5.4.148-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 5.4.148-rc1 review
This is the start of the stable review cycle for the 5.4.148 release. There are 260 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Sep 2021 16:38:49 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.148-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.148-rc1
Yoshihiro Shimoda <[email protected]>
net: renesas: sh_eth: Fix freeing wrong tx descriptor
Willem de Bruijn <[email protected]>
ip_gre: validate csum_start only on pull
Dinghao Liu <[email protected]>
qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
Eric Dumazet <[email protected]>
fq_codel: reject silly quantum parameters
Benjamin Hesmans <[email protected]>
netfilter: socket: icmp6: fix use-after-scope
Rafał Miłecki <[email protected]>
net: dsa: b53: Fix calculating number of switch ports
Li Huafei <[email protected]>
perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64}Randy Dunlap <[email protected]>
ARC: export clear_user_page() for modules
Christophe JAILLET <[email protected]>
mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
Andy Shevchenko <[email protected]>
PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
Oliver Upton <[email protected]>
KVM: arm64: Handle PSCI resets before userspace touches vCPU state
Matthias Schiffer <[email protected]>
mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
Dan Carpenter <[email protected]>
PCI: Fix pci_dev_str_match_path() alloc while atomic bug
Hans de Goede <[email protected]>
mfd: axp20x: Update AXP288 volatile ranges
Yang Li <[email protected]>
NTB: perf: Fix an error code in perf_setup_inbuf()
Yang Li <[email protected]>
NTB: Fix an error code in ntb_msit_probe()
Yang Li <[email protected]>
ethtool: Fix an error code in cxgb2.c
Vishal Aslot <[email protected]>
PCI: ibmphp: Fix double unmap of io_mem
Paolo Valente <[email protected]>
block, bfq: honor already-setup queue merges
Daniele Palmas <[email protected]>
net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
Ryoga Saito <[email protected]>
Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6
George Cherian <[email protected]>
PCI: Add ACS quirks for Cavium multi-function devices
Masami Hiramatsu <[email protected]>
tracing/probes: Reject events which have the same name of existing one
Marc Zyngier <[email protected]>
mfd: Don't use irq_create_mapping() to resolve a mapping
Miklos Szeredi <[email protected]>
fuse: fix use after free in fuse_read_interrupt()
Wasim Khan <[email protected]>
PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms
Linus Walleij <[email protected]>
mfd: db8500-prcmu: Adjust map to reality
Miquel Raynal <[email protected]>
dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
David Hildenbrand <[email protected]>
mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
Jiaran Zhang <[email protected]>
net: hns3: fix the timing issue of VF clearing interrupt sources
Yufeng Mo <[email protected]>
net: hns3: disable mac in flr process
Yufeng Mo <[email protected]>
net: hns3: change affinity_mask to numa node range
Yufeng Mo <[email protected]>
net: hns3: pad the short tunnel frame before sending to hardware
Nicholas Piggin <[email protected]>
KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers
Sukadev Bhattiprolu <[email protected]>
ibmvnic: check failover_pending in login response
David Heidelberg <[email protected]>
dt-bindings: arm: Fix Toradex compatible typo
Shai Malin <[email protected]>
qed: Handle management FW error
zhenggy <[email protected]>
tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
Vladimir Oltean <[email protected]>
net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup
Eric Dumazet <[email protected]>
net/af_unix: fix a data-race in unix_dgram_poll
Paolo Abeni <[email protected]>
vhost_net: fix OoB on sendmsg() failure.
Baptiste Lepers <[email protected]>
events: Reuse value read using READ_ONCE instead of re-reading it
Maor Gottlieb <[email protected]>
net/mlx5: Fix potential sleeping in atomic context
Saeed Mahameed <[email protected]>
net/mlx5: FWTrace, cancel work on alloc pd error flow
Michael Petlan <[email protected]>
perf machine: Initialize srcline string member in add_location struct
Hoang Le <[email protected]>
tipc: increase timeout in tipc_sk_enqueue()
Florian Fainelli <[email protected]>
r6040: Restore MDIO clock frequency after MAC reset
Xiyu Yang <[email protected]>
net/l2tp: Fix reference count leak in l2tp_udp_recv_core
Lin, Zhenpeng <[email protected]>
dccp: don't duplicate ccid when cloning dccp sock
Randy Dunlap <[email protected]>
ptp: dp83640: don't define PAGE0
Eric Dumazet <[email protected]>
net-caif: avoid user-triggerable WARN_ON(1)
Xin Long <[email protected]>
tipc: fix an use-after-free issue in tipc_recvmsg
Mike Rapoport <[email protected]>
x86/mm: Fix kern_addr_valid() to cope with existing but not present entries
Alexander Egorenkov <[email protected]>
s390/sclp: fix Secure-IPL facility detection
Lucas Stach <[email protected]>
drm/etnaviv: add missing MMU context put when reaping MMU mapping
Lucas Stach <[email protected]>
drm/etnaviv: reference MMU context when setting up hardware state
Lucas Stach <[email protected]>
drm/etnaviv: fix MMU context leak on GPU reset
Lucas Stach <[email protected]>
drm/etnaviv: exec and MMU state is lost when resetting the GPU
Lucas Stach <[email protected]>
drm/etnaviv: keep MMU context across runtime suspend/resume
Lucas Stach <[email protected]>
drm/etnaviv: stop abusing mmu_context as FE running marker
Lucas Stach <[email protected]>
drm/etnaviv: put submit prev MMU context when it exists
Lucas Stach <[email protected]>
drm/etnaviv: return context from etnaviv_iommu_context_get
Ernst Sjöstrand <[email protected]>
drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10
Evan Quan <[email protected]>
PCI: Add AMD GPU multi-function power dependencies
Juergen Gross <[email protected]>
PM: base: power: don't try to use non-existing RTC for storing data
Mark Brown <[email protected]>
arm64/sve: Use correct size when reinitialising SVE state
Adrian Bunk <[email protected]>
bnx2x: Fix enabling network interfaces without VFs
Juergen Gross <[email protected]>
xen: reset legacy rtc flag for PV domU
Anand Jain <[email protected]>
btrfs: fix upper limit for max_inline for page size 64K
Alyssa Rosenzweig <[email protected]>
drm/panfrost: Clamp lock region to Bifrost minimum
Alyssa Rosenzweig <[email protected]>
drm/panfrost: Use u64 for size in lock_region
Alyssa Rosenzweig <[email protected]>
drm/panfrost: Simplify lock_region calculation
Andrey Grodzovsky <[email protected]>
drm/amdgpu: Fix BUG_ON assert
David Heidelberg <[email protected]>
drm/msi/mdp4: populate priv->kms in mdp4_kms_init
Jan Hoffmann <[email protected]>
net: dsa: lantiq_gswip: fix maximum frame length
Kees Cook <[email protected]>
lib/test_stackinit: Fix static initializer test
Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Send command again when timeout occurs
Vasily Averin <[email protected]>
memcg: enable accounting for pids in nested pid namespaces
Rik van Riel <[email protected]>
mm,vmscan: fix divide by zero in get_scan_count
Liu Zixian <[email protected]>
mm/hugetlb: initialize hugetlb_usage in mm_init
Halil Pasic <[email protected]>
s390/pv: fix the forcing of the swiotlb
Pratik R. Sampat <[email protected]>
cpufreq: powernv: Fix init_chip_info initialization in numa=off
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Sync queue idx with queue_pair_map idx
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Changes to support kdump kernel
Maciej W. Rozycki <[email protected]>
scsi: BusLogic: Fix missing pr_cont() use
chenying <[email protected]>
ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
Mikulas Patocka <[email protected]>
parisc: fix crash with signals and alloca
Yang Yingliang <[email protected]>
net: w5100: check return value after calling platform_get_resource()
Haimin Zhang <[email protected]>
fix array-index-out-of-bounds in taprio_change
王贇 <[email protected]>
net: fix NULL pointer reference in cipso_v4_doi_free
Miaoqing Pan <[email protected]>
ath9k: fix sleeping in atomic context
Zekun Shen <[email protected]>
ath9k: fix OOB read ar9300_eeprom_restore_internal
Colin Ian King <[email protected]>
parport: remove non-zero check on count
Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Enable QP retransmission
Johannes Berg <[email protected]>
iwlwifi: mvm: fix access to BSS elements
Johannes Berg <[email protected]>
iwlwifi: mvm: avoid static queue number aliasing
Zhang Qilong <[email protected]>
iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed
Sean Keely <[email protected]>
drm/amdkfd: Account for SH/SE count when setting up cu masks.
Xiaotan Luo <[email protected]>
ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
Sugar Zhang <[email protected]>
ASoC: rockchip: i2s: Fix regmap_ops hang
Shuah Khan <[email protected]>
usbip:vhci_hcd USB port can get stuck in the disabled state
Anirudh Rayabharam <[email protected]>
usbip: give back URBs for unsent unlink requests during cleanup
Nadezda Lutovinova <[email protected]>
usb: musb: musb_dsps: request_irq() after initializing musb
Mathias Nyman <[email protected]>
Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
Ding Hui <[email protected]>
cifs: fix wrong release in sess_alloc_buffer() failed path
Nishad Kamdar <[email protected]>
mmc: core: Return correct emmc response in case of ioctl error
Li Zhijian <[email protected]>
selftests/bpf: Enlarge select() timeout for test_maps
Thomas Hebb <[email protected]>
mmc: rtsx_pci: Fix long reads when clock is prescaled
Manish Narani <[email protected]>
mmc: sdhci-of-arasan: Check return value of non-void funtions
Marc Zyngier <[email protected]>
of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
Gustaw Lewandowski <[email protected]>
ASoC: Intel: Skylake: Fix passing loadable flag for module
Cezary Rojewski <[email protected]>
ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
Marcos Paulo de Souza <[email protected]>
btrfs: tree-log: check btrfs_lookup_data_extent return value
Arnd Bergmann <[email protected]>
m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch
Nathan Chancellor <[email protected]>
drm/exynos: Always initialize mapping in exynos_drm_register_dma()
J. Bruce Fields <[email protected]>
lockd: lockd server-side shouldn't set fl_ops
Li Jun <[email protected]>
usb: chipidea: host: fix port index underflow and UBSAN complains
Bob Peterson <[email protected]>
gfs2: Don't call dlm after protocol is unmounted
Kees Cook <[email protected]>
staging: rts5208: Fix get_ms_information() heap buffer size
J. Bruce Fields <[email protected]>
rpc: fix gss_svc_init cleanup on failure
Luke Hsiao <[email protected]>
tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
Ulrich Hecht <[email protected]>
serial: sh-sci: fix break handling for sysrq
Rajendra Nayak <[email protected]>
opp: Don't print an error if required-opps is missing
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix handling of LE Enhanced Connection Complete
Sagi Grimberg <[email protected]>
nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data
Raag Jadav <[email protected]>
arm64: dts: ls1046a: fix eeprom entries
Thierry Reding <[email protected]>
arm64: tegra: Fix compatible string for Tegra132 CPUs
Andreas Obergschwandtner <[email protected]>
ARM: tegra: tamonten: Fix UART pad setting
Johan Almbladh <[email protected]>
mac80211: Fix monitor MTU limit so that A-MSDUs get through
Tuo Li <[email protected]>
drm/display: fix possible null-pointer dereference in dcn10_set_clock()
Tuo Li <[email protected]>
gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
Eran Ben Elisha <[email protected]>
net/mlx5: Fix variable type to match 64bit
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: avoid circular locks in sco_sock_connect
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: schedule SCO timeouts with delayed_work
Jussi Maki <[email protected]>
selftests/bpf: Fix xdp_tx.c prog section name
David Heidelberg <[email protected]>
drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
Nathan Chancellor <[email protected]>
net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
Vinod Koul <[email protected]>
arm64: dts: qcom: sdm660: use reg value for memory node
Sebastian Reichel <[email protected]>
ARM: dts: imx53-ppd: Fix ACHC entry
Evgeny Novikov <[email protected]>
media: tegra-cec: Handle errors of clk_prepare_enable()
Krzysztof Hałasa <[email protected]>
media: TDA1997x: fix tda1997x_query_dv_timings() return value
Hans Verkuil <[email protected]>
media: v4l2-dv-timings.c: fix wrong condition in two for-loops
Umang Jain <[email protected]>
media: imx258: Limit the max analogue gain to 480
Laurent Pinchart <[email protected]>
media: imx258: Rectify mismatch of VTS value
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output
Vidya Sagar <[email protected]>
arm64: tegra: Fix Tegra194 PCIe EP compatible string
Yufeng Mo <[email protected]>
bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()
Zhen Lei <[email protected]>
workqueue: Fix possible memory leaks in wq_numa_init()
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: skip invalid hci_sync_conn_complete_evt
Andy Shevchenko <[email protected]>
ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
Juhee Kang <[email protected]>
samples: bpf: Fix tracex7 error raised on the missing argument
Christophe JAILLET <[email protected]>
staging: ks7010: Fix the initialization of the 'sleep_status' structure
Greg Kroah-Hartman <[email protected]>
serial: 8250_pci: make setup_port() parameters explicitly unsigned
Jiri Slaby <[email protected]>
hvsi: don't panic on tty_register_driver failure
Jiri Slaby <[email protected]>
xtensa: ISS: don't panic in rs_init
Maciej W. Rozycki <[email protected]>
serial: 8250: Define RX trigger levels for OxSemi 950 devices
Niklas Schnelle <[email protected]>
s390: make PCI mio support a machine flag
Heiko Carstens <[email protected]>
s390/jump_label: print real address in a case of a jump label bug
Gustavo A. R. Silva <[email protected]>
flow_dissector: Fix out-of-bounds warnings
Gustavo A. R. Silva <[email protected]>
ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
Zheyu Ma <[email protected]>
video: fbdev: riva: Error out if 'pixclock' equals zero
Zheyu Ma <[email protected]>
video: fbdev: kyro: Error out if 'pixclock' equals zero
Zheyu Ma <[email protected]>
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
Johan Almbladh <[email protected]>
bpf/tests: Do not PASS tests without actually testing the result
Johan Almbladh <[email protected]>
bpf/tests: Fix copy-and-paste error in double word test
Anson Jacob <[email protected]>
drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex
Oliver Logush <[email protected]>
drm/amd/display: Fix timer_per_pixel unit error
Zheyu Ma <[email protected]>
tty: serial: jsm: hold port lock when reporting modem line changes
Geert Uytterhoeven <[email protected]>
staging: board: Fix uninitialized spinlock when attaching genpd
Jack Pham <[email protected]>
usb: gadget: composite: Allow bMaxPower=0 if self-powered
Evgeny Novikov <[email protected]>
USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
Maciej Żenczykowski <[email protected]>
usb: gadget: u_ether: fix a potential null pointer dereference
Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the actual_length of an iso packet
Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the endpoint's transactional opportunities calculation
Sasha Neftin <[email protected]>
igc: Check if num of q_vectors is smaller than max before array access
Desmond Cheong Zhi Xi <[email protected]>
drm: avoid blocking in drm_clients_info's rcu section
Tianjia Zhang <[email protected]>
Smack: Fix wrong semantics in smk_access_entry()
Yajun Deng <[email protected]>
netlink: Deal with ESRCH error in nlmsg_notify()
Zheyu Ma <[email protected]>
video: fbdev: kyro: fix a DoS bug by restricting user input
David Heidelberg <[email protected]>
ARM: dts: qcom: apq8064: correct clock names
Stefan Assmann <[email protected]>
iavf: fix locking of critical sections
Stefan Assmann <[email protected]>
iavf: do not override the adapter state in the watchdog task
Jonathan Cameron <[email protected]>
iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
Xin Long <[email protected]>
tipc: keep the skb in rcv queue until the whole data is read
Rafael J. Wysocki <[email protected]>
PCI: Use pci_update_current_state() in pci_enable_device_flags()
Sean Anderson <[email protected]>
crypto: mxs-dcp - Use sg_mapping_iter to copy data
Mauro Carvalho Chehab <[email protected]>
media: dib8000: rewrite the init prbs logic
Randy Dunlap <[email protected]>
ASoC: atmel: ATMEL drivers don't need HAS_DMA
Luben Tuikov <[email protected]>
drm/amdgpu: Fix amdgpu_ras_eeprom_init()
Nadav Amit <[email protected]>
userfaultfd: prevent concurrent API initialization
Masahiro Yamada <[email protected]>
kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y
Oleksij Rempel <[email protected]>
MIPS: Malta: fix alignment of the devicetree buffer
Chao Yu <[email protected]>
f2fs: fix to unmap pages from userspace process in punch_hole()
Chao Yu <[email protected]>
f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
Chao Yu <[email protected]>
f2fs: fix to account missing .skipped_gc_rwsem
Alexey Kardashevskiy <[email protected]>
KVM: PPC: Fix clearing never mapped TCEs in realmode
Codrin Ciubotariu <[email protected]>
clk: at91: clk-generated: Limit the requested rate to our range
Claudiu Beznea <[email protected]>
clk: at91: clk-generated: pass the id of changeable parent at registration
Codrin Ciubotariu <[email protected]>
clk: at91: sam9x60: Don't use audio PLL
David Howells <[email protected]>
fscache: Fix cookie key hashing
Hans de Goede <[email protected]>
platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call
Nicholas Piggin <[email protected]>
KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live
Jim Broadus <[email protected]>
HID: i2c-hid: Fix Elan touchpad regression
David Disseldorp <[email protected]>
scsi: target: avoid per-loop XCOPY buffer allocations
Joel Stanley <[email protected]>
powerpc/config: Renable MTD_PHYSMAP_OF
Dan Carpenter <[email protected]>
scsi: qedf: Fix error codes in qedf_alloc_global_queues()
Dan Carpenter <[email protected]>
scsi: qedi: Fix error codes in qedi_alloc_global_queues()
Dan Carpenter <[email protected]>
scsi: smartpqi: Fix an error code in pqi_get_raid_map()
Zhen Lei <[email protected]>
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
Wei Li <[email protected]>
scsi: fdomain: Fix error return code in fdomain_probe()
Trond Myklebust <[email protected]>
SUNRPC: Fix potential memory corruption
Anthony Iliopoulos <[email protected]>
dma-debug: fix debugfs initialization order
Randy Dunlap <[email protected]>
openrisc: don't printk() unconditionally
Yangtao Li <[email protected]>
f2fs: reduce the scope of setting fsck tag when de->name_len is zero
Chao Yu <[email protected]>
f2fs: show f2fs instance in printk_ratelimited
Leon Romanovsky <[email protected]>
RDMA/efa: Remove double QP type assignment
Michal Suchanek <[email protected]>
powerpc/stacktrace: Include linux/delay.h
Jason Gunthorpe <[email protected]>
vfio: Use config not menuconfig for VFIO_NOIOMMU
Jaehyoung Choi <[email protected]>
pinctrl: samsung: Fix pinctrl bank pin count
Leon Romanovsky <[email protected]>
docs: Fix infiniband uverbs minor number
Leon Romanovsky <[email protected]>
RDMA/iwcm: Release resources if iw_cm module initialization fails
Mike Marciniszyn <[email protected]>
IB/hfi1: Adjust pkey entry in index 0
Christoph Hellwig <[email protected]>
scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
Chao Yu <[email protected]>
f2fs: quota: fix potential deadlock
Dmitry Torokhov <[email protected]>
HID: input: do not report stylus battery state as "full"
Pali Rohár <[email protected]>
PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
Pali Rohár <[email protected]>
PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
Evan Wang <[email protected]>
PCI: aardvark: Fix checking for PIO status
Hyun Kwon <[email protected]>
PCI: xilinx-nwl: Enable the clock through CCF
Krzysztof Wilczyński <[email protected]>
PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
Marek Behún <[email protected]>
PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
Stuart Hayes <[email protected]>
PCI/portdrv: Enable Bandwidth Notification only if port supports it
David Heidelberg <[email protected]>
ARM: 9105/1: atags_to_fdt: don't warn about stack size
Hans de Goede <[email protected]>
libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
Robin Gong <[email protected]>
dmaengine: imx-sdma: remove duplicated sdma_load_context
Robin Gong <[email protected]>
Revert "dmaengine: imx-sdma: refine to load context only once"
Sean Young <[email protected]>
media: rc-loopback: return number of emitters rather than error
Mauro Carvalho Chehab <[email protected]>
media: uvc: don't do DMA on stack
Wang Hai <[email protected]>
VMCI: fix NULL pointer dereference when unmapping queue pair
Arne Welzel <[email protected]>
dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
Krzysztof Kozlowski <[email protected]>
power: supply: max17042: handle fails of reading status register
Damien Le Moal <[email protected]>
block: bfq: fix bfq_set_next_ioprio_data()
zhenwei pi <[email protected]>
crypto: public_key: fix overflow during implicit conversion
Mark Rutland <[email protected]>
arm64: head: avoid over-mapping in map_memory
Iwona Winiarska <[email protected]>
soc: aspeed: p2a-ctrl: Fix boundary check for mmap
Iwona Winiarska <[email protected]>
soc: aspeed: lpc-ctrl: Fix boundary check for mmap
Manivannan Sadhasivam <[email protected]>
soc: qcom: aoss: Fix the out of bound usage of cooling_devs
Paul Cercueil <[email protected]>
pinctrl: ingenic: Fix incorrect pull up/down info
Marc Zyngier <[email protected]>
pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast
Rolf Eike Beer <[email protected]>
tools/thermal/tmon: Add cross compiling support
Harshvardhan Jha <[email protected]>
9p/xen: Fix end of loop tests for list_for_each_entry
Andy Shevchenko <[email protected]>
include/linux/list.h: add a macro to test if entry is pointing to the head
Juergen Gross <[email protected]>
xen: fix setting of max_pfn in shared_info
Kajol Jain <[email protected]>
powerpc/perf/hv-gpci: Fix counter value parsing
Marek Marczykowski-Górecki <[email protected]>
PCI/MSI: Skip masking MSI-X on Xen PV
Niklas Cassel <[email protected]>
blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
Niklas Cassel <[email protected]>
blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
Desmond Cheong Zhi Xi <[email protected]>
btrfs: reset replace target device to allocation state on close
Josef Bacik <[email protected]>
btrfs: wake up async_delalloc_pages waiters after submit
Dmitry Osipenko <[email protected]>
rtc: tps65910: Correct driver module alias
-------------
Diffstat:
Documentation/admin-guide/devices.txt | 6 +- Documentation/devicetree/bindings/arm/tegra.yaml | 2 +- .../devicetree/bindings/mtd/gpmc-nand.txt | 2 +- Makefile | 4 +- arch/arc/mm/cache.c | 2 +- arch/arm/boot/compressed/Makefile | 2 + arch/arm/boot/dts/imx53-ppd.dts | 23 +++-- arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +-- arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts | 8 +- arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts | 7 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 6 +- arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 +- arch/arm64/include/asm/kernel-pgtable.h | 4 +- arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kernel/head.S | 11 ++- arch/m68k/Kconfig.bus | 2 +- arch/mips/mti-malta/malta-dtshim.c | 2 +- arch/openrisc/kernel/entry.S | 2 + arch/parisc/kernel/signal.c | 6 ++ arch/powerpc/configs/mpc885_ads_defconfig | 1 + arch/powerpc/include/asm/pmc.h | 7 ++ arch/powerpc/kernel/stacktrace.c | 1 + arch/powerpc/kvm/book3s_64_vio_hv.c | 9 +- arch/powerpc/kvm/book3s_hv.c | 20 ++++ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 36 ++++++- arch/powerpc/perf/hv-gpci.c | 2 +- arch/s390/include/asm/setup.h | 2 + arch/s390/kernel/early.c | 4 + arch/s390/kernel/jump_label.c | 2 +- arch/s390/mm/init.c | 2 +- arch/s390/pci/pci.c | 5 +- arch/x86/mm/init_64.c | 6 +- arch/x86/xen/enlighten_pv.c | 7 ++ arch/x86/xen/p2m.c | 4 +- arch/xtensa/platforms/iss/console.c | 17 +++- block/bfq-iosched.c | 18 +++- block/blk-zoned.c | 6 -- block/bsg.c | 5 +- drivers/ata/libata-core.c | 4 + drivers/ata/sata_dwc_460ex.c | 12 +-- drivers/base/power/trace.c | 10 ++ drivers/clk/at91/clk-generated.c | 32 +++--- drivers/clk/at91/dt-compat.c | 8 +- drivers/clk/at91/pmc.h | 4 +- drivers/clk/at91/sam9x60.c | 10 +- drivers/clk/at91/sama5d2.c | 31 +++--- drivers/cpufreq/powernv-cpufreq.c | 16 ++- drivers/crypto/mxs-dcp.c | 36 ++----- drivers/dma/imx-sdma.c | 13 +-- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 84 ++++++++++++---- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 1 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 16 +-- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +-- .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- drivers/gpu/drm/drm_debugfs.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 43 ++++---- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 1 + drivers/gpu/drm/etnaviv/etnaviv_iommu.c | 4 + drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c | 8 ++ drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 1 + drivers/gpu/drm/etnaviv/etnaviv_mmu.h | 4 +- drivers/gpu/drm/exynos/exynos_drm_dma.c | 2 + drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 17 +--- drivers/gpu/drm/panfrost/panfrost_mmu.c | 31 +++--- drivers/gpu/drm/panfrost/panfrost_regs.h | 2 + drivers/hid/hid-input.c | 2 - drivers/hid/i2c-hid/i2c-hid-core.c | 5 +- drivers/iio/dac/ad5624r_spi.c | 18 +++- drivers/infiniband/core/iwcm.c | 19 ++-- drivers/infiniband/hw/efa/efa_verbs.c | 1 - drivers/infiniband/hw/hfi1/init.c | 7 +- drivers/md/dm-crypt.c | 7 +- drivers/media/dvb-frontends/dib8000.c | 58 +++++++---- drivers/media/i2c/imx258.c | 4 +- drivers/media/i2c/tda1997x.c | 5 +- drivers/media/platform/tegra-cec/tegra_cec.c | 10 +- drivers/media/rc/rc-loopback.c | 2 +- drivers/media/usb/uvc/uvc_v4l2.c | 34 ++++--- drivers/media/v4l2-core/v4l2-dv-timings.c | 4 +- drivers/mfd/ab8500-core.c | 2 +- drivers/mfd/axp20x.c | 3 +- drivers/mfd/db8500-prcmu.c | 14 ++- drivers/mfd/stmpe.c | 4 +- drivers/mfd/tc3589x.c | 2 +- drivers/mfd/tqmx86.c | 2 + drivers/mfd/wm8994-irq.c | 2 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/block.c | 3 +- drivers/mmc/host/rtsx_pci_sdmmc.c | 36 ++++--- drivers/mmc/host/sdhci-of-arasan.c | 18 +++- drivers/mtd/nand/raw/cafe_nand.c | 4 +- drivers/net/bonding/bond_main.c | 3 +- drivers/net/dsa/b53/b53_common.c | 3 +- drivers/net/dsa/lantiq_gswip.c | 3 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 2 +- drivers/net/ethernet/chelsio/cxgb/cxgb2.c | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 19 ++-- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 6 +- drivers/net/ethernet/ibm/ibmvnic.c | 8 ++ drivers/net/ethernet/intel/iavf/iavf_main.c | 58 +++++++++-- drivers/net/ethernet/intel/igc/igc_main.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 5 +- .../ethernet/mellanox/mlx5/core/steering/dr_send.c | 1 + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 6 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | 1 - drivers/net/ethernet/rdc/r6040.c | 9 +- drivers/net/ethernet/renesas/sh_eth.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 18 ++-- drivers/net/ethernet/wiznet/w5100.c | 2 + drivers/net/phy/dp83640_reg.h | 2 +- drivers/net/usb/cdc_mbim.c | 5 + drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 3 +- drivers/net/wireless/ath/ath9k/hw.c | 12 ++- drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 24 ++++- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 30 +++--- drivers/ntb/test/ntb_msi_test.c | 4 +- drivers/ntb/test/ntb_perf.c | 1 + drivers/nvme/host/tcp.c | 14 +-- drivers/of/kobj.c | 2 +- drivers/opp/of.c | 12 +-- drivers/parport/ieee1284_ops.c | 2 +- drivers/pci/controller/pci-aardvark.c | 73 ++++++++++++-- drivers/pci/controller/pcie-xilinx-nwl.c | 12 +++ drivers/pci/hotplug/TODO | 3 - drivers/pci/hotplug/ibmphp_ebda.c | 5 +- drivers/pci/msi.c | 3 + drivers/pci/pci.c | 8 +- drivers/pci/pcie/portdrv_core.c | 9 +- drivers/pci/quirks.c | 59 ++++++++++- drivers/pci/syscall.c | 4 +- drivers/pinctrl/pinctrl-ingenic.c | 6 +- drivers/pinctrl/pinctrl-single.c | 1 + drivers/pinctrl/pinctrl-stmfx.c | 6 +- drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 9 ++ drivers/platform/x86/dell-smbios-wmi.c | 1 + drivers/power/supply/max17042_battery.c | 6 +- drivers/rtc/rtc-tps65910.c | 2 +- drivers/s390/char/sclp_early.c | 3 +- drivers/scsi/BusLogic.c | 4 +- drivers/scsi/pcmcia/fdomain_cs.c | 4 +- drivers/scsi/qedf/qedf_main.c | 10 +- drivers/scsi/qedi/qedi_main.c | 14 +-- drivers/scsi/qla2xxx/qla_nvme.c | 5 +- drivers/scsi/qla2xxx/qla_os.c | 6 ++ drivers/scsi/smartpqi/smartpqi_init.c | 1 + drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 +- drivers/soc/aspeed/aspeed-p2a-ctrl.c | 2 +- drivers/soc/qcom/qcom_aoss.c | 8 +- drivers/staging/board/board.c | 7 +- drivers/staging/ks7010/ks7010_sdio.c | 2 +- drivers/staging/rts5208/rtsx_scsi.c | 10 +- drivers/target/target_core_xcopy.c | 96 ++++++------------ drivers/target/target_core_xcopy.h | 1 + drivers/tty/hvc/hvsi.c | 19 +++- drivers/tty/serial/8250/8250_pci.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/serial/jsm/jsm_neo.c | 2 + drivers/tty/serial/jsm/jsm_tty.c | 3 + drivers/tty/serial/sh-sci.c | 7 +- drivers/usb/chipidea/host.c | 14 ++- drivers/usb/gadget/composite.c | 8 +- drivers/usb/gadget/function/u_ether.c | 5 +- drivers/usb/host/ehci-mv.c | 23 +++-- drivers/usb/host/fotg210-hcd.c | 41 ++++---- drivers/usb/host/fotg210.h | 5 - drivers/usb/host/xhci.c | 24 ++--- drivers/usb/musb/musb_dsps.c | 13 ++- drivers/usb/usbip/vhci_hcd.c | 32 +++++- drivers/vfio/Kconfig | 2 +- drivers/vhost/net.c | 11 ++- drivers/video/fbdev/asiliantfb.c | 3 + drivers/video/fbdev/kyro/fbdev.c | 8 ++ drivers/video/fbdev/riva/fbdev.c | 3 + fs/btrfs/disk-io.c | 45 ++++----- fs/btrfs/inode.c | 10 +- fs/btrfs/tree-log.c | 4 +- fs/btrfs/volumes.c | 3 + fs/cifs/sess.c | 2 +- fs/f2fs/checkpoint.c | 2 +- fs/f2fs/data.c | 23 ++++- fs/f2fs/dir.c | 15 ++- fs/f2fs/f2fs.h | 24 ++--- fs/f2fs/file.c | 6 +- fs/f2fs/gc.c | 6 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 2 +- fs/f2fs/segment.c | 9 +- fs/f2fs/super.c | 84 +++++++++------- fs/fscache/cookie.c | 14 +-- fs/fscache/internal.h | 2 + fs/fscache/main.c | 39 ++++++++ fs/fuse/dev.c | 4 +- fs/gfs2/lock_dlm.c | 5 + fs/lockd/svclock.c | 30 +++--- fs/overlayfs/dir.c | 6 +- fs/userfaultfd.c | 93 +++++++++--------- include/crypto/public_key.h | 4 +- include/linux/hugetlb.h | 9 ++ include/linux/list.h | 29 ++++-- include/linux/memory_hotplug.h | 4 +- include/linux/pci.h | 5 +- include/linux/pci_ids.h | 3 +- include/linux/skbuff.h | 2 +- include/linux/sunrpc/xprt.h | 1 + include/uapi/linux/pkt_sched.h | 2 + include/uapi/linux/serial_reg.h | 1 + kernel/dma/debug.c | 7 +- kernel/events/core.c | 2 +- kernel/fork.c | 1 + kernel/pid_namespace.c | 3 +- kernel/trace/trace_kprobe.c | 6 +- kernel/trace/trace_probe.c | 25 +++++ kernel/trace/trace_probe.h | 1 + kernel/trace/trace_uprobe.c | 6 +- kernel/workqueue.c | 12 ++- lib/test_bpf.c | 13 ++- lib/test_stackinit.c | 20 ++-- mm/memory_hotplug.c | 4 +- mm/vmscan.c | 2 +- net/9p/trans_xen.c | 4 +- net/bluetooth/hci_event.c | 108 +++++++++++++++------ net/bluetooth/sco.c | 74 ++++++++------ net/caif/chnl_net.c | 19 +--- net/core/flow_dissector.c | 12 ++- net/dccp/minisocks.c | 2 + net/dsa/slave.c | 12 +-- net/ipv4/ip_gre.c | 9 +- net/ipv4/ip_output.c | 5 +- net/ipv4/nexthop.c | 2 + net/ipv4/tcp_fastopen.c | 3 +- net/ipv4/tcp_input.c | 2 +- net/ipv6/netfilter/nf_socket_ipv6.c | 4 +- net/l2tp/l2tp_core.c | 4 +- net/mac80211/iface.c | 11 ++- net/netlabel/netlabel_cipso_v4.c | 4 +- net/netlink/af_netlink.c | 4 +- net/sched/sch_fq_codel.c | 12 ++- net/sched/sch_taprio.c | 4 +- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- net/sunrpc/xprt.c | 6 +- net/tipc/socket.c | 36 +++++-- net/unix/af_unix.c | 2 +- samples/bpf/test_override_return.sh | 1 + samples/bpf/tracex7_user.c | 5 + scripts/gen_ksymdeps.sh | 8 +- security/smack/smack_access.c | 17 ++-- sound/soc/atmel/Kconfig | 1 - sound/soc/intel/boards/bytcr_rt5640.c | 9 +- sound/soc/intel/skylake/skl-messages.c | 11 ++- sound/soc/intel/skylake/skl-pcm.c | 25 ++--- sound/soc/rockchip/rockchip_i2s.c | 35 ++++--- tools/perf/Makefile.config | 8 +- tools/perf/util/machine.c | 1 + tools/testing/selftests/bpf/progs/xdp_tx.c | 2 +- tools/testing/selftests/bpf/test_maps.c | 2 +- tools/testing/selftests/bpf/test_xdp_veth.sh | 2 +- tools/thermal/tmon/Makefile | 2 +- virt/kvm/arm/arm.c | 8 ++ 273 files changed, 1866 insertions(+), 1079 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/260 rtc: tps65910: Correct driver module alias
From: Dmitry Osipenko <[email protected]>
commit 8d448fa0a8bb1c8d94eef7647edffe9ac81a281e upstream.
The TPS65910 RTC driver module doesn't auto-load because of the wrong module alias that doesn't match the device name, fix it.
--- drivers/rtc/rtc-tps65910.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-tps65910.c +1 -1
@@ -460,6 +460,6 @@ static struct platform_driver tps65910_r };module_platform_driver (tps65910_rtc_driver); -MODULE_ALIAS ("platform:rtc-tps65910" ); +MODULE_ALIAS ("platform:tps65910-rtc" );MODULE_AUTHOR ("Venu Byravarasu <[email protected]>" );MODULE_LICENSE ("GPL" );
Greg Kroah-Hartman
maintainerPATCH 2/260 btrfs: wake up async_delalloc_pages waiters after submit
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit ac98141d140444fe93e26471d3074c603b70e2ca upstream.
We use the async_delalloc_pages mechanism to make sure that we've completed our async work before trying to continue our delalloc flushing. The reason for this is we need to see any ordered extents that were created by our delalloc flushing. However we're waking up before we do the submit work, which is before we create the ordered extents. This is a pretty wide race window where we could potentially think there are no ordered extents and thus exit shrink_delalloc prematurely. Fix this by waking us up after we've done the work to create ordered extents.
--- fs/btrfs/inode.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/btrfs/inode.c +5 -5
@@ -1200,11 +1200,6 @@ static noinline void async_cow_submit(st nr_pages = (async_chunk->end - async_chunk->start +PAGE_SIZE ) >>PAGE_SHIFT ; -/* atomic_sub_return implies a barrier */ -if (atomic_sub_return (nr_pages, &fs_info->async_delalloc_pages) < -5 *SZ_1M ) -cond_wake_up_nomb (&fs_info->async_submit_wait); -/* * ->inode could be NULL if async_chunk_start has failed to compress, * in which case we don't have anything to submit, yet we need to
@@ -1213,6 +1208,11 @@ static noinline void async_cow_submit(st*/ if (async_chunk->inode)submit_compressed_extents (async_chunk); + +/* atomic_sub_return implies a barrier */ +if (atomic_sub_return (nr_pages, &fs_info->async_delalloc_pages) < +5 *SZ_1M ) +cond_wake_up_nomb (&fs_info->async_submit_wait); } static noinline void async_cow_free(struct btrfs_work *work)
Greg Kroah-Hartman
maintainerPATCH 3/260 btrfs: reset replace target device to allocation state on close
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
commit 0d977e0eba234e01a60bdde27314dc21374201b3 upstream.
This crash was observed with a failed assertion on device close:
BTRFS: Transaction aborted (error -28)
WARNING: CPU: 1 PID: 3902 at fs/btrfs/extent-tree.c:2150 btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c crc32c_intel xor zstd_decompress zstd_compress xxhash lzo_compress lzo_decompress raid6_pq loop CPU: 1 PID: 3902 Comm: kworker/u8:4 Not tainted 5.14.0-rc5-default+ #1532 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs] RIP: 0010:btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs] RSP: 0018:ffffb7a5452d7d80 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffffabee13c4 RDI: 00000000ffffffff RBP: ffff97834176a378 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: ffff97835195d388 R13: 0000000005b08000 R14: ffff978385484000 R15: 000000000000016c FS: 0000000000000000(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056190d003fe8 CR3: 000000002a81e005 CR4: 0000000000170ea0 Call Trace: flush_space+0x197/0x2f0 [btrfs] btrfs_async_reclaim_metadata_space+0x139/0x300 [btrfs] process_one_work+0x262/0x5e0 worker_thread+0x4c/0x320 ? process_one_work+0x5e0/0x5e0 kthread+0x144/0x170 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 irq event stamp: 19334989 hardirqs last enabled at (19334997): [<ffffffffab0e0c87>] console_unlock+0x2b7/0x400 hardirqs last disabled at (19335006): [<ffffffffab0e0d0d>] console_unlock+0x33d/0x400 softirqs last enabled at (19334900): [<ffffffffaba0030d>] __do_softirq+0x30d/0x574 softirqs last disabled at (19334893): [<ffffffffab0721ec>] irq_exit_rcu+0x12c/0x140 ---[ end trace 45939e308e0dd3c7 ]--- BTRFS: error (device vdd) in btrfs_run_delayed_refs:2150: errno=-28 No space left BTRFS info (device vdd): forced readonly BTRFS warning (device vdd): failed setting block group ro: -30 BTRFS info (device vdd): suspending dev_replace for unmount assertion failed: !test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state), in fs/btrfs/volumes.c:1150 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.h:3431! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 3982 Comm: umount Tainted: G W 5.14.0-rc5-default+ #1532 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 RIP: 0010:assertfail.constprop.0+0x18/0x1a [btrfs] RSP: 0018:ffffb7a5454c7db8 EFLAGS: 00010246 RAX: 0000000000000068 RBX: ffff978364b91c00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffffabee13c4 RDI: 00000000ffffffff RBP: ffff9783523a4c00 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: ffff9783523a4d18 R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000003 FS: 00007f61c8f42800(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056190cffa810 CR3: 0000000030b96002 CR4: 0000000000170ea0 Call Trace: btrfs_close_one_device.cold+0x11/0x55 [btrfs] close_fs_devices+0x44/0xb0 [btrfs] btrfs_close_devices+0x48/0x160 [btrfs] generic_shutdown_super+0x69/0x100 kill_anon_super+0x14/0x30 btrfs_kill_super+0x12/0x20 [btrfs] deactivate_locked_super+0x2c/0xa0 cleanup_mnt+0x144/0x1b0 task_work_run+0x59/0xa0 exit_to_user_mode_loop+0xe7/0xf0 exit_to_user_mode_prepare+0xaf/0xf0 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x4a/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
This happens when close_ctree is called while a dev_replace hasn't completed. In close_ctree, we suspend the dev_replace, but keep the replace target around so that we can resume the dev_replace procedure when we mount the root again. This is the call trace:
close_ctree():
btrfs_dev_replace_suspend_for_unmount();
btrfs_close_devices():
btrfs_close_fs_devices():
btrfs_close_one_device():
ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
&device->dev_state));However, since the replace target sticks around, there is a device with BTRFS_DEV_STATE_REPLACE_TGT set on close, and we fail the assertion in btrfs_close_one_device.
To fix this, if we come across the replace target device when closing, we should properly reset it back to allocation state. This fix also ensures that if a non-target device has a corrupted state and has the BTRFS_DEV_STATE_REPLACE_TGT bit set, the assertion will still catch the error.
--- fs/btrfs/volumes.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/volumes.c +3 -0
@@ -1311,6 +1311,9 @@ static void btrfs_close_one_device(struc fs_devices->rw_devices--; } +if (device->devid ==BTRFS_DEV_REPLACE_DEVID ) +clear_bit (BTRFS_DEV_STATE_REPLACE_TGT , &device->dev_state); +if (test_bit (BTRFS_DEV_STATE_MISSING , &device->dev_state)) fs_devices->missing_devices--;
Greg Kroah-Hartman
maintainerPATCH 4/260 blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
commit ead3b768bb51259e3a5f2287ff5fc9041eb6f450 upstream.
Zone management send operations (BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE) should be allowed under the same permissions as write(). (write() does not require CAP_SYS_ADMIN).
Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check if the fd was successfully opened with FMODE_WRITE.
(They do not require CAP_SYS_ADMIN).
Currently, zone management send operations require both CAP_SYS_ADMIN and that the fd was successfully opened with FMODE_WRITE.
Remove the CAP_SYS_ADMIN requirement, so that zone management send operations match the access control requirement of write(), BLKSECDISCARD and BLKZEROOUT.
--- block/blk-zoned.c | 3 --- 1 file changed, 3 deletions(-)
block/blk-zoned.c +0 -3
@@ -374,9 +374,6 @@ int blkdev_reset_zones_ioctl(struct blocif (!blk_queue_is_zoned (q))return -ENOTTY ; -if (!capable (CAP_SYS_ADMIN )) -return -EACCES ; -if (!(mode &FMODE_WRITE ))return -EBADF ;
Greg Kroah-Hartman
maintainerPATCH 5/260 blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
commit 4d643b66089591b4769bcdb6fd1bfeff2fe301b8 upstream.
A user space process should not need the CAP_SYS_ADMIN capability set in order to perform a BLKREPORTZONE ioctl.
Getting the zone report is required in order to get the write pointer. Neither read() nor write() requires CAP_SYS_ADMIN, so it is reasonable that a user space process that can read/write from/to the device, also can get the write pointer. (Since e.g. writes have to be at the write pointer.)
--- block/blk-zoned.c | 3 --- 1 file changed, 3 deletions(-)
block/blk-zoned.c +0 -3
@@ -316,9 +316,6 @@ int blkdev_report_zones_ioctl(struct bloif (!blk_queue_is_zoned (q))return -ENOTTY ; -if (!capable (CAP_SYS_ADMIN )) -return -EACCES ; -if (copy_from_user (&rep, argp,sizeof (struct blk_zone_report )))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 6/260 PCI/MSI: Skip masking MSI-X on Xen PV
In reply to Greg Kroah-HartmanFrom: Marek Marczykowski-Górecki <[email protected]>
commit 1a519dc7a73c977547d8b5108d98c6e769c89f4b upstream.
When running as Xen PV guest, masking MSI-X is a responsibility of the hypervisor. The guest has no write access to the relevant BAR at all - when it tries to, it results in a crash like this:
BUG: unable to handle page fault for address: ffffc9004069100c
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation
RIP: e030:__pci_enable_msix_range.part.0+0x26b/0x5f0
e1000e_set_interrupt_capability+0xbf/0xd0 [e1000e]
e1000_probe+0x41f/0xdb0 [e1000e]
local_pci_probe+0x42/0x80
(...)The recently introduced function msix_mask_all() does not check the global variable pci_msi_ignore_mask which is set by XEN PV to bypass the masking of MSI[-X] interrupts.
Add the check to make this function XEN PV compatible.
--- drivers/pci/msi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pci/msi.c +3 -0
@@ -782,6 +782,9 @@ static void msix_mask_all(void __iomem *u32 ctrl =PCI_MSIX_ENTRY_CTRL_MASKBIT ;int i; +if (pci_msi_ignore_mask) +return ; +for (i =0 ; i < tsize; i++, base +=PCI_MSIX_ENTRY_SIZE )writel (ctrl, base +PCI_MSIX_ENTRY_VECTOR_CTRL ); }
Greg Kroah-Hartman
maintainerPATCH 7/260 powerpc/perf/hv-gpci: Fix counter value parsing
In reply to Greg Kroah-HartmanFrom: Kajol Jain <[email protected]>
commit f9addd85fbfacf0d155e83dbee8696d6df5ed0c7 upstream.
H_GetPerformanceCounterInfo (0xF080) hcall returns the counter data in the result buffer. Result buffer has specific format defined in the PAPR specification. One of the fields is counter offset and width of the counter data returned.
Counter data are returned in a unsigned char array in big endian byte order. To get the final counter data, the values must be left shifted byte at a time. But commit 220a0c609ad17 ("powerpc/perf: Add support for the hv gpci (get performance counter info) interface") made the shifting bitwise and also assumed little endian order. Because of that, hcall counters values are reported incorrectly.
In particular this can lead to counters go backwards which messes up the counter prev vs now calculation and leads to huge counter value reporting:
#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
-C 0 -I 1000
time counts unit events
1.000078854 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
2.000213293 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
3.000320107 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
4.000428392 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
5.000537864 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
6.000649087 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
7.000760312 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
8.000865218 16,448 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
9.000978985 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
10.001088891 16,384 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
11.001201435 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
12.001307937 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
Fix the shifting logic to correct match the format, ie. read bytes in big endian order.
--- arch/powerpc/perf/hv-gpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/perf/hv-gpci.c +1 -1
@@ -164,7 +164,7 @@ static unsigned long single_gpci_request*/ count =0 ;for (i = offset; i < offset + length; i++) - count |= arg->bytes[i] << (i - offset); + count |= (u64)(arg->bytes[i]) << ((length -1 - (i - offset)) *8 ); *value = count; out:
Greg Kroah-Hartman
maintainerPATCH 8/260 xen: fix setting of max_pfn in shared_info
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 4b511d5bfa74b1926daefd1694205c7f1bcf677f upstream.
Xen PV guests are specifying the highest used PFN via the max_pfn field in shared_info. This value is used by the Xen tools when saving or migrating the guest.
Unfortunately this field is misnamed, as in reality it is specifying the number of pages (including any memory holes) of the guest, so it is the highest used PFN + 1. Renaming isn't possible, as this is a public Xen hypervisor interface which needs to be kept stable.
The kernel will set the value correctly initially at boot time, but when adding more pages (e.g. due to memory hotplug or ballooning) a real PFN number is stored in max_pfn. This is done when expanding the p2m array, and the PFN stored there is even possibly wrong, as it should be the last possible PFN of the just added P2M frame, and not one which led to the P2M expansion.
Fix that by setting shared_info->max_pfn to the last possible PFN + 1.
--- arch/x86/xen/p2m.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/xen/p2m.c +2 -2
@@ -622,8 +622,8 @@ int xen_alloc_p2m_entry(unsigned long pf }/* Expanded the p2m? */ -if (pfn > xen_p2m_last_pfn) { - xen_p2m_last_pfn = pfn; +if (pfn >= xen_p2m_last_pfn) { + xen_p2m_last_pfn =ALIGN (pfn +1 ,P2M_PER_PAGE ); HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn; }
Greg Kroah-Hartman
maintainerPATCH 9/260 include/linux/list.h: add a macro to test if entry is pointing to the head
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit e130816164e244b692921de49771eeb28205152d upstream.
Add a macro to test if entry is pointing to the head of the list which is useful in cases like:
list_for_each_entry(pos, &head, member) {
if (cond)
break;
}
if (list_entry_is_head(pos, &head, member))
return -ERRNO;that allows to avoid additional variable to be added to track if loop has not been stopped in the middle.
While here, convert list_for_each_entry*() family of macros to use a new one.
--- include/linux/list.h | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
include/linux/list.h +19 -10
@@ -568,6 +568,15 @@ static inline void list_splice_tail_init pos = n, n = pos->prev)/** +* list_entry_is_head - test if the entry points to the head of the list +* @pos: the type * to cursor +* @head: the head for your list. +* @member: the name of the list_head within the struct. +*/ +#define list_entry_is_head (pos, head, member) \ + (&pos->member == (head)) + +/** * list_for_each_entry - iterate over list of given type * @pos: the type * to use as a loop cursor. * @head: the head for your list.
@@ -575,7 +584,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry (pos, head, member) \ for (pos = list_first_entry(head, typeof(*pos), member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_next_entry(pos, member))/**
@@ -586,7 +595,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_reverse (pos, head, member) \ for (pos = list_last_entry(head, typeof(*pos), member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_prev_entry(pos, member))/**
@@ -611,7 +620,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_continue (pos, head, member) \ for (pos = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_next_entry(pos, member))/**
@@ -625,7 +634,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_continue_reverse (pos, head, member) \ for (pos = list_prev_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_prev_entry(pos, member))/**
@@ -637,7 +646,7 @@ static inline void list_splice_tail_init* Iterate over list of given type, continuing from current position. */ #define list_for_each_entry_from (pos, head, member) \ - for (; &pos->member != (head); \ + for (; !list_entry_is_head(pos, head, member); \ pos = list_next_entry(pos, member))/**
@@ -650,7 +659,7 @@ static inline void list_splice_tail_init* Iterate backwards over list of given type, continuing from current position. */ #define list_for_each_entry_from_reverse (pos, head, member) \ - for (; &pos->member != (head); \ + for (; !list_entry_is_head(pos, head, member); \ pos = list_prev_entry(pos, member))/**
@@ -663,7 +672,7 @@ static inline void list_splice_tail_init#define list_for_each_entry_safe (pos, n, head, member) \ for (pos = list_first_entry(head, typeof(*pos), member), \ n = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_next_entry(n, member))/**
@@ -679,7 +688,7 @@ static inline void list_splice_tail_init#define list_for_each_entry_safe_continue (pos, n, head, member) \ for (pos = list_next_entry(pos, member), \ n = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_next_entry(n, member))/**
@@ -694,7 +703,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_safe_from (pos, n, head, member) \ for (n = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_next_entry(n, member))/**
@@ -710,7 +719,7 @@ static inline void list_splice_tail_init#define list_for_each_entry_safe_reverse (pos, n, head, member) \ for (pos = list_last_entry(head, typeof(*pos), member), \ n = list_prev_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_prev_entry(n, member))/**
Greg Kroah-Hartman
maintainerPATCH 10/260 9p/xen: Fix end of loop tests for list_for_each_entry
In reply to Greg Kroah-HartmanFrom: Harshvardhan Jha <[email protected]>
commit 732b33d0dbf17e9483f0b50385bf606f724f50a2 upstream.
This patch addresses the following problems:
- priv can never be NULL, so this part of the check is useless
- if the loop ran through the whole list, priv->client is invalid and
it is more appropriate and sufficient to check for the end of list_for_each_entry loop condition.
--- net/9p/trans_xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/9p/trans_xen.c +2 -2
@@ -138,7 +138,7 @@ static bool p9_xen_write_todo(struct xenstatic int p9_xen_request (struct p9_client *client,struct p9_req_t *p9_req) { -struct xen_9pfs_front_priv *priv =NULL ; +struct xen_9pfs_front_priv *priv;RING_IDX cons, prod, masked_cons, masked_prod;unsigned long flags;u32 size = p9_req->tc.size;
@@ -151,7 +151,7 @@ static int p9_xen_request(struct p9_cliebreak ; }read_unlock (&xen_9pfs_lock); -if (!priv || priv->client != client) +if (list_entry_is_head (priv, &xen_9pfs_devs, list))return -EINVAL ; num = p9_req->tc.tag % priv->num_rings;
Greg Kroah-Hartman
maintainerPATCH 11/260 tools/thermal/tmon: Add cross compiling support
In reply to Greg Kroah-HartmanFrom: Rolf Eike Beer <[email protected]>
commit b5f7912bb604b47a0fe024560488a7556dce8ee7 upstream.
Default to prefixed pkg-config when crosscompiling, this matches what other parts of the tools/ directory already do.
[dlezcano] : Reworked description
--- tools/thermal/tmon/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/thermal/tmon/Makefile +1 -1
@@ -10,7 +10,7 @@ override CFLAGS+= $(call cc-option,-O3,- # Add "-fstack-protector" only if toolchain supports it. override CFLAGS+= $(call cc-option,-fstack-protector-strong) CC?= $(CROSS_COMPILE)gcc -PKG_CONFIG?= pkg-config +PKG_CONFIG?= $(CROSS_COMPILE)pkg-config override CFLAGS+=-D VERSION=\"$(VERSION)\" LDFLAGS+=
Greg Kroah-Hartman
maintainerPATCH 12/260 pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 1b73e588f47397dee6e4bdfd953e0306c60b5fe5 upstream.
Casting a small array of u8 to an unsigned long is *never* OK:
- it does funny thing when the array size is less than that of a long, as it accesses random places in the stack
- it makes everything even more fun with a BE kernel
Fix this by building the unsigned long used as a bitmap byte by byte, in a way that works across endianess and has no undefined behaviours.
An extra BUILD_BUG_ON() catches the unlikely case where the array would be larger than a single unsigned long.
--- drivers/pinctrl/pinctrl-stmfx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pinctrl/pinctrl-stmfx.c +4 -2
@@ -540,7 +540,7 @@ static irqreturn_t stmfx_pinctrl_irq_thru8 pending[NR_GPIO_REGS ];u8 src[NR_GPIO_REGS ] = {0 ,0 ,0 };unsigned long n, status; -int ret; +int i, ret; ret =regmap_bulk_read (pctl->stmfx->map,STMFX_REG_IRQ_GPI_PENDING , &pending,NR_GPIO_REGS );
@@ -550,7 +550,9 @@ static irqreturn_t stmfx_pinctrl_irq_thrregmap_bulk_write (pctl->stmfx->map,STMFX_REG_IRQ_GPI_SRC , src,NR_GPIO_REGS ); - status = *(unsigned long *)pending; +BUILD_BUG_ON (NR_GPIO_REGS >sizeof (status)); +for (i =0 , status =0 ; i <NR_GPIO_REGS ; i++) + status |= (unsigned long )pending[i] << (i *8 );for_each_set_bit (n, &status, gc->ngpio) {handle_nested_irq (irq_find_mapping (gc->irq.domain, n));stmfx_pinctrl_irq_toggle_trigger (pctl, n);
Greg Kroah-Hartman
maintainerPATCH 13/260 pinctrl: ingenic: Fix incorrect pull up/down info
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
commit d5e931403942b3af39212960c2592b5ba741b2bf upstream.
Fix the pull up/down info for both the JZ4760 and JZ4770 SoCs, as the previous values sometimes contradicted what's written in the programming manual.
--- drivers/pinctrl/pinctrl-ingenic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-ingenic.c +3 -3
@@ -348,7 +348,7 @@ static const struct ingenic_chip_info jz };static const u32 jz4760_pull_ups[6 ] = { -0xffffffff ,0xfffcf3ff ,0xffffffff ,0xffffcfff ,0xfffffb7c ,0xfffff00f , +0xffffffff ,0xfffcf3ff ,0xffffffff ,0xffffcfff ,0xfffffb7c ,0x0000000f , };static const u32 jz4760_pull_downs[6 ] = {
@@ -611,11 +611,11 @@ static const struct ingenic_chip_info jz };static const u32 jz4770_pull_ups[6 ] = { -0x3fffffff ,0xfff0030c ,0xffffffff ,0xffff4fff ,0xfffffb7c ,0xffa7f00f , +0x3fffffff ,0xfff0f3fc ,0xffffffff ,0xffff4fff ,0xfffffb7c ,0x0024f00f , };static const u32 jz4770_pull_downs[6 ] = { -0x00000000 ,0x000f0c03 ,0x00000000 ,0x0000b000 ,0x00000483 ,0x00580ff0 , +0x00000000 ,0x000f0c03 ,0x00000000 ,0x0000b000 ,0x00000483 ,0x005b0ff0 , };static int jz4770_uart0_data_pins[] = {0xa0 ,0xa3 , };
Greg Kroah-Hartman
maintainerPATCH 14/260 soc: qcom: aoss: Fix the out of bound usage of cooling_devs
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
commit a89f355e469dcda129c2522be4fdba00c1c74c83 upstream.
In "qmp_cooling_devices_register", the count value is initially QMP_NUM_COOLING_RESOURCES, which is 2. Based on the initial count value, the memory for cooling_devs is allocated. Then while calling the "qmp_cooling_device_add" function, count value is post-incremented for each child node.
This makes the out of bound access to the cooling_dev array. Fix it by passing the QMP_NUM_COOLING_RESOURCES definition to devm_kzalloc() and initializing the count to 0.
While at it, let's also free the memory allocated to cooling_dev if no cooling device is found in DT and during unroll phase.
--- drivers/soc/qcom/qcom_aoss.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/soc/qcom/qcom_aoss.c +6 -2
@@ -472,12 +472,12 @@ static int qmp_cooling_device_add(structstatic int qmp_cooling_devices_register (struct qmp *qmp) {struct device_node *np, *child; -int count =QMP_NUM_COOLING_RESOURCES ; +int count =0 ;int ret; np = qmp->dev->of_node; - qmp->cooling_devs =devm_kcalloc (qmp->dev, count, + qmp->cooling_devs =devm_kcalloc (qmp->dev,QMP_NUM_COOLING_RESOURCES ,sizeof (*qmp->cooling_devs),GFP_KERNEL );
@@ -493,12 +493,16 @@ static int qmp_cooling_devices_register( goto unroll; } +if (!count) +devm_kfree (qmp->dev, qmp->cooling_devs); +return 0 ; unroll:while (--count >=0 )thermal_cooling_device_unregister (qmp->cooling_devs[count].cdev); +devm_kfree (qmp->dev, qmp->cooling_devs);return ret; }
Greg Kroah-Hartman
maintainerPATCH 15/260 soc: aspeed: lpc-ctrl: Fix boundary check for mmap
In reply to Greg Kroah-HartmanFrom: Iwona Winiarska <[email protected]>
commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream.
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver.
--- drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-lpc-ctrl.c +1 -1
@@ -46,7 +46,7 @@ static int aspeed_lpc_ctrl_mmap(struct funsigned long vsize = vma->vm_end - vma->vm_start;pgprot_t prot = vma->vm_page_prot; -if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size) +if (vma->vm_pgoff +vma_pages (vma) > lpc_ctrl->mem_size >>PAGE_SHIFT )return -EINVAL ;/* ast2400/2500 AHB accesses are not cache coherent */
Greg Kroah-Hartman
maintainerPATCH 16/260 soc: aspeed: p2a-ctrl: Fix boundary check for mmap
In reply to Greg Kroah-HartmanFrom: Iwona Winiarska <[email protected]>
commit 8b07e990fb254fcbaa919616ac77f981cb48c73d upstream.
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver.
--- drivers/soc/aspeed/aspeed-p2a-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-p2a-ctrl.c +1 -1
@@ -110,7 +110,7 @@ static int aspeed_p2a_mmap(struct file * vsize = vma->vm_end - vma->vm_start; prot = vma->vm_page_prot; -if (vma->vm_pgoff + vsize > ctrl->mem_base + ctrl->mem_size) +if (vma->vm_pgoff +vma_pages (vma) > ctrl->mem_size >>PAGE_SHIFT )return -EINVAL ;/* ast2400/2500 AHB accesses are not cache coherent */
Greg Kroah-Hartman
maintainerPATCH 17/260 arm64: head: avoid over-mapping in map_memory
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit 90268574a3e8a6b883bd802d702a2738577e1006 upstream.
The compute_indices and populate_entries macros operate on inclusive bounds, and thus the map_memory macro which uses them also operates on inclusive bounds.
We pass _end and _idmap_text_end to map_memory, but these are exclusive bounds, and if one of these is sufficiently aligned (as a result of kernel configuration, physical placement, and KASLR), then:
* In compute_indices, the computed iend will be in the page/block *after* the final byte of the intended mapping.
* In populate_entries, an unnecessary entry will be created at the end of each level of table. At the leaf level, this entry will map up to SWAPPER_BLOCK_SIZE bytes of physical addresses that we did not intend to map.
As we may map up to SWAPPER_BLOCK_SIZE bytes more than intended, we may violate the boot protocol and map physical address past the 2MiB-aligned end address we are permitted to map. As we map these with Normal memory attributes, this may result in further problems depending on what these physical addresses correspond to.
The final entry at each level may require an additional table at that level. As EARLY_ENTRIES() calculates an inclusive bound, we allocate enough memory for this.
Avoid the extraneous mapping by having map_memory convert the exclusive end address to an inclusive end address by subtracting one, and do likewise in EARLY_ENTRIES() when calculating the number of required tables. For clarity, comments are updated to more clearly document which boundaries the macros operate on. For consistency with the other macros, the comments in map_memory are also updated to describe vstart and vend as virtual addresses.
--- arch/arm64/include/asm/kernel-pgtable.h | 4 ++-- arch/arm64/kernel/head.S | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-)
arch/arm64/include/asm/kernel-pgtable.h +2 -2
@@ -65,8 +65,8 @@#define EARLY_KASLR (0)#endif -#define EARLY_ENTRIES (vstart, vend, shift) (((vend) >> (shift)) \ - - ((vstart) >> (shift)) + 1 + EARLY_KASLR) +#define EARLY_ENTRIES (vstart, vend, shift) \ + ((((vend) - 1) >> (shift)) - ((vstart) >> (shift)) + 1 + EARLY_KASLR)#define EARLY_PGDS (vstart, vend) (EARLY_ENTRIES(vstart, vend, PGDIR_SHIFT))
arch/arm64/kernel/head.S +6 -5
@@ -194,7 +194,7 @@ ENDPROC(preserve_boot_args) * to be composed of multiple pages. (This effectively scales the end index). * * vstart: virtual address of start of range - * vend: virtual address of end of range + * vend: virtual address of end of range - we map [vstart, vend] * shift: shift used to transform virtual address into index * ptrs: number of entries in page table * istart: index in table corresponding to vstart
@@ -231,17 +231,18 @@ ENDPROC(preserve_boot_args) * * tbl: location of page table * rtbl: address to be used for first level page table entry (typically tbl + PAGE_SIZE) - * vstart: start address to map - * vend: end address to map - we map [vstart, vend] + * vstart: virtual address of start of range + * vend: virtual address of end of range - we map [vstart, vend - 1] * flags: flags to use to map last level entries * phys: physical address corresponding to vstart - physical memory is contiguous * pgds: the number of pgd entries * * Temporaries: istart, iend, tmp, count, sv - these need to be different registers - * Preserves: vstart, vend, flags - * Corrupts: tbl, rtbl, istart, iend, tmp, count, sv + * Preserves: vstart, flags + * Corrupts: tbl, rtbl, vend, istart, iend, tmp, count, sv */ .macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv + sub \vend, \vend, #1 add \rtbl, \tbl, #PAGE_SIZE mov \sv, \rtbl mov \count, #0
Greg Kroah-Hartman
maintainerPATCH 18/260 crypto: public_key: fix overflow during implicit conversion
In reply to Greg Kroah-HartmanFrom: zhenwei pi <[email protected]>
commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream.
Hit kernel warning like this, it can be reproduced by verifying 256 bytes datafile by keyctl command, run script:
RAWDATA=rawdata
SIGDATA=sigdata
modprobe pkcs8_key_parser
rm -rf *.der *.pem *.pfx
rm -rf $RAWDATA
dd if=/dev/random of=$RAWDATA bs=256 count=1
openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
-subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=xx.com/[email protected]"
KEY_ID=`openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER | keyctl \
padd asymmetric 123 @s`
keyctl pkey_sign $KEY_ID 0 $RAWDATA enc=pkcs1 hash=sha1 > $SIGDATA keyctl pkey_verify $KEY_ID 0 $RAWDATA $SIGDATA enc=pkcs1 hash=sha1
Then the kernel reports:
WARNING: CPU: 5 PID: 344556 at crypto/rsa-pkcs1pad.c:540 pkcs1pad_verify+0x160/0x190 ... Call Trace: public_key_verify_signature+0x282/0x380 ? software_key_query+0x12d/0x180 ? keyctl_pkey_params_get+0xd6/0x130 asymmetric_key_verify_signature+0x66/0x80 keyctl_pkey_verify+0xa5/0x100 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
The reason of this issue, in function 'asymmetric_key_verify_signature':
'.digest_size(u8) = params->in_len(u32)' leads overflow of an u8 value, so use u32 instead of u8 for digest_size field. And reorder struct public_key_signature, it saves 8 bytes on a 64-bit machine.
--- include/crypto/public_key.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/crypto/public_key.h +2 -2
@@ -38,9 +38,9 @@ extern void public_key_free(struct publistruct public_key_signature {struct asymmetric_key_id *auth_ids[2 ];u8 *s;/* Signature */ -u32 s_size;/* Number of bytes in signature */ u8 *digest; -u8 digest_size;/* Number of bytes in digest */ +u32 s_size;/* Number of bytes in signature */ +u32 digest_size;/* Number of bytes in digest */ const char *pkey_algo;const char *hash_algo;const char *encoding;
Greg Kroah-Hartman
maintainerPATCH 19/260 block: bfq: fix bfq_set_next_ioprio_data()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit a680dd72ec336b81511e3bff48efac6dbfa563e7 upstream.
For a request that has a priority level equal to or larger than IOPRIO_BE_NR, bfq_set_next_ioprio_data() prints a critical warning but defaults to setting the request new_ioprio field to IOPRIO_BE_NR. This is not consistent with the warning and the allowed values for priority levels. Fix this by setting the request new_ioprio field to IOPRIO_BE_NR - 1, the lowest priority level allowed.
--- block/bfq-iosched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-iosched.c +1 -1
@@ -5004,7 +5004,7 @@ bfq_set_next_ioprio_data(struct bfq_queuif (bfqq->new_ioprio >=IOPRIO_BE_NR ) {pr_crit ("bfq_set_next_ioprio_data: new_ioprio %d\n" , bfqq->new_ioprio); - bfqq->new_ioprio =IOPRIO_BE_NR ; + bfqq->new_ioprio =IOPRIO_BE_NR -1 ; } bfqq->entity.new_weight =bfq_ioprio_to_weight (bfqq->new_ioprio);
Greg Kroah-Hartman
maintainerPATCH 20/260 power: supply: max17042: handle fails of reading status register
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 54784ffa5b267f57161eb8fbb811499f22a0a0bf upstream.
Reading status register can fail in the interrupt handler. In such case, the regmap_read() will not store anything useful under passed 'val' variable and random stack value will be used to determine type of interrupt.
Handle the regmap_read() failure to avoid handling interrupt type and triggering changed power supply event based on random stack value.
--- drivers/power/supply/max17042_battery.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +5 -1
@@ -842,8 +842,12 @@ static irqreturn_t max17042_thread_handl {struct max17042_chip *chip = dev;u32 val; +int ret; + + ret =regmap_read (chip->regmap,MAX17042_STATUS , &val); +if (ret) +return IRQ_HANDLED ; -regmap_read (chip->regmap,MAX17042_STATUS , &val);if ((val &STATUS_INTR_SOCMIN_BIT ) || (val &STATUS_INTR_SOCMAX_BIT )) {dev_info (&chip->client->dev,"SOC threshold INTR\n" );
Greg Kroah-Hartman
maintainerPATCH 21/260 dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
In reply to Greg Kroah-HartmanFrom: Arne Welzel <[email protected]>
commit 528b16bfc3ae5f11638e71b3b63a81f9999df727 upstream.
On systems with many cores using dm-crypt, heavy spinlock contention in percpu_counter_compare() can be observed when the page allocation limit for a given device is reached or close to be reached. This is due to percpu_counter_compare() taking a spinlock to compute an exact result on potentially many CPUs at the same time.
Switch to non-exact comparison of allocated and allowed pages by using the value returned by percpu_counter_read_positive() to avoid taking the percpu_counter spinlock.
This may over/under estimate the actual number of allocated pages by at most (batch-1) * num_online_cpus().
Currently, batch is bounded by 32. The system on which this issue was first observed has 256 CPUs and 512GB of RAM. With a 4k page size, this change may over/under estimate by 31MB. With ~10G (2%) allowed dm-crypt allocations, this seems an acceptable error. Certainly preferred over running into the spinlock contention.
This behavior was reproduced on an EC2 c5.24xlarge instance with 96 CPUs and 192GB RAM as follows, but can be provoked on systems with less CPUs as well.
* Disable swap
* Tune vm settings to promote regular writeback
$ echo 50 > /proc/sys/vm/dirty_expire_centisecs
$ echo 25 > /proc/sys/vm/dirty_writeback_centisecs
$ echo $((128 * 1024 * 1024)) > /proc/sys/vm/dirty_background_bytes * Create 8 dmcrypt devices based on files on a tmpfs
* Create and mount an ext4 filesystem on each crypt devices
* Run stress-ng --hdd 8 within one of above filesystems
Total %system usage collected from sysstat goes to ~35%. Write throughput on the underlying loop device is ~2GB/s. perf profiling an individual kworker kcryptd thread shows the following profile, indicating spinlock contention in percpu_counter_compare():
99.98% 0.00% kworker/u193:46 [kernel.kallsyms] [k] ret_from_fork
|
--ret_from_fork
kthread
worker_thread
|
--99.92%--process_one_work
|
|--80.52%--kcryptd_crypt
| |
| |--62.58%--mempool_alloc
| | |
| | --62.24%--crypt_page_alloc
| | |
| | --61.51%--__percpu_counter_compare
| | |
| | --61.34%--__percpu_counter_sum
| | |
| | |--58.68%--_raw_spin_lock_irqsave
| | | |
| | | --58.30%--native_queued_spin_lock_slowpath
| | |
| | --0.69%--cpumask_next
| | |
| | --0.51%--_find_next_bit
| |
| |--10.61%--crypt_convert
| | |
| | |--6.05%--xts_crypt
...After applying this patch and running the same test, %system usage is lowered to ~7% and write throughput on the loop device increases to ~2.7GB/s. perf report shows mempool_alloc() as ~8% rather than ~62% in the profile and not hitting the percpu_counter() spinlock anymore.
|--8.15%--mempool_alloc
| |
| |--3.93%--crypt_page_alloc
| | |
| | --3.75%--__alloc_pages
| | |
| | --3.62%--get_page_from_freelist
| | |
| | --3.22%--rmqueue_bulk
| | |
| | --2.59%--_raw_spin_lock
| | |
| | --2.57%--native_queued_spin_lock_slowpath
| |
| --3.05%--_raw_spin_lock_irqsave
| |
| --2.49%--native_queued_spin_lock_slowpath--- drivers/md/dm-crypt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/md/dm-crypt.c +6 -1
@@ -2092,7 +2092,12 @@ static void *crypt_page_alloc(gfp_t gfp_struct crypt_config *cc = pool_data;struct page *page; -if (unlikely (percpu_counter_compare (&cc->n_allocated_pages, dm_crypt_pages_per_client) >=0 ) && +/* +* Note, percpu_counter_read_positive() may over (and under) estimate +* the current usage by at most (batch - 1) * num_online_cpus() pages, +* but avoids potential spinlock contention of an exact result. +*/ +if (unlikely (percpu_counter_read_positive (&cc->n_allocated_pages) >= dm_crypt_pages_per_client) &&likely (gfp_mask & __GFP_NORETRY))return NULL ;
Greg Kroah-Hartman
maintainerPATCH 22/260 VMCI: fix NULL pointer dereference when unmapping queue pair
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
commit a30dc6cf0dc51419021550152e435736aaef8799 upstream.
I got a NULL pointer dereference report when doing fuzz test:
Call Trace: qp_release_pages+0xae/0x130 qp_host_unregister_user_memory.isra.25+0x2d/0x80 vmci_qp_broker_unmap+0x191/0x320 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 vmci_host_unlocked_ioctl+0x59f/0xd50 ? do_vfs_ioctl+0x14b/0xa10 ? tomoyo_file_ioctl+0x28/0x30 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 __x64_sys_ioctl+0xea/0x120 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
When a queue pair is created by the following call, it will not register the user memory if the page_store is NULL, and the entry->state will be set to VMCIQPB_CREATED_NO_MEM.
vmci_host_unlocked_ioctl
vmci_host_do_alloc_queuepair
vmci_qp_broker_alloc
qp_broker_alloc
qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM;When unmapping this queue pair, qp_host_unregister_user_memory() will be called to unregister the non-existent user memory, which will result in a null pointer reference. It will also change VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be present in this operation.
Only when the qp broker has mem, it can unregister the user memory when unmapping the qp broker.
Only when the qp broker has no mem, it can register the user memory when mapping the qp broker.
--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/misc/vmw_vmci/vmci_queue_pair.c +4 -2
@@ -2238,7 +2238,8 @@ int vmci_qp_broker_map(struct vmci_handl result =VMCI_SUCCESS ; -if (context_id !=VMCI_HOST_CONTEXT_ID ) { +if (context_id !=VMCI_HOST_CONTEXT_ID && + !QPBROKERSTATE_HAS_MEM (entry)) {struct vmci_qp_page_store page_store; page_store.pages = guest_mem;
@@ -2345,7 +2346,8 @@ int vmci_qp_broker_unmap(struct vmci_han goto out; } -if (context_id !=VMCI_HOST_CONTEXT_ID ) { +if (context_id !=VMCI_HOST_CONTEXT_ID && +QPBROKERSTATE_HAS_MEM (entry)) {qp_acquire_queue_mutex (entry->produce_q); result =qp_save_headers (entry);if (result <VMCI_SUCCESS )
Greg Kroah-Hartman
maintainerPATCH 23/260 media: uvc: dont do DMA on stack
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
commit 1a10d7fdb6d0e235e9d230916244cc2769d3f170 upstream.
As warned by smatch:
drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i) drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)
those two functions call uvc_query_ctrl passing a pointer to a data at the DMA stack. those are used to send URBs via usb_control_msg(). Using DMA stack is not supported and should not work anymore on modern Linux versions.
So, use a kmalloc'ed buffer.
--- drivers/media/usb/uvc/uvc_v4l2.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +23 -11
@@ -894,8 +894,8 @@ static int uvc_ioctl_g_input(struct file {struct uvc_fh *handle = fh;struct uvc_video_chain *chain = handle->chain; +u8 *buf;int ret; -u8 i;if (chain->selector ==NULL || (chain->dev->quirks &UVC_QUIRK_IGNORE_SELECTOR_UNIT )) {
@@ -903,22 +903,27 @@ static int uvc_ioctl_g_input(struct filereturn 0 ; } + buf =kmalloc (1 ,GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , chain->selector->id, chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , - &i,1 ); -if (ret <0 ) -return ret; + buf,1 ); +if (!ret) + *input = *buf -1 ; - *input = i -1 ; -return 0 ; +kfree (buf); + +return ret; }static int uvc_ioctl_s_input (struct file *file,void *fh,unsigned int input) {struct uvc_fh *handle = fh;struct uvc_video_chain *chain = handle->chain; +u8 *buf;int ret; -u32 i; ret =uvc_acquire_privileges (handle);if (ret <0 )
@@ -934,10 +939,17 @@ static int uvc_ioctl_s_input(struct fileif (input >= chain->selector->bNrInPins)return -EINVAL ; - i = input +1 ; -return uvc_query_ctrl (chain->dev,UVC_SET_CUR , chain->selector->id, - chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , - &i,1 ); + buf =kmalloc (1 ,GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + + *buf = input +1 ; + ret =uvc_query_ctrl (chain->dev,UVC_SET_CUR , chain->selector->id, + chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , + buf,1 ); +kfree (buf); + +return ret; } static int uvc_ioctl_queryctrl(struct file *file, void *fh,
Greg Kroah-Hartman
maintainerPATCH 24/260 media: rc-loopback: return number of emitters rather than error
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 upstream.
The LIRC_SET_TRANSMITTER_MASK ioctl should return the number of emitters if an invalid list was set.
--- drivers/media/rc/rc-loopback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/rc-loopback.c +1 -1
@@ -42,7 +42,7 @@ static int loop_set_tx_mask(struct rc_deif ((mask & (RXMASK_REGULAR |RXMASK_LEARNING )) != mask) {dprintk ("invalid tx mask: %u\n" , mask); -return -EINVAL ; +return 2 ; }dprintk ("setting tx mask: %u\n" , mask);
Greg Kroah-Hartman
maintainerPATCH 25/260 Revert "dmaengine: imx-sdma: refine to load context only once"
In reply to Greg Kroah-HartmanFrom: Robin Gong <[email protected]>
commit 8592f02464d52776c5cfae4627c6413b0ae7602d upstream.
This reverts commit ad0d92d7ba6aecbe2705907c38ff8d8be4da1e9c, because in spi-imx case, burst length may be changed dynamically.
--- drivers/dma/imx-sdma.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/dma/imx-sdma.c +0 -8
@@ -377,7 +377,6 @@ struct sdma_channel {unsigned long watermark_level;u32 shp_addr, per_addr;enum dma_status status; -bool context_loaded;struct imx_dma_data data;struct work_struct terminate_worker; };
@@ -988,9 +987,6 @@ static int sdma_load_context(struct sdmaint ret;unsigned long flags; -if (sdmac->context_loaded) -return 0 ; -if (sdmac->direction ==DMA_DEV_TO_MEM ) load_address = sdmac->pc_from_device;else if (sdmac->direction ==DMA_DEV_TO_DEV )
@@ -1033,8 +1029,6 @@ static int sdma_load_context(struct sdmaspin_unlock_irqrestore (&sdma->channel_0_lock, flags); - sdmac->context_loaded = true; -return ret; }
@@ -1074,7 +1068,6 @@ static void sdma_channel_terminate_work( sdmac->desc =NULL ;spin_unlock_irqrestore (&sdmac->vc.lock, flags);vchan_dma_desc_free_list (&sdmac->vc, &head); - sdmac->context_loaded = false; }static int sdma_disable_channel_async (struct dma_chan *chan)
@@ -1335,7 +1328,6 @@ static void sdma_free_chan_resources(str sdmac->event_id0 =0 ; sdmac->event_id1 =0 ; - sdmac->context_loaded = false;sdma_set_channel_priority (sdmac,0 );
Greg Kroah-Hartman
maintainerPATCH 26/260 dmaengine: imx-sdma: remove duplicated sdma_load_context
In reply to Greg Kroah-HartmanFrom: Robin Gong <[email protected]>
commit e555a03b112838883fdd8185d613c35d043732f2 upstream.
Since sdma_transfer_init() will do sdma_load_context before any sdma transfer, no need once more in sdma_config_channel().
--- drivers/dma/imx-sdma.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/dma/imx-sdma.c +1 -4
@@ -1134,7 +1134,6 @@ static void sdma_set_watermarklevel_for_static int sdma_config_channel (struct dma_chan *chan) {struct sdma_channel *sdmac =to_sdma_chan (chan); -int ret;sdma_disable_channel (chan);
@@ -1174,9 +1173,7 @@ static int sdma_config_channel(struct dm sdmac->watermark_level =0 ;/* FIXME: M3_BASE_ADDRESS */ } - ret =sdma_load_context (sdmac); - -return ret; +return 0 ; } static int sdma_set_channel_priority(struct sdma_channel *sdmac,
Greg Kroah-Hartman
maintainerPATCH 27/260 libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 8a6430ab9c9c87cb64c512e505e8690bbaee190b upstream.
Commit ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860") limited the existing ATA_HORKAGE_NO_NCQ_TRIM quirk from "Samsung SSD 8*", covering all Samsung 800 series SSDs, to only apply to "Samsung SSD 840*" and "Samsung SSD 850*" series based on information from Samsung.
But there is a large number of users which is still reporting issues with the Samsung 860 and 870 SSDs combined with Intel, ASmedia or Marvell SATA controllers and all reporters also report these problems going away when disabling queued trims.
Note that with AMD SATA controllers users are reporting even worse issues and only completely disabling NCQ helps there, this will be addressed in a separate patch.
--- drivers/ata/libata-core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/ata/libata-core.c +4 -0
@@ -4556,6 +4556,10 @@ static const struct ata_blacklist_entry ATA_HORKAGE_ZERO_AFTER_TRIM, }, {"Samsung SSD 850*" ,NULL ,ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, },
Greg Kroah-Hartman
maintainerPATCH 28/260 ARM: 9105/1: atags_to_fdt: dont warn about stack size
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
commit b30d0289de72c62516df03fdad8d53f552c69839 upstream.
The merge_fdt_bootargs() function by definition consumes more than 1024 bytes of stack because it has a 1024 byte command line on the stack, meaning that we always get a warning when building this file:
arch/arm/boot/compressed/atags_to_fdt.c: In function 'merge_fdt_bootargs':arch/arm/boot/compressed/atags_to_fdt.c:98:1: warning: the frame size of 1032 bytes is larger than 1024 bytes [-Wframe-larger-than=]
However, as this is the decompressor and we know that it has a very shallow call chain, and we do not actually risk overflowing the kernel stack at runtime here.
This just shuts up the warning by disabling the warning flag for this file.
Tested on Nexus 7 2012 builds.
--- arch/arm/boot/compressed/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/compressed/Makefile +2 -0
@@ -90,6 +90,8 @@ $(addprefix $(obj)/,$(libfdt_objs) atags $(addprefix $(obj)/,$(libfdt_hdrs)) ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y) +CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN} +CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280 OBJS += $(libfdt_objs) atags_to_fdt.o endif
Greg Kroah-Hartman
maintainerPATCH 29/260 PCI/portdrv: Enable Bandwidth Notification only if port supports it
In reply to Greg Kroah-HartmanFrom: Stuart Hayes <[email protected]>
commit 00823dcbdd415c868390feaca16f0265101efab4 upstream.
Previously we assumed that all Root Ports and Switch Downstream Ports supported Link Bandwidth Notification. Per spec, this is only required for Ports supporting Links wider than x1 and/or multiple Link speeds (PCIe r5.0, sec 7.5.3.6).
Because we assumed all Ports supported it, we tried to set up a Bandwidth Notification IRQ, which failed for devices that don't support IRQs at all, which meant pcieport didn't attach to the Port at all.
Check the Link Bandwidth Notification Capability bit and enable the service only when the Port supports it.
--- drivers/pci/pcie/portdrv_core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/pci/pcie/portdrv_core.c +7 -2
@@ -255,8 +255,13 @@ static int get_port_device_capability(st services |=PCIE_PORT_SERVICE_DPC ;if (pci_pcie_type (dev) ==PCI_EXP_TYPE_DOWNSTREAM || -pci_pcie_type (dev) ==PCI_EXP_TYPE_ROOT_PORT ) - services |=PCIE_PORT_SERVICE_BWNOTIF ; +pci_pcie_type (dev) ==PCI_EXP_TYPE_ROOT_PORT ) { +u32 linkcap; + +pcie_capability_read_dword (dev,PCI_EXP_LNKCAP , &linkcap); +if (linkcap &PCI_EXP_LNKCAP_LBNC ) + services |=PCIE_PORT_SERVICE_BWNOTIF ; + }return services; }
Greg Kroah-Hartman
maintainerPATCH 30/260 PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit b12d93e9958e028856cbcb061b6e64728ca07755 upstream.
The ASMedia ASM1062 SATA controller advertises Max_Payload_Size_Supported of 512, but in fact it cannot handle incoming TLPs with payload size of 512.
We discovered this issue on PCIe controllers capable of MPS = 512 (Aardvark and DesignWare), where the issue presents itself as an External Abort. Bjorn Helgaas says:
Probably ASM1062 reports a Malformed TLP error when it receives a data payload of 512 bytes, and Aardvark, DesignWare, etc convert this to an arm64 External Abort. [1]
To avoid this problem, limit the ASM1062 Max Payload Size Supported to 256 bytes, so we set the Max Payload Size of devices that may send TLPs to the ASM1062 to 256 or less.
[1] https://lore.kernel.org/linux-pci/20210601170907.GA1949035@bjorn-Precision-5520/
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -3252,6 +3252,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SO PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SOLARFLARE ,PCI_DEVICE_ID_SOLARFLARE_SFC4000B , fixup_mpss_256); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_ASMEDIA ,0x0612 , fixup_mpss_256);/* * Intel 5000 and 5100 Memory controllers have an erratum with read completion
Greg Kroah-Hartman
maintainerPATCH 31/260 PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
In reply to Greg Kroah-HartmanFrom: Krzysztof Wilczyński <[email protected]>
commit a8bd29bd49c4156ea0ec5a97812333e2aeef44e7 upstream.
The pciconfig_read() syscall reads PCI configuration space using hardware-dependent config accessors.
If the read fails on PCI, most accessors don't return an error; they pretend the read was successful and got ~0 data from the device, so the syscall returns success with ~0 data in the buffer.
When the accessor does return an error, pciconfig_read() normally fills the user's buffer with ~0 and returns an error in errno. But after e4585da22ad0 ("pci syscall.c: Switch to refcounting API"), we don't fill the buffer with ~0 for the EPERM "user lacks CAP_SYS_ADMIN" error.
Userspace may rely on the ~0 data to detect errors, but after e4585da22ad0, that would not detect CAP_SYS_ADMIN errors.
Restore the original behaviour of filling the buffer with ~0 when the CAP_SYS_ADMIN check fails.
[bhelgaas: commit log, fold in Nathan's fix
https://lore.kernel.org/r/[email protected]]
--- drivers/pci/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/syscall.c +3 -1
@@ -22,8 +22,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsignedlong err;int cfg_ret; + err = -EPERM ; + dev =NULL ;if (!capable (CAP_SYS_ADMIN )) -return -EPERM ; + goto error; err = -ENODEV ; dev =pci_get_domain_bus_and_slot (0 , bus, dfn);
Greg Kroah-Hartman
maintainerPATCH 32/260 PCI: xilinx-nwl: Enable the clock through CCF
In reply to Greg Kroah-HartmanFrom: Hyun Kwon <[email protected]>
commit de0a01f5296651d3a539f2d23d0db8f359483696 upstream.
Enable PCIe reference clock. There is no remove function that's why this should be enough for simple operation.
Normally this clock is enabled by default by firmware but there are usecases where this clock should be enabled by driver itself. It is also good that PCIe clock is recorded in a clock framework.
--- drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/pci/controller/pcie-xilinx-nwl.c +12 -0
@@ -6,6 +6,7 @@* (C) Copyright 2014 - 2015, Xilinx, Inc. */ +#include <linux/clk.h> #include <linux/delay.h> #include <linux/interrupt.h> #include <linux/irq.h>
@@ -169,6 +170,7 @@ struct nwl_pcie {u8 root_busno;struct nwl_msi msi;struct irq_domain *legacy_irq_domain; +struct clk *clk;raw_spinlock_t leg_mask_lock; };
@@ -839,6 +841,16 @@ static int nwl_pcie_probe(struct platforreturn err; } + pcie->clk =devm_clk_get (dev,NULL ); +if (IS_ERR (pcie->clk)) +return PTR_ERR (pcie->clk); + + err =clk_prepare_enable (pcie->clk); +if (err) { +dev_err (dev,"can't enable PCIe ref clock\n" ); +return err; + } + err =nwl_pcie_bridge_init (pcie);if (err) {dev_err (dev,"HW Initialization failed\n" );
Greg Kroah-Hartman
maintainerPATCH 33/260 PCI: aardvark: Fix checking for PIO status
In reply to Greg Kroah-HartmanFrom: Evan Wang <[email protected]>
commit fcb461e2bc8b83b7eaca20cb2221e8b940f2189c upstream.
There is an issue that when PCIe switch is connected to an Armada 3700 board, there will be lots of warnings about PIO errors when reading the config space. According to Aardvark PIO read and write sequence in HW specification, the current way to check PIO status has the following issues:
1) For PIO read operation, it reports the error message, which should be avoided according to HW specification.
2) For PIO read and write operations, it only checks PIO operation complete status, which is not enough, and error status should also be checked.
This patch aligns the code with Aardvark PIO read and write sequence in HW specification on PIO status check and fix the warnings when reading config space.
[pali: Fix CRS handling when CRSSVE is not enabled]
--- drivers/pci/controller/pci-aardvark.c | 62 +++++++++++++++++++++++++++++----- 1 file changed, 54 insertions(+), 8 deletions(-)
drivers/pci/controller/pci-aardvark.c +54 -8
@@ -62,6 +62,7 @@#define PIO_COMPLETION_STATUS_CRS 2#define PIO_COMPLETION_STATUS_CA 4#define PIO_NON_POSTED_REQ BIT(10) +#define PIO_ERR_STATUS BIT(11)#define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8)#define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc)#define PIO_WR_DATA (PIO_BASE_ADDR + 0x10)
@@ -363,7 +364,7 @@ static void advk_pcie_setup_hw(struct adadvk_writel (pcie, reg,PCIE_CORE_CMD_STATUS_REG ); } -static void advk_pcie_check_pio_status (struct advk_pcie *pcie) +static int advk_pcie_check_pio_status (struct advk_pcie *pcie,u32 *val) {struct device *dev = &pcie->pdev->dev;u32 reg;
@@ -374,14 +375,49 @@ static void advk_pcie_check_pio_status(s status = (reg &PIO_COMPLETION_STATUS_MASK ) >>PIO_COMPLETION_STATUS_SHIFT ; -if (!status) -return ; - +/* +* According to HW spec, the PIO status check sequence as below: +* 1) even if COMPLETION_STATUS(bit9:7) indicates successful, +* it still needs to check Error Status(bit11), only when this bit +* indicates no error happen, the operation is successful. +* 2) value Unsupported Request(1) of COMPLETION_STATUS(bit9:7) only +* means a PIO write error, and for PIO read it is successful with +* a read value of 0xFFFFFFFF. +* 3) value Completion Retry Status(CRS) of COMPLETION_STATUS(bit9:7) +* only means a PIO write error, and for PIO read it is successful +* with a read value of 0xFFFF0001. +* 4) value Completer Abort (CA) of COMPLETION_STATUS(bit9:7) means +* error for both PIO read and PIO write operation. +* 5) other errors are indicated as 'unknown'. +*/ switch (status) { +case PIO_COMPLETION_STATUS_OK : +if (reg &PIO_ERR_STATUS ) { + strcomp_status ="COMP_ERR" ; +break ; + } +/* Get the read result */ +if (val) + *val =advk_readl (pcie,PIO_RD_DATA ); +/* No error */ + strcomp_status =NULL ; +break ;case PIO_COMPLETION_STATUS_UR : strcomp_status ="UR" ;break ;case PIO_COMPLETION_STATUS_CRS : +/* PCIe r4.0, sec 2.3.2, says: +* If CRS Software Visibility is not enabled, the Root Complex +* must re-issue the Configuration Request as a new Request. +* A Root Complex implementation may choose to limit the number +* of Configuration Request/CRS Completion Status loops before +* determining that something is wrong with the target of the +* Request and taking appropriate action, e.g., complete the +* Request to the host as a failed transaction. +* +* To simplify implementation do not re-issue the Configuration +* Request and complete the Request as a failed transaction. +*/ strcomp_status ="CRS" ;break ;case PIO_COMPLETION_STATUS_CA :
@@ -392,6 +428,9 @@ static void advk_pcie_check_pio_status(sbreak ; } +if (!strcomp_status) +return 0 ; +if (reg &PIO_NON_POSTED_REQ ) str_posted ="Non-posted" ;else
@@ -399,6 +438,8 @@ static void advk_pcie_check_pio_status(sdev_err (dev,"%s PIO Response Status: %s, %#x @ %#x\n" , str_posted, strcomp_status, reg,advk_readl (pcie,PIO_ADDR_LS )); + +return -EFAULT ; }static int advk_pcie_wait_pio (struct advk_pcie *pcie)
@@ -625,10 +666,13 @@ static int advk_pcie_rd_conf(struct pci_if (ret <0 )return PCIBIOS_SET_FAILED ; -advk_pcie_check_pio_status (pcie); +/* Check PIO status and get the read result */ + ret =advk_pcie_check_pio_status (pcie, val); +if (ret <0 ) { + *val =0xffffffff ; +return PCIBIOS_SET_FAILED ; + } -/* Get the read result */ - *val =advk_readl (pcie,PIO_RD_DATA );if (size ==1 ) *val = (*val >> (8 * (where &3 ))) &0xff ;else if (size ==2 )
@@ -692,7 +736,9 @@ static int advk_pcie_wr_conf(struct pci_if (ret <0 )return PCIBIOS_SET_FAILED ; -advk_pcie_check_pio_status (pcie); + ret =advk_pcie_check_pio_status (pcie,NULL ); +if (ret <0 ) +return PCIBIOS_SET_FAILED ;return PCIBIOS_SUCCESSFUL ; }
Greg Kroah-Hartman
maintainerPATCH 34/260 PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 02bcec3ea5591720114f586960490b04b093a09e upstream.
Measurements in different conditions showed that aardvark hardware PIO response can take up to 1.44s. Increase wait timeout from 1ms to 1.5s to ensure that we do not miss responses from hardware. After 1.44s hardware returns errors (e.g. Completer abort).
The previous two patches fixed checking for PIO status, so now we can use it to also catch errors which are reported by hardware after 1.44s.
After applying this patch, kernel can detect and print PIO errors to dmesg:
[ 6.879999] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100004
[ 6.896436] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004
[ 6.913049] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100010
[ 6.929663] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100010
[ 6.953558] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100014
[ 6.970170] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100014
[ 6.994328] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004Without this patch kernel prints only a generic error to dmesg:
[ 5.246847] advk-pcie d0070000.pcie: config read/write timed out
--- drivers/pci/controller/pci-aardvark.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pci-aardvark.c +1 -1
@@ -177,7 +177,7 @@ (PCIE_CONF_BUS (bus) |PCIE_CONF_DEV (PCI_SLOT (devfn)) | \ PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where)) -#define PIO_RETRY_CNT 500 +#define PIO_RETRY_CNT 750000/* 1.5 s */ #define PIO_RETRY_DELAY 2/* 2 us*/ #define LINK_WAIT_MAX_RETRIES 10
Greg Kroah-Hartman
maintainerPATCH 35/260 PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit d212dcee27c1f89517181047e5485fcbba4a25c2 upstream.
irq_mask and irq_unmask callbacks need to be properly guarded by raw spin locks as masking/unmasking procedure needs atomic read-modify-write operation on hardware register.
--- drivers/pci/controller/pci-aardvark.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/pci/controller/pci-aardvark.c +9 -0
@@ -194,6 +194,7 @@ struct advk_pcie {struct list_head resources;struct irq_domain *irq_domain;struct irq_chip irq_chip; +raw_spinlock_t irq_lock;struct irq_domain *msi_domain;struct irq_domain *msi_inner_domain;struct irq_chip msi_bottom_irq_chip;
@@ -812,22 +813,28 @@ static void advk_pcie_irq_mask(struct ir {struct advk_pcie *pcie = d->domain->host_data;irq_hw_number_t hwirq =irqd_to_hwirq (d); +unsigned long flags;u32 mask; +raw_spin_lock_irqsave (&pcie->irq_lock, flags); mask =advk_readl (pcie,PCIE_ISR1_MASK_REG ); mask |=PCIE_ISR1_INTX_ASSERT (hwirq);advk_writel (pcie, mask,PCIE_ISR1_MASK_REG ); +raw_spin_unlock_irqrestore (&pcie->irq_lock, flags); }static void advk_pcie_irq_unmask (struct irq_data *d) {struct advk_pcie *pcie = d->domain->host_data;irq_hw_number_t hwirq =irqd_to_hwirq (d); +unsigned long flags;u32 mask; +raw_spin_lock_irqsave (&pcie->irq_lock, flags); mask =advk_readl (pcie,PCIE_ISR1_MASK_REG ); mask &= ~PCIE_ISR1_INTX_ASSERT (hwirq);advk_writel (pcie, mask,PCIE_ISR1_MASK_REG ); +raw_spin_unlock_irqrestore (&pcie->irq_lock, flags); } static int advk_pcie_irq_map(struct irq_domain *h,
@@ -911,6 +918,8 @@ static int advk_pcie_init_irq_domain(strstruct irq_chip *irq_chip;int ret =0 ; +raw_spin_lock_init (&pcie->irq_lock); + pcie_intc_node =of_get_next_child (node,NULL );if (!pcie_intc_node) {dev_err (dev,"No PCIe Intc node found\n" );
Greg Kroah-Hartman
maintainerPATCH 36/260 HID: input: do not report stylus battery state as "full"
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit f4abaa9eebde334045ed6ac4e564d050f1df3013 ]
The power supply states of discharging, charging, full, etc, represent state of charging, not the capacity level of the battery (for which we have a separate property). Current HID usage tables to not allow for expressing charging state of the batteries found in generic styli, so we should simply assume that the battery is discharging even if current capacity is at 100% when battery strength reporting is done via HID interface. In fact, we were doing just that before commit 581c4484769e.
This change helps UIs to not mis-represent fully charged batteries in styli as being charging/topping-off.
--- drivers/hid/hid-input.c | 2 -- 1 file changed, 2 deletions(-)
drivers/hid/hid-input.c +0 -2
@@ -415,8 +415,6 @@ static int hidinput_get_battery_property(struct power_supply *psy,if (dev->battery_status ==HID_BATTERY_UNKNOWN ) val->intval =POWER_SUPPLY_STATUS_UNKNOWN ; -else if (dev->battery_capacity ==100 ) - val->intval =POWER_SUPPLY_STATUS_FULL ;else val->intval =POWER_SUPPLY_STATUS_DISCHARGING ;break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 37/260 f2fs: quota: fix potential deadlock
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 9de71ede81e6d1a111fdd868b2d78d459fa77f80 ]
xfstest generic/587 reports a deadlock issue as below:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc1 #69 Not tainted
------------------------------------------------------
repquota/8606 is trying to acquire lock:ffff888022ac9320 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}, at: f2fs_quota_sync+0x207/0x300 [f2fs]
but task is already holding lock:ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&sbi->quota_sem){.+.+}-{3:3}:
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_read+0x3b/0x2a0
f2fs_quota_sync+0x59/0x300 [f2fs]
f2fs_quota_on+0x48/0x100 [f2fs]
do_quotactl+0x5e3/0xb30
__x64_sys_quotactl+0x23a/0x4e0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae-> #1 (&sbi->cp_rwsem){++++}-{3:3}:
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_read+0x3b/0x2a0
f2fs_unlink+0x353/0x670 [f2fs]
vfs_unlink+0x1c7/0x380
do_unlinkat+0x413/0x4b0
__x64_sys_unlinkat+0x50/0xb0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae-> #0 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}:
check_prev_add+0xdc/0xb30
validate_chain+0xa67/0xb20
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_write+0x39/0xc0
f2fs_quota_sync+0x207/0x300 [f2fs]
do_quotactl+0xaff/0xb30
__x64_sys_quotactl+0x23a/0x4e0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xaeother info that might help us debug this:
Chain exists of: &sb->s_type->i_mutex_key#18 --> &sbi->cp_rwsem --> &sbi->quota_sem Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sbi->quota_sem);
lock(&sbi->cp_rwsem);
lock(&sbi->quota_sem); lock(&sb->s_type->i_mutex_key#18);
*** DEADLOCK ***
3 locks held by repquota/8606:
#0: ffff88801efac0e0 (&type->s_umount_key#53){++++}-{3:3}, at: user_get_super+0xd9/0x190 #1: ffff8880084bc380 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_quota_sync+0x3e/0x300 [f2fs] #2: ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
stack backtrace: CPU: 6 PID: 8606 Comm: repquota Not tainted 5.14.0-rc1 #69 Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 Call Trace: dump_stack_lvl+0xce/0x134 dump_stack+0x17/0x20 print_circular_bug.isra.0.cold+0x239/0x253 check_noncircular+0x1be/0x1f0 check_prev_add+0xdc/0xb30 validate_chain+0xa67/0xb20 __lock_acquire+0x648/0x10b0 lock_acquire+0x128/0x470 down_write+0x39/0xc0 f2fs_quota_sync+0x207/0x300 [f2fs] do_quotactl+0xaff/0xb30 __x64_sys_quotactl+0x23a/0x4e0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f883b0b4efe
The root cause is ABBA deadlock of inode lock and cp_rwsem, reorder locks in f2fs_quota_sync() as below to fix this issue:
- lock inode
- lock cp_rwsem
- lock quota_sem
--- fs/f2fs/super.c | 84 ++++++++++++++++++++++++++++--------------------- 1 file changed, 48 insertions(+), 36 deletions(-)
fs/f2fs/super.c +48 -36
@@ -1994,6 +1994,33 @@ static int f2fs_enable_quotas(struct super_block *sb)return 0 ; } +static int f2fs_quota_sync_file (struct f2fs_sb_info *sbi,int type) +{ +struct quota_info *dqopt =sb_dqopt (sbi->sb); +struct address_space *mapping = dqopt->files[type]->i_mapping; +int ret =0 ; + + ret =dquot_writeback_dquots (sbi->sb, type); +if (ret) + goto out; + + ret =filemap_fdatawrite (mapping); +if (ret) + goto out; + +/* if we are using journalled quota */ +if (is_journalled_quota (sbi)) + goto out; + + ret =filemap_fdatawait (mapping); + +truncate_inode_pages (&dqopt->files[type]->i_data,0 ); +out: +if (ret) +set_sbi_flag (sbi,SBI_QUOTA_NEED_REPAIR ); +return ret; +} +int f2fs_quota_sync (struct super_block *sb,int type) {struct f2fs_sb_info *sbi =F2FS_SB (sb);
@@ -2001,57 +2028,42 @@ int f2fs_quota_sync(struct super_block *sb, int type)int cnt;int ret; -/* -* do_quotactl -* f2fs_quota_sync -* down_read(quota_sem) -* dquot_writeback_dquots() -* f2fs_dquot_commit -* block_operation -* down_read(quota_sem) -*/ -f2fs_lock_op (sbi); - -down_read (&sbi->quota_sem); - ret =dquot_writeback_dquots (sb, type); -if (ret) - goto out; -/* * Now when everything is written we can discard the pagecache so * that userspace sees the changes. */ for (cnt =0 ; cnt <MAXQUOTAS ; cnt++) { -struct address_space *mapping;if (type !=-1 && cnt != type)continue ; -if (!sb_has_quota_active (sb, cnt)) -continue ; - mapping = dqopt->files[cnt]->i_mapping; +if (!sb_has_quota_active (sb, type)) +return 0 ; - ret =filemap_fdatawrite (mapping); -if (ret) - goto out; +inode_lock (dqopt->files[cnt]); -/* if we are using journalled quota */ -if (is_journalled_quota (sbi)) -continue ; +/* +* do_quotactl +* f2fs_quota_sync +* down_read(quota_sem) +* dquot_writeback_dquots() +* f2fs_dquot_commit +* block_operation +* down_read(quota_sem) +*/ +f2fs_lock_op (sbi); +down_read (&sbi->quota_sem); - ret =filemap_fdatawait (mapping); -if (ret) -set_sbi_flag (F2FS_SB (sb),SBI_QUOTA_NEED_REPAIR ); + ret =f2fs_quota_sync_file (sbi, cnt); + +up_read (&sbi->quota_sem); +f2fs_unlock_op (sbi); -inode_lock (dqopt->files[cnt]); -truncate_inode_pages (&dqopt->files[cnt]->i_data,0 );inode_unlock (dqopt->files[cnt]); + +if (ret) +break ; } -out: -if (ret) -set_sbi_flag (F2FS_SB (sb),SBI_QUOTA_NEED_REPAIR ); -up_read (&sbi->quota_sem); -f2fs_unlock_op (sbi);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 38/260 scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit beec64d0c9749afedf51c3c10cf52de1d9a89cc0 ]
SCSI_IOCTL_SEND_COMMAND has been deprecated longer than bsg exists and has been warning for just as long. More importantly it harcodes SCSI CDBs and thus will do the wrong thing on non-SCSI bsg nodes.
--- block/bsg.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
block/bsg.c +4 -1
@@ -371,10 +371,13 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)case SG_GET_RESERVED_SIZE :case SG_SET_RESERVED_SIZE :case SG_EMULATED_HOST : -case SCSI_IOCTL_SEND_COMMAND :return scsi_cmd_ioctl (bd->queue,NULL , file->f_mode, cmd, uarg);case SG_IO :return bsg_sg_io (bd->queue, file->f_mode, uarg); +case SCSI_IOCTL_SEND_COMMAND : +pr_warn_ratelimited ("%s: calling unsupported SCSI_IOCTL_SEND_COMMAND\n" , + current->comm); +return -EINVAL ;default :return -ENOTTY ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 39/260 IB/hfi1: Adjust pkey entry in index 0
In reply to Greg Kroah-HartmanFrom: Mike Marciniszyn <[email protected]>
[ Upstream commit 62004871e1fa7f9a60797595c03477af5b5ec36f ]
It is possible for the primary IPoIB network device associated with any RDMA device to fail to join certain multicast groups preventing IPv6 neighbor discovery and possibly other network ULPs from working correctly. The IPv4 broadcast group is not affected as the IPoIB network device handles joining that multicast group directly.
This is because the primary IPoIB network device uses the pkey at ndex 0 in the associated RDMA device's pkey table. Anytime the pkey value of index 0 changes, the primary IPoIB network device automatically modifies it's broadcast address (i.e. /sys/class/net/[ib0]/broadcast), since the broadcast address includes the pkey value, and then bounces carrier. This includes initial pkey assignment, such as when the pkey at index 0 transitions from the opa default of invalid (0x0000) to some value such as the OPA default pkey for Virtual Fabric 0: 0x8001 or when the fabric manager is restarted with a configuration change causing the pkey at index 0 to change. Many network ULPs are not sensitive to the carrier bounce and are not expecting the broadcast address to change including the linux IPv6 stack. This problem does not affect IPoIB child network devices as their pkey value is constant for all time.
To mitigate this issue, change the default pkey in at index 0 to 0x8001 to cover the predominant case and avoid issues as ipoib comes up and the FM sweeps.
At some point, ipoib multicast support should automatically fix non-broadcast addresses as it does with the primary broadcast address.
--- drivers/infiniband/hw/hfi1/init.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/infiniband/hw/hfi1/init.c +1 -6
@@ -664,12 +664,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd, ppd->pkeys[default_pkey_idx] =DEFAULT_P_KEY ; ppd->part_enforce |=HFI1_PART_ENFORCE_IN ; - -if (loopback) { -dd_dev_err (dd,"Faking data partition 0x8001 in idx %u\n" , - !default_pkey_idx); - ppd->pkeys[!default_pkey_idx] =0x8001 ; - } + ppd->pkeys[0 ] =0x8001 ;INIT_WORK (&ppd->link_vc_work, handle_verify_cap);INIT_WORK (&ppd->link_up_work, handle_link_up);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 40/260 RDMA/iwcm: Release resources if iw_cm module initialization fails
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit e677b72a0647249370f2635862bf0241c86f66ad ]
The failure during iw_cm module initialization partially left the system with unreleased memory and other resources. Rewrite the module init/exit routines in such way that netlink commands will be opened only after successful initialization.
--- drivers/infiniband/core/iwcm.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/infiniband/core/iwcm.c +12 -7
@@ -1187,29 +1187,34 @@ static int __init iw_cm_init(void) ret =iwpm_init (RDMA_NL_IWCM );if (ret) -pr_err ("iw_cm: couldn't init iwpm\n" ); -else -rdma_nl_register (RDMA_NL_IWCM , iwcm_nl_cb_table); +return ret; + iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,0 );if (!iwcm_wq) -return -ENOMEM ; + goto err_alloc; iwcm_ctl_table_hdr =register_net_sysctl (&init_net,"net/iw_cm" , iwcm_ctl_table);if (!iwcm_ctl_table_hdr) {pr_err ("iw_cm: couldn't register sysctl paths\n" ); -destroy_workqueue (iwcm_wq); -return -ENOMEM ; + goto err_sysctl; } +rdma_nl_register (RDMA_NL_IWCM , iwcm_nl_cb_table);return 0 ; + +err_sysctl: +destroy_workqueue (iwcm_wq); +err_alloc: +iwpm_exit (RDMA_NL_IWCM ); +return -ENOMEM ; } static void __exit iw_cm_cleanup(void) { +rdma_nl_unregister (RDMA_NL_IWCM );unregister_net_sysctl_table (iwcm_ctl_table_hdr);destroy_workqueue (iwcm_wq); -rdma_nl_unregister (RDMA_NL_IWCM );iwpm_exit (RDMA_NL_IWCM ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 41/260 docs: Fix infiniband uverbs minor number
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 8d7e415d55610d503fdb8815344846b72d194a40 ]
Starting from the beginning of infiniband subsystem, the uverbs char devices start from 192 as a minor number, see
commit bc38a6abdd5a ("[PATCH] IB uverbs: core implementation").
This patch updates the admin guide documentation to reflect it.
--- Documentation/admin-guide/devices.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Documentation/admin-guide/devices.txt +3 -3
@@ -3002,10 +3002,10 @@ 65 = /dev/infiniband/issm1 Second InfiniBand IsSM device ... 127 = /dev/infiniband/issm63 63rd InfiniBand IsSM device - 128 = /dev/infiniband/uverbs0 First InfiniBand verbs device - 129 = /dev/infiniband/uverbs1 Second InfiniBand verbs device + 192 = /dev/infiniband/uverbs0 First InfiniBand verbs device + 193 = /dev/infiniband/uverbs1 Second InfiniBand verbs device ... - 159 = /dev/infiniband/uverbs31 31st InfiniBand verbs device + 223 = /dev/infiniband/uverbs31 31st InfiniBand verbs device 232 char Biometric Devices 0 = /dev/biometric/sensor0/fingerprint first fingerprint sensor on first device
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 42/260 pinctrl: samsung: Fix pinctrl bank pin count
In reply to Greg Kroah-HartmanFrom: Jaehyoung Choi <[email protected]>
[ Upstream commit 70115558ab02fe8d28a6634350b3491a542aaa02 ]
Commit 1abd18d1a51a ("pinctrl: samsung: Register pinctrl before GPIO") changes the order of GPIO and pinctrl registration: now pinctrl is registered before GPIO. That means gpio_chip->ngpio is not set when samsung_pinctrl_register() called, and one cannot rely on that value anymore. Use pin_bank->nr_pins' instead of pin_bank->gpio_chip.ngpio' to fix mentioned inconsistency.
--- drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/samsung/pinctrl-samsung.c +1 -1
@@ -918,7 +918,7 @@ static int samsung_pinctrl_register(struct platform_device *pdev, pin_bank->grange.pin_base = drvdata->pin_base + pin_bank->pin_base; pin_bank->grange.base = pin_bank->grange.pin_base; - pin_bank->grange.npins = pin_bank->gpio_chip.ngpio; + pin_bank->grange.npins = pin_bank->nr_pins; pin_bank->grange.gc = &pin_bank->gpio_chip;pinctrl_add_gpio_range (drvdata->pctl_dev, &pin_bank->grange); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 43/260 vfio: Use config not menuconfig for VFIO_NOIOMMU
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 26c22cfde5dd6e63f25c48458b0185dcb0fbb2fd ]
VFIO_NOIOMMU is supposed to be an element in the VFIO menu, not start a new menu. Correct this copy-paste mistake.
--- drivers/vfio/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/Kconfig +1 -1
@@ -29,7 +29,7 @@ menuconfig VFIO If you don't know what to do here, say N. -menuconfig VFIO_NOIOMMU +config VFIO_NOIOMMU bool "VFIO No-IOMMU support" depends on VFIO help
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 44/260 powerpc/stacktrace: Include linux/delay.h
In reply to Greg Kroah-HartmanFrom: Michal Suchanek <[email protected]>
[ Upstream commit a6cae77f1bc89368a4e2822afcddc45c3062d499 ]
commit 7c6986ade69e ("powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()") introduces udelay() call without including the linux/delay.h header.
This may happen to work on master but the header that declares the functionshould be included nonetheless.
--- arch/powerpc/kernel/stacktrace.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kernel/stacktrace.c +1 -0
@@ -8,6 +8,7 @@* Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp. */ +#include <linux/delay.h> #include <linux/export.h> #include <linux/kallsyms.h> #include <linux/module.h>
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 45/260 RDMA/efa: Remove double QP type assignment
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit f9193d266347fe9bed5c173e7a1bf96268142a79 ]
The QP type is set by the IB/core and shouldn't be set in the driver.
--- drivers/infiniband/hw/efa/efa_verbs.c | 1 - 1 file changed, 1 deletion(-)
drivers/infiniband/hw/efa/efa_verbs.c +0 -1
@@ -745,7 +745,6 @@ struct ib_qp *efa_create_qp(struct ib_pd *ibpd, rq_entry_inserted = true; qp->qp_handle = create_qp_resp.qp_handle; qp->ibqp.qp_num = create_qp_resp.qp_num; - qp->ibqp.qp_type = init_attr->qp_type; qp->max_send_wr = init_attr->cap.max_send_wr; qp->max_recv_wr = init_attr->cap.max_recv_wr; qp->max_send_sge = init_attr->cap.max_send_sge;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 46/260 f2fs: show f2fs instance in printk_ratelimited
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit c45d6002ff7a322022560e9b19ad867b01fec77f ]
As Eric mentioned, bare printk{,_ratelimited} won't show which filesystem instance these message is coming from, this patch tries to show fs instance with sb->s_id field in all places we missed before.
--- fs/f2fs/checkpoint.c | 2 +- fs/f2fs/data.c | 9 +++++---- fs/f2fs/dir.c | 7 ++++--- fs/f2fs/f2fs.h | 24 +++++++++++++----------- fs/f2fs/file.c | 2 +- fs/f2fs/gc.c | 2 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 2 +- fs/f2fs/segment.c | 9 +++++---- 9 files changed, 32 insertions(+), 27 deletions(-)
fs/f2fs/checkpoint.c +1 -1
@@ -583,7 +583,7 @@ int f2fs_acquire_orphan_inode(struct f2fs_sb_info *sbi)if (time_to_inject (sbi,FAULT_ORPHAN )) {spin_unlock (&im->ino_lock); -f2fs_show_injection_info (FAULT_ORPHAN ); +f2fs_show_injection_info (sbi,FAULT_ORPHAN );return -ENOSPC ; }
fs/f2fs/data.c +5 -4
@@ -167,9 +167,10 @@ static bool f2fs_bio_post_read_required(struct bio *bio)static void f2fs_read_end_io (struct bio *bio) { -if (time_to_inject (F2FS_P_SB (bio_first_page_all (bio)), -FAULT_READ_IO )) { -f2fs_show_injection_info (FAULT_READ_IO ); +struct f2fs_sb_info *sbi =F2FS_P_SB (bio_first_page_all (bio)); + +if (time_to_inject (sbi,FAULT_READ_IO )) { +f2fs_show_injection_info (sbi,FAULT_READ_IO ); bio->bi_status =BLK_STS_IOERR ; }
@@ -191,7 +192,7 @@ static void f2fs_write_end_io(struct bio *bio)struct bvec_iter_all iter_all;if (time_to_inject (sbi,FAULT_WRITE_IO )) { -f2fs_show_injection_info (FAULT_WRITE_IO ); +f2fs_show_injection_info (sbi,FAULT_WRITE_IO ); bio->bi_status =BLK_STS_IOERR ; }
fs/f2fs/dir.c +4 -3
@@ -618,7 +618,7 @@ int f2fs_add_regular_entry(struct inode *dir, const struct qstr *new_name, start:if (time_to_inject (F2FS_I_SB (dir),FAULT_DIR_DEPTH )) { -f2fs_show_injection_info (FAULT_DIR_DEPTH ); +f2fs_show_injection_info (F2FS_I_SB (dir),FAULT_DIR_DEPTH );return -ENOSPC ; }
@@ -909,8 +909,9 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, bit_pos++; ctx->pos = start_pos + bit_pos;printk_ratelimited ( -"%s, invalid namelen(0), ino:%u, run fsck to fix." , -KERN_WARNING ,le32_to_cpu (de->ino)); +"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix." , +KERN_WARNING , sbi->sb->s_id, +le32_to_cpu (de->ino));set_sbi_flag (sbi,SBI_NEED_FSCK );continue ; }
fs/f2fs/f2fs.h +13 -11
@@ -1374,9 +1374,10 @@ struct f2fs_private_dio { };#ifdef CONFIG_F2FS_FAULT_INJECTION -#define f2fs_show_injection_info (type) \ - printk_ratelimited("%sF2FS-fs : inject %s in %s of %pS\n", \ - KERN_INFO, f2fs_fault_name[type], \ +#define f2fs_show_injection_info (sbi, type) \ + printk_ratelimited("%sF2FS-fs (%s) : inject %s in %s of %pS\n", \ + KERN_INFO, sbi->sb->s_id, \ + f2fs_fault_name[type], \ __func__, __builtin_return_address(0))static inline bool time_to_inject (struct f2fs_sb_info *sbi,int type) {
@@ -1396,7 +1397,7 @@ static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type) return false; }#else -#define f2fs_show_injection_info (type) do { } while (0) +#define f2fs_show_injection_info (sbi, type) do { } while (0)static inline bool time_to_inject (struct f2fs_sb_info *sbi,int type) {return false;
@@ -1781,7 +1782,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,return ret;if (time_to_inject (sbi,FAULT_BLOCK )) { -f2fs_show_injection_info (FAULT_BLOCK ); +f2fs_show_injection_info (sbi,FAULT_BLOCK ); release = *count; goto release_quota; }
@@ -2033,7 +2034,7 @@ static inline int inc_valid_node_count(struct f2fs_sb_info *sbi, }if (time_to_inject (sbi,FAULT_BLOCK )) { -f2fs_show_injection_info (FAULT_BLOCK ); +f2fs_show_injection_info (sbi,FAULT_BLOCK ); goto enospc; }
@@ -2148,7 +2149,8 @@ static inline struct page *f2fs_grab_cache_page(struct address_space *mapping,return page;if (time_to_inject (F2FS_M_SB (mapping),FAULT_PAGE_ALLOC )) { -f2fs_show_injection_info (FAULT_PAGE_ALLOC ); +f2fs_show_injection_info (F2FS_M_SB (mapping), +FAULT_PAGE_ALLOC );return NULL ; } }
@@ -2163,7 +2165,7 @@ static inline struct page *f2fs_pagecache_get_page( int fgp_flags, gfp_t gfp_mask) { if (time_to_inject(F2FS_M_SB(mapping), FAULT_PAGE_GET)) { -f2fs_show_injection_info (FAULT_PAGE_GET ); +f2fs_show_injection_info (F2FS_M_SB (mapping ),FAULT_PAGE_GET );return NULL ; }
@@ -2232,7 +2234,7 @@ static inline struct bio *f2fs_bio_alloc(struct f2fs_sb_info *sbi,return bio; }if (time_to_inject (sbi,FAULT_ALLOC_BIO )) { -f2fs_show_injection_info (FAULT_ALLOC_BIO ); +f2fs_show_injection_info (sbi,FAULT_ALLOC_BIO );return NULL ; }
@@ -2797,7 +2799,7 @@ static inline void *f2fs_kmalloc(struct f2fs_sb_info *sbi, size_t size, gfp_t flags) { if (time_to_inject(sbi, FAULT_KMALLOC)) { -f2fs_show_injection_info (FAULT_KMALLOC ); +f2fs_show_injection_info (sbi ,FAULT_KMALLOC );return NULL ; }
@@ -2814,7 +2816,7 @@ static inline void *f2fs_kvmalloc(struct f2fs_sb_info *sbi, size_t size, gfp_t flags) { if (time_to_inject(sbi, FAULT_KVMALLOC)) { -f2fs_show_injection_info (FAULT_KVMALLOC ); +f2fs_show_injection_info (sbi ,FAULT_KVMALLOC );return NULL ; }
fs/f2fs/file.c +1 -1
@@ -682,7 +682,7 @@ int f2fs_truncate(struct inode *inode)trace_f2fs_truncate (inode);if (time_to_inject (F2FS_I_SB (inode),FAULT_TRUNCATE )) { -f2fs_show_injection_info (FAULT_TRUNCATE ); +f2fs_show_injection_info (F2FS_I_SB (inode),FAULT_TRUNCATE );return -EIO ; }
fs/f2fs/gc.c +1 -1
@@ -54,7 +54,7 @@ static int gc_thread_func(void *data) }if (time_to_inject (sbi,FAULT_CHECKPOINT )) { -f2fs_show_injection_info (FAULT_CHECKPOINT ); +f2fs_show_injection_info (sbi,FAULT_CHECKPOINT );f2fs_stop_checkpoint (sbi, false); }
fs/f2fs/inode.c +1 -1
@@ -681,7 +681,7 @@ void f2fs_evict_inode(struct inode *inode) err =f2fs_truncate (inode);if (time_to_inject (sbi,FAULT_EVICT_INODE )) { -f2fs_show_injection_info (FAULT_EVICT_INODE ); +f2fs_show_injection_info (sbi,FAULT_EVICT_INODE ); err = -EIO ; }
fs/f2fs/node.c +1 -1
@@ -2406,7 +2406,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid)struct free_nid *i =NULL ; retry:if (time_to_inject (sbi,FAULT_ALLOC_NID )) { -f2fs_show_injection_info (FAULT_ALLOC_NID ); +f2fs_show_injection_info (sbi,FAULT_ALLOC_NID );return false; }
fs/f2fs/segment.c +5 -4
@@ -489,7 +489,7 @@ int f2fs_commit_inmem_pages(struct inode *inode)void f2fs_balance_fs (struct f2fs_sb_info *sbi,bool need) {if (time_to_inject (sbi,FAULT_CHECKPOINT )) { -f2fs_show_injection_info (FAULT_CHECKPOINT ); +f2fs_show_injection_info (sbi,FAULT_CHECKPOINT );f2fs_stop_checkpoint (sbi, false); }
@@ -1017,8 +1017,9 @@ static void __remove_discard_cmd(struct f2fs_sb_info *sbi,if (dc->error)printk_ratelimited ( -"%sF2FS-fs: Issue discard(%u, %u, %u) failed, ret: %d" , -KERN_INFO , dc->lstart, dc->start, dc->len, dc->error); +"%sF2FS-fs (%s): Issue discard(%u, %u, %u) failed, ret: %d" , +KERN_INFO , sbi->sb->s_id, + dc->lstart, dc->start, dc->len, dc->error);__detach_discard_cmd (dcc, dc); }
@@ -1158,7 +1159,7 @@ static int __submit_discard_cmd(struct f2fs_sb_info *sbi, dc->len += len;if (time_to_inject (sbi,FAULT_DISCARD )) { -f2fs_show_injection_info (FAULT_DISCARD ); +f2fs_show_injection_info (sbi,FAULT_DISCARD ); err = -EIO ; goto submit; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 47/260 f2fs: reduce the scope of setting fsck tag when de->name_len is zero
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
[ Upstream commit d4bf15a7ce172d186d400d606adf4f34a59130d6 ]
I recently found a case where de->name_len is 0 in f2fs_fill_dentries() easily reproduced, and finally set the fsck flag.
Thread A Thread B
- f2fs_readdir
- f2fs_read_inline_dir
- ctx->pos = d.max
- f2fs_add_dentry
- f2fs_add_inline_entry
- do_convert_inline_dir
- f2fs_add_regular_entry
- f2fs_readdir
- f2fs_fill_dentries
- set_sbi_flag(sbi, SBI_NEED_FSCK)
Process A opens the folder, and has been reading without closing it. During this period, Process B created a file under the folder (occupying multiple f2fs_dir_entry, exceeding the d.max of the inline dir). After creation, process A uses the d.max of inline dir to read it again, and it will read that de->name_len is 0.
And Chao pointed out that w/o inline conversion, the race condition still can happen as below:
dir_entry1: Adir_entry2: Bdir_entry3: C
free slot: _ctx->pos: ^
Thread A is traversing directory,
ctx-pos moves to below position after readdir() by thread A:AAAABBBB___
^
Then thread B delete dir_entry2, and create dir_entry3.
Thread A calls readdir() to lookup dirents starting from middle of new dirent slots as below:AAAACCCCCC_
^
In these scenarios, the file system is not damaged, and it's hard to avoid it. But we can bypass tagging FSCK flag if:
a) bit_pos (:= ctx->pos % d->max) is non-zero and
b) before bit_pos moves to first valid dir_entry.
--- fs/f2fs/dir.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/f2fs/dir.c +9 -5
@@ -892,6 +892,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,struct f2fs_sb_info *sbi =F2FS_I_SB (d->inode);struct blk_plug plug;bool readdir_ra = sbi->readdir_ra ==1 ; +bool found_valid_dirent = false;int err =0 ; bit_pos = ((unsigned long )ctx->pos % d->max);
@@ -906,13 +907,15 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, de = &d->dentry[bit_pos];if (de->name_len ==0 ) { +if (found_valid_dirent || !bit_pos) { +printk_ratelimited ( +"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix." , +KERN_WARNING , sbi->sb->s_id, +le32_to_cpu (de->ino)); +set_sbi_flag (sbi,SBI_NEED_FSCK ); + } bit_pos++; ctx->pos = start_pos + bit_pos; -printk_ratelimited ( -"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix." , -KERN_WARNING , sbi->sb->s_id, -le32_to_cpu (de->ino)); -set_sbi_flag (sbi,SBI_NEED_FSCK );continue ; }
@@ -955,6 +958,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,f2fs_ra_node_page (sbi,le32_to_cpu (de->ino)); ctx->pos = start_pos + bit_pos; + found_valid_dirent = true; } out:if (readdir_ra)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 48/260 openrisc: dont printk() unconditionally
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 946e1052cdcc7e585ee5d1e72528ca49fb295243 ]
Don't call printk() when CONFIG_PRINTK is not set. Fixes the following build errors:
or1k-linux-ld: arch/openrisc/kernel/entry.o: in function `_external_irq_handler':
(.text+0x804): undefined reference to `printk'
(.text+0x804): relocation truncated to fit: R_OR1K_INSN_REL_26 against undefined symbol `printk'
--- arch/openrisc/kernel/entry.S | 2 ++ 1 file changed, 2 insertions(+)
arch/openrisc/kernel/entry.S +2 -0
@@ -547,6 +547,7 @@ EXCEPTION_ENTRY(_external_irq_handler) l.bnf 1f // ext irq enabled, all ok. l.nop +#ifdef CONFIG_PRINTK l.addi r1,r1,-0x8 l.movhi r3,hi(42f) l.ori r3,r3,lo(42f)
@@ -560,6 +561,7 @@ EXCEPTION_ENTRY(_external_irq_handler) .string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r" .align 4 .previous +#endif l.ori r4,r4,SPR_SR_IEE // fix the bug // l.sw PT_SR(r1),r4
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 49/260 dma-debug: fix debugfs initialization order
In reply to Greg Kroah-HartmanFrom: Anthony Iliopoulos <[email protected]>
[ Upstream commit 173735c346c412d9f084825ecb04f24ada0e2986 ]
Due to link order, dma_debug_init is called before debugfs has a chance to initialize (via debugfs_init which also happens in the core initcall stage), so the directories for dma-debug are never created.
Decouple dma_debug_fs_init from dma_debug_init and defer its init until core_initcall_sync (after debugfs has been initialized) while letting dma-debug initialization occur as soon as possible to catch any early mappings, as suggested in [1].
[1] https://lore.kernel.org/linux-iommu/YIgGa6yF%[email protected]/
--- kernel/dma/debug.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/dma/debug.c +4 -3
@@ -846,7 +846,7 @@ static int dump_show(struct seq_file *seq, void *v) }DEFINE_SHOW_ATTRIBUTE (dump); -static void dma_debug_fs_init (void ) +static int __init dma_debug_fs_init (void ) {struct dentry *dentry =debugfs_create_dir ("dma-api" ,NULL );
@@ -859,7 +859,10 @@ static void dma_debug_fs_init(void)debugfs_create_u32 ("nr_total_entries" ,0444 , dentry, &nr_total_entries);debugfs_create_file ("driver_filter" ,0644 , dentry,NULL , &filter_fops);debugfs_create_file ("dump" ,0444 , dentry,NULL , &dump_fops); + +return 0 ; } +core_initcall_sync (dma_debug_fs_init);static int device_dma_allocations (struct device *dev,struct dma_debug_entry **out_entry) {
@@ -944,8 +947,6 @@ static int dma_debug_init(void)spin_lock_init (&dma_entry_hash[i].lock); } -dma_debug_fs_init (); - nr_pages =DIV_ROUND_UP (nr_prealloc_entries,DMA_DEBUG_DYNAMIC_ENTRIES );for (i =0 ; i < nr_pages; ++i)dma_debug_create_entries (GFP_KERNEL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 50/260 SUNRPC: Fix potential memory corruption
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit c2dc3e5fad13aca5d7bdf4bcb52b1a1d707c8555 ]
We really should not call rpc_wake_up_queued_task_set_status() with xprt->snd_task as an argument unless we are certain that is actually an rpc_task.
--- include/linux/sunrpc/xprt.h | 1 + net/sunrpc/xprt.c | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-)
include/linux/sunrpc/xprt.h +1 -0
@@ -419,6 +419,7 @@ void xprt_unlock_connect(struct rpc_xprt *, void *);#define XPRT_CONGESTED (9)#define XPRT_CWND_WAIT (10)#define XPRT_WRITE_SPACE (11) +#define XPRT_SND_IS_COOKIE (12)static inline void xprt_set_connected (struct rpc_xprt *xprt) {
net/sunrpc/xprt.c +4 -2
@@ -729,9 +729,9 @@ void xprt_force_disconnect(struct rpc_xprt *xprt)/* Try to schedule an autoclose RPC call */ if (test_and_set_bit (XPRT_LOCKED , &xprt->state) ==0 )queue_work (xprtiod_workqueue, &xprt->task_cleanup); -else if (xprt->snd_task) +else if (xprt->snd_task && !test_bit (XPRT_SND_IS_COOKIE , &xprt->state))rpc_wake_up_queued_task_set_status (&xprt->pending, - xprt->snd_task, -ENOTCONN ); + xprt->snd_task, -ENOTCONN );spin_unlock (&xprt->transport_lock); }EXPORT_SYMBOL_GPL (xprt_force_disconnect);
@@ -820,6 +820,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt, goto out;if (xprt->snd_task != task) goto out; +set_bit (XPRT_SND_IS_COOKIE , &xprt->state); xprt->snd_task = cookie; ret = true; out:
@@ -835,6 +836,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)if (!test_bit (XPRT_LOCKED , &xprt->state)) goto out; xprt->snd_task =NULL ; +clear_bit (XPRT_SND_IS_COOKIE , &xprt->state); xprt->ops->release_xprt (xprt,NULL );xprt_schedule_autodisconnect (xprt); out:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 51/260 scsi: fdomain: Fix error return code in fdomain_probe()
In reply to Greg Kroah-HartmanFrom: Wei Li <[email protected]>
[ Upstream commit 632c4ae6da1d629eddf9da1e692d7617c568c256 ]
If request_region() fails the return value is not set. Return -EBUSY on error.
--- drivers/scsi/pcmcia/fdomain_cs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/pcmcia/fdomain_cs.c +3 -1
@@ -45,8 +45,10 @@ static int fdomain_probe(struct pcmcia_device *link) goto fail_disable;if (!request_region (link->resource[0 ]->start,FDOMAIN_REGION_SIZE , -"fdomain_cs" )) +"fdomain_cs" )) { + ret = -EBUSY ; goto fail_disable; + } sh =fdomain_create (link->resource[0 ]->start, link->irq,7 , &link->dev);if (!sh) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 52/260 pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit d789a490d32fdf0465275e3607f8a3bc87d3f3ba ]
Fix to return -ENOTSUPP instead of 0 when PCS_HAS_PINCONF is true, which is the same as that returned in pcs_parse_pinconf().
--- drivers/pinctrl/pinctrl-single.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/pinctrl-single.c +1 -0
@@ -1201,6 +1201,7 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,if (PCS_HAS_PINCONF ) {dev_err (pcs->dev,"pinconf not supported\n" ); + res = -ENOTSUPP ; goto free_pingroups; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 53/260 scsi: smartpqi: Fix an error code in pqi_get_raid_map()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit d1f6581a6796c4e9fd8a4a24e8b77463d18f0df1 ]
Return -EINVAL on failure instead of success.
--- drivers/scsi/smartpqi/smartpqi_init.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/smartpqi/smartpqi_init.c +1 -0
@@ -1192,6 +1192,7 @@ static int pqi_get_raid_map(struct pqi_ctrl_info *ctrl_info,"Requested %d bytes, received %d bytes" , raid_map_size, get_unaligned_le32(&raid_map->structure_size)); + rc = -EINVAL ; goto error; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 54/260 scsi: qedi: Fix error codes in qedi_alloc_global_queues()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 4dbe57d46d54a847875fa33e7d05877bb341585e ]
This function had some left over code that returned 1 on error instead negative error codes. Convert everything to use negative error codes. The caller treats all non-zero returns the same so this does not affect run time.
A couple places set "rc" instead of "status" so those error paths ended up returning success by mistake. Get rid of the "rc" variable and use "status" everywhere.
Remove the bogus "status = 0" initialization, as a future proofing measure so the compiler will warn about uninitialized error codes.
--- drivers/scsi/qedi/qedi_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/scsi/qedi/qedi_main.c +7 -7
@@ -1553,7 +1553,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) {u32 *list;int i; -int status =0 , rc; +int status;u32 *pbl;dma_addr_t page;int num_pages;
@@ -1564,14 +1564,14 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)*/ if (!qedi->num_queues) {QEDI_ERR (&qedi->dbg_ctx,"No MSI-X vectors available!\n" ); -return 1 ; +return -ENOMEM ; }/* Make sure we allocated the PBL that will contain the physical * addresses of our queues */ if (!qedi->p_cpuq) { - status =1 ; + status = -EINVAL ; goto mem_alloc_failure; }
@@ -1586,13 +1586,13 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) "qedi->global_queues=%p.\n", qedi->global_queues);/* Allocate DMA coherent buffers for BDQ */ - rc =qedi_alloc_bdq (qedi); -if (rc) + status =qedi_alloc_bdq (qedi); +if (status) goto mem_alloc_failure;/* Allocate DMA coherent buffers for NVM_ISCSI_CFG */ - rc =qedi_alloc_nvm_iscsi_cfg (qedi); -if (rc) + status =qedi_alloc_nvm_iscsi_cfg (qedi); +if (status) goto mem_alloc_failure;/* Allocate a CQ and an associated PBL for each MSI-X
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/260 scsi: qedf: Fix error codes in qedf_alloc_global_queues()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ccc89737aa6b9f248cf1623014038beb6c2b7f56 ]
This driver has some left over "return 1" on failure style code mixed with "return negative error codes" style code. The caller doesn't care so we should just convert everything to return negative error codes.
Then there was a problem that there were two variables used to store error codes which just resulted in confusion. If qedf_alloc_bdq() returned a negative error code, we accidentally returned success instead of propagating the error code. So get rid of the "rc" variable and use "status" every where.
Also remove the "status = 0" initialization so that these sorts of bugs will be detected by the compiler in the future.
--- drivers/scsi/qedf/qedf_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/scsi/qedf/qedf_main.c +5 -5
@@ -2894,7 +2894,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) {u32 *list;int i; -int status =0 , rc; +int status;u32 *pbl;dma_addr_t page;int num_pages;
@@ -2906,7 +2906,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)*/ if (!qedf->num_queues) {QEDF_ERR (&(qedf->dbg_ctx),"No MSI-X vectors available!\n" ); -return 1 ; +return -ENOMEM ; }/*
@@ -2914,7 +2914,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)* addresses of our queues */ if (!qedf->p_cpuq) { - status =1 ; + status = -EINVAL ;QEDF_ERR (&qedf->dbg_ctx,"p_cpuq is NULL.\n" ); goto mem_alloc_failure; }
@@ -2930,8 +2930,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) "qedf->global_queues=%p.\n", qedf->global_queues);/* Allocate DMA coherent buffers for BDQ */ - rc =qedf_alloc_bdq (qedf); -if (rc) { + status =qedf_alloc_bdq (qedf); +if (status) {QEDF_ERR (&qedf->dbg_ctx,"Unable to allocate bdq.\n" ); goto mem_alloc_failure; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/260 powerpc/config: Renable MTD_PHYSMAP_OF
In reply to Greg Kroah-HartmanFrom: Joel Stanley <[email protected]>
[ Upstream commit d0e28a6145c3455b69991245e7f6147eb914b34a ]
CONFIG_MTD_PHYSMAP_OF is not longer enabled as it depends on MTD_PHYSMAP which is not enabled.
This is a regression from commit 642b1e8dbed7 ("mtd: maps: Merge physmap_of.c into physmap-core.c"), which added the extra dependency. Add CONFIG_MTD_PHYSMAP=y so this stays in the config, as Christophe said it is useful for build coverage.
--- arch/powerpc/configs/mpc885_ads_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/configs/mpc885_ads_defconfig +1 -0
@@ -39,6 +39,7 @@ CONFIG_MTD_CFI_GEOMETRY=y # CONFIG_MTD_CFI_I2 is not set CONFIG_MTD_CFI_I4=y CONFIG_MTD_CFI_AMDSTD=y +CONFIG_MTD_PHYSMAP=y CONFIG_MTD_PHYSMAP_OF=y # CONFIG_BLK_DEV is not set CONFIG_NETDEVICES=y
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/260 scsi: target: avoid per-loop XCOPY buffer allocations
In reply to Greg Kroah-HartmanFrom: David Disseldorp <[email protected]>
[ Upstream commit 0ad08996da05b6b735d4963dceab7d2a4043607c ]
The main target_xcopy_do_work() loop unnecessarily allocates an I/O buffer with each synchronous READ / WRITE pair. This commit significantly reduces allocations by reusing the XCOPY I/O buffer when possible.
--- drivers/target/target_core_xcopy.c | 96 ++++++++++-------------------- drivers/target/target_core_xcopy.h | 1 + 2 files changed, 31 insertions(+), 66 deletions(-)
drivers/target/target_core_xcopy.c +30 -66
@@ -533,7 +533,6 @@ void target_xcopy_release_pt(void)* @cdb: SCSI CDB to be copied into @xpt_cmd. * @remote_port: If false, use the LUN through which the XCOPY command has * been received. If true, use @se_dev->xcopy_lun. -* @alloc_mem: Whether or not to allocate an SGL list. * * Set up a SCSI command (READ or WRITE) that will be used to execute an * XCOPY command.
@@ -543,12 +542,9 @@ static int target_xcopy_setup_pt_cmd(struct xcopy_op *xop, struct se_device *se_dev, unsigned char *cdb, - bool remote_port, - bool alloc_mem) + bool remote_port) { struct se_cmd *cmd = &xpt_cmd->se_cmd; -sense_reason_t sense_rc; -int ret =0 , rc;/* * Setup LUN+port to honor reservations based upon xop->op_origin for
@@ -564,46 +560,17 @@ static int target_xcopy_setup_pt_cmd( cmd->se_cmd_flags |=SCF_SE_LUN_CMD ; cmd->tag =0 ; - sense_rc =target_setup_cmd_from_cdb (cmd, cdb); -if (sense_rc) { - ret = -EINVAL ; - goto out; - } +if (target_setup_cmd_from_cdb (cmd, cdb)) +return -EINVAL ; -if (alloc_mem) { - rc =target_alloc_sgl (&cmd->t_data_sg, &cmd->t_data_nents, - cmd->data_length, false, false); -if (rc <0 ) { - ret = rc; - goto out; - } -/* -* Set this bit so that transport_free_pages() allows the -* caller to release SGLs + physical memory allocated by -* transport_generic_get_mem().. -*/ - cmd->se_cmd_flags |=SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC ; - }else { -/* -* Here the previously allocated SGLs for the internal READ -* are mapped zero-copy to the internal WRITE. -*/ - sense_rc =transport_generic_map_mem_to_cmd (cmd, - xop->xop_data_sg, xop->xop_data_nents, -NULL ,0 ); -if (sense_rc) { - ret = -EINVAL ; - goto out; - } +if (transport_generic_map_mem_to_cmd (cmd, xop->xop_data_sg, + xop->xop_data_nents,NULL ,0 )) +return -EINVAL ; -pr_debug ("Setup PASSTHROUGH_NOALLOC t_data_sg: %p t_data_nents:" -" %u\n" , cmd->t_data_sg, cmd->t_data_nents); - } +pr_debug ("Setup PASSTHROUGH_NOALLOC t_data_sg: %p t_data_nents:" +" %u\n" , cmd->t_data_sg, cmd->t_data_nents);return 0 ; - -out: -return ret; }static int target_xcopy_issue_pt_cmd (struct xcopy_pt_cmd *xpt_cmd)
@@ -660,15 +627,13 @@ static int target_xcopy_read_source( xop->src_pt_cmd = xpt_cmd; rc =target_xcopy_setup_pt_cmd (xpt_cmd, xop, src_dev, &cdb[0 ], - remote_port, true); + remote_port);if (rc <0 ) { ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;transport_generic_free_cmd (se_cmd,0 );return rc; } - xop->xop_data_sg = se_cmd->t_data_sg; - xop->xop_data_nents = se_cmd->t_data_nents;pr_debug ("XCOPY-READ: Saved xop->xop_data_sg: %p, num: %u for READ" " memory\n" , xop->xop_data_sg, xop->xop_data_nents);
@@ -678,12 +643,6 @@ static int target_xcopy_read_source(transport_generic_free_cmd (se_cmd,0 );return rc; } -/* -* Clear off the allocated t_data_sg, that has been saved for -* zero-copy WRITE submission reuse in struct xcopy_op.. -*/ - se_cmd->t_data_sg =NULL ; - se_cmd->t_data_nents =0 ;return 0 ; }
@@ -722,19 +681,9 @@ static int target_xcopy_write_destination( xop->dst_pt_cmd = xpt_cmd; rc =target_xcopy_setup_pt_cmd (xpt_cmd, xop, dst_dev, &cdb[0 ], - remote_port, false); + remote_port);if (rc <0 ) { -struct se_cmd *src_cmd = &xop->src_pt_cmd->se_cmd; ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status; -/* -* If the failure happened before the t_mem_list hand-off in -* target_xcopy_setup_pt_cmd(), Reset memory + clear flag so that -* core releases this memory on error during X-COPY WRITE I/O. -*/ - src_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC ; - src_cmd->t_data_sg = xop->xop_data_sg; - src_cmd->t_data_nents = xop->xop_data_nents; -transport_generic_free_cmd (se_cmd,0 );return rc; }
@@ -742,7 +691,6 @@ static int target_xcopy_write_destination( rc =target_xcopy_issue_pt_cmd (xpt_cmd);if (rc <0 ) { ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status; - se_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC ;transport_generic_free_cmd (se_cmd,0 );return rc; }
@@ -758,7 +706,7 @@ static void target_xcopy_do_work(struct work_struct *work)sector_t src_lba, dst_lba, end_lba;unsigned int max_sectors;int rc =0 ; -unsigned short nolb, cur_nolb, max_nolb, copied_nolb =0 ; +unsigned short nolb, max_nolb, copied_nolb =0 ;if (target_parse_xcopy_cmd (xop) !=TCM_NO_SENSE ) goto err_free;
@@ -788,7 +736,23 @@ static void target_xcopy_do_work(struct work_struct *work) (unsigned long long)src_lba, (unsigned long long)dst_lba);while (src_lba < end_lba) { - cur_nolb =min (nolb, max_nolb); +unsigned short cur_nolb =min (nolb, max_nolb); +u32 cur_bytes = cur_nolb * src_dev->dev_attrib.block_size; + +if (cur_bytes != xop->xop_data_bytes) { +/* +* (Re)allocate a buffer large enough to hold the XCOPY +* I/O size, which can be reused each read / write loop. +*/ +target_free_sgl (xop->xop_data_sg, xop->xop_data_nents); + rc =target_alloc_sgl (&xop->xop_data_sg, + &xop->xop_data_nents, + cur_bytes, + false, false); +if (rc <0 ) + goto out; + xop->xop_data_bytes = cur_bytes; + }pr_debug ("target_xcopy_do_work: Calling read src_dev: %p src_lba: %llu," " cur_nolb: %hu\n" , src_dev, (unsigned long long )src_lba, cur_nolb);
@@ -819,12 +783,11 @@ static void target_xcopy_do_work(struct work_struct *work) nolb -= cur_nolb;transport_generic_free_cmd (&xop->src_pt_cmd->se_cmd,0 ); - xop->dst_pt_cmd->se_cmd.se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC ; -transport_generic_free_cmd (&xop->dst_pt_cmd->se_cmd,0 ); }xcopy_pt_undepend_remotedev (xop); +target_free_sgl (xop->xop_data_sg, xop->xop_data_nents);kfree (xop); pr_debug("target_xcopy_do_work: Final src_lba: %llu, dst_lba: %llu\n",
@@ -838,6 +801,7 @@ static void target_xcopy_do_work(struct work_struct *work) out:xcopy_pt_undepend_remotedev (xop); +target_free_sgl (xop->xop_data_sg, xop->xop_data_nents); err_free:kfree (xop);
drivers/target/target_core_xcopy.h +1 -0
@@ -41,6 +41,7 @@ struct xcopy_op {struct xcopy_pt_cmd *src_pt_cmd;struct xcopy_pt_cmd *dst_pt_cmd; +u32 xop_data_bytes;u32 xop_data_nents;struct scatterlist *xop_data_sg;struct work_struct xop_work;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/260 HID: i2c-hid: Fix Elan touchpad regression
In reply to Greg Kroah-HartmanFrom: Jim Broadus <[email protected]>
[ Upstream commit 786537063bbfb3a7ebc6fc21b2baf37fb91df401 ]
A quirk was recently added for Elan devices that has same device match as an entry earlier in the list. The i2c_hid_lookup_quirk function will always return the last match in the list, so the new entry shadows the old entry. The quirk in the previous entry, I2C_HID_QUIRK_BOGUS_IRQ, silenced a flood of messages which have reappeared in the 5.13 kernel.
This change moves the two quirk flags into the same entry.
--- drivers/hid/i2c-hid/i2c-hid-core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/hid/i2c-hid/i2c-hid-core.c +2 -3
@@ -178,8 +178,6 @@ static const struct i2c_hid_quirks { I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, {I2C_VENDOR_ID_RAYDIUM ,I2C_PRODUCT_ID_RAYDIUM_3118 , I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, - { USB_VENDOR_ID_ELAN, HID_ANY_ID, - I2C_HID_QUIRK_BOGUS_IRQ }, { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID, I2C_HID_QUIRK_RESET_ON_RESUME }, { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393,
@@ -190,7 +188,8 @@ static const struct i2c_hid_quirks {* Sending the wakeup after reset actually break ELAN touchscreen controller */ {USB_VENDOR_ID_ELAN ,HID_ANY_ID , - I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET }, +I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET | + I2C_HID_QUIRK_BOGUS_IRQ }, { 0, 0 } };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 59/260 KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit 1782663897945a5cf28e564ba5eed730098e9aa4 ]
After the L1 saves its PMU SPRs but before loading the L2's PMU SPRs, switch the pmcregs_in_use field in the L1 lppaca to the value advertised by the L2 in its VPA. On the way out of the L2, set it back after saving the L2 PMU registers (if they were in-use).
This transfers the PMU liveness indication between the L1 and L2 at the points where the registers are not live.
This fixes the nested HV bug for which a workaround was added to the L0 HV by commit 63279eeb7f93a ("KVM: PPC: Book3S HV: Always save guest pmu for guest capable of nesting"), which explains the problem in detail. That workaround is no longer required for guests that include this bug fix.
--- arch/powerpc/include/asm/pmc.h | 7 +++++++ arch/powerpc/kvm/book3s_hv.c | 20 ++++++++++++++++++++ 2 files changed, 27 insertions(+)
arch/powerpc/include/asm/pmc.h +7 -0
@@ -34,6 +34,13 @@ static inline void ppc_set_pmu_inuse(int inuse)#endif } +#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE +static inline int ppc_get_pmu_inuse (void ) +{ +return get_paca ()->pmcregs_in_use; +} +#endif +extern void power4_enable_pmcs (void );#else /* CONFIG_PPC64 */
arch/powerpc/kvm/book3s_hv.c +20 -0
@@ -58,6 +58,7 @@#include <asm/kvm_book3s.h> #include <asm/mmu_context.h> #include <asm/lppaca.h> +#include <asm/pmc.h> #include <asm/processor.h> #include <asm/cputhreads.h> #include <asm/page.h>
@@ -3559,6 +3560,18 @@ int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, cpu_has_feature(CPU_FTR_P9_TM_HV_ASSIST))kvmppc_restore_tm_hv (vcpu, vcpu->arch.shregs.msr, true); +#ifdef CONFIG_PPC_PSERIES +if (kvmhv_on_pseries ()) { +barrier (); +if (vcpu->arch.vpa.pinned_addr) { +struct lppaca *lp = vcpu->arch.vpa.pinned_addr; +get_lppaca ()->pmcregs_in_use = lp->pmcregs_in_use; + }else { +get_lppaca ()->pmcregs_in_use =1 ; + } +barrier (); + } +#endif kvmhv_load_guest_pmu (vcpu);msr_check_and_set (MSR_FP |MSR_VEC |MSR_VSX );
@@ -3693,6 +3706,13 @@ int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, save_pmu |=nesting_enabled (vcpu->kvm);kvmhv_save_guest_pmu (vcpu, save_pmu); +#ifdef CONFIG_PPC_PSERIES +if (kvmhv_on_pseries ()) { +barrier (); +get_lppaca ()->pmcregs_in_use =ppc_get_pmu_inuse (); +barrier (); + } +#endif vc->entry_exit_map =0x101 ; vc->in_guest =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/260 platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 0487d4fc42d7f31a56cfd9e2237f9ebd889e6112 ]
As pointed out be Kees Cook if we return -EIO because the obj->type != ACPI_TYPE_BUFFER, then we must kfree the output buffer before the return.
--- drivers/platform/x86/dell-smbios-wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell-smbios-wmi.c +1 -0
@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev)if (obj->type ==ACPI_TYPE_INTEGER )dev_dbg (&wdev->dev,"SMBIOS call failed: %llu\n" , obj->integer.value); +kfree (output.pointer);return -EIO ; }memcpy (&priv->buf->std, obj->buffer.pointer, obj->buffer.length);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/260 fscache: Fix cookie key hashing
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 35b72573e977ed6b18b094136a4fa3e0ffb13603 ]
The current hash algorithm used for hashing cookie keys is really bad, producing almost no dispersion (after a test kernel build, ~30000 files were split over just 18 out of the 32768 hash buckets).
Borrow the full_name_hash() hash function into fscache to do the hashing for cookie keys and, in the future, volume keys.
I don't want to use full_name_hash() as-is because I want the hash value to be consistent across arches and over time as the hash value produced may get used on disk.
I can also optimise parts of it away as the key will always be a padded array of aligned 32-bit words.
--- fs/fscache/cookie.c | 14 +------------- fs/fscache/internal.h | 2 ++ fs/fscache/main.c | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 13 deletions(-)
fs/fscache/cookie.c +1 -13
@@ -74,10 +74,8 @@ void fscache_free_cookie(struct fscache_cookie *cookie)static int fscache_set_key (struct fscache_cookie *cookie,const void *index_key,size_t index_key_len) { -unsigned long long h;u32 *buf;int bufs; -int i; bufs =DIV_ROUND_UP (index_key_len,sizeof (*buf));
@@ -91,17 +89,7 @@ static int fscache_set_key(struct fscache_cookie *cookie, }memcpy (buf, index_key, index_key_len); - -/* Calculate a hash and combine this with the length in the first word -* or first half word -*/ - h = (unsigned long )cookie->parent; - h += index_key_len + cookie->type; - -for (i =0 ; i < bufs; i++) - h += buf[i]; - - cookie->key_hash = h ^ (h >>32 ); + cookie->key_hash =fscache_hash (0 , buf, bufs);return 0 ; }
fs/fscache/internal.h +2 -0
@@ -97,6 +97,8 @@ extern struct workqueue_struct *fscache_object_wq;extern struct workqueue_struct *fscache_op_wq;DECLARE_PER_CPU (wait_queue_head_t, fscache_object_cong_wait); +extern unsigned int fscache_hash (unsigned int salt,unsigned int *data,unsigned int n); +static inline bool fscache_object_congested (void ) {return workqueue_congested (WORK_CPU_UNBOUND , fscache_object_wq);
fs/fscache/main.c +39 -0
@@ -94,6 +94,45 @@ static struct ctl_table fscache_sysctls_root[] = { };#endif +/* +* Mixing scores (in bits) for (7,20): +* Input delta: 1-bit 2-bit +* 1 round: 330.3 9201.6 +* 2 rounds: 1246.4 25475.4 +* 3 rounds: 1907.1 31295.1 +* 4 rounds: 2042.3 31718.6 +* Perfect: 2048 31744 +* (32*64) (32*31/2 * 64) +*/ +#define HASH_MIX (x, y, a) \ + ( x ^= (a), \ + y ^= x, x = rol32(x, 7),\ + x += y, y = rol32(y,20),\ + y *= 9 ) + +static inline unsigned int fold_hash (unsigned long x,unsigned long y) +{ +/* Use arch-optimized multiply if one exists */ +return __hash_32 (y ^__hash_32 (x)); +} + +/* +* Generate a hash. This is derived from full_name_hash(), but we want to be +* sure it is arch independent and that it doesn't change as bits of the +* computed hash value might appear on disk. The caller also guarantees that +* the hashed data will be a series of aligned 32-bit words. +*/ +unsigned int fscache_hash (unsigned int salt,unsigned int *data,unsigned int n) +{ +unsigned int a, x =0 , y = salt; + +for (; n; n--) { + a = *data++; +HASH_MIX (x, y, a); + } +return fold_hash (x, y); +} +/* * initialise the fs caching module */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/260 clk: at91: sam9x60: Dont use audio PLL
In reply to Greg Kroah-HartmanFrom: Codrin Ciubotariu <[email protected]>
[ Upstream commit 5bf7f4a249387a6062b9a14c8a77e7ba2fd6a53b ]
On sam9x60, there is not audio PLL and so I2S and classD have to use one of the best matching parents for their generated clock.
--- drivers/clk/at91/sam9x60.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/clk/at91/sam9x60.c +3 -6
@@ -124,7 +124,6 @@ static const struct {char *n;u8 id;struct clk_range r; -bool pll; } sam9x60_gck[] = { { .n = "flex0_gclk", .id = 5, }, { .n = "flex1_gclk", .id = 6, },
@@ -144,11 +143,9 @@ static const struct { { .n = "sdmmc1_gclk", .id = 26, .r = { .min = 0, .max = 105000000 }, }, { .n = "flex11_gclk", .id = 32, }, { .n = "flex12_gclk", .id = 33, }, - { .n = "i2s_gclk", .id = 34, .r = { .min = 0, .max = 105000000 }, - .pll = true, }, + { .n = "i2s_gclk", .id = 34, .r = { .min = 0, .max = 105000000 }, }, { .n = "pit64b_gclk", .id = 37, }, - { .n = "classd_gclk", .id = 42, .r = { .min = 0, .max = 100000000 }, - .pll = true, }, + { .n = "classd_gclk", .id = 42, .r = { .min = 0, .max = 100000000 }, }, { .n = "tcb1_gclk", .id = 45, }, { .n = "dbgu_gclk", .id = 47, }, };
@@ -285,7 +282,7 @@ static void __init sam9x60_pmc_setup(struct device_node *np) sam9x60_gck[i].n, parent_names,6 , sam9x60_gck[i].id, - sam9x60_gck[i].pll, + false, &sam9x60_gck[i].r);if (IS_ERR (hw)) goto err_free;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/260 clk: at91: clk-generated: pass the id of changeable parent at registration
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 64c9247b9e87e96e41cea545eb64727cee10c55c ]
Pass the ID of changeable parent at registration. This will allow the scalability of this clock driver with regards to the changeable parent ID for versions of this IP where changeable parent is not the last one in the parents list (e.g. SAMA7G5). With this the clock flags are set to zero in case we have no changeable parent. Also in clk_generated_best_diff() the *best_diff variable is check against tmp_diff variable using ">=" operator instead of ">" so that in case the requested frequency could be obtained using fix parents + gck dividers but the clock also supports changeable parent to be able to force the usage of the changeable parent.
--- drivers/clk/at91/clk-generated.c | 26 ++++++++++++++------------ drivers/clk/at91/dt-compat.c | 8 +++++--- drivers/clk/at91/pmc.h | 4 ++-- drivers/clk/at91/sam9x60.c | 3 +-- drivers/clk/at91/sama5d2.c | 31 +++++++++++++++---------------- 5 files changed, 37 insertions(+), 35 deletions(-)
drivers/clk/at91/clk-generated.c +14 -12
@@ -18,8 +18,6 @@#define GENERATED_MAX_DIV 255 -#define GCK_INDEX_DT_AUDIO_PLL 5 -struct clk_generated {struct clk_hw hw;struct regmap *regmap;
@@ -29,7 +27,7 @@ struct clk_generated {u32 gckdiv;const struct clk_pcr_layout *layout;u8 parent_id; -bool audio_pll_allowed; +int chg_pid; };#define to_clk_generated (hw) \
@@ -109,7 +107,7 @@ static void clk_generated_best_diff(struct clk_rate_request *req, tmp_rate = parent_rate / div; tmp_diff =abs (req->rate - tmp_rate); -if (*best_diff <0 || *best_diff > tmp_diff) { +if (*best_diff <0 || *best_diff >= tmp_diff) { *best_rate = tmp_rate; *best_diff = tmp_diff; req->best_parent_rate = parent_rate;
@@ -129,7 +127,10 @@ static int clk_generated_determine_rate(struct clk_hw *hw,int i;u32 div; -for (i =0 ; i <clk_hw_get_num_parents (hw) -1 ; i++) { +for (i =0 ; i <clk_hw_get_num_parents (hw); i++) { +if (gck->chg_pid == i) +continue ; + parent =clk_hw_get_parent_by_index (hw, i);if (!parent)continue ;
@@ -161,10 +162,10 @@ static int clk_generated_determine_rate(struct clk_hw *hw,* that the only clks able to modify gck rate are those of audio IPs. */ -if (!gck->audio_pll_allowed) +if (gck->chg_pid <0 ) goto end; - parent =clk_hw_get_parent_by_index (hw,GCK_INDEX_DT_AUDIO_PLL ); + parent =clk_hw_get_parent_by_index (hw, gck->chg_pid);if (!parent) goto end;
@@ -271,8 +272,8 @@ struct clk_hw * __init at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, const struct clk_pcr_layout *layout, const char *name, const char **parent_names, - u8 num_parents, u8 id, bool pll_audio, - const struct clk_range *range) + u8 num_parents, u8 id, + const struct clk_range *range, int chg_pid) { struct clk_generated *gck;struct clk_init_data init;
@@ -287,15 +288,16 @@ at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, init.ops = &generated_ops; init.parent_names = parent_names; init.num_parents = num_parents; - init.flags =CLK_SET_RATE_GATE |CLK_SET_PARENT_GATE | -CLK_SET_RATE_PARENT ; + init.flags =CLK_SET_RATE_GATE |CLK_SET_PARENT_GATE ; +if (chg_pid >=0 ) + init.flags |=CLK_SET_RATE_PARENT ; gck->id = id; gck->hw.init = &init; gck->regmap = regmap; gck->lock = lock; gck->range = *range; - gck->audio_pll_allowed = pll_audio; + gck->chg_pid = chg_pid; gck->layout = layout;clk_generated_startup (gck);
drivers/clk/at91/dt-compat.c +5 -3
@@ -22,6 +22,8 @@#define SYSTEM_MAX_ID 31 +#define GCK_INDEX_DT_AUDIO_PLL 5 +#ifdef CONFIG_HAVE_AT91_AUDIO_PLL static void __init of_sama5d2_clk_audio_pll_frac_setup (struct device_node *np) {
@@ -135,7 +137,7 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np)return ;for_each_child_of_node (np, gcknp) { -bool pll_audio = false; +int chg_pid =INT_MIN ;if (of_property_read_u32 (gcknp,"reg" , &id))continue ;
@@ -152,12 +154,12 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np)if (of_device_is_compatible (np,"atmel,sama5d2-clk-generated" ) && (id ==GCK_ID_I2S0 || id ==GCK_ID_I2S1 || id ==GCK_ID_CLASSD )) - pll_audio = true; + chg_pid =GCK_INDEX_DT_AUDIO_PLL ; hw =at91_clk_register_generated (regmap, &pmc_pcr_lock, &dt_pcr_layout, name, parent_names, num_parents, - id, pll_audio, &range); + id, &range, chg_pid);if (IS_ERR (hw))continue ;
drivers/clk/at91/pmc.h +2 -2
@@ -118,8 +118,8 @@ struct clk_hw * __init at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, const struct clk_pcr_layout *layout, const char *name, const char **parent_names, - u8 num_parents, u8 id, bool pll_audio, - const struct clk_range *range); + u8 num_parents, u8 id, + const struct clk_range *range, int chg_pid);struct clk_hw *__init at91_clk_register_h32mx(struct regmap *regmap, const char *name,
drivers/clk/at91/sam9x60.c +1 -2
@@ -282,8 +282,7 @@ static void __init sam9x60_pmc_setup(struct device_node *np) sam9x60_gck[i].n, parent_names,6 , sam9x60_gck[i].id, - false, - &sam9x60_gck[i].r); + &sam9x60_gck[i].r, INT_MIN);if (IS_ERR (hw)) goto err_free;
drivers/clk/at91/sama5d2.c +15 -16
@@ -115,21 +115,20 @@ static const struct {char *n;u8 id;struct clk_range r; -bool pll; +int chg_pid; } sama5d2_gck[] = { - { .n = "sdmmc0_gclk", .id = 31, }, - { .n = "sdmmc1_gclk", .id = 32, }, - { .n = "tcb0_gclk", .id = 35, .r = { .min = 0, .max = 83000000 }, }, - { .n = "tcb1_gclk", .id = 36, .r = { .min = 0, .max = 83000000 }, }, - { .n = "pwm_gclk", .id = 38, .r = { .min = 0, .max = 83000000 }, }, - { .n = "isc_gclk", .id = 46, }, - { .n = "pdmic_gclk", .id = 48, }, - { .n = "i2s0_gclk", .id = 54, .pll = true }, - { .n = "i2s1_gclk", .id = 55, .pll = true }, - { .n = "can0_gclk", .id = 56, .r = { .min = 0, .max = 80000000 }, }, - { .n = "can1_gclk", .id = 57, .r = { .min = 0, .max = 80000000 }, }, - { .n = "classd_gclk", .id = 59, .r = { .min = 0, .max = 100000000 }, - .pll = true }, + { .n = "sdmmc0_gclk", .id = 31, .chg_pid = INT_MIN, }, + { .n = "sdmmc1_gclk", .id = 32, .chg_pid = INT_MIN, }, + { .n = "tcb0_gclk", .id = 35, .chg_pid = INT_MIN, .r = { .min = 0, .max = 83000000 }, }, + { .n = "tcb1_gclk", .id = 36, .chg_pid = INT_MIN, .r = { .min = 0, .max = 83000000 }, }, + { .n = "pwm_gclk", .id = 38, .chg_pid = INT_MIN, .r = { .min = 0, .max = 83000000 }, }, + { .n = "isc_gclk", .id = 46, .chg_pid = INT_MIN, }, + { .n = "pdmic_gclk", .id = 48, .chg_pid = INT_MIN, }, + { .n = "i2s0_gclk", .id = 54, .chg_pid = 5, }, + { .n = "i2s1_gclk", .id = 55, .chg_pid = 5, }, + { .n = "can0_gclk", .id = 56, .chg_pid = INT_MIN, .r = { .min = 0, .max = 80000000 }, }, + { .n = "can1_gclk", .id = 57, .chg_pid = INT_MIN, .r = { .min = 0, .max = 80000000 }, }, + { .n = "classd_gclk", .id = 59, .chg_pid = 5, .r = { .min = 0, .max = 100000000 }, }, }; static const struct clk_programmable_layout sama5d2_programmable_layout = {
@@ -317,8 +316,8 @@ static void __init sama5d2_pmc_setup(struct device_node *np) sama5d2_gck[i].n, parent_names,6 , sama5d2_gck[i].id, - sama5d2_gck[i].pll, - &sama5d2_gck[i].r); + &sama5d2_gck[i].r, + sama5d2_gck[i].chg_pid);if (IS_ERR (hw)) goto err_free;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/260 clk: at91: clk-generated: Limit the requested rate to our range
In reply to Greg Kroah-HartmanFrom: Codrin Ciubotariu <[email protected]>
[ Upstream commit af7651e67b9d5f7e63ea23b118e3672ac662244a ]
On clk_generated_determine_rate(), the requested rate could be outside of clk's range. Limit the rate to the clock's range to not return an error.
--- drivers/clk/at91/clk-generated.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/clk/at91/clk-generated.c +6 -0
@@ -127,6 +127,12 @@ static int clk_generated_determine_rate(struct clk_hw *hw,int i;u32 div; +/* do not look for a rate that is outside of our range */ +if (gck->range.max && req->rate > gck->range.max) + req->rate = gck->range.max; +if (gck->range.min && req->rate < gck->range.min) + req->rate = gck->range.min; +for (i =0 ; i <clk_hw_get_num_parents (hw); i++) {if (gck->chg_pid == i)continue ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/260 KVM: PPC: Fix clearing never mapped TCEs in realmode
In reply to Greg Kroah-HartmanFrom: Alexey Kardashevskiy <[email protected]>
[ Upstream commit 1d78dfde33a02da1d816279c2e3452978b7abd39 ]
Since commit e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on demand too"), pages for TCE tables for KVM guests are allocated only when needed. This allows skipping any update when clearing TCEs. This works mostly fine as TCE updates are handled when the MMU is enabled. The realmode handlers fail with H_TOO_HARD when pages are not yet allocated, except when clearing a TCE in which case KVM prints a warning and proceeds to dereference a NULL pointer, which crashes the host OS.
This has not been caught so far as the change in commit e1a1ef84cd07 is reasonably new, and POWER9 runs mostly radix which does not use realmode handlers. With hash, the default TCE table is memset() by QEMU when the machine is reset which triggers page faults and the KVM TCE device's kvm_spapr_tce_fault() handles those with MMU on. And the huge DMA windows are not cleared by VMs which instead successfully create a DMA window big enough to map the VM memory 1:1 and then VMs just map everything without clearing.
This started crashing now as commit 381ceda88c4c ("powerpc/pseries/iommu:
Make use of DDW for indirect mapping") added a mode when a dymanic DMA window not big enough to map the VM memory 1:1 but it is used anyway, and the VM now is the first (i.e. not QEMU) to clear a just created table. Note that upstream QEMU needs to be modified to trigger the VM to trigger the host OS crash.
This replaces WARN_ON_ONCE_RM() with a check and return, and adds another warning if TCE is not being cleared.
--- arch/powerpc/kvm/book3s_64_vio_hv.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/powerpc/kvm/book3s_64_vio_hv.c +6 -3
@@ -177,10 +177,13 @@ static void kvmppc_rm_tce_put(struct kvmppc_spapr_tce_table *stt, idx -= stt->offset; page = stt->pages[idx /TCES_PER_PAGE ];/* -* page must not be NULL in real mode, -* kvmppc_rm_ioba_validate() must have taken care of this. +* kvmppc_rm_ioba_validate() allows pages not be allocated if TCE is +* being cleared, otherwise it returns H_TOO_HARD and we skip this. */ -WARN_ON_ONCE_RM (!page); +if (!page) { +WARN_ON_ONCE_RM (tce !=0 ); +return ; + } tbl =kvmppc_page_address (page); tbl[idx %TCES_PER_PAGE ] = tce;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/260 f2fs: fix to account missing .skipped_gc_rwsem
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit ad126ebddecbf696e0cf214ff56c7b170fa9f0f7 ]
There is a missing place we forgot to account .skipped_gc_rwsem, fix it.
--- fs/f2fs/gc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/f2fs/gc.c +3 -1
@@ -1095,8 +1095,10 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,int err;if (S_ISREG (inode->i_mode)) { -if (!down_write_trylock (&fi->i_gc_rwsem[READ ])) +if (!down_write_trylock (&fi->i_gc_rwsem[READ ])) { + sbi->skipped_gc_rwsem++;continue ; + }if (!down_write_trylock ( &fi->i_gc_rwsem[WRITE ])) { sbi->skipped_gc_rwsem++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/260 f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit adf9ea89c719c1d23794e363f631e376b3ff8cbc ]
In below path, it will return ENOENT if filesystem is shutdown:
- f2fs_map_blocks
- f2fs_get_dnode_of_data
- f2fs_get_node_page
- __get_node_page
- read_node_page
- is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN)
return -ENOENT
- force return value from ENOENT to 0
It should be fine for read case, since it indicates a hole condition, and caller could use .m_next_pgofs to skip the hole and continue the lookup.
However it may cause confusing for write case, since leaving a hole there, and said nothing was wrong doesn't help.
There is at least one case from dax_iomap_actor() will complain that, so fix this in prior to supporting dax in f2fs.
xfstest generic/388 reports below warning:
ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 485833 at fs/dax.c:1127 dax_iomap_actor+0x339/0x370 Call Trace: iomap_apply+0x1c4/0x7b0 ? dax_iomap_rw+0x1c0/0x1c0 dax_iomap_rw+0xad/0x1c0 ? dax_iomap_rw+0x1c0/0x1c0 f2fs_file_write_iter+0x5ab/0x970 [f2fs] do_iter_readv_writev+0x273/0x2e0 do_iter_write+0xab/0x1f0 vfs_iter_write+0x21/0x40 iter_file_splice_write+0x287/0x540 do_splice+0x37c/0xa60 __x64_sys_splice+0x15f/0x3a0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
------------[ cut here ]------------ RIP: 0010:dax_iomap_pte_fault.isra.0+0x72e/0x14a0 Call Trace: dax_iomap_fault+0x44/0x70 f2fs_dax_huge_fault+0x155/0x400 [f2fs] f2fs_dax_fault+0x18/0x30 [f2fs] __do_fault+0x4e/0x120 do_fault+0x3cf/0x7a0 __handle_mm_fault+0xa8c/0xf20 ? find_held_lock+0x39/0xd0 handle_mm_fault+0x1b6/0x480 do_user_addr_fault+0x320/0xcd0 ? rcu_read_lock_sched_held+0x67/0xc0 exc_page_fault+0x77/0x3f0 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30
--- fs/f2fs/data.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/f2fs/data.c +14 -0
@@ -1191,7 +1191,21 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,if (err) {if (flag ==F2FS_GET_BLOCK_BMAP ) map->m_pblk =0 ; +if (err == -ENOENT ) { +/* +* There is one exceptional case that read_node_page() +* may return -ENOENT due to filesystem has been +* shutdown or cp_error, so force to convert error +* number to EIO for such case. +*/ +if (map->m_may_create && + (is_sbi_flag_set (sbi,SBI_IS_SHUTDOWN ) || +f2fs_cp_error (sbi))) { + err = -EIO ; + goto unlock_out; + } + err =0 ;if (map->m_next_pgofs) *map->m_next_pgofs =
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/260 f2fs: fix to unmap pages from userspace process in punch_hole()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit c8dc3047c48540183744f959412d44b08c5435e1 ]
We need to unmap pages from userspace process before removing pagecache in punch_hole() like we did in f2fs_setattr().
Similar change:
commit 5e44f8c374dc ("ext4: hole-punch use truncate_pagecache_range")
--- fs/f2fs/file.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/f2fs/file.c +1 -3
@@ -981,7 +981,6 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len) }if (pg_start < pg_end) { -struct address_space *mapping = inode->i_mapping;loff_t blk_start, blk_end;struct f2fs_sb_info *sbi =F2FS_I_SB (inode);
@@ -993,8 +992,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)down_write (&F2FS_I (inode)->i_gc_rwsem[WRITE ]);down_write (&F2FS_I (inode)->i_mmap_sem); -truncate_inode_pages_range (mapping, blk_start, - blk_end -1 ); +truncate_pagecache_range (inode, blk_start, blk_end -1 );f2fs_lock_op (sbi); ret =f2fs_truncate_hole (inode, pg_start, pg_end);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/260 MIPS: Malta: fix alignment of the devicetree buffer
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit bea6a94a279bcbe6b2cde348782b28baf12255a5 ]
Starting with following patch MIPS Malta is not able to boot:
| commit 79edff12060fe7772af08607eff50c0e2486c5ba | Author: Rob Herring <[email protected]> | scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9
The reason is the alignment test added to the fdt_ro_probe_(). To fix this issue, we need to make sure that fdt_buf is aligned.
Since the dtc patch was designed to uncover potential issue, I handle initial MIPS Malta patch as initial bug.
--- arch/mips/mti-malta/malta-dtshim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/mti-malta/malta-dtshim.c +1 -1
@@ -22,7 +22,7 @@#define ROCIT_CONFIG_GEN1_MEMMAP_SHIFT 8#define ROCIT_CONFIG_GEN1_MEMMAP_MASK (0xf << 8) -static unsigned char fdt_buf[16 <<10 ]__initdata ; +static unsigned char fdt_buf[16 <<10 ]__initdata __aligned(8) ;/* determined physical memory size, not overridden by command line args */ extern unsigned long physical_memsize;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/260 kbuild: Fix no symbols warning when CONFIG_TRIM_UNUSD_KSYMS=y
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 52d83df682c82055961531853c066f4f16e234ea ]
When CONFIG_TRIM_UNUSED_KSYMS is enabled, I see some warnings like this:
nm: arch/x86/entry/vdso/vdso32/note.o: no symbols
$NM (both GNU nm and llvm-nm) warns when no symbol is found in the object. Suppress the stderr.
Fangrui Song mentioned binutils>=2.37 nm -q can be used to suppress "no symbols" [1], and llvm-nm>=13.0.0 supports -q as well.
We cannot use it for now, but note it as a TODO.
[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=27408
--- scripts/gen_ksymdeps.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
scripts/gen_ksymdeps.sh +7 -1
@@ -4,7 +4,13 @@ set -e # List of exported symbols -ksyms=$($NM $1 | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z) +# +# If the object has no symbol, $NM warns 'no symbols'. +# Suppress the stderr. +# TODO: +# Use -q instead of 2>/dev/null when we upgrade the minimum version of +# binutils to 2.37, llvm to 13.0.0. +ksyms=$($NM $1 2>/dev/null | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z) if [ -z "$ksyms" ]; then exit 0
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/260 userfaultfd: prevent concurrent API initialization
In reply to Greg Kroah-HartmanFrom: Nadav Amit <[email protected]>
[ Upstream commit 22e5fe2a2a279d9a6fcbdfb4dffe73821bef1c90 ]
userfaultfd assumes that the enabled features are set once and never changed after UFFDIO_API ioctl succeeded.
However, currently, UFFDIO_API can be called concurrently from two different threads, succeed on both threads and leave userfaultfd's features in non-deterministic state. Theoretically, other uffd operations (ioctl's and page-faults) can be dispatched while adversely affected by such changes of features.
Moreover, the writes to ctx->state and ctx->features are not ordered, which can - theoretically, again - let userfaultfd_ioctl() think that userfaultfd API completed, while the features are still not initialized.
To avoid races, it is arguably best to get rid of ctx->state. Since there are only 2 states, record the API initialization in ctx->features as the uppermost bit and remove ctx->state.
--- fs/userfaultfd.c | 93 +++++++++++++++++++++++------------------------- 1 file changed, 45 insertions(+), 48 deletions(-)
fs/userfaultfd.c +45 -48
@@ -32,11 +32,6 @@ int sysctl_unprivileged_userfaultfd __read_mostly = 1;static struct kmem_cache *userfaultfd_ctx_cachep__read_mostly ; -enum userfaultfd_state { -UFFD_STATE_WAIT_API , -UFFD_STATE_RUNNING , -}; -/* * Start with fault_pending_wqh and fault_wqh so they're more likely * to be in the same cacheline.
@@ -68,8 +63,6 @@ struct userfaultfd_ctx {unsigned int flags;/* features requested from the userspace */ unsigned int features; -/* state machine */ -enum userfaultfd_state state;/* released */ bool released;/* memory mappings are changing because of non-cooperative event */
@@ -103,6 +96,14 @@ struct userfaultfd_wake_range {unsigned long len; }; +/* internal indication that UFFD_API ioctl was successfully executed */ +#define UFFD_FEATURE_INITIALIZED (1u << 31) + +static bool userfaultfd_is_initialized (struct userfaultfd_ctx *ctx) +{ +return ctx->features &UFFD_FEATURE_INITIALIZED ; +} +static int userfaultfd_wake_function (wait_queue_entry_t *wq,unsigned mode,int wake_flags,void *key) {
@@ -699,7 +700,6 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)refcount_set (&ctx->refcount,1 ); ctx->flags = octx->flags; - ctx->state =UFFD_STATE_RUNNING ; ctx->features = octx->features; ctx->released = false; ctx->mmap_changing = false;
@@ -980,38 +980,33 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait)poll_wait (file, &ctx->fd_wqh, wait); -switch (ctx->state) { -case UFFD_STATE_WAIT_API : +if (!userfaultfd_is_initialized (ctx))return EPOLLERR ; -case UFFD_STATE_RUNNING : -/* -* poll() never guarantees that read won't block. -* userfaults can be waken before they're read(). -*/ -if (unlikely (!(file->f_flags &O_NONBLOCK ))) -return EPOLLERR ; -/* -* lockless access to see if there are pending faults -* __pollwait last action is the add_wait_queue but -* the spin_unlock would allow the waitqueue_active to -* pass above the actual list_add inside -* add_wait_queue critical section. So use a full -* memory barrier to serialize the list_add write of -* add_wait_queue() with the waitqueue_active read -* below. -*/ - ret =0 ; -smp_mb (); -if (waitqueue_active (&ctx->fault_pending_wqh)) - ret =EPOLLIN ; -else if (waitqueue_active (&ctx->event_wqh)) - ret =EPOLLIN ; - -return ret; -default : -WARN_ON_ONCE (1 ); + +/* +* poll() never guarantees that read won't block. +* userfaults can be waken before they're read(). +*/ +if (unlikely (!(file->f_flags &O_NONBLOCK )))return EPOLLERR ; - } +/* +* lockless access to see if there are pending faults +* __pollwait last action is the add_wait_queue but +* the spin_unlock would allow the waitqueue_active to +* pass above the actual list_add inside +* add_wait_queue critical section. So use a full +* memory barrier to serialize the list_add write of +* add_wait_queue() with the waitqueue_active read +* below. +*/ + ret =0 ; +smp_mb (); +if (waitqueue_active (&ctx->fault_pending_wqh)) + ret =EPOLLIN ; +else if (waitqueue_active (&ctx->event_wqh)) + ret =EPOLLIN ; + +return ret; }static const struct file_operations userfaultfd_fops;
@@ -1205,7 +1200,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,struct uffd_msg msg;int no_wait = file->f_flags &O_NONBLOCK ; -if (ctx->state ==UFFD_STATE_WAIT_API ) +if (!userfaultfd_is_initialized (ctx))return -EINVAL ;for (;;) {
@@ -1807,9 +1802,10 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx,static inline unsigned int uffd_ctx_features (__u64 user_features) {/* -* For the current set of features the bits just coincide +* For the current set of features the bits just coincide. Set +* UFFD_FEATURE_INITIALIZED to mark the features as enabled. */ -return (unsigned int )user_features; +return (unsigned int )user_features |UFFD_FEATURE_INITIALIZED ; }/*
@@ -1822,12 +1818,10 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, {struct uffdio_api uffdio_api;void __user *buf = (void __user *)arg; +unsigned int ctx_features;int ret;__u64 features; - ret = -EINVAL ; -if (ctx->state !=UFFD_STATE_WAIT_API ) - goto out; ret = -EFAULT ;if (copy_from_user (&uffdio_api, buf,sizeof (uffdio_api))) goto out;
@@ -1844,9 +1838,13 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, ret = -EFAULT ;if (copy_to_user (buf, &uffdio_api,sizeof (uffdio_api))) goto out; - ctx->state =UFFD_STATE_RUNNING ; +/* only enable the requested features for this uffd context */ - ctx->features =uffd_ctx_features (features); + ctx_features =uffd_ctx_features (features); + ret = -EINVAL ; +if (cmpxchg (&ctx->features,0 , ctx_features) !=0 ) + goto err_out; + ret =0 ; out:return ret;
@@ -1863,7 +1861,7 @@ static long userfaultfd_ioctl(struct file *file, unsigned cmd,int ret = -EINVAL ;struct userfaultfd_ctx *ctx = file->private_data; -if (cmd !=UFFDIO_API && ctx->state ==UFFD_STATE_WAIT_API ) +if (cmd !=UFFDIO_API && !userfaultfd_is_initialized (ctx))return -EINVAL ;switch (cmd) {
@@ -1964,7 +1962,6 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)refcount_set (&ctx->refcount,1 ); ctx->flags = flags; ctx->features =0 ; - ctx->state =UFFD_STATE_WAIT_API ; ctx->released = false; ctx->mmap_changing = false; ctx->mm = current->mm;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/260 drm/amdgpu: Fix amdgpu_ras_eeprom_init()
In reply to Greg Kroah-HartmanFrom: Luben Tuikov <[email protected]>
[ Upstream commit dce4400e6516d18313d23de45b5be8a18980b00e ]
No need to account for the 2 bytes of EEPROM address--this is now well abstracted away by the fixes the the lower layers.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +1 -1
@@ -138,7 +138,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control *control)return ret; } -__decode_table_header_from_buff (hdr, &buff[2 ]); +__decode_table_header_from_buff (hdr, buff);if (hdr->header ==EEPROM_TABLE_HDR_VAL ) { control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) /
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/260 ASoC: atmel: ATMEL drivers dont need HAS_DMA
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 6c5c659dfe3f02e08054a6c20019e3886618b512 ]
On a config (such as arch/sh/) which does not set HAS_DMA when MMU is not set, several ATMEL ASoC drivers select symbols that cause kconfig warnings. There is one "depends on HAS_DMA" which is no longer needed. Dropping it eliminates the kconfig warnings and still builds with no problems reported.
Fix the following kconfig warnings:
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_PDC
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n] Selected by [m]:
- SND_ATMEL_SOC_SSC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m]
- SND_ATMEL_SOC_SSC_PDC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_PDC
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
Selected by [m]:
- SND_AT91_SOC_SAM9G20_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n] Selected by [m]:
- SND_ATMEL_SOC_SSC_DMA [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]
WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_DMA
Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
Selected by [m]:
- SND_ATMEL_SOC_WM8904 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && I2C [=m]
- SND_AT91_SOC_SAM9X5_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]
--- sound/soc/atmel/Kconfig | 1 - 1 file changed, 1 deletion(-)
sound/soc/atmel/Kconfig +0 -1
@@ -11,7 +11,6 @@ if SND_ATMEL_SOC config SND_ATMEL_SOC_PDC bool - depends on HAS_DMA config SND_ATMEL_SOC_DMA bool
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/260 media: dib8000: rewrite the init prbs logic
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit 8db11aebdb8f93f46a8513c22c9bd52fa23263aa ]
The logic at dib8000_get_init_prbs() has a few issues:
1. the tables used there has an extra unused value at the beginning;
2. the dprintk() message doesn't write the right value when transmission mode is not 8K;
3. the array overflow validation is done by the callers.
Rewrite the code to fix such issues.
This should also shut up those smatch warnings:
drivers/media/dvb-frontends/dib8000.c:2125 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14 drivers/media/dvb-frontends/dib8000.c:2129 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_2k' 14 <= 14 drivers/media/dvb-frontends/dib8000.c:2131 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_4k' 14 <= 14 drivers/media/dvb-frontends/dib8000.c:2134 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14
--- drivers/media/dvb-frontends/dib8000.c | 58 +++++++++++++++++++-------- 1 file changed, 41 insertions(+), 17 deletions(-)
drivers/media/dvb-frontends/dib8000.c +41 -17
@@ -2107,32 +2107,55 @@ static void dib8000_load_ana_fe_coefs(struct dib8000_state *state, const s16 *andib8000_write_word (state,117 + mode, ana_fe[mode]); } -static const u16 lut_prbs_2k[14 ] = { -0 ,0x423 ,0x009 ,0x5C7 ,0x7A6 ,0x3D8 ,0x527 ,0x7FF ,0x79B ,0x3D6 ,0x3A2 ,0x53B ,0x2F4 ,0x213 +static const u16 lut_prbs_2k[13 ] = { +0x423 ,0x009 ,0x5C7 , +0x7A6 ,0x3D8 ,0x527 , +0x7FF ,0x79B ,0x3D6 , +0x3A2 ,0x53B ,0x2F4 , +0x213 }; -static const u16 lut_prbs_4k[14 ] = { -0 ,0x208 ,0x0C3 ,0x7B9 ,0x423 ,0x5C7 ,0x3D8 ,0x7FF ,0x3D6 ,0x53B ,0x213 ,0x029 ,0x0D0 ,0x48E + +static const u16 lut_prbs_4k[13 ] = { +0x208 ,0x0C3 ,0x7B9 , +0x423 ,0x5C7 ,0x3D8 , +0x7FF ,0x3D6 ,0x53B , +0x213 ,0x029 ,0x0D0 , +0x48E }; -static const u16 lut_prbs_8k[14 ] = { -0 ,0x740 ,0x069 ,0x7DD ,0x208 ,0x7B9 ,0x5C7 ,0x7FF ,0x53B ,0x029 ,0x48E ,0x4C4 ,0x367 ,0x684 + +static const u16 lut_prbs_8k[13 ] = { +0x740 ,0x069 ,0x7DD , +0x208 ,0x7B9 ,0x5C7 , +0x7FF ,0x53B ,0x029 , +0x48E ,0x4C4 ,0x367 , +0x684 };static u16 dib8000_get_init_prbs (struct dib8000_state *state,u16 subchannel) {int sub_channel_prbs_group =0 ; +int prbs_group; - sub_channel_prbs_group = (subchannel /3 ) +1 ; -dprintk ("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n" , sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]); + sub_channel_prbs_group = subchannel /3 ; +if (sub_channel_prbs_group >=ARRAY_SIZE (lut_prbs_2k)) +return 0 ;switch (state->fe[0 ]->dtv_property_cache.transmission_mode) {case TRANSMISSION_MODE_2K : -return lut_prbs_2k[sub_channel_prbs_group]; + prbs_group = lut_prbs_2k[sub_channel_prbs_group]; +break ;case TRANSMISSION_MODE_4K : -return lut_prbs_4k[sub_channel_prbs_group]; + prbs_group = lut_prbs_4k[sub_channel_prbs_group]; +break ;default :case TRANSMISSION_MODE_8K : -return lut_prbs_8k[sub_channel_prbs_group]; + prbs_group = lut_prbs_8k[sub_channel_prbs_group]; } + +dprintk ("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n" , + sub_channel_prbs_group, subchannel, prbs_group); + +return prbs_group; }static void dib8000_set_13seg_channel (struct dib8000_state *state)
@@ -2409,10 +2432,8 @@ static void dib8000_set_isdbt_common_channel(struct dib8000_state *state, u8 seq/* TSB or ISDBT ? apply it now */ if (c->isdbt_sb_mode) {dib8000_set_sb_channel (state); -if (c->isdbt_sb_subchannel <14 ) - init_prbs =dib8000_get_init_prbs (state, c->isdbt_sb_subchannel); -else - init_prbs =0 ; + init_prbs =dib8000_get_init_prbs (state, + c->isdbt_sb_subchannel); }else {dib8000_set_13seg_channel (state); init_prbs =0xfff ;
@@ -3004,6 +3025,7 @@ static int dib8000_tune(struct dvb_frontend *fe)unsigned long *timeout = &state->timeout;unsigned long now = jiffies; +u16 init_prbs;#ifdef DIB8000_AGC_FREEZE u16 agc1, agc2;#endif
@@ -3302,8 +3324,10 @@ static int dib8000_tune(struct dvb_frontend *fe)break ;case CT_DEMOD_STEP_11 :/* 41 : init prbs autosearch */ -if (state->subchannel <=41 ) { -dib8000_set_subchannel_prbs (state,dib8000_get_init_prbs (state, state->subchannel)); + init_prbs =dib8000_get_init_prbs (state, state->subchannel); + +if (init_prbs) { +dib8000_set_subchannel_prbs (state, init_prbs); *tune_state =CT_DEMOD_STEP_9 ; }else { *tune_state =CT_DEMOD_STOP ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/260 crypto: mxs-dcp - Use sg_mapping_iter to copy data
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 2e6d793e1bf07fe5e20cfbbdcec9e1af7e5097eb ]
This uses the sg_pcopy_from_buffer to copy data, instead of doing it ourselves.
In addition to reducing code size, this fixes the following oops resulting from failing to kmap the page:
[ 68.896381] Unable to handle kernel NULL pointer dereference at virtual address 00000ab8 [ 68.904539] pgd = 3561adb3 [ 68.907475] [00000ab8] *pgd=00000000 [ 68.911153] Internal error: Oops: 805 [#1] ARM [ 68.915618] Modules linked in: cfg80211 rfkill des_generic libdes arc4 libarc4 cbc ecb algif_skcipher sha256_generic libsha256 sha1_generic hmac aes_generic libaes cmac sha512_generic md5 md4 algif_hash af_alg i2c_imx i2c_core ci_hdrc_imx ci_hdrc mxs_dcp ulpi roles udc_core imx_sdma usbmisc_imx usb_common firmware_class virt_dma phy_mxs_usb nf_tables nfnetlink ip_tables x_tables ipv6 autofs4 [ 68.950741] CPU: 0 PID: 139 Comm: mxs_dcp_chan/ae Not tainted 5.10.34 #296 [ 68.958501] Hardware name: Freescale i.MX6 Ultralite (Device Tree) [ 68.964710] PC is at memcpy+0xa8/0x330 [ 68.968479] LR is at 0xd7b2bc9d [ 68.971638] pc : [<c053e7c8>] lr : [<d7b2bc9d>] psr: 000f0013 [ 68.977920] sp : c2cbbee4 ip : 00000010 fp : 00000010 [ 68.983159] r10: 00000000 r9 : c3283a40 r8 : 1a5a6f08 [ 68.988402] r7 : 4bfe0ecc r6 : 76d8a220 r5 : c32f9050 r4 : 00000001 [ 68.994945] r3 : 00000ab8 r2 : fffffff0 r1 : c32f9050 r0 : 00000ab8 [ 69.001492] Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 69.008646] Control: 10c53c7d Table: 83664059 DAC: 00000051 [ 69.014414] Process mxs_dcp_chan/ae (pid: 139, stack limit = 0x667b57ab) [ 69.021133] Stack: (0xc2cbbee4 to 0xc2cbc000) [ 69.025519] bee0: c32f9050 c3235408 00000010 00000010 00000ab8 00000001 bf10406c [ 69.033720] bf00: 00000000 00000000 00000010 00000000 c32355d0 832fb080 00000000 c13de2fc [ 69.041921] bf20: c3628010 00000010 c33d5780 00000ab8 bf1067e8 00000002 c21e5010 c2cba000 [ 69.050125] bf40: c32f8040 00000000 bf106a40 c32f9040 c3283a80 00000001 bf105240 c3234040 [ 69.058327] bf60: ffffe000 c3204100 c2c69800 c2cba000 00000000 bf103b84 00000000 c2eddc54 [ 69.066530] bf80: c3204144 c0140d1c c2cba000 c2c69800 c0140be8 00000000 00000000 00000000 [ 69.074730] bfa0: 00000000 00000000 00000000 c0100114 00000000 00000000 00000000 00000000 [ 69.082932] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 69.091131] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [ 69.099364] [<c053e7c8>] (memcpy) from [<bf10406c>] (dcp_chan_thread_aes+0x4e8/0x840 [mxs_dcp]) [ 69.108117] [<bf10406c>] (dcp_chan_thread_aes [mxs_dcp]) from [<c0140d1c>] (kthread+0x134/0x160) [ 69.116941] [<c0140d1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20) [ 69.124178] Exception stack(0xc2cbbfb0 to 0xc2cbbff8) [ 69.129250] bfa0: 00000000 00000000 00000000 00000000 [ 69.137450] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 69.145648] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 69.152289] Code: e320f000 e4803004 e4804004 e4805004 (e4806004)
--- drivers/crypto/mxs-dcp.c | 36 +++++++++--------------------------- 1 file changed, 9 insertions(+), 27 deletions(-)
drivers/crypto/mxs-dcp.c +9 -27
@@ -298,21 +298,20 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)struct scatterlist *dst = req->dst;struct scatterlist *src = req->src; -const int nents =sg_nents (req->src); +int dst_nents =sg_nents (dst);const int out_off =DCP_BUF_SZ ;uint8_t *in_buf = sdcp->coh->aes_in_buf;uint8_t *out_buf = sdcp->coh->aes_out_buf; -uint8_t *out_tmp, *src_buf, *dst_buf =NULL ;uint32_t dst_off =0 ; +uint8_t *src_buf =NULL ;uint32_t last_out_len =0 ;uint8_t *key = sdcp->coh->aes_key;int ret =0 ; -int split =0 ; -unsigned int i, len, clen, rem =0 , tlen =0 ; +unsigned int i, len, clen, tlen =0 ;int init =0 ;bool limit_hit = false;
@@ -330,7 +329,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)memset (key +AES_KEYSIZE_128 ,0 ,AES_KEYSIZE_128 ); } -for_each_sg (req->src, src, nents, i) { +for_each_sg (req->src, src,sg_nents (src), i) { src_buf =sg_virt (src); len =sg_dma_len (src); tlen += len;
@@ -355,34 +354,17 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)* submit the buffer. */ if (actx->fill == out_off ||sg_is_last (src) || - limit_hit) { + limit_hit) { ret =mxs_dcp_run_aes (actx, req, init);if (ret)return ret; init =0 ; - out_tmp = out_buf; +sg_pcopy_from_buffer (dst, dst_nents, out_buf, + actx->fill, dst_off); + dst_off += actx->fill; last_out_len = actx->fill; -while (dst && actx->fill) { -if (!split) { - dst_buf =sg_virt (dst); - dst_off =0 ; - } - rem =min (sg_dma_len (dst) - dst_off, - actx->fill); - -memcpy (dst_buf + dst_off, out_tmp, rem); - out_tmp += rem; - dst_off += rem; - actx->fill -= rem; - -if (dst_off ==sg_dma_len (dst)) { - dst =sg_next (dst); - split =0 ; - }else { - split =1 ; - } - } + actx->fill =0 ; } }while (len);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/260 PCI: Use pci_update_current_state() in pci_enable_device_flags()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 14858dcc3b3587f4bb5c48e130ee7d68fc2b0a29 ]
Updating the current_state field of struct pci_dev the way it is done in pci_enable_device_flags() before calling do_pci_enable_device() may not work. For example, if the given PCI device depends on an ACPI power resource whose _STA method initially returns 0 ("off"), but the config space of the PCI device is accessible and the power state retrieved from the PCI_PM_CTRL register is D0, the current_state field in the struct pci_dev representing that device will get out of sync with the power.state of its ACPI companion object and that will lead to power management issues going forward.
To avoid such issues, make pci_enable_device_flags() call pci_update_current_state() which takes ACPI device power management into account, if present, to retrieve the current power state of the device.
--- drivers/pci/pci.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/pci/pci.c +1 -5
@@ -1672,11 +1672,7 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)* so that things like MSI message writing will behave as expected * (e.g. if the device really is in D0 at enable time). */ -if (dev->pm_cap) { -u16 pmcsr; -pci_read_config_word (dev, dev->pm_cap +PCI_PM_CTRL , &pmcsr); - dev->current_state = (pmcsr &PCI_PM_CTRL_STATE_MASK ); - } +pci_update_current_state (dev, dev->current_state);if (atomic_inc_return (&dev->enable_cnt) >1 )return 0 ;/* already enabled */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/260 tipc: keep the skb in rcv queue until the whole data is read
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit f4919ff59c2828064b4156e3c3600a169909bcf4 ]
Currently, when userspace reads a datagram with a buffer that is smaller than this datagram, the data will be truncated and only part of it can be received by users. It doesn't seem right that users don't know the datagram size and have to use a huge buffer to read it to avoid the truncation.
This patch to fix it by keeping the skb in rcv queue until the whole data is read by users. Only the last msg of the datagram will be marked with MSG_EOR, just as TCP/SCTP does.
Note that this will work as above only when MSG_EOR is set in the flags parameter of recvmsg(), so that it won't break any old user applications.
--- net/tipc/socket.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-)
net/tipc/socket.c +27 -9
@@ -1756,6 +1756,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,bool connected = !tipc_sk_type_connectionless (sk);struct tipc_sock *tsk =tipc_sk (sk);int rc, err, hlen, dlen, copy; +struct tipc_skb_cb *skb_cb;struct sk_buff_head xmitq;struct tipc_msg *hdr;struct sk_buff *skb;
@@ -1779,6 +1780,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,if (unlikely (rc)) goto exit; skb =skb_peek (&sk->sk_receive_queue); + skb_cb =TIPC_SKB_CB (skb); hdr =buf_msg (skb); dlen =msg_data_sz (hdr); hlen =msg_hdr_sz (hdr);
@@ -1798,18 +1800,33 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,/* Capture data if non-error msg, otherwise just set return value */ if (likely (!err)) { - copy =min_t (int, dlen, buflen); -if (unlikely (copy != dlen)) - m->msg_flags |=MSG_TRUNC ; - rc =skb_copy_datagram_msg (skb, hlen, m, copy); +int offset = skb_cb->bytes_read; + + copy =min_t (int, dlen - offset, buflen); + rc =skb_copy_datagram_msg (skb, hlen + offset, m, copy); +if (unlikely (rc)) + goto exit; +if (unlikely (offset + copy < dlen)) { +if (flags &MSG_EOR ) { +if (!(flags &MSG_PEEK )) + skb_cb->bytes_read = offset + copy; + }else { + m->msg_flags |=MSG_TRUNC ; + skb_cb->bytes_read =0 ; + } + }else { +if (flags &MSG_EOR ) + m->msg_flags |=MSG_EOR ; + skb_cb->bytes_read =0 ; + } }else { copy =0 ; rc =0 ; -if (err !=TIPC_CONN_SHUTDOWN && connected && !m->msg_control) +if (err !=TIPC_CONN_SHUTDOWN && connected && !m->msg_control) { rc = -ECONNRESET ; + goto exit; + } } -if (unlikely (rc)) - goto exit;/* Mark message as group event if applicable */ if (unlikely (grp_evt)) {
@@ -1832,9 +1849,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,tipc_node_distr_xmit (sock_net (sk), &xmitq); } -tsk_advance_rx_queue (sk); +if (!skb_cb->bytes_read) +tsk_advance_rx_queue (sk); -if (likely (!connected)) +if (likely (!connected) || skb_cb->bytes_read) goto exit;/* Send connection flow control advertisement when applicable */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/260 iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
[ Upstream commit 97683c851f9cdbd3ea55697cbe2dcb6af4287bbd ]
The naming of the regulator is problematic. VCC is usually a supply voltage whereas these devices have a separate VREF pin.
Secondly, the regulator core might have provided a stub regulator if a real regulator wasn't provided. That would in turn have failed to provide a voltage when queried. So reality was that there was no way to use the internal reference.
In order to avoid breaking any dts out in the wild, make sure to fallback to the original vcc naming if vref is not available.
--- drivers/iio/dac/ad5624r_spi.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/iio/dac/ad5624r_spi.c +17 -1
@@ -229,7 +229,7 @@ static int ad5624r_probe(struct spi_device *spi)if (!indio_dev)return -ENOMEM ; st =iio_priv (indio_dev); - st->reg =devm_regulator_get (&spi->dev,"vcc" ); + st->reg =devm_regulator_get_optional (&spi->dev,"vref" );if (!IS_ERR (st->reg)) { ret =regulator_enable (st->reg);if (ret)
@@ -240,6 +240,22 @@ static int ad5624r_probe(struct spi_device *spi) goto error_disable_reg; voltage_uv = ret; + }else { +if (PTR_ERR (st->reg) != -ENODEV ) +return PTR_ERR (st->reg); +/* Backwards compatibility. This naming is not correct */ + st->reg =devm_regulator_get_optional (&spi->dev,"vcc" ); +if (!IS_ERR (st->reg)) { + ret =regulator_enable (st->reg); +if (ret) +return ret; + + ret =regulator_get_voltage (st->reg); +if (ret <0 ) + goto error_disable_reg; + + voltage_uv = ret; + } }spi_set_drvdata (spi, indio_dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 79/260 iavf: do not override the adapter state in the watchdog task
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 22c8fd71d3a5e6fe584ccc2c1e8760e5baefd5aa ]
The iavf watchdog task overrides adapter->state to __IAVF_RESETTING when it detects a pending reset. Then schedules iavf_reset_task() which takes care of the reset.
The reset task is capable of handling the reset without changing adapter->state. In fact we lose the state information when the watchdog task prematurely changes the adapter state. This may lead to a crash if instead of the reset task the iavf_remove() function gets called before the reset task.
In that case (if we were in state __IAVF_RUNNING previously) the iavf_remove() function triggers iavf_close() which fails to close the device because of the incorrect state information.
This may result in a crash due to pending interrupts. kernel BUG at drivers/pci/msi.c:357!
[...]
Call Trace: [<ffffffffbddf24dd>] pci_disable_msix+0x3d/0x50 [<ffffffffc08d2a63>] iavf_reset_interrupt_capability+0x23/0x40 [iavf] [<ffffffffc08d312a>] iavf_remove+0x10a/0x350 [iavf] [<ffffffffbddd3359>] pci_device_remove+0x39/0xc0 [<ffffffffbdeb492f>] __device_release_driver+0x7f/0xf0 [<ffffffffbdeb49c3>] device_release_driver+0x23/0x30 [<ffffffffbddcabb4>] pci_stop_bus_device+0x84/0xa0 [<ffffffffbddcacc2>] pci_stop_and_remove_bus_device+0x12/0x20 [<ffffffffbddf361f>] pci_iov_remove_virtfn+0xaf/0x160 [<ffffffffbddf3bcc>] sriov_disable+0x3c/0xf0 [<ffffffffbddf3ca3>] pci_disable_sriov+0x23/0x30 [<ffffffffc0667365>] i40e_free_vfs+0x265/0x2d0 [i40e] [<ffffffffc0667624>] i40e_pci_sriov_configure+0x144/0x1f0 [i40e] [<ffffffffbddd5307>] sriov_numvfs_store+0x177/0x1d0 Code: 00 00 e8 3c 25 e3 ff 49 c7 86 88 08 00 00 00 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 7b 28 e8 0d 44 RIP [<ffffffffbbbf1068>] free_msi_irqs+0x188/0x190
The solution is to not touch the adapter->state in iavf_watchdog_task() and let the reset task handle the state transition.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +0 -1
@@ -1961,7 +1961,6 @@ static void iavf_watchdog_task(struct work_struct *work)/* check for hw reset */ reg_val =rd32 (hw,IAVF_VF_ARQLEN1 ) &IAVF_VF_ARQLEN1_ARQENABLE_MASK ;if (!reg_val) { - adapter->state = __IAVF_RESETTING; adapter->flags |=IAVF_FLAG_RESET_PENDING ; adapter->aq_required =0 ; adapter->current_op =VIRTCHNL_OP_UNKNOWN ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 80/260 iavf: fix locking of critical sections
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 226d528512cfac890a1619aea4301f3dd314fe60 ]
To avoid races between iavf_init_task(), iavf_reset_task(), iavf_watchdog_task(), iavf_adminq_task() as well as the shutdown and remove functions more locking is required.
The current protection by __IAVF_IN_CRITICAL_TASK is needed in additional places.
- The reset task performs state transitions, therefore needs locking.
- The adminq task acts on replies from the PF in iavf_virtchnl_completion() which may alter the states.
- The init task is not only run during probe but also if a VF gets stuck to reinitialize it.
- The shutdown function performs a state transition.
- The remove function performs a state transition and also free's resources.
iavf_lock_timeout() is introduced to avoid waiting infinitely and cause a deadlock. Rather unlock and print a warning.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 57 ++++++++++++++++++--- 1 file changed, 50 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +50 -7
@@ -142,6 +142,30 @@ enum iavf_status iavf_free_virt_mem_d(struct iavf_hw *hw,return 0 ; } +/** +* iavf_lock_timeout - try to set bit but give up after timeout +* @adapter: board private structure +* @bit: bit to set +* @msecs: timeout in msecs +* +* Returns 0 on success, negative on failure +**/ +static int iavf_lock_timeout (struct iavf_adapter *adapter, +enum iavf_critical_section_t bit, +unsigned int msecs) +{ +unsigned int wait, delay =10 ; + +for (wait =0 ; wait < msecs; wait += delay) { +if (!test_and_set_bit (bit, &adapter->crit_section)) +return 0 ; + +msleep (delay); + } + +return -1 ; +} +/** * iavf_schedule_reset - Set the flags and schedule a reset event * @adapter: board private structure
@@ -2076,6 +2100,10 @@ static void iavf_reset_task(struct work_struct *work)if (test_bit (__IAVF_IN_REMOVE_TASK, &adapter->crit_section))return ; +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,200 )) { +schedule_work (&adapter->reset_task); +return ; + }while (test_and_set_bit (__IAVF_IN_CLIENT_TASK, &adapter->crit_section))usleep_range (500 ,1000 );
@@ -2290,6 +2318,8 @@ static void iavf_adminq_task(struct work_struct *work)if (!event.msg_buf) goto out; +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,200 )) + goto freedom; do { ret = iavf_clean_arq_element(hw, &event, &pending); v_op = (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
@@ -2303,6 +2333,7 @@ static void iavf_adminq_task(struct work_struct *work)if (pending !=0 )memset (event.msg_buf,0 ,IAVF_MAX_AQ_BUF_SIZE ); }while (pending); +clear_bit (__IAVF_IN_CRITICAL_TASK, &adapter->crit_section); if ((adapter->flags & (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED)) ||
@@ -3599,6 +3630,10 @@ static void iavf_init_task(struct work_struct *work) init_task.work);struct iavf_hw *hw = &adapter->hw; +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,5000 )) { +dev_warn (&adapter->pdev->dev,"failed to set __IAVF_IN_CRITICAL_TASK in %s\n" , __FUNCTION__); +return ; + }switch (adapter->state) {case __IAVF_STARTUP:if (iavf_startup (adapter) <0 )
@@ -3611,14 +3646,14 @@ static void iavf_init_task(struct work_struct *work)case __IAVF_INIT_GET_RESOURCES:if (iavf_init_get_resources (adapter) <0 ) goto init_failed; -return ; + goto out;default : goto init_failed; }queue_delayed_work (iavf_wq, &adapter->init_task,msecs_to_jiffies (30 )); -return ; + goto out; init_failed:if (++adapter->aq_wait_count >IAVF_AQ_MAX_ERR ) { dev_err(&adapter->pdev->dev,
@@ -3627,9 +3662,11 @@ static void iavf_init_task(struct work_struct *work)iavf_shutdown_adminq (hw); adapter->state = __IAVF_STARTUP;queue_delayed_work (iavf_wq, &adapter->init_task,HZ *5 ); -return ; + goto out; }queue_delayed_work (iavf_wq, &adapter->init_task,HZ ); +out: +clear_bit (__IAVF_IN_CRITICAL_TASK, &adapter->crit_section); }/**
@@ -3646,9 +3683,12 @@ static void iavf_shutdown(struct pci_dev *pdev)if (netif_running (netdev))iavf_close (netdev); +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,5000 )) +dev_warn (&adapter->pdev->dev,"failed to set __IAVF_IN_CRITICAL_TASK in %s\n" , __FUNCTION__);/* Prevent the watchdog from running. */ adapter->state = __IAVF_REMOVE; adapter->aq_required =0 ; +clear_bit (__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);#ifdef CONFIG_PM pci_save_state (pdev);
@@ -3877,10 +3917,6 @@ static void iavf_remove(struct pci_dev *pdev) err); } -/* Shut down all the garbage mashers on the detention level */ - adapter->state = __IAVF_REMOVE; - adapter->aq_required =0 ; - adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED ;iavf_request_reset (adapter);msleep (50 );/* If the FW isn't responding, kick it once, but only once. */
@@ -3888,6 +3924,13 @@ static void iavf_remove(struct pci_dev *pdev)iavf_request_reset (adapter);msleep (50 ); } +if (iavf_lock_timeout (adapter, __IAVF_IN_CRITICAL_TASK,5000 )) +dev_warn (&adapter->pdev->dev,"failed to set __IAVF_IN_CRITICAL_TASK in %s\n" , __FUNCTION__); + +/* Shut down all the garbage mashers on the detention level */ + adapter->state = __IAVF_REMOVE; + adapter->aq_required =0 ; + adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED ;iavf_free_all_tx_resources (adapter);iavf_free_all_rx_resources (adapter);iavf_misc_irq_disable (adapter);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 81/260 ARM: dts: qcom: apq8064: correct clock names
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
[ Upstream commit 0dc6c59892ead17a9febd11202c9f6794aac1895 ]
Since new code doesn't take old clk names in account, it does fixes error:
msm_dsi 4700000.mdss_dsi: dev_pm_opp_set_clkname: Couldn't find clock: -2
and following kernel oops introduced byb0530eb1191 ("drm/msm/dpu: Use OPP API to set clk/perf state").
Also removes warning about deprecated clock names.
Tested against linux-5.10.y LTS on Nexus 7 2013.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +3 -3
@@ -1261,9 +1261,9 @@ dsi0: mdss_dsi@4700000 { <&mmcc DSI1_BYTE_CLK>, <&mmcc DSI_PIXEL_CLK>, <&mmcc DSI1_ESC_CLK>; - clock-names = "iface_clk", "bus_clk", "core_mmss_clk", - "src_clk", "byte_clk", "pixel_clk", - "core_clk"; + clock-names = "iface", "bus", "core_mmss", + "src", "byte", "pixel", + "core"; assigned-clocks = <&mmcc DSI1_BYTE_SRC>, <&mmcc DSI1_ESC_SRC>,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 82/260 video: fbdev: kyro: fix a DoS bug by restricting user input
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 98a65439172dc69cb16834e62e852afc2adb83ed ]
The user can pass in any value to the driver through the 'ioctl' interface. The driver dost not check, which may cause DoS bugs.
The following log reveals it:
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:SetOverlayViewPort+0x133/0x5f0 drivers/video/fbdev/kyro/STG4000OverlayDevice.c:476 Call Trace: kyro_dev_overlay_viewport_set drivers/video/fbdev/kyro/fbdev.c:378 [inline] kyrofb_ioctl+0x2eb/0x330 drivers/video/fbdev/kyro/fbdev.c:603 do_fb_ioctl+0x1f3/0x700 drivers/video/fbdev/core/fbmem.c:1171 fb_ioctl+0xeb/0x130 drivers/video/fbdev/core/fbmem.c:1185 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19b/0x220 fs/ioctl.c:739 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/video/fbdev/kyro/fbdev.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/video/fbdev/kyro/fbdev.c +5 -0
@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight/* probably haven't called CreateOverlay yet */ return -EINVAL ; +if (ulWidth ==0 || ulWidth ==0xffffffff || + ulHeight ==0 || ulHeight ==0xffffffff || + (x <2 && ulWidth +2 ==0 )) +return -EINVAL ; +/* Stop Ramdac Output */ DisableRamdacOutput (deviceInfo.pSTGReg);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 83/260 netlink: Deal with ESRCH error in nlmsg_notify()
In reply to Greg Kroah-HartmanFrom: Yajun Deng <[email protected]>
[ Upstream commit fef773fc8110d8124c73a5e6610f89e52814637d ]
Yonghong Song report:
The bpf selftest tc_bpf failed with latest bpf-next. The following is the command to run and the result:
$ ./test_progs -n 132 [ 40.947571] bpf_testmod: loading out-of-tree module taints kernel. test_tc_bpf:PASS:test_tc_bpf__open_and_load 0 nsec test_tc_bpf:PASS:bpf_tc_hook_create(BPF_TC_INGRESS) 0 nsec test_tc_bpf:PASS:bpf_tc_hook_create invalid hook.attach_point 0 nsec test_tc_bpf_basic:PASS:bpf_obj_get_info_by_fd 0 nsec test_tc_bpf_basic:PASS:bpf_tc_attach 0 nsec test_tc_bpf_basic:PASS:handle set 0 nsec test_tc_bpf_basic:PASS:priority set 0 nsec test_tc_bpf_basic:PASS:prog_id set 0 nsec test_tc_bpf_basic:PASS:bpf_tc_attach replace mode 0 nsec test_tc_bpf_basic:PASS:bpf_tc_query 0 nsec test_tc_bpf_basic:PASS:handle set 0 nsec test_tc_bpf_basic:PASS:priority set 0 nsec test_tc_bpf_basic:PASS:prog_id set 0 nsec libbpf: Kernel error message: Failed to send filter delete notification test_tc_bpf_basic:FAIL:bpf_tc_detach unexpected error: -3 (errno 3) test_tc_bpf:FAIL:test_tc_internal ingress unexpected error: -3 (errno 3)
The failure seems due to the commit
cfdf0d9ae75b ("rtnetlink: use nlmsg_notify() in rtnetlink_send()")
Deal with ESRCH error in nlmsg_notify() even the report variable is zero.
--- net/netlink/af_netlink.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netlink/af_netlink.c +3 -1
@@ -2521,13 +2521,15 @@ int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,/* errors reported via destination sk->sk_err, but propagate * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ err =nlmsg_multicast (sk, skb, exclude_portid, group, flags); +if (err == -ESRCH ) + err =0 ; }if (report) {int err2; err2 =nlmsg_unicast (sk, skb, portid); -if (!err || err == -ESRCH ) +if (!err) err = err2; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 84/260 Smack: Fix wrong semantics in smk_access_entry()
In reply to Greg Kroah-HartmanFrom: Tianjia Zhang <[email protected]>
[ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ]
In the smk_access_entry() function, if no matching rule is found in the rust_list, a negative error code will be used to perform bit operations with the MAY_ enumeration value. This is semantically wrong. This patch fixes this issue.
--- security/smack/smack_access.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
security/smack/smack_access.c +8 -9
@@ -81,23 +81,22 @@ int log_policy = SMACK_AUDIT_DENIED;int smk_access_entry (char *subject_label,char *object_label,struct list_head *rule_list) { -int may = -ENOENT ;struct smack_rule *srp;list_for_each_entry_rcu (srp, rule_list, list) {if (srp->smk_object->smk_known == object_label && srp->smk_subject->smk_known == subject_label) { - may = srp->smk_access; -break ; +int may = srp->smk_access; +/* +* MAY_WRITE implies MAY_LOCK. +*/ +if ((may &MAY_WRITE ) ==MAY_WRITE ) + may |=MAY_LOCK ; +return may; } } -/* -* MAY_WRITE implies MAY_LOCK. -*/ -if ((may &MAY_WRITE ) ==MAY_WRITE ) - may |=MAY_LOCK ; -return may; +return -ENOENT ; }/**
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 85/260 drm: avoid blocking in drm_clients_infos rcu section
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 5eff9585de220cdd131237f5665db5e6c6bdf590 ]
Inside drm_clients_info, the rcu_read_lock is held to lock pid_task()->comm. However, within this protected section, a call to drm_is_current_master is made, which involves a mutex lock in a future patch. However, this is illegal because the mutex lock might block while in the RCU read-side critical section.
Since drm_is_current_master isn't protected by rcu_read_lock, we avoid this by moving it out of the RCU critical section.
The following report came from intel-gfx ci's
igt@debugfs_test@read_all_entries testcase:
=============================
[ BUG: Invalid wait context ]
5.13.0-CI-Patchwork_20515+ #1 Tainted: G W
-----------------------------
debugfs_test/1101 is trying to lock:ffff888132d901a8 (&dev->master_mutex){+.+.}-{3:3}, at:drm_is_current_master+0x1e/0x50
other info that might help us debug this:
context-{4:4}
3 locks held by debugfs_test/1101:
#0: ffff88810fdffc90 (&p->lock){+.+.}-{3:3}, at:
seq_read_iter+0x53/0x3b0
#1: ffff888132d90240 (&dev->filelist_mutex){+.+.}-{3:3}, at:
drm_clients_info+0x63/0x2a0
#2: ffffffff82734220 (rcu_read_lock){....}-{1:2}, at:
drm_clients_info+0x1b1/0x2a0
stack backtrace:
CPU: 8 PID: 1101 Comm: debugfs_test Tainted: G W
5.13.0-CI-Patchwork_20515+ #1
Hardware name: Intel Corporation CometLake Client Platform/CometLake S
UDIMM (ERB/CRB), BIOS CMLSFWR1.R00.1263.D00.1906260926 06/26/2019
Call Trace:
dump_stack+0x7f/0xad
__lock_acquire.cold.78+0x2af/0x2ca
lock_acquire+0xd3/0x300
? drm_is_current_master+0x1e/0x50
? __mutex_lock+0x76/0x970
? lockdep_hardirqs_on+0xbf/0x130
__mutex_lock+0xab/0x970
? drm_is_current_master+0x1e/0x50
? drm_is_current_master+0x1e/0x50
? drm_is_current_master+0x1e/0x50
drm_is_current_master+0x1e/0x50
drm_clients_info+0x107/0x2a0
seq_read_iter+0x178/0x3b0
seq_read+0x104/0x150
full_proxy_read+0x4e/0x80
vfs_read+0xa5/0x1b0
ksys_read+0x5a/0xd0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae--- drivers/gpu/drm/drm_debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_debugfs.c +2 -1
@@ -91,6 +91,7 @@ static int drm_clients_info(struct seq_file *m, void *data)mutex_lock (&dev->filelist_mutex);list_for_each_entry_reverse (priv, &dev->filelist, lhead) {struct task_struct *task; +bool is_current_master =drm_is_current_master (priv);rcu_read_lock ();/* locks pid_task()->comm */ task =pid_task (priv->pid,PIDTYPE_PID );
@@ -99,7 +100,7 @@ static int drm_clients_info(struct seq_file *m, void *data) task ? task->comm :"<unknown>" ,pid_vnr (priv->pid), priv->minor->index, -drm_is_current_master (priv) ?'y' :'n' , + is_current_master ?'y' :'n' , priv->authenticated ?'y' :'n' ,from_kuid_munged (seq_user_ns (m), uid), priv->magic);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 86/260 igc: Check if num of q_vectors is smaller than max before array access
In reply to Greg Kroah-HartmanFrom: Sasha Neftin <[email protected]>
[ Upstream commit 373e2829e7c2e1e606503cdb5c97749f512a4be9 ]
Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed beyond its size. It was fixed by using a local variable num_q_vectors as a limit for loop index, and ensure that num_q_vectors is not bigger than MAX_Q_VECTORS.
--- drivers/net/ethernet/intel/igc/igc_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/igc/igc_main.c +8 -1
@@ -2693,6 +2693,7 @@ static irqreturn_t igc_msix_ring(int irq, void *data)*/ static int igc_request_msix (struct igc_adapter *adapter) { +unsigned int num_q_vectors = adapter->num_q_vectors;int i =0 , err =0 , vector =0 , free_vector =0 ;struct net_device *netdev = adapter->netdev;
@@ -2701,7 +2702,13 @@ static int igc_request_msix(struct igc_adapter *adapter)if (err) goto err_out; -for (i =0 ; i < adapter->num_q_vectors; i++) { +if (num_q_vectors >MAX_Q_VECTORS ) { + num_q_vectors =MAX_Q_VECTORS ; +dev_warn (&adapter->pdev->dev, +"The number of queue vectors (%d) is higher than max allowed (%d)\n" , + adapter->num_q_vectors,MAX_Q_VECTORS ); + } +for (i =0 ; i < num_q_vectors; i++) {struct igc_q_vector *q_vector = adapter->q_vector[i]; vector++;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 87/260 usb: host: fotg210: fix the endpoints transactional opportunities calculation
In reply to Greg Kroah-HartmanFrom: Kelly Devilliv <[email protected]>
[ Upstream commit c2e898764245c852bc8ee4857613ba4f3a6d761d ]
Now that usb_endpoint_maxp() only returns the lowest 11 bits from wMaxPacketSize, we should make use of the usb_endpoint_* helpers instead and remove the unnecessary max_packet()/hb_mult() macro.
--- drivers/usb/host/fotg210-hcd.c | 36 ++++++++++++++++------------------ 1 file changed, 17 insertions(+), 19 deletions(-)
drivers/usb/host/fotg210-hcd.c +17 -19
@@ -2511,11 +2511,6 @@ static unsigned qh_completions(struct fotg210_hcd *fotg210,return count; } -/* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */ -#define hb_mult (wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03)) -/* ... and packet size, for any kind of endpoint descriptor */ -#define max_packet (wMaxPacketSize) ((wMaxPacketSize) & 0x07ff) -/* reverse of qh_urb_transaction: free a list of TDs. * used for cleanup after errors, before HC sees an URB's TDs. */
@@ -2601,7 +2596,7 @@ static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210, token |= (1 /* "in" */ <<8 );/* else it's already initted to "out" pid (0 << 8) */ - maxpacket =max_packet (usb_maxpacket (urb->dev, urb->pipe, !is_input)); + maxpacket =usb_maxpacket (urb->dev, urb->pipe, !is_input);/* * buffer gets wrapped in one or more qtds;
@@ -2715,9 +2710,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, gfp_t flags) {struct fotg210_qh *qh =fotg210_qh_alloc (fotg210, flags); +struct usb_host_endpoint *ep;u32 info1 =0 , info2 =0 ;int is_input, type;int maxp =0 ; +int mult;struct usb_tt *tt = urb->dev->tt;struct fotg210_qh_hw *hw;
@@ -2732,14 +2729,15 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, is_input =usb_pipein (urb->pipe); type =usb_pipetype (urb->pipe); - maxp =usb_maxpacket (urb->dev, urb->pipe, !is_input); + ep =usb_pipe_endpoint (urb->dev, urb->pipe); + maxp =usb_endpoint_maxp (&ep->desc); + mult =usb_endpoint_maxp_mult (&ep->desc);/* 1024 byte maxpacket is a hardware ceiling. High bandwidth * acts like up to 3KB, but is built from smaller packets. */ -if (max_packet (maxp) >1024 ) { -fotg210_dbg (fotg210,"bogus qh maxpacket %d\n" , -max_packet (maxp)); +if (maxp >1024 ) { +fotg210_dbg (fotg210,"bogus qh maxpacket %d\n" , maxp); goto done; }
@@ -2753,8 +2751,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,*/ if (type ==PIPE_INTERRUPT ) { qh->usecs =NS_TO_US (usb_calc_bus_time (USB_SPEED_HIGH , - is_input,0 , -hb_mult (maxp) *max_packet (maxp))); + is_input,0 , mult * maxp)); qh->start =NO_FRAME ;if (urb->dev->speed ==USB_SPEED_HIGH ) {
@@ -2791,7 +2788,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, think_time = tt ? tt->think_time :0 ; qh->tt_usecs =NS_TO_US (think_time +usb_calc_bus_time (urb->dev->speed, - is_input,0 ,max_packet (maxp))); + is_input,0 , maxp)); qh->period = urb->interval;if (qh->period > fotg210->periodic_size) { qh->period = fotg210->periodic_size;
@@ -2854,11 +2851,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,* to help them do so. So now people expect to use * such nonconformant devices with Linux too; sigh. */ - info1 |=max_packet (maxp) <<16 ; + info1 |= maxp <<16 ; info2 |= (FOTG210_TUNE_MULT_HS <<30 ); }else {/* PIPE_INTERRUPT */ - info1 |=max_packet (maxp) <<16 ; - info2 |=hb_mult (maxp) <<30 ; + info1 |= maxp <<16 ; + info2 |= mult <<30 ; }break ;default :
@@ -3928,6 +3925,7 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,int is_input;long bandwidth;unsigned multi; +struct usb_host_endpoint *ep;/* * this might be a "high bandwidth" highspeed endpoint,
@@ -3935,14 +3933,14 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,*/ epnum =usb_pipeendpoint (pipe); is_input =usb_pipein (pipe) ?USB_DIR_IN :0 ; - maxp =usb_maxpacket (dev, pipe, !is_input); + ep =usb_pipe_endpoint (dev, pipe); + maxp =usb_endpoint_maxp (&ep->desc);if (is_input) buf1 = (1 <<11 );else buf1 =0 ; - maxp =max_packet (maxp); - multi =hb_mult (maxp); + multi =usb_endpoint_maxp_mult (&ep->desc); buf1 |= maxp; maxp *= multi;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 88/260 usb: host: fotg210: fix the actual_length of an iso packet
In reply to Greg Kroah-HartmanFrom: Kelly Devilliv <[email protected]>
[ Upstream commit 091cb2f782f32ab68c6f5f326d7868683d3d4875 ]
We should acquire the actual_length of an iso packet from the iTD directly using FOTG210_ITD_LENGTH() macro.
--- drivers/usb/host/fotg210-hcd.c | 5 ++--- drivers/usb/host/fotg210.h | 5 ----- 2 files changed, 2 insertions(+), 8 deletions(-)
drivers/usb/host/fotg210-hcd.c +2 -3
@@ -4461,13 +4461,12 @@ static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd)/* HC need not update length with this error */ if (!(t &FOTG210_ISOC_BABBLE )) { - desc->actual_length = -fotg210_itdlen (urb, desc, t); + desc->actual_length =FOTG210_ITD_LENGTH (t); urb->actual_length += desc->actual_length; } }else if (likely ((t &FOTG210_ISOC_ACTIVE ) ==0 )) { desc->status =0 ; - desc->actual_length =fotg210_itdlen (urb, desc, t); + desc->actual_length =FOTG210_ITD_LENGTH (t); urb->actual_length += desc->actual_length; }else {/* URB was too late */
drivers/usb/host/fotg210.h +0 -5
@@ -686,11 +686,6 @@ static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210) return fotg210_readl(fotg210, &fotg210->regs->frame_index); } -#define fotg210_itdlen (urb, desc, t) ({ \ - usb_pipein((urb)->pipe) ? \ - (desc)->length - FOTG210_ITD_LENGTH(t) : \ - FOTG210_ITD_LENGTH(t); \ -})/*-------------------------------------------------------------------------*/ #endif /* __LINUX_FOTG210_H */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 89/260 usb: gadget: u_ether: fix a potential null pointer dereference
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
[ Upstream commit 8ae01239609b29ec2eff55967c8e0fe3650cfa09 ]
f_ncm tx timeout can call us with null skb to flush a pending frame. In this case skb is NULL to begin with but ceases to be null after dev->wrap() completes.
In such a case in->maxpacket will be read, even though we've failed to check that 'in' is not NULL.
Though I've never observed this fail in practice, however the 'flush operation' simply does not make sense with a null usb IN endpoint - there's nowhere to flush to... (note that we're the gadget/device, and IN is from the point
of view of the host, so here IN actually means outbound...)
--- drivers/usb/gadget/function/u_ether.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/u_ether.c +3 -2
@@ -491,8 +491,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, }spin_unlock_irqrestore (&dev->lock, flags); -if (skb && !in) { -dev_kfree_skb_any (skb); +if (!in) { +if (skb) +dev_kfree_skb_any (skb);return NETDEV_TX_OK ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 90/260 USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 61136a12cbed234374ec6f588af57c580b20b772 ]
mv_ehci_enable() did not disable and unprepare clocks in case of failures of phy_init(). Besides, it did not take into account failures of ehci_clock_enable() (in effect, failures of clk_prepare_enable()). The patch fixes both issues and gets rid of redundant wrappers around clk_prepare_enable() and clk_disable_unprepare() to simplify this a bit.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/host/ehci-mv.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
drivers/usb/host/ehci-mv.c +11 -12
@@ -41,26 +41,25 @@ struct ehci_hcd_mv {int (*set_vbus)(unsigned int vbus); }; -static void ehci_clock_enable (struct ehci_hcd_mv *ehci_mv) +static int mv_ehci_enable (struct ehci_hcd_mv *ehci_mv) { -clk_prepare_enable (ehci_mv->clk); -} +int retval; -static void ehci_clock_disable (struct ehci_hcd_mv *ehci_mv) -{ -clk_disable_unprepare (ehci_mv->clk); -} + retval =clk_prepare_enable (ehci_mv->clk); +if (retval) +return retval; -static int mv_ehci_enable (struct ehci_hcd_mv *ehci_mv) -{ -ehci_clock_enable (ehci_mv); -return phy_init (ehci_mv->phy); + retval =phy_init (ehci_mv->phy); +if (retval) +clk_disable_unprepare (ehci_mv->clk); + +return retval; }static void mv_ehci_disable (struct ehci_hcd_mv *ehci_mv) {phy_exit (ehci_mv->phy); -ehci_clock_disable (ehci_mv); +clk_disable_unprepare (ehci_mv->clk); }static int mv_ehci_reset (struct usb_hcd *hcd)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 91/260 usb: gadget: composite: Allow bMaxPower=0 if self-powered
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
[ Upstream commit bcacbf06c891374e7fdd7b72d11cda03b0269b43 ]
Currently the composite driver encodes the MaxPower field of the configuration descriptor by reading the c->MaxPower of the usb_configuration only if it is non-zero, otherwise it falls back to using the value hard-coded in CONFIG_USB_GADGET_VBUS_DRAW. However, there are cases when a configuration must explicitly set bMaxPower to 0, particularly if its bmAttributes also has the Self-Powered bit set, which is a valid combination.
This is specifically called out in the USB PD specification section 9.1, in which a PDUSB device "shall report zero in the bMaxPower field after negotiating a mutually agreeable Contract", and also verified by the USB Type-C Functional Test TD.4.10.2 Sink Power Precedence Test.
The fix allows the c->MaxPower to be used for encoding the bMaxPower even if it is 0, if the self-powered bit is also set. An example usage of this would be for a ConfigFS gadget to be dynamically updated by userspace when the Type-C connection is determined to be operating in Power Delivery mode.
--- drivers/usb/gadget/composite.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/gadget/composite.c +6 -2
@@ -481,7 +481,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed, {unsigned val; -if (c->MaxPower) +if (c->MaxPower || (c->bmAttributes &USB_CONFIG_ATT_SELFPOWER )) val = c->MaxPower;else val =CONFIG_USB_GADGET_VBUS_DRAW ;
@@ -905,7 +905,11 @@ static int set_config(struct usb_composite_dev *cdev, }/* when we return, be sure our power usage is valid */ - power = c->MaxPower ? c->MaxPower :CONFIG_USB_GADGET_VBUS_DRAW ; +if (c->MaxPower || (c->bmAttributes &USB_CONFIG_ATT_SELFPOWER )) + power = c->MaxPower; +else + power =CONFIG_USB_GADGET_VBUS_DRAW ; +if (gadget->speed <USB_SPEED_SUPER ) power =min (power,500U );else
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 92/260 staging: board: Fix uninitialized spinlock when attaching genpd
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit df00609821bf17f50a75a446266d19adb8339d84 ]
On Armadillo-800-EVA with CONFIG_DEBUG_SPINLOCK=y:
BUG: spinlock bad magic on CPU#0, swapper/1
lock: lcdc0_device+0x10c/0x308, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
CPU: 0 PID: 1 Comm: swapper Not tainted 5.11.0-rc5-armadillo-00036-gbbca04be7a80-dirty #287
Hardware name: Generic R8A7740 (Flattened Device Tree)
[<c010c3c8>] (unwind_backtrace) from [<c010a49c>] (show_stack+0x10/0x14)
[<c010a49c>] (show_stack) from [<c0159534>] (do_raw_spin_lock+0x20/0x94)
[<c0159534>] (do_raw_spin_lock) from [<c040858c>] (dev_pm_get_subsys_data+0x8c/0x11c)
[<c040858c>] (dev_pm_get_subsys_data) from [<c05fbcac>] (genpd_add_device+0x78/0x2b8)
[<c05fbcac>] (genpd_add_device) from [<c0412db4>] (of_genpd_add_device+0x34/0x4c)
[<c0412db4>] (of_genpd_add_device) from [<c0a1ea74>] (board_staging_register_device+0x11c/0x148)
[<c0a1ea74>] (board_staging_register_device) from [<c0a1eac4>] (board_staging_register_devices+0x24/0x28)of_genpd_add_device() is called before platform_device_register(), as it needs to attach the genpd before the device is probed. But the spinlock is only initialized when the device is registered.
Fix this by open-coding the spinlock initialization, cfr. device_pm_init_common() in the internal drivers/base code, and in the SuperH early platform code.
--- drivers/staging/board/board.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/staging/board/board.c +6 -1
@@ -136,6 +136,7 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc)static int board_staging_add_dev_domain (struct platform_device *pdev,const char *domain) { +struct device *dev = &pdev->dev;struct of_phandle_args pd_args;struct device_node *np;
@@ -148,7 +149,11 @@ static int board_staging_add_dev_domain(struct platform_device *pdev, pd_args.np = np; pd_args.args_count =0 ; -return of_genpd_add_device (&pd_args, &pdev->dev); +/* Initialization similar to device_pm_init_common() */ +spin_lock_init (&dev->power.lock); + dev->power.early_init = true; + +return of_genpd_add_device (&pd_args, dev); }#else static inline int board_staging_add_dev_domain(struct platform_device *pdev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 93/260 tty: serial: jsm: hold port lock when reporting modem line changes
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 240e126c28df084222f0b661321e8e3ecb0d232e ]
uart_handle_dcd_change() requires a port lock to be held and will emit a warning when lockdep is enabled.
Held corresponding lock to fix the following warnings.
[ 132.528648] WARNING: CPU: 5 PID: 11600 at drivers/tty/serial/serial_core.c:3046 uart_handle_dcd_change+0xf4/0x120 [ 132.530482] Modules linked in: [ 132.531050] CPU: 5 PID: 11600 Comm: jsm Not tainted 5.14.0-rc1-00003-g7fef2edf7cc7-dirty #31 [ 132.535268] RIP: 0010:uart_handle_dcd_change+0xf4/0x120 [ 132.557100] Call Trace: [ 132.557562] ? __free_pages+0x83/0xb0 [ 132.558213] neo_parse_modem+0x156/0x220 [ 132.558897] neo_param+0x399/0x840 [ 132.559495] jsm_tty_open+0x12f/0x2d0 [ 132.560131] uart_startup.part.18+0x153/0x340 [ 132.560888] ? lock_is_held_type+0xe9/0x140 [ 132.561660] uart_port_activate+0x7f/0xe0 [ 132.562351] ? uart_startup.part.18+0x340/0x340 [ 132.563003] tty_port_open+0x8d/0xf0 [ 132.563523] ? uart_set_options+0x1e0/0x1e0 [ 132.564125] uart_open+0x24/0x40 [ 132.564604] tty_open+0x15c/0x630
--- drivers/tty/serial/jsm/jsm_neo.c | 2 ++ drivers/tty/serial/jsm/jsm_tty.c | 3 +++ 2 files changed, 5 insertions(+)
drivers/tty/serial/jsm/jsm_neo.c +2 -0
@@ -815,7 +815,9 @@ static void neo_parse_isr(struct jsm_board *brd, u32 port)/* Parse any modem signal changes */ jsm_dbg (INTR , &ch->ch_bd->pci_dev,"MOD_STAT: sending to parse_modem_sigs\n" ); +spin_lock_irqsave (&ch->uart_port.lock, lock_flags);neo_parse_modem (ch,readb (&ch->ch_neo_uart->msr)); +spin_unlock_irqrestore (&ch->uart_port.lock, lock_flags); } }
drivers/tty/serial/jsm/jsm_tty.c +3 -0
@@ -187,6 +187,7 @@ static void jsm_tty_break(struct uart_port *port, int break_state)static int jsm_tty_open (struct uart_port *port) { +unsigned long lock_flags;struct jsm_board *brd;struct jsm_channel *channel = container_of(port, struct jsm_channel, uart_port);
@@ -240,6 +241,7 @@ static int jsm_tty_open(struct uart_port *port) channel->ch_cached_lsr =0 ; channel->ch_stops_sent =0 ; +spin_lock_irqsave (&port->lock, lock_flags); termios = &port->state->port.tty->termios; channel->ch_c_cflag = termios->c_cflag; channel->ch_c_iflag = termios->c_iflag;
@@ -259,6 +261,7 @@ static int jsm_tty_open(struct uart_port *port)jsm_carrier (channel); channel->ch_open_count++; +spin_unlock_irqrestore (&port->lock, lock_flags);jsm_dbg (OPEN , &channel->ch_bd->pci_dev,"finish\n" );return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 94/260 drm/amd/display: Fix timer_per_pixel unit error
In reply to Greg Kroah-HartmanFrom: Oliver Logush <[email protected]>
[ Upstream commit 23e55639b87fb16a9f0f66032ecb57060df6c46c ]
[why]
The units of the time_per_pixel variable were incorrect, this had to be changed for the code to properly function.
[how]
The change was very straightforward, only required one line of code to be changed where the calculation was done.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +1 -1
@@ -2232,7 +2232,7 @@ void dcn20_set_mcif_arb_params( wb_arb_params->cli_watermark[k] =get_wm_writeback_urgent (&context->bw_ctx.dml, pipes, pipe_cnt) *1000 ; wb_arb_params->pstate_watermark[k] =get_wm_writeback_dram_clock_change (&context->bw_ctx.dml, pipes, pipe_cnt) *1000 ; } - wb_arb_params->time_per_pixel =16.0 / context->res_ctx.pipe_ctx[i].stream->phy_pix_clk;/* 4 bit fraction, ms */ + wb_arb_params->time_per_pixel =16.0 *1000 / (context->res_ctx.pipe_ctx[i].stream->phy_pix_clk /1000 );/* 4 bit fraction, ms */ wb_arb_params->slice_lines =32 ; wb_arb_params->arbitration_slice =2 ; wb_arb_params->max_scaled_time = dcn20_calc_max_scaled_time(wb_arb_params->time_per_pixel,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 95/260 drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex
In reply to Greg Kroah-HartmanFrom: Anson Jacob <[email protected]>
[ Upstream commit 1a394b3c3de2577f200cb623c52a5c2b82805cec ]
link_rate is updated via debugfs using hex values, set it to output in hex as well.
eg: Resolution: 1920x1080@144Hz
cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current: 4 0x14 0 Verified: 4 0x1e 0 Reported: 4 0x1e 16 Preferred: 0 0x0 0
echo "4 0x1e" > /sys/kernel/debug/dri/0/DP-1/link_settings
cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current: 4 0x1e 0 Verified: 4 0x1e 0 Reported: 4 0x1e 16 Preferred: 4 0x1e 0
--- .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +8 -8
@@ -95,29 +95,29 @@ static ssize_t dp_link_settings_read(struct file *f, char __user *buf, rd_buf_ptr = rd_buf; - str_len =strlen ("Current: %d %d %d " ); -snprintf (rd_buf_ptr, str_len,"Current: %d %d %d " , + str_len =strlen ("Current: %d 0x%x %d " ); +snprintf (rd_buf_ptr, str_len,"Current: %d 0x%x %d " , link->cur_link_settings.lane_count, link->cur_link_settings.link_rate, link->cur_link_settings.link_spread); rd_buf_ptr += str_len; - str_len =strlen ("Verified: %d %d %d " ); -snprintf (rd_buf_ptr, str_len,"Verified: %d %d %d " , + str_len =strlen ("Verified: %d 0x%x %d " ); +snprintf (rd_buf_ptr, str_len,"Verified: %d 0x%x %d " , link->verified_link_cap.lane_count, link->verified_link_cap.link_rate, link->verified_link_cap.link_spread); rd_buf_ptr += str_len; - str_len =strlen ("Reported: %d %d %d " ); -snprintf (rd_buf_ptr, str_len,"Reported: %d %d %d " , + str_len =strlen ("Reported: %d 0x%x %d " ); +snprintf (rd_buf_ptr, str_len,"Reported: %d 0x%x %d " , link->reported_link_cap.lane_count, link->reported_link_cap.link_rate, link->reported_link_cap.link_spread); rd_buf_ptr += str_len; - str_len =strlen ("Preferred: %d %d %d " ); -snprintf (rd_buf_ptr, str_len,"Preferred: %d %d %d\n" , + str_len =strlen ("Preferred: %d 0x%x %d " ); +snprintf (rd_buf_ptr, str_len,"Preferred: %d 0x%x %d\n" , link->preferred_link_setting.lane_count, link->preferred_link_setting.link_rate, link->preferred_link_setting.link_spread);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 96/260 bpf/tests: Fix copy-and-paste error in double word test
In reply to Greg Kroah-HartmanFrom: Johan Almbladh <[email protected]>
[ Upstream commit ae7f47041d928b1a2f28717d095b4153c63cbf6a ]
This test now operates on DW as stated instead of W, which was already covered by another test.
--- lib/test_bpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/test_bpf.c +2 -2
@@ -4286,8 +4286,8 @@ static struct bpf_test tests[] = { .u.insns_int = {BPF_LD_IMM64 (R0 ,0 ),BPF_LD_IMM64 (R1 ,0xffffffffffffffffLL ), -BPF_STX_MEM (BPF_W ,R10 ,R1 ,-40 ), -BPF_LDX_MEM (BPF_W ,R0 ,R10 ,-40 ), +BPF_STX_MEM (BPF_DW ,R10 ,R1 ,-40 ), +BPF_LDX_MEM (BPF_DW ,R0 ,R10 ,-40 ),BPF_EXIT_INSN (), }, INTERNAL,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 97/260 bpf/tests: Do not PASS tests without actually testing the result
In reply to Greg Kroah-HartmanFrom: Johan Almbladh <[email protected]>
[ Upstream commit 2b7e9f25e590726cca76700ebdb10e92a7a72ca1 ]
Each test case can have a set of sub-tests, where each sub-test can run the cBPF/eBPF test snippet with its own data_size and expected result. Before, the end of the sub-test array was indicated by both data_size and result being zero. However, most or all of the internal eBPF tests has a data_size of zero already. When such a test also had an expected value of zero, the test was never run but reported as PASS anyway.
Now the test runner always runs the first sub-test, regardless of the data_size and result values. The sub-test array zero-termination only applies for any additional sub-tests.
There are other ways fix it of course, but this solution at least removes the surprise of eBPF tests with a zero result always succeeding.
--- lib/test_bpf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
lib/test_bpf.c +8 -1
@@ -6684,7 +6684,14 @@ static int run_one(const struct bpf_prog *fp, struct bpf_test *test)u64 duration;u32 ret; -if (test->test[i].data_size ==0 && +/* +* NOTE: Several sub-tests may be present, in which case +* a zero {data_size, result} tuple indicates the end of +* the sub-test array. The first test is always run, +* even if both data_size and result happen to be zero. +*/ +if (i >0 && + test->test[i].data_size ==0 && test->test[i].result ==0 )break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 98/260 video: fbdev: asiliantfb: Error out if pixclock equals zero
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit b36b242d4b8ea178f7fd038965e3cac7f30c3f09 ]
The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of 'pixclock', it may cause divide error.
Fix this by checking whether 'pixclock' is zero first.
The following log reveals it:
[ 43.861711] divide error: 0000 [#1] PREEMPT SMP KASAN PTI [ 43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #224 [ 43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730 [ 43.861843] Call Trace: [ 43.861848] ? asiliantfb_remove+0x190/0x190 [ 43.861858] fb_set_var+0x2e4/0xeb0 [ 43.861866] ? fb_blank+0x1a0/0x1a0 [ 43.861873] ? lock_acquire+0x1ef/0x530 [ 43.861884] ? lock_release+0x810/0x810 [ 43.861892] ? lock_is_held_type+0x100/0x140 [ 43.861903] ? ___might_sleep+0x1ee/0x2d0 [ 43.861914] ? __mutex_lock+0x620/0x1190 [ 43.861921] ? do_fb_ioctl+0x313/0x700 [ 43.861929] ? mutex_lock_io_nested+0xfa0/0xfa0 [ 43.861936] ? __this_cpu_preempt_check+0x1d/0x30 [ 43.861944] ? _raw_spin_unlock_irqrestore+0x46/0x60 [ 43.861952] ? lockdep_hardirqs_on+0x59/0x100 [ 43.861959] ? _raw_spin_unlock_irqrestore+0x46/0x60 [ 43.861967] ? trace_hardirqs_on+0x6a/0x1c0 [ 43.861978] do_fb_ioctl+0x31e/0x700
--- drivers/video/fbdev/asiliantfb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/asiliantfb.c +3 -0
@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var, {unsigned long Ftarget, ratio, remainder; +if (!var->pixclock) +return -EINVAL ; + ratio =1000000 / var->pixclock; remainder =1000000 % var->pixclock; Ftarget =1000000 * ratio + (1000000 * remainder) / var->pixclock;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 99/260 video: fbdev: kyro: Error out if pixclock equals zero
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 1520b4b7ba964f8eec2e7dd14c571d50de3e5191 ]
The userspace program could pass any values to the driver through ioctl() interface. if the driver doesn't check the value of 'pixclock', it may cause divide error because the value of 'lineclock' and 'frameclock' will be zero.
Fix this by checking whether 'pixclock' is zero in kyrofb_check_var().
The following log reveals it:
[ 103.073930] divide error: 0000 [#1] PREEMPT SMP KASAN PTI [ 103.073942] CPU: 4 PID: 12483 Comm: syz-executor Not tainted 5.14.0-rc2-00478-g2734d6c1b1a0-dirty #118 [ 103.073959] RIP: 0010:kyrofb_set_par+0x316/0xc80 [ 103.074045] Call Trace: [ 103.074048] ? ___might_sleep+0x1ee/0x2d0 [ 103.074060] ? kyrofb_ioctl+0x330/0x330 [ 103.074069] fb_set_var+0x5bf/0xeb0 [ 103.074078] ? fb_blank+0x1a0/0x1a0 [ 103.074085] ? lock_acquire+0x3bd/0x530 [ 103.074094] ? lock_release+0x810/0x810 [ 103.074103] ? ___might_sleep+0x1ee/0x2d0 [ 103.074114] ? __mutex_lock+0x620/0x1190 [ 103.074126] ? trace_hardirqs_on+0x6a/0x1c0 [ 103.074137] do_fb_ioctl+0x31e/0x700 [ 103.074144] ? fb_getput_cmap+0x280/0x280 [ 103.074152] ? rcu_read_lock_sched_held+0x11/0x80 [ 103.074162] ? rcu_read_lock_sched_held+0x11/0x80 [ 103.074171] ? __sanitizer_cov_trace_switch+0x67/0xf0 [ 103.074181] ? __sanitizer_cov_trace_const_cmp2+0x20/0x80 [ 103.074191] ? do_vfs_ioctl+0x14b/0x16c0 [ 103.074199] ? vfs_fileattr_set+0xb60/0xb60 [ 103.074207] ? rcu_read_lock_sched_held+0x11/0x80 [ 103.074216] ? lock_release+0x483/0x810 [ 103.074224] ? __fget_files+0x217/0x3d0 [ 103.074234] ? __fget_files+0x239/0x3d0 [ 103.074243] ? do_fb_ioctl+0x700/0x700 [ 103.074250] fb_ioctl+0xe6/0x130
--- drivers/video/fbdev/kyro/fbdev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/kyro/fbdev.c +3 -0
@@ -399,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) {struct kyrofb_info *par = info->par; +if (!var->pixclock) +return -EINVAL ; +if (var->bits_per_pixel !=16 && var->bits_per_pixel !=32 ) {printk (KERN_WARNING "kyrofb: depth not supported: %u\n" , var->bits_per_pixel);return -EINVAL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 100/260 video: fbdev: riva: Error out if pixclock equals zero
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit f92763cb0feba247e0939ed137b495601fd072a5 ]
The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of 'pixclock', it may cause divide error.
Fix this by checking whether 'pixclock' is zero first.
The following log reveals it:
[ 33.396850] divide error: 0000 [#1] PREEMPT SMP KASAN PTI [ 33.396864] CPU: 5 PID: 11754 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #222 [ 33.396883] RIP: 0010:riva_load_video_mode+0x417/0xf70 [ 33.396969] Call Trace: [ 33.396973] ? debug_smp_processor_id+0x1c/0x20 [ 33.396984] ? tick_nohz_tick_stopped+0x1a/0x90 [ 33.396996] ? rivafb_copyarea+0x3c0/0x3c0 [ 33.397003] ? wake_up_klogd.part.0+0x99/0xd0 [ 33.397014] ? vprintk_emit+0x110/0x4b0 [ 33.397024] ? vprintk_default+0x26/0x30 [ 33.397033] ? vprintk+0x9c/0x1f0 [ 33.397041] ? printk+0xba/0xed [ 33.397054] ? record_print_text.cold+0x16/0x16 [ 33.397063] ? __kasan_check_read+0x11/0x20 [ 33.397074] ? profile_tick+0xc0/0x100 [ 33.397084] ? __sanitizer_cov_trace_const_cmp4+0x24/0x80 [ 33.397094] ? riva_set_rop_solid+0x2a0/0x2a0 [ 33.397102] rivafb_set_par+0xbe/0x610 [ 33.397111] ? riva_set_rop_solid+0x2a0/0x2a0 [ 33.397119] fb_set_var+0x5bf/0xeb0 [ 33.397127] ? fb_blank+0x1a0/0x1a0 [ 33.397134] ? lock_acquire+0x1ef/0x530 [ 33.397143] ? lock_release+0x810/0x810 [ 33.397151] ? lock_is_held_type+0x100/0x140 [ 33.397159] ? ___might_sleep+0x1ee/0x2d0 [ 33.397170] ? __mutex_lock+0x620/0x1190 [ 33.397180] ? trace_hardirqs_on+0x6a/0x1c0 [ 33.397190] do_fb_ioctl+0x31e/0x700
--- drivers/video/fbdev/riva/fbdev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/riva/fbdev.c +3 -0
@@ -1088,6 +1088,9 @@ static int rivafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)int mode_valid =0 ;NVTRACE_ENTER (); +if (!var->pixclock) +return -EINVAL ; +switch (var->bits_per_pixel) { case 1 ... 8: var->red.offset = var->green.offset = var->blue.offset =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 101/260 ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 6321c7acb82872ef6576c520b0e178eaad3a25c0 ]
Fix the following out-of-bounds warning:
In function 'ip_copy_addrs',
inlined from '__ip_queue_xmit' at net/ipv4/ip_output.c:517:2:net/ipv4/ip_output.c:449:2: warning: 'memcpy' offset [40, 43] from the object at 'fl' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 36 [-Warray-bounds]
449 | memcpy(&iph->saddr, &fl4->saddr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
450 | sizeof(fl4->saddr) + sizeof(fl4->daddr));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~The problem is that the original code is trying to copy data into a couple of struct members adjacent to each other in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &iph->saddr and &fl4->saddr. As these are just a couple of struct members, fix this by using direct assignments, instead of memcpy().
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- net/ipv4/ip_output.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ipv4/ip_output.c +3 -2
@@ -446,8 +446,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4) { BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) != offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr)); -memcpy (&iph->saddr, &fl4->saddr, -sizeof (fl4->saddr) +sizeof (fl4->daddr)); + + iph->saddr = fl4->saddr; + iph->daddr = fl4->daddr; }/* Note: skb->sk can be different from sk, in case of tunnels */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 102/260 flow_dissector: Fix out-of-bounds warnings
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 323e0cb473e2a8706ff162b6b4f4fa16023c9ba7 ]
Fix the following out-of-bounds warnings:
net/core/flow_dissector.c: In function '__skb_flow_dissect':
Quoted 1 line
Quoted 1 line
net/core/flow_dissector.c:1104:4: warning: 'memcpy' offset [24, 39] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'structin6_addr' at offset 8 [-Warray-bounds]
1104 | memcpy(&key_addrs->v6addrs, &iph->saddr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1105 | sizeof(key_addrs->v6addrs));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/ipv6.h:5,
from net/core/flow_dissector.c:6:
include/uapi/linux/ipv6.h:133:18: note: subobject 'saddr' declared here
133 | struct in6_addr saddr;
| ^~~~~
Quoted 1 line
Quoted 1 line
net/core/flow_dissector.c:1059:4: warning: 'memcpy' offset [16, 19] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 12 [-Warray-bounds]
1059 | memcpy(&key_addrs->v4addrs, &iph->saddr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1060 | sizeof(key_addrs->v4addrs));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/ip.h:17,
from net/core/flow_dissector.c:5:
include/uapi/linux/ip.h:103:9: note: subobject 'saddr' declared here
103 | __be32 saddr;
| ^~~~~
The problem is that the original code is trying to copy data into a couple of struct members adjacent to each other in a single call to memcpy(). So, the compiler legitimately complains about it. As these are just a couple of members, fix this by copying each one of them in separate calls to memcpy().
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- net/core/flow_dissector.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/core/flow_dissector.c +8 -4
@@ -1025,8 +1025,10 @@ bool __skb_flow_dissect(const struct net *net,FLOW_DISSECTOR_KEY_IPV4_ADDRS , target_container); -memcpy (&key_addrs->v4addrs, &iph->saddr, -sizeof (key_addrs->v4addrs)); +memcpy (&key_addrs->v4addrs.src, &iph->saddr, +sizeof (key_addrs->v4addrs.src)); +memcpy (&key_addrs->v4addrs.dst, &iph->daddr, +sizeof (key_addrs->v4addrs.dst)); key_control->addr_type =FLOW_DISSECTOR_KEY_IPV4_ADDRS ; }
@@ -1070,8 +1072,10 @@ bool __skb_flow_dissect(const struct net *net,FLOW_DISSECTOR_KEY_IPV6_ADDRS , target_container); -memcpy (&key_addrs->v6addrs, &iph->saddr, -sizeof (key_addrs->v6addrs)); +memcpy (&key_addrs->v6addrs.src, &iph->saddr, +sizeof (key_addrs->v6addrs.src)); +memcpy (&key_addrs->v6addrs.dst, &iph->daddr, +sizeof (key_addrs->v6addrs.dst)); key_control->addr_type =FLOW_DISSECTOR_KEY_IPV6_ADDRS ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 103/260 s390/jump_label: print real address in a case of a jump label bug
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit 5492886c14744d239e87f1b0b774b5a341e755cc ]
In case of a jump label print the real address of the piece of code where a mismatch was detected. This is right before the system panics, so there is nothing revealed.
--- arch/s390/kernel/jump_label.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/jump_label.c +1 -1
@@ -36,7 +36,7 @@ static void jump_label_bug(struct jump_entry *entry, struct insn *expected,unsigned char *ipe = (unsigned char *)expected;unsigned char *ipn = (unsigned char *)new; -pr_emerg ("Jump label code mismatch at %pS [%p]\n" , ipc, ipc); +pr_emerg ("Jump label code mismatch at %pS [%px]\n" , ipc, ipc);pr_emerg ("Found: %6ph\n" , ipc);pr_emerg ("Expected: %6ph\n" , ipe);pr_emerg ("New: %6ph\n" , ipn);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 104/260 s390: make PCI mio support a machine flag
In reply to Greg Kroah-HartmanFrom: Niklas Schnelle <[email protected]>
[ Upstream commit 3322ba0d7bea1e24ae464418626f6a15b69533ab ]
Kernel support for the newer PCI mio instructions can be toggled off with the pci=nomio command line option which needs to integrate with common code PCI option parsing. However this option then toggles static branches which can't be toggled yet in an early_param() call.
Thus commit 9964f396f1d0 ("s390: fix setting of mio addressing control") moved toggling the static branches to the PCI init routine.
With this setup however we can't check for mio support outside the PCI code during early boot, i.e. before switching the static branches, which we need to be able to export this as an ELF HWCAP.
Improve on this by turning mio availability into a machine flag that gets initially set based on CONFIG_PCI and the facility bit and gets toggled off if pci=nomio is found during PCI option parsing allowing simple access to this machine flag after early init.
--- arch/s390/include/asm/setup.h | 2 ++ arch/s390/kernel/early.c | 4 ++++ arch/s390/pci/pci.c | 5 ++--- 3 files changed, 8 insertions(+), 3 deletions(-)
arch/s390/include/asm/setup.h +2 -0
@@ -39,6 +39,7 @@#define MACHINE_FLAG_NX BIT(15)#define MACHINE_FLAG_GS BIT(16)#define MACHINE_FLAG_SCC BIT(17) +#define MACHINE_FLAG_PCI_MIO BIT(18)#define LPP_MAGIC BIT(31)#define LPP_PID_MASK _AC(0xffffffff, UL)
@@ -106,6 +107,7 @@ extern unsigned long __swsusp_reset_dma;#define MACHINE_HAS_NX (S390_lowcore.machine_flags & MACHINE_FLAG_NX)#define MACHINE_HAS_GS (S390_lowcore.machine_flags & MACHINE_FLAG_GS)#define MACHINE_HAS_SCC (S390_lowcore.machine_flags & MACHINE_FLAG_SCC) +#define MACHINE_HAS_PCI_MIO (S390_lowcore.machine_flags & MACHINE_FLAG_PCI_MIO)/* * Console mode. Override with conmode=
arch/s390/kernel/early.c +4 -0
@@ -252,6 +252,10 @@ static __init void detect_machine_facilities(void) clock_comparator_max =-1ULL >>1 ;__ctl_set_bit (0 ,53 ); } +if (IS_ENABLED (CONFIG_PCI ) &&test_facility (153 )) { + S390_lowcore.machine_flags |=MACHINE_FLAG_PCI_MIO ; +/* the control bit is set during PCI initialization */ + } }static inline void save_vector_registers (void )
arch/s390/pci/pci.c +2 -3
@@ -854,7 +854,6 @@ static void zpci_mem_exit(void) }static unsigned int s390_pci_probe__initdata =1 ; -static unsigned int s390_pci_no_mio__initdata ;unsigned int s390_pci_force_floating__initdata ;static unsigned int s390_pci_initialized;
@@ -865,7 +864,7 @@ char * __init pcibios_setup(char *str)return NULL ; }if (!strcmp (str,"nomio" )) { - s390_pci_no_mio =1 ; + S390_lowcore.machine_flags &= ~MACHINE_FLAG_PCI_MIO ;return NULL ; }if (!strcmp (str,"force_floating" )) {
@@ -890,7 +889,7 @@ static int __init pci_base_init(void)if (!test_facility (69 ) || !test_facility (71 ))return 0 ; -if (test_facility (153 ) && !s390_pci_no_mio) { +if (MACHINE_HAS_PCI_MIO ) {static_branch_enable (&have_mio);ctl_set_bit (2 ,5 ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 105/260 serial: 8250: Define RX trigger levels for OxSemi 950 devices
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
[ Upstream commit d7aff291d069c4418285f3c8ee27b0ff67ce5998 ]
Oxford Semiconductor 950 serial port devices have a 128-byte FIFO and in the enhanced (650) mode, which we select in `autoconfig_has_efr' with the ECB bit set in the EFR register, they support the receive interrupt trigger level selectable with FCR bits 7:6 from the set of 16, 32, 112,
120. This applies to the original OX16C950 discrete UART[1] as well as 950 cores embedded into more complex devices.
For these devices we set the default to 112, which sets an excessively high level of 112 or 7/8 of the FIFO capacity, unlike with other port types where we choose at most 1/2 of their respective FIFO capacities. Additionally we don't make the trigger level configurable. Consequently frequent input overruns happen with high bit rates where hardware flow control cannot be used (e.g. terminal applications) even with otherwise highly-performant systems.
Lower the default receive interrupt trigger level to 32 then, and make it configurable. Document the trigger levels along with other port types, including the set of 16, 32, 64, 112 for the transmit interrupt as well[2].
[1] "OX16C950 rev B High Performance UART with 128 byte FIFOs", Oxford Semiconductor, Inc., DS-0031, Sep 05, Table 10: "Receiver Trigger Levels", p. 22
[2] same, Table 9: "Transmit Interrupt Trigger Levels", p. 22
--- drivers/tty/serial/8250/8250_port.c | 3 ++- include/uapi/linux/serial_reg.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_port.c +2 -1
@@ -125,7 +125,8 @@ static const struct serial8250_config uart_config[] = { .name = "16C950/954", .fifo_size = 128, .tx_loadsz = 128, - .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10, + .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_01, + .rxtrig_bytes = {16, 32, 112, 120},/* UART_CAP_EFR breaks billionon CF bluetooth card. */ .flags = UART_CAP_FIFO | UART_CAP_SLEEP, },
include/uapi/linux/serial_reg.h +1 -0
@@ -62,6 +62,7 @@* ST16C654: 8 16 56 60 8 16 32 56 PORT_16654 * TI16C750: 1 16 32 56 xx xx xx xx PORT_16750 * TI16C752: 8 16 56 60 8 16 32 56 +* OX16C950: 16 32 112 120 16 32 64 112 PORT_16C950 * Tegra: 1 4 8 14 16 8 4 1 PORT_TEGRA */ #define UART_FCR_R_TRIG_00 0x00
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 106/260 xtensa: ISS: dont panic in rs_init
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
[ Upstream commit 23411c720052ad860b3e579ee4873511e367130a ]
While alloc_tty_driver failure in rs_init would mean we have much bigger problem, there is no reason to panic when tty_register_driver fails there. It can fail for various reasons.
So handle the failure gracefully. Actually handle them both while at it. This will make at least the console functional as it was enabled earlier by console_initcall in iss_console_init. Instead of shooting down the whole system.
We move tty_port_init() after alloc_tty_driver(), so that we don't need to destroy the port in case the latter function fails.
--- arch/xtensa/platforms/iss/console.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
arch/xtensa/platforms/iss/console.c +14 -3
@@ -168,9 +168,13 @@ static const struct tty_operations serial_ops = {int __init rs_init (void ) { -tty_port_init (&serial_port); +int ret; serial_driver =alloc_tty_driver (SERIAL_MAX_NUM_LINES ); +if (!serial_driver) +return -ENOMEM ; + +tty_port_init (&serial_port);pr_info ("%s %s\n" , serial_name, serial_version);
@@ -190,8 +194,15 @@ int __init rs_init(void)tty_set_operations (serial_driver, &serial_ops);tty_port_link_device (&serial_port, serial_driver,0 ); -if (tty_register_driver (serial_driver)) -panic ("Couldn't register serial driver\n" ); + ret =tty_register_driver (serial_driver); +if (ret) { +pr_err ("Couldn't register serial driver\n" ); +tty_driver_kref_put (serial_driver); +tty_port_destroy (&serial_port); + +return ret; + } +return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 107/260 hvsi: dont panic on tty_register_driver failure
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
[ Upstream commit 7ccbdcc4d08a6d7041e4849219bbb12ffa45db4c ]
The alloc_tty_driver failure is handled gracefully in hvsi_init. But tty_register_driver is not. panic is called if that one fails.
So handle the failure of tty_register_driver gracefully too. This will keep at least the console functional as it was enabled earlier by console_initcall in hvsi_console_init. Instead of shooting down the whole system.
This means, we disable interrupts and restore hvsi_wait back to poll_for_state().
--- drivers/tty/hvc/hvsi.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/tty/hvc/hvsi.c +16 -3
@@ -1038,7 +1038,7 @@ static const struct tty_operations hvsi_ops = {static int __init hvsi_init (void ) { -int i; +int i, ret; hvsi_driver =alloc_tty_driver (hvsi_count);if (!hvsi_driver)
@@ -1069,12 +1069,25 @@ static int __init hvsi_init(void) } hvsi_wait = wait_for_state;/* irqs active now */ -if (tty_register_driver (hvsi_driver)) -panic ("Couldn't register hvsi console driver\n" ); + ret =tty_register_driver (hvsi_driver); +if (ret) { +pr_err ("Couldn't register hvsi console driver\n" ); + goto err_free_irq; + }printk (KERN_DEBUG "HVSI: registered %i devices\n" , hvsi_count);return 0 ; +err_free_irq: + hvsi_wait = poll_for_state; +for (i =0 ; i < hvsi_count; i++) { +struct hvsi_struct *hp = &hvsi_ports[i]; + +free_irq (hp->virq, hp); + } +tty_driver_kref_put (hvsi_driver); + +return ret; }device_initcall (hvsi_init);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 108/260 serial: 8250_pci: make setup_port() parameters explicitly unsigned
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 3a96e97ab4e835078e6f27b7e1c0947814df3841 ]
The bar and offset parameters to setup_port() are used in pointer math, and while it would be very difficult to get them to wrap as a negative number, just be "safe" and make them unsigned so that static checkers do not trip over them unintentionally.
--- drivers/tty/serial/8250/8250_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_pci.c +1 -1
@@ -89,7 +89,7 @@ static void moan_device(const char *str, struct pci_dev *dev)static int setup_port (struct serial_private *priv,struct uart_8250_port *port, -int bar,int offset,int regshift) +u8 bar,unsigned int offset,int regshift) {struct pci_dev *dev = priv->dev;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 109/260 staging: ks7010: Fix the initialization of the sleep_status structure
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 56315e55119c0ea57e142b6efb7c31208628ad86 ]
'sleep_status' has 3 atomic_t members. Initialize the 3 of them instead of initializing only 2 of them and setting 0 twice to the same variable.
--- drivers/staging/ks7010/ks7010_sdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/ks7010/ks7010_sdio.c +1 -1
@@ -938,9 +938,9 @@ static void ks7010_private_init(struct ks_wlan_private *priv,memset (&priv->wstats,0 ,sizeof (priv->wstats));/* sleep mode */ +atomic_set (&priv->sleepstatus.status,0 );atomic_set (&priv->sleepstatus.doze_request,0 );atomic_set (&priv->sleepstatus.wakeup_request,0 ); -atomic_set (&priv->sleepstatus.wakeup_request,0 );trx_device_init (priv);hostif_init (priv);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 110/260 samples: bpf: Fix tracex7 error raised on the missing argument
In reply to Greg Kroah-HartmanFrom: Juhee Kang <[email protected]>
[ Upstream commit 7d07006f05922b95518be403f08ef8437b67aa32 ]
The current behavior of 'tracex7' doesn't consist with other bpf samples tracex{1..6}. Other samples do not require any argument to run with, but tracex7 should be run with btrfs device argument. (it should be executed with test_override_return.sh)
Currently, tracex7 doesn't have any description about how to run this program and raises an unexpected error. And this result might be confusing since users might not have a hunch about how to run this program.
// Current behavior
# ./tracex7
sh: 1: Syntax error: word unexpected (expecting ")")
// Fixed behavior
# ./tracex7
ERROR: Run with the btrfs device argument!In order to fix this error, this commit adds logic to report a message and exit when running this program with a missing argument.
Additionally in test_override_return.sh, there is a problem with multiple directory(tmpmnt) creation. So in this commit adds a line with removing the directory with every execution.
--- samples/bpf/test_override_return.sh | 1 + samples/bpf/tracex7_user.c | 5 +++++ 2 files changed, 6 insertions(+)
samples/bpf/test_override_return.sh +1 -0
@@ -1,5 +1,6 @@ #!/bin/bash +rm -r tmpmnt rm -f testfile.img dd if=/dev/zero of=testfile.img bs=1M seek=1000 count=1 DEVICE=$(losetup --show -f testfile.img)
samples/bpf/tracex7_user.c +5 -0
@@ -13,6 +13,11 @@ int main(int argc, char **argv)char command[256 ];int ret; +if (!argv[1 ]) { +fprintf (stderr,"ERROR: Run with the btrfs device argument!\n" ); +return 0 ; + } +snprintf (filename,sizeof (filename),"%s_kern.o" , argv[0 ]);if (load_bpf_file (filename)) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 111/260 ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 3ad4a31620355358316fa08fcfab37b9d6c33347 ]
Last change to device managed APIs cleaned up error path to simple phy_exit() call, which in some cases has been executed with NULL parameter. This per se is not a problem, but rather logical misconception: no need to free resource when it's for sure has not been allocated yet. Fix the driver accordingly.
--- drivers/ata/sata_dwc_460ex.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/ata/sata_dwc_460ex.c +4 -8
@@ -1249,24 +1249,20 @@ static int sata_dwc_probe(struct platform_device *ofdev) irq =irq_of_parse_and_map (np,0 );if (irq ==NO_IRQ ) {dev_err (&ofdev->dev,"no SATA DMA irq\n" ); - err = -ENODEV ; - goto error_out; +return -ENODEV ; }#ifdef CONFIG_SATA_DWC_OLD_DMA if (!of_find_property (np,"dmas" ,NULL )) { err =sata_dwc_dma_init_old (ofdev, hsdev);if (err) - goto error_out; +return err; }#endif hsdev->phy =devm_phy_optional_get (hsdev->dev,"sata-phy" ); -if (IS_ERR (hsdev->phy)) { - err =PTR_ERR (hsdev->phy); - hsdev->phy =NULL ; - goto error_out; - } +if (IS_ERR (hsdev->phy)) +return PTR_ERR (hsdev->phy); err =phy_init (hsdev->phy);if (err)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 112/260 Bluetooth: skip invalid hci_sync_conn_complete_evt
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 92fe24a7db751b80925214ede43f8d2be792ea7b ]
Syzbot reported a corrupted list in kobject_add_internal [1]. This happens when multiple HCI_EV_SYNC_CONN_COMPLETE event packets with status 0 are sent for the same HCI connection. This causes us to register the device more than once which corrupts the kset list.
As this is forbidden behavior, we add a check for whether we're trying to process the same HCI_EV_SYNC_CONN_COMPLETE event multiple times for one connection. If that's the case, the event is invalid, so we report an error that the device is misbehaving, and ignore the packet.
--- net/bluetooth/hci_event.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
net/bluetooth/hci_event.c +15 -0
@@ -4202,6 +4202,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,switch (ev->status) {case 0x00 : +/* The synchronous connection complete event should only be +* sent once per new connection. Receiving a successful +* complete event when the connection status is already +* BT_CONNECTED means that the device is misbehaving and sent +* multiple complete event packets for the same new connection. +* +* Registering the device more than once can corrupt kernel +* memory, hence upon detecting this invalid event, we report +* an error and ignore the packet. +*/ +if (conn->state ==BT_CONNECTED ) { +bt_dev_err (hdev,"Ignoring connect complete event for existing connection" ); + goto unlock; + } + conn->handle =__le16_to_cpu (ev->handle); conn->state =BT_CONNECTED ; conn->type = ev->link_type;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 113/260 workqueue: Fix possible memory leaks in wq_numa_init()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit f728c4a9e8405caae69d4bc1232c54ff57b5d20f ]
In error handling branch "if (WARN_ON(node == NUMA_NO_NODE))", the previously allocated memories are not released. Doing this before allocating memory eliminates memory leaks.
tj: Note that the condition only occurs when the arch code is pretty broken and the WARN_ON might as well be BUG_ON().
--- kernel/workqueue.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
kernel/workqueue.c +7 -5
@@ -5869,6 +5869,13 @@ static void __init wq_numa_init(void)return ; } +for_each_possible_cpu (cpu) { +if (WARN_ON (cpu_to_node (cpu) ==NUMA_NO_NODE )) { +pr_warn ("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n" , cpu); +return ; + } + } + wq_update_unbound_numa_attrs_buf =alloc_workqueue_attrs ();BUG_ON (!wq_update_unbound_numa_attrs_buf);
@@ -5886,11 +5893,6 @@ static void __init wq_numa_init(void)for_each_possible_cpu (cpu) { node =cpu_to_node (cpu); -if (WARN_ON (node ==NUMA_NO_NODE )) { -pr_warn ("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n" , cpu); -/* happens iff arch is bonkers, let's just proceed */ -return ; - }cpumask_set_cpu (cpu, tbl[node]); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 114/260 bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()
In reply to Greg Kroah-HartmanFrom: Yufeng Mo <[email protected]>
[ Upstream commit 220ade77452c15ecb1ab94c3f8aaeb6d033c3582 ]
Some time ago, I reported a calltrace issue "did not find a suitable aggregator", please see[1]. After a period of analysis and reproduction, I find that this problem is caused by concurrency.
Before the problem occurs, the bond structure is like follows:
bond0 - slaver0(eth0) - agg0.lag_ports -> port0 - port1
\
port0
\
slaver1(eth1) - agg1.lag_ports -> NULL
\
port1If we run 'ifenslave bond0 -d eth1', the process is like below:
excuting __bond_release_one()
|
bond_upper_dev_unlink()[step1]
| | | | | bond_3ad_lacpdu_recv() | | ->bond_3ad_rx_indication() | | spin_lock_bh() | | ->ad_rx_machine() | | ->__record_pdu()[step2] | | spin_unlock_bh() | | | | bond_3ad_state_machine_handler() | spin_lock_bh() | ->ad_port_selection_logic() | ->try to find free aggregator[step3] | ->try to find suitable aggregator[step4] | ->did not find a suitable aggregator[step5] | spin_unlock_bh() | | | | bond_3ad_unbind_slave() |
spin_lock_bh()spin_unlock_bh()
step1: already removed slaver1(eth1) from list, but port1 remains
step2: receive a lacpdu and update port0
step3: port0 will be removed from agg0.lag_ports. The struct is
"agg0.lag_ports -> port1" now, and agg0 is not free. At the
same time, slaver1/agg1 has been removed from the list by step1. So we can't find a free aggregator now.
step4: can't find suitable aggregator because of step2
step5: cause a calltrace since port->aggregator is NULL
To solve this concurrency problem, put bond_upper_dev_unlink() after bond_3ad_unbind_slave(). In this way, we can invalid the port first and skip this port in bond_3ad_state_machine_handler(). This eliminates the situation that the slaver has been removed from the list but the port is still valid.
[1]https://lore.kernel.org/netdev/10374.1611947473@famine/
--- drivers/net/bonding/bond_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +2 -1
@@ -1926,7 +1926,6 @@ static int __bond_release_one(struct net_device *bond_dev,/* recompute stats just before removing the slave */ bond_get_stats (bond->dev, &bond->bond_stats); -bond_upper_dev_unlink (bond, slave);/* unregister rx_handler early so bond_handle_frame wouldn't be called * for this slave anymore. */
@@ -1935,6 +1934,8 @@ static int __bond_release_one(struct net_device *bond_dev,if (BOND_MODE (bond) ==BOND_MODE_8023AD )bond_3ad_unbind_slave (slave); +bond_upper_dev_unlink (bond, slave); +if (bond_mode_can_use_xmit_hash (bond))bond_update_slave_arr (bond, slave);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 115/260 arm64: tegra: Fix Tegra194 PCIe EP compatible string
In reply to Greg Kroah-HartmanFrom: Vidya Sagar <[email protected]>
[ Upstream commit bf2942a8b7c38e8cc2d5157b4f0323d7f4e5ec71 ]
The initialization sequence performed by the generic platform driver pcie-designware-plat.c for a DWC based implementation doesn't work for Tegra194. Tegra194 has a different initialization sequence requirement which can only be satisfied by the Tegra194 specific platform driver pcie-tegra194.c. So, remove the generic compatible string "snps,dw-pcie-ep" from Tegra194's endpoint controller nodes.
--- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/nvidia/tegra194.dtsi +3 -3
@@ -1434,7 +1434,7 @@ pcie@141a0000 { }; pcie_ep@14160000 { - compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; + compatible = "nvidia,tegra194-pcie-ep"; power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; reg = <0x00 0x14160000 0x0 0x00020000 /* appl registers (128K) */ 0x00 0x36040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */
@@ -1466,7 +1466,7 @@ pcie_ep@14160000 { }; pcie_ep@14180000 { - compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; + compatible = "nvidia,tegra194-pcie-ep"; power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */ 0x00 0x38040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */
@@ -1498,7 +1498,7 @@ pcie_ep@14180000 { }; pcie_ep@141a0000 { - compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; + compatible = "nvidia,tegra194-pcie-ep"; power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; reg = <0x00 0x141a0000 0x0 0x00020000 /* appl registers (128K) */ 0x00 0x3a040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 116/260 ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit dccd1dfd0770bfd494b68d1135b4547b2c602c42 ]
Move the "Platform Clock" routes for the "Internal Mic" and "Speaker" routes to the intmic_*_map[] / *_spk_map[] arrays.
This ensures that these "Platform Clock" routes do not get added when the BYT_RT5640_NO_INTERNAL_MIC_MAP / BYT_RT5640_NO_SPEAKERS quirks are used.
--- sound/soc/intel/boards/bytcr_rt5640.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/intel/boards/bytcr_rt5640.c +6 -3
@@ -284,9 +284,6 @@ static const struct snd_soc_dapm_widget byt_rt5640_widgets[] = {static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = { {"Headphone" ,NULL ,"Platform Clock" }, {"Headset Mic" ,NULL ,"Platform Clock" }, - {"Internal Mic" ,NULL ,"Platform Clock" }, - {"Speaker" ,NULL ,"Platform Clock" }, - {"Headset Mic" ,NULL ,"MICBIAS1" }, {"IN2P" ,NULL ,"Headset Mic" }, {"Headphone" ,NULL ,"HPOL" },
@@ -294,19 +291,23 @@ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = { };static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic1_map[] = { + {"Internal Mic" ,NULL ,"Platform Clock" }, {"DMIC1" ,NULL ,"Internal Mic" }, };static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic2_map[] = { + {"Internal Mic" ,NULL ,"Platform Clock" }, {"DMIC2" ,NULL ,"Internal Mic" }, };static const struct snd_soc_dapm_route byt_rt5640_intmic_in1_map[] = { + {"Internal Mic" ,NULL ,"Platform Clock" }, {"Internal Mic" ,NULL ,"MICBIAS1" }, {"IN1P" ,NULL ,"Internal Mic" }, };static const struct snd_soc_dapm_route byt_rt5640_intmic_in3_map[] = { + {"Internal Mic" ,NULL ,"Platform Clock" }, {"Internal Mic" ,NULL ,"MICBIAS1" }, {"IN3P" ,NULL ,"Internal Mic" }, };
@@ -348,6 +349,7 @@ static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif2_map[] = { };static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = { + {"Speaker" ,NULL ,"Platform Clock" }, {"Speaker" ,NULL ,"SPOLP" }, {"Speaker" ,NULL ,"SPOLN" }, {"Speaker" ,NULL ,"SPORP" },
@@ -355,6 +357,7 @@ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = { };static const struct snd_soc_dapm_route byt_rt5640_mono_spk_map[] = { + {"Speaker" ,NULL ,"Platform Clock" }, {"Speaker" ,NULL ,"SPOLP" }, {"Speaker" ,NULL ,"SPOLN" }, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 117/260 media: imx258: Rectify mismatch of VTS value
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit 51f93add3669f1b1f540de1cf397815afbd4c756 ]
The frame_length_lines (0x0340) registers are hard-coded as follows:
- 4208x3118
frame_length_lines = 0x0c50
- 2104x1560
frame_length_lines = 0x0638
- 1048x780
frame_length_lines = 0x034c
The driver exposes the V4L2_CID_VBLANK control in read-only mode and sets its value to vts_def - height, where vts_def is a mode-dependent value coming from the supported_modes array. It is set using one of the following macros defined in the driver:
#define IMX258_VTS_30FPS 0x0c98 #define IMX258_VTS_30FPS_2K 0x0638 #define IMX258_VTS_30FPS_VGA 0x034c
There's a clear mismatch in the value for the full resolution mode i.e. IMX258_VTS_30FPS. Fix it by rectifying the macro with the value set for the frame_length_lines register as stated above.
--- drivers/media/i2c/imx258.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/imx258.c +1 -1
@@ -22,7 +22,7 @@#define IMX258_CHIP_ID 0x0258/* V_TIMING internal */ -#define IMX258_VTS_30FPS 0x0c98 +#define IMX258_VTS_30FPS 0x0c50#define IMX258_VTS_30FPS_2K 0x0638#define IMX258_VTS_30FPS_VGA 0x034c#define IMX258_VTS_MAX 0xffff
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 118/260 media: imx258: Limit the max analogue gain to 480
In reply to Greg Kroah-HartmanFrom: Umang Jain <[email protected]>
[ Upstream commit f809665ee75fff3f4ea8907f406a66d380aeb184 ]
The range for analog gain mentioned in the datasheet is [0, 480]. The real gain formula mentioned in the datasheet is:
Gain = 512 / (512 – X)
Hence, values larger than 511 clearly makes no sense. The gain register field is also documented to be of 9-bits in the datasheet.
Certainly, it is enough to infer that, the kernel driver currently advertises an arbitrary analog gain max. Fix it by rectifying the value as per the data sheet i.e. 480.
--- drivers/media/i2c/imx258.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/imx258.c +1 -1
@@ -46,7 +46,7 @@/* Analog gain control */ #define IMX258_REG_ANALOG_GAIN 0x0204#define IMX258_ANA_GAIN_MIN 0 -#define IMX258_ANA_GAIN_MAX 0x1fff +#define IMX258_ANA_GAIN_MAX 480#define IMX258_ANA_GAIN_STEP 1#define IMX258_ANA_GAIN_DEFAULT 0x0
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 119/260 media: v4l2-dv-timings.c: fix wrong condition in two for-loops
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 4108b3e6db31acc4c68133290bbcc87d4db905c9 ]
These for-loops should test against v4l2_dv_timings_presets[i].bt.width, not if i < v4l2_dv_timings_presets[i].bt.width. Luckily nothing ever broke, since the smallest width is still a lot higher than the total number of presets, but it is wrong.
The last item in the presets array is all 0, so the for-loop must stop when it reaches that sentinel.
--- drivers/media/v4l2-core/v4l2-dv-timings.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/v4l2-core/v4l2-dv-timings.c +2 -2
@@ -196,7 +196,7 @@ bool v4l2_find_dv_timings_cap(struct v4l2_dv_timings *t,if (!v4l2_valid_dv_timings (t, cap, fnc, fnc_handle))return false; - for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) { + for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) { if (v4l2_valid_dv_timings(v4l2_dv_timings_presets + i, cap, fnc, fnc_handle) && v4l2_match_dv_timings(t, v4l2_dv_timings_presets + i,
@@ -218,7 +218,7 @@ bool v4l2_find_dv_timings_cea861_vic(struct v4l2_dv_timings *t, u8 vic) {unsigned int i; -for (i =0 ; i < v4l2_dv_timings_presets[i].bt.width; i++) { +for (i =0 ; v4l2_dv_timings_presets[i].bt.width; i++) {const struct v4l2_bt_timings *bt = &v4l2_dv_timings_presets[i].bt;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 120/260 media: TDA1997x: fix tda1997x_query_dv_timings() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Hałasa <[email protected]>
[ Upstream commit 7dee1030871a48d4f3c5a74227a4b4188463479a ]
Correctly propagate the tda1997x_detect_std error value.
--- drivers/media/i2c/tda1997x.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/i2c/tda1997x.c +3 -2
@@ -1695,14 +1695,15 @@ static int tda1997x_query_dv_timings(struct v4l2_subdev *sd, struct v4l2_dv_timings *timings) {struct tda1997x_state *state =to_state (sd); +int ret;v4l_dbg (1 , debug, state->client,"%s\n" , __func__);memset (timings,0 ,sizeof (struct v4l2_dv_timings ));mutex_lock (&state->lock); -tda1997x_detect_std (state, timings); + ret =tda1997x_detect_std (state, timings);mutex_unlock (&state->lock); -return 0 ; +return ret; }static const struct v4l2_subdev_video_ops tda1997x_video_ops = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 121/260 media: tegra-cec: Handle errors of clk_prepare_enable()
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 38367073c796a37a61549b1f66a71b3adb03802d ]
tegra_cec_probe() and tegra_cec_resume() ignored possible errors of clk_prepare_enable(). The patch fixes this.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/media/platform/tegra-cec/tegra_cec.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/media/platform/tegra-cec/tegra_cec.c +6 -4
@@ -366,7 +366,11 @@ static int tegra_cec_probe(struct platform_device *pdev)return -ENOENT ; } -clk_prepare_enable (cec->clk); + ret =clk_prepare_enable (cec->clk); +if (ret) { +dev_err (&pdev->dev,"Unable to prepare clock for CEC\n" ); +return ret; + }/* set context info. */ cec->dev = &pdev->dev;
@@ -446,9 +450,7 @@ static int tegra_cec_resume(struct platform_device *pdev)dev_notice (&pdev->dev,"Resuming\n" ); -clk_prepare_enable (cec->clk); - - return 0; + return clk_prepare_enable(cec->clk); }#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 122/260 ARM: dts: imx53-ppd: Fix ACHC entry
In reply to Greg Kroah-HartmanFrom: Sebastian Reichel <[email protected]>
[ Upstream commit cd7cd5b716d594e27a933c12f026d4f2426d7bf4 ]
PPD has only one ACHC device, which effectively is a Kinetis microcontroller. It has one SPI interface used for normal communication. Additionally it's possible to flash the device firmware using NXP's EzPort protocol by correctly driving a second chip select pin and the device reset pin.
--- arch/arm/boot/dts/imx53-ppd.dts | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
arch/arm/boot/dts/imx53-ppd.dts +13 -10
@@ -70,6 +70,12 @@ cko2_11M: sgtl-clock-cko2 { clock-frequency = <11289600>; }; + achc_24M: achc-clock { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <24000000>; + }; + sgtlsound: sound { compatible = "fsl,imx53-cpuvo-sgtl5000", "fsl,imx-audio-sgtl5000";
@@ -287,16 +293,13 @@ &gpio4 11 GPIO_ACTIVE_LOW &gpio4 12 GPIO_ACTIVE_LOW>; status = "okay"; - spidev0: spi@0 { - compatible = "ge,achc"; - reg = <0>; - spi-max-frequency = <1000000>; - }; - - spidev1: spi@1 { - compatible = "ge,achc"; - reg = <1>; - spi-max-frequency = <1000000>; + spidev0: spi@1 { + compatible = "ge,achc", "nxp,kinetis-k20"; + reg = <1>, <0>; + vdd-supply = <®_3v3>; + vdda-supply = <®_3v3>; + clocks = <&achc_24M>; + reset-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>; }; gpioxra0: gpio@2 {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 123/260 arm64: dts: qcom: sdm660: use reg value for memory node
In reply to Greg Kroah-HartmanFrom: Vinod Koul <[email protected]>
[ Upstream commit c81210e38966cfa1c784364e4035081c3227cf5b ]
memory node like other node should be node@reg, which is missing in this case, so fix it up
arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 1073741824, 0, 536870912]]}
--- arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/ipq8074-hk01.dts +1 -1
@@ -20,7 +20,7 @@ chosen { stdout-path = "serial0"; }; - memory { + memory@40000000 { device_type = "memory"; reg = <0x0 0x40000000 0x0 0x20000000>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 124/260 net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 4367355dd90942a71641c98c40c74589c9bddf90 ]
When compiling with clang in certain configurations, an objtool warning appears:
drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.o: warning: objtool:ipq806x_gmac_probe() falls through to next function phy_modes()
This happens because the unreachable annotation in the third switch statement is not eliminated. The compiler should know that the first default case would prevent the second and third from being reached as the comment notes but sanitizer options can make it harder for the compiler to reason this out.
Help the compiler out by eliminating the unreachable() annotation and unifying the default case error handling so that there is no objtool warning, the meaning of the code stays the same, and there is less duplication.
--- .../ethernet/stmicro/stmmac/dwmac-ipq806x.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +8 -10
@@ -288,10 +288,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) val &= ~NSS_COMMON_GMAC_CTL_PHY_IFACE_SEL ;break ;default : -dev_err (&pdev->dev,"Unsupported PHY mode: \"%s\"\n" , -phy_modes (gmac->phy_mode)); - err = -EINVAL ; - goto err_remove_config_dt; + goto err_unsupported_phy; }regmap_write (gmac->nss_common,NSS_COMMON_GMAC_CTL (gmac->id), val);
@@ -308,10 +305,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)NSS_COMMON_CLK_SRC_CTRL_OFFSET (gmac->id);break ;default : -dev_err (&pdev->dev,"Unsupported PHY mode: \"%s\"\n" , -phy_modes (gmac->phy_mode)); - err = -EINVAL ; - goto err_remove_config_dt; + goto err_unsupported_phy; }regmap_write (gmac->nss_common,NSS_COMMON_CLK_SRC_CTRL , val);
@@ -328,8 +322,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)NSS_COMMON_CLK_GATE_GMII_TX_EN (gmac->id);break ;default : -/* We don't get here; the switch above will have errored out */ -unreachable (); + goto err_unsupported_phy; }regmap_write (gmac->nss_common,NSS_COMMON_CLK_GATE , val);
@@ -360,6 +353,11 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)return 0 ; +err_unsupported_phy: +dev_err (&pdev->dev,"Unsupported PHY mode: \"%s\"\n" , +phy_modes (gmac->phy_mode)); + err = -EINVAL ; + err_remove_config_dt:stmmac_remove_config_dt (pdev, plat_dat);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 125/260 drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
[ Upstream commit 56bd931ae506730c9ab1e4cc4bfefa43fc2d18fa ]
msm_atomic is doing vblank get/put's already, currently there no need to duplicate the effort in MDP4
Fix warning:
...
WARNING: CPU: 3 PID: 79 at drivers/gpu/drm/drm_vblank.c:1194 drm_vblank_put+0x1cc/0x1d4
...
and multiple vblank time-outs:
...
msm 5100000.mdp: vblank time out, crtc=1
...
Tested on Nexus 7 2013 (deb), LTS 5.10.50.
Introduced by: 119ecb7fd3b5 ("drm/msm/mdp4: request vblank during modeset")
--- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 13 ------------- 1 file changed, 13 deletions(-)
drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +0 -13
@@ -108,13 +108,6 @@ static void mdp4_disable_commit(struct msm_kms *kms)static void mdp4_prepare_commit (struct msm_kms *kms,struct drm_atomic_state *state) { -int i; -struct drm_crtc *crtc; -struct drm_crtc_state *crtc_state; - -/* see 119ecb7fd */ -for_each_new_crtc_in_state (state, crtc, crtc_state, i) -drm_crtc_vblank_get (crtc); }static void mdp4_flush_commit (struct msm_kms *kms,unsigned crtc_mask)
@@ -133,12 +126,6 @@ static void mdp4_wait_flush(struct msm_kms *kms, unsigned crtc_mask)static void mdp4_complete_commit (struct msm_kms *kms,unsigned crtc_mask) { -struct mdp4_kms *mdp4_kms =to_mdp4_kms (to_mdp_kms (kms)); -struct drm_crtc *crtc; - -/* see 119ecb7fd */ -for_each_crtc_mask (mdp4_kms->dev, crtc, crtc_mask) -drm_crtc_vblank_put (crtc); } static long mdp4_round_pixclk(struct msm_kms *kms, unsigned long rate,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 126/260 selftests/bpf: Fix xdp_tx.c prog section name
In reply to Greg Kroah-HartmanFrom: Jussi Maki <[email protected]>
[ Upstream commit 95413846cca37f20000dd095cf6d91f8777129d7 ]
The program type cannot be deduced from 'tx' which causes an invalid argument error when trying to load xdp_tx.o using the skeleton. Rename the section name to "xdp" so that libbpf can deduce the type.
--- tools/testing/selftests/bpf/progs/xdp_tx.c | 2 +- tools/testing/selftests/bpf/test_xdp_veth.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/progs/xdp_tx.c +1 -1
@@ -3,7 +3,7 @@#include <linux/bpf.h> #include "bpf_helpers.h" -SEC("tx") +SEC("xdp")int xdp_tx (struct xdp_md *xdp) {return XDP_TX ;
tools/testing/selftests/bpf/test_xdp_veth.sh +1 -1
@@ -108,7 +108,7 @@ ip link set dev veth2 xdp pinned $BPF_DIR/progs/redirect_map_1 ip link set dev veth3 xdp pinned $BPF_DIR/progs/redirect_map_2 ip -n ns1 link set dev veth11 xdp obj xdp_dummy.o sec xdp_dummy -ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec tx +ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec xdp ip -n ns3 link set dev veth33 xdp obj xdp_dummy.o sec xdp_dummy trap cleanup EXIT
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 127/260 Bluetooth: schedule SCO timeouts with delayed_work
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit ba316be1b6a00db7126ed9a39f9bee434a508043 ]
struct sock.sk_timer should be used as a sock cleanup timer. However, SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in an IRQ context, and the timer callback function sco_sock_timeout takes a spin lock on the socket. However, other functions such as sco_conn_del and sco_conn_ready take the spin lock with interrupts enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);To fix this, we use delayed work to implement SCO sock timouts instead. This allows us to avoid taking the spin lock on the socket in an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of cancel_delayed_work_sync in sco_sock_set_timer and sco_sock_clear_timer to avoid a deadlock. In the future, the call to bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to synchronize with other functions using lock_sock. However, since sco_sock_set_timer and sco_sock_clear_timer are sometimes called under the locked socket (in sco_connect and __sco_sock_close), cancel_delayed_work_sync might cause them to sleep until an sco_sock_timeout that has started finishes running. But sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not change from run to run, hence there is no functional difference between:
1. waiting for a timeout to finish running before scheduling another timeout
2. scheduling another timeout while a timeout is running.
--- net/bluetooth/sco.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-)
net/bluetooth/sco.c +29 -6
@@ -48,6 +48,8 @@ struct sco_conn {spinlock_t lock;struct sock *sk; +struct delayed_work timeout_work; +unsigned int mtu; };
@@ -73,9 +75,20 @@ struct sco_pinfo {#define SCO_CONN_TIMEOUT (HZ * 40)#define SCO_DISCONN_TIMEOUT (HZ * 2) -static void sco_sock_timeout (struct timer_list *t) +static void sco_sock_timeout (struct work_struct *work) { -struct sock *sk =from_timer (sk, t, sk_timer); + struct sco_conn *conn = container_of(work, struct sco_conn, + timeout_work.work); +struct sock *sk; + +sco_conn_lock (conn); + sk = conn->sk; +if (sk) +sock_hold (sk); +sco_conn_unlock (conn); + +if (!sk) +return ;BT_DBG ("sock %p state %d" , sk, sk->sk_state);
@@ -89,14 +102,21 @@ static void sco_sock_timeout(struct timer_list *t)static void sco_sock_set_timer (struct sock *sk,long timeout) { +if (!sco_pi (sk)->conn) +return ; +BT_DBG ("sock %p state %d timeout %ld" , sk, sk->sk_state, timeout); -sk_reset_timer (sk, &sk->sk_timer, jiffies + timeout); +cancel_delayed_work (&sco_pi (sk)->conn->timeout_work); +schedule_delayed_work (&sco_pi (sk)->conn->timeout_work, timeout); }static void sco_sock_clear_timer (struct sock *sk) { +if (!sco_pi (sk)->conn) +return ; +BT_DBG ("sock %p state %d" , sk, sk->sk_state); -sk_stop_timer (sk, &sk->sk_timer); +cancel_delayed_work (&sco_pi (sk)->conn->timeout_work); }/* ---- SCO connections ---- */
@@ -176,6 +196,9 @@ static void sco_conn_del(struct hci_conn *hcon, int err)sco_chan_del (sk, err);bh_unlock_sock (sk);sock_put (sk); + +/* Ensure no more work items will run before freeing conn. */ +cancel_delayed_work_sync (&conn->timeout_work); } hcon->sco_data =NULL ;
@@ -190,6 +213,8 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,sco_pi (sk)->conn = conn; conn->sk = sk; +INIT_DELAYED_WORK (&conn->timeout_work, sco_sock_timeout); +if (parent)bt_accept_enqueue (parent, sk, true); }
@@ -484,8 +509,6 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,sco_pi (sk)->setting =BT_VOICE_CVSD_16BIT ; -timer_setup (&sk->sk_timer, sco_sock_timeout,0 ); -bt_sock_link (&sco_sk_list, sk);return sk; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 128/260 Bluetooth: avoid circular locks in sco_sock_connect
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 734bc5ff783115aa3164f4e9dd5967ae78e0a8ab ]
In a future patch, calls to bh_lock_sock in sco.c should be replaced by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected 5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:lock_sock include/net/sock.h:1613 [inline] ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline] ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288other info that might help us debug this:
Chain exists of: sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock --> hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example, one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);However, in sco_sock_connect, we call lock_sock before calling hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
--- net/bluetooth/sco.c | 39 ++++++++++++++++----------------------- 1 file changed, 16 insertions(+), 23 deletions(-)
net/bluetooth/sco.c +16 -23
@@ -234,44 +234,32 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,return err; } -static int sco_connect (struct sock *sk) +static int sco_connect (struct hci_dev *hdev,struct sock *sk) {struct sco_conn *conn;struct hci_conn *hcon; -struct hci_dev *hdev;int err, type;BT_DBG ("%pMR -> %pMR" , &sco_pi (sk)->src, &sco_pi (sk)->dst); - hdev =hci_get_route (&sco_pi (sk)->dst, &sco_pi (sk)->src,BDADDR_BREDR ); -if (!hdev) -return -EHOSTUNREACH ; - -hci_dev_lock (hdev); -if (lmp_esco_capable (hdev) && !disable_esco) type =ESCO_LINK ;else type =SCO_LINK ;if (sco_pi (sk)->setting ==BT_VOICE_TRANSPARENT && - (!lmp_transp_capable (hdev) || !lmp_esco_capable (hdev))) { - err = -EOPNOTSUPP ; - goto done; - } + (!lmp_transp_capable (hdev) || !lmp_esco_capable (hdev))) +return -EOPNOTSUPP ; hcon =hci_connect_sco (hdev, type, &sco_pi (sk)->dst,sco_pi (sk)->setting); -if (IS_ERR (hcon)) { - err =PTR_ERR (hcon); - goto done; - } +if (IS_ERR (hcon)) +return PTR_ERR (hcon); conn =sco_conn_add (hcon);if (!conn) {hci_conn_drop (hcon); - err = -ENOMEM ; - goto done; +return -ENOMEM ; }/* Update source addr of the socket */
@@ -279,7 +267,7 @@ static int sco_connect(struct sock *sk) err =sco_chan_add (conn, sk,NULL );if (err) - goto done; +return err;if (hcon->state ==BT_CONNECTED ) {sco_sock_clear_timer (sk);
@@ -289,9 +277,6 @@ static int sco_connect(struct sock *sk)sco_sock_set_timer (sk, sk->sk_sndtimeo); } -done: -hci_dev_unlock (hdev); -hci_dev_put (hdev);return err; }
@@ -573,6 +558,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen {struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;struct sock *sk = sock->sk; +struct hci_dev *hdev;int err;BT_DBG ("sk %p" , sk);
@@ -587,12 +573,19 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alenif (sk->sk_type !=SOCK_SEQPACKET )return -EINVAL ; + hdev =hci_get_route (&sa->sco_bdaddr, &sco_pi (sk)->src,BDADDR_BREDR ); +if (!hdev) +return -EHOSTUNREACH ; +hci_dev_lock (hdev); +lock_sock (sk);/* Set destination address and psm */ bacpy (&sco_pi (sk)->dst, &sa->sco_bdaddr); - err =sco_connect (sk); + err =sco_connect (hdev, sk); +hci_dev_unlock (hdev); +hci_dev_put (hdev);if (err) goto done;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 129/260 net/mlx5: Fix variable type to match 64bit
In reply to Greg Kroah-HartmanFrom: Eran Ben Elisha <[email protected]>
[ Upstream commit 979aa51967add26b37f9d77e01729d44a2da8e5f ]
Fix the following smatch warning:wait_func_handle_exec_timeout() warn: should '1 << ent->idx' be a 64 bit type?
Use 1ULL, to have a 64 bit type variable.
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +4 -4
@@ -865,7 +865,7 @@ static void cb_timeout_handler(struct work_struct *work) ent->ret = -ETIMEDOUT ;mlx5_core_warn (dev,"cmd[%d]: %s(0x%x) Async, timeout. Will cause a leak of a command resource\n" , ent->idx,mlx5_command_str (msg_to_opcode (ent->in)),msg_to_opcode (ent->in)); -mlx5_cmd_comp_handler (dev,1UL << ent->idx, true); +mlx5_cmd_comp_handler (dev,1ULL << ent->idx, true); out:cmd_ent_put (ent);/* for the cmd_ent_get() took on schedule delayed work */
@@ -977,7 +977,7 @@ static void cmd_work_handler(struct work_struct *work)MLX5_SET (mbox_out, ent->out, status, status);MLX5_SET (mbox_out, ent->out, syndrome, drv_synd); -mlx5_cmd_comp_handler (dev,1UL << ent->idx, true); +mlx5_cmd_comp_handler (dev,1ULL << ent->idx, true);return ; }
@@ -991,7 +991,7 @@ static void cmd_work_handler(struct work_struct *work)poll_timeout (ent);/* make sure we read the descriptor after ownership is SW */ rmb (); -mlx5_cmd_comp_handler (dev,1UL << ent->idx, (ent->ret == -ETIMEDOUT )); +mlx5_cmd_comp_handler (dev,1ULL << ent->idx, (ent->ret == -ETIMEDOUT )); } }
@@ -1051,7 +1051,7 @@ static void wait_func_handle_exec_timeout(struct mlx5_core_dev *dev, mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in)); ent->ret = -ETIMEDOUT ; -mlx5_cmd_comp_handler (dev,1UL << ent->idx, true); +mlx5_cmd_comp_handler (dev,1ULL << ent->idx, true); }static int wait_func (struct mlx5_core_dev *dev,struct mlx5_cmd_work_ent *ent)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 130/260 gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
In reply to Greg Kroah-HartmanFrom: Tuo Li <[email protected]>
[ Upstream commit a211260c34cfadc6068fece8c9e99e0fe1e2a2b6 ]
The variable val is declared without initialization, and its address is passed to amdgpu_i2c_get_byte(). In this function, the value of val is accessed in:
DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
addr, *val);
Also, when amdgpu_i2c_get_byte() returns, val may remain uninitialized, but it is accessed in:
val &= ~amdgpu_connector->router.ddc_mux_control_pin;
To fix this possible uninitialized-variable access, initialize val to 0 in amdgpu_i2c_router_select_ddc_port().
--- drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c +1 -1
@@ -339,7 +339,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan *i2c_bus,void amdgpu_i2c_router_select_ddc_port (const struct amdgpu_connector *amdgpu_connector) { -u8 val; +u8 val =0 ;if (!amdgpu_connector->router.ddc_valid)return ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 131/260 drm/display: fix possible null-pointer dereference in dcn10_set_clock()
In reply to Greg Kroah-HartmanFrom: Tuo Li <[email protected]>
[ Upstream commit 554594567b1fa3da74f88ec7b2dc83d000c58e98 ]
The variable dc->clk_mgr is checked in:
if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
if (!dc->clk_mgr->funcs->get_clock)
To fix this null-pointer dereference, check dc->clk_mgr and the function pointer dc->clk_mgr->funcs->get_clock earlier, and return if one of them is NULL.
--- .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +5 -6
@@ -3264,13 +3264,12 @@ static enum dc_status dcn10_set_clock(struct dc *dc,struct dc_clock_config clock_cfg = {0 };struct dc_clocks *current_clocks = &context->bw_ctx.bw.dcn.clk; -if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock) - dc->clk_mgr->funcs->get_clock (dc->clk_mgr, - context, clock_type, &clock_cfg); - -if (!dc->clk_mgr->funcs->get_clock) +if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)return DC_FAIL_UNSUPPORTED_1 ; + dc->clk_mgr->funcs->get_clock (dc->clk_mgr, + context, clock_type, &clock_cfg); +if (clk_khz > clock_cfg.max_clock_khz)return DC_FAIL_CLK_EXCEED_MAX ;
@@ -3288,7 +3287,7 @@ static enum dc_status dcn10_set_clock(struct dc *dc,else return DC_ERROR_UNEXPECTED ; -if (dc->clk_mgr && dc->clk_mgr->funcs->update_clocks) +if (dc->clk_mgr->funcs->update_clocks) dc->clk_mgr->funcs->update_clocks (dc->clk_mgr, context, true);return DC_OK ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 132/260 mac80211: Fix monitor MTU limit so that A-MSDUs get through
In reply to Greg Kroah-HartmanFrom: Johan Almbladh <[email protected]>
[ Upstream commit 79f5962baea74ce1cd4e5949598944bff854b166 ]
The maximum MTU was set to 2304, which is the maximum MSDU size. While this is valid for normal WLAN interfaces, it is too low for monitor interfaces. A monitor interface may receive and inject MPDU frames, and the maximum MPDU frame size is larger than 2304. The MPDU may also contain an A-MSDU frame, in which case the size may be much larger than the MTU limit. Since the maximum size of an A-MSDU depends on the PHY mode of the transmitting STA, it is not possible to set an exact MTU limit for a monitor interface. Now the maximum MTU for a monitor interface is unrestricted.
--- net/mac80211/iface.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/mac80211/iface.c +9 -2
@@ -1875,9 +1875,16 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,netdev_set_default_ethtool_ops (ndev, &ieee80211_ethtool_ops); -/* MTU range: 256 - 2304 */ +/* MTU range is normally 256 - 2304, where the upper limit is +* the maximum MSDU size. Monitor interfaces send and receive +* MPDU and A-MSDU frames which may be much larger so we do +* not impose an upper limit in that case. +*/ ndev->min_mtu =256 ; - ndev->max_mtu = local->hw.max_mtu; +if (type ==NL80211_IFTYPE_MONITOR ) + ndev->max_mtu =0 ; +else + ndev->max_mtu = local->hw.max_mtu; ret =register_netdevice (ndev);if (ret) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 133/260 ARM: tegra: tamonten: Fix UART pad setting
In reply to Greg Kroah-HartmanFrom: Andreas Obergschwandtner <[email protected]>
[ Upstream commit 2270ad2f4e123336af685ecedd1618701cb4ca1e ]
This patch fixes the tristate and pullup configuration for UART 1 to 3 on the Tamonten SOM.
--- arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
arch/arm/boot/dts/tegra20-tamonten.dtsi +7 -7
@@ -185,8 +185,9 @@ conf_ata { nvidia,pins = "ata", "atb", "atc", "atd", "ate", "cdev1", "cdev2", "dap1", "dtb", "gma", "gmb", "gmc", "gmd", "gme", "gpu7", - "gpv", "i2cp", "pta", "rm", "slxa", - "slxk", "spia", "spib", "uac"; + "gpv", "i2cp", "irrx", "irtx", "pta", + "rm", "slxa", "slxk", "spia", "spib", + "uac"; nvidia,pull = <TEGRA_PIN_PULL_NONE>; nvidia,tristate = <TEGRA_PIN_DISABLE>; };
@@ -211,7 +212,7 @@ conf_crtp { conf_ddc { nvidia,pins = "ddc", "dta", "dtd", "kbca", "kbcb", "kbcc", "kbcd", "kbce", "kbcf", - "sdc"; + "sdc", "uad", "uca"; nvidia,pull = <TEGRA_PIN_PULL_UP>; nvidia,tristate = <TEGRA_PIN_DISABLE>; };
@@ -221,10 +222,9 @@ conf_hdint { "lvp0", "owc", "sdb"; nvidia,tristate = <TEGRA_PIN_ENABLE>; }; - conf_irrx { - nvidia,pins = "irrx", "irtx", "sdd", "spic", - "spie", "spih", "uaa", "uab", "uad", - "uca", "ucb"; + conf_sdd { + nvidia,pins = "sdd", "spic", "spie", "spih", + "uaa", "uab", "ucb"; nvidia,pull = <TEGRA_PIN_PULL_UP>; nvidia,tristate = <TEGRA_PIN_ENABLE>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 134/260 arm64: tegra: Fix compatible string for Tegra132 CPUs
In reply to Greg Kroah-HartmanFrom: Thierry Reding <[email protected]>
[ Upstream commit f865d0292ff3c0ca09414436510eb4c815815509 ]
The documented compatible string for the CPUs found on Tegra132 is "nvidia,tegra132-denver", rather than the previously used compatible string "nvidia,denver".
--- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/nvidia/tegra132.dtsi +2 -2
@@ -1082,13 +1082,13 @@ cpus { cpu@0 { device_type = "cpu"; - compatible = "nvidia,denver"; + compatible = "nvidia,tegra132-denver"; reg = <0>; }; cpu@1 { device_type = "cpu"; - compatible = "nvidia,denver"; + compatible = "nvidia,tegra132-denver"; reg = <1>; }; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 135/260 arm64: dts: ls1046a: fix eeprom entries
In reply to Greg Kroah-HartmanFrom: Raag Jadav <[email protected]>
[ Upstream commit c1a6018d1839c9cb8f807dc863a50102a1a5c412 ]
ls1046afrwy and ls1046ardb boards have CAT24C04[1] and CAT24C05[2] eeproms respectively. Both are 4Kb (512 bytes) in size,
and compatible with AT24C04[3].
Remove multi-address entries, as both the boards have a single chip each.
[1] https://www.onsemi.com/pdf/datasheet/cat24c01-d.pdf
[2] https://www.onsemi.com/pdf/datasheet/cat24c03-d.pdf
[3] https://ww1.microchip.com/downloads/en/DeviceDoc/doc0180.pdf
--- arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts | 8 +------- arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts | 7 +------ 2 files changed, 2 insertions(+), 13 deletions(-)
arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts +1 -7
@@ -83,15 +83,9 @@ rtc@51 { }; eeprom@52 { - compatible = "atmel,24c512"; + compatible = "onnn,cat24c04", "atmel,24c04"; reg = <0x52>; }; - - eeprom@53 { - compatible = "atmel,24c512"; - reg = <0x53>; - }; - }; }; };
arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts +1 -6
@@ -58,14 +58,9 @@ temp-sensor@4c { }; eeprom@52 { - compatible = "atmel,24c512"; + compatible = "onnn,cat24c05", "atmel,24c04"; reg = <0x52>; }; - - eeprom@53 { - compatible = "atmel,24c512"; - reg = <0x53>; - }; }; &i2c3 {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 136/260 nvme-tcp: dont check blk_mq_tag_to_rq when receiving pdu data
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 3b01a9d0caa8276d9ce314e09610f7fb70f49a00 ]
We already validate it when receiving the c2hdata pdu header and this is not changing so this is a redundant check.
--- drivers/nvme/host/tcp.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/nvme/host/tcp.c +3 -11
@@ -642,17 +642,9 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb, unsigned int *offset, size_t *len) { struct nvme_tcp_data_pdu *pdu = (void *)queue->pdu; -struct nvme_tcp_request *req; -struct request *rq; - - rq =blk_mq_tag_to_rq (nvme_tcp_tagset (queue), pdu->command_id); -if (!rq) { -dev_err (queue->ctrl->ctrl.device, -"queue %d tag %#x not found\n" , -nvme_tcp_queue_id (queue), pdu->command_id); -return -ENOENT ; - } - req =blk_mq_rq_to_pdu (rq); +struct request *rq = +blk_mq_tag_to_rq (nvme_tcp_tagset (queue), pdu->command_id); +struct nvme_tcp_request *req =blk_mq_rq_to_pdu (rq);while (true) {int recv_len, ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 137/260 Bluetooth: Fix handling of LE Enhanced Connection Complete
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit cafae4cd625502f65d1798659c1aa9b62d38cc56 ]
LE Enhanced Connection Complete contains the Local RPA used in the connection which must be used when set otherwise there could problems when pairing since the address used by the remote stack could be the Local RPA:
BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E page 2396
'Resolvable Private Address being used by the local device for this connection. This is only valid when the Own_Address_Type (from the HCI_LE_Create_Connection, HCI_LE_Set_Advertising_Parameters, HCI_LE_Set_Extended_Advertising_Parameters, or HCI_LE_Extended_Create_Connection commands) is set to 0x02 or 0x03, and the Controller generated a resolvable private address for the local device using a non-zero local IRK. For other Own_Address_Type values, the Controller shall return all zeros.'
--- net/bluetooth/hci_event.c | 93 ++++++++++++++++++++++++++------------- 1 file changed, 62 insertions(+), 31 deletions(-)
net/bluetooth/hci_event.c +62 -31
@@ -4920,9 +4920,64 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, }#endif +static void le_conn_update_addr (struct hci_conn *conn,bdaddr_t *bdaddr, +u8 bdaddr_type,bdaddr_t *local_rpa) +{ +if (conn->out) { + conn->dst_type = bdaddr_type; + conn->resp_addr_type = bdaddr_type; +bacpy (&conn->resp_addr, bdaddr); + +/* Check if the controller has set a Local RPA then it must be +* used instead or hdev->rpa. +*/ +if (local_rpa &&bacmp (local_rpa,BDADDR_ANY )) { + conn->init_addr_type =ADDR_LE_DEV_RANDOM ; +bacpy (&conn->init_addr, local_rpa); + }else if (hci_dev_test_flag (conn->hdev,HCI_PRIVACY )) { + conn->init_addr_type =ADDR_LE_DEV_RANDOM ; +bacpy (&conn->init_addr, &conn->hdev->rpa); + }else { +hci_copy_identity_address (conn->hdev, &conn->init_addr, + &conn->init_addr_type); + } + }else { + conn->resp_addr_type = conn->hdev->adv_addr_type; +/* Check if the controller has set a Local RPA then it must be +* used instead or hdev->rpa. +*/ +if (local_rpa &&bacmp (local_rpa,BDADDR_ANY )) { + conn->resp_addr_type =ADDR_LE_DEV_RANDOM ; +bacpy (&conn->resp_addr, local_rpa); + }else if (conn->hdev->adv_addr_type ==ADDR_LE_DEV_RANDOM ) { +/* In case of ext adv, resp_addr will be updated in +* Adv Terminated event. +*/ +if (!ext_adv_capable (conn->hdev)) +bacpy (&conn->resp_addr, + &conn->hdev->random_addr); + }else { +bacpy (&conn->resp_addr, &conn->hdev->bdaddr); + } + + conn->init_addr_type = bdaddr_type; +bacpy (&conn->init_addr, bdaddr); + +/* For incoming connections, set the default minimum +* and maximum connection interval. They will be used +* to check if the parameters are in range and if not +* trigger the connection update procedure. +*/ + conn->le_conn_min_interval = conn->hdev->le_conn_min_interval; + conn->le_conn_max_interval = conn->hdev->le_conn_max_interval; + } +} +static void le_conn_complete_evt (struct hci_dev *hdev,u8 status, -bdaddr_t *bdaddr,u8 bdaddr_type,u8 role,u16 handle, -u16 interval,u16 latency,u16 supervision_timeout) +bdaddr_t *bdaddr,u8 bdaddr_type, +bdaddr_t *local_rpa,u8 role,u16 handle, +u16 interval,u16 latency, +u16 supervision_timeout) {struct hci_conn_params *params;struct hci_conn *conn;
@@ -4970,32 +5025,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,cancel_delayed_work (&conn->le_conn_timeout); } -if (!conn->out) { -/* Set the responder (our side) address type based on -* the advertising address type. -*/ - conn->resp_addr_type = hdev->adv_addr_type; -if (hdev->adv_addr_type ==ADDR_LE_DEV_RANDOM ) { -/* In case of ext adv, resp_addr will be updated in -* Adv Terminated event. -*/ -if (!ext_adv_capable (hdev)) -bacpy (&conn->resp_addr, &hdev->random_addr); - }else { -bacpy (&conn->resp_addr, &hdev->bdaddr); - } - - conn->init_addr_type = bdaddr_type; -bacpy (&conn->init_addr, bdaddr); - -/* For incoming connections, set the default minimum -* and maximum connection interval. They will be used -* to check if the parameters are in range and if not -* trigger the connection update procedure. -*/ - conn->le_conn_min_interval = hdev->le_conn_min_interval; - conn->le_conn_max_interval = hdev->le_conn_max_interval; - } +le_conn_update_addr (conn, bdaddr, bdaddr_type, local_rpa);/* Lookup the identity address from the stored connection * address and address type.
@@ -5089,7 +5119,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)BT_DBG ("%s status 0x%2.2x" , hdev->name, ev->status);le_conn_complete_evt (hdev, ev->status, &ev->bdaddr, ev->bdaddr_type, - ev->role,le16_to_cpu (ev->handle), +NULL , ev->role,le16_to_cpu (ev->handle),le16_to_cpu (ev->interval),le16_to_cpu (ev->latency),le16_to_cpu (ev->supervision_timeout));
@@ -5103,7 +5133,7 @@ static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,BT_DBG ("%s status 0x%2.2x" , hdev->name, ev->status);le_conn_complete_evt (hdev, ev->status, &ev->bdaddr, ev->bdaddr_type, - ev->role,le16_to_cpu (ev->handle), + &ev->local_rpa, ev->role,le16_to_cpu (ev->handle),le16_to_cpu (ev->interval),le16_to_cpu (ev->latency),le16_to_cpu (ev->supervision_timeout));
@@ -5134,7 +5164,8 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)if (conn) {struct adv_info *adv_instance; -if (hdev->adv_addr_type !=ADDR_LE_DEV_RANDOM ) +if (hdev->adv_addr_type !=ADDR_LE_DEV_RANDOM || +bacmp (&conn->resp_addr,BDADDR_ANY ))return ;if (!hdev->cur_adv_instance) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 138/260 opp: Dont print an error if required-opps is missing
In reply to Greg Kroah-HartmanFrom: Rajendra Nayak <[email protected]>
[ Upstream commit 020d86fc0df8b865f6dc168d88a7c2dccabd0a9e ]
The 'required-opps' property is considered optional, hence remove the pr_err() in of_parse_required_opp() when we find the property is missing.
While at it, also fix the return value of of_get_required_opp_performance_state() when of_parse_required_opp() fails, return a -ENODEV instead of the -EINVAL.
--- drivers/opp/of.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
drivers/opp/of.c +2 -10
@@ -95,15 +95,7 @@ static struct dev_pm_opp *_find_opp_of_np(struct opp_table *opp_table,static struct device_node *of_parse_required_opp (struct device_node *np,int index) { -struct device_node *required_np; - - required_np =of_parse_phandle (np,"required-opps" , index); -if (unlikely (!required_np)) { -pr_err ("%s: Unable to parse required-opps: %pOF, index: %d\n" , - __func__, np, index); - } - -return required_np; +return of_parse_phandle (np,"required-opps" , index); }/* The caller must call dev_pm_opp_put_opp_table() after the table is used */
@@ -996,7 +988,7 @@ int of_get_required_opp_performance_state(struct device_node *np, int index) required_np =of_parse_required_opp (np, index);if (!required_np) -return -EINVAL ; +return -ENODEV ; opp_table =_find_table_of_opp_np (required_np);if (IS_ERR (opp_table)) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 139/260 serial: sh-sci: fix break handling for sysrq
In reply to Greg Kroah-HartmanFrom: Ulrich Hecht <[email protected]>
[ Upstream commit 87b8061bad9bd4b549b2daf36ffbaa57be2789a2 ]
This fixes two issues that cause the sysrq sequence to be inadvertently aborted on SCIF serial consoles:
- a NUL character remains in the RX queue after a break has been detected, which is then passed on to uart_handle_sysrq_char()
- the break interrupt is handled twice on controllers with multiplexed ERI and BRI interrupts
--- drivers/tty/serial/sh-sci.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/tty/serial/sh-sci.c +6 -1
@@ -1763,6 +1763,10 @@ static irqreturn_t sci_br_interrupt(int irq, void *ptr)/* Handle BREAKs */ sci_handle_breaks (port); + +/* drop invalid character received before break was detected */ +serial_port_in (port, SCxRDR); +sci_clear_SCxSR (port,SCxSR_BREAK_CLEAR (port));return IRQ_HANDLED ;
@@ -1842,7 +1846,8 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr) ret =sci_er_interrupt (irq, ptr);/* Break Interrupt */ -if ((ssr_status &SCxSR_BRK (port)) && err_enabled) +if (s->irqs[SCIx_ERI_IRQ] != s->irqs[SCIx_BRI_IRQ] && + (ssr_status &SCxSR_BRK (port)) && err_enabled) ret =sci_br_interrupt (irq, ptr);/* Overrun Interrupt */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 140/260 tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
In reply to Greg Kroah-HartmanFrom: Luke Hsiao <[email protected]>
[ Upstream commit e3faa49bcecdfcc80e94dd75709d6acb1a5d89f6 ]
Since the original TFO server code was implemented in commit 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef ("tcp: TCP Fast Open Server - main code path") the TFO server code has supported the sysctl bit flag TFO_SERVER_COOKIE_NOT_REQD. Currently, when the TFO_SERVER_ENABLE and TFO_SERVER_COOKIE_NOT_REQD sysctl bit flags are set, a server connection will accept a SYN with N bytes of data (N > 0) that has no TFO cookie, create a new fast open connection, process the incoming data in the SYN, and make the connection ready for accepting. After accepting, the connection is ready for read()/recvmsg() to read the N bytes of data in the SYN, ready for write()/sendmsg() calls and data transmissions to transmit data.
This commit changes an edge case in this feature by changing this behavior to apply to (N >= 0) bytes of data in the SYN rather than only (N > 0) bytes of data in the SYN. Now, a server will accept a data-less SYN without a TFO cookie if TFO_SERVER_COOKIE_NOT_REQD is set.
Caveat! While this enables a new kind of TFO (data-less empty-cookie SYN), some firewall rules setup may not work if they assume such packets are not legit TFOs and will filter them.
--- net/ipv4/tcp_fastopen.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/ipv4/tcp_fastopen.c +1 -2
@@ -379,8 +379,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,return NULL ; } -if (syn_data && -tcp_fastopen_no_cookie (sk, dst,TFO_SERVER_COOKIE_NOT_REQD )) +if (tcp_fastopen_no_cookie (sk, dst,TFO_SERVER_COOKIE_NOT_REQD )) goto fastopen;if (foc->len ==0 ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 141/260 rpc: fix gss_svc_init cleanup on failure
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 5a4753446253a427c0ff1e433b9c4933e5af207c ]
The failure case here should be rare, but it's obviously wrong.
--- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/auth_gss/svcauth_gss.c +1 -1
@@ -1937,7 +1937,7 @@ gss_svc_init_net(struct net *net) goto out2;return 0 ; out2: -destroy_use_gss_proxy_proc_entry (net); +rsi_cache_destroy_net (net); out1:rsc_cache_destroy_net (net);return rv;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 142/260 staging: rts5208: Fix get_ms_information() heap buffer size
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit cbe34165cc1b7d1110b268ba8b9f30843c941639 ]
Fix buf allocation size (it needs to be 2 bytes larger). Found when __alloc_size() annotations were added to kmalloc() interfaces.
In file included from ./include/linux/string.h:253,
from ./include/linux/bitmap.h:10,
from ./include/linux/cpumask.h:12,
from ./arch/x86/include/asm/paravirt.h:17,
from ./arch/x86/include/asm/irqflags.h:63,
from ./include/linux/irqflags.h:16,
from ./include/linux/rcupdate.h:26,
from ./include/linux/rculist.h:11,
from ./include/linux/pid.h:5,
from ./include/linux/sched.h:14,
from ./include/linux/blkdev.h:5,
from drivers/staging/rts5208/rtsx_scsi.c:12:
In function 'get_ms_information',
inlined from 'ms_sp_cmnd' at drivers/staging/rts5208/rtsx_scsi.c:2877:12,
inlined from 'rtsx_scsi_handler' at drivers/staging/rts5208/rtsx_scsi.c:3247:12:./include/linux/fortify-string.h:54:29: warning: '__builtin_memcpy' forming offset [106, 107] is out
of the bounds [0, 106] [-Warray-bounds]
54 | #define __underlying_memcpy __builtin_memcpy
| ^./include/linux/fortify-string.h:417:2: note: in expansion of macro '__underlying_memcpy'
417 | __underlying_##op(p, q, __fortify_size); \
| ^~~~~~~~~~~~~
./include/linux/fortify-string.h:463:26: note: in expansion of macro '__fortify_memcpy_chk'
463 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
| ^~~~~~~~~~~~~~~~~~~~
drivers/staging/rts5208/rtsx_scsi.c:2851:3: note: in expansion of macro 'memcpy'
2851 | memcpy(buf + i, ms_card->raw_sys_info, 96);
| ^~~~~~--- drivers/staging/rts5208/rtsx_scsi.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/staging/rts5208/rtsx_scsi.c +3 -7
@@ -2802,10 +2802,10 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip) }if (dev_info_id ==0x15 ) { - buf_len =0x3A ; + buf_len =0x3C ; data_len =0x3A ; }else { - buf_len =0x6A ; + buf_len =0x6C ; data_len =0x6A ; }
@@ -2855,11 +2855,7 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip) }rtsx_stor_set_xfer_buf (buf, buf_len, srb); - -if (dev_info_id ==0x15 ) -scsi_set_resid (srb,scsi_bufflen (srb) -0x3C ); -else -scsi_set_resid (srb,scsi_bufflen (srb) -0x6C ); +scsi_set_resid (srb,scsi_bufflen (srb) - buf_len);kfree (buf);return STATUS_SUCCESS ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 143/260 gfs2: Dont call dlm after protocol is unmounted
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit d1340f80f0b8066321b499a376780da00560e857 ]
In the gfs2 withdraw sequence, the dlm protocol is unmounted with a call to lm_unmount. After a withdraw, users are allowed to unmount the withdrawn file system. But at that point we may still have glocks left over that we need to free via unmount's call to gfs2_gl_hash_clear. These glocks may have never been completed because of whatever problem caused the withdraw (IO errors or whatever).
Before this patch, function gdlm_put_lock would still try to call into dlm to unlock these leftover glocks, which resulted in dlm returning -EINVAL because the lock space was abandoned. These glocks were never freed because there was no mechanism after that to free them.
This patch adds a check to gdlm_put_lock to see if the locking protocol was inactive (DFL_UNMOUNT flag) and if so, free the glock and not make the invalid call into dlm.
I could have combined this "if" with the one that follows, related to leftover glock LVBs, but I felt the code was more readable with its own if clause.
--- fs/gfs2/lock_dlm.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/gfs2/lock_dlm.c +5 -0
@@ -292,6 +292,11 @@ static void gdlm_put_lock(struct gfs2_glock *gl)gfs2_sbstats_inc (gl,GFS2_LKS_DCOUNT );gfs2_update_request_times (gl); +/* don't want to call dlm if we've unmounted the lock protocol */ +if (test_bit (DFL_UNMOUNT , &ls->ls_recover_flags)) { +gfs2_glock_free (gl); +return ; + }/* don't want to skip dlm_unlock writing the lvb when lock has one */ if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 144/260 usb: chipidea: host: fix port index underflow and UBSAN complains
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
[ Upstream commit e5d6a7c6cfae9e714a0e8ff64facd1ac68a784c6 ]
If wIndex is 0 (and it often is), these calculations underflow and UBSAN complains, here resolve this by not decrementing the index when it is equal to 0, this copies the solution from commit 85e3990bea49 ("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")
--- drivers/usb/chipidea/host.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/usb/chipidea/host.c +11 -3
@@ -233,18 +233,26 @@ static int ci_ehci_hub_control( ) {struct ehci_hcd *ehci =hcd_to_ehci (hcd); +unsigned int ports =HCS_N_PORTS (ehci->hcs_params);u32 __iomem *status_reg; -u32 temp; +u32 temp, port_index;unsigned long flags;int retval =0 ;struct device *dev = hcd->self.controller;struct ci_hdrc *ci =dev_get_drvdata (dev); - status_reg = &ehci->regs->port_status[(wIndex &0xff ) -1 ]; + port_index = wIndex &0xff ; + port_index -= (port_index >0 ); + status_reg = &ehci->regs->port_status[port_index];spin_lock_irqsave (&ehci->lock, flags);if (typeReq == SetPortFeature && wValue ==USB_PORT_FEAT_SUSPEND ) { +if (!wIndex || wIndex > ports) { + retval = -EPIPE ; + goto done; + } + temp =ehci_readl (ehci, status_reg);if ((temp &PORT_PE ) ==0 || (temp &PORT_RESET ) !=0 ) { retval = -EPIPE ;
@@ -273,7 +281,7 @@ static int ci_ehci_hub_control(ehci_writel (ehci, temp, status_reg); } -set_bit ((wIndex &0xff ) -1 , &ehci->suspended_ports); +set_bit (port_index, &ehci->suspended_ports); goto done; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 145/260 lockd: lockd server-side shouldnt set fl_ops
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 7de875b231edb807387a81cde288aa9e1015ef9e ]
Locks have two sets of op arrays, fl_lmops for the lock manager (lockd or nfsd), fl_ops for the filesystem. The server-side lockd code has been setting its own fl_ops, which leads to confusion (and crashes) in the reexport case, where the filesystem expects to be the only one setting fl_ops.
And there's no reason for it that I can see-the lm_get/put_owner ops do the same job.
--- fs/lockd/svclock.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-)
fs/lockd/svclock.c +12 -18
@@ -395,28 +395,10 @@ nlmsvc_release_lockowner(struct nlm_lock *lock)nlmsvc_put_lockowner (lock->fl.fl_owner); } -static void nlmsvc_locks_copy_lock (struct file_lock *new,struct file_lock *fl) -{ -struct nlm_lockowner *nlm_lo = (struct nlm_lockowner *)fl->fl_owner; - new->fl_owner =nlmsvc_get_lockowner (nlm_lo); -} - -static void nlmsvc_locks_release_private (struct file_lock *fl) -{ -nlmsvc_put_lockowner ((struct nlm_lockowner *)fl->fl_owner); -} - -static const struct file_lock_operations nlmsvc_lock_ops = { - .fl_copy_lock = nlmsvc_locks_copy_lock, - .fl_release_private = nlmsvc_locks_release_private, -}; -void nlmsvc_locks_init_private (struct file_lock *fl,struct nlm_host *host,pid_t pid) { fl->fl_owner =nlmsvc_find_lockowner (host, pid); -if (fl->fl_owner !=NULL ) - fl->fl_ops = &nlmsvc_lock_ops; }/*
@@ -788,9 +770,21 @@ nlmsvc_notify_blocked(struct file_lock *fl)printk (KERN_WARNING "lockd: notification for unknown block!\n" ); } +static fl_owner_t nlmsvc_get_owner (fl_owner_t owner) +{ +return nlmsvc_get_lockowner (owner); +} + +static void nlmsvc_put_owner (fl_owner_t owner) +{ +nlmsvc_put_lockowner (owner); +} +const struct lock_manager_operations nlmsvc_lock_operations = { .lm_notify = nlmsvc_notify_blocked, .lm_grant = nlmsvc_grant_deferred, + .lm_get_owner = nlmsvc_get_owner, + .lm_put_owner = nlmsvc_put_owner, };/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 146/260 drm/exynos: Always initialize mapping in exynos_drm_register_dma()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit c626f3864bbbb28bbe06476b0b497c1330aa4463 ]
In certain randconfigs, clang warns:
drivers/gpu/drm/exynos/exynos_drm_dma.c:121:19: warning: variable 'mapping' is uninitialized when used here [-Wuninitialized]
priv->mapping = mapping;
^~~~~~~
drivers/gpu/drm/exynos/exynos_drm_dma.c:111:16: note: initialize the
variable 'mapping' to silence this warning
void *mapping;
^
= NULL1 warning generated.
This occurs when CONFIG_EXYNOS_IOMMU is enabled and both CONFIG_ARM_DMA_USE_IOMMU and CONFIG_IOMMU_DMA are disabled, which makes the code look like
void *mapping;
if (0)
mapping = arm_iommu_create_mapping()
else if (0)
mapping = iommu_get_domain_for_dev()
... priv->mapping = mapping;
Add an else branch that initializes mapping to the -ENODEV error pointer so that there is no more warning and the driver does not change during runtime.
--- drivers/gpu/drm/exynos/exynos_drm_dma.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/exynos/exynos_drm_dma.c +2 -0
@@ -140,6 +140,8 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev, EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE); else if (IS_ENABLED(CONFIG_IOMMU_DMA)) mapping =iommu_get_domain_for_dev (priv->dma_dev); + else + mapping =ERR_PTR (-ENODEV );if (IS_ERR (mapping))return PTR_ERR (mapping);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 147/260 m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit db87db65c1059f3be04506d122f8ec9b2fa3b05e ]
Quoted 33 lines
Hi Arnd,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master head: 2f73937c9aa561e2082839bc1a8efaac75d6e244 commit: 47fd22f2b84765a2f7e3f150282497b902624547 [4771/5318] cs89x0: rework driver configuration config: m68k-randconfig-c003-20210804 (attached as .config) compiler: m68k-linux-gcc (GCC) 10.3.0reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=47fd22f2b84765a2f7e3f150282497b902624547
git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
git fetch --no-tags linux-next master
git checkout47fd22f2b84765a2f7e3f150282497b902624547
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-10.3.0 make.cross ARCH=m68kIf you fix the issue, kindly add following tag as appropriate
Reported-by kernel test robot <[email protected]>All errors (new ones prefixed by >>):
In file included from include/linux/kernel.h:19, from include/linux/list.h:9, from include/linux/module.h:12, from drivers/net/ethernet/cirrus/cs89x0.c:51: drivers/net/ethernet/cirrus/cs89x0.c: In function 'net_open': drivers/net/ethernet/cirrus/cs89x0.c:897:20: error: implicit declaration of function 'isa_virt_to_bus'; did you mean 'virt_to_bus'? [-Werror=implicit-function-declaration] 897 | (unsigned long)isa_virt_to_bus(lp->dma_buff)); | ^~~~~~~~~~~~~~~ include/linux/printk.h:141:17: note: in definition of macro 'no_printk'
Quoted 9 lines
141 | printk(fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ drivers/net/ethernet/cirrus/cs89x0.c:86:3: note: in expansion of macro 'pr_debug' 86 | pr_##level(fmt, ##__VA_ARGS__); \ | ^~~ drivers/net/ethernet/cirrus/cs89x0.c:894:3: note: in expansion of macro 'cs89_dbg' 894 | cs89_dbg(1, debug, "%s: dma %lx %lx\n", | ^~~~~~~~Quoted 1 line
Quoted 1 line
drivers/net/ethernet/cirrus/cs89x0.c:914:3: error: implicit declaration of function 'disable_dma'; did you mean 'disable_irq'? [-Werror=implicit-function-declaration]
As far as I can tell, this is a bug with the m68kmmu architecture, not with my driver:
The CONFIG_ISA_DMA_API option is provided for coldfire, which implements it, but dragonball also sets the option as a side-effect, without actually implementing
the interfaces. The patch below should fix it.
--- arch/m68k/Kconfig.bus | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/Kconfig.bus +1 -1
@@ -63,7 +63,7 @@ source "drivers/zorro/Kconfig" endif -if !MMU +if COLDFIRE config ISA_DMA_API def_bool !M5272
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 148/260 btrfs: tree-log: check btrfs_lookup_data_extent return value
In reply to Greg Kroah-HartmanFrom: Marcos Paulo de Souza <[email protected]>
[ Upstream commit 3736127a3aa805602b7a2ad60ec9cfce68065fbb ]
Function btrfs_lookup_data_extent calls btrfs_search_slot to verify if the EXTENT_ITEM exists in the extent tree. btrfs_search_slot can return values bellow zero if an error happened.
Function replay_one_extent currently checks if the search found something (0 returned) and increments the reference, and if not, it seems to evaluate as 'not found'.
Fix the condition by checking if the value was bellow zero and return early.
--- fs/btrfs/tree-log.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/tree-log.c +3 -1
@@ -719,7 +719,9 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,*/ ret =btrfs_lookup_data_extent (fs_info, ins.objectid, ins.offset); -if (ret ==0 ) { +if (ret <0 ) { + goto out; + }else if (ret ==0 ) {btrfs_init_generic_ref (&ref,BTRFS_ADD_DELAYED_REF , ins.objectid, ins.offset,0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 149/260 ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit e4e0633bcadc950b4b4af06c7f1bb7f7e3e86321 ]
KeyPhrasebuffer, Mixin and Mixout modules configuration is described by firmware's basic module configuration structure. There are no extended parameters required. Update functions taking part in building INIT_INSTANCE IPC payload to reflect that.
--- sound/soc/intel/skylake/skl-messages.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
sound/soc/intel/skylake/skl-messages.c +9 -2
@@ -802,9 +802,12 @@ static u16 skl_get_module_param_size(struct skl_dev *skl,case SKL_MODULE_TYPE_BASE_OUTFMT :case SKL_MODULE_TYPE_MIC_SELECT : -case SKL_MODULE_TYPE_KPB :return sizeof (struct skl_base_outfmt_cfg ); +case SKL_MODULE_TYPE_MIXER : +case SKL_MODULE_TYPE_KPB : +return sizeof (struct skl_base_cfg ); +default :/* * return only base cfg when no specific module type is
@@ -857,10 +860,14 @@ static int skl_set_module_format(struct skl_dev *skl,case SKL_MODULE_TYPE_BASE_OUTFMT :case SKL_MODULE_TYPE_MIC_SELECT : -case SKL_MODULE_TYPE_KPB :skl_set_base_outfmt_format (skl, module_config, *param_data);break ; +case SKL_MODULE_TYPE_MIXER : +case SKL_MODULE_TYPE_KPB : +skl_set_base_module_format (skl, module_config, *param_data); +break ; +default :skl_set_base_module_format (skl, module_config, *param_data);break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 150/260 ASoC: Intel: Skylake: Fix passing loadable flag for module
In reply to Greg Kroah-HartmanFrom: Gustaw Lewandowski <[email protected]>
[ Upstream commit c5ed9c547cba1dc1238c6e8a0c290fd62ee6e127 ]
skl_get_module_info() tries to set mconfig->module->loadable before mconfig->module has been assigned thus flag was always set to false and driver did not try to load module binaries.
--- sound/soc/intel/skylake/skl-pcm.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-)
sound/soc/intel/skylake/skl-pcm.c +9 -16
@@ -1333,21 +1333,6 @@ static int skl_get_module_info(struct skl_dev *skl,return -EIO ; } -list_for_each_entry (module, &skl->uuid_list, list) { -if (guid_equal (uuid_mod, &module->uuid)) { - mconfig->id.module_id = module->id; -if (mconfig->module) - mconfig->module->loadable = module->is_loadable; - ret =0 ; -break ; - } - } - -if (ret) -return ret; - - uuid_mod = &module->uuid; - ret = -EIO ;for (i =0 ; i < skl->nr_modules; i++) { skl_module = skl->modules[i]; uuid_tplg = &skl_module->uuid;
@@ -1357,10 +1342,18 @@ static int skl_get_module_info(struct skl_dev *skl,break ; } } +if (skl->nr_modules && ret)return ret; + ret = -EIO ;list_for_each_entry (module, &skl->uuid_list, list) { +if (guid_equal (uuid_mod, &module->uuid)) { + mconfig->id.module_id = module->id; + mconfig->module->loadable = module->is_loadable; + ret =0 ; + } +for (i =0 ; i <MAX_IN_QUEUE ; i++) { pin_id = &mconfig->m_in_pin[i].id;if (guid_equal (&pin_id->mod_uuid, &module->uuid))
@@ -1374,7 +1367,7 @@ static int skl_get_module_info(struct skl_dev *skl, } } -return 0 ; +return ret; }static int skl_populate_modules (struct skl_dev *skl)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 151/260 of: Dont allow __of_attached_node_sysfs() without CONFIG_SYSFS
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 6211e9cb2f8faf7faae0b6caf844bfe9527cc607 ]
Trying to boot without SYSFS, but with OF_DYNAMIC quickly results in a crash:
[ 0.088460] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 [...] [ 0.103927] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc3 #4179 [ 0.105810] Hardware name: linux,dummy-virt (DT) [ 0.107147] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) [ 0.108876] pc : kernfs_find_and_get_ns+0x3c/0x7c [ 0.110244] lr : kernfs_find_and_get_ns+0x3c/0x7c [...] [ 0.134087] Call trace: [ 0.134800] kernfs_find_and_get_ns+0x3c/0x7c [ 0.136054] safe_name+0x4c/0xd0 [ 0.136994] __of_attach_node_sysfs+0xf8/0x124 [ 0.138287] of_core_init+0x90/0xfc [ 0.139296] driver_init+0x30/0x4c [ 0.140283] kernel_init_freeable+0x160/0x1b8 [ 0.141543] kernel_init+0x30/0x140 [ 0.142561] ret_from_fork+0x10/0x18
While not having sysfs isn't a very common option these days, it is still expected that such configuration would work.
Paper over it by bailing out from __of_attach_node_sysfs() if CONFIG_SYSFS isn't enabled.
--- drivers/of/kobj.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/kobj.c +1 -1
@@ -119,7 +119,7 @@ int __of_attach_node_sysfs(struct device_node *np)struct property *pp;int rc; -if (!of_kset) +if (!IS_ENABLED (CONFIG_SYSFS ) || !of_kset)return 0 ; np->kobj.kset = of_kset;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 152/260 mmc: sdhci-of-arasan: Check return value of non-void funtions
In reply to Greg Kroah-HartmanFrom: Manish Narani <[email protected]>
[ Upstream commit 66bad6ed2204fdb78a0a8fb89d824397106a5471 ]
At a couple of places, the return values of the non-void functions were not getting checked. This was reported by the coverity tool. Modify the code to check the return values of the same.
Addresses-Coverity: ("check_return")
--- drivers/mmc/host/sdhci-of-arasan.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/mmc/host/sdhci-of-arasan.c +15 -3
@@ -192,7 +192,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)* through low speeds without power cycling. */ sdhci_set_clock (host, host->max_clk); -phy_power_on (sdhci_arasan->phy); +if (phy_power_on (sdhci_arasan->phy)) { +pr_err ("%s: Cannot power on phy.\n" , +mmc_hostname (host->mmc)); +return ; + } + sdhci_arasan->is_phy_on = true;/*
@@ -228,7 +233,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)msleep (20 );if (ctrl_phy) { -phy_power_on (sdhci_arasan->phy); +if (phy_power_on (sdhci_arasan->phy)) { +pr_err ("%s: Cannot power on phy.\n" , +mmc_hostname (host->mmc)); +return ; + } + sdhci_arasan->is_phy_on = true; } }
@@ -416,7 +426,9 @@ static int sdhci_arasan_suspend(struct device *dev) ret =phy_power_off (sdhci_arasan->phy);if (ret) {dev_err (dev,"Cannot power off phy.\n" ); -sdhci_resume_host (host); +if (sdhci_resume_host (host)) +dev_err (dev,"Cannot resume host.\n" ); +return ret; } sdhci_arasan->is_phy_on = false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 153/260 mmc: rtsx_pci: Fix long reads when clock is prescaled
In reply to Greg Kroah-HartmanFrom: Thomas Hebb <[email protected]>
[ Upstream commit 3ac5e45291f3f0d699a721357380d4593bc2dcb3 ]
For unexplained reasons, the prescaler register for this device needs to be cleared (set to 1) while performing a data read or else the command will hang. This does not appear to affect the real clock rate sent out on the bus, so I assume it's purely to work around a hardware bug.
During normal operation, the prescaler is already set to 1, so nothing needs to be done. However, in "initial mode" (which is used for sub-MHz clock speeds, like the core sets while enumerating cards), it's set to 128 and so we need to reset it during data reads. We currently fail to do this for long reads.
This has no functional affect on the driver's operation currently written, as the MMC core always sets a clock above 1MHz before attempting any long reads. However, the core could conceivably set any clock speed at any time and the driver should still work, so I think this fix is worthwhile.
I personally encountered this issue while performing data recovery on an external chip. My connections had poor signal integrity, so I modified the core code to reduce the clock speed. Without this change, I saw the card enumerate but was unable to actually read any data.
Writes don't seem to work in the situation described above even with this change (and even if the workaround is extended to encompass data write commands). I was not able to find a way to get them working.
--- drivers/mmc/host/rtsx_pci_sdmmc.c | 36 ++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 13 deletions(-)
drivers/mmc/host/rtsx_pci_sdmmc.c +23 -13
@@ -539,9 +539,22 @@ static int sd_write_long_data(struct realtek_pci_sdmmc *host,return 0 ; } +static inline void sd_enable_initial_mode (struct realtek_pci_sdmmc *host) +{ +rtsx_pci_write_register (host->pcr,SD_CFG1 , +SD_CLK_DIVIDE_MASK ,SD_CLK_DIVIDE_128 ); +} + +static inline void sd_disable_initial_mode (struct realtek_pci_sdmmc *host) +{ +rtsx_pci_write_register (host->pcr,SD_CFG1 , +SD_CLK_DIVIDE_MASK ,SD_CLK_DIVIDE_0 ); +} +static int sd_rw_multi (struct realtek_pci_sdmmc *host,struct mmc_request *mrq) {struct mmc_data *data = mrq->data; +int err;if (host->sg_count <0 ) { data->error = host->sg_count;
@@ -550,22 +563,19 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)return data->error; } -if (data->flags &MMC_DATA_READ ) -return sd_read_long_data (host, mrq); +if (data->flags &MMC_DATA_READ ) { +if (host->initial_mode) +sd_disable_initial_mode (host); -return sd_write_long_data (host, mrq); -} + err =sd_read_long_data (host, mrq); -static inline void sd_enable_initial_mode (struct realtek_pci_sdmmc *host) -{ -rtsx_pci_write_register (host->pcr,SD_CFG1 , -SD_CLK_DIVIDE_MASK ,SD_CLK_DIVIDE_128 ); -} +if (host->initial_mode) +sd_enable_initial_mode (host); -static inline void sd_disable_initial_mode (struct realtek_pci_sdmmc *host) -{ -rtsx_pci_write_register (host->pcr,SD_CFG1 , -SD_CLK_DIVIDE_MASK ,SD_CLK_DIVIDE_0 ); +return err; + } + +return sd_write_long_data (host, mrq); } static void sd_normal_rw(struct realtek_pci_sdmmc *host,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 154/260 selftests/bpf: Enlarge select() timeout for test_maps
In reply to Greg Kroah-HartmanFrom: Li Zhijian <[email protected]>
[ Upstream commit 2d82d73da35b72b53fe0d96350a2b8d929d07e42 ]
0Day robot observed that it's easily timeout on a heavy load host.
-------------------
# selftests: bpf: test_maps
# Fork 1024 tasks to 'test_update_delete'
# Fork 1024 tasks to 'test_update_delete'
# Fork 100 tasks to 'test_hashmap'
# Fork 100 tasks to 'test_hashmap_percpu'
# Fork 100 tasks to 'test_hashmap_sizes'
# Fork 100 tasks to 'test_hashmap_walk'
# Fork 100 tasks to 'test_arraymap'
# Fork 100 tasks to 'test_arraymap_percpu'
# Failed sockmap unexpected timeout
not ok 3 selftests: bpf: test_maps # exit=1
# selftests: bpf: test_lru_map
# nr_cpus:8
-------------------
Since this test will be scheduled by 0Day to a random host that could have only a few cpus(2-8), enlarge the timeout to avoid a false NG report.
In practice, i tried to pin it to only one cpu by 'taskset 0x01 ./test_maps', and knew 10S is likely enough, but i still perfer to a larger value 30.
--- tools/testing/selftests/bpf/test_maps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_maps.c +1 -1
@@ -972,7 +972,7 @@ static void test_sockmap(unsigned int tasks, void *data)FD_ZERO (&w);FD_SET (sfd[3 ], &w); - to.tv_sec =1 ; + to.tv_sec =30 ; to.tv_usec =0 ; s =select (sfd[3 ] +1 , &w,NULL ,NULL , &to);if (s ==-1 ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 155/260 mmc: core: Return correct emmc response in case of ioctl error
In reply to Greg Kroah-HartmanFrom: Nishad Kamdar <[email protected]>
[ Upstream commit e72a55f2e5ddcfb3dce0701caf925ce435b87682 ]
When a read/write command is sent via ioctl to the kernel, and the command fails, the actual error response of the emmc is not sent to the user.
IOCTL read/write tests are carried out using commands 17 (Single BLock Read), 24 (Single Block Write), 18 (Multi Block Read), 25 (Multi Block Write)
The tests are carried out on a 64Gb emmc device. All of these tests try to access an "out of range" sector address (0x09B2FFFF).
It is seen that without the patch the response received by the user is not OUT_OF_RANGE error (R1 response 31st bit is not set) as per JEDEC specification. After applying the patch proper response is seen. This is because the function returns without copying the response to the user in case of failure. This patch fixes the issue.
Hence, this memcpy is required whether we get an error response or not. Therefor it is moved up from the current position up to immediately after we have called mmc_wait_for_req().
The test code and the output of only the CMD17 is included in the commit to limit the message length.
CMD17 (Test Code Snippet):
==========================
printf("Forming CMD%d\n", opt_idx);
/* single block read */
cmd.blksz = 512;
cmd.blocks = 1;
cmd.write_flag = 0;
cmd.opcode = 17;
//cmd.arg = atoi(argv[3]);
cmd.arg = 0x09B2FFFF;
/* Expecting response R1B */
cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
memset(data, 0, sizeof(__u8) * 512);
mmc_ioc_cmd_set_data(cmd, data);
printf("Sending CMD%d: ARG[0x%08x]\n", opt_idx, cmd.arg);
if(ioctl(fd, MMC_IOC_CMD, &cmd))
perror("Error");
printf("\nResponse: %08x\n", cmd.response[0]);CMD17 (Output without patch):
=============================
test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17 Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4 Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 0x09B2FFF] Forming CMD17 Sending CMD17: ARG[0x09b2ffff] Error: Connection timed out
Response: 00000000
(Incorrect response)
CMD17 (Output with patch):
==========================
test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17 [sudo] password for test: Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4 Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 09B2FFFF] Forming CMD17 Sending CMD17: ARG[0x09b2ffff] Error: Connection timed out
Response: 80000900
(Correct OUT_OF_ERROR response as per JEDEC specification)
--- drivers/mmc/core/block.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/mmc/core/block.c +1 -2
@@ -591,6 +591,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, }mmc_wait_for_req (card->host, &mrq); +memcpy (&idata->ic.response, cmd.resp,sizeof (cmd.resp));if (cmd.error) { dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
@@ -640,8 +641,6 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,if (idata->ic.postsleep_min_us)usleep_range (idata->ic.postsleep_min_us, idata->ic.postsleep_max_us); -memcpy (&(idata->ic.response), cmd.resp,sizeof (cmd.resp)); -if (idata->rpmb || (cmd.flags &MMC_RSP_R1B ) ==MMC_RSP_R1B ) {/* * Ensure RPMB/R1B command has completed by polling CMD13
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 156/260 cifs: fix wrong release in sess_alloc_buffer() failed path
In reply to Greg Kroah-HartmanFrom: Ding Hui <[email protected]>
[ Upstream commit d72c74197b70bc3c95152f351a568007bffa3e11 ]
smb_buf is allocated by small_smb_init_no_tc(), and buf type is CIFS_SMALL_BUFFER, so we should use cifs_small_buf_release() to release it in failed path.
--- fs/cifs/sess.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/sess.c +1 -1
@@ -610,7 +610,7 @@ sess_alloc_buffer(struct sess_data *sess_data, int wct)return 0 ; out_free_smb_buf: -kfree (smb_buf); +cifs_small_buf_release (smb_buf); sess_data->iov[0 ].iov_base =NULL ; sess_data->iov[0 ].iov_len =0 ; sess_data->buf0_type =CIFS_NO_BUFFER ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 157/260 Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit 2847c46c61486fd8bca9136a6e27177212e78c69 ]
This reverts commit 5d5323a6f3625f101dbfa94ba3ef7706cce38760.
That commit effectively disabled Intel host initiated U1/U2 lpm for devices with periodic endpoints.
Before that commit we disabled host initiated U1/U2 lpm if the exit latency was larger than any periodic endpoint service interval, this is according to xhci spec xhci 1.1 specification section 4.23.5.2
After that commit we incorrectly checked that service interval was smaller than U1/U2 inactivity timeout. This is not relevant, and can't happen for Intel hosts as previously set U1/U2 timeout = 105% * service interval.
Patch claimed it solved cases where devices can't be enumerated because of bandwidth issues. This might be true but it's a side effect of accidentally turning off lpm.
exit latency calculations have been revised since then
--- drivers/usb/host/xhci.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/usb/host/xhci.c +12 -12
@@ -4662,19 +4662,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci, {unsigned long long timeout_ns; -if (xhci->quirks &XHCI_INTEL_HOST ) - timeout_ns =xhci_calculate_intel_u1_timeout (udev, desc); -else - timeout_ns = udev->u1_params.sel; -/* Prevent U1 if service interval is shorter than U1 exit latency */ if (usb_endpoint_xfer_int (desc) ||usb_endpoint_xfer_isoc (desc)) { -if (xhci_service_interval_to_ns (desc) <= timeout_ns) { +if (xhci_service_interval_to_ns (desc) <= udev->u1_params.mel) {dev_dbg (&udev->dev,"Disable U1, ESIT shorter than exit latency\n" );return USB3_LPM_DISABLED ; } } +if (xhci->quirks &XHCI_INTEL_HOST ) + timeout_ns =xhci_calculate_intel_u1_timeout (udev, desc); +else + timeout_ns = udev->u1_params.sel; +/* The U1 timeout is encoded in 1us intervals. * Don't return a timeout of zero, because that's USB3_LPM_DISABLED. */
@@ -4726,19 +4726,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci, {unsigned long long timeout_ns; -if (xhci->quirks &XHCI_INTEL_HOST ) - timeout_ns =xhci_calculate_intel_u2_timeout (udev, desc); -else - timeout_ns = udev->u2_params.sel; -/* Prevent U2 if service interval is shorter than U2 exit latency */ if (usb_endpoint_xfer_int (desc) ||usb_endpoint_xfer_isoc (desc)) { -if (xhci_service_interval_to_ns (desc) <= timeout_ns) { +if (xhci_service_interval_to_ns (desc) <= udev->u2_params.mel) {dev_dbg (&udev->dev,"Disable U2, ESIT shorter than exit latency\n" );return USB3_LPM_DISABLED ; } } +if (xhci->quirks &XHCI_INTEL_HOST ) + timeout_ns =xhci_calculate_intel_u2_timeout (udev, desc); +else + timeout_ns = udev->u2_params.sel; +/* The U2 timeout is encoded in 256us intervals */ timeout_ns =DIV_ROUND_UP_ULL (timeout_ns,256 *1000 );/* If the necessary timeout value is bigger than what we can set in the
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 158/260 usb: musb: musb_dsps: request_irq() after initializing musb
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
[ Upstream commit 7c75bde329d7e2a93cf86a5c15c61f96f1446cdc ]
If IRQ occurs between calling dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev(), then null pointer dereference occurs since glue->musb wasn't initialized yet.
The patch puts initializing of neccesery data before registration of the interrupt handler.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/musb/musb_dsps.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/usb/musb/musb_dsps.c +6 -7
@@ -890,23 +890,22 @@ static int dsps_probe(struct platform_device *pdev)if (!glue->usbss_base)return -ENXIO ; -if (usb_get_dr_mode (&pdev->dev) ==USB_DR_MODE_PERIPHERAL ) { - ret =dsps_setup_optional_vbus_irq (pdev, glue); -if (ret) - goto err_iounmap; - } -platform_set_drvdata (pdev, glue);pm_runtime_enable (&pdev->dev); ret =dsps_create_musb_pdev (glue, pdev);if (ret) goto err; +if (usb_get_dr_mode (&pdev->dev) ==USB_DR_MODE_PERIPHERAL ) { + ret =dsps_setup_optional_vbus_irq (pdev, glue); +if (ret) + goto err; + } +return 0 ; err:pm_runtime_disable (&pdev->dev); -err_iounmap:iounmap (glue->usbss_base);return ret; }
Signature · 1 line
2.30.2