5.10.58-rc1 review
Greg Kroah-Hartman
maintainercover 5.10.58-rc1 review
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.58-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.58-rc1
Mark Rutland <[email protected]>
arm64: fix compat syscall return truncation
Alex Deucher <[email protected]>
drm/amdgpu/display: only enable aux backlight control for OLED panels
Steve French <[email protected]>
smb3: rc uninitialized in one fallocate path
Letu Ren <[email protected]>
net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
Prarit Bhargava <[email protected]>
alpha: Send stop IPI to send to online CPUs
Harshvardhan Jha <[email protected]>
net: qede: Fix end of loop tests for list_for_each_entry
Matteo Croce <[email protected]>
virt_wifi: fix error on connect
Shreyansh Chouhan <[email protected]>
reiserfs: check directory items on read from disk
Yu Kuai <[email protected]>
reiserfs: add check for root_inode in reiserfs_fill_super
Christoph Hellwig <[email protected]>
libata: fix ata_pio_sector for CONFIG_HIGHMEM
Jonathan Gray <[email protected]>
drm/i915: avoid uninitialised var in eb_parse()
Peter Zijlstra <[email protected]>
sched/rt: Fix double enqueue caused by rt_effective_prio
Like Xu <[email protected]>
perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
Arnd Bergmann <[email protected]>
soc: ixp4xx/qmgr: fix invalid __iomem access
Matt Roper <[email protected]>
drm/i915: Correct SFC_DONE register offset
Mike Tipton <[email protected]>
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
Mike Tipton <[email protected]>
interconnect: qcom: icc-rpmh: Ensure floor BW is enforced for all nodes
Mike Tipton <[email protected]>
interconnect: Always call pre_aggregate before aggregate
Mike Tipton <[email protected]>
interconnect: Zero initial BW after sync-state
Dongliang Mu <[email protected]>
spi: meson-spicc: fix memory leak in meson_spicc_remove
Colin Ian King <[email protected]>
interconnect: Fix undersized devress_alloc allocation
Arnd Bergmann <[email protected]>
soc: ixp4xx: fix printing resources
Will Deacon <[email protected]>
arm64: vdso: Avoid ISB after reading from cntvct_el0
Sean Christopherson <[email protected]>
KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
Paolo Bonzini <[email protected]>
KVM: Do not leak memory for duplicate debugfs directories
Paolo Bonzini <[email protected]>
KVM: x86: accept userspace interrupt only if no event is injected
Wei Shuyu <[email protected]>
md/raid10: properly indicate failure when ending a failed write request
Tero Kristo <[email protected]>
ARM: omap2+: hwmod: fix potential NULL pointer access
Rasmus Villemoes <[email protected]>
Revert "gpio: mpc8xxx: change the gpio interrupt flags."
Kevin Hilman <[email protected]>
bus: ti-sysc: AM3: RNG is GP only
Xiu Jianfeng <[email protected]>
selinux: correct the return value when loads initial sids
Zheyu Ma <[email protected]>
pcmcia: i82092: fix a null pointer dereference bug
Dmitry Safonov <[email protected]>
net/xfrm/compat: Copy xfrm_spdattr_type_t atributes
Frederic Weisbecker <[email protected]>
xfrm: Fix RCU vs hash_resize_mutex lock inversion
Thomas Gleixner <[email protected]>
timers: Move clearing of base::timer_running under base:: Lock
Kajol Jain <[email protected]>
fpga: dfl: fme: Fix cpu hotplug issue in performance reporting
Mario Kleiner <[email protected]>
serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.
Andy Shevchenko <[email protected]>
serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Do not byte-swap accesses to the CBUS UART
Maciej W. Rozycki <[email protected]>
serial: 8250: Mask out floating 16/32-bit bus bits
Zhiyong Tao <[email protected]>
serial: 8250_mtk: fix uart corruption issue when rx power off
Jon Hunter <[email protected]>
serial: tegra: Only print FIFO error message when an error occurs
Theodore Ts'o <[email protected]>
ext4: fix potential htree corruption when growing large_dir directories
Alex Xu (Hello71) <[email protected]>
pipe: increase minimum default pipe size to 2 pages
Johan Hovold <[email protected]>
media: rtl28xxu: fix zero-length control request
Filip Schauer <[email protected]>
drivers core: Fix oops when driver probe fails
Pavel Skripkin <[email protected]>
staging: rtl8712: error handling refactoring
Pavel Skripkin <[email protected]>
staging: rtl8712: get rid of flush_scheduled_work
Xiangyang Zhang <[email protected]>
staging: rtl8723bs: Fix a resource leak in sd_int_dpc
Tyler Hicks <[email protected]>
tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
Allen Pais <[email protected]>
optee: fix tee out of memory failure seen during kexec reboot
Tyler Hicks <[email protected]>
optee: Refuse to load the driver under the kdump kernel
Tyler Hicks <[email protected]>
optee: Fix memory leak when failing to register shm pages
Jens Wiklander <[email protected]>
tee: add tee_shm_alloc_kernel_buf()
Tyler Hicks <[email protected]>
optee: Clear stale cache entries during initialization
Mark Rutland <[email protected]>
arm64: stacktrace: avoid tracing arch_stack_walk()
Mathieu Desnoyers <[email protected]>
tracepoint: Fix static call function vs data state mismatch
Mathieu Desnoyers <[email protected]>
tracepoint: static call: Compare data on transition from 2->1 callees
Kamal Agrawal <[email protected]>
tracing: Fix NULL pointer dereference in start_creating
Masami Hiramatsu <[email protected]>
tracing: Reject string operand in the histogram expression
Steven Rostedt (VMware) <[email protected]>
tracing / histogram: Give calculation hist_fields a size
Hui Su <[email protected]>
scripts/tracing: fix the bug that can't parse raw_trace_func
Brian Norris <[email protected]>
clk: fix leak on devm_clk_bulk_get_all() unwind
Dmitry Osipenko <[email protected]>
usb: otg-fsm: Fix hrtimer list corruption
Kyle Tso <[email protected]>
usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events
Claudiu Beznea <[email protected]>
usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses
Maxim Devaev <[email protected]>
usb: gadget: f_hid: idle uses the highest byte for duration
Phil Elwell <[email protected]>
usb: gadget: f_hid: fixed NULL pointer dereference
Maxim Devaev <[email protected]>
usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
Pawel Laszczak <[email protected]>
usb: cdns3: Fixed incorrect gadget state
Zhang Qilong <[email protected]>
usb: gadget: remove leaked entry from udc driver list
Wesley Cheng <[email protected]>
usb: dwc3: gadget: Avoid runtime resume if disabling pullup
Alexander Tsoy <[email protected]>
ALSA: usb-audio: Add registration quirk for JBL Quantum 600
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix superfluous autosuspend recovery
Nikos Liolios <[email protected]>
ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256)
Alexander Monakov <[email protected]>
ALSA: hda/realtek: add mic quirk for Acer SF314-42
Jaroslav Kysela <[email protected]>
ALSA: pcm - fix mmap capability check for the snd-dummy driver
Shirish S <[email protected]>
drm/amdgpu/display: fix DMUB firmware version info
Anirudh Rayabharam <[email protected]>
firmware_loader: fix use-after-free in firmware_fallback_sysfs
Anirudh Rayabharam <[email protected]>
firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
David Bauer <[email protected]>
USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
Willy Tarreau <[email protected]>
USB: serial: ch341: fix character loss at high transfer rates
Daniele Palmas <[email protected]>
USB: serial: option: add Telit FD980 composition 0x1056
Qiang.zhang <[email protected]>
USB: usbtmc: Fix RCU stall warning
Tetsuo Handa <[email protected]>
Bluetooth: defer cleanup of resources in hci_unregister_dev()
Yu Kuai <[email protected]>
blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit()
Pavel Skripkin <[email protected]>
net: vxge: fix use-after-free in vxge_device_unregister
Pavel Skripkin <[email protected]>
net: fec: fix use-after-free in fec_drv_remove
Pavel Skripkin <[email protected]>
net: pegasus: fix uninit-value in get_interrupt_interval
Dan Carpenter <[email protected]>
bnx2x: fix an error code in bnx2x_nic_load()
H. Nikolaus Schaller <[email protected]>
mips: Fix non-POSIX regexp
Huang Pei <[email protected]>
MIPS: check return value of pgtable_pmd_page_ctor
Yunsheng Lin <[email protected]>
net: sched: fix lockdep_set_class() typo error for sch->seqlock
Oleksij Rempel <[email protected]>
net: dsa: qca: ar9331: reorder MDIO write sequence
Antoine Tenart <[email protected]>
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
Fei Qin <[email protected]>
nfp: update ethtool reporting of pauseframe control
Xin Long <[email protected]>
sctp: move the active_key update after sh_keys is added
Aharon Landau <[email protected]>
RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently
Matthias Schiffer <[email protected]>
gpio: tqmx86: really make IRQ optional
Wang Hai <[email protected]>
net: natsemi: Fix missing pci_disable_device() in probe and remove
Steve Bennett <[email protected]>
net: phy: micrel: Fix detection of ksz87xx switch
Vladimir Oltean <[email protected]>
net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN tag
Vladimir Oltean <[email protected]>
net: dsa: sja1105: be stateless with FDB entries on SJA1105P/Q/R/S/SJA1110 too
Vladimir Oltean <[email protected]>
net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones
Vladimir Oltean <[email protected]>
net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add
Jakub Sitnicki <[email protected]>
net, gro: Set inner transport header offset in tcp/udp GRO hook
Juergen Borleis <[email protected]>
dmaengine: imx-dma: configure the generic DMA type to make it work
Marek Vasut <[email protected]>
ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM
Marek Vasut <[email protected]>
ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM
Hans Verkuil <[email protected]>
media: videobuf2-core: dequeue if start_streaming fails
Li Manyi <[email protected]>
scsi: sr: Return correct event when media event code is 3
Marek Vasut <[email protected]>
spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
Marek Vasut <[email protected]>
spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
Zhang Qilong <[email protected]>
dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 dmamux ops
Zhang Qilong <[email protected]>
dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops
Dmitry Osipenko <[email protected]>
clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops
Kunihiko Hayashi <[email protected]>
dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic state
H. Nikolaus Schaller <[email protected]>
omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator
Dario Binacchi <[email protected]>
ARM: dts: am437x-l4: fix typo in can@0 node
Dario Binacchi <[email protected]>
clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
chihhao.chen <[email protected]>
ALSA: usb-audio: fix incorrect clock source setting
Pali Rohár <[email protected]>
arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
Vladimir Oltean <[email protected]>
arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC controllers
Marek Vasut <[email protected]>
ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins
Colin Ian King <[email protected]>
ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
Oleksandr Suvorov <[email protected]>
ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz
Michael Walle <[email protected]>
arm64: dts: ls1028: sl28: fix networking for variant 2
Maxime Chevallier <[email protected]>
ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms
Yang Yingliang <[email protected]>
ARM: imx: add missing clk_disable_unprepare()
Yang Yingliang <[email protected]>
ARM: imx: add missing iounmap()
Vladimir Oltean <[email protected]>
arm64: dts: ls1028a: fix node name for the sysclk
Pavel Skripkin <[email protected]>
net: xfrm: fix memory leak in xfrm_user_rcv_msg
Tony Lindgren <[email protected]>
bus: ti-sysc: Fix gpt12 system timer issue with reserved status
Takashi Iwai <[email protected]>
ALSA: seq: Fix racy deletion of subscriber
Rafael J. Wysocki <[email protected]>
Revert "ACPICA: Fix memory leak caused by _CID repair function"
-------------
Diffstat:
Makefile | 4 +- arch/alpha/kernel/smp.c | 2 +- arch/arm/boot/dts/am437x-l4.dtsi | 2 +- arch/arm/boot/dts/imx53-m53menlo.dts | 4 +- arch/arm/boot/dts/imx6qdl-sr-som.dtsi | 8 +- arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi | 1 + arch/arm/boot/dts/omap5-board-common.dtsi | 9 +- arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 24 +++-- arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 + arch/arm/mach-imx/mmdc.c | 17 +++- arch/arm/mach-omap2/omap_hwmod.c | 10 +- .../freescale/fsl-ls1028a-kontron-sl28-var2.dts | 2 + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +- .../boot/dts/marvell/armada-3720-turris-mox.dts | 3 + arch/arm64/include/asm/arch_timer.h | 21 ----- arch/arm64/include/asm/barrier.h | 19 ++++ arch/arm64/include/asm/ptrace.h | 12 ++- arch/arm64/include/asm/syscall.h | 19 ++-- arch/arm64/include/asm/vdso/gettimeofday.h | 6 +- arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/kernel/signal.c | 3 +- arch/arm64/kernel/stacktrace.c | 2 +- arch/arm64/kernel/syscall.c | 9 +- arch/mips/Makefile | 2 +- arch/mips/include/asm/pgalloc.h | 17 ++-- arch/mips/mti-malta/malta-platform.c | 3 +- arch/x86/events/perf_event.h | 3 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/x86.c | 13 ++- block/blk-iolatency.c | 6 +- drivers/acpi/acpica/nsrepair2.c | 7 -- drivers/ata/libata-sff.c | 35 +++++-- drivers/base/dd.c | 4 +- drivers/base/firmware_loader/fallback.c | 14 +-- drivers/base/firmware_loader/firmware.h | 10 +- drivers/base/firmware_loader/main.c | 2 + drivers/bus/ti-sysc.c | 22 +++-- drivers/char/tpm/tpm_ftpm_tee.c | 8 +- drivers/clk/clk-devres.c | 9 +- drivers/clk/clk-stm32f4.c | 10 +- drivers/clk/tegra/clk-sdmmc-mux.c | 10 ++ drivers/dma/imx-dma.c | 2 + drivers/dma/stm32-dma.c | 4 +- drivers/dma/stm32-dmamux.c | 6 +- drivers/dma/uniphier-xdmac.c | 4 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/gpio/gpio-mpc8xxx.c | 2 +- drivers/gpio/gpio-tqmx86.c | 6 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 7 ++ drivers/gpu/drm/i915/i915_reg.h | 2 +- drivers/infiniband/hw/mlx5/mr.c | 4 +- drivers/interconnect/core.c | 9 +- drivers/interconnect/qcom/icc-rpmh.c | 22 ++--- drivers/md/raid1.c | 2 - drivers/md/raid10.c | 4 +- drivers/media/common/videobuf2/videobuf2-core.c | 13 ++- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 11 ++- drivers/net/dsa/qca/ar9331.c | 14 ++- drivers/net/dsa/sja1105/sja1105_main.c | 85 ++++++++++++----- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +- drivers/net/ethernet/freescale/fec_main.c | 2 +- drivers/net/ethernet/natsemi/natsemi.c | 8 +- drivers/net/ethernet/neterion/vxge/vxge-main.c | 6 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 + drivers/net/ethernet/qlogic/qede/qede_filter.c | 4 +- drivers/net/ethernet/qlogic/qla3xxx.c | 6 +- drivers/net/phy/micrel.c | 10 +- drivers/net/usb/pegasus.c | 14 ++- drivers/net/wireless/virt_wifi.c | 52 +++++++---- drivers/pcmcia/i82092.c | 1 + drivers/scsi/sr.c | 2 +- drivers/soc/ixp4xx/ixp4xx-npe.c | 11 +-- drivers/soc/ixp4xx/ixp4xx-qmgr.c | 9 +- drivers/spi/spi-imx.c | 52 +++++++---- drivers/spi/spi-meson-spicc.c | 2 + drivers/staging/rtl8712/hal_init.c | 30 ++++-- drivers/staging/rtl8712/rtl8712_led.c | 8 ++ drivers/staging/rtl8712/rtl871x_led.h | 1 + drivers/staging/rtl8712/rtl871x_pwrctrl.c | 8 ++ drivers/staging/rtl8712/rtl871x_pwrctrl.h | 1 + drivers/staging/rtl8712/usb_intf.c | 51 +++++------ drivers/staging/rtl8723bs/hal/sdio_ops.c | 2 + drivers/tee/optee/call.c | 36 +++++++- drivers/tee/optee/core.c | 40 ++++++++ drivers/tee/optee/optee_private.h | 1 + drivers/tee/optee/shm_pool.c | 12 ++- drivers/tee/tee_shm.c | 18 ++++ drivers/tty/serial/8250/8250_mtk.c | 5 + drivers/tty/serial/8250/8250_pci.c | 7 ++ drivers/tty/serial/8250/8250_port.c | 12 ++- drivers/tty/serial/serial-tegra.c | 6 +- drivers/usb/cdns3/ep0.c | 1 + drivers/usb/class/usbtmc.c | 9 +- drivers/usb/common/usb-otg-fsm.c | 6 +- drivers/usb/dwc3/gadget.c | 11 +++ drivers/usb/gadget/function/f_hid.c | 44 +++++++-- drivers/usb/gadget/udc/max3420_udc.c | 14 ++- drivers/usb/host/ohci-at91.c | 9 +- drivers/usb/serial/ch341.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 3 + drivers/usb/serial/option.c | 2 + drivers/usb/typec/tcpm/tcpm.c | 4 +- fs/cifs/smb2ops.c | 3 +- fs/ext4/namei.c | 2 +- fs/pipe.c | 19 +++- fs/reiserfs/stree.c | 31 ++++++- fs/reiserfs/super.c | 8 ++ include/linux/tee_drv.h | 1 + include/linux/usb/otg-fsm.h | 1 + include/net/bluetooth/hci_core.h | 1 + include/net/ip6_route.h | 2 +- include/net/netns/xfrm.h | 1 + kernel/sched/core.c | 90 +++++++----------- kernel/time/timer.c | 6 +- kernel/trace/trace.c | 4 +- kernel/trace/trace_events_hist.c | 24 ++++- kernel/tracepoint.c | 102 +++++++++++++++++---- net/bluetooth/hci_core.c | 16 ++-- net/bluetooth/hci_sock.c | 49 ++++++---- net/bluetooth/hci_sysfs.c | 3 + net/ipv4/tcp_offload.c | 3 + net/ipv4/udp_offload.c | 4 + net/sched/sch_generic.c | 2 +- net/sctp/auth.c | 14 ++- net/xfrm/xfrm_compat.c | 49 +++++++++- net/xfrm/xfrm_policy.c | 17 ++-- net/xfrm/xfrm_user.c | 10 ++ scripts/tracing/draw_functrace.py | 6 +- security/selinux/ss/policydb.c | 10 +- sound/core/pcm_native.c | 2 +- sound/core/seq/seq_ports.c | 39 +++++--- sound/pci/hda/patch_realtek.c | 2 + sound/usb/card.c | 2 +- sound/usb/clock.c | 6 ++ sound/usb/quirks.c | 1 + virt/kvm/kvm_main.c | 18 +++- 138 files changed, 1144 insertions(+), 495 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/135 Revert "ACPICA: Fix memory leak caused by _CID repair function"
From: Rafael J. Wysocki <[email protected]>
commit 6511a8b5b7a65037340cd8ee91a377811effbc83 upstream.
Revert commit c27bac0314131 ("ACPICA: Fix memory leak caused by _CID repair function") which is reported to cause a boot issue on Acer Swift 3 (SF314-51).
--- drivers/acpi/acpica/nsrepair2.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/acpi/acpica/nsrepair2.c +0 -7
@@ -375,13 +375,6 @@ acpi_ns_repair_CID(struct acpi_evaluate_ (*element_ptr)->common.reference_count = original_ref_count; - -/* -* The original_element holds a reference from the package object -* that represents _HID. Since a new element was created by _HID, -* remove the reference from the _CID package. -*/ -acpi_ut_remove_reference (original_element); } element_ptr++;
Greg Kroah-Hartman
maintainerPATCH 2/135 ALSA: seq: Fix racy deletion of subscriber
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 97367c97226aab8b298ada954ce12659ee3ad2a4 upstream.
It turned out that the current implementation of the port subscription is racy. The subscription contains two linked lists, and we have to add to or delete from both lists. Since both connection and disconnection procedures perform the same order for those two lists (i.e. src list, then dest list), when a deletion happens during a connection procedure, the src list may be deleted before the dest list addition completes, and this may lead to a use-after-free or an Oops, even though the access to both lists are protected via mutex.
The simple workaround for this race is to change the access order for the disconnection, namely, dest list, then src list. This assures that the connection has been established when disconnecting, and also the concurrent deletion can be avoided.
--- sound/core/seq/seq_ports.c | 39 +++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-)
sound/core/seq/seq_ports.c +27 -12
@@ -514,10 +514,11 @@ static int check_and_subscribe_port(strureturn err; } -static void delete_and_unsubscribe_port (struct snd_seq_client *client, -struct snd_seq_client_port *port, -struct snd_seq_subscribers *subs, -bool is_src,bool ack) +/* called with grp->list_mutex held */ +static void __delete_and_unsubscribe_port (struct snd_seq_client *client, +struct snd_seq_client_port *port, +struct snd_seq_subscribers *subs, +bool is_src,bool ack) {struct snd_seq_port_subs_info *grp;struct list_head *list;
@@ -525,7 +526,6 @@ static void delete_and_unsubscribe_port( grp = is_src ? &port->c_src : &port->c_dest; list = is_src ? &subs->src_list : &subs->dest_list; -down_write (&grp->list_mutex);write_lock_irq (&grp->list_lock); empty =list_empty (list);if (!empty)
@@ -535,6 +535,18 @@ static void delete_and_unsubscribe_port(if (!empty)unsubscribe_port (client, port, grp, &subs->info, ack); +} + +static void delete_and_unsubscribe_port (struct snd_seq_client *client, +struct snd_seq_client_port *port, +struct snd_seq_subscribers *subs, +bool is_src,bool ack) +{ +struct snd_seq_port_subs_info *grp; + + grp = is_src ? &port->c_src : &port->c_dest; +down_write (&grp->list_mutex); +__delete_and_unsubscribe_port (client, port, subs, is_src, ack);up_write (&grp->list_mutex); }
@@ -590,27 +602,30 @@ int snd_seq_port_disconnect(struct snd_sstruct snd_seq_client_port *dest_port, struct snd_seq_port_subscribe *info) { - struct snd_seq_port_subs_info *src = &src_port->c_src; + struct snd_seq_port_subs_info *dest = &dest_port->c_dest;struct snd_seq_subscribers *subs;int err = -ENOENT ; -down_write (&src->list_mutex); +/* always start from deleting the dest port for avoiding concurrent +* deletions +*/ +down_write (&dest->list_mutex);/* look for the connection */ -list_for_each_entry (subs, &src->list_head, src_list) { +list_for_each_entry (subs, &dest->list_head, dest_list) {if (match_subs_info (info, &subs->info)) { -atomic_dec (&subs->ref_count);/* mark as not ready */ +__delete_and_unsubscribe_port (dest_client, dest_port, + subs, false, + connector->number != dest_client->number); err =0 ;break ; } } -up_write (&src->list_mutex); +up_write (&dest->list_mutex);if (err <0 )return err;delete_and_unsubscribe_port (src_client, src_port, subs, true, connector->number != src_client->number); -delete_and_unsubscribe_port (dest_client, dest_port, subs, false, - connector->number != dest_client->number);kfree (subs);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 3/135 bus: ti-sysc: Fix gpt12 system timer issue with reserved status
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 3ff340e24c9dd5cff9fc07d67914c5adf67f80d6 ]
Jarkko Nikula <[email protected]> reported that Beagleboard revision c2 stopped booting. Jarkko bisected the issue down to commit 6cfcd5563b4f ("clocksource/drivers/timer-ti-dm: Fix suspend and resume for am3 and am4").
Let's fix the issue by tagging system timers as reserved rather than ignoring them. And let's not probe any interconnect target module child devices for reserved modules.
This allows PM runtime to keep track of clocks and clockdomains for the interconnect target module, and prevent the system timer from idling as we already have SYSC_QUIRK_NO_IDLE and SYSC_QUIRK_NO_IDLE_ON_INIT flags set for system timers.
--- drivers/bus/ti-sysc.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/bus/ti-sysc.c +13 -7
@@ -100,6 +100,7 @@ static const char * const clock_names[SYSC_MAX_CLOCKS] = {* @cookie: data used by legacy platform callbacks * @name: name if available * @revision: interconnect target module revision +* @reserved: target module is reserved and already in use * @enabled: sysc runtime enabled status * @needs_resume: runtime resume needed on resume from suspend * @child_needs_resume: runtime resume needed for child on resume from suspend
@@ -130,6 +131,7 @@ struct sysc {struct ti_sysc_cookie cookie;const char *name;u32 revision; + unsigned int reserved:1; unsigned int enabled:1; unsigned int needs_resume:1; unsigned int child_needs_resume:1;
@@ -3057,8 +3059,8 @@ static int sysc_probe(struct platform_device *pdev)return error; error =sysc_check_active_timer (ddata); -if (error) -return error; +if (error == -EBUSY ) + ddata->reserved = true; error =sysc_get_clocks (ddata);if (error)
@@ -3094,11 +3096,15 @@ static int sysc_probe(struct platform_device *pdev)sysc_show_registers (ddata); ddata->dev->type = &sysc_device_type; - error =of_platform_populate (ddata->dev->of_node, sysc_match_table, - pdata ? pdata->auxdata :NULL , - ddata->dev); -if (error) - goto err; + +if (!ddata->reserved) { + error =of_platform_populate (ddata->dev->of_node, + sysc_match_table, + pdata ? pdata->auxdata :NULL , + ddata->dev); +if (error) + goto err; + }INIT_DELAYED_WORK (&ddata->idle_work, ti_sysc_idle);
Signature · 1 line
2.30.2
Re: [PATCH 5.10 003/135] bus: ti-sysc: Fix gpt12 system timer issue with reserved status
Hi!
Quoted 5 lines
Jarkko Nikula <[email protected]> reported that Beagleboard revision c2 stopped booting. Jarkko bisected the issue down to commit
6cfcd5563b4f("clocksource/drivers/timer-ti-dm: Fix suspend and resume for am3 and am4").
Quoted 8 lines
Let's fix the issue by tagging system timers as reserved rather than ignoring them. And let's not probe any interconnect target module child devices for reserved modules.
This allows PM runtime to keep track of clocks and clockdomains for the interconnect target module, and prevent the system timer from idling as we already have
SYSC_QUIRK_NO_IDLEandSYSC_QUIRK_NO_IDLE_ON_INITflags set for system timers.
There was interaction between two patches, and result is that this one does not do anything useful, see:
https://lore.kernel.org/linux-omap/[email protected]/T/#u
I believe it should be dropped for now.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 4/135 net: xfrm: fix memory leak in xfrm_user_rcv_msg
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 7c1a80e80cde008f271bae630d28cf684351e807 ]
Syzbot reported memory leak in xfrm_user_rcv_msg(). The problem was is non-freed skb's frag_list.
In skb_release_all() skb_release_data() will be called only in case of skb->head != NULL, but netlink_skb_destructor() sets head to NULL. So, allocated frag_list skb should be freed manualy, since consume_skb() won't take care of it
--- net/xfrm/xfrm_user.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
net/xfrm/xfrm_user.c +10 -0
@@ -2751,6 +2751,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, err = link->doit (skb, nlh, attrs); +/* We need to free skb allocated in xfrm_alloc_compat() before +* returning from this function, because consume_skb() won't take +* care of frag_list since netlink destructor sets +* sbk->head to NULL. (see netlink_skb_destructor()) +*/ +if (skb_has_frag_list (skb)) { +kfree_skb (skb_shinfo (skb)->frag_list); +skb_shinfo (skb)->frag_list =NULL ; + } + err:kvfree (nlh64);return err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 5/135 arm64: dts: ls1028a: fix node name for the sysclk
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 7e71b85473f863a29eb1c69265ef025389b4091d ]
U-Boot attempts to fix up the "clock-frequency" property of the "/sysclk" node:
https://elixir.bootlin.com/u-boot/v2021.04/source/arch/arm/cpu/armv8/fsl-layerscape/fdt.c#L512
but fails to do so:
## Booting kernel from Legacy Image at a1000000 ...
Image Name:
Created: 2021-06-08 10:31:38 UTC
Image Type: AArch64 Linux Kernel Image (gzip compressed)
Data Size: 15431370 Bytes = 14.7 MiB
Load Address: 80080000
Entry Point: 80080000
Verifying Checksum ... OK
## Flattened Device Tree blob at a0000000
Booting using the fdt blob at 0xa0000000
Uncompressing Kernel Image
Loading Device Tree to 00000000fbb19000, end 00000000fbb22717 ... OKUnable to update property /sysclk:clock-frequency, err=FDT_ERR_NOTFOUND
Starting kernel ...
All Layerscape SoCs except LS1028A use "sysclk" as the node name, and not "clock-sysclk". So change the node name of LS1028A accordingly.
--- arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +1 -1
@@ -69,7 +69,7 @@ }; }; - sysclk: clock-sysclk { + sysclk: sysclk { compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <100000000>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 6/135 ARM: imx: add missing iounmap()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f9613aa07f16d6042e74208d1b40a6104d72964a ]
Commit e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") introduced imx_mmdc_remove(), the mmdc_base need be unmapped in it if config PERF_EVENTS is enabled.
If imx_mmdc_perf_init() fails, the mmdc_base also need be unmapped.
--- arch/arm/mach-imx/mmdc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/arm/mach-imx/mmdc.c +6 -1
@@ -462,6 +462,7 @@ static int imx_mmdc_remove(struct platform_device *pdev)cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);perf_pmu_unregister (&pmu_mmdc->pmu); +iounmap (pmu_mmdc->mmdc_base);kfree (pmu_mmdc);return 0 ; }
@@ -567,7 +568,11 @@ static int imx_mmdc_probe(struct platform_device *pdev) val &= ~(1 <<BP_MMDC_MAPSR_PSD );writel_relaxed (val, reg); -return imx_mmdc_perf_init (pdev, mmdc_base); + err =imx_mmdc_perf_init (pdev, mmdc_base); +if (err) +iounmap (mmdc_base); + +return err; }int imx_mmdc_get_ddr_type (void )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 7/135 ARM: imx: add missing clk_disable_unprepare()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f07ec85365807b3939f32d0094a6dd5ce065d1b9 ]
clock source is prepared and enabled by clk_prepare_enable() in probe function, but no disable or unprepare in remove and error path.
--- arch/arm/mach-imx/mmdc.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/arm/mach-imx/mmdc.c +9 -3
@@ -103,6 +103,7 @@ struct mmdc_pmu {struct perf_event *mmdc_events[MMDC_NUM_COUNTERS ];struct hlist_node node;struct fsl_mmdc_devtype_data *devtype_data; +struct clk *mmdc_ipg_clk; };/*
@@ -463,11 +464,13 @@ static int imx_mmdc_remove(struct platform_device *pdev)cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);perf_pmu_unregister (&pmu_mmdc->pmu);iounmap (pmu_mmdc->mmdc_base); +clk_disable_unprepare (pmu_mmdc->mmdc_ipg_clk);kfree (pmu_mmdc);return 0 ; } -static int imx_mmdc_perf_init (struct platform_device *pdev,void __iomem *mmdc_base) +static int imx_mmdc_perf_init (struct platform_device *pdev,void __iomem *mmdc_base, +struct clk *mmdc_ipg_clk) {struct mmdc_pmu *pmu_mmdc;char *name;
@@ -495,6 +498,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b } mmdc_num =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;if (mmdc_num ==0 ) name ="mmdc" ;else
@@ -568,9 +572,11 @@ static int imx_mmdc_probe(struct platform_device *pdev) val &= ~(1 <<BP_MMDC_MAPSR_PSD );writel_relaxed (val, reg); - err =imx_mmdc_perf_init (pdev, mmdc_base); -if (err) + err =imx_mmdc_perf_init (pdev, mmdc_base, mmdc_ipg_clk); +if (err) {iounmap (mmdc_base); +clk_disable_unprepare (mmdc_ipg_clk); + }return err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 8/135 ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms
In reply to Greg Kroah-HartmanFrom: Maxime Chevallier <[email protected]>
[ Upstream commit fd8e83884fdd7b5fc411f201a58d8d01890198a2 ]
The AR803x PHY used on this modules seems to require the reset line to be asserted for around 10ms in order to avoid rare cases where the PHY gets stuck in an incoherent state that prevents it to function correctly.
The previous value of 2ms was found to be problematic on some setups, causing intermittent issues where the PHY would be unresponsive every once in a while on some sytems, with a low occurrence (it typically took around 30 consecutive reboots to encounter the issue).
Bumping the delay to the 10ms makes the issue dissapear, with more than 2500 consecutive reboots performed without the issue showing-up.
--- arch/arm/boot/dts/imx6qdl-sr-som.dtsi | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-sr-som.dtsi +7 -1
@@ -54,7 +54,13 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_microsom_enet_ar8035>; phy-mode = "rgmii-id"; - phy-reset-duration = <2>; + + /* + * The PHY seems to require a long-enough reset duration to avoid + * some rare issues where the PHY gets stuck in an inconsistent and + * non-functional state at boot-up. 10ms proved to be fine . + */ + phy-reset-duration = <10>; phy-reset-gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; status = "okay";
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 9/135 arm64: dts: ls1028: sl28: fix networking for variant 2
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 29f6a20c21b5bdc7eb623a712bbf7b99612ee746 ]
The PHY configuration for the variant 2 is still missing the flag for in-band signalling between PHY and MAC. Both sides - MAC and PHY - have to match the setting. For now, Linux only supports setting the MAC side and thus it has to match the setting the bootloader is configuring. Enable in-band signalling to make ethernet work.
--- arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts +2 -0
@@ -54,6 +54,7 @@ &mscc_felix_port0 { label = "swp0"; + managed = "in-band-status"; phy-handle = <&phy0>; phy-mode = "sgmii"; status = "okay";
@@ -61,6 +62,7 @@ &mscc_felix_port1 { label = "swp1"; + managed = "in-band-status"; phy-handle = <&phy1>; phy-mode = "sgmii"; status = "okay";
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 10/135 ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz
In reply to Greg Kroah-HartmanFrom: Oleksandr Suvorov <[email protected]>
[ Upstream commit 828db68f4ff1ab6982a36a56522b585160dc8c8e ]
NXP and AzureWave don't recommend using SDIO bus mode 3.3V@50MHz due to noise affecting the wireless throughput. Colibri iMX6ULL uses only 3.3V signaling for Wi-Fi module AW-CM276NF.
Limit the SDIO Clock on Colibri iMX6ULL to 25MHz.
--- arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi +1 -0
@@ -43,6 +43,7 @@ assigned-clock-rates = <0>, <198000000>; cap-power-off-card; keep-power-in-suspend; + max-frequency = <25000000>; mmc-pwrseq = <&wifi_pwrseq>; no-1-8-v; non-removable;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 11/135 ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 20fb73911fec01f06592de1cdbca00b66602ebd7 ]
The function imx_mmdc_perf_init recently had a 3rd argument added to it but the equivalent macro was not updated and is still the older 2 argument version. Fix this by adding in the missing 3rd argumement mmdc_ipg_clk.
--- arch/arm/mach-imx/mmdc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-imx/mmdc.c +1 -1
@@ -534,7 +534,7 @@ pmu_free:#else #define imx_mmdc_remove NULL -#define imx_mmdc_perf_init (pdev, mmdc_base) 0 +#define imx_mmdc_perf_init (pdev, mmdc_base, mmdc_ipg_clk) 0#endif static int imx_mmdc_probe (struct platform_device *pdev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 12/135 ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 3d9e30a52047f2d464efdfd1d561ae1f707a0286 ]
The pinctrl_power_button/pinctrl_power_out each define single GPIO pinmux, except it is exactly the other one than the matching gpio-keys and gpio-poweroff DT nodes use for that functionality. Swap the two GPIOs to correct this error.
--- arch/arm/boot/dts/imx53-m53menlo.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx53-m53menlo.dts +2 -2
@@ -388,13 +388,13 @@ pinctrl_power_button: powerbutgrp { fsl,pins = < - MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4 + MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4 >; }; pinctrl_power_out: poweroutgrp { fsl,pins = < - MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4 + MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4 >; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 13/135 arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC controllers
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 923f98929182dfd04e9149be839160b63a3db145 ]
Since drivers/mmc/host/sdhci-xenon.c declares the PROBE_PREFER_ASYNCHRONOUS probe type, it is not guaranteed whether /dev/mmcblk0 will belong to sdhci0 or sdhci1. In turn, this will break booting by:
root=/dev/mmcblk0p1
Fix the issue by adding aliases so that the old MMC controller indices are preserved.
--- arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +2 -0
@@ -19,6 +19,8 @@ aliases { spi0 = &spi0; ethernet1 = ð1; + mmc0 = &sdhci0; + mmc1 = &sdhci1; }; chosen {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 14/135 arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit ee7ab3f263f8131722cff3871b9618b1e7478f07 ]
Some SFP modules are not detected when i2c-fast-mode is enabled even when clock-frequency is already set to 100000. The I2C bus violates the timing specifications when run in fast mode. So disable fast mode on Turris Mox.
Same change was already applied for uDPU (also Armada 3720 board with SFP) in commit fe3ec631a77d ("arm64: dts: uDPU: remove i2c-fast-mode").
--- arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +1 -0
@@ -120,6 +120,7 @@ pinctrl-names = "default"; pinctrl-0 = <&i2c1_pins>; clock-frequency = <100000>; + /delete-property/ mrvl,i2c-fast-mode; status = "okay"; rtc@6f {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 15/135 ALSA: usb-audio: fix incorrect clock source setting
In reply to Greg Kroah-HartmanFrom: chihhao.chen <[email protected]>
[ Upstream commit 4511781f95da0a3b2bad34f3f5e3967e80cd2d18 ]
The following scenario describes an echo test for Samsung USBC Headset (AKG) with VID/PID (0x04e8/0xa051).
We first start a capture stream(USB IN transfer) in 96Khz/24bit/1ch mode. In clock find source function, we get value 0x2 for clock selector and 0x1 for clock source.
Kernel-4.14 behavior
Since clock source is valid so clock selector was not set again. We pass through this function and start a playback stream(USB OUT transfer) in 48Khz/32bit/2ch mode. This time we get value 0x1 for clock selector and 0x1 for clock source. Finally clock id with this setting is 0x9.
Kernel-5.10 behavior
Clock selector was always set one more time even it is valid. When we start a playback stream, we will get 0x2 for clock selector and 0x1 for clock source. In this case clock id becomes 0xA. This is an incorrect clock source setting and results in severe noises. We see wrong data rate in USB IN transfer.
(From 288 bytes/ms becomes 144 bytes/ms) It should keep in 288 bytes/ms.
This earphone works fine on older kernel version load because this is a newly-added behavior.
--- sound/usb/clock.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/usb/clock.c +6 -0
@@ -319,6 +319,12 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, selector->baCSourceID[ret -1 ], visited, validate);if (ret >0 ) { +/* +* For Samsung USBC Headset (AKG), setting clock selector again +* will result in incorrect default clock setting problems +*/ +if (chip->usb_id ==USB_ID (0x04e8 ,0xa051 )) +return ret; err =uac_clock_selector_set_val (chip, entity_id, cur);if (err <0 )return err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 16/135 clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
In reply to Greg Kroah-HartmanFrom: Dario Binacchi <[email protected]>
[ Upstream commit 24b5b1978cd5a80db58e2a19db2f9c36fe8d4f7a ]
Enabling the framebuffer leads to a system hang. Running, as a debug hack, the store_pan() function in drivers/video/fbdev/core/fbsysfs.c without taking the console_lock, allows to see the crash backtrace on the serial line.
~ # echo 0 0 > /sys/class/graphics/fb0/pan
[ 9.719414] Unhandled exception: IPSR = 00000005 LR = fffffff1 [ 9.726937] CPU: 0 PID: 49 Comm: sh Not tainted 5.13.0-rc5 #9 [ 9.733008] Hardware name: STM32 (Device Tree Support) [ 9.738296] PC is at clk_gate_is_enabled+0x0/0x28 [ 9.743426] LR is at stm32f4_pll_div_set_rate+0xf/0x38 [ 9.748857] pc : [<0011e4be>] lr : [<0011f9e3>] psr: 0100000b [ 9.755373] sp : 00bc7be0 ip : 00000000 fp : 001f3ac4 [ 9.760812] r10: 002610d0 r9 : 01efe920 r8 : 00540560 [ 9.766269] r7 : 02e7ddb0 r6 : 0173eed8 r5 : 00000000 r4 : 004027c0 [ 9.773081] r3 : 0011e4bf r2 : 02e7ddb0 r1 : 0173eed8 r0 : 1d3267b8 [ 9.779911] xPSR: 0100000b [ 9.782719] CPU: 0 PID: 49 Comm: sh Not tainted 5.13.0-rc5 #9 [ 9.788791] Hardware name: STM32 (Device Tree Support) [ 9.794120] [<0000afa1>] (unwind_backtrace) from [<0000a33f>] (show_stack+0xb/0xc) [ 9.802421] [<0000a33f>] (show_stack) from [<0000a8df>] (__invalid_entry+0x4b/0x4c)
The `pll_num' field in the post_div_data configuration contained a wrong value which also referenced an uninitialized hardware clock when clk_register_pll_div() was called.
--- drivers/clk/clk-stm32f4.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/clk/clk-stm32f4.c +5 -5
@@ -526,7 +526,7 @@ struct stm32f4_pll {struct stm32f4_pll_post_div_data {int idx; -u8 pll_num; +int pll_idx;const char *name;const char *parent;u8 flag;
@@ -557,13 +557,13 @@ static const struct clk_div_table post_divr_table[] = {#define MAX_POST_DIV 3static const struct stm32f4_pll_post_div_data post_div_data[MAX_POST_DIV ] = { - {CLK_I2SQ_PDIV ,PLL_I2S ,"plli2s-q-div" ,"plli2s-q" , + {CLK_I2SQ_PDIV ,PLL_VCO_I2S ,"plli2s-q-div" ,"plli2s-q" ,CLK_SET_RATE_PARENT ,STM32F4_RCC_DCKCFGR ,0 ,5 ,0 ,NULL }, - {CLK_SAIQ_PDIV ,PLL_SAI ,"pllsai-q-div" ,"pllsai-q" , + {CLK_SAIQ_PDIV ,PLL_VCO_SAI ,"pllsai-q-div" ,"pllsai-q" ,CLK_SET_RATE_PARENT ,STM32F4_RCC_DCKCFGR ,8 ,5 ,0 ,NULL }, - {NO_IDX ,PLL_SAI ,"pllsai-r-div" ,"pllsai-r" ,CLK_SET_RATE_PARENT , + {NO_IDX ,PLL_VCO_SAI ,"pllsai-r-div" ,"pllsai-r" ,CLK_SET_RATE_PARENT ,STM32F4_RCC_DCKCFGR ,16 ,2 ,0 , post_divr_table }, };
@@ -1774,7 +1774,7 @@ static void __init stm32f4_rcc_init(struct device_node *np) post_div->width, post_div->flag_div, post_div->div_table, - clks[post_div->pll_num], + clks[post_div->pll_idx], &stm32f4_clk_lock);if (post_div->idx !=NO_IDX )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 17/135 ARM: dts: am437x-l4: fix typo in can@0 node
In reply to Greg Kroah-HartmanFrom: Dario Binacchi <[email protected]>
[ Upstream commit 0162a9964365fd26e34575e121b17d021204c481 ]
Replace clock-name with clock-names.
--- arch/arm/boot/dts/am437x-l4.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/am437x-l4.dtsi +1 -1
@@ -1576,7 +1576,7 @@ compatible = "ti,am4372-d_can", "ti,am3352-d_can"; reg = <0x0 0x2000>; clocks = <&dcan1_fck>; - clock-name = "fck"; + clock-names = "fck"; syscon-raminit = <&scm_conf 0x644 1>; interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>; status = "disabled";
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 18/135 omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator
In reply to Greg Kroah-HartmanFrom: H. Nikolaus Schaller <[email protected]>
[ Upstream commit c68ef4ad180e09805fa46965d15e1dfadf09ffa5 ]
This device tree include file describes a fixed-regulator connecting smps7_reg output (1.8V) to some 1.8V rail and consumers (vdds_1v8_main).
This regulator does not physically exist.
I assume it was introduced as a wrapper around smps7_reg to provide a speaking signal name "vdds_1v8_main" as label.
This fixed-regulator without real function was not an issue in driver code until
Commit 98e48cd9283d ("regulator: core: resolve supply for boot-on/always-on regulators")
introduced a new check for regulator initialization which makes Palmas regulator registration fail:
[ 5.407712] ldo1: supplied by vsys_cobra [ 5.412748] ldo2: supplied by vsys_cobra [ 5.417603] palmas-pmic 48070000.i2c:palmas@48:palmas_pmic: failed to register 48070000.i2c:palmas@48:palmas_pmic regulator
The reason is that the supply-chain of regulators is too long and goes from ldo3 through the virtual vdds_1v8_main regulator and then back to smps7. This adds a cross-dependency of probing Palmas regulators and the fixed-regulator which leads to probe deferral by the new check and is no longer resolved.
Since we do not control what device tree files including this one reference (either &vdds_1v8_main or &smps7_reg or both) we keep both labels for smps7 for compatibility.
--- arch/arm/boot/dts/omap5-board-common.dtsi | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
arch/arm/boot/dts/omap5-board-common.dtsi +1 -8
@@ -30,14 +30,6 @@ regulator-max-microvolt = <5000000>; }; - vdds_1v8_main: fixedregulator-vdds_1v8_main { - compatible = "regulator-fixed"; - regulator-name = "vdds_1v8_main"; - vin-supply = <&smps7_reg>; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - }; - vmmcsd_fixed: fixedregulator-mmcsd { compatible = "regulator-fixed"; regulator-name = "vmmcsd_fixed";
@@ -487,6 +479,7 @@ regulator-boot-on; }; + vdds_1v8_main: smps7_reg: smps7 { /* VDDS_1v8_OMAP over VDDS_1v8_MAIN */ regulator-name = "smps7";
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 19/135 dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic state
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit 55f24c27b6c1a840b62fe297616f1f9ea3576cb7 ]
The function uniphier_xdmac_chan_stop() is only called in atomic state. Should use readl_poll_timeout_atomic() there instead of readl_poll_timeout().
--- drivers/dma/uniphier-xdmac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/uniphier-xdmac.c +2 -2
@@ -209,8 +209,8 @@ static int uniphier_xdmac_chan_stop(struct uniphier_xdmac_chan *xc)writel (0 , xc->reg_ch_base +XDMAC_TSS );/* wait until transfer is stopped */ -return readl_poll_timeout (xc->reg_ch_base +XDMAC_STAT , val, - !(val &XDMAC_STAT_TENF ),100 ,1000 ); +return readl_poll_timeout_atomic (xc->reg_ch_base +XDMAC_STAT , val, + !(val &XDMAC_STAT_TENF ),100 ,1000 ); }/* xc->vc.lock must be held by caller */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 20/135 clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 2bcc025ab9bbd029b1730cde71cb4e4f0ed35d0f ]
Implement disable_unused() callback of tegra_clk_sdmmc_mux_ops to fix imbalanced disabling of the unused MMC clock on Tegra210 Jetson Nano.
--- drivers/clk/tegra/clk-sdmmc-mux.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/clk/tegra/clk-sdmmc-mux.c +10 -0
@@ -194,6 +194,15 @@ static void clk_sdmmc_mux_disable(struct clk_hw *hw) gate_ops->disable (gate_hw); } +static void clk_sdmmc_mux_disable_unused (struct clk_hw *hw) +{ +struct tegra_sdmmc_mux *sdmmc_mux =to_clk_sdmmc_mux (hw); +const struct clk_ops *gate_ops = sdmmc_mux->gate_ops; +struct clk_hw *gate_hw = &sdmmc_mux->gate.hw; + + gate_ops->disable_unused (gate_hw); +} +static void clk_sdmmc_mux_restore_context (struct clk_hw *hw) {struct clk_hw *parent =clk_hw_get_parent (hw);
@@ -218,6 +227,7 @@ static const struct clk_ops tegra_clk_sdmmc_mux_ops = { .is_enabled = clk_sdmmc_mux_is_enabled, .enable = clk_sdmmc_mux_enable, .disable = clk_sdmmc_mux_disable, + .disable_unused = clk_sdmmc_mux_disable_unused, .restore_context = clk_sdmmc_mux_restore_context, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 21/135 dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit d54db74ad6e0dea8c253fb68c689b836657ab914 ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. We fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/dma/stm32-dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/stm32-dma.c +2 -2
@@ -1187,7 +1187,7 @@ static int stm32_dma_alloc_chan_resources(struct dma_chan *c) chan->config_init = false; - ret =pm_runtime_get_sync (dmadev->ddev.dev); + ret =pm_runtime_resume_and_get (dmadev->ddev.dev);if (ret <0 )return ret;
@@ -1455,7 +1455,7 @@ static int stm32_dma_suspend(struct device *dev)struct stm32_dma_device *dmadev =dev_get_drvdata (dev);int id, ret, scr; - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 22/135 dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 dmamux ops
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit baa16371c9525f24d508508e4d296c031e1de29c ]
pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. We fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/dma/stm32-dmamux.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/dma/stm32-dmamux.c +3 -3
@@ -137,7 +137,7 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,/* Set dma request */ spin_lock_irqsave (&dmamux->lock, flags); - ret =pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 ) {spin_unlock_irqrestore (&dmamux->lock, flags); goto error;
@@ -336,7 +336,7 @@ static int stm32_dmamux_suspend(struct device *dev)struct stm32_dmamux_data *stm32_dmamux =platform_get_drvdata (pdev);int i, ret; - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 )return ret;
@@ -361,7 +361,7 @@ static int stm32_dmamux_resume(struct device *dev)if (ret <0 )return ret; - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 23/135 spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 135cbd378eab336da15de9c84bbb22bf743b38a5 ]
Since 00b80ac935539 ("spi: imx: mx51-ecspi: Move some initialisation to prepare_message hook."), the MX51_ECSPI_CONFIG write no longer happens in prepare_transfer hook, but rather in prepare_message hook, however the MX51_ECSPI_CONFIG delay is still left in prepare_transfer hook and thus has no effect. This leads to low bus frequency operation problems described in 6fd8b8503a0dc ("spi: spi-imx: Fix out-of-order CS/SCLK operation at low speeds") again.
Move the MX51_ECSPI_CONFIG write delay into the prepare_message hook as well, thus reinstating the low bus frequency fix.
--- drivers/spi/spi-imx.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-)
drivers/spi/spi-imx.c +19 -19
@@ -506,7 +506,7 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, {struct spi_device *spi = msg->spi;u32 ctrl =MX51_ECSPI_CTRL_ENABLE ; -u32 testreg; +u32 testreg, delay;u32 cfg =readl (spi_imx->base +MX51_ECSPI_CONFIG );/* set Master or Slave mode */
@@ -567,6 +567,23 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,writel (cfg, spi_imx->base +MX51_ECSPI_CONFIG ); +/* +* Wait until the changes in the configuration register CONFIGREG +* propagate into the hardware. It takes exactly one tick of the +* SCLK clock, but we will wait two SCLK clock just to be sure. The +* effect of the delay it takes for the hardware to apply changes +* is noticable if the SCLK clock run very slow. In such a case, if +* the polarity of SCLK should be inverted, the GPIO ChipSelect might +* be asserted before the SCLK polarity changes, which would disrupt +* the SPI communication as the device on the other end would consider +* the change of SCLK polarity as a clock tick already. +*/ + delay = (2 *1000000 ) / spi_imx->spi_bus_clk; +if (likely (delay <10 ))/* SCLK is faster than 100 kHz */ +udelay (delay); +else /* SCLK is _very_ slow */ +usleep_range (delay, delay +10 ); +return 0 ; }
@@ -574,7 +591,7 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, struct spi_device *spi) {u32 ctrl =readl (spi_imx->base +MX51_ECSPI_CTRL ); -u32 clk, delay; +u32 clk;/* Clear BL field and set the right value */ ctrl &= ~MX51_ECSPI_CTRL_BL_MASK ;
@@ -596,23 +613,6 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx,writel (ctrl, spi_imx->base +MX51_ECSPI_CTRL ); -/* -* Wait until the changes in the configuration register CONFIGREG -* propagate into the hardware. It takes exactly one tick of the -* SCLK clock, but we will wait two SCLK clock just to be sure. The -* effect of the delay it takes for the hardware to apply changes -* is noticable if the SCLK clock run very slow. In such a case, if -* the polarity of SCLK should be inverted, the GPIO ChipSelect might -* be asserted before the SCLK polarity changes, which would disrupt -* the SPI communication as the device on the other end would consider -* the change of SCLK polarity as a clock tick already. -*/ - delay = (2 *1000000 ) / clk; -if (likely (delay <10 ))/* SCLK is faster than 100 kHz */ -udelay (delay); -else /* SCLK is _very_ slow */ -usleep_range (delay, delay +10 ); -return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 24/135 spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 53ca18acbe645656132fb5a329833db711067e54 ]
The spi_imx->spi_bus_clk may be uninitialized and thus also zero in mx51_ecspi_prepare_message(), which would lead to division by zero in kernel. Since bitbang .setup_transfer callback which initializes the spi_imx->spi_bus_clk is called after bitbang prepare_message callback, iterate over all the transfers in spi_message, find the one with lowest bus frequency, and use that bus frequency for the delay calculation.
Note that it is not possible to move this CONFIGREG delay back into the .setup_transfer callback, because that is invoked too late, after the GPIO chipselects were already configured.
--- drivers/spi/spi-imx.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/spi/spi-imx.c +15 -1
@@ -505,7 +505,9 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, struct spi_message *msg) {struct spi_device *spi = msg->spi; +struct spi_transfer *xfer;u32 ctrl =MX51_ECSPI_CTRL_ENABLE ; +u32 min_speed_hz = ~0U ;u32 testreg, delay;u32 cfg =readl (spi_imx->base +MX51_ECSPI_CONFIG );
@@ -577,8 +579,20 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx,* be asserted before the SCLK polarity changes, which would disrupt * the SPI communication as the device on the other end would consider * the change of SCLK polarity as a clock tick already. +* +* Because spi_imx->spi_bus_clk is only set in bitbang prepare_message +* callback, iterate over all the transfers in spi_message, find the +* one with lowest bus frequency, and use that bus frequency for the +* delay calculation. In case all transfers have speed_hz == 0, then +* min_speed_hz is ~0 and the resulting delay is zero. */ - delay = (2 *1000000 ) / spi_imx->spi_bus_clk; +list_for_each_entry (xfer, &msg->transfers, transfer_list) { +if (!xfer->speed_hz) +continue ; + min_speed_hz =min (xfer->speed_hz, min_speed_hz); + } + + delay = (2 *1000000 ) / min_speed_hz;if (likely (delay <10 ))/* SCLK is faster than 100 kHz */ udelay (delay);else /* SCLK is _very_ slow */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 25/135 scsi: sr: Return correct event when media event code is 3
In reply to Greg Kroah-HartmanFrom: Li Manyi <[email protected]>
[ Upstream commit 5c04243a56a7977185b00400e59ca7e108004faf ]
Media event code 3 is defined in the MMC-6 spec as follows:
"MediaRemoval: The media has been removed from the specified slot, and
the Drive is unable to access the media without user intervention. This applies to media changers only."
This indicated that treating the condition as an EJECT_REQUEST was appropriate. However, doing so had the unfortunate side-effect of causing the drive tray to be physically ejected on resume. Instead treat the event as a MEDIA_CHANGE request.
--- drivers/scsi/sr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/sr.c +1 -1
@@ -221,7 +221,7 @@ static unsigned int sr_get_events(struct scsi_device *sdev)else if (med->media_event_code ==2 )return DISK_EVENT_MEDIA_CHANGE ;else if (med->media_event_code ==3 ) -return DISK_EVENT_EJECT_REQUEST ; +return DISK_EVENT_MEDIA_CHANGE ;return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 26/135 media: videobuf2-core: dequeue if start_streaming fails
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit c592b46907adbeb81243f7eb7a468c36692658b8 ]
If a vb2_queue sets q->min_buffers_needed then when the number of queued buffers reaches q->min_buffers_needed, vb2_core_qbuf() will call the start_streaming() callback. If start_streaming() returns an error, then that error was just returned by vb2_core_qbuf(), but the buffer was still queued. However, userspace expects that if VIDIOC_QBUF fails, the buffer is returned dequeued.
So if start_streaming() fails, then remove the buffer from the queue, thus avoiding this unwanted side-effect.
--- drivers/media/common/videobuf2/videobuf2-core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/media/common/videobuf2/videobuf2-core.c +12 -1
@@ -1573,6 +1573,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb, struct media_request *req) {struct vb2_buffer *vb; +enum vb2_buffer_state orig_state;int ret;if (q->error) {
@@ -1673,6 +1674,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb,* Add to the queued buffers list, a buffer will stay on it until * dequeued in dqbuf. */ + orig_state = vb->state;list_add_tail (&vb->queued_entry, &q->queued_list); q->queued_count++; q->waiting_for_buffers = false;
@@ -1703,8 +1705,17 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb,if (q->streaming && !q->start_streaming_called && q->queued_count >= q->min_buffers_needed) { ret =vb2_start_streaming (q); -if (ret) +if (ret) { +/* +* Since vb2_core_qbuf will return with an error, +* we should return it to state DEQUEUED since +* the error indicates that the buffer wasn't queued. +*/ +list_del (&vb->queued_entry); + q->queued_count--; + vb->state = orig_state;return ret; + } }dprintk (q,2 ,"qbuf of buffer %d succeeded\n" , vb->index);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 27/135 ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 36862c1ebc92a7e6fcc55002965c44b8ad17d4ca ]
The LAN8710 Energy Detect Power Down (EDPD) functionality might cause unreliable cable detection. There are multiple accounts of this in the SMSC PHY driver patches which attempted to make EDPD reliable, however it seems there is always some sort of corner case left. Unfortunatelly, there is no errata documented which would confirm this to be a silicon bug on the LAN87xx series of PHYs (LAN8700, LAN8710, LAN8720 at least).
Disable EDPD on the DHCOM SoM, just like multiple other boards already do as well, to make the cable detection reliable.
--- arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +1 -0
@@ -133,6 +133,7 @@ reset-gpios = <&gpioh 3 GPIO_ACTIVE_LOW>; reset-assert-us = <500>; reset-deassert-us = <500>; + smsc,disable-energy-detect; interrupt-parent = <&gpioi>; interrupts = <11 IRQ_TYPE_LEVEL_LOW>; };
Signature · 9 lines
2.30.2 _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Greg Kroah-Hartman
maintainerPATCH 28/135 ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 15f68f027ebd961b99a1c420f96ff3838c5e4450 ]
While 7e5f3155dcbb4 ("ARM: dts: stm32: Fix LED5 on STM32MP1 DHCOM PDK2") fixed the LED0 assignment on the PDK2 board, the same commit did not update the touchscreen IRQ line assignment, which is the same GPIO line, shared between the LED0 output and touchscreen IRQ input. To make this more convoluted, the same EXTI input (not the same GPIO line) is shared between Button B which is Active-Low IRQ, and touchscreen IRQ which is Edge-Falling IRQ, which cannot be used at the same time. In case the LCD board with touchscreen is in use, which is the case here, LED0 must be disabled, Button B must be polled, so the touchscreen interrupt works as it should.
Update the touchscreen IRQ line assignment, disable LED0 and use polled GPIO button driver for Button B, since the DT here describes baseboard with LCD board.
--- arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-)
arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +14 -10
@@ -37,7 +37,7 @@ poll-interval = <20>; /* - * The EXTi IRQ line 3 is shared with touchscreen and ethernet, + * The EXTi IRQ line 3 is shared with ethernet, * so mark this as polled GPIO key. */ button-0 {
@@ -46,6 +46,16 @@ gpios = <&gpiof 3 GPIO_ACTIVE_LOW>; }; + /* + * The EXTi IRQ line 6 is shared with touchscreen, + * so mark this as polled GPIO key. + */ + button-1 { + label = "TA2-GPIO-B"; + linux,code = <KEY_B>; + gpios = <&gpiod 6 GPIO_ACTIVE_LOW>; + }; + /* * The EXTi IRQ line 0 is shared with PMIC, * so mark this as polled GPIO key.
@@ -60,13 +70,6 @@ gpio-keys { compatible = "gpio-keys"; - button-1 { - label = "TA2-GPIO-B"; - linux,code = <KEY_B>; - gpios = <&gpiod 6 GPIO_ACTIVE_LOW>; - wakeup-source; - }; - button-3 { label = "TA4-GPIO-D"; linux,code = <KEY_D>;
@@ -82,6 +85,7 @@ label = "green:led5"; gpios = <&gpioc 6 GPIO_ACTIVE_HIGH>; default-state = "off"; + status = "disabled"; }; led-1 {
@@ -185,8 +189,8 @@ touchscreen@38 { compatible = "edt,edt-ft5406"; reg = <0x38>; - interrupt-parent = <&gpiog>; - interrupts = <2 IRQ_TYPE_EDGE_FALLING>; /* GPIO E */ + interrupt-parent = <&gpioc>; + interrupts = <6 IRQ_TYPE_EDGE_FALLING>; /* GPIO E */ }; };
Signature · 9 lines
2.30.2 _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Greg Kroah-Hartman
maintainerPATCH 29/135 dmaengine: imx-dma: configure the generic DMA type to make it work
In reply to Greg Kroah-HartmanFrom: Juergen Borleis <[email protected]>
[ Upstream commit 7199ddede9f0f2f68d41e6928e1c6c4bca9c39c0 ]
Commit dea7a9fbb009 ("dmaengine: imx-dma: remove dma_slave_config direction usage") changes the method from a "configuration when called" to an "configuration when used". Due to this, only the cyclic DMA type gets configured correctly, while the generic DMA type is left non-configured.
Without this additional call, the struct imxdma_channel::word_size member is stuck at DMA_SLAVE_BUSWIDTH_UNDEFINED and imxdma_prep_slave_sg() always returns NULL.
--- drivers/dma/imx-dma.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/imx-dma.c +2 -0
@@ -831,6 +831,8 @@ static struct dma_async_tx_descriptor *imxdma_prep_slave_sg( dma_length +=sg_dma_len (sg); } +imxdma_config_write (chan, &imxdmac->config, direction); +switch (imxdmac->word_size) {case DMA_SLAVE_BUSWIDTH_4_BYTES :if (sg_dma_len (sgl) &3 || sgl->dma_address &3 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 30/135 net, gro: Set inner transport header offset in tcp/udp GRO hook
In reply to Greg Kroah-HartmanFrom: Jakub Sitnicki <[email protected]>
[ Upstream commit d51c5907e9809a803b276883d203f45849abd4d6 ]
GSO expects inner transport header offset to be valid when skb->encapsulation flag is set. GSO uses this value to calculate the length of an individual segment of a GSO packet in skb_gso_transport_seglen().
However, tcp/udp gro_complete callbacks don't update the skb->inner_transport_header when processing an encapsulated TCP/UDP segment. As a result a GRO skb has ->inner_transport_header set to a value carried over from earlier skb processing.
This can have mild to tragic consequences. From miscalculating the GSO segment length to triggering a page fault [1], when trying to read TCP/UDP header at an address past the skb->data page.
The latter scenario leads to an oops report like so:
BUG: unable to handle page fault for address: ffff9fa7ec00d008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 123f201067 P4D 123f201067 PUD 123f209067 PMD 0 Oops: 0000 [#1] SMP NOPTI CPU: 44 PID: 0 Comm: swapper/44 Not tainted 5.4.53-cloudflare-2020.7.21 #1 Hardware name: HYVE EDGE-METAL-GEN10/HS-1811DLite1, BIOS V2.15 02/21/2020 RIP: 0010:skb_gso_transport_seglen+0x44/0xa0 Code: c0 41 83 e0 11 f6 87 81 00 00 00 20 74 30 0f b7 87 aa 00 00 00 0f [...] RSP: 0018:ffffad8640bacbb8 EFLAGS: 00010202 RAX: 000000000000feda RBX: ffff9fcc8d31bc00 RCX: ffff9fa7ec00cffc RDX: ffff9fa7ebffdec0 RSI: 000000000000feda RDI: 0000000000000122 RBP: 00000000000005c4 R08: 0000000000000001 R09: 0000000000000000 R10: ffff9fe588ae3800 R11: ffff9fe011fc92f0 R12: ffff9fcc8d31bc00 R13: ffff9fe0119d4300 R14: 00000000000005c4 R15: ffff9fba57d70900 FS: 0000000000000000(0000) GS:ffff9fe68df00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9fa7ec00d008 CR3: 0000003e99b1c000 CR4: 0000000000340ee0 Call Trace: <IRQ> skb_gso_validate_network_len+0x11/0x70 __ip_finish_output+0x109/0x1c0 ip_sublist_rcv_finish+0x57/0x70 ip_sublist_rcv+0x2aa/0x2d0 ? ip_rcv_finish_core.constprop.0+0x390/0x390 ip_list_rcv+0x12b/0x14f __netif_receive_skb_list_core+0x2a9/0x2d0 netif_receive_skb_list_internal+0x1b5/0x2e0 napi_complete_done+0x93/0x140 veth_poll+0xc0/0x19f [veth] ? mlx5e_napi_poll+0x221/0x610 [mlx5_core] net_rx_action+0x1f8/0x790 __do_softirq+0xe1/0x2bf irq_exit+0x8e/0xc0 do_IRQ+0x58/0xe0 common_interrupt+0xf/0xf </IRQ>
The bug can be observed in a simple setup where we send IP/GRE/IP/TCP packets into a netns over a veth pair. Inside the netns, packets are forwarded to dummy device:
trafgen -> [veth A]--[veth B] -forward-> [dummy]
For veth B to GRO aggregate packets on receive, it needs to have an XDP program attached (for example, a trivial XDP_PASS). Additionally, for UDP, we need to enable GSO_UDP_L4 feature on the device:
ip netns exec A ethtool -K AB rx-udp-gro-forwarding on
The last component is an artificial delay to increase the chances of GRO batching happening:
ip netns exec A tc qdisc add dev AB root \
netem delay 200us slot 5ms 10ms packets 2 bytes 64kWith such a setup in place, the bug can be observed by tracing the skb outer and inner offsets when GSO skb is transmitted from the dummy device:
tcp:
FUNC DEV SKB_LEN NH TH ENC INH ITH GSO_SIZE GSO_TYPEip_finish_output dumB 2830 270 290 1 294 254 1383 (tcpv4,gre,)
^^^
udp:
FUNC DEV SKB_LEN NH TH ENC INH ITH GSO_SIZE GSO_TYPEip_finish_output dumB 2818 270 290 1 294 254 1383 (gre,udp_l4,)
^^^
Fix it by updating the inner transport header offset in tcp/udp gro_complete callbacks, similar to how {inet,ipv6}_gro_complete callbacks update the inner network header offset, when skb->encapsulation flag is set.
[1] https://lore.kernel.org/netdev/CAKxSbF01cLpZem2GFaUaifh0S-5WYViZemTicAg7FCHOnh6kug@mail.gmail.com/
--- net/ipv4/tcp_offload.c | 3 +++ net/ipv4/udp_offload.c | 4 ++++ 2 files changed, 7 insertions(+)
net/ipv4/tcp_offload.c +3 -0
@@ -298,6 +298,9 @@ int tcp_gro_complete(struct sk_buff *skb)if (th->cwr)skb_shinfo (skb)->gso_type |=SKB_GSO_TCP_ECN ; +if (skb->encapsulation) + skb->inner_transport_header = skb->transport_header; +return 0 ; }EXPORT_SYMBOL (tcp_gro_complete);
net/ipv4/udp_offload.c +4 -0
@@ -615,6 +615,10 @@ static int udp_gro_complete_segment(struct sk_buff *skb)skb_shinfo (skb)->gso_segs =NAPI_GRO_CB (skb)->count;skb_shinfo (skb)->gso_type |=SKB_GSO_UDP_L4 ; + +if (skb->encapsulation) + skb->inner_transport_header = skb->transport_header; +return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 31/135 net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit e11e865bf84e3c6ea91563ff3e858cfe0e184bd2 ]
The SJA1105 switch family leaves it up to software to decide where within the FDB to install a static entry, and to concatenate destination ports for already existing entries (the FDB is also used for multicast entries), it is not as simple as just saying "please add this entry".
This means we first need to search for an existing FDB entry before adding a new one. The driver currently manages to fool itself into thinking that if an FDB entry already exists, there is nothing to be done. But that FDB entry might be dynamically learned, case in which it should be replaced with a static entry, but instead it is left alone.
This patch checks the LOCKEDS ("locked/static") bit from found FDB entries, and lets the code "goto skip_finding_an_index;" if the FDB entry was not static. So we also need to move the place where we set LOCKEDS = true, to cover the new case where a dynamic FDB entry existed but was dynamic.
--- drivers/net/dsa/sja1105/sja1105_main.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/dsa/sja1105/sja1105_main.c +6 -4
@@ -1275,7 +1275,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port,* mask? If yes, we need to do nothing. If not, we need * to rewrite the entry by adding this port to it. */ -if (l2_lookup.destports &BIT (port)) +if ((l2_lookup.destports &BIT (port)) && l2_lookup.lockeds)return 0 ; l2_lookup.destports |=BIT (port); }else {
@@ -1306,6 +1306,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port, index, NULL, false); } } + l2_lookup.lockeds = true; l2_lookup.index =sja1105et_fdb_index (bin, way); rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP,
@@ -1376,10 +1377,10 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, rc =sja1105_dynamic_config_read (priv,BLK_IDX_L2_LOOKUP ,SJA1105_SEARCH , &l2_lookup);if (rc ==0 ) { -/* Found and this port is already in the entry's +/* Found a static entry and this port is already in the entry's * port mask => job done */ -if (l2_lookup.destports &BIT (port)) +if ((l2_lookup.destports &BIT (port)) && l2_lookup.lockeds)return 0 ;/* l2_lookup.index is populated by the switch in case it * found something.
@@ -1402,10 +1403,11 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,dev_err (ds->dev,"FDB is full, cannot add entry.\n" );return -EINVAL ; } - l2_lookup.lockeds = true; l2_lookup.index = i; skip_finding_an_index: + l2_lookup.lockeds = true; + rc =sja1105_dynamic_config_write (priv,BLK_IDX_L2_LOOKUP , l2_lookup.index, &l2_lookup, true);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 32/135 net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 6c5fc159e0927531707895709eee1f8bfa04289f ]
The procedure to add a static FDB entry in sja1105 is concurrent with dynamic learning performed on all bridge ports and the CPU port.
The switch looks up the FDB from left to right, and also learns dynamically from left to right, so it is possible that between the moment when we pick up a free slot to install an FDB entry, another slot to the left of that one becomes free due to an address ageing out, and that other slot is then immediately used by the switch to learn dynamically the same address as we're trying to add statically.
The result is that we succeeded to add our static FDB entry, but it is being shadowed by a dynamic FDB entry to its left, and the switch will behave as if our static FDB entry did not exist.
We cannot really prevent this from happening unless we make the entire process to add a static FDB entry a huge critical section where address learning is temporarily disabled on _all_ ports, and then re-enabled according to the configuration done by sja1105_port_set_learning. However, that is kind of disruptive for the operation of the network.
What we can do alternatively is to simply read back the FDB for dynamic entries located before our newly added static one, and delete them. This will guarantee that our static FDB entry is now operational. It will still not guarantee that there aren't dynamic FDB entries to the _right_ of that static FDB entry, but at least those entries will age out by themselves since they aren't hit, and won't bother anyone.
--- drivers/net/dsa/sja1105/sja1105_main.c | 57 +++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 2 deletions(-)
drivers/net/dsa/sja1105/sja1105_main.c +55 -2
@@ -1260,10 +1260,11 @@ static int sja1105et_is_fdb_entry_in_bin(struct sja1105_private *priv, int bin,int sja1105et_fdb_add (struct dsa_switch *ds,int port,const unsigned char *addr,u16 vid) { -struct sja1105_l2_lookup_entry l2_lookup = {0 }; +struct sja1105_l2_lookup_entry l2_lookup = {0 }, tmp;struct sja1105_private *priv = ds->priv;struct device *dev = ds->dev;int last_unused =-1 ; +int start, end, i;int bin, way, rc; bin =sja1105et_fdb_hash (priv, addr, vid);
@@ -1315,6 +1316,29 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port,if (rc <0 )return rc; +/* Invalidate a dynamically learned entry if that exists */ + start =sja1105et_fdb_index (bin,0 ); + end =sja1105et_fdb_index (bin, way); + +for (i = start; i < end; i++) { + rc =sja1105_dynamic_config_read (priv,BLK_IDX_L2_LOOKUP , + i, &tmp); +if (rc == -ENOENT ) +continue ; +if (rc) +return rc; + +if (tmp.macaddr !=ether_addr_to_u64 (addr) || tmp.vlanid != vid) +continue ; + + rc =sja1105_dynamic_config_write (priv,BLK_IDX_L2_LOOKUP , + i,NULL , false); +if (rc) +return rc; + +break ; + } +return sja1105_static_fdb_change (priv, port, &l2_lookup, true); }
@@ -1356,7 +1380,7 @@ int sja1105et_fdb_del(struct dsa_switch *ds, int port,int sja1105pqrs_fdb_add (struct dsa_switch *ds,int port,const unsigned char *addr,u16 vid) { -struct sja1105_l2_lookup_entry l2_lookup = {0 }; +struct sja1105_l2_lookup_entry l2_lookup = {0 }, tmp;struct sja1105_private *priv = ds->priv;int rc, i;
@@ -1414,6 +1438,35 @@ skip_finding_an_index:if (rc <0 )return rc; +/* The switch learns dynamic entries and looks up the FDB left to +* right. It is possible that our addition was concurrent with the +* dynamic learning of the same address, so now that the static entry +* has been installed, we are certain that address learning for this +* particular address has been turned off, so the dynamic entry either +* is in the FDB at an index smaller than the static one, or isn't (it +* can also be at a larger index, but in that case it is inactive +* because the static FDB entry will match first, and the dynamic one +* will eventually age out). Search for a dynamically learned address +* prior to our static one and invalidate it. +*/ + tmp = l2_lookup; + + rc =sja1105_dynamic_config_read (priv,BLK_IDX_L2_LOOKUP , +SJA1105_SEARCH , &tmp); +if (rc <0 ) { +dev_err (ds->dev, +"port %d failed to read back entry for %pM vid %d: %pe\n" , + port, addr, vid,ERR_PTR (rc)); +return rc; + } + +if (tmp.index < l2_lookup.index) { + rc =sja1105_dynamic_config_write (priv,BLK_IDX_L2_LOOKUP , + tmp.index,NULL , false); +if (rc <0 ) +return rc; + } +return sja1105_static_fdb_change (priv, port, &l2_lookup, true); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 33/135 net: dsa: sja1105: be stateless with FDB entries on SJA1105P/Q/R/S/SJA1110 too
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 589918df93226a1e5f104306c185b6dcf2bd8051 ]
Similar but not quite the same with what was done in commit b11f0a4c0c81 ("net: dsa: sja1105: be stateless when installing FDB entries") for SJA1105E/T, it is desirable to drop the priv->vlan_aware check and simply go ahead and install FDB entries in the VLAN that was given by the bridge.
As opposed to SJA1105E/T, in SJA1105P/Q/R/S and SJA1110, the FDB is a maskable TCAM, and we are installing VLAN-unaware FDB entries with the VLAN ID masked off. However, such FDB entries might completely obscure VLAN-aware entries where the VLAN ID is included in the search mask, because the switch looks up the FDB from left to right and picks the first entry which results in a masked match. So it depends on whether the bridge installs first the VLAN-unaware or the VLAN-aware FDB entries.
Anyway, if we had a VLAN-unaware FDB entry towards one set of DESTPORTS and a VLAN-aware one towards other set of DESTPORTS, the result is that the packets in VLAN-aware mode will be forwarded towards the DESTPORTS specified by the VLAN-unaware entry.
To solve this, simply do not use the masked matching ability of the FDB for VLAN ID, and always match precisely on it. In VLAN-unaware mode, we configure the switch for shared VLAN learning, so the VLAN ID will be ignored anyway during lookup, so it is redundant to mask it off in the TCAM.
This patch conflicts with net-next commit 0fac6aa098ed ("net: dsa: sja1105:
delete the best_effort_vlan_filtering mode") which changed this line:
if (priv->vlan_state != SJA1105_VLAN_UNAWARE) {
into:
if (priv->vlan_aware) {When merging with net-next, the lines added by this patch should take precedence in the conflict resolution (i.e. the "if" condition should be deleted in both cases).
--- drivers/net/dsa/sja1105/sja1105_main.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-)
drivers/net/dsa/sja1105/sja1105_main.c +4 -14
@@ -1389,13 +1389,8 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, l2_lookup.vlanid = vid; l2_lookup.iotag =SJA1105_S_TAG ; l2_lookup.mask_macaddr =GENMASK_ULL (ETH_ALEN *8 -1 ,0 ); -if (priv->vlan_state !=SJA1105_VLAN_UNAWARE ) { - l2_lookup.mask_vlanid =VLAN_VID_MASK ; - l2_lookup.mask_iotag =BIT (0 ); - }else { - l2_lookup.mask_vlanid =0 ; - l2_lookup.mask_iotag =0 ; - } + l2_lookup.mask_vlanid =VLAN_VID_MASK ; + l2_lookup.mask_iotag =BIT (0 ); l2_lookup.destports =BIT (port); rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
@@ -1482,13 +1477,8 @@ int sja1105pqrs_fdb_del(struct dsa_switch *ds, int port, l2_lookup.vlanid = vid; l2_lookup.iotag =SJA1105_S_TAG ; l2_lookup.mask_macaddr =GENMASK_ULL (ETH_ALEN *8 -1 ,0 ); -if (priv->vlan_state !=SJA1105_VLAN_UNAWARE ) { - l2_lookup.mask_vlanid =VLAN_VID_MASK ; - l2_lookup.mask_iotag =BIT (0 ); - }else { - l2_lookup.mask_vlanid =0 ; - l2_lookup.mask_iotag =0 ; - } + l2_lookup.mask_vlanid =VLAN_VID_MASK ; + l2_lookup.mask_iotag =BIT (0 ); l2_lookup.destports =BIT (port); rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 34/135 net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN tag
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 47c2c0c2312118a478f738503781de1d1a6020d2 ]
On SJA1105P/Q/R/S and SJA1110, the L2 Lookup Table entries contain a maskable "inner/outer tag" bit which means:
- when set to 1: match single-outer and double tagged frames
- when set to 0: match untagged and single-inner tagged frames
- when masked off: match all frames regardless of the type of tag
This driver does not make any meaningful distinction between inner tags (matches on TPID) and outer tags (matches on TPID2). In fact, all VLAN table entries are installed as SJA1110_VLAN_D_TAG, which means that they match on both inner and outer tags.
So it does not make sense that we install FDB entries with the IOTAG bit set to 1.
In VLAN-unaware mode, we set both TPID and TPID2 to 0xdadb, so the switch will see frames as outer-tagged or double-tagged (never inner). So the FDB entries will match if IOTAG is set to 1.
In VLAN-aware mode, we set TPID to 0x8100 and TPID2 to 0x88a8. So the switch will see untagged and 802.1Q-tagged packets as inner-tagged, and 802.1ad-tagged packets as outer-tagged. So untagged and 802.1Q-tagged packets will not match FDB entries if IOTAG is set to 1, but 802.1ad tagged packets will. Strange.
To fix this, simply mask off the IOTAG bit from FDB entries, and make them match regardless of whether the VLAN tag is inner or outer.
--- drivers/net/dsa/sja1105/sja1105_main.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/dsa/sja1105/sja1105_main.c +0 -4
@@ -1387,10 +1387,8 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port,/* Search for an existing entry in the FDB table */ l2_lookup.macaddr =ether_addr_to_u64 (addr); l2_lookup.vlanid = vid; - l2_lookup.iotag =SJA1105_S_TAG ; l2_lookup.mask_macaddr =GENMASK_ULL (ETH_ALEN *8 -1 ,0 ); l2_lookup.mask_vlanid =VLAN_VID_MASK ; - l2_lookup.mask_iotag =BIT (0 ); l2_lookup.destports =BIT (port); rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
@@ -1475,10 +1473,8 @@ int sja1105pqrs_fdb_del(struct dsa_switch *ds, int port, l2_lookup.macaddr =ether_addr_to_u64 (addr); l2_lookup.vlanid = vid; - l2_lookup.iotag =SJA1105_S_TAG ; l2_lookup.mask_macaddr =GENMASK_ULL (ETH_ALEN *8 -1 ,0 ); l2_lookup.mask_vlanid =VLAN_VID_MASK ; - l2_lookup.mask_iotag =BIT (0 ); l2_lookup.destports =BIT (port); rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 35/135 net: phy: micrel: Fix detection of ksz87xx switch
In reply to Greg Kroah-HartmanFrom: Steve Bennett <[email protected]>
[ Upstream commit a5e63c7d38d548b8dab6c6205e0b6af76899dbf5 ]
The logic for discerning between KSZ8051 and KSZ87XX PHYs is incorrect such that the that KSZ87XX switch is not identified correctly.
ksz8051_ksz8795_match_phy_device() uses the parameter ksz_phy_id to discriminate whether it was called from ksz8051_match_phy_device() or from ksz8795_match_phy_device() but since PHY_ID_KSZ87XX is the same value as PHY_ID_KSZ8051, this doesn't work.
Instead use a bool to discriminate the caller.
Without this patch, the KSZ8795 switch port identifies as:
ksz8795-switch spi3.1 ade1 (uninitialized): PHY [dsa-0.1:03] driver [Generic PHY]
With the patch, it identifies correctly:
ksz8795-switch spi3.1 ade1 (uninitialized): PHY [dsa-0.1:03] driver [Micrel KSZ87XX Switch]
--- drivers/net/phy/micrel.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/phy/micrel.c +5 -5
@@ -349,11 +349,11 @@ static int ksz8041_config_aneg(struct phy_device *phydev) }static int ksz8051_ksz8795_match_phy_device (struct phy_device *phydev, -const u32 ksz_phy_id) +const bool ksz_8051) {int ret; -if ((phydev->phy_id &MICREL_PHY_ID_MASK ) != ksz_phy_id) +if ((phydev->phy_id &MICREL_PHY_ID_MASK ) !=PHY_ID_KSZ8051 )return 0 ; ret =phy_read (phydev,MII_BMSR );
@@ -366,7 +366,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev,* the switch does not. */ ret &=BMSR_ERCAP ; -if (ksz_phy_id ==PHY_ID_KSZ8051 ) +if (ksz_8051)return ret;else return !ret;
@@ -374,7 +374,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev,static int ksz8051_match_phy_device (struct phy_device *phydev) { -return ksz8051_ksz8795_match_phy_device (phydev,PHY_ID_KSZ8051 ); +return ksz8051_ksz8795_match_phy_device (phydev, true); }static int ksz8081_config_init (struct phy_device *phydev)
@@ -402,7 +402,7 @@ static int ksz8061_config_init(struct phy_device *phydev)static int ksz8795_match_phy_device (struct phy_device *phydev) { -return ksz8051_ksz8795_match_phy_device (phydev,PHY_ID_KSZ87XX ); +return ksz8051_ksz8795_match_phy_device (phydev, false); } static int ksz9021_load_values_from_of(struct phy_device *phydev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 36/135 net: natsemi: Fix missing pci_disable_device() in probe and remove
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 7fe74dfd41c428afb24e2e615470832fa997ff14 ]
Replace pci_enable_device() with pcim_enable_device(), pci_disable_device() and pci_release_regions() will be called in release automatically.
--- drivers/net/ethernet/natsemi/natsemi.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/ethernet/natsemi/natsemi.c +2 -6
@@ -819,7 +819,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)printk (version);#endif - i =pci_enable_device (pdev); + i =pcim_enable_device (pdev);if (i)return i;/* natsemi has a non-standard PM control register
@@ -852,7 +852,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) ioaddr =ioremap (iostart, iosize);if (!ioaddr) { i = -ENOMEM ; - goto err_ioremap; + goto err_pci_request_regions; }/* Work around the dropped serial bit. */
@@ -974,9 +974,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) err_register_netdev:iounmap (ioaddr); - err_ioremap: -pci_release_regions (pdev); - err_pci_request_regions:free_netdev (dev);return i;
@@ -3241,7 +3238,6 @@ static void natsemi_remove1(struct pci_dev *pdev)NATSEMI_REMOVE_FILE (pdev, dspcfg_workaround);unregister_netdev (dev); -pci_release_regions (pdev);iounmap (ioaddr);free_netdev (dev); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 37/135 gpio: tqmx86: really make IRQ optional
In reply to Greg Kroah-HartmanFrom: Matthias Schiffer <[email protected]>
[ Upstream commit 9b87f43537acfa24b95c236beba0f45901356eb2 ]
The tqmx86 MFD driver was passing IRQ 0 for "no IRQ" in the past. This causes warnings with newer kernels.
Prepare the gpio-tqmx86 driver for the fixed MFD driver by handling a missing IRQ properly.
--- drivers/gpio/gpio-tqmx86.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpio/gpio-tqmx86.c +3 -3
@@ -238,8 +238,8 @@ static int tqmx86_gpio_probe(struct platform_device *pdev)struct resource *res;int ret, irq; - irq =platform_get_irq (pdev,0 ); -if (irq <0 ) + irq =platform_get_irq_optional (pdev,0 ); +if (irq <0 && irq != -ENXIO )return irq; res =platform_get_resource (pdev,IORESOURCE_IO ,0 );
@@ -278,7 +278,7 @@ static int tqmx86_gpio_probe(struct platform_device *pdev)pm_runtime_enable (&pdev->dev); -if (irq) { +if (irq >0 ) {struct irq_chip *irq_chip = &gpio->irq_chip;u8 irq_status;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 38/135 RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently
In reply to Greg Kroah-HartmanFrom: Aharon Landau <[email protected]>
[ Upstream commit d6793ca97b76642b77629dd0783ec64782a50bdb ]
Fixing a typo that causes a cache entry to shrink immediately after adding to it new MRs if the entry size exceeds the high limit. In doing so, the cache misses its purpose to prevent the creation of new mkeys on the runtime by using the cached ones.
--- drivers/infiniband/hw/mlx5/mr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +2 -2
@@ -526,8 +526,8 @@ static void __cache_work_func(struct mlx5_cache_ent *ent)*/ spin_unlock_irq (&ent->lock); need_delay =need_resched () ||someone_adding (cache) || -time_after (jiffies, -READ_ONCE (cache->last_add) +300 *HZ ); + !time_after (jiffies, +READ_ONCE (cache->last_add) +300 *HZ );spin_lock_irq (&ent->lock);if (ent->disabled) goto out;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 39/135 sctp: move the active_key update after sh_keys is added
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit ae954bbc451d267f7d60d7b49db811d5a68ebd7b ]
In commit 58acd1009226 ("sctp: update active_key for asoc when old key is being replaced"), sctp_auth_asoc_init_active_key() is called to update the active_key right after the old key is deleted and before the new key is added, and it caused that the active_key could be found with the key_id.
In Ying Xu's testing, the BUG_ON in sctp_auth_asoc_init_active_key() was triggered:
[ ] kernel BUG at net/sctp/auth.c:416!
[ ] RIP: 0010:sctp_auth_asoc_init_active_key.part.8+0xe7/0xf0 [sctp] [ ] Call Trace:
[ ] sctp_auth_set_key+0x16d/0x1b0 [sctp] [ ] sctp_setsockopt.part.33+0x1ba9/0x2bd0 [sctp] [ ] __sys_setsockopt+0xd6/0x1d0 [ ] __x64_sys_setsockopt+0x20/0x30 [ ] do_syscall_64+0x5b/0x1a0
So fix it by moving the active_key update after sh_keys is added.
--- net/sctp/auth.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/sctp/auth.c +9 -5
@@ -857,14 +857,18 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,memcpy (key->data, &auth_key->sca_key[0 ], auth_key->sca_keylength); cur_key->key = key; -if (replace) { -list_del_init (&shkey->key_list); -sctp_auth_shkey_release (shkey); -if (asoc && asoc->active_key_id == auth_key->sca_keynumber) -sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL ); +if (!replace) { +list_add (&cur_key->key_list, sh_keys); +return 0 ; } + +list_del_init (&shkey->key_list); +sctp_auth_shkey_release (shkey);list_add (&cur_key->key_list, sh_keys); +if (asoc && asoc->active_key_id == auth_key->sca_keynumber) +sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL ); +return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 40/135 nfp: update ethtool reporting of pauseframe control
In reply to Greg Kroah-HartmanFrom: Fei Qin <[email protected]>
[ Upstream commit 9fdc5d85a8fe684cdf24dc31c6bc4a727decfe87 ]
Pauseframe control is set to symmetric mode by default on the NFP. Pause frames can not be configured through ethtool now, but ethtool can report the supported mode.
--- drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +2 -0
@@ -286,6 +286,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev,/* Init to unknowns */ ethtool_link_ksettings_add_link_mode (cmd, supported,FIBRE ); +ethtool_link_ksettings_add_link_mode (cmd, supported, Pause); +ethtool_link_ksettings_add_link_mode (cmd, advertising, Pause); cmd->base.port =PORT_OTHER ; cmd->base.speed =SPEED_UNKNOWN ; cmd->base.duplex =DUPLEX_UNKNOWN ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 41/135 net: ipv6: fix returned variable type in ip6_skb_dst_mtu
In reply to Greg Kroah-HartmanFrom: Antoine Tenart <[email protected]>
[ Upstream commit 4039146777a91e1576da2bf38e0d8a1061a1ae47 ]
The patch fixing the returned value of ip6_skb_dst_mtu (int -> unsigned int) was rebased between its initial review and the version applied. In the meantime fade56410c22 was applied, which added a new variable (int) used as the returned value. This lead to a mismatch between the function prototype and the variable used as the return value.
--- include/net/ip6_route.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/ip6_route.h +1 -1
@@ -264,7 +264,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,static inline unsigned int ip6_skb_dst_mtu (struct sk_buff *skb) { -int mtu; +unsigned int mtu;struct ipv6_pinfo *np = skb->sk && !dev_recursion_level () ?inet6_sk (skb->sk) :NULL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 42/135 net: dsa: qca: ar9331: reorder MDIO write sequence
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit d1a58c013a5837451e3213e7a426d350fa524ead ]
In case of this switch we work with 32bit registers on top of 16bit bus. Some registers (for example access to forwarding database) have trigger bit on the first 16bit half of request and the result + configuration of request in the second half. Without this patch, we would trigger database operation and overwrite result in one run.
To make it work properly, we should do the second part of transfer before the first one is done.
So far, this rule seems to work for all registers on this switch.
--- drivers/net/dsa/qca/ar9331.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/dsa/qca/ar9331.c +11 -3
@@ -689,16 +689,24 @@ static int ar9331_mdio_write(void *ctx, u32 reg, u32 val)return 0 ; } - ret =__ar9331_mdio_write (sbus,AR9331_SW_MDIO_PHY_MODE_REG , reg, val); +/* In case of this switch we work with 32bit registers on top of 16bit +* bus. Some registers (for example access to forwarding database) have +* trigger bit on the first 16bit half of request, the result and +* configuration of request in the second half. +* To make it work properly, we should do the second part of transfer +* before the first one is done. +*/ + ret =__ar9331_mdio_write (sbus,AR9331_SW_MDIO_PHY_MODE_REG , reg +2 , + val >>16 );if (ret <0 ) goto error; - ret =__ar9331_mdio_write (sbus,AR9331_SW_MDIO_PHY_MODE_REG , reg +2 , - val >>16 ); + ret =__ar9331_mdio_write (sbus,AR9331_SW_MDIO_PHY_MODE_REG , reg, val);if (ret <0 ) goto error;return 0 ; + error:dev_err_ratelimited (&sbus->dev,"Bus error. Failed to write register.\n" );return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 43/135 net: sched: fix lockdep_set_class() typo error for sch->seqlock
In reply to Greg Kroah-HartmanFrom: Yunsheng Lin <[email protected]>
[ Upstream commit 06f5553e0f0c2182268179b93856187d9cb86dd5 ]
According to comment in qdisc_alloc(), sch->seqlock's lockdep class key should be set to qdisc_tx_busylock, due to possible type error, sch->busylock's lockdep class key is set to qdisc_tx_busylock, which is duplicated because sch->busylock's lockdep class key is already set in qdisc_alloc().
So fix it by replacing sch->busylock with sch->seqlock.
--- net/sched/sch_generic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_generic.c +1 -1
@@ -886,7 +886,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,/* seqlock has the same scope of busylock, for NOLOCK qdisc */ spin_lock_init (&sch->seqlock); -lockdep_set_class (&sch->busylock, +lockdep_set_class (&sch->seqlock, dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);seqcount_init (&sch->running);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 44/135 MIPS: check return value of pgtable_pmd_page_ctor
In reply to Greg Kroah-HartmanFrom: Huang Pei <[email protected]>
[ Upstream commit 6aa32467299e9e12280a6aec9dbc21bf2db830b0 ]
+. According to Documentation/vm/split_page_table_lock, handle failure of pgtable_pmd_page_ctor
+. Use GFP_KERNEL_ACCOUNT instead of GFP_KERNEL|__GFP_ACCOUNT
+. Adjust coding style
--- arch/mips/include/asm/pgalloc.h | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
arch/mips/include/asm/pgalloc.h +11 -6
@@ -59,15 +59,20 @@ do { \static inline pmd_t *pmd_alloc_one (struct mm_struct *mm,unsigned long address) { -pmd_t *pmd =NULL ; +pmd_t *pmd;struct page *pg; - pg =alloc_pages (GFP_KERNEL | __GFP_ACCOUNT,PMD_ORDER ); -if (pg) { -pgtable_pmd_page_ctor (pg); - pmd = (pmd_t *)page_address (pg); -pmd_init ((unsigned long )pmd, (unsigned long )invalid_pte_table); + pg =alloc_pages (GFP_KERNEL_ACCOUNT ,PMD_ORDER ); +if (!pg) +return NULL ; + +if (!pgtable_pmd_page_ctor (pg)) { +__free_pages (pg,PMD_ORDER ); +return NULL ; } + + pmd = (pmd_t *)page_address (pg); +pmd_init ((unsigned long )pmd, (unsigned long )invalid_pte_table);return pmd; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 45/135 mips: Fix non-POSIX regexp
In reply to Greg Kroah-HartmanFrom: H. Nikolaus Schaller <[email protected]>
[ Upstream commit 28bbbb9875a35975904e46f9b06fa689d051b290 ]
When cross compiling a MIPS kernel on a BSD based HOSTCC leads to errors like
SYNC include/config/auto.conf.cmd - due to: .config
egrep: empty (sub)expression
UPD include/config/kernel.release
HOSTCC scripts/dtc/dtc.o - due to target missing
It turns out that egrep uses this egrep pattern:
(|MINOR_|PATCHLEVEL_)
This is not valid syntax or gives undefined results according to POSIX 9.5.3 ERE Grammar
https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html
It seems to be silently accepted by the Linux egrep implementation while a BSD host complains.
Such patterns can be replaced by a transformation like
"(|p1|p2)" -> "(p1|p2)?"
--- arch/mips/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/Makefile +1 -1
@@ -320,7 +320,7 @@ KBUILD_LDFLAGS += -m $(ld-emul) ifdef CONFIG_MIPS CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ - egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \ + egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g') endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 46/135 bnx2x: fix an error code in bnx2x_nic_load()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit fb653827c758725b149b5c924a5eb50ab4812750 ]
Set the error code if bnx2x_alloc_fw_stats_mem() fails. The current code returns success.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +2 -1
@@ -2669,7 +2669,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode) }/* Allocated memory for FW statistics */ -if (bnx2x_alloc_fw_stats_mem (bp)) + rc =bnx2x_alloc_fw_stats_mem (bp); +if (rc)LOAD_ERROR_EXIT (bp, load_error0);/* request pf to initialize status blocks */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 47/135 net: pegasus: fix uninit-value in get_interrupt_interval
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit af35fc37354cda3c9c8cc4961b1d24bdc9d27903 ]
Syzbot reported uninit value pegasus_probe(). The problem was in missing error handling.
get_interrupt_interval() internally calls read_eprom_word() which can fail in some cases. For example: failed to receive usb control message. These cases should be handled to prevent uninit value bug, since read_eprom_word() will not initialize passed stack variable in case of internal failure.
Fail log:
BUG: KMSAN: uninit-value in get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline] BUG: KMSAN: uninit-value in pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152 CPU: 1 PID: 825 Comm: kworker/1:1 Not tainted 5.12.0-rc6-syzkaller #0 ... Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline] pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
....
Local variable ----data.i@pegasus_probe created at:
get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline] pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152 get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline] pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152
--- drivers/net/usb/pegasus.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/usb/pegasus.c +11 -3
@@ -736,12 +736,16 @@ static inline void disable_net_traffic(pegasus_t *pegasus)set_registers (pegasus, EthCtrl0,sizeof (tmp), &tmp); } -static inline void get_interrupt_interval (pegasus_t *pegasus) +static inline int get_interrupt_interval (pegasus_t *pegasus) {u16 data;u8 interval; +int ret; + + ret =read_eprom_word (pegasus,4 , &data); +if (ret <0 ) +return ret; -read_eprom_word (pegasus,4 , &data); interval = data >>8 ;if (pegasus->usb->speed !=USB_SPEED_HIGH ) {if (interval <0x80 ) {
@@ -756,6 +760,8 @@ static inline void get_interrupt_interval(pegasus_t *pegasus) } } pegasus->intr_interval = interval; + +return 0 ; }static void set_carrier (struct net_device *net)
@@ -1150,7 +1156,9 @@ static int pegasus_probe(struct usb_interface *intf, | NETIF_MSG_PROBE | NETIF_MSG_LINK); pegasus->features = usb_dev_id[dev_index].private; -get_interrupt_interval (pegasus); + res =get_interrupt_interval (pegasus); +if (res) + goto out2;if (reset_mac (pegasus)) {dev_err (&intf->dev,"can't reset MAC\n" ); res = -EIO ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 48/135 net: fec: fix use-after-free in fec_drv_remove
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 44712965bf12ae1758cec4de53816ed4b914ca1a ]
Smatch says:
drivers/net/ethernet/freescale/fec_main.c:3994 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev);
drivers/net/ethernet/freescale/fec_main.c:3995 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev);Since fep pointer is netdev private data, accessing it after free_netdev() call can cause use-after-free bug. Fix it by moving free_netdev() call at the end of the function
--- drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/fec_main.c +1 -1
@@ -3822,13 +3822,13 @@ fec_drv_remove(struct platform_device *pdev)if (of_phy_is_fixed_link (np))of_phy_deregister_fixed_link (np);of_node_put (fep->phy_node); -free_netdev (ndev);clk_disable_unprepare (fep->clk_ahb);clk_disable_unprepare (fep->clk_ipg);pm_runtime_put_noidle (&pdev->dev);pm_runtime_disable (&pdev->dev); +free_netdev (ndev);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 49/135 net: vxge: fix use-after-free in vxge_device_unregister
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 942e560a3d3862dd5dee1411dbdd7097d29b8416 ]
Smatch says:drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev); drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev); drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev); drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
Since vdev pointer is netdev private data accessing it after free_netdev() call can cause use-after-free bug. Fix it by moving free_netdev() call at the end of the function
--- drivers/net/ethernet/neterion/vxge/vxge-main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/neterion/vxge/vxge-main.c +3 -3
@@ -3527,13 +3527,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev)kfree (vdev->vpaths); -/* we are safe to free it now */ -free_netdev (dev); -vxge_debug_init (vdev->level_trace,"%s: ethernet device unregistered" , buf);vxge_debug_entryexit (vdev->level_trace,"%s: %s:%d Exiting..." , buf, __func__, __LINE__); + +/* we are safe to free it now */ +free_netdev (dev); }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 50/135 blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 8d75d0eff6887bcac7225e12b9c75595e523d92d ]
If queue is dying while iolatency_set_limit() is in progress, blk_get_queue() won't increment the refcount of the queue. However, blk_put_queue() will still decrement the refcount later, which will cause the refcout to be unbalanced.
Thus error out in such case to fix the problem.
--- block/blk-iolatency.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
block/blk-iolatency.c +5 -1
@@ -833,7 +833,11 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, enable =iolatency_set_min_lat_nsec (blkg, lat_val);if (enable) { -WARN_ON_ONCE (!blk_get_queue (blkg->q)); +if (!blk_get_queue (blkg->q)) { + ret = -ENODEV ; + goto out; + } +blkg_get (blkg); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 51/135 Bluetooth: defer cleanup of resources in hci_unregister_dev()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit e04480920d1eec9c061841399aa6f35b6f987d8b ]
syzbot is hitting might_sleep() warning at hci_sock_dev_event() due to calling lock_sock() with rw spinlock held [1].
It seems that history of this locking problem is a trial and error.
Commit b40df5743ee8 ("[PATCH] bluetooth: fix socket locking in hci_sock_dev_event()") in 2.6.21-rc4 changed bh_lock_sock() to lock_sock() as an attempt to fix lockdep warning.
Then, commit 4ce61d1c7a8e ("[BLUETOOTH]: Fix locking in hci_sock_dev_event().") in 2.6.22-rc2 changed lock_sock() to local_bh_disable() + bh_lock_sock_nested() as an attempt to fix the sleep in atomic context warning.
Then, commit 4b5dd696f81b ("Bluetooth: Remove local_bh_disable() from hci_sock.c") in 3.3-rc1 removed local_bh_disable().
Then, commit e305509e678b ("Bluetooth: use correct lock to prevent UAF of hdev object") in 5.13-rc5 again changed bh_lock_sock_nested() to lock_sock() as an attempt to fix CVE-2021-3573.
This difficulty comes from current implementation that hci_sock_dev_event(HCI_DEV_UNREG) is responsible for dropping all references from sockets because hci_unregister_dev() immediately reclaims resources as soon as returning from hci_sock_dev_event(HCI_DEV_UNREG).
But the history suggests that hci_sock_dev_event(HCI_DEV_UNREG) was not doing what it should do.
Therefore, instead of trying to detach sockets from device, let's accept not detaching sockets from device at hci_sock_dev_event(HCI_DEV_UNREG), by moving actual cleanup of resources from hci_unregister_dev() to hci_cleanup_dev() which is called by bt_host_release() when all references to this unregistered device (which is a kobject) are gone.
Since hci_sock_dev_event(HCI_DEV_UNREG) no longer resets hci_pi(sk)->hdev, we need to check whether this device was unregistered and return an error based on HCI_UNREGISTER flag. There might be subtle behavioral difference in "monitor the hdev" functionality; please report if you found something went wrong due to this patch.
--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_core.c | 16 +++++------ net/bluetooth/hci_sock.c | 49 +++++++++++++++++++++----------- net/bluetooth/hci_sysfs.c | 3 ++ 4 files changed, 45 insertions(+), 24 deletions(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -1189,6 +1189,7 @@ struct hci_dev *hci_alloc_dev(void);void hci_free_dev (struct hci_dev *hdev);int hci_register_dev (struct hci_dev *hdev);void hci_unregister_dev (struct hci_dev *hdev); +void hci_cleanup_dev (struct hci_dev *hdev);int hci_suspend_dev (struct hci_dev *hdev);int hci_resume_dev (struct hci_dev *hdev);int hci_reset_dev (struct hci_dev *hdev);
net/bluetooth/hci_core.c +8 -8
@@ -3816,14 +3816,10 @@ EXPORT_SYMBOL(hci_register_dev);/* Unregister HCI device */ void hci_unregister_dev (struct hci_dev *hdev) { -int id; -BT_DBG ("%p name %s bus %d" , hdev, hdev->name, hdev->bus);hci_dev_set_flag (hdev,HCI_UNREGISTER ); - id = hdev->id; -write_lock (&hci_dev_list_lock);list_del (&hdev->list);write_unlock (&hci_dev_list_lock);
@@ -3858,7 +3854,14 @@ void hci_unregister_dev(struct hci_dev *hdev) }device_del (&hdev->dev); +/* Actual cleanup is deferred until hci_cleanup_dev(). */ +hci_dev_put (hdev); +} +EXPORT_SYMBOL (hci_unregister_dev); +/* Cleanup HCI device */ +void hci_cleanup_dev (struct hci_dev *hdev) +{debugfs_remove_recursive (hdev->debugfs);kfree_const (hdev->hw_info);kfree_const (hdev->fw_info);
@@ -3883,11 +3886,8 @@ void hci_unregister_dev(struct hci_dev *hdev)hci_blocked_keys_clear (hdev);hci_dev_unlock (hdev); -hci_dev_put (hdev); - -ida_simple_remove (&hci_index_ida, id); +ida_simple_remove (&hci_index_ida, hdev->id); } -EXPORT_SYMBOL (hci_unregister_dev);/* Suspend HCI device */ int hci_suspend_dev (struct hci_dev *hdev)
net/bluetooth/hci_sock.c +33 -16
92 lines not on this page · raw message
net/bluetooth/hci_sysfs.c +3 -0
@@ -83,6 +83,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)static void bt_host_release (struct device *dev) {struct hci_dev *hdev =to_hci_dev (dev); + +if (hci_dev_test_flag (hdev,HCI_UNREGISTER )) +hci_cleanup_dev (hdev);kfree (hdev);module_put (THIS_MODULE ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 52/135 USB: usbtmc: Fix RCU stall warning
In reply to Greg Kroah-HartmanFrom: Qiang.zhang <[email protected]>
commit 30fad76ce4e98263edfa8f885c81d5426c1bf169 upstream.
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-...!: (2 ticks this GP) idle=d92/1/0x4000000000000000
softirq=25390/25392 fqs=3
(t=12164 jiffies g=31645 q=43226)
rcu: rcu_preempt kthread starved for 12162 jiffies! g31645 f0x0
RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0rcu: Unless rcu_preempt kthread gets sufficient CPU time,
OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task
...........
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: unknown status received: -71
usbtmc 3-1:0.0: usb_submit_urb failed: -19
The function usbtmc_interrupt() resubmits urbs when the error status of an urb is -EPROTO. In systems using the dummy_hcd usb controller this can result in endless interrupt loops when the usbtmc device is disconnected from the host system.
Since host controller drivers already try to recover from transmission errors, there is no need to resubmit the urb or try other solutions to repair the error situation.
In case of errors the INT pipe just stops to wait for further packets.
--- drivers/usb/class/usbtmc.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/usb/class/usbtmc.c +1 -8
@@ -2283,17 +2283,10 @@ static void usbtmc_interrupt(struct urbdev_err (dev,"overflow with length %d, actual length is %d\n" , data->iin_wMaxPacketSize, urb->actual_length); fallthrough; -case -ECONNRESET : -case -ENOENT : -case -ESHUTDOWN : -case -EILSEQ : -case -ETIME : -case -EPIPE : +default :/* urb terminated, clean up */ dev_dbg (dev,"urb terminated, status: %d\n" , status);return ; -default : -dev_err (dev,"unknown status received: %d\n" , status); } exit: rv =usb_submit_urb (urb,GFP_ATOMIC );
Greg Kroah-Hartman
maintainerPATCH 53/135 USB: serial: option: add Telit FD980 composition 0x1056
In reply to Greg Kroah-HartmanFrom: Daniele Palmas <[email protected]>
commit 5648c073c33d33a0a19d0cb1194a4eb88efe2b71 upstream.
Add the following Telit FD980 composition 0x1056:
Cfg #1: mass storage
Cfg #2: rndis, tty, adb, tty, tty, tty, tty
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1203,6 +1203,8 @@ static const struct usb_device_id option .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ + .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 54/135 USB: serial: ch341: fix character loss at high transfer rates
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
commit 3c18e9baee0ef97510dcda78c82285f52626764b upstream.
The chip supports high transfer rates, but with the small default buffers (64 bytes read), some entire blocks are regularly lost. This typically happens at 1.5 Mbps (which is the default speed on Rockchip devices) when used as a console to access U-Boot where the output of the "help" command misses many lines and where "printenv" mangles the environment.
The FTDI driver doesn't suffer at all from this. One difference is that it uses 512 bytes rx buffers and 256 bytes tx buffers. Adopting these values completely resolved the issue, even the output of "dmesg" is reliable. I preferred to leave the Tx value unchanged as it is not involved in this issue, while a change could increase the risk of triggering the same issue with other devices having too small buffers.
I verified that it backports well (and works) at least to 5.4. It's of low importance enough to be dropped where it doesn't trivially apply anymore.
--- drivers/usb/serial/ch341.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/ch341.c +1 -0
@@ -853,6 +853,7 @@ static struct usb_serial_driver ch341_de .owner = THIS_MODULE, .name = "ch341-uart", }, + .bulk_in_size = 512, .id_table = id_table, .num_ports = 1, .open = ch341_open,
Greg Kroah-Hartman
maintainerPATCH 55/135 USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
In reply to Greg Kroah-HartmanFrom: David Bauer <[email protected]>
commit 8da0e55c7988ef9f08a708c38e5c75ecd8862cf8 upstream.
The Auto-M3 OP-COM v2 is a OBD diagnostic device using a FTD232 for the USB connection.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ 2 files changed, 4 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -219,6 +219,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) }, { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) }, { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_AUTO_M3_OP_COM_V2_PID) }, { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) }, { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) }, { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) },
drivers/usb/serial/ftdi_sio_ids.h +3 -0
@@ -159,6 +159,9 @@/* Vardaan Enterprises Serial Interface VEUSB422R3 */ #define FTDI_VARDAAN_PID 0xF070 +/* Auto-M3 Ltd. - OP-COM USB V2 - OBD interface Adapter */ +#define FTDI_AUTO_M3_OP_COM_V2_PID 0x4f50 +/* * Xsens Technologies BV products (http://www.xsens.com). */
Greg Kroah-Hartman
maintainerPATCH 56/135 firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
In reply to Greg Kroah-HartmanFrom: Anirudh Rayabharam <[email protected]>
commit 0d6434e10b5377a006f6dd995c8fc5e2d82acddc upstream.
The only motivation for using -EAGAIN in commit 0542ad88fbdd81bb ("firmware loader: Fix _request_firmware_load() return val for fw load abort") was to distinguish the error from -ENOMEM, and so there is no real reason in keeping it. -EAGAIN is typically used to tell the userspace to try something again and in this case re-using the sysfs loading interface cannot be retried when a timeout happens, so the return value is also bogus.
-ETIMEDOUT is received when the wait times out and returning that is much more telling of what the reason for the failure was. So, just propagate that instead of returning -EAGAIN.
--- drivers/base/firmware_loader/fallback.c | 2 -- 1 file changed, 2 deletions(-)
drivers/base/firmware_loader/fallback.c +0 -2
@@ -535,8 +535,6 @@ static int fw_load_sysfs_fallback(structif (fw_state_is_aborted (fw_priv)) {if (retval == -ERESTARTSYS ) retval = -EINTR ; -else - retval = -EAGAIN ; }else if (fw_priv->is_paged_buf && !fw_priv->data) retval = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 57/135 firmware_loader: fix use-after-free in firmware_fallback_sysfs
In reply to Greg Kroah-HartmanFrom: Anirudh Rayabharam <[email protected]>
commit 75d95e2e39b27f733f21e6668af1c9893a97de5e upstream.
This use-after-free happens when a fw_priv object has been freed but hasn't been removed from the pending list (pending_fw_head). The next time fw_load_sysfs_fallback tries to insert into the list, it ends up accessing the pending_list member of the previously freed fw_priv.
The root cause here is that all code paths that abort the fw load don't delete it from the pending list. For example:
_request_firmware()
-> fw_abort_batch_reqs()
-> fw_state_aborted()To fix this, delete the fw_priv from the list in __fw_set_state() if the new state is DONE or ABORTED. This way, all aborts will remove the fw_priv from the list. Accordingly, remove calls to list_del_init that were being made before calling fw_state_(aborted|done).
Also, in fw_load_sysfs_fallback, don't add the fw_priv to the pending list if it is already aborted. Instead, just jump out and return early.
--- drivers/base/firmware_loader/fallback.c | 12 ++++++++---- drivers/base/firmware_loader/firmware.h | 10 +++++++++- drivers/base/firmware_loader/main.c | 2 ++ 3 files changed, 19 insertions(+), 5 deletions(-)
drivers/base/firmware_loader/fallback.c +8 -4
@@ -89,12 +89,11 @@ static void __fw_load_abort(struct fw_pr {/* * There is a small window in which user can write to 'loading' -* between loading done and disappearance of 'loading' +* between loading done/aborted and disappearance of 'loading' */ -if (fw_sysfs_done (fw_priv)) +if (fw_state_is_aborted (fw_priv) ||fw_sysfs_done (fw_priv))return ; -list_del_init (&fw_priv->pending_list);fw_state_aborted (fw_priv); }
@@ -280,7 +279,6 @@ static ssize_t firmware_loading_store(st* Same logic as fw_load_abort, only the DONE bit * is ignored and we set ABORT only on failure. */ -list_del_init (&fw_priv->pending_list);if (rc) {fw_state_aborted (fw_priv); written = rc;
@@ -513,6 +511,11 @@ static int fw_load_sysfs_fallback(struct }mutex_lock (&fw_lock); +if (fw_state_is_aborted (fw_priv)) { +mutex_unlock (&fw_lock); + retval = -EINTR ; + goto out; + }list_add (&fw_priv->pending_list, &pending_fw_head);mutex_unlock (&fw_lock);
@@ -538,6 +541,7 @@ static int fw_load_sysfs_fallback(struct }else if (fw_priv->is_paged_buf && !fw_priv->data) retval = -ENOMEM ; +out:device_del (f_dev); err_put_dev:put_device (f_dev);
drivers/base/firmware_loader/firmware.h +9 -1
@@ -117,8 +117,16 @@ static inline void __fw_state_set(structWRITE_ONCE (fw_st->status, status); -if (status ==FW_STATUS_DONE || status ==FW_STATUS_ABORTED ) +if (status ==FW_STATUS_DONE || status ==FW_STATUS_ABORTED ) { +#ifdef CONFIG_FW_LOADER_USER_HELPER +/* +* Doing this here ensures that the fw_priv is deleted from +* the pending list in all abort/done paths. +*/ +list_del_init (&fw_priv->pending_list); +#endif complete_all (&fw_st->completion); + } }static inline void fw_state_aborted (struct fw_priv *fw_priv)
drivers/base/firmware_loader/main.c +2 -0
@@ -781,8 +781,10 @@ static void fw_abort_batch_reqs(struct freturn ; fw_priv = fw->priv; +mutex_lock (&fw_lock);if (!fw_state_is_aborted (fw_priv))fw_state_aborted (fw_priv); +mutex_unlock (&fw_lock); }/* called from request_firmware() and request_firmware_work_func() */
Greg Kroah-Hartman
maintainerPATCH 58/135 drm/amdgpu/display: fix DMUB firmware version info
In reply to Greg Kroah-HartmanFrom: Shirish S <[email protected]>
commit 0e99e960ce6d5ff586fc0733bc393c087f52c27b upstream.
DMUB firmware info is printed before it gets initialized. Correct this order to ensure true value is conveyed.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -1
@@ -1301,6 +1301,7 @@ static int dm_dmub_sw_init(struct amdgpu } hdr = (const struct dmcub_firmware_header_v1_0 *)adev->dm.dmub_fw->data; + adev->dm.dmcub_fw_version =le32_to_cpu (hdr->header.ucode_version);if (adev->firmware.load_type ==AMDGPU_FW_LOAD_PSP ) { adev->firmware.ucode[AMDGPU_UCODE_ID_DMCUB].ucode_id =
@@ -1314,7 +1315,6 @@ static int dm_dmub_sw_init(struct amdgpu adev->dm.dmcub_fw_version); } - adev->dm.dmcub_fw_version =le32_to_cpu (hdr->header.ucode_version); adev->dm.dmub_srv =kzalloc (sizeof (*adev->dm.dmub_srv),GFP_KERNEL ); dmub_srv = adev->dm.dmub_srv;
Greg Kroah-Hartman
maintainerPATCH 59/135 ALSA: pcm - fix mmap capability check for the snd-dummy driver
In reply to Greg Kroah-HartmanFrom: Jaroslav Kysela <[email protected]>
commit 852a8a97776a153be2e6c803218eced45f37a19c upstream.
The snd-dummy driver (fake_buffer configuration) uses the ops->page callback for the mmap operations. Allow mmap for this case, too.
--- sound/core/pcm_native.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/pcm_native.c +1 -1
@@ -246,7 +246,7 @@ static bool hw_support_mmap(struct snd_pif (!(substream->runtime->hw.info &SNDRV_PCM_INFO_MMAP ))return false; -if (substream->ops->mmap) +if (substream->ops->mmap || substream->ops->page)return true;switch (substream->dma_buffer.dev.type) {
Greg Kroah-Hartman
maintainerPATCH 60/135 ALSA: hda/realtek: add mic quirk for Acer SF314-42
In reply to Greg Kroah-HartmanFrom: Alexander Monakov <[email protected]>
commit 0d4867a185460397af56b9afe3e2243d3e610e37 upstream.
The Acer Swift SF314-42 laptop is using Realtek ALC255 codec. Add a quirk so microphone in a headset connected via the right-hand side jack is usable.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8203,6 +8203,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1025 ,0x1308 ,"Acer Aspire Z24-890" ,ALC286_FIXUP_ACER_AIO_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x132a ,"Acer TravelMate B114-21" ,ALC233_FIXUP_ACER_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x1330 ,"Acer TravelMate X514-51T" ,ALC255_FIXUP_ACER_HEADSET_MIC ), +SND_PCI_QUIRK (0x1025 ,0x142b ,"Acer Swift SF314-42" ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1025 ,0x1430 ,"Acer TravelMate B311R-31" ,ALC256_FIXUP_ACER_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1025 ,0x1466 ,"Acer Aspire A515-56" ,ALC255_FIXUP_ACER_HEADPHONE_AND_MIC ), SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
Greg Kroah-Hartman
maintainerPATCH 61/135 ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256)
In reply to Greg Kroah-HartmanFrom: Nikos Liolios <[email protected]>
commit 35171fbfc0d94aa31b009bb475d156ad1941ab50 upstream.
The issue on Acer SWIFT SF314-56 is that headset microphone doesn't work.
The following quirk fixed headset microphone issue. The fixup was found by trial and error. Note that the fixup of SF314-54/55 (ALC256_FIXUP_ACER_HEADSET_MIC) was not successful on my SF314-56.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8200,6 +8200,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1025 ,0x1290 ,"Acer Veriton Z4860G" ,ALC286_FIXUP_ACER_AIO_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x1291 ,"Acer Veriton Z4660G" ,ALC286_FIXUP_ACER_AIO_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x129c ,"Acer SWIFT SF314-55" ,ALC256_FIXUP_ACER_HEADSET_MIC ), +SND_PCI_QUIRK (0x1025 ,0x1300 ,"Acer SWIFT SF314-56" ,ALC256_FIXUP_ACER_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1025 ,0x1308 ,"Acer Aspire Z24-890" ,ALC286_FIXUP_ACER_AIO_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x132a ,"Acer TravelMate B114-21" ,ALC233_FIXUP_ACER_HEADSET_MIC ), SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 62/135 ALSA: usb-audio: Fix superfluous autosuspend recovery
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 66291b6adb66dd3bc96b0f594d88c2ff1300d95f upstream.
The change to restore the autosuspend from the disabled state uses a wrong check: namely, it should have been the exact comparison of the quirk_type instead of the bitwise and (&). Otherwise it matches wrongly with the other quirk types.
Although re-enabling the autosuspend for the already enabled device shouldn't matter much, it's better to fix the unbalanced call.
--- sound/usb/card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/card.c +1 -1
@@ -907,7 +907,7 @@ static void usb_audio_disconnect(struct } } -if (chip->quirk_type &QUIRK_SETUP_DISABLE_AUTOSUSPEND ) +if (chip->quirk_type ==QUIRK_SETUP_DISABLE_AUTOSUSPEND )usb_enable_autosuspend (interface_to_usbdev (intf)); chip->num_interfaces--;
Greg Kroah-Hartman
maintainerPATCH 63/135 ALSA: usb-audio: Add registration quirk for JBL Quantum 600
In reply to Greg Kroah-HartmanFrom: Alexander Tsoy <[email protected]>
commit 4b0556b96e1fe7723629bd40e3813a30cd632faf upstream.
Apparently JBL Quantum 600 has multiple hardware revisions. Apply registration quirk to another device id as well.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1897,6 +1897,7 @@ static const struct registration_quirk rREG_QUIRK_ENTRY (0x0951 ,0x16ea ,2 ),/* Kingston HyperX Cloud Flight S */ REG_QUIRK_ENTRY (0x0ecb ,0x1f46 ,2 ),/* JBL Quantum 600 */ REG_QUIRK_ENTRY (0x0ecb ,0x2039 ,2 ),/* JBL Quantum 400 */ +REG_QUIRK_ENTRY (0x0ecb ,0x203c ,2 ),/* JBL Quantum 600 */ REG_QUIRK_ENTRY (0x0ecb ,0x203e ,2 ),/* JBL Quantum 800 */ { 0 } /* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 64/135 usb: dwc3: gadget: Avoid runtime resume if disabling pullup
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
commit cb10f68ad8150f243964b19391711aaac5e8ff42 upstream.
If the device is already in the runtime suspended state, any call to the pullup routine will issue a runtime resume on the DWC3 core device. If the USB gadget is disabling the pullup, then avoid having to issue a runtime resume, as DWC3 gadget has already been halted/stopped.
This fixes an issue where the following condition occurs:
usb_gadget_remove_driver()
-->usb_gadget_disconnect()
-->dwc3_gadget_pullup(0)
-->pm_runtime_get_sync() -> ret = 0
-->pm_runtime_put() [async]
-->usb_gadget_udc_stop()
-->dwc3_gadget_stop()
-->dwc->gadget_driver = NULL
...
dwc3_suspend_common()
-->dwc3_gadget_suspend()
-->DWC3 halt/stop routine skipped, driver_data == NULL
This leads to a situation where the DWC3 gadget is not properly stopped, as the runtime resume would have re-enabled EP0 and event interrupts, and since we avoided the DWC3 gadget suspend, these resources were never disabled.
--- drivers/usb/dwc3/gadget.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/dwc3/gadget.c +11 -0
@@ -2132,6 +2132,17 @@ static int dwc3_gadget_pullup(struct usb }/* +* Avoid issuing a runtime resume if the device is already in the +* suspended state during gadget disconnect. DWC3 gadget was already +* halted/stopped during runtime suspend. +*/ +if (!is_on) { +pm_runtime_barrier (dwc->dev); +if (pm_runtime_suspended (dwc->dev)) +return 0 ; + } + +/* * Check the return value for successful resume, or error. For a * successful resume, the DWC3 runtime PM resume routine will handle * the run stop sequence, so avoid duplicate operations here.
Greg Kroah-Hartman
maintainerPATCH 65/135 usb: gadget: remove leaked entry from udc driver list
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
commit fa4a8dcfd51b911f101ebc461dfe22230b74dd64 upstream.
The usb_add_gadget_udc will add a new gadget to the udc class driver list. Not calling usb_del_gadget_udc in error branch will result in residual gadget entry in the udc driver list. We fix it by calling usb_del_gadget_udc to clean it when error return.
--- drivers/usb/gadget/udc/max3420_udc.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/usb/gadget/udc/max3420_udc.c +10 -4
@@ -1260,12 +1260,14 @@ static int max3420_probe(struct spi_devi err =devm_request_irq (&spi->dev, irq, max3420_irq_handler,0 ,"max3420" , udc);if (err <0 ) -return err; + goto del_gadget; udc->thread_task =kthread_create (max3420_thread, udc,"max3420-thread" ); -if (IS_ERR (udc->thread_task)) -return PTR_ERR (udc->thread_task); +if (IS_ERR (udc->thread_task)) { + err =PTR_ERR (udc->thread_task); + goto del_gadget; + } irq =of_irq_get_byname (spi->dev.of_node,"vbus" );if (irq <=0 ) {/* no vbus irq implies self-powered design */
@@ -1285,10 +1287,14 @@ static int max3420_probe(struct spi_devi err =devm_request_irq (&spi->dev, irq, max3420_vbus_handler,0 ,"vbus" , udc);if (err <0 ) -return err; + goto del_gadget; }return 0 ; + +del_gadget: +usb_del_gadget_udc (&udc->gadget); +return err; }static int max3420_remove (struct spi_device *spi)
Greg Kroah-Hartman
maintainerPATCH 66/135 usb: cdns3: Fixed incorrect gadget state
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
commit aa35772f61752d4c636d46be51a4f7ca6c029ee6 upstream.
For delayed status phase, the usb_gadget->state was set to USB_STATE_ADDRESS and it has never been updated to USB_STATE_CONFIGURED.
Patch updates the gadget state to correct USB_STATE_CONFIGURED. As a result of this bug the controller was not able to enter to Test Mode while using MSC function.
--- drivers/usb/cdns3/ep0.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/cdns3/ep0.c +1 -0
@@ -731,6 +731,7 @@ static int cdns3_gadget_ep0_queue(struct request->actual =0 ; priv_dev->status_completion_no_call = true; priv_dev->pending_status_request = request; +usb_gadget_set_state (&priv_dev->gadget,USB_STATE_CONFIGURED );spin_unlock_irqrestore (&priv_dev->lock, flags);/*
Greg Kroah-Hartman
maintainerPATCH 67/135 usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
In reply to Greg Kroah-HartmanFrom: Maxim Devaev <[email protected]>
commit afcff6dc690e24d636a41fd4bee6057e7c70eebd upstream.
The USB HID standard declares mandatory support for GET_IDLE and SET_IDLE requests for Boot Keyboard. Most hosts can handle their absence, but others like some old/strange UEFIs and BIOSes consider this a critical error and refuse to work with f_hid.
This primitive implementation of saving and returning idle is sufficient to meet the requirements of the standard and these devices.
--- drivers/usb/gadget/function/f_hid.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/usb/gadget/function/f_hid.c +18 -0
@@ -41,6 +41,7 @@ struct f_hidg {unsigned char bInterfaceSubClass;unsigned char bInterfaceProtocol;unsigned char protocol; +unsigned char idle;unsigned short report_desc_length;char *report_desc;unsigned short report_length;
@@ -523,6 +524,14 @@ static int hidg_setup(struct usb_functio goto respond;break ; +case ((USB_DIR_IN |USB_TYPE_CLASS |USB_RECIP_INTERFACE ) <<8 + |HID_REQ_GET_IDLE ): +VDBG (cdev,"get_idle\n" ); + length = min_t(unsigned int, length, 1); + ((u8 *) req->buf)[0 ] = hidg->idle; + goto respond; +break ; +case ((USB_DIR_OUT |USB_TYPE_CLASS |USB_RECIP_INTERFACE ) <<8 |HID_REQ_SET_REPORT ):VDBG (cdev,"set_report | wLength=%d\n" , ctrl->wLength);
@@ -546,6 +555,14 @@ static int hidg_setup(struct usb_functio goto stall;break ; +case ((USB_DIR_OUT |USB_TYPE_CLASS |USB_RECIP_INTERFACE ) <<8 + |HID_REQ_SET_IDLE ): +VDBG (cdev,"set_idle\n" ); + length =0 ; + hidg->idle = value; + goto respond; +break ; +case ((USB_DIR_IN |USB_TYPE_STANDARD |USB_RECIP_INTERFACE ) <<8 |USB_REQ_GET_DESCRIPTOR ):switch (value >>8 ) {
@@ -773,6 +790,7 @@ static int hidg_bind(struct usb_configur hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass; hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol; hidg->protocol =HID_REPORT_PROTOCOL ; + hidg->idle =1 ; hidg_ss_in_ep_desc.wMaxPacketSize =cpu_to_le16 (hidg->report_length); hidg_ss_in_comp_desc.wBytesPerInterval =cpu_to_le16 (hidg->report_length);
Greg Kroah-Hartman
maintainerPATCH 68/135 usb: gadget: f_hid: fixed NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
commit 2867652e4766360adf14dfda3832455e04964f2a upstream.
Disconnecting and reconnecting the USB cable can lead to crashes and a variety of kernel log spam.
The problem was found and reproduced on the Raspberry Pi [1] and the original fix was created in Raspberry's own fork [2].
--- drivers/usb/gadget/function/f_hid.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-)
drivers/usb/gadget/function/f_hid.c +20 -6
@@ -339,6 +339,11 @@ static ssize_t f_hidg_write(struct filespin_lock_irqsave (&hidg->write_spinlock, flags); +if (!hidg->req) { +spin_unlock_irqrestore (&hidg->write_spinlock, flags); +return -ESHUTDOWN ; + } +#define WRITE_COND (!hidg->write_pending) try_again:/* write queue */
@@ -359,8 +364,14 @@ try_again: count =min_t (unsigned, count, hidg->report_length);spin_unlock_irqrestore (&hidg->write_spinlock, flags); - status =copy_from_user (req->buf, buffer, count); +if (!req) { +ERROR (hidg->func.config->cdev,"hidg->req is NULL\n" ); + status = -ESHUTDOWN ; + goto release_write_pending; + } + + status =copy_from_user (req->buf, buffer, count);if (status !=0 ) {ERROR (hidg->func.config->cdev,"copy_from_user error\n" );
@@ -388,14 +399,17 @@ try_again:spin_unlock_irqrestore (&hidg->write_spinlock, flags); +if (!hidg->in_ep->enabled) { +ERROR (hidg->func.config->cdev,"in_ep is disabled\n" ); + status = -ESHUTDOWN ; + goto release_write_pending; + } + status =usb_ep_queue (hidg->in_ep, req,GFP_ATOMIC ); -if (status <0 ) { -ERROR (hidg->func.config->cdev, -"usb_ep_queue error on int endpoint %zd\n" , status); +if (status <0 ) goto release_write_pending; - }else { +else status = count; - }return status; release_write_pending:
Greg Kroah-Hartman
maintainerPATCH 69/135 usb: gadget: f_hid: idle uses the highest byte for duration
In reply to Greg Kroah-HartmanFrom: Maxim Devaev <[email protected]>
commit fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 upstream.
SET_IDLE value must be shifted 8 bits to the right to get duration. This confirmed by USBCV test.
--- drivers/usb/gadget/function/f_hid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_hid.c +1 -1
@@ -573,7 +573,7 @@ static int hidg_setup(struct usb_functio | HID_REQ_SET_IDLE):VDBG (cdev,"set_idle\n" ); length =0 ; - hidg->idle = value; + hidg->idle = value >>8 ; goto respond;break ;
Greg Kroah-Hartman
maintainerPATCH 70/135 usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
commit 00de6a572f30ee93cad7e0704ec4232e5e72bda8 upstream.
On SAMA7G5 suspending ports will cut the access to OHCI registers and any subsequent access to them will lead to CPU being blocked trying to access that memory. Same thing happens on resume: if OHCI memory is accessed before resuming ports the CPU will block on that access. The OCHI memory is accessed on suspend/resume though ohci_suspend()/ohci_resume().
--- drivers/usb/host/ohci-at91.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/usb/host/ohci-at91.c +5 -4
@@ -606,8 +606,6 @@ ohci_hcd_at91_drv_suspend(struct deviceif (ohci_at91->wakeup)enable_irq_wake (hcd->irq); -ohci_at91_port_suspend (ohci_at91->sfr_regmap,1 ); - ret =ohci_suspend (hcd, ohci_at91->wakeup);if (ret) {if (ohci_at91->wakeup)
@@ -627,7 +625,10 @@ ohci_hcd_at91_drv_suspend(struct device/* flush the writes */ (void )ohci_readl (ohci, &ohci->regs->control);msleep (1 ); +ohci_at91_port_suspend (ohci_at91->sfr_regmap,1 );at91_stop_clock (ohci_at91); + }else { +ohci_at91_port_suspend (ohci_at91->sfr_regmap,1 ); }return ret;
@@ -639,6 +640,8 @@ ohci_hcd_at91_drv_resume(struct device *struct usb_hcd *hcd =dev_get_drvdata (dev);struct ohci_at91_priv *ohci_at91 =hcd_to_ohci_at91_priv (hcd); +ohci_at91_port_suspend (ohci_at91->sfr_regmap,0 ); +if (ohci_at91->wakeup)disable_irq_wake (hcd->irq);else
@@ -646,8 +649,6 @@ ohci_hcd_at91_drv_resume(struct device *ohci_resume (hcd, false); -ohci_at91_port_suspend (ohci_at91->sfr_regmap,0 ); -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 71/135 usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events
In reply to Greg Kroah-HartmanFrom: Kyle Tso <[email protected]>
commit 43ad944cd73f2360ec8ff31d29ea44830b3119af upstream.
When receiving FRS and Sourcing_Vbus events from low-level drivers, keep other events which come a bit earlier so that they will not be ignored in the event handler.
--- drivers/usb/typec/tcpm/tcpm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +2 -2
@@ -4314,7 +4314,7 @@ EXPORT_SYMBOL_GPL(tcpm_pd_hard_reset);void tcpm_sink_frs (struct tcpm_port *port) {spin_lock (&port->pd_event_lock); - port->pd_events =TCPM_FRS_EVENT ; + port->pd_events |=TCPM_FRS_EVENT ;spin_unlock (&port->pd_event_lock);kthread_queue_work (port->wq, &port->event_work); }
@@ -4323,7 +4323,7 @@ EXPORT_SYMBOL_GPL(tcpm_sink_frs);void tcpm_sourcing_vbus (struct tcpm_port *port) {spin_lock (&port->pd_event_lock); - port->pd_events =TCPM_SOURCING_VBUS ; + port->pd_events |=TCPM_SOURCING_VBUS ;spin_unlock (&port->pd_event_lock);kthread_queue_work (port->wq, &port->event_work); }
Greg Kroah-Hartman
maintainerPATCH 72/135 usb: otg-fsm: Fix hrtimer list corruption
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit bf88fef0b6f1488abeca594d377991171c00e52a upstream.
The HNP work can be re-scheduled while it's still in-fly. This results in re-initialization of the busy work, resetting the hrtimer's list node of the work and crashing kernel with null dereference within kernel/timer once work's timer is expired. It's very easy to trigger this problem by re-plugging USB cable quickly. Initialize HNP work only once to fix this trouble.
Unable to handle kernel NULL pointer dereference at virtual address 00000126) ... PC is at __run_timers.part.0+0x150/0x228 LR is at __next_timer_interrupt+0x51/0x9c ... (__run_timers.part.0) from [<c0187a2b>] (run_timer_softirq+0x2f/0x50) (run_timer_softirq) from [<c01013ad>] (__do_softirq+0xd5/0x2f0) (__do_softirq) from [<c012589b>] (irq_exit+0xab/0xb8) (irq_exit) from [<c0170341>] (handle_domain_irq+0x45/0x60) (handle_domain_irq) from [<c04c4a43>] (gic_handle_irq+0x6b/0x7c) (gic_handle_irq) from [<c0100b65>] (__irq_svc+0x65/0xac)
--- drivers/usb/common/usb-otg-fsm.c | 6 +++++- include/linux/usb/otg-fsm.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/usb/common/usb-otg-fsm.c +5 -1
@@ -193,7 +193,11 @@ static void otg_start_hnp_polling(structif (!fsm->host_req_flag)return ; -INIT_DELAYED_WORK (&fsm->hnp_polling_work, otg_hnp_polling_work); +if (!fsm->hnp_work_inited) { +INIT_DELAYED_WORK (&fsm->hnp_polling_work, otg_hnp_polling_work); + fsm->hnp_work_inited = true; + } +schedule_delayed_work (&fsm->hnp_polling_work,msecs_to_jiffies (T_HOST_REQ_POLL )); }
include/linux/usb/otg-fsm.h +1 -0
@@ -196,6 +196,7 @@ struct otg_fsm {struct mutex lock;u8 *host_req_flag;struct delayed_work hnp_polling_work; +bool hnp_work_inited;bool state_changed; };
Greg Kroah-Hartman
maintainerPATCH 73/135 clk: fix leak on devm_clk_bulk_get_all() unwind
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit f828b0bcacef189edbd247e9f48864fc36bfbe33 upstream.
clk_bulk_get_all() allocates an array of struct clk_bulk data for us (unlike clk_bulk_get()), so we need to free it. Let's use the clk_bulk_put_all() helper.
kmemleak complains, on an RK3399 Gru/Kevin system:
unreferenced object 0xffffff80045def00 (size 128):
comm "swapper/0", pid 1, jiffies 4294667682 (age 86.394s) hex dump (first 32 bytes):
44 32 60 fe fe ff ff ff 00 00 00 00 00 00 00 00 D2`.............
48 32 60 fe fe ff ff ff 00 00 00 00 00 00 00 00 H2`.............
backtrace:
[<00000000742860d6>] __kmalloc+0x22c/0x39c
[<00000000b0493f2c>] clk_bulk_get_all+0x64/0x188
[<00000000325f5900>] devm_clk_bulk_get_all+0x58/0xa8
[<00000000175b9bc5>] dwc3_probe+0x8ac/0xb5c
[<000000009169e2f9>] platform_drv_probe+0x9c/0xbc
[<000000005c51e2ee>] really_probe+0x13c/0x378
[<00000000c47b1f24>] driver_probe_device+0x84/0xc0
[<00000000f870fcfb>] __device_attach_driver+0x94/0xb0
[<000000004d1b92ae>] bus_for_each_drv+0x8c/0xd8
[<00000000481d60c3>] __device_attach+0xc4/0x150
[<00000000a163bd36>] device_initial_probe+0x1c/0x28
[<00000000accb6bad>] bus_probe_device+0x3c/0x9c
[<000000001a199f89>] device_add+0x218/0x3cc
[<000000001bd84952>] of_device_add+0x40/0x50
[<000000009c658c29>] of_platform_device_create_pdata+0xac/0x100
[<0000000021c69ba4>] of_platform_bus_create+0x190/0x224--- drivers/clk/clk-devres.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/clk/clk-devres.c +8 -1
@@ -92,13 +92,20 @@ int __must_check devm_clk_bulk_get_optio }EXPORT_SYMBOL_GPL (devm_clk_bulk_get_optional); +static void devm_clk_bulk_release_all (struct device *dev,void *res) +{ +struct clk_bulk_devres *devres = res; + +clk_bulk_put_all (devres->num_clks, devres->clks); +} +int __must_check devm_clk_bulk_get_all (struct device *dev,struct clk_bulk_data **clks) {struct clk_bulk_devres *devres;int ret; - devres =devres_alloc (devm_clk_bulk_release, + devres =devres_alloc (devm_clk_bulk_release_all,sizeof (*devres),GFP_KERNEL );if (!devres)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 74/135 scripts/tracing: fix the bug that cant parse raw_trace_func
In reply to Greg Kroah-HartmanFrom: Hui Su <[email protected]>
commit 1c0cec64a7cc545eb49f374a43e9f7190a14defa upstream.
Since commit 77271ce4b2c0 ("tracing: Add irq, preempt-count and need resched info to default trace output"), the default trace output format has been changed to:
<idle>-0 [009] d.h. 22420.068695: _raw_spin_lock_irqsave <-hrtimer_interrupt
<idle>-0 [000] ..s. 22420.068695: _nohz_idle_balance <-run_rebalance_domains
<idle>-0 [011] d.h. 22420.068695: account_process_tick <-update_process_timesorigin trace output format:(before v3.2.0)
# tracer: nop
#
# TASK-PID CPU# TIMESTAMP FUNCTION
# | | | | |
migration/0-6 [000] 50.025810: rcu_note_context_switch <-__schedule
migration/0-6 [000] 50.025812: trace_rcu_utilization <-rcu_note_context_switch
migration/0-6 [000] 50.025813: rcu_sched_qs <-rcu_note_context_switch
migration/0-6 [000] 50.025815: rcu_preempt_qs <-rcu_note_context_switch
migration/0-6 [000] 50.025817: trace_rcu_utilization <-rcu_note_context_switch
migration/0-6 [000] 50.025818: debug_lockdep_rcu_enabled <-__schedule
migration/0-6 [000] 50.025820: debug_lockdep_rcu_enabled <-__scheduleThe draw_functrace.py(introduced in v2.6.28) can't parse the new version format trace_func, So we need modify draw_functrace.py to adapt the new version trace output format.
--- scripts/tracing/draw_functrace.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
scripts/tracing/draw_functrace.py +3 -3
@@ -17,7 +17,7 @@ Usage: $ cat /sys/kernel/debug/tracing/trace_pipe > ~/raw_trace_func Wait some times but not too much, the script is a bit slow. Break the pipe (Ctrl + Z) - $ scripts/draw_functrace.py < raw_trace_func > draw_functrace + $ scripts/tracing/draw_functrace.py < ~/raw_trace_func > draw_functrace Then you have your drawn trace in draw_functrace """
@@ -103,10 +103,10 @@ def parseLine(line): line = line.strip() if line.startswith("#"): raise CommentLineException - m = re.match("[^]]+?\\] +([0-9.]+): (\\w+) <-(\\w+)", line) + m = re.match("[^]]+?\\] +([a-z.]+) +([0-9.]+): (\\w+) <-(\\w+)", line) if m is None: raise BrokenLineException - return (m.group(1), m.group(2), m.group(3)) + return (m.group(2), m.group(3), m.group(4)) def main():
Greg Kroah-Hartman
maintainerPATCH 75/135 tracing / histogram: Give calculation hist_fields a size
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 2c05caa7ba8803209769b9e4fe02c38d77ae88d0 upstream.
When working on my user space applications, I found a bug in the synthetic event code where the automated synthetic event field was not matching the event field calculation it was attached to. Looking deeper into it, it was because the calculation hist_field was not given a size.
The synthetic event fields are matched to their hist_fields either by having the field have an identical string type, or if that does not match, then the size and signed values are used to match the fields.
The problem arose when I tried to match a calculation where the fields were "unsigned int". My tool created a synthetic event of type "u32". But it failed to match. The string was:
diff=field1-field2:onmatch(event).trace(synth,$diff)
Adding debugging into the kernel, I found that the size of "diff" was 0. And since it was given "unsigned int" as a type, the histogram fallback code used size and signed. The signed matched, but the size of u32 (4) did not match zero, and the event failed to be created.
This can be worse if the field you want to match is not one of the acceptable fields for a synthetic event. As event fields can have any type that is supported in Linux, this can cause an issue. For example, if a type is an enum. Then there's no way to use that with any calculations.
Have the calculation field simply take on the size of what it is calculating.
--- kernel/trace/trace_events_hist.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/trace/trace_events_hist.c +4 -0
@@ -2271,6 +2271,10 @@ static struct hist_field *parse_expr(str expr->operands[0 ] = operand1; expr->operands[1 ] = operand2; + +/* The operand sizes should be the same, so just pick one */ + expr->size = operand1->size; + expr->operator = field_op; expr->name =expr_str (expr,0 ); expr->type =kstrdup (operand1->type,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 76/135 tracing: Reject string operand in the histogram expression
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit a9d10ca4986571bffc19778742d508cc8dd13e02 upstream.
Since the string type can not be the target of the addition / subtraction operation, it must be rejected. Without this fix, the string type silently converted to digits.
--- kernel/trace/trace_events_hist.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
kernel/trace/trace_events_hist.c +19 -1
@@ -65,7 +65,8 @@C (INVALID_SORT_MODIFIER ,"Invalid sort modifier" ), \C (EMPTY_SORT_FIELD ,"Empty sort field" ), \C (TOO_MANY_SORT_FIELDS ,"Too many sort fields (Max = 2)" ), \ -C (INVALID_SORT_FIELD ,"Sort field must be a key or a val" ), +C (INVALID_SORT_FIELD ,"Sort field must be a key or a val" ), \ +C (INVALID_STR_OPERAND ,"String type can not be an operand in expression" ), #undef C #define C(a, b) HIST_ERR_##a
@@ -2140,6 +2141,13 @@ static struct hist_field *parse_unary(st ret =PTR_ERR (operand1); goto free; } +if (operand1->flags &HIST_FIELD_FL_STRING ) { +/* String type can not be the operand of unary operator. */ +hist_err (file->tr,HIST_ERR_INVALID_STR_OPERAND ,errpos (str)); +destroy_hist_field (operand1,0 ); + ret = -EINVAL ; + goto free; + } expr->flags |= operand1->flags & (HIST_FIELD_FL_TIMESTAMP |HIST_FIELD_FL_TIMESTAMP_USECS );
@@ -2241,6 +2249,11 @@ static struct hist_field *parse_expr(str operand1 =NULL ; goto free; } +if (operand1->flags &HIST_FIELD_FL_STRING ) { +hist_err (file->tr,HIST_ERR_INVALID_STR_OPERAND ,errpos (operand1_str)); + ret = -EINVAL ; + goto free; + }/* rest of string could be another expression e.g. b+c in a+b+c */ operand_flags =0 ;
@@ -2250,6 +2263,11 @@ static struct hist_field *parse_expr(str operand2 =NULL ; goto free; } +if (operand2->flags &HIST_FIELD_FL_STRING ) { +hist_err (file->tr,HIST_ERR_INVALID_STR_OPERAND ,errpos (str)); + ret = -EINVAL ; + goto free; + } ret =check_expr_operands (file->tr, operand1, operand2);if (ret)
Greg Kroah-Hartman
maintainerPATCH 77/135 tracing: Fix NULL pointer dereference in start_creating
In reply to Greg Kroah-HartmanFrom: Kamal Agrawal <[email protected]>
commit ff41c28c4b54052942180d8b3f49e75f1445135a upstream.
The event_trace_add_tracer() can fail. In this case, it leads to a crash in start_creating with below call stack. Handle the error scenario properly in trace_array_create_dir.
Call trace: down_write+0x7c/0x204 start_creating.25017+0x6c/0x194 tracefs_create_file+0xc4/0x2b4 init_tracer_tracefs+0x5c/0x940 trace_array_create_dir+0x58/0xb4 trace_array_create+0x1bc/0x2b8 trace_array_get_by_name+0xdc/0x18c
--- kernel/trace/trace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/trace/trace.c +3 -1
@@ -8683,8 +8683,10 @@ static int trace_array_create_dir(structreturn -EINVAL ; ret =event_trace_add_tracer (tr->dir, tr); -if (ret) +if (ret) {tracefs_remove (tr->dir); +return ret; + }init_tracer_tracefs (tr, tr->dir);__update_tracer_options (tr);
Greg Kroah-Hartman
maintainerPATCH 78/135 tracepoint: static call: Compare data on transition from 2->1 callees
In reply to Greg Kroah-HartmanFrom: Mathieu Desnoyers <[email protected]>
commit f7ec4121256393e1d03274acdca73eb18958f27e upstream.
On transition from 2->1 callees, we should be comparing .data rather than .func, because the same callback can be registered twice with different data, and what we care about here is that the data of array element 0 is unchanged to skip rcu sync.
--- kernel/tracepoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/tracepoint.c +1 -1
@@ -359,7 +359,7 @@ static int tracepoint_remove_func(struct }else {rcu_assign_pointer (tp->funcs, tp_funcs);tracepoint_update_call (tp, tp_funcs, - tp_funcs[0 ].func != old[0 ].func); + tp_funcs[0 ].data != old[0 ].data); }release_probes (old);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 79/135 tracepoint: Fix static call function vs data state mismatch
In reply to Greg Kroah-HartmanFrom: Mathieu Desnoyers <[email protected]>
commit 231264d6927f6740af36855a622d0e240be9d94c upstream.
On a 1->0->1 callbacks transition, there is an issue with the new callback using the old callback's data.
Considering __DO_TRACE_CALL:
do { \
struct tracepoint_func *it_func_ptr; \
void *__data; \
it_func_ptr = \
rcu_dereference_raw((&__tracepoint_##name)->funcs); \
if (it_func_ptr) { \
__data = (it_func_ptr)->data; \----> [ delayed here on one CPU (e.g. vcpu preempted by the host) ]
static_call(tp_func_##name)(__data, args); \
} \
} while (0)It has loaded the tp->funcs of the old callback, so it will try to use the old data. This can be fixed by adding a RCU sync anywhere in the 1->0->1 transition chain.
On a N->2->1 transition, we need an rcu-sync because you may have a sequence of 3->2->1 (or 1->2->1) where the element 0 data is unchanged between 2->1, but was changed from 3->2 (or from 1->2), which may be observed by the static call. This can be fixed by adding an unconditional RCU sync in transition 2->1.
Note, this fixes a correctness issue at the cost of adding a tremendous performance regression to the disabling of tracepoints.
Before this commit:
# trace-cmd start -e all # time trace-cmd start -p nop
real 0m0.778s
user 0m0.000s
sys 0m0.061s
After this commit:
# trace-cmd start -e all # time trace-cmd start -p nop
real 0m10.593s
user 0m0.017s
sys 0m0.259s
A follow up fix will introduce a more lightweight scheme based on RCU get_state and cond_sync, that will return the performance back to what it was. As both this change and the lightweight versions are complex on their own, for bisecting any issues that this may cause, they are kept as two separate changes.
--- kernel/tracepoint.c | 102 +++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 82 insertions(+), 20 deletions(-)
kernel/tracepoint.c +82 -20
@@ -15,6 +15,13 @@#include <linux/sched/task.h> #include <linux/static_key.h> +enum tp_func_state { +TP_FUNC_0 , +TP_FUNC_1 , +TP_FUNC_2 , +TP_FUNC_N , +}; +extern tracepoint_ptr_t __start___tracepoints_ptrs[];extern tracepoint_ptr_t __stop___tracepoints_ptrs[];
@@ -267,26 +274,29 @@ static void *func_remove(struct tracepoireturn old; } -static void tracepoint_update_call (struct tracepoint *tp,struct tracepoint_func *tp_funcs,bool sync) +/* +* Count the number of functions (enum tp_func_state) in a tp_funcs array. +*/ +static enum tp_func_state nr_func_state (const struct tracepoint_func *tp_funcs) +{ +if (!tp_funcs) +return TP_FUNC_0 ; +if (!tp_funcs[1 ].func) +return TP_FUNC_1 ; +if (!tp_funcs[2 ].func) +return TP_FUNC_2 ; +return TP_FUNC_N ;/* 3 or more */ +} + +static void tracepoint_update_call (struct tracepoint *tp,struct tracepoint_func *tp_funcs) {void *func = tp->iterator;/* Synthetic events do not have static call sites */ if (!tp->static_call_key)return ; - -if (!tp_funcs[1 ].func) { +if (nr_func_state (tp_funcs) ==TP_FUNC_1 ) func = tp_funcs[0 ].func; -/* -* If going from the iterator back to a single caller, -* we need to synchronize with __DO_TRACE to make sure -* that the data passed to the callback is the one that -* belongs to that callback. -*/ -if (sync) -tracepoint_synchronize_unregister (); - } -__static_call_update (tp->static_call_key, tp->static_call_tramp, func); }
@@ -320,9 +330,31 @@ static int tracepoint_add_func(struct tr* a pointer to it. This array is referenced by __DO_TRACE from * include/linux/tracepoint.h using rcu_dereference_sched(). */ -tracepoint_update_call (tp, tp_funcs, false); -rcu_assign_pointer (tp->funcs, tp_funcs); -static_key_enable (&tp->key); +switch (nr_func_state (tp_funcs)) { +case TP_FUNC_1 :/* 0->1 */ +/* Set static call to first function */ +tracepoint_update_call (tp, tp_funcs); +/* Both iterator and static call handle NULL tp->funcs */ +rcu_assign_pointer (tp->funcs, tp_funcs); +static_key_enable (&tp->key); +break ; +case TP_FUNC_2 :/* 1->2 */ +/* Set iterator static call */ +tracepoint_update_call (tp, tp_funcs); +/* +* Iterator callback installed before updating tp->funcs. +* Requires ordering between RCU assign/dereference and +* static call update/call. +*/ +rcu_assign_pointer (tp->funcs, tp_funcs); +break ; +case TP_FUNC_N :/* N->N+1 (N>1) */ +rcu_assign_pointer (tp->funcs, tp_funcs); +break ; +default : +WARN_ON_ONCE (1 ); +break ; + }release_probes (old);return 0 ;
@@ -349,17 +381,47 @@ static int tracepoint_remove_func(struct/* Failed allocating new tp_funcs, replaced func with stub */ return 0 ; -if (!tp_funcs) { +switch (nr_func_state (tp_funcs)) { +case TP_FUNC_0 :/* 1->0 */ /* Removed last function */ if (tp->unregfunc &&static_key_enabled (&tp->key)) tp->unregfunc ();static_key_disable (&tp->key); +/* Set iterator static call */ +tracepoint_update_call (tp, tp_funcs); +/* Both iterator and static call handle NULL tp->funcs */ +rcu_assign_pointer (tp->funcs,NULL ); +/* +* Make sure new func never uses old data after a 1->0->1 +* transition sequence. +* Considering that transition 0->1 is the common case +* and don't have rcu-sync, issue rcu-sync after +* transition 1->0 to break that sequence by waiting for +* readers to be quiescent. +*/ +tracepoint_synchronize_unregister (); +break ; +case TP_FUNC_1 :/* 2->1 */ rcu_assign_pointer (tp->funcs, tp_funcs); - }else { +/* +* On 2->1 transition, RCU sync is needed before setting +* static call to first callback, because the observer +* may have loaded any prior tp->funcs after the last one +* associated with an rcu-sync. +*/ +tracepoint_synchronize_unregister (); +/* Set static call to first function */ +tracepoint_update_call (tp, tp_funcs); +break ; +case TP_FUNC_2 :/* N->N-1 (N>2) */ + fallthrough; +case TP_FUNC_N :rcu_assign_pointer (tp->funcs, tp_funcs); -tracepoint_update_call (tp, tp_funcs, - tp_funcs[0 ].data != old[0 ].data); +break ; +default : +WARN_ON_ONCE (1 ); +break ; }release_probes (old);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 80/135 arm64: stacktrace: avoid tracing arch_stack_walk()
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit 0c32706dac1b0a72713184246952ab0f54327c21 upstream.
When the function_graph tracer is in use, arch_stack_walk() may unwind the stack incorrectly, erroneously reporting itself, missing the final entry which is being traced, and reporting all traced entries between these off-by-one from where they should be.
When ftrace hooks a function return, the original return address is saved to the fgraph ret_stack, and the return address in the LR (or the function's frame record) is replaced with return_to_handler.
When arm64's unwinder encounter frames returning to return_to_handler, it finds the associated original return address from the fgraph ret stack, assuming the most recent ret_to_hander entry on the stack corresponds to the most recent entry in the fgraph ret stack, and so on.
When arch_stack_walk() is used to dump the current task's stack, it starts from the caller of arch_stack_walk(). However, arch_stack_walk() can be traced, and so may push an entry on to the fgraph ret stack, leaving the fgraph ret stack offset by one from the expected position.
This can be seen when dumping the stack via /proc/self/stack, where enabling the graph tracer results in an unexpected stack_trace_save_tsk entry at the start of the trace, and el0_svc missing form the end of the trace.
This patch fixes this by marking arch_stack_walk() as notrace, as we do for all other functions on the path to ftrace_graph_get_ret_stack(). While a few helper functions are not marked notrace, their calls/returns are balanced, and will have no observable effect when examining the fgraph ret stack.
It is possible for an exeption boundary to cause a similar offset if the return address of the interrupted context was in the LR. Fixing those cases will require some more substantial rework, and is left for subsequent patches.
Before:
| # cat /proc/self/stack | [<0>] proc_pid_stack+0xc4/0x140 | [<0>] proc_single_show+0x6c/0x120 | [<0>] seq_read_iter+0x240/0x4e0 | [<0>] seq_read+0xe8/0x140 | [<0>] vfs_read+0xb8/0x1e4 | [<0>] ksys_read+0x74/0x100 | [<0>] __arm64_sys_read+0x28/0x3c | [<0>] invoke_syscall+0x50/0x120 | [<0>] el0_svc_common.constprop.0+0xc4/0xd4 | [<0>] do_el0_svc+0x30/0x9c | [<0>] el0_svc+0x2c/0x54 | [<0>] el0t_64_sync_handler+0x1a8/0x1b0 | [<0>] el0t_64_sync+0x198/0x19c | # echo function_graph > /sys/kernel/tracing/current_tracer | # cat /proc/self/stack | [<0>] stack_trace_save_tsk+0xa4/0x110 | [<0>] proc_pid_stack+0xc4/0x140 | [<0>] proc_single_show+0x6c/0x120 | [<0>] seq_read_iter+0x240/0x4e0 | [<0>] seq_read+0xe8/0x140 | [<0>] vfs_read+0xb8/0x1e4 | [<0>] ksys_read+0x74/0x100 | [<0>] __arm64_sys_read+0x28/0x3c | [<0>] invoke_syscall+0x50/0x120 | [<0>] el0_svc_common.constprop.0+0xc4/0xd4 | [<0>] do_el0_svc+0x30/0x9c | [<0>] el0t_64_sync_handler+0x1a8/0x1b0 | [<0>] el0t_64_sync+0x198/0x19c
After:
| # cat /proc/self/stack | [<0>] proc_pid_stack+0xc4/0x140 | [<0>] proc_single_show+0x6c/0x120 | [<0>] seq_read_iter+0x240/0x4e0 | [<0>] seq_read+0xe8/0x140 | [<0>] vfs_read+0xb8/0x1e4 | [<0>] ksys_read+0x74/0x100 | [<0>] __arm64_sys_read+0x28/0x3c | [<0>] invoke_syscall+0x50/0x120 | [<0>] el0_svc_common.constprop.0+0xc4/0xd4 | [<0>] do_el0_svc+0x30/0x9c | [<0>] el0_svc+0x2c/0x54 | [<0>] el0t_64_sync_handler+0x1a8/0x1b0 | [<0>] el0t_64_sync+0x198/0x19c | # echo function_graph > /sys/kernel/tracing/current_tracer | # cat /proc/self/stack | [<0>] proc_pid_stack+0xc4/0x140 | [<0>] proc_single_show+0x6c/0x120 | [<0>] seq_read_iter+0x240/0x4e0 | [<0>] seq_read+0xe8/0x140 | [<0>] vfs_read+0xb8/0x1e4 | [<0>] ksys_read+0x74/0x100 | [<0>] __arm64_sys_read+0x28/0x3c | [<0>] invoke_syscall+0x50/0x120 | [<0>] el0_svc_common.constprop.0+0xc4/0xd4 | [<0>] do_el0_svc+0x30/0x9c | [<0>] el0_svc+0x2c/0x54 | [<0>] el0t_64_sync_handler+0x1a8/0x1b0 | [<0>] el0t_64_sync+0x198/0x19c
--- arch/arm64/kernel/stacktrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/stacktrace.c +1 -1
@@ -199,7 +199,7 @@ void show_stack(struct task_struct *tsk,#ifdef CONFIG_STACKTRACE -noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, +noinline notrace void arch_stack_walk(stack_trace_consume_fn consume_entry,void *cookie,struct task_struct *task,struct pt_regs *regs) {
Greg Kroah-Hartman
maintainerPATCH 81/135 optee: Clear stale cache entries during initialization
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
commit b5c10dd04b7418793517e3286cde5c04759a86de upstream.
The shm cache could contain invalid addresses if optee_disable_shm_cache() was not called from the .shutdown hook of the previous kernel before a kexec. These addresses could be unmapped or they could point to mapped but unintended locations in memory.
Clear the shared memory cache, while being careful to not translate the addresses returned from OPTEE_SMC_DISABLE_SHM_CACHE, during driver initialization. Once all pre-cache shm objects are removed, proceed with enabling the cache so that we know that we can handle cached shm objects with confidence later in the .shutdown hook.
--- drivers/tee/optee/call.c | 36 +++++++++++++++++++++++++++++++++--- drivers/tee/optee/core.c | 9 +++++++++ drivers/tee/optee/optee_private.h | 1 + 3 files changed, 43 insertions(+), 3 deletions(-)
drivers/tee/optee/call.c +33 -3
@@ -413,11 +413,13 @@ void optee_enable_shm_cache(struct optee }/** -* optee_disable_shm_cache() - Disables caching of some shared memory allocation -* in OP-TEE +* __optee_disable_shm_cache() - Disables caching of some shared memory +* allocation in OP-TEE * @optee: main service struct +* @is_mapped: true if the cached shared memory addresses were mapped by this +* kernel, are safe to dereference, and should be freed */ -void optee_disable_shm_cache (struct optee *optee) +static void __optee_disable_shm_cache (struct optee *optee,bool is_mapped) {struct optee_call_waiter w;
@@ -436,6 +438,13 @@ void optee_disable_shm_cache(struct opteif (res.result.status ==OPTEE_SMC_RETURN_OK ) {struct tee_shm *shm; +/* +* Shared memory references that were not mapped by +* this kernel must be ignored to prevent a crash. +*/ +if (!is_mapped) +continue ; + shm =reg_pair_to_ptr (res.result.shm_upper32, res.result.shm_lower32);tee_shm_free (shm);
@@ -446,6 +455,27 @@ void optee_disable_shm_cache(struct opteoptee_cq_wait_final (&optee->call_queue, &w); } +/** +* optee_disable_shm_cache() - Disables caching of mapped shared memory +* allocations in OP-TEE +* @optee: main service struct +*/ +void optee_disable_shm_cache (struct optee *optee) +{ +return __optee_disable_shm_cache (optee, true); +} + +/** +* optee_disable_unmapped_shm_cache() - Disables caching of shared memory +* allocations in OP-TEE which are not +* currently mapped +* @optee: main service struct +*/ +void optee_disable_unmapped_shm_cache (struct optee *optee) +{ +return __optee_disable_shm_cache (optee, false); +} +#define PAGELIST_ENTRIES_PER_PAGE \ ((OPTEE_MSG_NONCONTIG_PAGE_SIZE / sizeof(u64)) - 1)
drivers/tee/optee/core.c +9 -0
@@ -686,6 +686,15 @@ static int optee_probe(struct platform_d optee->memremaped_shm = memremaped_shm; optee->pool = pool; +/* +* Ensure that there are no pre-existing shm objects before enabling +* the shm cache so that there's no chance of receiving an invalid +* address during shutdown. This could occur, for example, if we're +* kexec booting from an older kernel that did not properly cleanup the +* shm cache. +*/ +optee_disable_unmapped_shm_cache (optee); +optee_enable_shm_cache (optee);if (optee->sec_caps &OPTEE_SMC_SEC_CAP_DYNAMIC_SHM )
drivers/tee/optee/optee_private.h +1 -0
@@ -159,6 +159,7 @@ int optee_cancel_req(struct tee_contextvoid optee_enable_shm_cache (struct optee *optee);void optee_disable_shm_cache (struct optee *optee); +void optee_disable_unmapped_shm_cache (struct optee *optee); int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm, struct page **pages, size_t num_pages,
Greg Kroah-Hartman
maintainerPATCH 82/135 tee: add tee_shm_alloc_kernel_buf()
In reply to Greg Kroah-HartmanFrom: Jens Wiklander <[email protected]>
commit dc7019b7d0e188d4093b34bd0747ed0d668c63bf upstream.
Adds a new function tee_shm_alloc_kernel_buf() to allocate shared memory from a kernel driver. This function can later be made more lightweight by unnecessary dma-buf export.
--- drivers/tee/tee_shm.c | 18 ++++++++++++++++++ include/linux/tee_drv.h | 1 + 2 files changed, 19 insertions(+)
drivers/tee/tee_shm.c +18 -0
@@ -193,6 +193,24 @@ err_dev_put: }EXPORT_SYMBOL_GPL (tee_shm_alloc); +/** +* tee_shm_alloc_kernel_buf() - Allocate shared memory for kernel buffer +* @ctx: Context that allocates the shared memory +* @size: Requested size of shared memory +* +* The returned memory registered in secure world and is suitable to be +* passed as a memory buffer in parameter argument to +* tee_client_invoke_func(). The memory allocated is later freed with a +* call to tee_shm_free(). +* +* @returns a pointer to 'struct tee_shm' +*/ +struct tee_shm *tee_shm_alloc_kernel_buf (struct tee_context *ctx,size_t size) +{ +return tee_shm_alloc (ctx, size,TEE_SHM_MAPPED |TEE_SHM_DMA_BUF ); +} +EXPORT_SYMBOL_GPL (tee_shm_alloc_kernel_buf); +struct tee_shm *tee_shm_register (struct tee_context *ctx,unsigned long addr,size_t length,u32 flags) {
include/linux/tee_drv.h +1 -0
@@ -332,6 +332,7 @@ void *tee_get_drvdata(struct tee_device* @returns a pointer to 'struct tee_shm' */ struct tee_shm *tee_shm_alloc (struct tee_context *ctx,size_t size,u32 flags); +struct tee_shm *tee_shm_alloc_kernel_buf (struct tee_context *ctx,size_t size);/** * tee_shm_register() - Register shared memory buffer
Greg Kroah-Hartman
maintainerPATCH 83/135 optee: Fix memory leak when failing to register shm pages
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
commit ec185dd3ab257dc2a60953fdf1b6622f524cc5b7 upstream.
Free the previously allocated pages when we encounter an error condition while attempting to register the pages with the secure world.
--- drivers/tee/optee/shm_pool.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/tee/optee/shm_pool.c +10 -2
@@ -32,8 +32,10 @@ static int pool_op_alloc(struct tee_shm_struct page **pages; pages =kcalloc (nr_pages,sizeof (pages),GFP_KERNEL ); -if (!pages) -return -ENOMEM ; +if (!pages) { + rc = -ENOMEM ; + goto err; + }for (i =0 ; i < nr_pages; i++) { pages[i] = page;
@@ -44,8 +46,14 @@ static int pool_op_alloc(struct tee_shm_ rc =optee_shm_register (shm->ctx, shm, pages, nr_pages, (unsigned long )shm->kaddr);kfree (pages); +if (rc) + goto err; } +return 0 ; + +err: +__free_pages (page, order);return rc; }
Greg Kroah-Hartman
maintainerPATCH 84/135 optee: Refuse to load the driver under the kdump kernel
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
commit adf752af454e91e123e85e3784972d166837af73 upstream.
Fix a hung task issue, seen when booting the kdump kernel, that is caused by all of the secure world threads being in a permanent suspended state:
INFO: task swapper/0:1 blocked for more than 120 seconds.
Not tainted 5.4.83 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
swapper/0 D 0 1 0 0x00000028
Call trace:
__switch_to+0xc8/0x118
__schedule+0x2e0/0x700
schedule+0x38/0xb8
schedule_timeout+0x258/0x388
wait_for_completion+0x16c/0x4b8
optee_cq_wait_for_completion+0x28/0xa8
optee_disable_shm_cache+0xb8/0xf8
optee_probe+0x560/0x61c
platform_drv_probe+0x58/0xa8
really_probe+0xe0/0x338
driver_probe_device+0x5c/0xf0
device_driver_attach+0x74/0x80
__driver_attach+0x64/0xe0
bus_for_each_dev+0x84/0xd8
driver_attach+0x30/0x40
bus_add_driver+0x188/0x1e8
driver_register+0x64/0x110
__platform_driver_register+0x54/0x60
optee_driver_init+0x20/0x28
do_one_initcall+0x54/0x24c
kernel_init_freeable+0x1e8/0x2c0
kernel_init+0x18/0x118
ret_from_fork+0x10/0x18The invoke_fn hook returned OPTEE_SMC_RETURN_ETHREAD_LIMIT, indicating that the secure world threads were all in a suspended state at the time of the kernel crash. This intermittently prevented the kdump kernel from booting, resulting in a failure to collect the kernel dump.
Make kernel dump collection more reliable on systems utilizing OP-TEE by refusing to load the driver under the kdump kernel.
--- drivers/tee/optee/core.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/tee/optee/core.c +11 -0
@@ -6,6 +6,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt#include <linux/arm-smccc.h> +#include <linux/crash_dump.h> #include <linux/errno.h> #include <linux/io.h> #include <linux/module.h>
@@ -612,6 +613,16 @@ static int optee_probe(struct platform_du32 sec_caps;int rc; +/* +* The kernel may have crashed at the same time that all available +* secure world threads were suspended and we cannot reschedule the +* suspended threads without access to the crashed kernel's wait_queue. +* Therefore, we cannot reliably initialize the OP-TEE driver in the +* kdump kernel. +*/ +if (is_kdump_kernel ()) +return -ENODEV ; + invoke_fn =get_invoke_func (&pdev->dev);if (IS_ERR (invoke_fn))return PTR_ERR (invoke_fn);
Greg Kroah-Hartman
maintainerPATCH 85/135 optee: fix tee out of memory failure seen during kexec reboot
In reply to Greg Kroah-HartmanFrom: Allen Pais <[email protected]>
commit f25889f93184db8b07a543cc2bbbb9a8fcaf4333 upstream.
The following out of memory errors are seen on kexec reboot from the optee core.
[ 0.368428] tee_bnxt_fw optee-clnt0: tee_shm_alloc failed [ 0.368461] tee_bnxt_fw: probe of optee-clnt0 failed with error -22
tee_shm_release() is not invoked on dma shm buffer.
Implement .shutdown() method to handle the release of the buffers correctly.
More info:
https://github.com/OP-TEE/optee_os/issues/3637
--- drivers/tee/optee/core.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/tee/optee/core.c +20 -0
@@ -573,6 +573,13 @@ static optee_invoke_fn *get_invoke_func(return ERR_PTR (-EINVAL ); } +/* optee_remove - Device Removal Routine +* @pdev: platform device information struct +* +* optee_remove is called by platform subsystem to alert the driver +* that it should release the device +*/ +static int optee_remove (struct platform_device *pdev) {struct optee *optee =platform_get_drvdata (pdev);
@@ -603,6 +610,18 @@ static int optee_remove(struct platform_return 0 ; } +/* optee_shutdown - Device Removal Routine +* @pdev: platform device information struct +* +* platform_shutdown is called by the platform subsystem to alert +* the driver that a shutdown, reboot, or kexec is happening and +* device must be disabled. +*/ +static void optee_shutdown (struct platform_device *pdev) +{ +optee_disable_shm_cache (platform_get_drvdata (pdev)); +} +static int optee_probe (struct platform_device *pdev) {optee_invoke_fn *invoke_fn;
@@ -748,6 +767,7 @@ MODULE_DEVICE_TABLE(of, optee_dt_match);static struct platform_driver optee_driver = { .probe = optee_probe, .remove = optee_remove, + .shutdown = optee_shutdown, .driver = { .name ="optee" , .of_match_table = optee_dt_match,
Greg Kroah-Hartman
maintainerPATCH 86/135 tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
commit dfb703ad2a8d366b829818a558337be779746575 upstream.
dma-buf backed shared memory cannot be reliably freed and unregistered during a kexec operation even when tee_shm_free() is called on the shm from a .shutdown hook. The problem occurs because dma_buf_put() calls fput() which then uses task_work_add(), with the TWA_RESUME parameter, to queue tee_shm_release() to be called before the current task returns to user mode. However, the current task never returns to user mode before the kexec completes so the memory is never freed nor unregistered.
Use tee_shm_alloc_kernel_buf() to avoid dma-buf backed shared memory allocation so that tee_shm_free() can directly call tee_shm_release(). This will ensure that the shm can be freed and unregistered during a kexec operation.
--- drivers/char/tpm/tpm_ftpm_tee.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm_ftpm_tee.c +4 -4
@@ -254,11 +254,11 @@ static int ftpm_tee_probe(struct device pvt_data->session = sess_arg.session;/* Allocate dynamic shared memory with fTPM TA */ - pvt_data->shm =tee_shm_alloc (pvt_data->ctx, -MAX_COMMAND_SIZE +MAX_RESPONSE_SIZE , -TEE_SHM_MAPPED |TEE_SHM_DMA_BUF ); + pvt_data->shm =tee_shm_alloc_kernel_buf (pvt_data->ctx, +MAX_COMMAND_SIZE + +MAX_RESPONSE_SIZE );if (IS_ERR (pvt_data->shm)) { -dev_err (dev,"%s: tee_shm_alloc failed\n" , __func__); +dev_err (dev,"%s: tee_shm_alloc_kernel_buf failed\n" , __func__); rc = -ENOMEM ; goto out_shm_alloc; }
Greg Kroah-Hartman
maintainerPATCH 87/135 staging: rtl8723bs: Fix a resource leak in sd_int_dpc
In reply to Greg Kroah-HartmanFrom: Xiangyang Zhang <[email protected]>
commit 990e4ad3ddcb72216caeddd6e62c5f45a21e8121 upstream.
The "c2h_evt" variable is not freed when function call "c2h_evt_read_88xx" failed
--- drivers/staging/rtl8723bs/hal/sdio_ops.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/rtl8723bs/hal/sdio_ops.c +2 -0
@@ -989,6 +989,8 @@ void sd_int_dpc(struct adapter *adapter) }else {rtw_c2h_wk_cmd (adapter, (u8 *)c2h_evt); } + }else { +kfree (c2h_evt); } }else {/* Error handling for malloc fail */
Greg Kroah-Hartman
maintainerPATCH 88/135 staging: rtl8712: get rid of flush_scheduled_work
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit 9be550ee43919b070bcd77f9228bdbbbc073245b upstream.
This patch is preparation for following patch for error handling refactoring.
flush_scheduled_work() takes (wq_completion)events lock and
it can lead to deadlock when r871xu_dev_remove() is called from workqueue. To avoid deadlock sutiation we can change flush_scheduled_work() call to flush_work() call for all possibly scheduled works in this driver, since next patch adds device_release_driver() in case of fw load failure.
--- drivers/staging/rtl8712/rtl8712_led.c | 8 ++++++++ drivers/staging/rtl8712/rtl871x_led.h | 1 + drivers/staging/rtl8712/rtl871x_pwrctrl.c | 8 ++++++++ drivers/staging/rtl8712/rtl871x_pwrctrl.h | 1 + drivers/staging/rtl8712/usb_intf.c | 3 ++- 5 files changed, 20 insertions(+), 1 deletion(-)
drivers/staging/rtl8712/rtl8712_led.c +8 -0
@@ -1820,3 +1820,11 @@ void LedControl871x(struct _adapter *padbreak ; } } + +void r8712_flush_led_works (struct _adapter *padapter) +{ +struct led_priv *pledpriv = &padapter->ledpriv; + +flush_work (&pledpriv->SwLed0.BlinkWorkItem); +flush_work (&pledpriv->SwLed1.BlinkWorkItem); +}
drivers/staging/rtl8712/rtl871x_led.h +1 -0
@@ -112,6 +112,7 @@ struct led_priv {void r8712_InitSwLeds (struct _adapter *padapter);void r8712_DeInitSwLeds (struct _adapter *padapter);void LedControl871x (struct _adapter *padapter,enum LED_CTL_MODE LedAction); +void r8712_flush_led_works (struct _adapter *padapter);#endif
drivers/staging/rtl8712/rtl871x_pwrctrl.c +8 -0
@@ -224,3 +224,11 @@ void r8712_unregister_cmd_alive(struct _ }mutex_unlock (&pwrctrl->mutex_lock); } + +void r8712_flush_rwctrl_works (struct _adapter *padapter) +{ +struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv; + +flush_work (&pwrctrl->SetPSModeWorkItem); +flush_work (&pwrctrl->rpwm_workitem); +}
drivers/staging/rtl8712/rtl871x_pwrctrl.h +1 -0
@@ -111,5 +111,6 @@ void r8712_cpwm_int_hdl(struct _adaptervoid r8712_set_ps_mode (struct _adapter *padapter,uint ps_mode,uint smart_ps);void r8712_set_rpwm (struct _adapter *padapter,u8 val8); +void r8712_flush_rwctrl_works (struct _adapter *padapter);#endif /* __RTL871X_PWRCTRL_H_ */
drivers/staging/rtl8712/usb_intf.c +2 -1
@@ -609,7 +609,8 @@ static void r871xu_dev_remove(struct usb padapter->surprise_removed = true;if (pnetdev->reg_state !=NETREG_UNINITIALIZED )unregister_netdev (pnetdev);/* will call netdev_close() */ -flush_scheduled_work (); +r8712_flush_rwctrl_works (padapter); +r8712_flush_led_works (padapter);udelay (1 );/* Stop driver mlme relation timer */ r8712_stop_drv_timers (padapter);
Greg Kroah-Hartman
maintainerPATCH 89/135 staging: rtl8712: error handling refactoring
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit e9e6aa51b2735d83a67d9fa0119cf11abef80d99 upstream.
There was strange error handling logic in case of fw load failure. For some reason fw loader callback was doing clean up stuff when fw is not available. I don't see any reason behind doing this. Since this driver doesn't have EEPROM firmware let's just disconnect it in case of fw load failure. Doing clean up stuff in 2 different place which can run concurently is not good idea and syzbot found 2 bugs related to this strange approach.
So, in this pacth I deleted all clean up code from fw callback and made a call to device_release_driver() under device_lock(parent) in case of fw load failure. This approach is more generic and it defend driver from UAF bugs, since all clean up code is moved to one place.
--- drivers/staging/rtl8712/hal_init.c | 30 +++++++++++++++-------- drivers/staging/rtl8712/usb_intf.c | 48 ++++++++++++++++--------------------- 2 files changed, 41 insertions(+), 37 deletions(-)
drivers/staging/rtl8712/hal_init.c +20 -10
@@ -29,21 +29,31 @@#define FWBUFF_ALIGN_SZ 512#define MAX_DUMP_FWSZ (48 * 1024) +static void rtl871x_load_fw_fail (struct _adapter *adapter) +{ +struct usb_device *udev = adapter->dvobjpriv.pusbdev; +struct device *dev = &udev->dev; +struct device *parent = dev->parent; + +complete (&adapter->rtl8712_fw_ready); + +dev_err (&udev->dev,"r8712u: Firmware request failed\n" ); + +if (parent) +device_lock (parent); + +device_release_driver (dev); + +if (parent) +device_unlock (parent); +} +static void rtl871x_load_fw_cb (const struct firmware *firmware,void *context) {struct _adapter *adapter = context;if (!firmware) { -struct usb_device *udev = adapter->dvobjpriv.pusbdev; -struct usb_interface *usb_intf = adapter->pusb_intf; - -dev_err (&udev->dev,"r8712u: Firmware request failed\n" ); -usb_put_dev (udev); -usb_set_intfdata (usb_intf,NULL ); -r8712_free_drv_sw (adapter); - adapter->dvobj_deinit (adapter); -complete (&adapter->rtl8712_fw_ready); -free_netdev (adapter->pnetdev); +rtl871x_load_fw_fail (adapter);return ; } adapter->fw = firmware;
drivers/staging/rtl8712/usb_intf.c +21 -27
57 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 90/135 drivers core: Fix oops when driver probe fails
In reply to Greg Kroah-HartmanFrom: Filip Schauer <[email protected]>
commit 4d1014c1816c0395eca5d1d480f196a4c63119d0 upstream.
dma_range_map is freed to early, which might cause an oops when a driver probe fails.
Call trace: is_free_buddy_page+0xe4/0x1d4 __free_pages+0x2c/0x88 dma_free_contiguous+0x64/0x80 dma_direct_free+0x38/0xb4 dma_free_attrs+0x88/0xa0 dmam_release+0x28/0x34 release_nodes+0x78/0x8c devres_release_all+0xa8/0x110 really_probe+0x118/0x2d0 __driver_probe_device+0xc8/0xe0 driver_probe_device+0x54/0xec __driver_attach+0xe0/0xf0 bus_for_each_dev+0x7c/0xc8 driver_attach+0x30/0x3c bus_add_driver+0x17c/0x1c4 driver_register+0xc0/0xf8 __platform_driver_register+0x34/0x40 ...
This issue is introduced by commit d0243bbd5dd3 ("drivers core:
Free dma_range_map when driver probe failed"). It frees dma_range_map before the call to devres_release_all, which is too early. The solution is to free dma_range_map only after devres_release_all.
--- drivers/base/dd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/base/dd.c +2 -2
@@ -617,8 +617,6 @@ dev_groups_failed:else if (drv->remove) drv->remove (dev); probe_failed: -kfree (dev->dma_range_map); - dev->dma_range_map =NULL ;if (dev->bus)blocking_notifier_call_chain (&dev->bus->p->bus_notifier,BUS_NOTIFY_DRIVER_NOT_BOUND , dev);
@@ -626,6 +624,8 @@ pinctrl_bind_failed:device_links_no_driver (dev);devres_release_all (dev);arch_teardown_dma_ops (dev); +kfree (dev->dma_range_map); + dev->dma_range_map =NULL ;driver_sysfs_remove (dev); dev->driver =NULL ;dev_set_drvdata (dev,NULL );
Greg Kroah-Hartman
maintainerPATCH 91/135 media: rtl28xxu: fix zero-length control request
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 76f22c93b209c811bd489950f17f8839adb31901 upstream.
The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation.
Control transfers without a data stage are treated as OUT requests by the USB stack and should be using usb_sndctrlpipe(). Failing to do so will now trigger a warning.
The driver uses a zero-length i2c-read request for type detection so update the control-request code to use usb_sndctrlpipe() in this case.
Note that actually trying to read the i2c register in question does not work as the register might not exist (e.g. depending on the demodulator) as reported by Eero Lehtinen <[email protected]>.
--- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +10 -1
@@ -37,7 +37,16 @@ static int rtl28xxu_ctrl_msg(struct dvb_ }else {/* read */ requesttype = (USB_TYPE_VENDOR |USB_DIR_IN ); - pipe =usb_rcvctrlpipe (d->udev,0 ); + +/* +* Zero-length transfers must use usb_sndctrlpipe() and +* rtl28xxu_identify_state() uses a zero-length i2c read +* command to determine the chip type. +*/ +if (req->size) + pipe =usb_rcvctrlpipe (d->udev,0 ); +else + pipe =usb_sndctrlpipe (d->udev,0 ); } ret = usb_control_msg(d->udev, pipe, 0, requesttype, req->value,
Greg Kroah-Hartman
maintainerPATCH 92/135 pipe: increase minimum default pipe size to 2 pages
In reply to Greg Kroah-HartmanFrom: Alex Xu (Hello71) <[email protected]>
commit 46c4c9d1beb7f5b4cec4dd90e7728720583ee348 upstream.
This program always prints 4096 and hangs before the patch, and always prints 8192 and exits successfully after:
int main()
{
int pipefd[2];
for (int i = 0; i < 1025; i++)
if (pipe(pipefd) == -1)
return 1;
size_t bufsz = fcntl(pipefd[1], F_GETPIPE_SZ);
printf("%zd\n", bufsz);
char *buf = calloc(bufsz, 1);
write(pipefd[1], buf, bufsz);
read(pipefd[0], buf, bufsz-1);
write(pipefd[1], buf, 1);
}Note that you may need to increase your RLIMIT_NOFILE before running the program.
--- fs/pipe.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
fs/pipe.c +17 -2
@@ -32,6 +32,21 @@#include "internal.h" /* +* New pipe buffers will be restricted to this size while the user is exceeding +* their pipe buffer quota. The general pipe use case needs at least two +* buffers: one for data yet to be read, and one for new data. If this is less +* than two, then a write to a non-empty pipe may block even if the pipe is not +* full. This can occur with GNU make jobserver or similar uses of pipes as +* semaphores: multiple processes may be waiting to write tokens back to the +* pipe before reading tokens: https://lore.kernel.org/lkml/1628086770.5rn8p04n6j.none@localhost/. +* +* Users can reduce their pipe buffers with F_SETPIPE_SZ below this at their +* own risk, namely: pipe writes to non-full pipes may block until the pipe is +* emptied. +*/ +#define PIPE_MIN_DEF_BUFFERS 2 + +/* * The max size that a non-root user is allowed to grow the pipe. Can * be set by root in /proc/sys/fs/pipe-max-size */
@@ -781,8 +796,8 @@ struct pipe_inode_info *alloc_pipe_info( user_bufs =account_pipe_buffers (user,0 , pipe_bufs);if (too_many_pipe_buffers_soft (user_bufs) &&pipe_is_unprivileged_user ()) { - user_bufs =account_pipe_buffers (user, pipe_bufs,1 ); - pipe_bufs =1 ; + user_bufs =account_pipe_buffers (user, pipe_bufs,PIPE_MIN_DEF_BUFFERS ); + pipe_bufs =PIPE_MIN_DEF_BUFFERS ; }if (too_many_pipe_buffers_hard (user_bufs) &&pipe_is_unprivileged_user ())
Greg Kroah-Hartman
maintainerPATCH 93/135 ext4: fix potential htree corruption when growing large_dir directories
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit 877ba3f729fd3d8ef0e29bc2a55e57cfa54b2e43 upstream.
Commit b5776e7524af ("ext4: fix potential htree index checksum corruption) removed a required restart when multiple levels of index nodes need to be split. Fix this to avoid directory htree corruptions when using the large_dir feature.
--- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/namei.c +1 -1
@@ -2412,7 +2412,7 @@ again: goto journal_error; err =ext4_handle_dirty_dx_node (handle, dir, frame->bh); -if (err) +if (restart || err) goto journal_error; }else {struct dx_root *dxroot;
Greg Kroah-Hartman
maintainerPATCH 94/135 serial: tegra: Only print FIFO error message when an error occurs
In reply to Greg Kroah-HartmanFrom: Jon Hunter <[email protected]>
commit cc9ca4d95846cbbece48d9cd385550f8fba6a3c1 upstream.
The Tegra serial driver always prints an error message when enabling the FIFO for devices that have support for checking the FIFO enable status. Fix this by displaying the error message, only when an error occurs.
Finally, update the error message to make it clear that enabling the FIFO failed and display the error code.
--- drivers/tty/serial/serial-tegra.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/tty/serial/serial-tegra.c +4 -2
@@ -1040,9 +1040,11 @@ static int tegra_uart_hw_init(struct tegif (tup->cdata->fifo_mode_enable_status) { ret =tegra_uart_wait_fifo_mode_enabled (tup); -dev_err (tup->uport.dev,"FIFO mode not enabled\n" ); -if (ret <0 ) +if (ret <0 ) { +dev_err (tup->uport.dev, +"Failed to enable FIFO mode: %d\n" , ret);return ret; + } }else {/* * For all tegra devices (up to t210), there is a hardware
Greg Kroah-Hartman
maintainerPATCH 95/135 serial: 8250_mtk: fix uart corruption issue when rx power off
In reply to Greg Kroah-HartmanFrom: Zhiyong Tao <[email protected]>
commit 7c4a509d3815a260c423c0633bd73695250ac26d upstream.
Fix uart corruption issue when rx power off.
Add spin lock in mtk8250_dma_rx_complete function in APDMA mode.
when uart is used as a communication port with external device(GPS). when external device(GPS) power off, the power of rx pin is also from 1.8v to 0v. Even if there is not any data in rx. But uart rx pin can capture the data "0".
If uart don't receive any data in specified cycle, uart will generates BI(Break interrupt) interrupt.
If external device(GPS) power off, we found that BI interrupt appeared continuously and very frequently.
When uart interrupt type is BI, uart IRQ handler(8250 framwork API:serial8250_handle_irq) will push data to tty buffer. mtk8250_dma_rx_complete is a task of mtk_uart_apdma_rx_handler. mtk8250_dma_rx_complete priority is lower than uart irq handler(serial8250_handle_irq).
if we are in process of mtk8250_dma_rx_complete, uart appear BI interrupt:1)serial8250_handle_irq will priority execution.2)it may cause write tty buffer conflict in mtk8250_dma_rx_complete.
So the spin lock protect the rx receive data process is not break.
--- drivers/tty/serial/8250/8250_mtk.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/tty/serial/8250/8250_mtk.c +5 -0
@@ -93,10 +93,13 @@ static void mtk8250_dma_rx_complete(voidstruct dma_tx_state state;int copied, total, cnt;unsigned char *ptr; +unsigned long flags;if (data->rx_status ==DMA_RX_SHUTDOWN )return ; +spin_lock_irqsave (&up->port.lock, flags); +dmaengine_tx_status (dma->rxchan, dma->rx_cookie, &state); total = dma->rx_size - state.residue; cnt = total;
@@ -120,6 +123,8 @@ static void mtk8250_dma_rx_complete(voidtty_flip_buffer_push (tty_port);mtk8250_rx_dma (up); + +spin_unlock_irqrestore (&up->port.lock, flags); }static void mtk8250_rx_dma (struct uart_8250_port *up)
Greg Kroah-Hartman
maintainerPATCH 96/135 serial: 8250: Mask out floating 16/32-bit bus bits
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit e5227c51090e165db4b48dcaa300605bfced7014 upstream.
Make sure only actual 8 bits of the IIR register are used in determining the port type in `autoconfig'.
The serial_in' port accessor returns the unsigned int' type, meaning that with UPIO_AU, UPIO_MEM16, UPIO_MEM32, and UPIO_MEM32BE access types more than 8 bits of data are returned, of which the high order bits will often come from bus lines that are left floating in the data phase. For example with the MIPS Malta board's CBUS UART, where the registers are aligned on 8-byte boundaries and which uses 32-bit accesses, data as follows is returned:
YAMON> dump -32 0xbf000900 0x40
BF000900: 1F000942 1F000942 1F000900 1F000900 ...B...B........
BF000910: 1F000901 1F000901 1F000900 1F000900 ................
BF000920: 1F000900 1F000900 1F000960 1F000960 ..............
BF000930: 1F000900 1F000900 1F0009FF 1F0009FF ................
YAMON>
Evidently high-order 24 bits return values previously driven in the address phase (the 3 highest order address bits used with the command above are masked out in the simple virtual address mapping used here and come out at zeros on the external bus), a common scenario with bus lines left floating, due to bus capacitance.
Consequently when the value of IIR, mapped at 0x1f000910, is retrieved in autoconfig', it comes out at 0x1f0009c1 and when it is right-shifted by 6 and then assigned to 8-bit scratch' variable, the value calculated is 0x27, not one of 0, 1, 2, 3 expected in port type determination.
Fix the issue then, by assigning the value returned from serial_in' to scratch' first, which masks out 24 high-order bits retrieved, and only then right-shift the resulting 8-bit data quantity, producing the value of 3 in this case, as expected. Fix the same issue in `serial_dl_read'.
The problem first appeared with Linux 2.6.9-rc3 which predates our repo history, but the origin could be identified with the old MIPS/Linux repo also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit e0d2356c0777 ("Merge with Linux 2.6.9-rc3."), where code in `serial_in' was updated with this case:
+ case UPIO_MEM32:
+ return readl(up->port.membase + offset);
+
which made it produce results outside the unsigned 8-bit range for the first time, though obviously it is system dependent what actual values appear in the high order bits retrieved and it may well have been zeros in the relevant positions with the system the change originally was intended for. It is at that point that code in `autoconf' should have been updated accordingly, but clearly it was overlooked.
--- drivers/tty/serial/8250/8250_port.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/tty/serial/8250/8250_port.c +9 -3
@@ -311,7 +311,11 @@ static const struct serial8250_config ua/* Uart divisor latch read */ static int default_serial_dl_read (struct uart_8250_port *up) { -return serial_in (up,UART_DLL ) |serial_in (up,UART_DLM ) <<8 ; +/* Assign these in pieces to truncate any bits above 7. */ +unsigned char dll =serial_in (up,UART_DLL ); +unsigned char dlm =serial_in (up,UART_DLM ); + +return dll | dlm <<8 ; }/* Uart divisor latch write */
@@ -1297,9 +1301,11 @@ static void autoconfig(struct uart_8250_serial_out (up,UART_LCR ,0 );serial_out (up,UART_FCR ,UART_FCR_ENABLE_FIFO ); - scratch =serial_in (up,UART_IIR ) >>6 ; -switch (scratch) { +/* Assign this as it is to truncate any bits above 7. */ + scratch =serial_in (up,UART_IIR ); + +switch (scratch >>6 ) {case 0 :autoconfig_8250 (up);break ;
Greg Kroah-Hartman
maintainerPATCH 97/135 MIPS: Malta: Do not byte-swap accesses to the CBUS UART
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 9a936d6c3d3d6c33ecbadf72dccdb567b5cd3c72 upstream.
Correct big-endian accesses to the CBUS UART, a Malta on-board discrete TI16C550C part wired directly to the system controller's device bus, and do not use byte swapping with the 32-bit accesses to the device.
The CBUS is used for devices such as the boot flash memory needed early on in system bootstrap even before PCI has been initialised. Therefore it uses the system controller's device bus, which follows the endianness set with the CPU, which means no byte-swapping is ever required for data accesses to CBUS, unlike with PCI.
The CBUS UART uses the UPIO_MEM32 access method, that is the readl' and writel' MMIO accessors, which on the MIPS platform imply byte-swapping with PCI systems. Consequently the wrong byte lane is accessed with the big-endian configuration and the UART is not correctly accessed.
As it happens the UPIO_MEM32BE access method makes use of the ioread32' and iowrite32' MMIO accessors, which still use readl' and writel' respectively, however they byte-swap data passed, effectively cancelling swapping done with the accessors themselves and making it suitable for the CBUS UART.
Make the CBUS UART switch between UPIO_MEM32 and UPIO_MEM32BE then, based on the endianness selected. With this change in place the device is correctly recognised with big-endian Malta at boot, along with the Super I/O devices behind PCI:
Serial: 8250/16550 driver, 5 ports, IRQ sharing enabled
printk: console [ttyS0] disabled
serial8250.0: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
printk: console [ttyS0] enabled
printk: bootconsole [uart8250] disabled
serial8250.0: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A serial8250.0: ttyS2 at MMIO 0x1f000900 (irq = 20, base_baud = 230400) is a 16550A
--- arch/mips/mti-malta/malta-platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/mips/mti-malta/malta-platform.c +2 -1
@@ -47,7 +47,8 @@ static struct plat_serial8250_port uart8 .mapbase = 0x1f000900, /* The CBUS UART */ .irq = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_MB2, .uartclk = 3686400, /* Twice the usual clk! */ - .iotype = UPIO_MEM32, + .iotype =IS_ENABLED (CONFIG_CPU_BIG_ENDIAN ) ? + UPIO_MEM32BE : UPIO_MEM32, .flags = CBUS_UART_FLAGS, .regshift = 3, },
Greg Kroah-Hartman
maintainerPATCH 98/135 serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 7f0909db761535aefafa77031062603a71557267 upstream.
Elkhart Lake UARTs are PCI enumerated Synopsys DesignWare v4.0+ UART integrated with Intel iDMA 32-bit DMA controller. There is a specific driver to handle them, i.e. 8250_lpss. Hence, disable 8250_pci enumeration for these UARTs.
--- drivers/tty/serial/8250/8250_pci.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/tty/serial/8250/8250_pci.c +6 -0
@@ -3804,6 +3804,12 @@ static const struct pci_device_id blackl { PCI_VDEVICE(INTEL, 0x0f0c), }, { PCI_VDEVICE(INTEL, 0x228a), }, { PCI_VDEVICE(INTEL, 0x228c), }, + { PCI_VDEVICE(INTEL, 0x4b96), }, + { PCI_VDEVICE(INTEL, 0x4b97), }, + { PCI_VDEVICE(INTEL, 0x4b98), }, + { PCI_VDEVICE(INTEL, 0x4b99), }, + { PCI_VDEVICE(INTEL, 0x4b9a), }, + { PCI_VDEVICE(INTEL, 0x4b9b), }, { PCI_VDEVICE(INTEL, 0x9ce3), }, { PCI_VDEVICE(INTEL, 0x9ce4), },
Greg Kroah-Hartman
maintainerPATCH 99/135 serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.
In reply to Greg Kroah-HartmanFrom: Mario Kleiner <[email protected]>
commit 341abd693d10e5f337a51f140ae3e7a1ae0febf6 upstream.
This attempts to fix a bug found with a serial port card which uses an MCS9922 chip, one of the 4 models for which MSI-X interrupts are currently supported. I don't possess such a card, and i'm not experienced with the serial subsystem, so this patch is based on what i think i found as a likely reason for failure, based on walking the user who actually owns the card through some diagnostic.
The user who reported the problem finds the following in his dmesg output for the relevant ttyS4 and ttyS5:
[ 0.580425] serial 0000:02:00.0: enabling device (0000 -> 0003) [ 0.601448] 0000:02:00.0: ttyS4 at I/O 0x3010 (irq = 125, base_baud = 115200) is a ST16650V2 [ 0.603089] serial 0000:02:00.1: enabling device (0000 -> 0003) [ 0.624119] 0000:02:00.1: ttyS5 at I/O 0x3000 (irq = 126, base_baud = 115200) is a ST16650V2 ... [ 6.323784] genirq: Flags mismatch irq 128. 00000080 (ttyS5) vs. 00000000 (xhci_hcd) [ 6.324128] genirq: Flags mismatch irq 128. 00000080 (ttyS5) vs. 00000000 (xhci_hcd)
...
Output of setserial -a:
/dev/ttyS4, Line 4, UART: 16650V2, Port: 0x3010, IRQ: 127
Baud_base: 115200, close_delay: 50, divisor: 0 closing_wait: 3000 Flags: spd_normal skip_test
This suggests to me that the serial driver wants to register and share a MSI/MSI-X irq 128 with the xhci_hcd driver, whereas the xhci driver does not want to share the irq, as flags 0x00000080 (== IRQF_SHARED) from the serial port driver means to share the irq, and this mismatch ends in some failed irq init?
With this setup, data reception works very unreliable, with dropped data, already at a transmission rate of only a 16 Bytes chunk every 1/120th of a second, ie. 1920 Bytes/sec, presumably due to rx fifo overflow due to mishandled or not used at all rx irq's?
See full discussion thread with attempted diagnosis at:
https://psychtoolbox.discourse.group/t/issues-with-iscan-serial-port-recording/3886
Disabling the use of MSI interrupts for the serial port pci card did fix the reliability problems. The user executed the following sequence of commands to achieve this:
echo 0000:02:00.0 | sudo tee /sys/bus/pci/drivers/serial/unbind echo 0000:02:00.1 | sudo tee /sys/bus/pci/drivers/serial/unbind
echo 0 | sudo tee /sys/bus/pci/devices/0000:02:00.0/msi_bus echo 0 | sudo tee /sys/bus/pci/devices/0000:02:00.1/msi_bus
echo 0000:02:00.0 | sudo tee /sys/bus/pci/drivers/serial/bind echo 0000:02:00.1 | sudo tee /sys/bus/pci/drivers/serial/bind
This resulted in the following log output:
[ 82.179021] pci 0000:02:00.0: MSI/MSI-X disallowed for future drivers [ 87.003031] pci 0000:02:00.1: MSI/MSI-X disallowed for future drivers [ 98.537010] 0000:02:00.0: ttyS4 at I/O 0x3010 (irq = 17, base_baud = 115200) is a ST16650V2 [ 103.648124] 0000:02:00.1: ttyS5 at I/O 0x3000 (irq = 18, base_baud = 115200) is a ST16650V2
This patch attempts to fix the problem by disabling irq sharing when using MSI irq's. Note that all i know for sure is that disabling MSI irq's fixed the problem for the user, so this patch could be wrong and is untested. Please review with caution, keeping this in mind.
--- drivers/tty/serial/8250/8250_pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/8250/8250_pci.c +1 -0
@@ -3970,6 +3970,7 @@ pciserial_init_ports(struct pci_dev *devif (pci_match_id (pci_use_msi, dev)) {dev_dbg (&dev->dev,"Using MSI(-X) interrupts\n" );pci_set_master (dev); + uart.port.flags &= ~UPF_SHARE_IRQ ; rc =pci_alloc_irq_vectors (dev,1 ,1 ,PCI_IRQ_ALL_TYPES ); }else {dev_dbg (&dev->dev,"Using legacy interrupts\n" );
Greg Kroah-Hartman
maintainerPATCH 100/135 fpga: dfl: fme: Fix cpu hotplug issue in performance reporting
In reply to Greg Kroah-HartmanFrom: Kajol Jain <[email protected]>
commit ec6446d5304b3c3dd692a1e244df7e40bbb5af36 upstream.
The performance reporting driver added cpu hotplug feature but it didn't add pmu migration call in cpu offline function.
This can create an issue incase the current designated cpu being used to collect fme pmu data got offline, as based on current code we are not migrating fme pmu to new target cpu. Because of that perf will still try to fetch data from that offline cpu and hence we will not get counter data.
Patch fixed this issue by adding pmu_migrate_context call in fme_perf_offline_cpu function.
--- drivers/fpga/dfl-fme-perf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/fpga/dfl-fme-perf.c +2 -0
@@ -953,6 +953,8 @@ static int fme_perf_offline_cpu(unsignedreturn 0 ; priv->cpu = target; +perf_pmu_migrate_context (&priv->pmu, cpu, target); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 101/135 timers: Move clearing of base::timer_running under base:: Lock
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit bb7262b295472eb6858b5c49893954794027cd84 upstream.
syzbot reported KCSAN data races vs. timer_base::timer_running being set to NULL without holding base::lock in expire_timers().
This looks innocent and most reads are clearly not problematic, but Frederic identified an issue which is:
int data = 0;
void timer_func(struct timer_list *t)
{
data = 1;}
CPU 0 CPU 1 ------------------------------ -------------------------- base = lock_timer_base(timer, &flags); raw_spin_unlock(&base->lock); if (base->running_timer != timer) call_timer_fn(timer, fn, baseclk); ret = detach_if_pending(timer, base, true); base->running_timer = NULL; raw_spin_unlock_irqrestore(&base->lock, flags); raw_spin_lock(&base->lock);
x = data;
If the timer has previously executed on CPU 1 and then CPU 0 can observe base->running_timer == NULL and returns, assuming the timer has completed, but it's not guaranteed on all architectures. The comment for del_timer_sync() makes that guarantee. Moving the assignment under base->lock prevents this.
For non-RT kernel it's performance wise completely irrelevant whether the store happens before or after taking the lock. For an RT kernel moving the store under the lock requires an extra unlock/lock pair in the case that there is a waiter for the timer, but that's not the end of the world.
--- kernel/time/timer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/time/timer.c +4 -2
@@ -1265,8 +1265,10 @@ static inline void timer_base_unlock_expstatic void timer_sync_wait_running (struct timer_base *base) {if (atomic_read (&base->timer_waiters)) { +raw_spin_unlock_irq (&base->lock);spin_unlock (&base->expiry_lock);spin_lock (&base->expiry_lock); +raw_spin_lock_irq (&base->lock); } }
@@ -1450,14 +1452,14 @@ static void expire_timers(struct timer_bif (timer->flags &TIMER_IRQSAFE ) {raw_spin_unlock (&base->lock);call_timer_fn (timer, fn, baseclk); - base->running_timer =NULL ;raw_spin_lock (&base->lock); + base->running_timer =NULL ; }else {raw_spin_unlock_irq (&base->lock);call_timer_fn (timer, fn, baseclk); +raw_spin_lock_irq (&base->lock); base->running_timer =NULL ;timer_sync_wait_running (base); -raw_spin_lock_irq (&base->lock); } } }
Greg Kroah-Hartman
maintainerPATCH 102/135 xfrm: Fix RCU vs hash_resize_mutex lock inversion
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
commit 2580d3f40022642452dd8422bfb8c22e54cf84bb upstream.
xfrm_bydst_resize() calls synchronize_rcu() while holding hash_resize_mutex. But then on PREEMPT_RT configurations, xfrm_policy_lookup_bytype() may acquire that mutex while running in an RCU read side critical section. This results in a deadlock.
In fact the scope of hash_resize_mutex is way beyond the purpose of xfrm_policy_lookup_bytype() to just fetch a coherent and stable policy for a given destination/direction, along with other details.
The lower level net->xfrm.xfrm_policy_lock, which among other things protects per destination/direction references to policy entries, is enough to serialize and benefit from priority inheritance against the write side. As a bonus, it makes it officially a per network namespace synchronization business where a policy table resize on namespace A shouldn't block a policy lookup on namespace B.
--- include/net/netns/xfrm.h | 1 + net/xfrm/xfrm_policy.c | 17 ++++++++--------- 2 files changed, 9 insertions(+), 9 deletions(-)
include/net/netns/xfrm.h +1 -0
@@ -74,6 +74,7 @@ struct netns_xfrm {#endif spinlock_t xfrm_state_lock;seqcount_t xfrm_state_hash_generation; +seqcount_spinlock_t xfrm_policy_hash_generation;spinlock_t xfrm_policy_lock;struct mutex xfrm_cfg_mutex;
net/xfrm/xfrm_policy.c +8 -9
@@ -155,7 +155,6 @@ static struct xfrm_policy_afinfo const ___read_mostly ;static struct kmem_cache *xfrm_dst_cache__ro_after_init ; -static __read_mostly seqcount_mutex_t xfrm_policy_hash_generation;static struct rhashtable xfrm_policy_inexact_table;static const struct rhashtable_params xfrm_pol_inexact_params;
@@ -585,7 +584,7 @@ static void xfrm_bydst_resize(struct netreturn ;spin_lock_bh (&net->xfrm.xfrm_policy_lock); -write_seqcount_begin (&xfrm_policy_hash_generation); +write_seqcount_begin (&net->xfrm.xfrm_policy_hash_generation); odst =rcu_dereference_protected (net->xfrm.policy_bydst[dir].table,lockdep_is_held (&net->xfrm.xfrm_policy_lock));
@@ -596,7 +595,7 @@ static void xfrm_bydst_resize(struct netrcu_assign_pointer (net->xfrm.policy_bydst[dir].table, ndst); net->xfrm.policy_bydst[dir].hmask = nhashmask; -write_seqcount_end (&xfrm_policy_hash_generation); +write_seqcount_end (&net->xfrm.xfrm_policy_hash_generation);spin_unlock_bh (&net->xfrm.xfrm_policy_lock);synchronize_rcu ();
@@ -1245,7 +1244,7 @@ static void xfrm_hash_rebuild(struct wor }while (read_seqretry (&net->xfrm.policy_hthresh.lock, seq));spin_lock_bh (&net->xfrm.xfrm_policy_lock); -write_seqcount_begin (&xfrm_policy_hash_generation); +write_seqcount_begin (&net->xfrm.xfrm_policy_hash_generation);/* make sure that we can insert the indirect policies again before * we start with destructive action.
@@ -1354,7 +1353,7 @@ static void xfrm_hash_rebuild(struct wor out_unlock:__xfrm_policy_inexact_flush (net); -write_seqcount_end (&xfrm_policy_hash_generation); +write_seqcount_end (&net->xfrm.xfrm_policy_hash_generation);spin_unlock_bh (&net->xfrm.xfrm_policy_lock);mutex_unlock (&hash_resize_mutex);
@@ -2095,9 +2094,9 @@ static struct xfrm_policy *xfrm_policy_lrcu_read_lock (); retry:do { - sequence =read_seqcount_begin (&xfrm_policy_hash_generation); + sequence =read_seqcount_begin (&net->xfrm.xfrm_policy_hash_generation); chain =policy_hash_direct (net, daddr, saddr, family, dir); - }while (read_seqcount_retry (&xfrm_policy_hash_generation, sequence)); + }while (read_seqcount_retry (&net->xfrm.xfrm_policy_hash_generation, sequence)); ret =NULL ;hlist_for_each_entry_rcu (pol, chain, bydst) {
@@ -2128,7 +2127,7 @@ static struct xfrm_policy *xfrm_policy_l } skip_inexact: -if (read_seqcount_retry (&xfrm_policy_hash_generation, sequence)) +if (read_seqcount_retry (&net->xfrm.xfrm_policy_hash_generation, sequence)) goto retry;if (ret && !xfrm_pol_hold_rcu (ret))
@@ -4123,6 +4122,7 @@ static int __net_init xfrm_net_init(stru/* Initialize the per-net locks here */ spin_lock_init (&net->xfrm.xfrm_state_lock);spin_lock_init (&net->xfrm.xfrm_policy_lock); +seqcount_spinlock_init (&net->xfrm.xfrm_policy_hash_generation, &net->xfrm.xfrm_policy_lock);mutex_init (&net->xfrm.xfrm_cfg_mutex); rv =xfrm_statistics_init (net);
@@ -4167,7 +4167,6 @@ void __init xfrm_init(void) {register_pernet_subsys (&xfrm_net_ops);xfrm_dev_init (); -seqcount_mutex_init (&xfrm_policy_hash_generation, &hash_resize_mutex);xfrm_input_init ();#ifdef CONFIG_XFRM_ESPINTCP
Greg Kroah-Hartman
maintainerPATCH 103/135 net/xfrm/compat: Copy xfrm_spdattr_type_t atributes
In reply to Greg Kroah-HartmanFrom: Dmitry Safonov <[email protected]>
commit 4e9505064f58d1252805952f8547a5b7dbc5c111 upstream.
The attribute-translator has to take in mind maxtype, that is xfrm_link::nla_max. When it is set, attributes are not of xfrm_attr_type_t. Currently, they can be only XFRMA_SPD_MAX (message XFRM_MSG_NEWSPDINFO), their UABI is the same for 64/32-bit, so just copy them.
Thanks to YueHaibing for reporting this:
In xfrm_user_rcv_msg_compat() if maxtype is not zero and less than XFRMA_MAX, nlmsg_parse_deprecated() do not initialize attrs array fully. xfrm_xlate32() will access uninit 'attrs[i]' while iterating all attrs array.
KASAN: probably user-memory-access in range [0x0000000041b58ab0-0x0000000041b58ab7] CPU: 0 PID: 15799 Comm: syz-executor.2 Tainted: G W 5.14.0-rc1-syzkaller #0 RIP: 0010:nla_type include/net/netlink.h:1130 [inline] RIP: 0010:xfrm_xlate32_attr net/xfrm/xfrm_compat.c:410 [inline] RIP: 0010:xfrm_xlate32 net/xfrm/xfrm_compat.c:532 [inline] RIP: 0010:xfrm_user_rcv_msg_compat+0x5e5/0x1070 net/xfrm/xfrm_compat.c:577 [...] Call Trace: xfrm_user_rcv_msg+0x556/0x8b0 net/xfrm/xfrm_user.c:2774 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2824 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:702 [inline]
--- net/xfrm/xfrm_compat.c | 49 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 5 deletions(-)
net/xfrm/xfrm_compat.c +44 -5
@@ -298,8 +298,16 @@ static int xfrm_xlate64(struct sk_buff * len =nlmsg_attrlen (nlh_src, xfrm_msg_min[type]);nla_for_each_attr (nla, attrs, len, remaining) { -int err =xfrm_xlate64_attr (dst, nla); +int err; +switch (type) { +case XFRM_MSG_NEWSPDINFO : + err =xfrm_nla_cpy (dst, nla,nla_len (nla)); +break ; +default : + err =xfrm_xlate64_attr (dst, nla); +break ; + }if (err)return err; }
@@ -341,7 +349,8 @@ static int xfrm_alloc_compat(struct sk_b/* Calculates len of translated 64-bit message. */ static size_t xfrm_user_rcv_calculate_len64 (const struct nlmsghdr *src, -struct nlattr *attrs[XFRMA_MAX +1 ]) +struct nlattr *attrs[XFRMA_MAX +1 ], +int maxtype) {size_t len =nlmsg_len (src);
@@ -358,10 +367,20 @@ static size_t xfrm_user_rcv_calculate_lecase XFRM_MSG_POLEXPIRE : len +=8 ;break ; +case XFRM_MSG_NEWSPDINFO : +/* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */ +return len;default :break ; } +/* Unexpected for anything, but XFRM_MSG_NEWSPDINFO, please +* correct both 64=>32-bit and 32=>64-bit translators to copy +* new attributes. +*/ +if (WARN_ON_ONCE (maxtype)) +return len; +if (attrs[XFRMA_SA ]) len +=4 ;if (attrs[XFRMA_POLICY ])
@@ -440,7 +459,8 @@ static int xfrm_xlate32_attr(void *dst,static int xfrm_xlate32 (struct nlmsghdr *dst,const struct nlmsghdr *src,struct nlattr *attrs[XFRMA_MAX +1 ], -size_t size,u8 type,struct netlink_ext_ack *extack) +size_t size,u8 type,int maxtype, +struct netlink_ext_ack *extack) {size_t pos;int i;
@@ -520,6 +540,25 @@ static int xfrm_xlate32(struct nlmsghdr } pos = dst->nlmsg_len; +if (maxtype) { +/* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */ +WARN_ON_ONCE (src->nlmsg_type !=XFRM_MSG_NEWSPDINFO ); + +for (i =1 ; i <= maxtype; i++) { +int err; + +if (!attrs[i]) +continue ; + +/* just copy - no need for translation */ + err =xfrm_attr_cpy32 (dst, &pos, attrs[i], size, +nla_len (attrs[i]),nla_len (attrs[i])); +if (err) +return err; + } +return 0 ; + } +for (i =1 ; i <XFRMA_MAX +1 ; i++) {int err;
@@ -564,7 +603,7 @@ static struct nlmsghdr *xfrm_user_rcv_msif (err <0 )return ERR_PTR (err); - len =xfrm_user_rcv_calculate_len64 (h32, attrs); + len =xfrm_user_rcv_calculate_len64 (h32, attrs, maxtype);/* The message doesn't need translation */ if (len ==nlmsg_len (h32))return NULL ;
@@ -574,7 +613,7 @@ static struct nlmsghdr *xfrm_user_rcv_msif (!h64)return ERR_PTR (-ENOMEM ); - err =xfrm_xlate32 (h64, h32, attrs, len, type, extack); + err =xfrm_xlate32 (h64, h32, attrs, len, type, maxtype, extack);if (err <0 ) {kvfree (h64);return ERR_PTR (err);
Greg Kroah-Hartman
maintainerPATCH 104/135 pcmcia: i82092: fix a null pointer dereference bug
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
commit e39cdacf2f664b09029e7c1eb354c91a20c367af upstream.
During the driver loading process, the 'dev' field was not assigned, but the 'dev' field was referenced in the subsequent 'i82092aa_set_mem_map' function.
--- drivers/pcmcia/i82092.c | 1 + 1 file changed, 1 insertion(+)
drivers/pcmcia/i82092.c +1 -0
@@ -112,6 +112,7 @@ static int i82092aa_pci_probe(struct pcifor (i =0 ; i < socket_count; i++) { sockets[i].card_state =1 ;/* 1 = present but empty */ sockets[i].io_base =pci_resource_start (dev,0 ); + sockets[i].dev = dev; sockets[i].socket.features |=SS_CAP_PCCARD ; sockets[i].socket.map_size =0x1000 ; sockets[i].socket.irq_mask =0 ;
Greg Kroah-Hartman
maintainerPATCH 105/135 selinux: correct the return value when loads initial sids
In reply to Greg Kroah-HartmanFrom: Xiu Jianfeng <[email protected]>
commit 4c156084daa8ee70978e4b150b5eb5fc7b1f15be upstream.
It should not return 0 when SID 0 is assigned to isids. This patch fixes it.
--- security/selinux/ss/policydb.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
security/selinux/ss/policydb.c +4 -6
@@ -874,7 +874,7 @@ int policydb_load_isids(struct policydb rc =sidtab_init (s);if (rc) {pr_err ("SELinux: out of memory on SID table init\n" ); - goto out; +return rc; } head = p->ocontexts[OCON_ISID ];
@@ -885,7 +885,7 @@ int policydb_load_isids(struct policydbif (sid ==SECSID_NULL ) {pr_err ("SELinux: SID 0 was assigned a context.\n" );sidtab_destroy (s); - goto out; +return -EINVAL ; }/* Ignore initial SIDs unused by this kernel. */
@@ -897,12 +897,10 @@ int policydb_load_isids(struct policydbpr_err ("SELinux: unable to load initial SID %s.\n" , name);sidtab_destroy (s); - goto out; +return rc; } } - rc =0 ; -out: -return rc; +return 0 ; }int policydb_class_isvalid (struct policydb *p,unsigned int class)
Greg Kroah-Hartman
maintainerPATCH 106/135 bus: ti-sysc: AM3: RNG is GP only
In reply to Greg Kroah-HartmanFrom: Kevin Hilman <[email protected]>
commit a6d90e9f22328f07343e49e08a4ca483ae8e8abb upstream.
Make the RNG on AM3 GP only.
Based on this patch from TI v5.4 tree which is based on hwmod data which are now removed:
| ARM: AM43xx: hwmod: Move RNG to a GP only links table | | On non-GP devices the RNG is controlled by the secure-side software, | like in DRA7xx hwmod we should not control this IP when we are not | a GP device. | | Signed-off-by: Andrew F. Davis <[email protected]>
--- drivers/bus/ti-sysc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bus/ti-sysc.c +2 -0
@@ -2920,6 +2920,8 @@ static int sysc_init_soc(struct sysc *dd case SOC_3430 ... SOC_3630:sysc_add_disabled (0x48304000 );/* timer12 */ break ; +case SOC_AM3 : +sysc_add_disabled (0x48310000 );/* rng */ default :break ; };
Greg Kroah-Hartman
maintainerPATCH 107/135 Revert "gpio: mpc8xxx: change the gpio interrupt flags."
In reply to Greg Kroah-HartmanFrom: Rasmus Villemoes <[email protected]>
commit ec7099fdea8025988710ee6fecfd4e4210c29ab5 upstream.
This reverts commit 3d5bfbd9716318b1ca5c38488aa69f64d38a9aa5.
When booting with threadirqs, it causes a splat
WARNING: CPU: 0 PID: 29 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x1ec/0x27c irq 66 handler irq_default_primary_handler+0x0/0x1c enabled interrupts
That splat later went away with commit 81e2073c175b ("genirq: Disable interrupts for force threaded handlers"), which got backported to -stable. However, when running an -rt kernel, the splat still exists. Moreover, quoting Thomas Gleixner [1]
But 3d5bfbd97163 ("gpio: mpc8xxx: change the gpio interrupt flags.") has nothing to do with that:
"Delete the interrupt IRQF_NO_THREAD flags in order to gpio interrupts
can be threaded to allow high-priority processes to preempt."
This changelog is blatantly wrong. In mainline forced irq threads have always been invoked with softirqs disabled, which obviously makes them non-preemptible.
So the patch didn't even do what its commit log said.
[1] https://lore.kernel.org/lkml/[email protected]/
--- drivers/gpio/gpio-mpc8xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-mpc8xxx.c +1 -1
@@ -396,7 +396,7 @@ static int mpc8xxx_probe(struct platform ret =devm_request_irq (&pdev->dev, mpc8xxx_gc->irqn, mpc8xxx_gpio_irq_cascade, -IRQF_SHARED ,"gpio-cascade" , +IRQF_NO_THREAD |IRQF_SHARED ,"gpio-cascade" , mpc8xxx_gc);if (ret) { dev_err(&pdev->dev, "%s: failed to devm_request_irq(%d), ret = %d\n",
Greg Kroah-Hartman
maintainerPATCH 108/135 ARM: omap2+: hwmod: fix potential NULL pointer access
In reply to Greg Kroah-HartmanFrom: Tero Kristo <[email protected]>
commit b070f9ca78680486927b799cf6126b128a7c2c1b upstream.
omap_hwmod_get_pwrdm() may access a NULL clk_hw pointer in some failure cases. Add a check for the case and bail out gracely if this happens.
--- arch/arm/mach-omap2/omap_hwmod.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/omap_hwmod.c +9 -1
@@ -3777,6 +3777,7 @@ struct powerdomain *omap_hwmod_get_pwrdmstruct omap_hwmod_ocp_if *oi;struct clockdomain *clkdm;struct clk_hw_omap *clk; +struct clk_hw *hw;if (!oh)return NULL ;
@@ -3793,7 +3794,14 @@ struct powerdomain *omap_hwmod_get_pwrdm c = oi->_clk; } - clk =to_clk_hw_omap (__clk_get_hw (c)); + hw =__clk_get_hw (c); +if (!hw) +return NULL ; + + clk =to_clk_hw_omap (hw); +if (!clk) +return NULL ; + clkdm = clk->clkdm;if (!clkdm)return NULL ;
Greg Kroah-Hartman
maintainerPATCH 109/135 md/raid10: properly indicate failure when ending a failed write request
In reply to Greg Kroah-HartmanFrom: Wei Shuyu <[email protected]>
commit 5ba03936c05584b6f6f79be5ebe7e5036c1dd252 upstream.
Similar to [1], this patch fixes the same bug in raid10. Also cleanup the comments.
[1] commit 2417b9869b81 ("md/raid1: properly indicate failure when ending a failed write request")
--- drivers/md/raid1.c | 2 -- drivers/md/raid10.c | 4 ++-- 2 files changed, 2 insertions(+), 4 deletions(-)
drivers/md/raid1.c +0 -2
@@ -472,8 +472,6 @@ static void raid1_end_write_request(stru/* * When the device is faulty, it is not necessary to * handle write error. -* For failfast, this is the only remaining device, -* We need to retry the write without FailFast. */ if (!test_bit (Faulty, &rdev->flags))set_bit (R1BIO_WriteError, &r1_bio->state);
drivers/md/raid10.c +2 -2
@@ -470,12 +470,12 @@ static void raid10_end_write_request(str/* * When the device is faulty, it is not necessary to * handle write error. -* For failfast, this is the only remaining device, -* We need to retry the write without FailFast. */ if (!test_bit (Faulty, &rdev->flags))set_bit (R10BIO_WriteError, &r10_bio->state);else { +/* Fail the request */ +set_bit (R10BIO_Degraded, &r10_bio->state); r10_bio->devs[slot].bio =NULL ; to_put = bio; dec_rdev =1 ;
Greg Kroah-Hartman
maintainerPATCH 110/135 KVM: x86: accept userspace interrupt only if no event is injected
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit fa7a549d321a4189677b0cea86e58d9db7977f7b upstream.
Once an exception has been injected, any side effects related to the exception (such as setting CR2 or DR6) have been taked place. Therefore, once KVM sets the VM-entry interruption information field or the AMD EVENTINJ field, the next VM-entry must deliver that exception.
Pending interrupts are processed after injected exceptions, so in theory it would not be a problem to use KVM_INTERRUPT when an injected exception is present. However, DOSEMU is using run->ready_for_interrupt_injection to detect interrupt windows and then using KVM_SET_SREGS/KVM_SET_REGS to inject the interrupt manually. For this to work, the interrupt window must be delayed after the completion of the previous event injection.
--- arch/x86/kvm/x86.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
arch/x86/kvm/x86.c +11 -2
@@ -4100,8 +4100,17 @@ static int kvm_cpu_accept_dm_intr(structstatic int kvm_vcpu_ready_for_interrupt_injection (struct kvm_vcpu *vcpu) { -return kvm_arch_interrupt_allowed (vcpu) && -kvm_cpu_accept_dm_intr (vcpu); +/* +* Do not cause an interrupt window exit if an exception +* is pending or an event needs reinjection; userspace +* might want to inject the interrupt manually using KVM_SET_REGS +* or KVM_SET_SREGS. For that to work, we must be at an +* instruction boundary and with no events half-injected. +*/ +return (kvm_arch_interrupt_allowed (vcpu) && +kvm_cpu_accept_dm_intr (vcpu) && + !kvm_event_needs_reinjection (vcpu) && + !vcpu->arch.exception.pending); } static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
Greg Kroah-Hartman
maintainerPATCH 111/135 KVM: Do not leak memory for duplicate debugfs directories
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 85cd39af14f498f791d8aab3fbd64cd175787f1a upstream.
KVM creates a debugfs directory for each VM in order to store statistics about the virtual machine. The directory name is built from the process pid and a VM fd. While generally unique, it is possible to keep a file descriptor alive in a way that causes duplicate directories, which manifests as these messages:
[ 471.846235] debugfs: Directory '20245-4' with parent 'kvm' already present!
Even though this should not happen in practice, it is more or less expected in the case of KVM for testcases that call KVM_CREATE_VM and close the resulting file descriptor repeatedly and in parallel.
When this happens, debugfs_create_dir() returns an error but kvm_create_vm_debugfs() goes on to allocate stat data structs which are later leaked. The slow memory leak was spotted by syzkaller, where it caused OOM reports.
Since the issue only affects debugfs, do a lookup before calling debugfs_create_dir, so that the message is downgraded and rate-limited. While at it, ensure kvm->debugfs_dentry is NULL rather than an error if it is not created. This fixes kvm_destroy_vm_debugfs, which was not checking IS_ERR_OR_NULL correctly.
--- virt/kvm/kvm_main.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
virt/kvm/kvm_main.c +16 -2
@@ -685,6 +685,8 @@ static void kvm_destroy_vm_debugfs(strucstatic int kvm_create_vm_debugfs (struct kvm *kvm,int fd) { +static DEFINE_MUTEX (kvm_debugfs_lock); +struct dentry *dent;char dir_name[ITOA_MAX_LEN *2 ];struct kvm_stat_data *stat_data;struct kvm_stats_debugfs_item *p;
@@ -693,8 +695,20 @@ static int kvm_create_vm_debugfs(structreturn 0 ;snprintf (dir_name,sizeof (dir_name),"%d-%d" ,task_pid_nr (current), fd); - kvm->debugfs_dentry =debugfs_create_dir (dir_name, kvm_debugfs_dir); +mutex_lock (&kvm_debugfs_lock); + dent =debugfs_lookup (dir_name, kvm_debugfs_dir); +if (dent) { +pr_warn_ratelimited ("KVM: debugfs: duplicate directory %s\n" , dir_name); +dput (dent); +mutex_unlock (&kvm_debugfs_lock); +return 0 ; + } + dent =debugfs_create_dir (dir_name, kvm_debugfs_dir); +mutex_unlock (&kvm_debugfs_lock); +if (IS_ERR (dent)) +return 0 ; + kvm->debugfs_dentry = dent; kvm->debugfs_stat_data =kcalloc (kvm_debugfs_num_entries,sizeof (*kvm->debugfs_stat_data),GFP_KERNEL_ACCOUNT );
@@ -4698,7 +4712,7 @@ static void kvm_uevent_notify_change(uns }add_uevent_var (env,"PID=%d" , kvm->userspace_pid); -if (!IS_ERR_OR_NULL (kvm->debugfs_dentry)) { +if (kvm->debugfs_dentry) {char *tmp, *p =kmalloc (PATH_MAX ,GFP_KERNEL_ACCOUNT );if (p) {
Greg Kroah-Hartman
maintainerPATCH 112/135 KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit d5aaad6f83420efb8357ac8e11c868708b22d0a9 upstream.
Take a signed 'long' instead of an 'unsigned long' for the number of pages to add/subtract to the total number of pages used by the MMU. This fixes a zero-extension bug on 32-bit kernels that effectively corrupts the per-cpu counter used by the shrinker.
Per-cpu counters take a signed 64-bit value on both 32-bit and 64-bit kernels, whereas kvm_mod_used_mmu_pages() takes an unsigned long and thus an unsigned 32-bit value on 32-bit kernels. As a result, the value used to adjust the per-cpu counter is zero-extended (unsigned -> signed), not sign-extended (signed -> signed), and so KVM's intended -1 gets morphed to 4294967295 and effectively corrupts the counter.
This was found by a staggering amount of sheer dumb luck when running kvm-unit-tests on a 32-bit KVM build. The shrinker just happened to kick in while running tests and do_shrink_slab() logged an error about trying to free a negative number of objects. The truly lucky part is that the kernel just happened to be a slightly stale build, as the shrinker no longer yells about negative objects as of commit 18bb473e5031 ("mm:
vmscan: shrink deferred objects proportional to priority").
vmscan: shrink_slab: mmu_shrink_scan+0x0/0x210 [kvm] negative objects to delete nr=-858993460
Message-Id: <[email protected]>
--- arch/x86/kvm/mmu/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/mmu/mmu.c +1 -1
@@ -1621,7 +1621,7 @@ static int is_empty_shadow_page(u64 *spt* aggregate version in order to make the slab shrinker * faster */ -static inline void kvm_mod_used_mmu_pages (struct kvm *kvm,unsigned long nr) +static inline void kvm_mod_used_mmu_pages (struct kvm *kvm,long nr) { kvm->arch.n_used_mmu_pages += nr;percpu_counter_add (&kvm_total_used_mmu_pages, nr);
Greg Kroah-Hartman
maintainerPATCH 113/135 arm64: vdso: Avoid ISB after reading from cntvct_el0
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 77ec462536a13d4b428a1eead725c4818a49f0b1 upstream.
We can avoid the expensive ISB instruction after reading the counter in the vDSO gettime functions by creating a fake address hazard against a dummy stack read, just like we do inside the kernel.
--- arch/arm64/include/asm/arch_timer.h | 21 --------------------- arch/arm64/include/asm/barrier.h | 19 +++++++++++++++++++ arch/arm64/include/asm/vdso/gettimeofday.h | 6 +----- 3 files changed, 20 insertions(+), 26 deletions(-)
arch/arm64/include/asm/arch_timer.h +0 -21
@@ -165,25 +165,6 @@ static inline void arch_timer_set_cntkctisb (); } -/* -* Ensure that reads of the counter are treated the same as memory reads -* for the purposes of ordering by subsequent memory barriers. -* -* This insanity brought to you by speculative system register reads, -* out-of-order memory accesses, sequence locks and Thomas Gleixner. -* -* http://lists.infradead.org/pipermail/linux-arm-kernel/2019-February/631195.html -*/ -#define arch_counter_enforce_ordering (val) do { \ - u64 tmp, _val = (val); \ - \ - asm volatile( \ - " eor %0, %1, %1\n" \ - " add %0, sp, %0\n" \ - " ldr xzr, [%0]" \ - : "=r" (tmp) : "r" (_val)); \ -} while (0) - static __always_inline u64 __arch_counter_get_cntpct_stable(void) {u64 cnt;
@@ -224,8 +205,6 @@ static __always_inline u64 __arch_countereturn cnt; } -#undef arch_counter_enforce_ordering -static inline int arch_timer_arch_init (void ) {return 0 ;
arch/arm64/include/asm/barrier.h +19 -0
@@ -70,6 +70,25 @@ static inline unsigned long array_index_return mask; } +/* +* Ensure that reads of the counter are treated the same as memory reads +* for the purposes of ordering by subsequent memory barriers. +* +* This insanity brought to you by speculative system register reads, +* out-of-order memory accesses, sequence locks and Thomas Gleixner. +* +* http://lists.infradead.org/pipermail/linux-arm-kernel/2019-February/631195.html +*/ +#define arch_counter_enforce_ordering (val) do { \ + u64 tmp, _val = (val); \ + \ + asm volatile( \ + " eor %0, %1, %1\n" \ + " add %0, sp, %0\n" \ + " ldr xzr, [%0]" \ + : "=r" (tmp) : "r" (_val)); \ +} while (0) +#define __smp_mb () dmb(ish)#define __smp_rmb () dmb(ishld)#define __smp_wmb () dmb(ishst)
arch/arm64/include/asm/vdso/gettimeofday.h +1 -5
@@ -83,11 +83,7 @@ static __always_inline u64 __arch_get_hw*/ isb (); asmvolatile ("mrs %0, cntvct_el0" :"=r" (res) ::"memory" ); -/* -* This isb() is required to prevent that the seq lock is -* speculated.# -*/ -isb (); +arch_counter_enforce_ordering (res);return res; }
Greg Kroah-Hartman
maintainerPATCH 114/135 soc: ixp4xx: fix printing resources
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 8861452b2097bb0b5d0081a1c137fb3870b0a31f upstream.
When compile-testing with 64-bit resource_size_t, gcc reports an invalid printk format string:
In file included from include/linux/dma-mapping.h:7,
from drivers/soc/ixp4xx/ixp4xx-npe.c:15:
drivers/soc/ixp4xx/ixp4xx-npe.c: In function 'ixp4xx_npe_probe':
drivers/soc/ixp4xx/ixp4xx-npe.c:694:18: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
dev_info(dev, "NPE%d at 0x%08x-0x%08x not available\n",Use the special %pR format string to print the resources.
--- drivers/soc/ixp4xx/ixp4xx-npe.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/soc/ixp4xx/ixp4xx-npe.c +5 -6
@@ -690,8 +690,8 @@ static int ixp4xx_npe_probe(struct platfif (!(ixp4xx_read_feature_bits () & (IXP4XX_FEATURE_RESET_NPEA << i))) { -dev_info (dev,"NPE%d at 0x%08x-0x%08x not available\n" , - i, res->start, res->end); +dev_info (dev,"NPE%d at %pR not available\n" , + i, res);continue ;/* NPE already disabled or not present */ } npe->regs =devm_ioremap_resource (dev, res);
@@ -699,13 +699,12 @@ static int ixp4xx_npe_probe(struct platfreturn PTR_ERR (npe->regs);if (npe_reset (npe)) { -dev_info (dev,"NPE%d at 0x%08x-0x%08x does not reset\n" , - i, res->start, res->end); +dev_info (dev,"NPE%d at %pR does not reset\n" , + i, res);continue ; } npe->valid =1 ; -dev_info (dev,"NPE%d at 0x%08x-0x%08x registered\n" , - i, res->start, res->end); +dev_info (dev,"NPE%d at %pR registered\n" , i, res); found++; }
Greg Kroah-Hartman
maintainerPATCH 115/135 interconnect: Fix undersized devress_alloc allocation
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 85b1ebfea2b0d8797266bcc6f04b6cc87e38290a upstream.
The expression sizeof(**ptr) for the void **ptr is just 1 rather than the size of a pointer. Fix this by using sizeof(*ptr).
Addresses-Coverity: ("Wrong sizeof argument")
--- drivers/interconnect/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/interconnect/core.c +1 -1
@@ -403,7 +403,7 @@ struct icc_path *devm_of_icc_get(struct {struct icc_path **ptr, *path; - ptr =devres_alloc (devm_icc_release,sizeof (**ptr),GFP_KERNEL ); + ptr =devres_alloc (devm_icc_release,sizeof (*ptr),GFP_KERNEL );if (!ptr)return ERR_PTR (-ENOMEM );
Greg Kroah-Hartman
maintainerPATCH 116/135 spi: meson-spicc: fix memory leak in meson_spicc_remove
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit 8311ee2164c5cd1b63a601ea366f540eae89f10e upstream.
In meson_spicc_probe, the error handling code needs to clean up master by calling spi_master_put, but the remove function does not have this function call. This will lead to memory leak of spicc->master.
--- drivers/spi/spi-meson-spicc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-meson-spicc.c +2 -0
@@ -785,6 +785,8 @@ static int meson_spicc_remove(struct placlk_disable_unprepare (spicc->core);clk_disable_unprepare (spicc->pclk); +spi_master_put (spicc->master); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 117/135 interconnect: Zero initial BW after sync-state
In reply to Greg Kroah-HartmanFrom: Mike Tipton <[email protected]>
commit 456a9dace42ecfcec7ce6e17c18d1985d628dcd0 upstream.
The initial BW values may be used by providers to enforce floors. Zero these values after sync-state so that providers know when to stop enforcing them.
--- drivers/interconnect/core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/interconnect/core.c +2 -0
@@ -1106,6 +1106,8 @@ void icc_sync_state(struct device *dev)dev_dbg (p->dev,"interconnect provider is in synced state\n" );list_for_each_entry (n, &p->nodes, node_list) {if (n->init_avg || n->init_peak) { + n->init_avg =0 ; + n->init_peak =0 ;aggregate_requests (n); p->set (n, n); }
Greg Kroah-Hartman
maintainerPATCH 118/135 interconnect: Always call pre_aggregate before aggregate
In reply to Greg Kroah-HartmanFrom: Mike Tipton <[email protected]>
commit 73606ba9242f8e32023699b500b7922b4cf2993c upstream.
The pre_aggregate callback isn't called in all cases before calling aggregate. Add the missing calls so providers can rely on consistent framework behavior.
--- drivers/interconnect/core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/interconnect/core.c +5 -0
@@ -973,9 +973,14 @@ void icc_node_add(struct icc_node *node, } node->avg_bw = node->init_avg; node->peak_bw = node->init_peak; + +if (provider->pre_aggregate) + provider->pre_aggregate (node); +if (provider->aggregate) provider->aggregate (node,0 , node->init_avg, node->init_peak, &node->avg_bw, &node->peak_bw); + provider->set (node, node); node->avg_bw =0 ; node->peak_bw =0 ;
Greg Kroah-Hartman
maintainerPATCH 119/135 interconnect: qcom: icc-rpmh: Ensure floor BW is enforced for all nodes
In reply to Greg Kroah-HartmanFrom: Mike Tipton <[email protected]>
commit ce5a595744126be4f1327e29e3c5ae9aac6b38d5 upstream.
We currently only enforce BW floors for a subset of nodes in a path. All BCMs that need updating are queued in the pre_aggregate/aggregate phase. The first set() commits all queued BCMs and subsequent set() calls short-circuit without committing anything. Since the floor BW isn't set in sum_avg/max_peak until set(), then some BCMs are committed before their associated nodes reflect the floor.
Set the floor as each node is being aggregated. This ensures that all all relevant floors are set before the BCMs are committed.
--- drivers/interconnect/qcom/icc-rpmh.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/interconnect/qcom/icc-rpmh.c +5 -7
@@ -57,6 +57,11 @@ int qcom_icc_aggregate(struct icc_node * qn->sum_avg[i] += avg_bw; qn->max_peak[i] =max_t (u32, qn->max_peak[i], peak_bw); } + +if (node->init_avg || node->init_peak) { + qn->sum_avg[i] =max_t (u64, qn->sum_avg[i], node->init_avg); + qn->max_peak[i] =max_t (u64, qn->max_peak[i], node->init_peak); + } } *agg_avg += avg_bw;
@@ -79,7 +84,6 @@ EXPORT_SYMBOL_GPL(qcom_icc_aggregate);int qcom_icc_set (struct icc_node *src,struct icc_node *dst) {struct qcom_icc_provider *qp; -struct qcom_icc_node *qn;struct icc_node *node;if (!src)
@@ -88,12 +92,6 @@ int qcom_icc_set(struct icc_node *src, s node = src; qp =to_qcom_provider (node->provider); - qn = node->data; - - qn->sum_avg[QCOM_ICC_BUCKET_AMC ] =max_t (u64, qn->sum_avg[QCOM_ICC_BUCKET_AMC ], - node->avg_bw); - qn->max_peak[QCOM_ICC_BUCKET_AMC ] =max_t (u64, qn->max_peak[QCOM_ICC_BUCKET_AMC ], - node->peak_bw);qcom_icc_bcm_voter_commit (qp->voter);
Greg Kroah-Hartman
maintainerPATCH 120/135 interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate
In reply to Greg Kroah-HartmanFrom: Mike Tipton <[email protected]>
commit f84f5b6f72e68bbaeb850b58ac167e4a3a47532a upstream.
We're only adding BCMs to the commit list in aggregate(), but there are cases where pre_aggregate() is called without subsequently calling aggregate(). In particular, in icc_sync_state() when a node with initial BW has zero requests. Since BCMs aren't added to the commit list in these cases, we don't actually send the zero BW request to HW. So the resources remain on unnecessarily.
Add BCMs to the commit list in pre_aggregate() instead, which is always called even when there are no requests.
--- drivers/interconnect/qcom/icc-rpmh.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/interconnect/qcom/icc-rpmh.c +5 -5
@@ -20,13 +20,18 @@ void qcom_icc_pre_aggregate(struct icc_n {size_t i;struct qcom_icc_node *qn; +struct qcom_icc_provider *qp; qn = node->data; + qp =to_qcom_provider (node->provider);for (i =0 ; i <QCOM_ICC_NUM_BUCKETS ; i++) { qn->sum_avg[i] =0 ; qn->max_peak[i] =0 ; } + +for (i =0 ; i < qn->num_bcms; i++) +qcom_icc_bcm_voter_add (qp->voter, qn->bcms[i]); }EXPORT_SYMBOL_GPL (qcom_icc_pre_aggregate);
@@ -44,10 +49,8 @@ int qcom_icc_aggregate(struct icc_node * {size_t i;struct qcom_icc_node *qn; -struct qcom_icc_provider *qp; qn = node->data; - qp =to_qcom_provider (node->provider);if (!tag) tag =QCOM_ICC_TAG_ALWAYS ;
@@ -67,9 +70,6 @@ int qcom_icc_aggregate(struct icc_node * *agg_avg += avg_bw; *agg_peak =max_t (u32, *agg_peak, peak_bw); -for (i =0 ; i < qn->num_bcms; i++) -qcom_icc_bcm_voter_add (qp->voter, qn->bcms[i]); -return 0 ; }EXPORT_SYMBOL_GPL (qcom_icc_aggregate);
Greg Kroah-Hartman
maintainerPATCH 121/135 drm/i915: Correct SFC_DONE register offset
In reply to Greg Kroah-HartmanFrom: Matt Roper <[email protected]>
commit 9c9c6d0ab08acfe41c9f7efa72c4ad3f133a266b upstream.
The register offset for SFC_DONE was missing a '0' at the end, causing us to read from a non-existent register address. We only use this register in error state dumps so the mistake hasn't caused any real problems, but fixing it will hopefully make the error state dumps a bit more useful for debugging.
--- drivers/gpu/drm/i915/i915_reg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_reg.h +1 -1
@@ -413,7 +413,7 @@ static inline bool i915_mmio_reg_valid(i#define GEN11_VECS_SFC_USAGE (engine) _MMIO((engine)->mmio_base + 0x2014)#define GEN11_VECS_SFC_USAGE_BIT (1 << 0) -#define GEN12_SFC_DONE (n) _MMIO(0x1cc00 + (n) * 0x100) +#define GEN12_SFC_DONE (n) _MMIO(0x1cc000 + (n) * 0x1000)#define GEN12_SFC_DONE_MAX 4#define RING_PP_DIR_BASE (base) _MMIO((base) + 0x228)
Greg Kroah-Hartman
maintainerPATCH 122/135 soc: ixp4xx/qmgr: fix invalid __iomem access
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit a8eee86317f11e97990d755d4615c1c0db203d08 upstream.
Sparse reports a compile time warning when dereferencing an __iomem pointer:
drivers/soc/ixp4xx/ixp4xx-qmgr.c:149:37: warning: dereference of noderef expression drivers/soc/ixp4xx/ixp4xx-qmgr.c:153:40: warning: dereference of noderef expression drivers/soc/ixp4xx/ixp4xx-qmgr.c:154:40: warning: dereference of noderef expression drivers/soc/ixp4xx/ixp4xx-qmgr.c:174:38: warning: dereference of noderef expression drivers/soc/ixp4xx/ixp4xx-qmgr.c:174:44: warning: dereference of noderef expression
Use __raw_readl() here for consistency with the rest of the file. This should really get converted to some proper accessor, as the __raw functions are not meant to be used in drivers, but the driver has used these since the start, so for the moment, let's only fix the warning.
--- drivers/soc/ixp4xx/ixp4xx-qmgr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/soc/ixp4xx/ixp4xx-qmgr.c +5 -4
@@ -145,12 +145,12 @@ static irqreturn_t qmgr_irq1_a0(int irq,/* ACK - it may clear any bits so don't rely on it */ __raw_writel (0xFFFFFFFF , &qmgr_regs->irqstat[0 ]); - en_bitmap = qmgr_regs->irqen[0 ]; + en_bitmap =__raw_readl (&qmgr_regs->irqen[0 ]);while (en_bitmap) { i =__fls (en_bitmap);/* number of the last "low" queue */ en_bitmap &= ~BIT (i); - src = qmgr_regs->irqsrc[i >>3 ]; - stat = qmgr_regs->stat1[i >>3 ]; + src =__raw_readl (&qmgr_regs->irqsrc[i >>3 ]); + stat =__raw_readl (&qmgr_regs->stat1[i >>3 ]);if (src &4 )/* the IRQ condition is inverted */ stat = ~stat;if (stat &BIT (src &3 )) {
@@ -170,7 +170,8 @@ static irqreturn_t qmgr_irq2_a0(int irq,/* ACK - it may clear any bits so don't rely on it */ __raw_writel (0xFFFFFFFF , &qmgr_regs->irqstat[1 ]); - req_bitmap = qmgr_regs->irqen[1 ] & qmgr_regs->statne_h; + req_bitmap =__raw_readl (&qmgr_regs->irqen[1 ]) & +__raw_readl (&qmgr_regs->statne_h);while (req_bitmap) { i =__fls (req_bitmap);/* number of the last "high" queue */ req_bitmap &= ~BIT (i);
Greg Kroah-Hartman
maintainerPATCH 123/135 perf/x86/amd: Dont touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
In reply to Greg Kroah-HartmanFrom: Like Xu <[email protected]>
commit df51fe7ea1c1c2c3bfdb81279712fdd2e4ea6c27 upstream.
If we use "perf record" in an AMD Milan guest, dmesg reports a #GP warning from an unchecked MSR access error on MSR_F15H_PERF_CTLx:
[] unchecked MSR access error: WRMSR to 0xc0010200 (tried to write 0x0000020000110076) at rIP: 0xffffffff8106ddb4 (native_write_msr+0x4/0x20) [] Call Trace:
[] amd_pmu_disable_event+0x22/0x90 [] x86_pmu_stop+0x4c/0xa0 [] x86_pmu_del+0x3a/0x140
The AMD64_EVENTSEL_HOSTONLY bit is defined and used on the host, while the guest perf driver should avoid such use.
--- arch/x86/events/perf_event.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/events/perf_event.h +2 -1
@@ -1009,9 +1009,10 @@ void x86_pmu_stop(struct perf_event *evestatic inline void x86_pmu_disable_event (struct perf_event *event) { +u64 disable_mask =__this_cpu_read (cpu_hw_events.perf_ctr_virt_mask);struct hw_perf_event *hwc = &event->hw; -wrmsrl (hwc->config_base, hwc->config); +wrmsrl (hwc->config_base, hwc->config & ~disable_mask);if (is_counter_pair (hwc))wrmsrl (x86_pmu_config_addr (hwc->idx +1 ),0 );
Greg Kroah-Hartman
maintainerPATCH 124/135 sched/rt: Fix double enqueue caused by rt_effective_prio
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit f558c2b834ec27e75d37b1c860c139e7b7c3a8e4 upstream.
Double enqueues in rt runqueues (list) have been reported while running a simple test that spawns a number of threads doing a short sleep/run pattern while being concurrently setscheduled between rt and fair class.
WARNING: CPU: 3 PID: 2825 at kernel/sched/rt.c:1294 enqueue_task_rt+0x355/0x360 CPU: 3 PID: 2825 Comm: setsched__13 RIP: 0010:enqueue_task_rt+0x355/0x360 Call Trace: __sched_setscheduler+0x581/0x9d0 _sched_setscheduler+0x63/0xa0 do_sched_setscheduler+0xa0/0x150 __x64_sys_sched_setscheduler+0x1a/0x30 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae
list_add double add: new=ffff9867cb629b40, prev=ffff9867cb629b40,
next=ffff98679fc67ca0. kernel BUG at lib/list_debug.c:31! invalid opcode: 0000 [#1] PREEMPT_RT SMP PTI CPU: 3 PID: 2825 Comm: setsched__13 RIP: 0010:__list_add_valid+0x41/0x50 Call Trace: enqueue_task_rt+0x291/0x360 __sched_setscheduler+0x581/0x9d0 _sched_setscheduler+0x63/0xa0 do_sched_setscheduler+0xa0/0x150 __x64_sys_sched_setscheduler+0x1a/0x30 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae
__sched_setscheduler() uses rt_effective_prio() to handle proper queuing of priority boosted tasks that are setscheduled while being boosted. rt_effective_prio() is however called twice per each __sched_setscheduler() call: first directly by __sched_setscheduler() before dequeuing the task and then by __setscheduler() to actually do the priority change. If the priority of the pi_top_task is concurrently being changed however, it might happen that the two calls return different results. If, for example, the first call returned the same rt priority the task was running at and the second one a fair priority, the task won't be removed by the rt list (on_list still set) and then enqueued in the fair runqueue. When eventually setscheduled back to rt it will be seen as enqueued already and the WARNING/BUG be issued.
Fix this by calling rt_effective_prio() only once and then reusing the return value. While at it refactor code as well for clarity. Concurrent priority inheritance handling is still safe and will eventually converge to a new state by following the inheritance chain(s).
--- kernel/sched/core.c | 90 ++++++++++++++++++++-------------------------------- 1 file changed, 35 insertions(+), 55 deletions(-)
kernel/sched/core.c +35 -55
@@ -1598,12 +1598,18 @@ void deactivate_task(struct rq *rq, strudequeue_task (rq, p, flags); } -/* -* __normal_prio - return the priority that is based on the static prio -*/ -static inline int __normal_prio (struct task_struct *p) +static inline int __normal_prio (int policy,int rt_prio,int nice) { -return p->static_prio; +int prio; + +if (dl_policy (policy)) + prio =MAX_DL_PRIO -1 ; +else if (rt_policy (policy)) + prio =MAX_RT_PRIO -1 - rt_prio; +else + prio =NICE_TO_PRIO (nice); + +return prio; }/*
@@ -1615,15 +1621,7 @@ static inline int __normal_prio(struct t*/ static inline int normal_prio (struct task_struct *p) { -int prio; - -if (task_has_dl_policy (p)) - prio =MAX_DL_PRIO -1 ; -else if (task_has_rt_policy (p)) - prio =MAX_RT_PRIO -1 - p->rt_priority; -else - prio =__normal_prio (p); -return prio; +return __normal_prio (p->policy, p->rt_priority,PRIO_TO_NICE (p->static_prio)); }/*
@@ -3248,7 +3246,7 @@ int sched_fork(unsigned long clone_flags }else if (PRIO_TO_NICE (p->static_prio) <0 ) p->static_prio =NICE_TO_PRIO (0 ); - p->prio = p->normal_prio =__normal_prio (p); + p->prio = p->normal_prio = p->static_prio;set_load_weight (p, false);/*
@@ -4799,6 +4797,18 @@ int default_wake_function(wait_queue_ent }EXPORT_SYMBOL (default_wake_function); +static void __setscheduler_prio (struct task_struct *p,int prio) +{ +if (dl_prio (prio)) + p->sched_class = &dl_sched_class; +else if (rt_prio (prio)) + p->sched_class = &rt_sched_class; +else + p->sched_class = &fair_sched_class; + + p->prio = prio; +} +#ifdef CONFIG_RT_MUTEXES static inline int __rt_effective_prio (struct task_struct *pi_task,int prio)
@@ -4914,22 +4924,19 @@ void rt_mutex_setprio(struct task_struct }else { p->dl.pi_se = &p->dl; } - p->sched_class = &dl_sched_class; }else if (rt_prio (prio)) {if (dl_prio (oldprio)) p->dl.pi_se = &p->dl;if (oldprio < prio) queue_flag |=ENQUEUE_HEAD ; - p->sched_class = &rt_sched_class; }else {if (dl_prio (oldprio)) p->dl.pi_se = &p->dl;if (rt_prio (oldprio)) p->rt.timeout =0 ; - p->sched_class = &fair_sched_class; } - p->prio = prio; +__setscheduler_prio (p, prio);if (queued)enqueue_task (rq, p, queue_flag);
@@ -5162,35 +5169,6 @@ static void __setscheduler_params(structset_load_weight (p, true); } -/* Actually do priority change: must hold pi & rq lock. */ -static void __setscheduler (struct rq *rq,struct task_struct *p, -const struct sched_attr *attr,bool keep_boost) -{ -/* -* If params can't change scheduling class changes aren't allowed -* either. -*/ -if (attr->sched_flags &SCHED_FLAG_KEEP_PARAMS ) -return ; - -__setscheduler_params (p, attr); - -/* -* Keep a potential priority boosting if called from -* sched_setscheduler(). -*/ - p->prio =normal_prio (p); -if (keep_boost) - p->prio =rt_effective_prio (p, p->prio); - -if (dl_prio (p->prio)) - p->sched_class = &dl_sched_class; -else if (rt_prio (p->prio)) - p->sched_class = &rt_sched_class; -else - p->sched_class = &fair_sched_class; -} -/* * Check the target process has a UID that matches the current process's: */
@@ -5211,10 +5189,8 @@ static int __sched_setscheduler(struct tconst struct sched_attr *attr, bool user, bool pi) { - int newprio = dl_policy(attr->sched_policy) ? MAX_DL_PRIO - 1 : -MAX_RT_PRIO -1 - attr->sched_priority; -int retval, oldprio, oldpolicy =-1 , queued, running; -int new_effective_prio, policy = attr->sched_policy; + int oldpolicy = -1, policy = attr->sched_policy; +int retval, oldprio, newprio, queued, running;const struct sched_class *prev_class;struct rq_flags rf;int reset_on_fork;
@@ -5412,6 +5388,7 @@ change: p->sched_reset_on_fork = reset_on_fork; oldprio = p->prio; + newprio =__normal_prio (policy, attr->sched_priority, attr->sched_nice);if (pi) {/* * Take priority boosted tasks into account. If the new
@@ -5420,8 +5397,8 @@ change:* the runqueue. This will be done when the task deboost * itself. */ - new_effective_prio =rt_effective_prio (p, newprio); -if (new_effective_prio == oldprio) + newprio =rt_effective_prio (p, newprio); +if (newprio == oldprio) queue_flags &= ~DEQUEUE_MOVE ; }
@@ -5434,7 +5411,10 @@ change: prev_class = p->sched_class; -__setscheduler (rq, p, attr, pi); +if (!(attr->sched_flags &SCHED_FLAG_KEEP_PARAMS )) { +__setscheduler_params (p, attr); +__setscheduler_prio (p, newprio); + }__setscheduler_uclamp (p, attr);if (queued) {
Greg Kroah-Hartman
maintainerPATCH 125/135 drm/i915: avoid uninitialised var in eb_parse()
In reply to Greg Kroah-HartmanFrom: Jonathan Gray <[email protected]>
The backport of c9d9fdbc108af8915d3f497bbdf3898bf8f321b8 to 5.10 in 6976f3cf34a1a8b791c048bbaa411ebfe48666b1 removed more than it should have leading to 'batch' being used uninitialised. The 5.13 backport and the mainline commit did not remove the portion this patch adds back.
--- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +7 -0
@@ -2351,6 +2351,12 @@ static int eb_parse(struct i915_execbuff eb->batch_flags |=I915_DISPATCH_SECURE ; } + batch =eb_dispatch_secure (eb, shadow); +if (IS_ERR (batch)) { + err =PTR_ERR (batch); + goto err_trampoline; + } + err = intel_engine_cmd_parser(eb->engine, eb->batch->vma, eb->batch_start_offset,
@@ -2377,6 +2383,7 @@ secure_batch: err_unpin_batch:if (batch)i915_vma_unpin (batch); +err_trampoline:if (trampoline)i915_vma_unpin (trampoline); err_shadow:
Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Hi!
Quoted 6 lines
From: Jonathan Gray <[email protected]>
The backport of
c9d9fdbc108af8915d3f497bbdf3898bf8f321b8to 5.10 in6976f3cf34a1a8b791c048bbaa411ebfe48666b1removed more than it should have leading to 'batch' being used uninitialised. The 5.13 backport and the mainline commit did not remove the portion this patch adds back.
This patch has no upstream equivalent, right?
Which is okay -- it explains it in plain english, but it shows that scripts should not simply search for anything that looks like SHA and treat it as upsteam commit it.
So let me re-iterate need for consistent marking of upstream commits.
So far this works reasonably well, but selecting one format and sticking to it would be even better.
ma = re.match(".*Upstream commit ([0-9a-f]*) .*", l) if ma:
m.upstream = ma.group(1)
ma = re.match("[Cc]ommit ([0-9a-f]*) upstream[.]*", l) if ma:
m.upstream = ma.group(1)
ma = re.match("[Cc]ommit: ([0-9a-f]*)", l) if ma:
m.upstream = ma.group(1)
Thanks and best regards,
Pavel
Quoted 33 lines
Signed-off-by Jonathan Gray <[email protected]>Fixes 6976f3cf34a1 ("drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser"")Cc <[email protected]> # 5.10Cc Jason Ekstrand <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 7 +++++++ 1 file changed, 7 insertions(+)drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +7
-0@@ -2351,6 +2351,12 @@ static int eb_parse(struct i915_execbuff eb->batch_flags |=I915_DISPATCH_SECURE ; } + batch =eb_dispatch_secure (eb, shadow); +if (IS_ERR (batch)) { + err =PTR_ERR (batch); + goto err_trampoline; + } + err = intel_engine_cmd_parser(eb->engine, eb->batch->vma, eb->batch_start_offset,@@ -2377,6 +2383,7 @@ secure_batch: err_unpin_batch:if (batch)i915_vma_unpin (batch); +err_trampoline:if (trampoline)i915_vma_unpin (trampoline); err_shadow:
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 9 lines · Pavel Machek
Hi!
Quoted 6 lines
From: Jonathan Gray <[email protected]>
The backport of
c9d9fdbc108af8915d3f497bbdf3898bf8f321b8to 5.10 in6976f3cf34a1a8b791c048bbaa411ebfe48666b1removed more than it should have leading to 'batch' being used uninitialised. The 5.13 backport and the mainline commit did not remove the portion this patch adds back.
Quoted 5 lines
This patch has no upstream equivalent, right?
Which is okay -- it explains it in plain english, but it shows that scripts should not simply search for anything that looks like SHA and treat it as upsteam commit it.
Sounds like you have a broken script if you do it that way.
good luck!
greg k-h
Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Pavel Machek
Hi!
Quoted 6 lines
From: Jonathan Gray <[email protected]>
The backport of
c9d9fdbc108af8915d3f497bbdf3898bf8f321b8to 5.10 in6976f3cf34a1a8b791c048bbaa411ebfe48666b1removed more than it should have leading to 'batch' being used uninitialised. The 5.13 backport and the mainline commit did not remove the portion this patch adds back.
Quoted 7 lines
Quoted 5 lines
This patch has no upstream equivalent, right?
Which is okay -- it explains it in plain english, but it shows that scripts should not simply search for anything that looks like SHA and treat it as upsteam commit it.
Sounds like you have a broken script if you do it that way.
That is what you told me to do!
https://lore.kernel.org/stable/[email protected]/
I would happily adapt my script, but there's no good/documented/working way to determine upstream commit given -stable commit.
If we could agree on
Commit: (SHA)
in the beggining of body, that would be great.
Upstream: (SHA)
in sign-off area would be even better.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 17 lines · Pavel Machek
Quoted 16 lines · Greg Kroah-Hartman
Quoted 14 lines · Pavel Machek
Hi!
Quoted 6 lines
From: Jonathan Gray <[email protected]>
The backport of
c9d9fdbc108af8915d3f497bbdf3898bf8f321b8to 5.10 in6976f3cf34a1a8b791c048bbaa411ebfe48666b1removed more than it should have leading to 'batch' being used uninitialised. The 5.13 backport and the mainline commit did not remove the portion this patch adds back.This patch has no upstream equivalent, right?
Which is okay -- it explains it in plain english, but it shows that scripts should not simply search for anything that looks like SHA and treat it as upsteam commit it.
Quoted 5 lines
Quoted 1 line
Sounds like you have a broken script if you do it that way.
That is what you told me to do!
Yes, which is fine for matching sha1 values.
Quoted 6 lines
I would happily adapt my script, but there's no good/documented/working way to determine upstream commit given -stable commit.
If we could agree on
Quoted 7 lines
Commit: (SHA)
in the beggining of body, that would be great.
Upstream: (SHA)
in sign-off area would be even better.
What exactly are you trying to do when you find a sha1? For some reason my scripts work just fine with a semi-free-form way that we currently have been doing this for the past 17+ years. What are you attempting to do that requires such a fixed format?
thanks,
greg k-h
Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Hi!
Quoted 13 lines
Quoted 13 lines
Quoted 13 lines
Quoted 12 lines
Quoted 6 lines
From: Jonathan Gray <[email protected]>
The backport of
c9d9fdbc108af8915d3f497bbdf3898bf8f321b8to 5.10 in6976f3cf34a1a8b791c048bbaa411ebfe48666b1removed more than it should have leading to 'batch' being used uninitialised. The 5.13 backport and the mainline commit did not remove the portion this patch adds back.This patch has no upstream equivalent, right?
Which is okay -- it explains it in plain english, but it shows that scripts should not simply search for anything that looks like SHA and treat it as upsteam commit it.
Quoted 7 lines
Quoted 5 lines
Quoted 1 line
Sounds like you have a broken script if you do it that way.
That is what you told me to do!
Yes, which is fine for matching sha1 values.
I'd really like reliable / automated way to tell upstream commit from given -stable commit.
Quoted 10 lines
Quoted 10 lines
I would happily adapt my script, but there's no good/documented/working way to determine upstream commit given -stable commit.
If we could agree on
Commit: (SHA)
in the beggining of body, that would be great.
Quoted 8 lines
Quoted 3 lines
Upstream: (SHA)
in sign-off area would be even better.
What exactly are you trying to do when you find a sha1? For some reason my scripts work just fine with a semi-free-form way that we currently have been doing this for the past 17+ years. What are you attempting to do that requires such a fixed format?
Is there any problem having a fixed format? You are producing -stable kernels, so you are not the one needing such functionality.
Anyway... We do reviews here, and we review patches on multiple branches (4.4, 4.19, 5.10). So I'm using scripts to group backports of the same patch together, for easier review and to flag patches that do not have upstream equivalent for extra review. (Example of the review file below)
There are other uses. When we were creating 5.10-cip branch, we used automatic scripts to verify that all patches from 4.19-cip are included in 5.10-cip. Determining mainline patch for given commit was essential for that.
Other use was actually suggested by you: you jokingly wanted to
replace CVE-XXX with mainline commit IDs. But that needs reliable way
to determine upstream commit from stable commit to work nicely.
(And yes, we are actually trying to maintain the mapping, see for
example
https://gitlab.com/cip-project/cip-kernel/cip-kernel-sec/-/blob/master/issues/CVE-2016-10147.yml )
Best regards,
Pavel
a |150198841 135cbd o: 5.10| spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay a |8916a8606 53ca18 o: 5.10| spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation v |2c32af963 5c0424 o: 5.10| scsi: sr: Return correct event when media event code is 3 v |671402b0e 5c0424 o: 4.19| scsi: sr: Return correct event when media event code is 3 a |a78c94304 5c0424 o: 4.4| scsi: sr: Return correct event when media event code is 3 v |9acc1f082 c592b4 o: 5.10| media: videobuf2-core: dequeue if start_streaming fails v |8f33cda2c c592b4 o: 4.19| media: videobuf2-core: dequeue if start_streaming fails a |f18813d9c c592b4 .: 4.4| media: videobuf2-core: dequeue if start_streaming fails a |da6c08058 36862c .: 5.10| ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM a |630677821 15f68f .: 5.10| ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM a |f84d7d425 7199dd .: 5.10| dmaengine: imx-dma: configure the generic DMA type to make it work a |e0188a8de d51c59 o: 5.10| net, gro: Set inner transport header offset in tcp/udp GRO hook a |72795b111 e11e86 .: 5.10| net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add a |0c548fae4 6c5fc1 .: 5.10| net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Hi Pavel,
Quoted 10 lines · Pavel Machek
Quoted 10 lines
Quoted 9 lines
If we could agree on
Commit: (SHA)
in the beggining of body, that would be great.
Upstream: (SHA)
in sign-off area would be even better.
Quoted 7 lines
Quoted 4 lines
What exactly are you trying to do when you find a sha1? For some reason my scripts work just fine with a semi-free-form way that we currently have been doing this for the past 17+ years. What are you attempting to do that requires such a fixed format?
Is there any problem having a fixed format? You are producing -stable kernels, so you are not the one needing such functionality.
When I was doing extended LTS in the past, I used to restart from Greg's closest branch (e.g. 4.4.y for latest 3.10.y) and needed exactly that. It was pretty easy in the end, as you'll essentially find two formats (one form from net and the other for the rest of the patches):
- commit XXXX upstream
- [ Upstream commit XXXX ]
I ended up writing this trivial script that did the job well for me and also supported the "git cherry-pick -x" format that I was using a lot. Feel free to reuse that as a starting point, here it comes, a bit covered in dust :-)
Willy
#!/bin/bash
die() {
[ "$#" -eq 0 ] || echo "$*" >&2
exit 1
}[ -n "$1" ] || die "Usage: ${0##*/} <commit>|<file>"
upstream=( )
if [ -s "$1" ]; then
upstream=( $(sed -n -e '/^$/,/^./s/^commit \([0-9a-f]*\) upstream\.$/\1/p' \
-e 's/^\[ Upstream commit \([0-9a-f]*\) \]$/\1/p' \
-e 's/^(cherry picked from commit \([0-9a-f]*\))/\1/p' "$1") )
else
upstream=( $(git log -1 --pretty --format=%B "$1" | \
sed -n -e '1,3s/^commit \([0-9a-f]*\) upstream\.$/\1/p' \
-e 's/^\[ Upstream commit \([0-9a-f]*\) \]$/\1/p' \
-e 's/^(cherry picked from commit \([0-9a-f]*\))/\1/p') )fi
[ "${#upstream[@]}" -gt 0 ] || die "No upstream commit ID found."
echo "${upstream[0]}"
Re: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 27 lines · Willy Tarreau
Hi Pavel,
Quoted 10 lines · Pavel Machek
Quoted 10 lines
Quoted 9 lines
If we could agree on
Commit: (SHA)
in the beggining of body, that would be great.
Upstream: (SHA)
in sign-off area would be even better.
Quoted 7 lines
Quoted 4 lines
What exactly are you trying to do when you find a sha1? For some reason my scripts work just fine with a semi-free-form way that we currently have been doing this for the past 17+ years. What are you attempting to do that requires such a fixed format?
Is there any problem having a fixed format? You are producing -stable kernels, so you are not the one needing such functionality.
When I was doing extended LTS in the past, I used to restart from Greg's closest branch (e.g. 4.4.y for latest 3.10.y) and needed exactly that. It was pretty easy in the end, as you'll essentially find two formats (one form from net and the other for the rest of the patches):
Quoted 7 lines
- commit XXXX upstream
- [ Upstream commit XXXX ]I ended up writing this trivial script that did the job well for me and also supported the "git cherry-pick -x" format that I was using a lot. Feel free to reuse that as a starting point, here it comes, a bit covered in dust :-)
Please see previous discussion. Yes, I have my regexps, too, but there are variations, and there were even false positives.. One of them is in this email thread.
Greg suggests to simply ignore context and look for SHA1 sum; that does not work, either.
So what I'm asking is for single, easy to parse format. I don't quite care what it is, but
Upstream: (SHA)
would be best.
Best regards,
Pavel
Quoted 26 lines
Willy
#!/bin/bash
die() { [ "$#" -eq 0 ] || echo "$*" >&2 exit 1 }[ -n "$1" ] || die "Usage: ${0##*/} <commit>|<file>"
upstream=( )
if [ -s "$1" ]; thenupstream=( $(sed -n -e '/^$/,/^./s/^commit \([0-9a-f]*\) upstream\.$/\1/p' \ -e 's/^\[ Upstream commit \([0-9a-f]*\) \]$/\1/p' \ -e 's/^(cherry picked from commit \([0-9a-f]*\))/\1/p' "$1") ) else upstream=( $(git log -1 --pretty --format=%B "$1" | \ sed -n -e '1,3s/^commit \([0-9a-f]*\) upstream\.$/\1/p' \ -e 's/^\[ Upstream commit \([0-9a-f]*\) \]$/\1/p' \ -e 's/^(cherry picked from commit \([0-9a-f]*\))/\1/p') )fi
[ "${#upstream[@]}" -gt 0 ] || die "No upstream commit ID found."
echo "${upstream[0]}"
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerRe: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 36 lines · Pavel Machek
Quoted 27 lines · Willy Tarreau
Hi Pavel,
Quoted 10 lines · Pavel Machek
Quoted 10 lines
Quoted 9 lines
If we could agree on
Commit: (SHA)
in the beggining of body, that would be great.
Upstream: (SHA)
in sign-off area would be even better.
Quoted 7 lines
Quoted 4 lines
What exactly are you trying to do when you find a sha1? For some reason my scripts work just fine with a semi-free-form way that we currently have been doing this for the past 17+ years. What are you attempting to do that requires such a fixed format?
Is there any problem having a fixed format? You are producing -stable kernels, so you are not the one needing such functionality.
When I was doing extended LTS in the past, I used to restart from Greg's closest branch (e.g. 4.4.y for latest 3.10.y) and needed exactly that. It was pretty easy in the end, as you'll essentially find two formats (one form from net and the other for the rest of the patches):
Quoted 7 lines
- commit XXXX upstream
- [ Upstream commit XXXX ]I ended up writing this trivial script that did the job well for me and also supported the "git cherry-pick -x" format that I was using a lot. Feel free to reuse that as a starting point, here it comes, a bit covered in dust :-)
Quoted 6 lines
Please see previous discussion. Yes, I have my regexps, too, but there are variations, and there were even false positives.. One of them is in this email thread.
Greg suggests to simply ignore context and look for SHA1 sum; that does not work, either.
The number of patches that your regex does not work on is a very tiny %, right? Can't you just handle those "by hand"?
Quoted 2 lines
So what I'm asking is for single, easy to parse format. I don't quite care what it is, but
As long as people end up sending us patches as backports, they will get the format wrong in odd ways over time. Heck, we can't even all get a simple signed-off-by: right all the time, look at the kernel logs for loads of issues where long-time developers mess that one up.
The phrase "perfect is the enemy of good" or something like that applies here. I'm giving you backported patches "for free", the number of ones that someone messes up the text on is so small it should be lost in the noise...
thanks,
greg k-h
Re: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 9 lines · Greg Kroah-Hartman
Quoted 9 lines
Quoted 4 lines
I ended up writing this trivial script that did the job well for me and also supported the "git cherry-pick -x" format that I was using a lot. Feel free to reuse that as a starting point, here it comes, a bit covered in dust :-)
Please see previous discussion. Yes, I have my regexps, too, but there are variations, and there were even false positives.. One of them is in this email thread.
Quoted 5 lines
Quoted 2 lines
Greg suggests to simply ignore context and look for SHA1 sum; that does not work, either.
The number of patches that your regex does not work on is a very tiny %, right? Can't you just handle those "by hand"?
I agree, that's what I used to do as well and this never caused me any particular difficult. The rare cases where the script emits no ID just have to be dealt with manually. It used to happen less than once per series (with series containing ~1k input patches). I'd say that the amount of failed backports is roughly in the same order of magnitude as the ones that could be missed this way, this needs to be put in perspective!
Quoted 7 lines
Quoted 2 lines
So what I'm asking is for single, easy to parse format. I don't quite care what it is, but
As long as people end up sending us patches as backports, they will get the format wrong in odd ways over time. Heck, we can't even all get a simple signed-off-by: right all the time, look at the kernel logs for loads of issues where long-time developers mess that one up.
Plus this adds some cognitive load on those writing these patches, which increases the global effort. It's already difficult enough to figure the appropriate Cc list when writing a fix, let's not add more burden in this chain.
Quoted 4 lines
The phrase "perfect is the enemy of good" or something like that applies here. I'm giving you backported patches "for free", the number of ones that someone messes up the text on is so small it should be lost in the noise...
I'm also defending this on other projects. I find it important that efforts are reasonably shared. If tolerating 1% failures saves 20% effort on authors and adds 2% work on recipients, that's a net global win. You never completely eliminate mistakes anyway, regardless of the cost.
Willy
Re: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 6 lines · Willy Tarreau
Plus this adds some cognitive load on those writing these patches, which increases the global effort. It's already difficult enough to figure the appropriate Cc list when writing a fix, let's not add more burden in this chain.
Quoted 7 lines
...
I'm also defending this on other projects. I find it important that efforts are reasonably shared. If tolerating 1% failures saves 20% effort on authors and adds 2% work on recipients, that's a net global win. You never completely eliminate mistakes anyway, regardless of the cost.
The only way I can see to square the circle would be if there was some kind of script that added enough value that people naturally use it because it saves *them* time, and it automatically inserts the right commit metadata in some kind of standardized way.
I've been starting to use b4, and that's a great example of a workflow that saves me time, and standardizes things as a very nice side effect. So perhaps the question is there some kind of automation that saves 10-20% effort for authors *and* improves the quality of the patch metadata for those that choose to use the script?
- Ted
Greg Kroah-Hartman
maintainerRe: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Quoted 20 lines · Theodore Ts'o
Quoted 6 lines · Willy Tarreau
Plus this adds some cognitive load on those writing these patches, which increases the global effort. It's already difficult enough to figure the appropriate Cc list when writing a fix, let's not add more burden in this chain.
Quoted 7 lines
...
I'm also defending this on other projects. I find it important that efforts are reasonably shared. If tolerating 1% failures saves 20% effort on authors and adds 2% work on recipients, that's a net global win. You never completely eliminate mistakes anyway, regardless of the cost.
The only way I can see to square the circle would be if there was some kind of script that added enough value that people naturally use it because it saves *them* time, and it automatically inserts the right commit metadata in some kind of standardized way.
Quoted 5 lines
I've been starting to use b4, and that's a great example of a workflow that saves me time, and standardizes things as a very nice side effect. So perhaps the question is there some kind of automation that saves 10-20% effort for authors *and* improves the quality of the patch metadata for those that choose to use the script?
A script/tool does generate the metadata in the "correct" way, as that is what Sasha and I use. It is the issue for when people do it on their own for various reasons and do not just point us at an upstream commit that can cause issues. In those cases, people wouldn't be using any script anyway, so there's nothing really to do here.
thanks,
greg k-h
Re: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Hi!
Quoted 24 lines
Quoted 18 lines
Quoted 5 lines
Plus this adds some cognitive load on those writing these patches, which increases the global effort. It's already difficult enough to figure the appropriate Cc list when writing a fix, let's not add more burden in this chain.
Quoted 7 lines
...
I'm also defending this on other projects. I find it important that efforts are reasonably shared. If tolerating 1% failures saves 20% effort on authors and adds 2% work on recipients, that's a net global win. You never completely eliminate mistakes anyway, regardless of the cost.
The only way I can see to square the circle would be if there was some kind of script that added enough value that people naturally use it because it saves *them* time, and it automatically inserts the right commit metadata in some kind of standardized way.
Quoted 5 lines
I've been starting to use b4, and that's a great example of a workflow that saves me time, and standardizes things as a very nice side effect. So perhaps the question is there some kind of automation that saves 10-20% effort for authors *and* improves the quality of the patch metadata for those that choose to use the script?
Quoted 5 lines
A script/tool does generate the metadata in the "correct" way, as that is what Sasha and I use. It is the issue for when people do it on their own for various reasons and do not just point us at an upstream commit that can cause issues. In those cases, people wouldn't be using any script anyway, so there's nothing really to do here.
I agree that submitters would need to know about the tag; OTOH I believe that if it looked like a tag, people would be more likely to get it right. We moved from "mention what this fixes in body" to "Fixes: " and I believe that was an improvement.
Anyway, three new entries in stable queues have format I have not seen before:
|ec547f971 None .: 4.19| KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) |dbfcc0f75 None o: 4.19| KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) |b79b08940 None o: 4.4| KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
[ upstream commit 0f923e07124df069ba68d8bb12324398f4b6b709 ]
I guess I'll simply update the script.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: Determining corresponding mainline patch for stable patches Re: [PATCH 5.10 125/135] drm/i915: avoid uninitialised var in eb_parse()
Hi Pavel,
Quoted 11 lines · Pavel Machek
I agree that submitters would need to know about the tag; OTOH I believe that if it looked like a tag, people would be more likely to get it right. We moved from "mention what this fixes in body" to "Fixes: " and I believe that was an improvement.
Anyway, three new entries in stable queues have format I have not seen before:
|ec547f971 None .: 4.19| KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) |dbfcc0f75 None o: 4.19| KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) |b79b08940 None o: 4.4| KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
I can't find these commits.
Quoted 1 line
[ upstream commit
0f923e07124df069ba68d8bb12324398f4b6b709]
I've seen them a few times, mostly in the bpf subsystem or in net components whose backports were provided later by the original patch authors (or users) trying to use the same format and using a different case on "upstream".
Quoted 1 line
I guess I'll simply update the script.
That's clearly how it ought to be done. Again, I don't remember having faced issues during 2.6.32/3.10 in the past using the trivial script I shared and which used to ignore the case, so I don't see any particular difficulty there :-/
Cheers,
Willy
Greg Kroah-Hartman
maintainerPATCH 126/135 libata: fix ata_pio_sector for CONFIG_HIGHMEM
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit ecef6a9effe49e8e2635c839020b9833b71e934c ]
Data transfers are not required to be block aligned in memory, so they span two pages. Fix this by splitting the call to >sff_data_xfer into two for that case.
This has been broken since the initial libata import before the damn of git, but was uncovered by the legacy ide driver removal.
--- drivers/ata/libata-sff.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-)
drivers/ata/libata-sff.c +27 -8
@@ -637,6 +637,20 @@ unsigned int ata_sff_data_xfer32(struct ata_queued_cmd *qc, unsigned char *buf, }EXPORT_SYMBOL_GPL (ata_sff_data_xfer32); +static void ata_pio_xfer (struct ata_queued_cmd *qc,struct page *page, +unsigned int offset,size_t xfer_size) +{ +bool do_write = (qc->tf.flags &ATA_TFLAG_WRITE ); +unsigned char *buf; + + buf =kmap_atomic (page); + qc->ap->ops->sff_data_xfer (qc, buf + offset, xfer_size, do_write); +kunmap_atomic (buf); + +if (!do_write && !PageSlab (page)) +flush_dcache_page (page); +} +/** * ata_pio_sector - Transfer a sector of data. * @qc: Command on going
@@ -648,11 +662,9 @@ EXPORT_SYMBOL_GPL(ata_sff_data_xfer32);*/ static void ata_pio_sector (struct ata_queued_cmd *qc) { -int do_write = (qc->tf.flags &ATA_TFLAG_WRITE );struct ata_port *ap = qc->ap;struct page *page;unsigned int offset; -unsigned char *buf;if (!qc->cursg) { qc->curbytes = qc->nbytes;
@@ -670,13 +682,20 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)DPRINTK ("data %s\n" , qc->tf.flags &ATA_TFLAG_WRITE ?"write" :"read" ); -/* do the actual data transfer */ - buf =kmap_atomic (page); - ap->ops->sff_data_xfer (qc, buf + offset, qc->sect_size, do_write); -kunmap_atomic (buf); +/* +* Split the transfer when it splits a page boundary. Note that the +* split still has to be dword aligned like all ATA data transfers. +*/ +WARN_ON_ONCE (offset %4 ); +if (offset + qc->sect_size >PAGE_SIZE ) { +unsigned int split_len =PAGE_SIZE - offset; -if (!do_write && !PageSlab (page)) -flush_dcache_page (page); +ata_pio_xfer (qc, page, offset, split_len); +ata_pio_xfer (qc,nth_page (page,1 ),0 , + qc->sect_size - split_len); + }else { +ata_pio_xfer (qc, page, offset, qc->sect_size); + } qc->curbytes += qc->sect_size; qc->cursg_ofs += qc->sect_size;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 127/135 reiserfs: add check for root_inode in reiserfs_fill_super
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 2acf15b94d5b8ea8392c4b6753a6ffac3135cd78 ]
Our syzcaller report a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 116e95067 P4D 116e95067 PUD 1080b5067 PMD 0 Oops: 0010 [#1] SMP KASAN CPU: 7 PID: 592 Comm: a.out Not tainted 5.13.0-next-20210629-dirty #67 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffff888114e779b8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff110229cef39 RCX: ffffffffaa67e1aa RDX: 0000000000000000 RSI: ffff88810a58ee00 RDI: ffff8881233180b0 RBP: ffffffffac38e9c0 R08: ffffffffaa67e17e R09: 0000000000000001 R10: ffffffffb91c5557 R11: fffffbfff7238aaa R12: ffff88810a58ee00 R13: ffff888114e77aa0 R14: 0000000000000000 R15: ffff8881233180b0 FS: 00007f946163c480(0000) GS:ffff88839f1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001099c1000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __lookup_slow+0x116/0x2d0 ? page_put_link+0x120/0x120 ? __d_lookup+0xfc/0x320 ? d_lookup+0x49/0x90 lookup_one_len+0x13c/0x170 ? __lookup_slow+0x2d0/0x2d0 ? reiserfs_schedule_old_flush+0x31/0x130 reiserfs_lookup_privroot+0x64/0x150 reiserfs_fill_super+0x158c/0x1b90 ? finish_unfinished+0xb10/0xb10 ? bprintf+0xe0/0xe0 ? __mutex_lock_slowpath+0x30/0x30 ? __kasan_check_write+0x20/0x30 ? up_write+0x51/0xb0 ? set_blocksize+0x9f/0x1f0 mount_bdev+0x27c/0x2d0 ? finish_unfinished+0xb10/0xb10 ? reiserfs_kill_sb+0x120/0x120 get_super_block+0x19/0x30 legacy_get_tree+0x76/0xf0 vfs_get_tree+0x49/0x160 ? capable+0x1d/0x30 path_mount+0xacc/0x1380 ? putname+0x97/0xd0 ? finish_automount+0x450/0x450 ? kmem_cache_free+0xf8/0x5a0 ? putname+0x97/0xd0 do_mount+0xe2/0x110 ? path_mount+0x1380/0x1380 ? copy_mount_options+0x69/0x140 __x64_sys_mount+0xf0/0x190 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae
This is because 'root_inode' is initialized with wrong mode, and it's i_op is set to 'reiserfs_special_inode_operations'. Thus add check for 'root_inode' to fix the problem.
--- fs/reiserfs/super.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/reiserfs/super.c +8 -0
@@ -2082,6 +2082,14 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)unlock_new_inode (root_inode); } +if (!S_ISDIR (root_inode->i_mode) || !inode_get_bytes (root_inode) || + !root_inode->i_size) { +SWARN (silent, s,"" ,"corrupt root inode, run fsck" ); +iput (root_inode); + errval = -EUCLEAN ; + goto error; + } + s->s_root =d_make_root (root_inode);if (!s->s_root) goto error;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 128/135 reiserfs: check directory items on read from disk
In reply to Greg Kroah-HartmanFrom: Shreyansh Chouhan <[email protected]>
[ Upstream commit 13d257503c0930010ef9eed78b689cec417ab741 ]
While verifying the leaf item that we read from the disk, reiserfs doesn't check the directory items, this could cause a crash when we read a directory item from the disk that has an invalid deh_location.
This patch adds a check to the directory items read from the disk that does a bounds check on deh_location for the directory entries. Any directory entry header with a directory entry offset greater than the item length is considered invalid.
--- fs/reiserfs/stree.c | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-)
fs/reiserfs/stree.c +26 -5
@@ -387,6 +387,24 @@ void pathrelse(struct treepath *search_path) search_path->path_length =ILLEGAL_PATH_ELEMENT_OFFSET ; } +static int has_valid_deh_location (struct buffer_head *bh,struct item_head *ih) +{ +struct reiserfs_de_head *deh; +int i; + + deh =B_I_DEH (bh, ih); +for (i =0 ; i <ih_entry_count (ih); i++) { +if (deh_location (&deh[i]) >ih_item_len (ih)) { +reiserfs_warning (NULL ,"reiserfs-5094" , +"directory entry location seems wrong %h" , + &deh[i]); +return 0 ; + } + } + +return 1 ; +} +static int is_leaf (char *buf,int blocksize,struct buffer_head *bh) {struct block_head *blkh;
@@ -454,11 +472,14 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) "(second one): %h", ih);return 0 ; } -if (is_direntry_le_ih (ih) && (ih_item_len (ih) < (ih_entry_count (ih) *IH_SIZE ))) { -reiserfs_warning (NULL ,"reiserfs-5093" , -"item entry count seems wrong %h" , - ih); -return 0 ; +if (is_direntry_le_ih (ih)) { +if (ih_item_len (ih) < (ih_entry_count (ih) *IH_SIZE )) { +reiserfs_warning (NULL ,"reiserfs-5093" , +"item entry count seems wrong %h" , + ih); +return 0 ; + } +return has_valid_deh_location (bh, ih); } prev_location =ih_location (ih); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 129/135 virt_wifi: fix error on connect
In reply to Greg Kroah-HartmanFrom: Matteo Croce <[email protected]>
[ Upstream commit 17109e9783799be2a063b2bd861a508194b0a487 ]
When connecting without first doing a scan, the BSS list is empty and __cfg80211_connect_result() generates this warning:
$ iw dev wlan0 connect -w VirtWifi [ 15.371989] ------------[ cut here ]------------ [ 15.372179] WARNING: CPU: 0 PID: 92 at net/wireless/sme.c:756 __cfg80211_connect_result+0x402/0x440 [ 15.372383] CPU: 0 PID: 92 Comm: kworker/u2:2 Not tainted 5.13.0-kvm #444 [ 15.372512] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-3.fc34 04/01/2014 [ 15.372597] Workqueue: cfg80211 cfg80211_event_work [ 15.372756] RIP: 0010:__cfg80211_connect_result+0x402/0x440 [ 15.372818] Code: 48 2b 04 25 28 00 00 00 75 59 48 8b 3b 48 8b 76 10 48 8d 65 e0 5b 41 5c 41 5d 41 5e 5d 49 8d 65 f0 41 5d e9 d0 d4 fd ff 0f 0b <0f> 0b e9 f6 fd ff ff e8 f2 4a b4 ff e9 ec fd ff ff 0f 0b e9 19 fd [ 15.372966] RSP: 0018:ffffc900005cbdc0 EFLAGS: 00010246 [ 15.373022] RAX: 0000000000000000 RBX: ffff8880028e2400 RCX: ffff8880028e2472 [ 15.373088] RDX: 0000000000000002 RSI: 00000000fffffe01 RDI: ffffffff815335ba [ 15.373149] RBP: ffffc900005cbe00 R08: 0000000000000008 R09: ffff888002bdf8b8 [ 15.373209] R10: ffff88803ec208f0 R11: ffffffffffffe9ae R12: ffff88801d687d98 [ 15.373280] R13: ffff88801b5fe000 R14: ffffc900005cbdc0 R15: dead000000000100 [ 15.373330] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 15.373382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 15.373425] CR2: 000056421c468958 CR3: 000000001b458001 CR4: 0000000000170eb0 [ 15.373478] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 15.373529] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 15.373580] Call Trace: [ 15.373611] ? cfg80211_process_wdev_events+0x10e/0x170 [ 15.373743] cfg80211_process_wdev_events+0x10e/0x170 [ 15.373783] cfg80211_process_rdev_events+0x21/0x40 [ 15.373846] cfg80211_event_work+0x20/0x30 [ 15.373892] process_one_work+0x1e9/0x340 [ 15.373956] worker_thread+0x4b/0x3f0 [ 15.374017] ? process_one_work+0x340/0x340 [ 15.374053] kthread+0x11f/0x140 [ 15.374089] ? set_kthread_struct+0x30/0x30 [ 15.374153] ret_from_fork+0x1f/0x30 [ 15.374187] ---[ end trace 321ef0cb7e9c0be1 ]--- wlan0 (phy #0): connected to 00:00:00:00:00:00
Add the fake bss just before the connect so that cfg80211_get_bss() finds the virtual network.
As some code was duplicated, move it in a common function.
--- drivers/net/wireless/virt_wifi.c | 52 ++++++++++++++++++++------------ 1 file changed, 32 insertions(+), 20 deletions(-)
drivers/net/wireless/virt_wifi.c +32 -20
@@ -136,6 +136,29 @@ static struct ieee80211_supported_band band_5ghz = {/* Assigned at module init. Guaranteed locally-administered and unicast. */ static u8 fake_router_bssid[ETH_ALEN ]__ro_after_init = {}; +static void virt_wifi_inform_bss (struct wiphy *wiphy) +{ +u64 tsf =div_u64 (ktime_get_boottime_ns (),1000 ); +struct cfg80211_bss *informed_bss; +static const struct { +u8 tag; +u8 len; +u8 ssid[8 ]; + } __packed ssid = { + .tag =WLAN_EID_SSID , + .len =8 , + .ssid ="VirtWifi" , + }; + + informed_bss =cfg80211_inform_bss (wiphy, &channel_5ghz, +CFG80211_BSS_FTYPE_PRESP , + fake_router_bssid, tsf, +WLAN_CAPABILITY_ESS ,0 , + (void *)&ssid,sizeof (ssid), +DBM_TO_MBM (-50 ),GFP_KERNEL ); +cfg80211_put_bss (wiphy, informed_bss); +} +/* Called with the rtnl lock held. */ static int virt_wifi_scan (struct wiphy *wiphy,struct cfg80211_scan_request *request)
@@ -156,28 +179,13 @@ static int virt_wifi_scan(struct wiphy *wiphy,/* Acquires and releases the rdev BSS lock. */ static void virt_wifi_scan_result (struct work_struct *work) { -struct { -u8 tag; -u8 len; -u8 ssid[8 ]; - } __packed ssid = { - .tag =WLAN_EID_SSID , .len =8 , .ssid ="VirtWifi" , - }; -struct cfg80211_bss *informed_bss;struct virt_wifi_wiphy_priv *priv = container_of(work, struct virt_wifi_wiphy_priv, scan_result.work);struct wiphy *wiphy =priv_to_wiphy (priv);struct cfg80211_scan_info scan_info = { .aborted = false }; -u64 tsf =div_u64 (ktime_get_boottime_ns (),1000 ); - informed_bss =cfg80211_inform_bss (wiphy, &channel_5ghz, -CFG80211_BSS_FTYPE_PRESP , - fake_router_bssid, tsf, -WLAN_CAPABILITY_ESS ,0 , - (void *)&ssid,sizeof (ssid), -DBM_TO_MBM (-50 ),GFP_KERNEL ); -cfg80211_put_bss (wiphy, informed_bss); +virt_wifi_inform_bss (wiphy);/* Schedules work which acquires and releases the rtnl lock. */ cfg80211_scan_done (priv->scan_request, &scan_info);
@@ -225,10 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev,if (!could_schedule)return -EBUSY ; -if (sme->bssid) +if (sme->bssid) {ether_addr_copy (priv->connect_requested_bss, sme->bssid); -else + }else { +virt_wifi_inform_bss (wiphy);eth_zero_addr (priv->connect_requested_bss); + }wiphy_debug (wiphy,"connect\n" );
@@ -241,11 +251,13 @@ static void virt_wifi_connect_complete(struct work_struct *work)struct virt_wifi_netdev_priv *priv = container_of(work, struct virt_wifi_netdev_priv, connect.work);u8 *requested_bss = priv->connect_requested_bss; -bool has_addr = !is_zero_ether_addr (requested_bss);bool right_addr =ether_addr_equal (requested_bss, fake_router_bssid);u16 status =WLAN_STATUS_SUCCESS ; -if (!priv->is_up || (has_addr && !right_addr)) +if (is_zero_ether_addr (requested_bss)) + requested_bss =NULL ; + +if (!priv->is_up || (requested_bss && !right_addr)) status =WLAN_STATUS_UNSPECIFIED_FAILURE ;else priv->is_connected = true;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 130/135 net: qede: Fix end of loop tests for list_for_each_entry
In reply to Greg Kroah-HartmanFrom: Harshvardhan Jha <[email protected]>
[ Upstream commit 795e3d2ea68e489ee7039ac29e98bfea0e34a96c ]
The list_for_each_entry() iterator, "vlan" in this code, can never be NULL so the warning will never be printed.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -2
@@ -831,7 +831,7 @@ int qede_configure_vlan_filters(struct qede_dev *edev)int qede_vlan_rx_kill_vid (struct net_device *dev,__be16 proto,u16 vid) {struct qede_dev *edev =netdev_priv (dev); -struct qede_vlan *vlan =NULL ; +struct qede_vlan *vlan;int rc =0 ;DP_VERBOSE (edev,NETIF_MSG_IFDOWN ,"Removing vlan 0x%04x\n" , vid);
@@ -842,7 +842,7 @@ int qede_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)if (vlan->vid == vid)break ; -if (!vlan || (vlan->vid != vid)) { +if (list_entry_is_head (vlan, &edev->vlan_list, list)) {DP_VERBOSE (edev, (NETIF_MSG_IFUP |NETIF_MSG_IFDOWN ),"Vlan isn't configured\n" ); goto out;
Signature · 1 line
2.30.2
Re: [PATCH 5.10 130/135] net: qede: Fix end of loop tests for list_for_each_entry
Hi!
Quoted 4 lines
[ Upstream commit
795e3d2ea68e489ee7039ac29e98bfea0e34a96c]The
list_for_each_entry()iterator, "vlan" in this code, can never be NULL so the warning will never be printed.
Could someone double-check this? Because changelog is not accurate; condition is using logical or, so warning can be printed. I don't really see a bug with the old code.
New code is quite confusing, and if the vlan with required vic is the "head" one, it will do the wrong thing, no?
Best regards,
Pavel
Quoted 10 lines
+++
b/drivers/net/ethernet/qlogic/qede/qede_filter.cdrivers/net/ethernet/qlogic/qede/qede_filter.c +1
-1@@ -842,7 +842,7 @@ int qede_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)if (vlan->vid == vid)break ; -if (!vlan || (vlan->vid != vid)) { +if (list_entry_is_head (vlan, &edev->vlan_list, list)) {DP_VERBOSE (edev, (NETIF_MSG_IFUP |NETIF_MSG_IFDOWN ),"Vlan isn't configured\n" ); goto out;
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 131/135 alpha: Send stop IPI to send to online CPUs
In reply to Greg Kroah-HartmanFrom: Prarit Bhargava <[email protected]>
[ Upstream commit caace6ca4e06f09413fb8f8a63319594cfb7d47d ]
This issue was noticed while debugging a shutdown issue where some secondary CPUs are not being shutdown correctly. A fix for that [1] requires that secondary cpus be offlined using the cpu_online_mask so that the stop operation is a no-op if CPU HOTPLUG is disabled. I, like the author in
[1] looked at the architectures and found that alpha is one of two architectures that executes smp_send_stop() on all possible CPUs.
On alpha, smp_send_stop() sends an IPI to all possible CPUs but only needs to send them to online CPUs.
Send the stop IPI to only the online CPUs.
[1] https://lkml.org/lkml/2020/1/10/250
--- arch/alpha/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/alpha/kernel/smp.c +1 -1
@@ -582,7 +582,7 @@ voidsmp_send_stop (void) {cpumask_t to_whom; -cpumask_copy (&to_whom, cpu_possible_mask); +cpumask_copy (&to_whom, cpu_online_mask);cpumask_clear_cpu (smp_processor_id (), &to_whom);#ifdef DEBUG_IPI_MSG if (hard_smp_processor_id () != boot_cpu_id)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 132/135 net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
In reply to Greg Kroah-HartmanFrom: Letu Ren <[email protected]>
[ Upstream commit 92766c4628ea349c8ddab0cd7bd0488f36e5c4ce ]
When calling the 'ql_wait_for_drvr_lock' and 'ql_adapter_reset', the driver has already acquired the spin lock, so the driver should not call 'ssleep' in atomic context.
This bug can be fixed by using 'mdelay' instead of 'ssleep'.
--- drivers/net/ethernet/qlogic/qla3xxx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qla3xxx.c +3 -3
@@ -154,7 +154,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev) "driver lock acquired\n");return 1 ; } -ssleep (1 ); +mdelay (1000 ); }while (++i <10 );netdev_err (qdev->ndev,"Timed out waiting for driver lock...\n" );
@@ -3290,7 +3290,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev)if ((value &ISP_CONTROL_SR ) ==0 )break ; -ssleep (1 ); +mdelay (1000 ); }while ((--max_wait_time));/*
@@ -3326,7 +3326,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev) ispControlStatus);if ((value &ISP_CONTROL_FSR ) ==0 )break ; -ssleep (1 ); +mdelay (1000 ); }while ((--max_wait_time)); }if (max_wait_time ==0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 133/135 smb3: rc uninitialized in one fallocate path
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
[ Upstream commit 5ad4df56cd2158965f73416d41fce37906724822 ]
Clang detected a problem with rc possibly being unitialized (when length is zero) in a recently added fallocate code path.
--- fs/cifs/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cifs/smb2ops.c +2 -1
@@ -3466,7 +3466,8 @@ static int smb3_simple_fallocate_write_range(unsigned int xid, char *buf) {struct cifs_io_parms io_parms = {0 }; -int rc, nbytes; +int nbytes; +int rc =0 ;struct kvec iov[2 ]; io_parms.netfid = cfile->fid.netfid;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 134/135 drm/amdgpu/display: only enable aux backlight control for OLED panels
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
[ Upstream commit f2ad3accefc63e72e9932e141c21875cc04beec8 ]
We've gotten a number of reports about backlight control not working on panels which indicate that they use aux backlight control. A recent patch:
commit 2d73eabe2984a435737498ab39bb1500a9ffe9a9
Author: Camille Cho <[email protected]> Date: Thu Jul 8 18:28:37 2021 +0800
drm/amd/display: Only set default brightness for OLED
[Why]
We used to unconditionally set backlight path as AUX for panels capable of backlight adjustment via DPCD in set default brightness.
[How]
This should be limited to OLED panel only since we control backlight via PWM path for SDR mode in LCD HDR panel.
Changes some other code to only use aux for backlight control on OLED panels. The commit message seems to indicate that PWM should be used for SDR mode on HDR panels. Do something similar for backlight control in general. This may need to be revisited if and when HDR started to get used.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -2
@@ -2162,9 +2162,9 @@ static void update_connector_ext_caps(st max_cll = conn_base->hdr_sink_metadata.hdmi_type1.max_cll; min_cll = conn_base->hdr_sink_metadata.hdmi_type1.min_cll; -if (caps->ext_caps->bits.oled ==1 || +if (caps->ext_caps->bits.oled ==1 /*|| caps->ext_caps->bits.sdr_aux_backlight_control == 1 || - caps->ext_caps->bits.hdr_aux_backlight_control ==1 ) +caps->ext_caps->bits.hdr_aux_backlight_control == 1*/ ) caps->aux_support = true;if (amdgpu_backlight ==0 )
Greg Kroah-Hartman
maintainerPATCH 135/135 arm64: fix compat syscall return truncation
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit e30e8d46cf605d216a799a28c77b8a41c328613a upstream.
Due to inconsistencies in the way we manipulate compat GPRs, we have a few issues today:
* For audit and tracing, where error codes are handled as a (native) long, negative error codes are expected to be sign-extended to the native 64-bits, or they may fail to be matched correctly. Thus a syscall which fails with an error may erroneously be identified as failing.
* For ptrace, *all* compat return values should be sign-extended for consistency with 32-bit arm, but we currently only do this for negative return codes.
* As we may transiently set the upper 32 bits of some compat GPRs while in the kernel, these can be sampled by perf, which is somewhat confusing. This means that where a syscall returns a pointer above 2G, this will be sign-extended, but will not be mistaken for an error as error codes are constrained to the inclusive range [-4096, -1] where no user pointer can exist.
To fix all of these, we must consistently use helpers to get/set the compat GPRs, ensuring that we never write the upper 32 bits of the return code, and always sign-extend when reading the return code. This patch does so, with the following changes:
* We re-organise syscall_get_return_value() to always sign-extend for compat tasks, and reimplement syscall_get_error() atop. We update syscall_trace_exit() to use syscall_get_return_value().
* We consistently use syscall_set_return_value() to set the return value, ensureing the upper 32 bits are never set unexpectedly.
* As the core audit code currently uses regs_return_value() rather than syscall_get_return_value(), we special-case this for compat_user_mode(regs) such that this will do the right thing. Going forward, we should try to move the core audit code over to syscall_get_return_value().
--- arch/arm64/include/asm/ptrace.h | 12 +++++++++++- arch/arm64/include/asm/syscall.h | 19 ++++++++++--------- arch/arm64/kernel/ptrace.c | 2 +- arch/arm64/kernel/signal.c | 3 ++- arch/arm64/kernel/syscall.c | 9 +++------ 5 files changed, 27 insertions(+), 18 deletions(-)
arch/arm64/include/asm/ptrace.h +11 -1
@@ -316,7 +316,17 @@ static inline unsigned long kernel_stackstatic inline unsigned long regs_return_value (struct pt_regs *regs) { -return regs->regs[0 ]; +unsigned long val = regs->regs[0 ]; + +/* +* Audit currently uses regs_return_value() instead of +* syscall_get_return_value(). Apply the same sign-extension here until +* audit is updated to use syscall_get_return_value(). +*/ +if (compat_user_mode (regs)) + val =sign_extend64 (val,31 ); + +return val; }static inline void regs_set_return_value (struct pt_regs *regs,unsigned long rc)
arch/arm64/include/asm/syscall.h +10 -9
@@ -29,22 +29,23 @@ static inline void syscall_rollback(stru regs->regs[0 ] = regs->orig_x0; } - -static inline long syscall_get_error (struct task_struct *task, -struct pt_regs *regs) +static inline long syscall_get_return_value (struct task_struct *task, +struct pt_regs *regs) { -unsigned long error = regs->regs[0 ]; +unsigned long val = regs->regs[0 ];if (is_compat_thread (task_thread_info (task))) - error =sign_extend64 (error,31 ); + val =sign_extend64 (val,31 ); -return IS_ERR_VALUE (error) ? error :0 ; +return val; } -static inline long syscall_get_return_value (struct task_struct *task, -struct pt_regs *regs) +static inline long syscall_get_error (struct task_struct *task, +struct pt_regs *regs) { -return regs->regs[0 ]; +unsigned long error =syscall_get_return_value (task, regs); + +return IS_ERR_VALUE (error) ? error :0 ; } static inline void syscall_set_return_value(struct task_struct *task,
arch/arm64/kernel/ptrace.c +1 -1
@@ -1823,7 +1823,7 @@ void syscall_trace_exit(struct pt_regs *audit_syscall_exit (regs);if (flags & _TIF_SYSCALL_TRACEPOINT) -trace_sys_exit (regs,regs_return_value (regs)); +trace_sys_exit (regs,syscall_get_return_value (current, regs));if (flags & (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP))tracehook_report_syscall (regs,PTRACE_SYSCALL_EXIT );
arch/arm64/kernel/signal.c +2 -1
@@ -29,6 +29,7 @@#include <asm/unistd.h> #include <asm/fpsimd.h> #include <asm/ptrace.h> +#include <asm/syscall.h> #include <asm/signal32.h> #include <asm/traps.h> #include <asm/vdso.h>
@@ -890,7 +891,7 @@ static void do_signal(struct pt_regs *re retval == -ERESTART_RESTARTBLOCK || (retval == -ERESTARTSYS && !(ksig.ka.sa.sa_flags & SA_RESTART)))) { - regs->regs[0 ] = -EINTR ; +syscall_set_return_value (current, regs, -EINTR ,0 ); regs->pc = continue_addr; }
arch/arm64/kernel/syscall.c +3 -6
@@ -50,10 +50,7 @@ static void invoke_syscall(struct pt_reg ret =do_ni_syscall (regs, scno); } -if (is_compat_task ()) - ret =lower_32_bits (ret); - - regs->regs[0 ] = ret; +syscall_set_return_value (current, regs,0 , ret); }static inline bool has_syscall_work (unsigned long flags)
@@ -128,7 +125,7 @@ static void el0_svc_common(struct pt_reg* syscall. do_notify_resume() will send a signal to userspace * before the syscall is restarted. */ - regs->regs[0 ] = -ERESTARTNOINTR ; +syscall_set_return_value (current, regs, -ERESTARTNOINTR ,0 );return ; }
@@ -149,7 +146,7 @@ static void el0_svc_common(struct pt_reg* anyway. */ if (scno ==NO_SYSCALL ) - regs->regs[0 ] = -ENOSYS ; +syscall_set_return_value (current, regs, -ENOSYS ,0 ); scno =syscall_trace_enter (regs);if (scno ==NO_SYSCALL ) goto trace_exit;
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.58-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
5.10.58-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.58-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Tested on arm64 and x86 for 5.10.58-rc1,
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.58-rc1
Commit: b04ed4b2e724be0ecb9ddff01abd637b467eb33c
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8907
passed: 8907
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8907
passed: 8907
failed: 0
timeout: 0
--------------------------------------------------------------------
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
Build test:
mips (gcc version 11.1.1 20210723): 63 configs -> no failure arm (gcc version 11.1.1 20210723): 105 configs -> no new failure arm64 (gcc version 11.1.1 20210723): 3 configs -> no failure x86_64 (gcc version 10.2.1 20210110): 4 configs -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
[1]. https://openqa.qa.codethink.co.uk/tests/20
[2]. https://openqa.qa.codethink.co.uk/tests/23
--
Regards
Sudip
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.58-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.10.58-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.10.y
* git commit: 252d84386e003502ea789f777bda459363174184
* git describe: v5.10.57-136-g252d84386e00
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.57-136-g252d84386e00
## No regressions (compared to v5.10.57-126-gb04ed4b2e724)
## No fixes (compared to v5.10.57-126-gb04ed4b2e724)
## Test result summary
total: 82063, pass: 67049, fail: 2170, skip: 11566, xfail: 1278
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 193 total, 193 passed, 0 failed
* arm64: 27 total, 27 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 26 total, 26 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 45 total, 45 passed, 0 failed
* parisc: 9 total, 9 passed, 0 failed
* powerpc: 27 total, 27 passed, 0 failed
* riscv: 21 total, 21 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 18 total, 18 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 27 total, 27 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-
* kselftest-android
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-vsyscall-mode-native-
* kselftest-vsyscall-mode-none-
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* prep-tmp-disk
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
Build results:
total: 159 pass: 159 fail: 0 Qemu test results: total: 472 pass: 472 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.58-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Aug 2021 17:29:30 +0000. Anything received after that time might be too late.
Compiled, booted and tested with no regressions
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 5.10.58 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any kernel problems here: (but we have some problems with test infrastructure)
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany