_main.c:1530:23: note: in expansion of macro 'KVM_PFN_ERR_RO_FAULT'
1530 | pfn =KVM_PFN_ERR_RO_FAULT;It built fine after reverting this patch.
gcc version 11.1.1 20210723
I'll resend a version that works tomorrow (including the second patch too, which depends on this one for context).
Paolo
Re: [PATCH 4.19 111/120] KVM: do not assume PTE is writable after follow_pfn
Hi,
Quoted 24 lines · Paolo Bonzini
[Please note: This e-mail is from an EXTERNAL e-mail address]
Quoted 21 lines · Sudip Mukherjee
Hi Greg,
Quoted 4 lines · Greg Kroah-Hartman
From: Paolo Bonzini <[email protected]>
commit
bd2fae8da794b55bf2ac02632da3a151b10e664cupstream.The build of mips
malta_kvm_defconfigfails with the error:
In file included fromarch/mips/kvm/../../../virt/kvm/kvm_main.c:21:arch/mips/kvm/../../../virt/kvm/kvm_main.c: In function 'hva_to_pfn_remapped':./include/linux/kvm_host.h:70:33: error: conversion from 'long long unsigned int' to 'long unsigned int' changes value from '9218868437227405314' to '2' [-Werror=overflow]
70 | #define KVM_PFN_ERR_RO_FAULT (KVM_PFN_ERR_MASK+ 2)
| ^arch/mips/kvm/../../../virt/kvm/kvm_main.c:1530:23: note: in expansion of macro 'KVM_PFN_ERR_RO_FAULT'
1530 | pfn =KVM_PFN_ERR_RO_FAULT;
Quoted 6 lines
Quoted 2 lines
It built fine after reverting this patch.
gcc version 11.1.1 20210723I'll resend a version that works tomorrow (including the second patch too, which depends on this one for context).
The following upstream commit needed to be backported as well:
I have sent v2 for this patchset.
Thanks!
Ovidiu
Quoted 2 lines
Paolo
Greg Kroah-Hartman
maintainerPATCH 112/120 KVM: do not allow mapping valid but non-reference-counted pages
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
commit f8be156be163a052a067306417cd0ff679068c97 upstream.
It's possible to create a region which maps valid but non-refcounted pages (e.g., tail pages of non-compound higher order allocations). These host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family of APIs, which take a reference to the page, which takes it from 0 to 1. When the reference is dropped, this will free the page incorrectly.
Fix this by only taking a reference on valid pages if it was non-zero, which indicates it is participating in normal refcounting (and can be released with put_page).
This addresses CVE-2021-22543.
--- virt/kvm/kvm_main.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
virt/kvm/kvm_main.c +17 -2
@@ -1489,6 +1489,13 @@ static bool vma_is_valid(struct vm_area_return true; } +static int kvm_try_get_pfn (kvm_pfn_t pfn) +{ +if (kvm_is_reserved_pfn (pfn)) +return 1 ; +return get_page_unless_zero (pfn_to_page (pfn)); +} + static int hva_to_pfn_remapped(struct vm_area_struct *vma, unsigned long addr, bool *async, bool write_fault, bool *writable,
@@ -1538,13 +1545,21 @@ static int hva_to_pfn_remapped(struct vm* Whoever called remap_pfn_range is also going to call e.g. * unmap_mapping_range before the underlying pages are freed, * causing a call to our MMU notifier. +* +* Certain IO or PFNMAP mappings can be backed with valid +* struct pages, but be allocated without refcounting e.g., +* tail pages of non-compound higher order allocations, which +* would then underflow the refcount when the caller does the +* required put_page. Don't allow those pages here. */ -kvm_get_pfn (pfn); +if (!kvm_try_get_pfn (pfn)) + r = -EFAULT ; out:pte_unmap_unlock (ptep, ptl); *p_pfn = pfn; -return 0 ; + +return r; }/*
Greg Kroah-Hartman
maintainerPATCH 113/120 net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit 11527f3c4725640e6c40a2b7654e303f45e82a6c upstream.
Commit 40cff8fca9e3 ("net: dsa: mv88e6xxx: Fix stats histogram mode") introduced wrong .stats_set_histogram() method for Topaz family.
The Peridot method should be used instead.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -3051,7 +3051,7 @@ static const struct mv88e6xxx_ops mv88e6 .port_link_state = mv88e6352_port_link_state, .port_get_cmode = mv88e6352_port_get_cmode, .stats_snapshot = mv88e6390_g1_stats_snapshot, - .stats_set_histogram = mv88e6095_g1_stats_set_histogram, + .stats_set_histogram = mv88e6390_g1_stats_set_histogram, .stats_get_sset_count = mv88e6320_stats_get_sset_count, .stats_get_strings = mv88e6320_stats_get_strings, .stats_get_stats = mv88e6390_stats_get_stats,
@@ -3672,7 +3672,7 @@ static const struct mv88e6xxx_ops mv88e6 .port_link_state = mv88e6352_port_link_state, .port_get_cmode = mv88e6352_port_get_cmode, .stats_snapshot = mv88e6390_g1_stats_snapshot, - .stats_set_histogram = mv88e6095_g1_stats_set_histogram, + .stats_set_histogram = mv88e6390_g1_stats_set_histogram, .stats_get_sset_count = mv88e6320_stats_get_sset_count, .stats_get_strings = mv88e6320_stats_get_strings, .stats_get_stats = mv88e6390_stats_get_stats,
Greg Kroah-Hartman
maintainerPATCH 114/120 net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
In reply to Greg Kroah-HartmanFrom: Doug Berger <[email protected]>
commit 5a3c680aa2c12c90c44af383fe6882a39875ab81 upstream.
Setting the EXT_ENERGY_DET_MASK bit allows the port energy detection logic of the internal PHY to prevent the system from sleeping. Some internal PHYs will report that energy is detected when the network interface is closed which can prevent the system from going to sleep if WoL is enabled when the interface is brought down.
Since the driver does not support waking the system on this logic, this commit clears the bit whenever the internal PHY is powered up and the other logic for manipulating the bit is removed since it serves no useful function.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++-------------- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 6 ------ 2 files changed, 2 insertions(+), 20 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +2 -14
@@ -1189,7 +1189,8 @@ static void bcmgenet_power_up(struct bcmswitch (mode) {case GENET_POWER_PASSIVE : - reg &= ~(EXT_PWR_DOWN_DLL |EXT_PWR_DOWN_BIAS ); + reg &= ~(EXT_PWR_DOWN_DLL |EXT_PWR_DOWN_BIAS | +EXT_ENERGY_DET_MASK );if (GENET_IS_V5 (priv)) { reg &= ~(EXT_PWR_DOWN_PHY_EN | EXT_PWR_DOWN_PHY_RD |
@@ -2908,12 +2909,6 @@ static int bcmgenet_open(struct net_devibcmgenet_set_hw_addr (priv, dev->dev_addr); -if (priv->internal_phy) { - reg =bcmgenet_ext_readl (priv,EXT_EXT_PWR_MGMT ); - reg |=EXT_ENERGY_DET_MASK ; -bcmgenet_ext_writel (priv, reg,EXT_EXT_PWR_MGMT ); - } -/* Disable RX/TX DMA and flush TX queues */ dma_ctrl =bcmgenet_dma_disable (priv);
@@ -3632,7 +3627,6 @@ static int bcmgenet_resume(struct devicestruct bcmgenet_priv *priv =netdev_priv (dev);unsigned long dma_ctrl;int ret; -u32 reg;if (!netif_running (dev))return 0 ;
@@ -3664,12 +3658,6 @@ static int bcmgenet_resume(struct devicebcmgenet_set_hw_addr (priv, dev->dev_addr); -if (priv->internal_phy) { - reg =bcmgenet_ext_readl (priv,EXT_EXT_PWR_MGMT ); - reg |=EXT_ENERGY_DET_MASK ; -bcmgenet_ext_writel (priv, reg,EXT_EXT_PWR_MGMT ); - } -if (priv->wolopts)bcmgenet_power_up (priv,GENET_POWER_WOL_MAGIC );
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c +0 -6
@@ -166,12 +166,6 @@ int bcmgenet_wol_power_down_cfg(struct b reg |=CMD_RX_EN ;bcmgenet_umac_writel (priv, reg,UMAC_CMD ); -if (priv->hw_params->flags &GENET_HAS_EXT ) { - reg =bcmgenet_ext_readl (priv,EXT_EXT_PWR_MGMT ); - reg &= ~EXT_ENERGY_DET_MASK ; -bcmgenet_ext_writel (priv, reg,EXT_EXT_PWR_MGMT ); - } -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 115/120 iio: accel: bma180: Use explicit member assignment
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit 9436abc40139503a7cea22a96437697d048f31c0 upstream
This uses the C99 explicit .member assignment for the variant data in struct bma180_part_info. This makes it easier to understand and add new variants.
--- drivers/iio/accel/bma180.c | 68 +++++++++++++++++++++++++++++---------------- 1 file changed, 44 insertions(+), 24 deletions(-)
drivers/iio/accel/bma180.c +44 -24
@@ -625,32 +625,52 @@ static const struct iio_chan_spec bma250static const struct bma180_part_info bma180_part_info[] = { [BMA180 ] = { - bma180_channels,ARRAY_SIZE (bma180_channels), - bma180_scale_table,ARRAY_SIZE (bma180_scale_table), - bma180_bw_table,ARRAY_SIZE (bma180_bw_table), -BMA180_CTRL_REG0 ,BMA180_RESET_INT , -BMA180_CTRL_REG0 ,BMA180_SLEEP , -BMA180_BW_TCS ,BMA180_BW , -BMA180_OFFSET_LSB1 ,BMA180_RANGE , -BMA180_TCO_Z ,BMA180_MODE_CONFIG ,BMA180_LOW_POWER , -BMA180_CTRL_REG3 ,BMA180_NEW_DATA_INT , -BMA180_RESET , - bma180_chip_config, - bma180_chip_disable, + .channels = bma180_channels, + .num_channels =ARRAY_SIZE (bma180_channels), + .scale_table = bma180_scale_table, + .num_scales =ARRAY_SIZE (bma180_scale_table), + .bw_table = bma180_bw_table, + .num_bw =ARRAY_SIZE (bma180_bw_table), + .int_reset_reg =BMA180_CTRL_REG0 , + .int_reset_mask =BMA180_RESET_INT , + .sleep_reg =BMA180_CTRL_REG0 , + .sleep_mask =BMA180_SLEEP , + .bw_reg =BMA180_BW_TCS , + .bw_mask =BMA180_BW , + .scale_reg =BMA180_OFFSET_LSB1 , + .scale_mask =BMA180_RANGE , + .power_reg =BMA180_TCO_Z , + .power_mask =BMA180_MODE_CONFIG , + .lowpower_val =BMA180_LOW_POWER , + .int_enable_reg =BMA180_CTRL_REG3 , + .int_enable_mask =BMA180_NEW_DATA_INT , + .softreset_reg =BMA180_RESET , + .chip_config = bma180_chip_config, + .chip_disable = bma180_chip_disable, }, [BMA250 ] = { - bma250_channels,ARRAY_SIZE (bma250_channels), - bma250_scale_table,ARRAY_SIZE (bma250_scale_table), - bma250_bw_table,ARRAY_SIZE (bma250_bw_table), -BMA250_INT_RESET_REG ,BMA250_INT_RESET_MASK , -BMA250_POWER_REG ,BMA250_SUSPEND_MASK , -BMA250_BW_REG ,BMA250_BW_MASK , -BMA250_RANGE_REG ,BMA250_RANGE_MASK , -BMA250_POWER_REG ,BMA250_LOWPOWER_MASK ,1 , -BMA250_INT_ENABLE_REG ,BMA250_DATA_INTEN_MASK , -BMA250_RESET_REG , - bma250_chip_config, - bma250_chip_disable, + .channels = bma250_channels, + .num_channels =ARRAY_SIZE (bma250_channels), + .scale_table = bma250_scale_table, + .num_scales =ARRAY_SIZE (bma250_scale_table), + .bw_table = bma250_bw_table, + .num_bw =ARRAY_SIZE (bma250_bw_table), + .int_reset_reg =BMA250_INT_RESET_REG , + .int_reset_mask =BMA250_INT_RESET_MASK , + .sleep_reg =BMA250_POWER_REG , + .sleep_mask =BMA250_SUSPEND_MASK , + .bw_reg =BMA250_BW_REG , + .bw_mask =BMA250_BW_MASK , + .scale_reg =BMA250_RANGE_REG , + .scale_mask =BMA250_RANGE_MASK , + .power_reg =BMA250_POWER_REG , + .power_mask =BMA250_LOWPOWER_MASK , + .lowpower_val =1 , + .int_enable_reg =BMA250_INT_ENABLE_REG , + .int_enable_mask =BMA250_DATA_INTEN_MASK , + .softreset_reg =BMA250_RESET_REG , + .chip_config = bma250_chip_config, + .chip_disable = bma250_chip_disable, }, };
Greg Kroah-Hartman
maintainerPATCH 116/120 iio: accel: bma180: Fix BMA25x bandwidth register values
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
commit 8090d67421ddab0ae932abab5a60200598bf0bbb upstream
According to the BMA253 datasheet [1] and BMA250 datasheet [2] the bandwidth value for BMA25x should be set as 01xxx:
"Settings 00xxx result in a bandwidth of 7.81 Hz; [...]
It is recommended [...] to use the range from ´01000b´ to ´01111b´ only in order to be compatible with future products."
However, at the moment the drivers sets bandwidth values from 0 to 6, which is not recommended and always results into 7.81 Hz bandwidth according to the datasheet.
Fix this by introducing a bw_offset = 8 = 01000b for BMA25x, so the additional bit is always set for BMA25x.
[1]: https://www.bosch-sensortec.com/media/boschsensortec/downloads/datasheets/bst-bma253-ds000.pdf
[2]: https://datasheet.octopart.com/BMA250-Bosch-datasheet-15540103.pdf
--- drivers/iio/accel/bma180.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/iio/accel/bma180.c +5 -2
@@ -50,7 +50,7 @@ struct bma180_part_info {u8 int_reset_reg, int_reset_mask;u8 sleep_reg, sleep_mask; -u8 bw_reg, bw_mask; +u8 bw_reg, bw_mask, bw_offset;u8 scale_reg, scale_mask;u8 power_reg, power_mask, lowpower_val;u8 int_enable_reg, int_enable_mask;
@@ -106,6 +106,7 @@ struct bma180_part_info {#define BMA250_RANGE_MASK GENMASK(3, 0)/* Range of accel values */ #define BMA250_BW_MASK GENMASK(4, 0)/* Accel bandwidth */ +#define BMA250_BW_OFFSET 8#define BMA250_SUSPEND_MASK BIT(7)/* chip will sleep */ #define BMA250_LOWPOWER_MASK BIT(6)#define BMA250_DATA_INTEN_MASK BIT(4)
@@ -243,7 +244,8 @@ static int bma180_set_bw(struct bma180_dfor (i =0 ; i < data->part_info->num_bw; ++i) {if (data->part_info->bw_table[i] == val) { ret =bma180_set_bits (data, data->part_info->bw_reg, - data->part_info->bw_mask, i); + data->part_info->bw_mask, + i + data->part_info->bw_offset);if (ret) {dev_err (&data->client->dev,"failed to set bandwidth\n" );
@@ -661,6 +663,7 @@ static const struct bma180_part_info bma .sleep_mask = BMA250_SUSPEND_MASK, .bw_reg = BMA250_BW_REG, .bw_mask = BMA250_BW_MASK, + .bw_offset = BMA250_BW_OFFSET, .scale_reg = BMA250_RANGE_REG, .scale_mask = BMA250_RANGE_MASK, .power_reg = BMA250_POWER_REG,
Greg Kroah-Hartman
maintainerPATCH 117/120 btrfs: compression: dont try to compress if we dont have enough pages
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
commit f2165627319ffd33a6217275e5690b1ab5c45763 upstream
The early check if we should attempt compression does not take into account the number of input pages. It can happen that there's only one page, eg. a tail page after some ranges of the BTRFS_MAX_UNCOMPRESSED have been processed, or an isolated page that won't be converted to an inline extent.
The single page would be compressed but a later check would drop it again because the result size must be at least one block shorter than the input. That can never work with just one page.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -530,7 +530,7 @@ again:* inode has not been flagged as nocompress. This flag can * change at any time if we discover bad compression ratios. */ -if (inode_need_compress (inode, start, end)) { +if (nr_pages >1 &&inode_need_compress (inode, start, end)) {WARN_ON (pages); pages =kcalloc (nr_pages,sizeof (struct page *),GFP_NOFS );if (!pages) {
Greg Kroah-Hartman
maintainerPATCH 118/120 PCI: Mark AMD Navi14 GPU ATS as broken
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
commit e8946a53e2a698c148b3b3ed732f43c7747fbeb6 upstream
Observed unexpected GPU hang during runpm stress test on 0x7341 rev 0x00. Further debugging shows broken ATS is related.
Disable ATS on this part. Similar issues on other devices:
a2da5d8cc0b0 ("PCI: Mark AMD Raven iGPU ATS as broken in some platforms") 45beb31d3afb ("PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken") 5e89cd303e3a ("PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken")
--- drivers/pci/quirks.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/quirks.c +3 -1
@@ -5172,7 +5172,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SEstatic void quirk_amd_harvest_no_ats (struct pci_dev *pdev) {if ((pdev->device ==0x7312 && pdev->revision !=0x00 ) || - (pdev->device ==0x7340 && pdev->revision !=0xc5 )) + (pdev->device ==0x7340 && pdev->revision !=0xc5 ) || + (pdev->device ==0x7341 && pdev->revision !=0x00 ))return ;pci_info (pdev,"disabling ATS\n" );
@@ -5187,6 +5188,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATDECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x7312 , quirk_amd_harvest_no_ats);/* AMD Navi14 dGPU */ DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x7340 , quirk_amd_harvest_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x7341 , quirk_amd_harvest_no_ats);#endif /* CONFIG_PCI_ATS */ /* Freescale PCIe doesn't support MSI in RC mode */
Greg Kroah-Hartman
maintainerPATCH 119/120 spi: spi-fsl-dspi: Fix a resource leak in an error handling path
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 680ec0549a055eb464dce6ffb4bfb736ef87236e upstream
'dspi_request_dma()' should be undone by a 'dspi_release_dma()' call in the error handling path of the probe function, as already done in the remove function
--- drivers/spi/spi-fsl-dspi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/spi/spi-fsl-dspi.c +3 -1
@@ -1124,11 +1124,13 @@ static int dspi_probe(struct platform_de ret =spi_register_master (master);if (ret !=0 ) {dev_err (&pdev->dev,"Problem registering DSPI master\n" ); - goto out_free_irq; + goto out_release_dma; }return ret; +out_release_dma: +dspi_release_dma (dspi); out_free_irq:if (dspi->irq)free_irq (dspi->irq, dspi);
Greg Kroah-Hartman
maintainerPATCH 120/120 xhci: add xhci_get_virt_ep() helper
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[commit b1adc42d440df3233255e313a45ab7e9b2b74096 upstream]
In several event handlers we need to find the right endpoint structure from slot_id and ep_index in the event.
Add a helper for this, check that slot_id and ep_index are valid.
--- drivers/usb/host/xhci-ring.c | 58 +++++++++++++++++++++++++++++++++---------- drivers/usb/host/xhci.h | 3 +- 2 files changed, 47 insertions(+), 14 deletions(-)
drivers/usb/host/xhci-ring.c +45 -13
@@ -433,6 +433,26 @@ static void ring_doorbell_for_active_rin } } +static struct xhci_virt_ep *xhci_get_virt_ep (struct xhci_hcd *xhci, +unsigned int slot_id, +unsigned int ep_index) +{ +if (slot_id ==0 || slot_id >=MAX_HC_SLOTS ) { +xhci_warn (xhci,"Invalid slot_id %u\n" , slot_id); +return NULL ; + } +if (ep_index >=EP_CTX_PER_DEV ) { +xhci_warn (xhci,"Invalid endpoint index %u\n" , ep_index); +return NULL ; + } +if (!xhci->devs[slot_id]) { +xhci_warn (xhci,"No xhci virt device for slot_id %u\n" , slot_id); +return NULL ; + } + +return &xhci->devs[slot_id]->eps[ep_index]; +} +/* Get the right ring for the given slot_id, ep_index and stream_id. * If the endpoint supports streams, boundary check the URB's stream ID. * If the endpoint doesn't support streams, return the singular endpoint ring.
@@ -443,7 +463,10 @@ struct xhci_ring *xhci_triad_to_transfer {struct xhci_virt_ep *ep; - ep = &xhci->devs[slot_id]->eps[ep_index]; + ep =xhci_get_virt_ep (xhci, slot_id, ep_index); +if (!ep) +return NULL ; +/* Common case: no streams */ if (!(ep->ep_state &EP_HAS_STREAMS ))return ep->ring;
@@ -718,11 +741,14 @@ static void xhci_handle_cmd_stop_ep(strumemset (&deq_state,0 ,sizeof (deq_state)); ep_index =TRB_TO_EP_INDEX (le32_to_cpu (trb->generic.field[3 ])); + ep =xhci_get_virt_ep (xhci, slot_id, ep_index); +if (!ep) +return ; + vdev = xhci->devs[slot_id]; ep_ctx =xhci_get_ep_ctx (xhci, vdev->out_ctx, ep_index);trace_xhci_handle_cmd_stop_ep (ep_ctx); - ep = &xhci->devs[slot_id]->eps[ep_index]; last_unlinked_td =list_last_entry (&ep->cancelled_td_list, struct xhci_td, cancelled_td_list);
@@ -1043,9 +1069,11 @@ static void xhci_handle_cmd_set_deq(stru ep_index =TRB_TO_EP_INDEX (le32_to_cpu (trb->generic.field[3 ])); stream_id =TRB_TO_STREAM_ID (le32_to_cpu (trb->generic.field[2 ])); - dev = xhci->devs[slot_id]; - ep = &dev->eps[ep_index]; + ep =xhci_get_virt_ep (xhci, slot_id, ep_index); +if (!ep) +return ; + dev = xhci->devs[slot_id]; ep_ring =xhci_stream_id_to_ring (dev, ep_index, stream_id);if (!ep_ring) { xhci_warn(xhci, "WARN Set TR deq ptr command for freed stream ID %u\n",
@@ -1118,9 +1146,9 @@ static void xhci_handle_cmd_set_deq(stru } cleanup: - dev->eps[ep_index].ep_state &= ~SET_DEQ_PENDING ; - dev->eps[ep_index].queued_deq_seg =NULL ; - dev->eps[ep_index].queued_deq_ptr =NULL ; + ep->ep_state &= ~SET_DEQ_PENDING ; + ep->queued_deq_seg =NULL ; + ep->queued_deq_ptr =NULL ;/* Restart any rings with pending URBs */ ring_doorbell_for_active_rings (xhci, slot_id, ep_index); }
@@ -1129,10 +1157,15 @@ static void xhci_handle_cmd_reset_ep(str union xhci_trb *trb, u32 cmd_comp_code) {struct xhci_virt_device *vdev; +struct xhci_virt_ep *ep;struct xhci_ep_ctx *ep_ctx;unsigned int ep_index; ep_index =TRB_TO_EP_INDEX (le32_to_cpu (trb->generic.field[3 ])); + ep =xhci_get_virt_ep (xhci, slot_id, ep_index); +if (!ep) +return ; + vdev = xhci->devs[slot_id]; ep_ctx =xhci_get_ep_ctx (xhci, vdev->out_ctx, ep_index);trace_xhci_handle_cmd_reset_ep (ep_ctx);
@@ -1162,7 +1195,7 @@ static void xhci_handle_cmd_reset_ep(strxhci_ring_cmd_db (xhci); }else {/* Clear our internal halted state */ - xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED ; + ep->ep_state &= ~EP_HALTED ; } }
@@ -2281,14 +2314,13 @@ static int handle_tx_event(struct xhci_h trb_comp_code =GET_COMP_CODE (le32_to_cpu (event->transfer_len)); ep_trb_dma =le64_to_cpu (event->buffer); - xdev = xhci->devs[slot_id]; -if (!xdev) { -xhci_err (xhci,"ERROR Transfer event pointed to bad slot %u\n" , - slot_id); + ep =xhci_get_virt_ep (xhci, slot_id, ep_index); +if (!ep) { +xhci_err (xhci,"ERROR Invalid Transfer event\n" ); goto err_out; } - ep = &xdev->eps[ep_index]; + xdev = xhci->devs[slot_id]; ep_ring =xhci_dma_to_transfer_ring (ep, ep_trb_dma); ep_ctx =xhci_get_ep_ctx (xhci, xdev->out_ctx, ep_index);
drivers/usb/host/xhci.h +2 -1
@@ -991,6 +991,7 @@ struct xhci_interval_bw_table {unsigned int ss_bw_out; }; +#define EP_CTX_PER_DEV 31struct xhci_virt_device {struct usb_device *udev;
@@ -1005,7 +1006,7 @@ struct xhci_virt_device {struct xhci_container_ctx *out_ctx;/* Used for addressing devices and configuration changes */ struct xhci_container_ctx *in_ctx; -struct xhci_virt_ep eps[31 ]; +struct xhci_virt_ep eps[EP_CTX_PER_DEV ];u8 fake_port;u8 real_port;struct xhci_interval_bw_table *bw_table;
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.199 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 28 Jul 2021 15:38:12 +0000. Anything received after that time might be too late.
perf fails to build:
builtin-script.c: In function ‘perf_script__exit’:
builtin-script.c:2212:2: error: implicit declaration of function ‘perf_thread_map__put’; did you mean ‘thread_map__put’?
builtin-script.c:2212:2: error: nested extern declaration of ‘perf_thread_map__put’ [-Werror=nested-externs] builtin-script.c:2213:2: error: implicit declaration of function ‘perf_cpu_map__put’; did you mean ‘perf_mmap__put’?
tests/topology.c: In function ‘session_write_header’:tests/topology.c:55:2: error: implicit declaration of function ‘evlist__delete’; did you mean ‘perf_evlist__delete’? tests/topology.c:55:2: error: nested extern declaration of ‘evlist__delete’
Guenter
Quoted 7 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.199 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 5 lines
Quoted 3 lines
Responses should be made by Wed, 28 Jul 2021 15:38:12 +0000. Anything received after that time might be too late.
perf fails to build:
Results from Linaro’s test farm.
These build warnings / errors were noticed on arm64, arm, x86_64, and i386 while building perf on 4.19 and below.
Quoted 11 lines
builtin-script.c: In function ‘perf_script__exit’:
builtin-script.c:2212:2: error: implicit declaration of function ‘perf_thread_map__put’; did you mean ‘thread_map__put’?builtin-script.c:2212:2: error: nested extern declaration of ‘perf_thread_map__put’ [-Werror=nested-externs] builtin-script.c:2213:2: error: implicit declaration of function ‘perf_cpu_map__put’; did you mean ‘perf_mmap__put’?
tests/topology.c: In function ‘session_write_header’:tests/topology.c:55:2: error: implicit declaration of function ‘evlist__delete’; did you mean ‘perf_evlist__delete’?tests/topology.c:55:2: error: nested extern declaration of ‘evlist__delete’Guenter
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.199 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 28 Jul 2021 15:38:12 +0000. Anything received after that time might be too late.
Quoted 7 lines
perf fails to build:
builtin-script.c: In function ‘perf_script__exit’:
builtin-script.c:2212:2: error: implicit declaration of function ‘perf_thread_map__put’; did you mean ‘thread_map__put’?builtin-script.c:2212:2: error: nested extern declaration of ‘perf_thread_map__put’ [-Werror=nested-externs] builtin-script.c:2213:2: error: implicit declaration of function ‘perf_cpu_map__put’; did you mean ‘perf_mmap__put’?
I'll go fix this one up as well...
thanks,
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.199 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 28 Jul 2021 15:38:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.199-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah