4.14.256-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 4.14.256-rc1 review
This is the start of the stable review cycle for the 4.14.256 release. There are 251 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.256-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.256-rc1
Nadav Amit <[email protected]>
hugetlbfs: flush TLBs correctly after huge_pmd_unshare
Uwe Kleine-König <[email protected]>
usb: max-3421: Use driver data instead of maintaining a list of bound devices
Takashi Iwai <[email protected]>
ASoC: DAPM: Cover regression by kctl change notification fix
Leon Romanovsky <[email protected]>
RDMA/netlink: Add __maybe_unused to static inline in C file
Sven Eckelmann <[email protected]>
batman-adv: Don't always reallocate the fragmentation skb head
Sven Eckelmann <[email protected]>
batman-adv: Reserve needed_*room for fragments
Sven Eckelmann <[email protected]>
batman-adv: Consider fragmentation for needed_headroom
Linus Lüssing <[email protected]>
batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
Linus Lüssing <[email protected]>
batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
Greg Thelen <[email protected]>
perf/core: Avoid put_page() when GUP fails
hongao <[email protected]>
drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
Johan Hovold <[email protected]>
drm/udl: fix control-message timeout
Nguyen Dinh Phi <[email protected]>
cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
Sven Schnelle <[email protected]>
parisc/sticon: fix reverse colors
Nikolay Borisov <[email protected]>
btrfs: fix memory ordering between normal and ordered work functions
Rustam Kovhaev <[email protected]>
mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
Nathan Chancellor <[email protected]>
hexagon: export raw I/O routines for modules
Nicolas Dichtel <[email protected]>
tun: fix bonding active backup with arp monitoring
Alexander Antonov <[email protected]>
perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
Alexander Antonov <[email protected]>
perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
Sohaib Mohamed <[email protected]>
perf bench: Fix two memory leaks detected with ASan
Lin Ma <[email protected]>
NFC: reorder the logic in nfc_{un,}register_device
Lin Ma <[email protected]>
NFC: reorganize the functions in nci_request
Michal Maloszewski <[email protected]>
i40e: Fix NULL ptr dereference on VSI filter sync
Jonathan Davies <[email protected]>
net: virtio_net_hdr_to_skb: count transport header in UFO
Christophe JAILLET <[email protected]>
platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
Randy Dunlap <[email protected]>
mips: lantiq: add support for clk_get_parent()
Randy Dunlap <[email protected]>
mips: bcm63xx: add support for clk_get_parent()
Colin Ian King <[email protected]>
MIPS: generic/yamon-dt: fix uninitialized variable error
Surabhi Boob <[email protected]>
iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
Pavel Skripkin <[email protected]>
net: bnx2x: fix variable dereferenced before check
Vincent Donnefort <[email protected]>
sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
Randy Dunlap <[email protected]>
mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
Randy Dunlap <[email protected]>
sh: define __BIG_ENDIAN for math-emu
Randy Dunlap <[email protected]>
sh: fix kconfig unmet dependency warning for FRAME_POINTER
Lu Wei <[email protected]>
maple: fix wrong return value of maple_bus_init().
Nick Desaulniers <[email protected]>
sh: check return code of request_irq
Michael Ellerman <[email protected]>
powerpc/dcr: Use cmplwi instead of 3-argument cmpli
Chengfeng Ye <[email protected]>
ALSA: gus: fix null pointer dereference on pointer block
Anatolij Gustschin <[email protected]>
powerpc/5200: dts: fix memory node unit name
Mike Christie <[email protected]>
scsi: target: Fix alua_tg_pt_gps_count tracking
Mike Christie <[email protected]>
scsi: target: Fix ordered tag handling
Bart Van Assche <[email protected]>
MIPS: sni: Fix the build
Guanghui Feng <[email protected]>
tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
Yang Yingliang <[email protected]>
usb: host: ohci-tmio: check return value after calling platform_get_resource()
Roger Quadros <[email protected]>
ARM: dts: omap: fix gpmc,mux-add-data type
Guo Zhi <[email protected]>
scsi: advansys: Fix kernel pointer leak
Yang Yingliang <[email protected]>
usb: musb: tusb6010: check return value after calling platform_get_resource()
James Smart <[email protected]>
scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Michal Simek <[email protected]>
arm64: zynqmp: Fix serial compatible string
Thomas Gleixner <[email protected]>
PCI/MSI: Destroy sysfs before freeing entries
Sven Schnelle <[email protected]>
parisc/entry: fix trace test in syscall exit path
Paul Burton <[email protected]>
tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
Shaoying Xu <[email protected]>
ext4: fix lazy initialization next schedule time computation in more granular unit
Pali Rohár <[email protected]>
PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
Vineeth Vijayan <[email protected]>
s390/cio: check the subchannel validity for dev_busid
Michal Hocko <[email protected]>
mm, oom: do not trigger out_of_memory from the #PF
Vasily Averin <[email protected]>
mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
Naveen N. Rao <[email protected]>
powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
Naveen N. Rao <[email protected]>
powerpc/bpf: Validate branch ranges
Naveen N. Rao <[email protected]>
powerpc/lib: Add helper to check if offset is within conditional branch range
Arnd Bergmann <[email protected]>
ARM: 9156/1: drop cc-option fallbacks for architecture selection
Michał Mirosław <[email protected]>
ARM: 9155/1: fix early early_iounmap()
Johan Hovold <[email protected]>
USB: chipidea: fix interrupt deadlock
Eiichi Tsukata <[email protected]>
vsock: prevent unnecessary refcnt inc for nonblocking connect
Chengfeng Ye <[email protected]>
nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
Eric Dumazet <[email protected]>
llc: fix out-of-bound array index in llc_sk_dev_hash()
Miaohe Lin <[email protected]>
mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
Huang Guobin <[email protected]>
bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
Hans de Goede <[email protected]>
ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
Ziyang Xuan <[email protected]>
net: vlan: fix a UAF in vlan_dev_real_dev()
Maxim Kiselev <[email protected]>
net: davinci_emac: Fix interrupt pacing disable
YueHaibing <[email protected]>
xen-pciback: Fix return in pm_ctrl_init()
Christophe JAILLET <[email protected]>
i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
Quinn Tran <[email protected]>
scsi: qla2xxx: Turn off target reset during issue_lip
Jackie Liu <[email protected]>
ar7: fix kernel builds for compiler test
Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
Randy Dunlap <[email protected]>
m68k: set a default value for MEMORY_RESERVE
Lars-Peter Clausen <[email protected]>
dmaengine: dmaengine_desc_callback_valid(): Check for callback_result
Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: fix OOB when mac header was cleared
Geert Uytterhoeven <[email protected]>
auxdisplay: ht16k33: Fix frame buffer device blanking
Geert Uytterhoeven <[email protected]>
auxdisplay: ht16k33: Connect backlight to fbdev
Geert Uytterhoeven <[email protected]>
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
Claudiu Beznea <[email protected]>
dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
Evgeny Novikov <[email protected]>
mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
Jia-Ju Bai <[email protected]>
fs: orangefs: fix error return code of orangefs_revalidate_lookup()
Trond Myklebust <[email protected]>
NFS: Fix deadlocks in nfs_scan_commit_list()
Marek Behún <[email protected]>
PCI: aardvark: Don't spam about PIO Response Status
Alex Xu (Hello71) <[email protected]>
drm/plane-helper: fix uninitialized variable reference
Baptiste Lepers <[email protected]>
pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
Arnaud Pouliquen <[email protected]>
rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
Tom Rix <[email protected]>
apparmor: fix error check
Hans de Goede <[email protected]>
power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
Geert Uytterhoeven <[email protected]>
mips: cm: Convert to bitfield API to fix out-of-bounds access
Anssi Hannula <[email protected]>
serial: xilinx_uartps: Fix race condition causing stuck TX
Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Correct some register default values
Leon Romanovsky <[email protected]>
RDMA/mlx4: Return missed an error if device doesn't support steering
Dan Carpenter <[email protected]>
scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
Jakob Hauser <[email protected]>
power: supply: rt5033_battery: Change voltage values to µV
Dan Carpenter <[email protected]>
usb: gadget: hid: fix error code in do_config()
Andy Shevchenko <[email protected]>
serial: 8250_dw: Drop wrong use of ACPI_PTR()
Christophe Leroy <[email protected]>
video: fbdev: chipsfb: use memset_io() instead of memset()
Dongliang Mu <[email protected]>
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
Christophe JAILLET <[email protected]>
soc/tegra: Fix an error handling path in tegra_powergate_power_up()
Andreas Kemnade <[email protected]>
arm: dts: omap3-gta04a4: accelerometer irq fix
Takashi Iwai <[email protected]>
ALSA: hda: Reduce udelay() at SKL+ position reporting
Dongliang Mu <[email protected]>
JFS: fix memleak in jfs_mount
Jackie Liu <[email protected]>
MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
Tong Zhang <[email protected]>
scsi: dc395: Fix error case unwinding
Peter Rosin <[email protected]>
ARM: dts: at91: tse850: the emac<->phy interface is rmii
Jackie Liu <[email protected]>
ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
Junji Wei <[email protected]>
RDMA/rxe: Fix wrong port_cap_flags
Sukadev Bhattiprolu <[email protected]>
ibmvnic: Process crqs after enabling interrupts
Daniel Jordan <[email protected]>
crypto: pcrypt - Delay write to padata->info
Russell King (Oracle) <[email protected]>
net: phylink: avoid mvneta warning when setting pause parameters
Shyam Sundar S K <[email protected]>
net: amd-xgbe: Toggle PLL settings during rate change
Wang Hai <[email protected]>
libertas: Fix possible memory leak in probe and disconnect
Wang Hai <[email protected]>
libertas_tf: Fix possible memory leak in probe and disconnect
Tiezhu Yang <[email protected]>
samples/kretprobes: Fix return value if register_kretprobe() failed
Mark Rutland <[email protected]>
irq: mips: avoid nested irq_enter()
David Hildenbrand <[email protected]>
s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
Tetsuo Handa <[email protected]>
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
Anders Roxell <[email protected]>
PM: hibernate: fix sparse warnings
Stefan Agner <[email protected]>
phy: micrel: ksz8041nl: do not use power down mode
Jonas Dreßler <[email protected]>
mwifiex: Send DELBA requests according to spec
Nathan Chancellor <[email protected]>
platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
Christophe JAILLET <[email protected]>
mmc: mxs-mmc: disable regulator on error and in the remove function
Jakub Kicinski <[email protected]>
net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
Dan Carpenter <[email protected]>
drm/msm: uninitialized variable in msm_gem_import()
Sven Eckelmann <[email protected]>
ath10k: fix max antenna gain unit
Yang Yingliang <[email protected]>
hwmon: Fix possible memleak in __hwmon_device_register()
Dan Carpenter <[email protected]>
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
Arnd Bergmann <[email protected]>
memstick: avoid out-of-range warning
Dan Carpenter <[email protected]>
b43: fix a lower bounds test
Dan Carpenter <[email protected]>
b43legacy: fix a lower bounds test
Markus Schneider-Pargmann <[email protected]>
hwrng: mtk - Force runtime pm ops for sleep ops
Giovanni Cabiddu <[email protected]>
crypto: qat - disregard spurious PFVF interrupts
Giovanni Cabiddu <[email protected]>
crypto: qat - detect PFVF collision after ACK
Linus Lüssing <[email protected]>
ath9k: Fix potential interrupt storm on queue reset
Anel Orazgaliyeva <[email protected]>
cpuidle: Fix kobject memory leaks in error paths
Colin Ian King <[email protected]>
media: cx23885: Fix snd_card_free call on null card pointer
Kees Cook <[email protected]>
media: si470x: Avoid card name truncation
Christophe JAILLET <[email protected]>
media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
Pavel Skripkin <[email protected]>
media: dvb-usb: fix ununit-value in az6027_rc_query
Waiman Long <[email protected]>
cgroup: Make rebind_subsystems() disable v2 controllers all at once
Sven Schnelle <[email protected]>
parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
Helge Deller <[email protected]>
task_stack: Fix end_of_stack() for architectures with upwards-growing stack
Sven Schnelle <[email protected]>
parisc: fix warning in flush_tlb_all
Yang Yingliang <[email protected]>
spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
Arnd Bergmann <[email protected]>
ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
Stephen Suryaputra <[email protected]>
gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
Masami Hiramatsu <[email protected]>
ARM: clang: Do not rely on lr register for stacktrace
Tetsuo Handa <[email protected]>
smackfs: use __GFP_NOFAIL for smk_cipso_doi()
Johannes Berg <[email protected]>
iwlwifi: mvm: disable RX-diversity in powersave
Ye Bin <[email protected]>
PM: hibernate: Get block device exclusively in swsusp_check()
Zheyu Ma <[email protected]>
mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
Kalesh Singh <[email protected]>
tracing/cfi: Fix cmp_entries_* functions signature mismatch
Lasse Collin <[email protected]>
lib/xz: Validate the value before assigning it to an enum variable
Lasse Collin <[email protected]>
lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
Zheyu Ma <[email protected]>
memstick: r592: Fix a UAF bug when removing the driver
Kees Cook <[email protected]>
leaking_addresses: Always print a trailing newline
André Almeida <[email protected]>
ACPI: battery: Accept charges over the design capacity as full
Tuo Li <[email protected]>
ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
Steven Rostedt (VMware) <[email protected]>
tracefs: Have tracefs directories not set OTH permission bits by default
Anant Thazhemadam <[email protected]>
media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
Rafael J. Wysocki <[email protected]>
ACPICA: Avoid evaluating methods too early during system resume
Randy Dunlap <[email protected]>
ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
Rajat Asthana <[email protected]>
media: mceusb: return without resubmitting URB in case of -EPROTO error.
Nadezda Lutovinova <[email protected]>
media: s5p-mfc: Add checking to s5p_mfc_probe().
Tuo Li <[email protected]>
media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
Ricardo Ribalda <[email protected]>
media: uvcvideo: Set capability in s_param
Zheyu Ma <[email protected]>
media: netup_unidvb: handle interrupt properly according to the firmware
Dirk Bender <[email protected]>
media: mt9p031: Fix corrupted frame after restarting stream
Jonas Dreßler <[email protected]>
mwifiex: Properly initialize private structure on interface type changes
Jonas Dreßler <[email protected]>
mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
Peter Zijlstra <[email protected]>
x86: Increase exception stack sizes
Pawan Gupta <[email protected]>
smackfs: Fix use-after-free in netlbl_catmap_walk()
Peter Zijlstra <[email protected]>
locking/lockdep: Avoid RCU-induced noinstr fail
Aleksander Jan Bajkowski <[email protected]>
MIPS: lantiq: dma: reset correct number of channel
Aleksander Jan Bajkowski <[email protected]>
MIPS: lantiq: dma: add small delay after reset
Barnabás Pőcze <[email protected]>
platform/x86: wmi: do not fail if disabling fails
Wang ShaoBo <[email protected]>
Bluetooth: fix use-after-free error in lock_sock_nested()
Takashi Iwai <[email protected]>
Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
Johan Hovold <[email protected]>
USB: iowarrior: fix control-message timeouts
Wang Hai <[email protected]>
USB: serial: keyspan: fix memleak on probe errors
Pekka Korpinen <[email protected]>
iio: dac: ad5446: Fix ad5622_write() return value
Yang Yingliang <[email protected]>
pinctrl: core: fix possible memory leak in pinctrl_enable()
Zhang Yi <[email protected]>
quota: correct error number in free_dqentry()
Zhang Yi <[email protected]>
quota: check block number when reading the block in quota file
Marek Behún <[email protected]>
PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
Marek Behún <[email protected]>
PCI: aardvark: Fix return value of MSI domain .alloc() method
Pali Rohár <[email protected]>
PCI: aardvark: Do not unmask unused interrupts
Pali Rohár <[email protected]>
PCI: aardvark: Do not clear status bits of masked interrupts
Juergen Gross <[email protected]>
xen/balloon: add late_initcall_sync() for initial ballooning done
Pavel Skripkin <[email protected]>
ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
Takashi Iwai <[email protected]>
ALSA: mixer: oss: Fix racy access to slots
Pali Rohár <[email protected]>
serial: core: Fix initializing and restoring termios speed
Xiaoming Ni <[email protected]>
powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
Henrik Grimler <[email protected]>
power: supply: max17042_battery: use VFSOC for capacity when no rsns
Sebastian Krzyszkowiak <[email protected]>
power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
Eric W. Biederman <[email protected]>
signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
Eric W. Biederman <[email protected]>
signal: Remove the bogus sigkill_pending in ptrace_stop
Alok Prasad <[email protected]>
RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
Benjamin Li <[email protected]>
wcn36xx: handle connection loss indication
Reimar Döffinger <[email protected]>
libata: fix checking of DMA state
Jonas Dreßler <[email protected]>
mwifiex: Read a PCI register after writing the TX ring write pointer
Loic Poulain <[email protected]>
wcn36xx: Fix HT40 capability for 2Ghz band
Austin Kim <[email protected]>
evm: mark evm_fixmode as __ro_after_init
Johan Hovold <[email protected]>
rtl8187: fix control-message timeouts
Ingmar Klein <[email protected]>
PCI: Mark Atheros QCA6174 to avoid bus reset
Johan Hovold <[email protected]>
ath10k: fix division by zero in send path
Johan Hovold <[email protected]>
ath10k: fix control-message timeout
Johan Hovold <[email protected]>
ath6kl: fix control-message timeout
Johan Hovold <[email protected]>
ath6kl: fix division by zero in send path
Johan Hovold <[email protected]>
mwifiex: fix division by zero in fw download path
Eric Badger <[email protected]>
EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
Krzysztof Kozlowski <[email protected]>
regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
Krzysztof Kozlowski <[email protected]>
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
Zev Weiss <[email protected]>
hwmon: (pmbus/lm25066) Add offset coefficients
Filipe Manana <[email protected]>
btrfs: fix lost error handling when replaying directory deletes
Dongli Zhang <[email protected]>
vmxnet3: do not stop tx queues after netif_device_detach()
Walter Stoll <[email protected]>
watchdog: Fix OMAP watchdog early handling
Thomas Perrot <[email protected]>
spi: spl022: fix Microwire full duplex mode
Dongli Zhang <[email protected]>
xen/netfront: stop tx queues during live migration
Lorenz Bauer <[email protected]>
bpf: Prevent increasing bpf_jit_limit above max
Randy Dunlap <[email protected]>
mmc: winbond: don't build on M68K
Arnd Bergmann <[email protected]>
hyperv/vmbus: include linux/bitops.h
Erik Ekman <[email protected]>
sfc: Don't use netif_info before net_device setup
Zheyu Ma <[email protected]>
cavium: Fix return values of the probe function
Dmitry Bogdanov <[email protected]>
scsi: qla2xxx: Fix unmap of already freed sgl
Zheyu Ma <[email protected]>
cavium: Return negative value when pci_alloc_irq_vectors() fails
Sean Christopherson <[email protected]>
x86/irq: Ensure PI wakeup handler is unregistered before module unload
Miklos Szeredi <[email protected]>
fuse: fix page stealing
Takashi Iwai <[email protected]>
ALSA: timer: Unconditionally unlink slave instances, too
Wang Wensheng <[email protected]>
ALSA: timer: Fix use-after-free problem
Austin Kim <[email protected]>
ALSA: synth: missing check for possible NULL after the call to kstrdup
Johan Hovold <[email protected]>
ALSA: line6: fix control and interrupt message timeouts
Johan Hovold <[email protected]>
ALSA: 6fire: fix control and bulk message timeouts
Johan Hovold <[email protected]>
ALSA: ua101: fix division by zero at probe
Sean Young <[email protected]>
media: ite-cir: IR receiver stop working after receive overflow
Dan Carpenter <[email protected]>
tpm: Check for integer overflow in tpm2_map_response_body()
Helge Deller <[email protected]>
parisc: Fix ptrace check on syscall return
Christian Löhle <[email protected]>
mmc: dw_mmc: Dont wait for DRTO on Write RSP error
Jan Kara <[email protected]>
ocfs2: fix data corruption on truncate
Damien Le Moal <[email protected]>
libata: fix read log timeout value
Takashi Iwai <[email protected]>
Input: i8042 - Add quirk for Fujitsu Lifebook T725
Phoenix Huang <[email protected]>
Input: elantench - fix misreporting trackpoint coordinates
Todd Kjos <[email protected]>
binder: use cred instead of task for selinux checks
Todd Kjos <[email protected]>
binder: use euid from cred instead of using task
Mathias Nyman <[email protected]>
xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 7 ++ .../bindings/regulator/samsung,s5m8767.txt | 23 ++--- Makefile | 4 +- arch/arm/Makefile | 22 ++--- arch/arm/boot/dts/at91-tse850-3.dts | 2 +- arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +- arch/arm/boot/dts/omap3-gta04.dtsi | 2 +- arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +- arch/arm/kernel/stacktrace.c | 3 +- arch/arm/mm/Kconfig | 2 +- arch/arm/mm/mmu.c | 4 +- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 +- arch/hexagon/lib/io.c | 4 + arch/ia64/Kconfig.debug | 2 +- arch/m68k/Kconfig.machine | 1 + arch/mips/Kconfig | 4 + arch/mips/bcm63xx/clk.c | 6 ++ arch/mips/generic/yamon-dt.c | 2 +- arch/mips/include/asm/mips-cm.h | 12 +-- arch/mips/kernel/mips-cm.c | 21 ++--- arch/mips/kernel/r2300_fpu.S | 4 +- arch/mips/kernel/syscall.c | 9 -- arch/mips/lantiq/clk.c | 6 ++ arch/mips/lantiq/xway/dma.c | 14 ++- arch/mips/sni/time.c | 4 +- arch/parisc/kernel/entry.S | 4 +- arch/parisc/kernel/smp.c | 19 +++- arch/parisc/mm/init.c | 4 +- arch/powerpc/boot/dts/charon.dts | 2 +- arch/powerpc/boot/dts/digsy_mtc.dts | 2 +- arch/powerpc/boot/dts/lite5200.dts | 2 +- arch/powerpc/boot/dts/lite5200b.dts | 2 +- arch/powerpc/boot/dts/media5200.dts | 2 +- arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +- arch/powerpc/boot/dts/o2d.dts | 2 +- arch/powerpc/boot/dts/o2d.dtsi | 2 +- arch/powerpc/boot/dts/o2dnt2.dts | 2 +- arch/powerpc/boot/dts/o3dnt.dts | 2 +- arch/powerpc/boot/dts/pcm032.dts | 2 +- arch/powerpc/boot/dts/tqm5200.dts | 2 +- arch/powerpc/include/asm/code-patching.h | 1 + arch/powerpc/lib/code-patching.c | 7 +- arch/powerpc/net/bpf_jit.h | 33 ++++--- arch/powerpc/net/bpf_jit_comp64.c | 37 +++++--- arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 3 +- arch/powerpc/sysdev/dcr-low.S | 2 +- arch/s390/mm/gmap.c | 5 +- arch/sh/Kconfig.debug | 1 + arch/sh/include/asm/sfp-machine.h | 8 ++ arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +- arch/x86/events/intel/uncore_snbep.c | 4 + arch/x86/include/asm/page_64_types.h | 2 +- arch/x86/kernel/irq.c | 4 +- crypto/pcrypt.c | 12 ++- drivers/acpi/acpica/acglobal.h | 2 + drivers/acpi/acpica/hwesleep.c | 8 +- drivers/acpi/acpica/hwsleep.c | 11 +-- drivers/acpi/acpica/hwxfsleep.c | 7 ++ drivers/acpi/battery.c | 2 +- drivers/acpi/pmic/intel_pmic.c | 51 +++++----- drivers/android/binder.c | 20 ++-- drivers/ata/libata-core.c | 2 +- drivers/ata/libata-eh.c | 8 ++ drivers/auxdisplay/ht16k33.c | 66 +++++++------ drivers/auxdisplay/img-ascii-lcd.c | 10 ++ drivers/char/hw_random/mtk-rng.c | 9 +- drivers/char/tpm/tpm2-space.c | 3 + drivers/cpuidle/sysfs.c | 5 +- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 13 +++ drivers/crypto/qat/qat_common/adf_vf_isr.c | 6 ++ drivers/dma/at_xdmac.c | 2 +- drivers/dma/dmaengine.h | 2 +- drivers/edac/sb_edac.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 1 + drivers/gpu/drm/drm_plane_helper.c | 1 - drivers/gpu/drm/msm/msm_gem.c | 4 +- drivers/gpu/drm/udl/udl_connector.c | 2 +- drivers/hv/hyperv_vmbus.h | 1 + drivers/hwmon/hwmon.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 23 +++++ drivers/i2c/busses/i2c-xlr.c | 6 +- drivers/iio/dac/ad5446.c | 9 +- drivers/infiniband/hw/mlx4/qp.c | 4 +- drivers/infiniband/hw/qedr/verbs.c | 15 +-- drivers/infiniband/sw/rxe/rxe_param.h | 2 +- drivers/input/mouse/elantech.c | 13 +++ drivers/input/serio/i8042-x86ia64io.h | 14 +++ drivers/irqchip/irq-bcm6345-l1.c | 2 +- drivers/irqchip/irq-s3c24xx.c | 22 ++++- drivers/media/i2c/mt9p031.c | 28 +++++- drivers/media/pci/cx23885/cx23885-alsa.c | 3 +- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 27 +++--- drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 +- drivers/media/platform/s5p-mfc/s5p_mfc.c | 6 +- drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- drivers/media/radio/si470x/radio-si470x-usb.c | 2 +- drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/usb/dvb-usb/az6027.c | 1 + drivers/media/usb/dvb-usb/dibusb-common.c | 2 +- drivers/media/usb/uvc/uvc_v4l2.c | 7 +- drivers/memory/fsl_ifc.c | 13 ++- drivers/memstick/core/ms_block.c | 2 +- drivers/memstick/host/jmb38x_ms.c | 2 +- drivers/memstick/host/r592.c | 8 +- drivers/mmc/host/Kconfig | 2 +- drivers/mmc/host/dw_mmc.c | 3 +- drivers/mmc/host/mxs-mmc.c | 10 ++ drivers/mtd/spi-nor/hisi-sfc.c | 1 - drivers/net/bonding/bond_sysfs_slave.c | 36 +++---- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 ++ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 20 +++- .../net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +- drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 +- drivers/net/ethernet/ibm/ibmvnic.c | 3 + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 +- drivers/net/ethernet/sfc/ptp.c | 4 +- drivers/net/ethernet/sfc/siena_sriov.c | 2 +- drivers/net/ethernet/ti/davinci_emac.c | 16 +++- drivers/net/phy/micrel.c | 5 +- drivers/net/phy/phylink.c | 2 +- drivers/net/tun.c | 5 + drivers/net/vmxnet3/vmxnet3_drv.c | 1 - drivers/net/wireless/ath/ath10k/mac.c | 6 +- drivers/net/wireless/ath/ath10k/usb.c | 7 +- drivers/net/wireless/ath/ath10k/wmi.h | 3 + drivers/net/wireless/ath/ath6kl/usb.c | 7 +- drivers/net/wireless/ath/ath9k/main.c | 4 +- drivers/net/wireless/ath/dfs_pattern_detector.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 4 +- drivers/net/wireless/ath/wcn36xx/smd.c | 44 ++++++--- drivers/net/wireless/broadcom/b43/phy_g.c | 2 +- drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 + drivers/net/wireless/marvell/libertas/if_usb.c | 2 + drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 + drivers/net/wireless/marvell/mwifiex/11n.c | 5 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +++---- drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++ drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++ drivers/net/wireless/marvell/mwl8k.c | 2 +- .../net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +-- drivers/net/xen-netfront.c | 8 ++ drivers/nfc/pn533/pn533.c | 6 +- drivers/pci/host/pci-aardvark.c | 23 +++-- drivers/pci/msi.c | 24 ++--- drivers/pci/quirks.c | 1 + drivers/pinctrl/core.c | 2 + drivers/platform/x86/hp_accel.c | 2 + drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/platform/x86/wmi.c | 9 +- drivers/power/supply/bq27xxx_battery_i2c.c | 3 +- drivers/power/supply/max17042_battery.c | 8 +- drivers/power/supply/rt5033_battery.c | 2 +- drivers/regulator/s5m8767.c | 21 ++--- drivers/s390/cio/css.c | 4 +- drivers/scsi/advansys.c | 4 +- drivers/scsi/csiostor/csio_lnode.c | 2 +- drivers/scsi/dc395x.c | 1 + drivers/scsi/lpfc/lpfc_sli.c | 1 + drivers/scsi/qla2xxx/qla_gbl.h | 2 - drivers/scsi/qla2xxx/qla_mr.c | 23 ----- drivers/scsi/qla2xxx/qla_os.c | 27 +----- drivers/scsi/qla2xxx/qla_target.c | 14 +-- drivers/sh/maple/maple.c | 5 +- drivers/soc/tegra/pmc.c | 2 +- drivers/spi/spi-bcm-qspi.c | 5 +- drivers/spi/spi-pl022.c | 5 +- drivers/target/target_core_alua.c | 1 - drivers/target/target_core_device.c | 2 + drivers/target/target_core_internal.h | 1 + drivers/target/target_core_transport.c | 76 ++++++++++----- drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/serial_core.c | 16 +++- drivers/tty/serial/xilinx_uartps.c | 3 +- drivers/tty/tty_buffer.c | 3 + drivers/usb/chipidea/core.c | 19 +++- drivers/usb/gadget/legacy/hid.c | 4 +- drivers/usb/host/max3421-hcd.c | 25 +---- drivers/usb/host/ohci-tmio.c | 2 +- drivers/usb/host/xhci-hub.c | 3 +- drivers/usb/misc/iowarrior.c | 8 +- drivers/usb/musb/tusb6010.c | 5 + drivers/usb/serial/keyspan.c | 15 ++- drivers/video/console/sticon.c | 12 +-- drivers/video/fbdev/chipsfb.c | 2 +- drivers/watchdog/Kconfig | 2 +- drivers/watchdog/f71808e_wdt.c | 4 +- drivers/watchdog/omap_wdt.c | 6 +- drivers/xen/balloon.c | 86 ++++++++++++----- drivers/xen/xen-pciback/conf_space_capability.c | 2 +- fs/btrfs/async-thread.c | 14 +++ fs/btrfs/tree-log.c | 4 +- fs/ext4/super.c | 9 +- fs/fuse/dev.c | 14 ++- fs/jfs/jfs_mount.c | 51 +++++----- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfs/write.c | 17 +--- fs/ocfs2/file.c | 8 +- fs/orangefs/dcache.c | 4 +- fs/quota/quota_tree.c | 15 +++ fs/tracefs/inode.c | 3 +- include/asm-generic/tlb.h | 6 ++ include/linux/console.h | 2 + include/linux/filter.h | 1 + include/linux/libata.h | 2 +- include/linux/lsm_hooks.h | 28 +++--- include/linux/rpmsg.h | 2 +- include/linux/sched/task_stack.h | 4 + include/linux/security.h | 28 +++--- include/linux/virtio_net.h | 7 +- include/net/llc.h | 4 +- include/rdma/rdma_netlink.h | 2 +- include/target/target_core_base.h | 6 +- include/uapi/linux/pci_regs.h | 6 ++ kernel/bpf/core.c | 4 +- kernel/cgroup/cgroup.c | 31 ++++++- kernel/events/core.c | 10 +- kernel/locking/lockdep.c | 2 +- kernel/power/swap.c | 7 +- kernel/sched/core.c | 3 + kernel/signal.c | 19 +--- kernel/trace/trace.c | 62 ++++++++++--- kernel/trace/tracing_map.c | 40 ++++---- lib/decompress_unxz.c | 2 +- lib/xz/xz_dec_lzma2.c | 21 ++++- lib/xz/xz_dec_stream.c | 6 +- mm/hugetlb.c | 19 ++++ mm/oom_kill.c | 23 ++--- mm/slab.h | 2 +- mm/zsmalloc.c | 7 +- net/8021q/vlan.c | 3 - net/8021q/vlan_dev.c | 3 + net/batman-adv/bridge_loop_avoidance.c | 103 +++++++++++++++++---- net/batman-adv/fragmentation.c | 26 ++++-- net/batman-adv/hard-interface.c | 3 + net/batman-adv/multicast.c | 31 +++++++ net/batman-adv/multicast.h | 15 +++ net/batman-adv/soft-interface.c | 5 +- net/bluetooth/l2cap_sock.c | 10 +- net/bluetooth/sco.c | 24 +++-- net/core/stream.c | 3 - net/core/sysctl_net_core.c | 2 +- net/ipv6/addrconf.c | 3 + net/netfilter/nfnetlink_queue.c | 2 +- net/nfc/core.c | 32 ++++--- net/nfc/nci/core.c | 11 ++- net/vmw_vsock/af_vsock.c | 2 + net/wireless/util.c | 1 + samples/kprobes/kretprobe_example.c | 2 +- scripts/leaking_addresses.pl | 3 +- security/apparmor/label.c | 4 +- security/integrity/evm/evm_main.c | 2 +- security/security.c | 14 +-- security/selinux/hooks.c | 31 +++---- security/smack/smackfs.c | 11 ++- sound/core/oss/mixer_oss.c | 43 +++++++-- sound/core/timer.c | 17 ++-- sound/isa/gus/gus_dma.c | 2 + sound/pci/hda/hda_intel.c | 28 +++++- sound/soc/codecs/cs42l42.c | 9 +- sound/soc/soc-dapm.c | 29 ++++-- sound/synth/emux/emux.c | 2 +- sound/usb/6fire/comm.c | 2 +- sound/usb/6fire/firmware.c | 6 +- sound/usb/line6/driver.c | 14 +-- sound/usb/line6/driver.h | 2 +- sound/usb/line6/podhd.c | 6 +- sound/usb/line6/toneport.c | 2 +- sound/usb/misc/ua101.c | 4 +- tools/perf/bench/sched-messaging.c | 4 + 275 files changed, 1724 insertions(+), 915 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/251 xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
From: Mathias Nyman <[email protected]>
commit e1959faf085b004e6c3afaaaa743381f00e7c015 upstream.
Some USB 3.1 enumeration issues were reported after the hub driver removed the minimum 100ms limit for the power-on-good delay.
Since commit 90d28fb53d4a ("usb: core: reduce power-on-good delay time of root hub") the hub driver sets the power-on-delay based on the bPwrOn2PwrGood value in the hub descriptor.
xhci driver has a 20ms bPwrOn2PwrGood value for both roothubs based on xhci spec section 5.4.8, but it's clearly not enough for the USB 3.1 devices, causing enumeration issues.
Tests indicate full 100ms delay is needed.
--- drivers/usb/host/xhci-hub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-hub.c +2 -1
@@ -174,7 +174,6 @@ static void xhci_common_hub_descriptor(s {u16 temp; - desc->bPwrOn2PwrGood =10 ;/* xhci section 5.4.9 says 20ms max */ desc->bHubContrCurrent =0 ; desc->bNbrPorts = ports;
@@ -208,6 +207,7 @@ static void xhci_usb2_hub_descriptor(str desc->bDescriptorType =USB_DT_HUB ; temp =1 + (ports /8 ); desc->bDescLength =USB_DT_HUB_NONVAR_SIZE +2 * temp; + desc->bPwrOn2PwrGood =10 ;/* xhci section 5.4.8 says 20ms */ /* The Device Removable bits are reported on a byte granularity. * If the port doesn't exist within that byte, the bit is set to 0.
@@ -258,6 +258,7 @@ static void xhci_usb3_hub_descriptor(strxhci_common_hub_descriptor (xhci, desc, ports); desc->bDescriptorType =USB_DT_SS_HUB ; desc->bDescLength =USB_DT_SS_HUB_SIZE ; + desc->bPwrOn2PwrGood =50 ;/* usb 3.1 may fail if less than 100ms */ /* header decode latency should be zero for roothubs, * see section 4.23.5.2.
Greg Kroah-Hartman
maintainerPATCH 2/251 binder: use euid from cred instead of using task
In reply to Greg Kroah-HartmanFrom: Todd Kjos <[email protected]>
commit 29bc22ac5e5bc63275e850f0c8fc549e3d0e306b upstream.
Save the 'struct cred' associated with a binder process at initial open to avoid potential race conditions when converting to an euid.
Set a transaction's sender_euid from the 'struct cred' saved at binder_open() instead of looking up the euid from the binder proc's 'struct task'. This ensures the euid is associated with the security context that of the task that opened binder.
--- drivers/android/binder.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/android/binder.c +7 -1
@@ -484,6 +484,9 @@ enum binder_deferred_state {* @files files_struct for process * (protected by @files_lock) * @files_lock mutex to protect @files +* @cred struct cred associated with the `struct file` +* in binder_open() +* (invariant after initialized) * @deferred_work_node: element for binder_deferred_list * (protected by binder_deferred_lock) * @deferred_work: bitmap of deferred work to perform
@@ -532,6 +535,7 @@ struct binder_proc {struct task_struct *tsk;struct files_struct *files;struct mutex files_lock; +const struct cred *cred;struct hlist_node deferred_work_node;int deferred_work;bool is_dead;
@@ -2890,7 +2894,7 @@ static void binder_transaction(struct bi t->from = thread; else t->from = NULL; - t->sender_euid =task_euid (proc->tsk); + t->sender_euid = proc->cred->euid; t->to_proc = target_proc; t->to_thread = target_thread; t->code = tr->code;
@@ -4261,6 +4265,7 @@ static void binder_free_proc(struct bindBUG_ON (!list_empty (&proc->delivered_death));binder_alloc_deferred_release (&proc->alloc);put_task_struct (proc->tsk); +put_cred (proc->cred);binder_stats_deleted (BINDER_STAT_PROC );kfree (proc); }
@@ -4717,6 +4722,7 @@ static int binder_open(struct inode *nodget_task_struct (current->group_leader); proc->tsk = current->group_leader;mutex_init (&proc->files_lock); + proc->cred =get_cred (filp->f_cred);INIT_LIST_HEAD (&proc->todo); proc->default_priority =task_nice (current); binder_dev = container_of(filp->private_data, struct binder_device,
Greg Kroah-Hartman
maintainerPATCH 3/251 binder: use cred instead of task for selinux checks
In reply to Greg Kroah-HartmanFrom: Todd Kjos <[email protected]>
commit 52f88693378a58094c538662ba652aff0253c4fe upstream.
Since binder was integrated with selinux, it has passed 'struct task_struct' associated with the binder_proc to represent the source and target of transactions. The conversion of task to SID was then done in the hook implementations. It turns out that there are race conditions which can result in an incorrect security context being used.
Fix by using the 'struct cred' saved during binder_open and pass it to the selinux subsystem.
--- drivers/android/binder.c | 12 ++++++------ include/linux/lsm_hooks.h | 28 ++++++++++++++-------------- include/linux/security.h | 28 ++++++++++++++-------------- security/security.c | 14 +++++++------- security/selinux/hooks.c | 31 +++++++++++++------------------ 5 files changed, 54 insertions(+), 59 deletions(-)
drivers/android/binder.c +6 -6
@@ -2285,7 +2285,7 @@ static int binder_translate_binder(struc ret = -EINVAL ; goto done; } -if (security_binder_transfer_binder (proc->tsk, target_proc->tsk)) { +if (security_binder_transfer_binder (proc->cred, target_proc->cred)) { ret = -EPERM ; goto done; }
@@ -2331,7 +2331,7 @@ static int binder_translate_handle(struc proc->pid, thread->pid, fp->handle);return -EINVAL ; } -if (security_binder_transfer_binder (proc->tsk, target_proc->tsk)) { +if (security_binder_transfer_binder (proc->cred, target_proc->cred)) { ret = -EPERM ; goto done; }
@@ -2415,7 +2415,7 @@ static int binder_translate_fd(int fd, ret = -EBADF ; goto err_fget; } - ret =security_binder_transfer_file (proc->tsk, target_proc->tsk, file); + ret =security_binder_transfer_file (proc->cred, target_proc->cred, file);if (ret <0 ) { ret = -EPERM ; goto err_security;
@@ -2802,8 +2802,8 @@ static void binder_transaction(struct bi return_error_line = __LINE__; goto err_invalid_target_handle; } -if (security_binder_transaction (proc->tsk, - target_proc->tsk) <0 ) { +if (security_binder_transaction (proc->cred, + target_proc->cred) <0 ) { return_error =BR_FAILED_REPLY ; return_error_param = -EPERM ; return_error_line = __LINE__;
@@ -4469,7 +4469,7 @@ static int binder_ioctl_set_ctx_mgr(stru ret = -EBUSY ; goto out; } - ret =security_binder_set_context_mgr (proc->tsk); + ret =security_binder_set_context_mgr (proc->cred);if (ret <0 ) goto out;if (uid_valid (context->binder_context_mgr_uid)) {
include/linux/lsm_hooks.h +14 -14
@@ -1170,22 +1170,22 @@* * @binder_set_context_mgr: * Check whether @mgr is allowed to be the binder context manager. -* @mgr contains the task_struct for the task being registered. +* @mgr contains the struct cred for the current binder process. * Return 0 if permission is granted. * @binder_transaction: * Check whether @from is allowed to invoke a binder transaction call * to @to. -* @from contains the task_struct for the sending task. -* @to contains the task_struct for the receiving task. +* @from contains the struct cred for the sending process. +* @to contains the struct cred for the receiving process. * @binder_transfer_binder: * Check whether @from is allowed to transfer a binder reference to @to. -* @from contains the task_struct for the sending task. -* @to contains the task_struct for the receiving task. +* @from contains the struct cred for the sending process. +* @to contains the struct cred for the receiving process. * @binder_transfer_file: * Check whether @from is allowed to transfer @file to @to. -* @from contains the task_struct for the sending task. +* @from contains the struct cred for the sending process. * @file contains the struct file being transferred. -* @to contains the task_struct for the receiving task. +* @to contains the struct cred for the receiving process. * * @ptrace_access_check: * Check permission before allowing the current process to trace the
@@ -1353,13 +1353,13 @@* @ctxlen points to the place to put the length of @ctx. */ union security_list_options { -int (*binder_set_context_mgr)(struct task_struct *mgr); -int (*binder_transaction)(struct task_struct *from, -struct task_struct *to); -int (*binder_transfer_binder)(struct task_struct *from, -struct task_struct *to); -int (*binder_transfer_file)(struct task_struct *from, -struct task_struct *to, +int (*binder_set_context_mgr)(const struct cred *mgr); +int (*binder_transaction)(const struct cred *from, +const struct cred *to); +int (*binder_transfer_binder)(const struct cred *from, +const struct cred *to); +int (*binder_transfer_file)(const struct cred *from, +const struct cred *to,struct file *file); int (*ptrace_access_check)(struct task_struct *child,
include/linux/security.h +14 -14
@@ -197,13 +197,13 @@ static inline void security_free_mnt_optextern int security_init (void );/* Security operations */ -int security_binder_set_context_mgr (struct task_struct *mgr); -int security_binder_transaction (struct task_struct *from, -struct task_struct *to); -int security_binder_transfer_binder (struct task_struct *from, -struct task_struct *to); -int security_binder_transfer_file (struct task_struct *from, -struct task_struct *to,struct file *file); +int security_binder_set_context_mgr (const struct cred *mgr); +int security_binder_transaction (const struct cred *from, +const struct cred *to); +int security_binder_transfer_binder (const struct cred *from, +const struct cred *to); +int security_binder_transfer_file (const struct cred *from, +const struct cred *to,struct file *file);int security_ptrace_access_check (struct task_struct *child,unsigned int mode);int security_ptrace_traceme (struct task_struct *parent); int security_capget(struct task_struct *target,
@@ -424,25 +424,25 @@ static inline int security_init(void)return 0 ; } -static inline int security_binder_set_context_mgr (struct task_struct *mgr) +static inline int security_binder_set_context_mgr (const struct cred *mgr) {return 0 ; } -static inline int security_binder_transaction (struct task_struct *from, -struct task_struct *to) +static inline int security_binder_transaction (const struct cred *from, +const struct cred *to) {return 0 ; } -static inline int security_binder_transfer_binder (struct task_struct *from, -struct task_struct *to) +static inline int security_binder_transfer_binder (const struct cred *from, +const struct cred *to) {return 0 ; } -static inline int security_binder_transfer_file (struct task_struct *from, -struct task_struct *to, +static inline int security_binder_transfer_file (const struct cred *from, +const struct cred *to,struct file *file) {return 0 ;
security/security.c +7 -7
@@ -222,25 +222,25 @@ EXPORT_SYMBOL(unregister_lsm_notifier);/* Security operations */ -int security_binder_set_context_mgr (struct task_struct *mgr) +int security_binder_set_context_mgr (const struct cred *mgr) {return call_int_hook (binder_set_context_mgr,0 , mgr); } -int security_binder_transaction (struct task_struct *from, -struct task_struct *to) +int security_binder_transaction (const struct cred *from, +const struct cred *to) {return call_int_hook (binder_transaction,0 , from, to); } -int security_binder_transfer_binder (struct task_struct *from, -struct task_struct *to) +int security_binder_transfer_binder (const struct cred *from, +const struct cred *to) {return call_int_hook (binder_transfer_binder,0 , from, to); } -int security_binder_transfer_file (struct task_struct *from, -struct task_struct *to,struct file *file) +int security_binder_transfer_file (const struct cred *from, +const struct cred *to,struct file *file) {return call_int_hook (binder_transfer_file,0 , from, to, file); }
security/selinux/hooks.c +13 -18
@@ -2136,21 +2136,18 @@ static inline u32 open_file_to_av(struct/* Hook functions begin here. */ -static int selinux_binder_set_context_mgr (struct task_struct *mgr) +static int selinux_binder_set_context_mgr (const struct cred *mgr) { -u32 mysid =current_sid (); -u32 mgrsid =task_sid (mgr); - -return avc_has_perm (mysid, mgrsid,SECCLASS_BINDER , +return avc_has_perm (current_sid (),cred_sid (mgr),SECCLASS_BINDER ,BINDER__SET_CONTEXT_MGR ,NULL ); } -static int selinux_binder_transaction (struct task_struct *from, -struct task_struct *to) +static int selinux_binder_transaction (const struct cred *from, +const struct cred *to) {u32 mysid =current_sid (); -u32 fromsid =task_sid (from); -u32 tosid =task_sid (to); +u32 fromsid =cred_sid (from); +u32 tosid =cred_sid (to);int rc;if (mysid != fromsid) {
@@ -2164,21 +2161,19 @@ static int selinux_binder_transaction(st NULL); } -static int selinux_binder_transfer_binder (struct task_struct *from, -struct task_struct *to) +static int selinux_binder_transfer_binder (const struct cred *from, +const struct cred *to) { -u32 fromsid =task_sid (from); -u32 tosid =task_sid (to); - -return avc_has_perm (fromsid, tosid,SECCLASS_BINDER ,BINDER__TRANSFER , +return avc_has_perm (cred_sid (from),cred_sid (to), +SECCLASS_BINDER ,BINDER__TRANSFER ,NULL ); } -static int selinux_binder_transfer_file (struct task_struct *from, -struct task_struct *to, +static int selinux_binder_transfer_file (const struct cred *from, +const struct cred *to,struct file *file) { -u32 sid =task_sid (to); +u32 sid =cred_sid (to);struct file_security_struct *fsec = file->f_security;struct dentry *dentry = file->f_path.dentry;struct inode_security_struct *isec;
Greg Kroah-Hartman
maintainerPATCH 4/251 Input: elantench - fix misreporting trackpoint coordinates
In reply to Greg Kroah-HartmanFrom: Phoenix Huang <[email protected]>
commit be896bd3b72b44126c55768f14c22a8729b0992e upstream.
Some firmwares occasionally report bogus data from trackpoint, with X or Y displacement being too large (outside of [-127, 127] range). Let's drop such packets so that we do not generate jumps.
--- drivers/input/mouse/elantech.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/input/mouse/elantech.c +13 -0
@@ -431,6 +431,19 @@ static void elantech_report_trackpoint(scase 0x16008020U :case 0x26800010U :case 0x36808000U : + +/* +* This firmware misreport coordinates for trackpoint +* occasionally. Discard packets outside of [-127, 127] range +* to prevent cursor jumps. +*/ +if (packet[4 ] ==0x80 || packet[5 ] ==0x80 || + packet[1 ] >>7 == packet[4 ] >>7 || + packet[2 ] >>7 == packet[5 ] >>7 ) { +elantech_debug ("discarding packet [%6ph]\n" , packet); +break ; + + } x = packet[4 ] - (int )((packet[1 ]^0x80 ) <<1 ); y = (int )((packet[2 ]^0x80 ) <<1 ) - packet[5 ];
Greg Kroah-Hartman
maintainerPATCH 5/251 Input: i8042 - Add quirk for Fujitsu Lifebook T725
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 16e28abb7290c4ca3b3a0f333ba067f34bb18c86 upstream.
Fujitsu Lifebook T725 laptop requires, like a few other similar models, the nomux and notimeout options to probe the touchpad properly. This patch adds the corresponding quirk entries.
--- drivers/input/serio/i8042-x86ia64io.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +14 -0
@@ -277,6 +277,13 @@ static const struct dmi_system_id __init }, }, { +/* Fujitsu Lifebook T725 laptop */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), + }, + }, + {/* Fujitsu Lifebook U745 */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
@@ -845,6 +852,13 @@ static const struct dmi_system_id __init }, }, { +/* Fujitsu Lifebook T725 laptop */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), + }, + }, + {/* Fujitsu U574 laptop */ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ .matches = {
Greg Kroah-Hartman
maintainerPATCH 6/251 libata: fix read log timeout value
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit 68dbbe7d5b4fde736d104cbbc9a2fce875562012 upstream.
Some ATA drives are very slow to respond to READ_LOG_EXT and READ_LOG_DMA_EXT commands issued from ata_dev_configure() when the device is revalidated right after resuming a system or inserting the ATA adapter driver (e.g. ahci). The default 5s timeout (ATA_EH_CMD_DFL_TIMEOUT) used for these commands is too short, causing errors during the device configuration. Ex:
...
ata9: SATA max UDMA/133 abar m524288@0x9d200000 port 0x9d200400 irq 209
ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300) ata9.00: ATA-9: XXX XXXXXXXXXXXXXXX, XXXXXXXX, max UDMA/133 ata9.00: qc timeout (cmd 0x2f)
ata9.00: Read log page 0x00 failed, Emask 0x4
ata9.00: Read log page 0x00 failed, Emask 0x40
ata9.00: NCQ Send/Recv Log not supported
ata9.00: Read log page 0x08 failed, Emask 0x40
ata9.00: 27344764928 sectors, multi 16: LBA48 NCQ (depth 32), AA ata9.00: Read log page 0x00 failed, Emask 0x40
ata9.00: ATA Identify Device Log not supported
ata9.00: failed to set xfermode (err_mask=0x40)
ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300) ata9.00: configured for UDMA/133
...
The timeout error causes a soft reset of the drive link, followed in most cases by a successful revalidation as that give enough time to the drive to become fully ready to quickly process the read log commands. However, in some cases, this also fails resulting in the device being dropped.
Fix this by using adding the ata_eh_revalidate_timeouts entries for the READ_LOG_EXT and READ_LOG_DMA_EXT commands. This defines a timeout increased to 15s, retriable one time.
--- drivers/ata/libata-eh.c | 8 ++++++++ include/linux/libata.h | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-)
drivers/ata/libata-eh.c +8 -0
@@ -114,6 +114,12 @@ static const unsigned long ata_eh_identi ULONG_MAX, }; +static const unsigned long ata_eh_revalidate_timeouts[] = { +15000 ,/* Some drives are slow to read log pages when waking-up */ +15000 ,/* combined time till here is enough even for media access */ +ULONG_MAX , +}; +static const unsigned long ata_eh_flush_timeouts[] = {15000 ,/* be generous with flush */ 15000 ,/* ditto */
@@ -150,6 +156,8 @@ static const struct ata_eh_cmd_timeout_e ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = { { .commands = CMDS(ATA_CMD_ID_ATA, ATA_CMD_ID_ATAPI), .timeouts = ata_eh_identify_timeouts, }, + { .commands = CMDS(ATA_CMD_READ_LOG_EXT, ATA_CMD_READ_LOG_DMA_EXT), + .timeouts = ata_eh_revalidate_timeouts, }, { .commands = CMDS(ATA_CMD_READ_NATIVE_MAX, ATA_CMD_READ_NATIVE_MAX_EXT), .timeouts = ata_eh_other_timeouts, }, { .commands = CMDS(ATA_CMD_SET_MAX, ATA_CMD_SET_MAX_EXT),
include/linux/libata.h +1 -1
@@ -409,7 +409,7 @@ enum {/* This should match the actual table size of * ata_eh_cmd_timeout_table in libata-eh.c. */ - ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 6, + ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7,/* Horkage types. May be set by libata or controller on drives (some horkage may be drive/controller pair dependent */
Greg Kroah-Hartman
maintainerPATCH 7/251 ocfs2: fix data corruption on truncate
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 839b63860eb3835da165642923120d305925561d upstream.
Patch series "ocfs2: Truncate data corruption fix".
As further testing has shown, commit 5314454ea3f ("ocfs2: fix data corruption after conversion from inline format") didn't fix all the data corruption issues the customer started observing after 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") This time I have tracked them down to two bugs in ocfs2 truncation code.
One bug (truncating page cache before clearing tail cluster and setting i_size) could cause data corruption even before 6dbf7bb55598, but before that commit it needed a race with page fault, after 6dbf7bb55598 it started to be pretty deterministic.
Another bug (zeroing pages beyond old i_size) used to be harmless inefficiency before commit 6dbf7bb55598. But after commit 6dbf7bb55598 in combination with the first bug it resulted in deterministic data corruption.
Although fixing only the first problem is needed to stop data corruption, I've fixed both issues to make the code more robust.
This patch (of 2):
ocfs2_truncate_file() did unmap invalidate page cache pages before zeroing partial tail cluster and setting i_size. Thus some pages could be left (and likely have left if the cluster zeroing happened) in the page cache beyond i_size after truncate finished letting user possibly see stale data once the file was extended again. Also the tail cluster zeroing was not guaranteed to finish before truncate finished causing possible stale data exposure. The problem started to be particularly easy to hit after commit 6dbf7bb55598 "fs: Don't invalidate page buffers in block_write_full_page()" stopped invalidation of pages beyond i_size from page writeback path.
Fix these problems by unmapping and invalidating pages in the page cache after the i_size is reduced and tail cluster is zeroed out.
--- fs/ocfs2/file.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ocfs2/file.c +6 -2
@@ -490,10 +490,11 @@ int ocfs2_truncate_file(struct inode *in* greater than page size, so we have to truncate them * anyway. */ -unmap_mapping_range (inode->i_mapping, new_i_size +PAGE_SIZE -1 ,0 ,1 ); -truncate_inode_pages (inode->i_mapping, new_i_size);if (OCFS2_I (inode)->ip_dyn_features &OCFS2_INLINE_DATA_FL ) { +unmap_mapping_range (inode->i_mapping, + new_i_size +PAGE_SIZE -1 ,0 ,1 ); +truncate_inode_pages (inode->i_mapping, new_i_size); status =ocfs2_truncate_inline (inode, di_bh, new_i_size,i_size_read (inode),1 );if (status)
@@ -512,6 +513,9 @@ int ocfs2_truncate_file(struct inode *in goto bail_unlock_sem; } +unmap_mapping_range (inode->i_mapping, new_i_size +PAGE_SIZE -1 ,0 ,1 ); +truncate_inode_pages (inode->i_mapping, new_i_size); + status =ocfs2_commit_truncate (osb, inode, di_bh);if (status <0 ) {mlog_errno (status);
Greg Kroah-Hartman
maintainerPATCH 8/251 mmc: dw_mmc: Dont wait for DRTO on Write RSP error
In reply to Greg Kroah-HartmanFrom: Christian Löhle <[email protected]>
commit 43592c8736e84025d7a45e61a46c3fa40536a364 upstream.
Only wait for DRTO on reads, otherwise the driver hangs.
The driver prevents sending CMD12 on response errors like CRCs. According to the comment this is because some cards have problems with this during the UHS tuning sequence. Unfortunately this workaround currently also applies for any command with data. On reads this will set the drto timer, which then triggers after a while. On writes this will not set any timer and the tasklet will not be scheduled again.
I cannot test for the UHS workarounds need, but even if so, it should at most apply to reads. I have observed many hangs when CMD25 response contained a CRC error. This patch fixes this without touching the actual UHS tuning workaround.
--- drivers/mmc/host/dw_mmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/dw_mmc.c +2 -1
@@ -2047,7 +2047,8 @@ static void dw_mci_tasklet_func(unsigned* delayed. Allowing the transfer to take place * avoids races and keeps things simple. */ -if (err != -ETIMEDOUT ) { +if (err != -ETIMEDOUT && + host->dir_status ==DW_MCI_RECV_STATUS ) { state =STATE_SENDING_DATA ;continue ; }
Greg Kroah-Hartman
maintainerPATCH 9/251 parisc: Fix ptrace check on syscall return
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 8779e05ba8aaffec1829872ef9774a71f44f6580 upstream.
The TIF_XXX flags are stored in the flags field in the thread_info struct (TI_FLAGS), not in the flags field of the task_struct structure (TASK_FLAGS).
It seems this bug didn't generate any important side-effects, otherwise it wouldn't have went unnoticed for 12 years (since v2.6.32).
--- arch/parisc/kernel/entry.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/kernel/entry.S +1 -1
@@ -1849,7 +1849,7 @@ syscall_restore: LDREG TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* Are we being ptraced? */ - ldw TASK_FLAGS(%r1),%r19 + LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19 ldi _TIF_SYSCALL_TRACE_MASK,%r2 and,COND(=) %r19,%r2,%r0 b,n syscall_restore_rfi
Greg Kroah-Hartman
maintainerPATCH 10/251 tpm: Check for integer overflow in tpm2_map_response_body()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 upstream.
The "4 * be32_to_cpu(data->count)" multiplication can potentially overflow which would lead to memory corruption. Add a check for that.
--- drivers/char/tpm/tpm2-space.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/char/tpm/tpm2-space.c +3 -0
@@ -422,6 +422,9 @@ static int tpm2_map_response_body(structif (be32_to_cpu (data->capability) !=TPM2_CAP_HANDLES )return 0 ; +if (be32_to_cpu (data->count) > (UINT_MAX -TPM_HEADER_SIZE -9 ) /4 ) +return -EFAULT ; +if (len !=TPM_HEADER_SIZE +9 +4 *be32_to_cpu (data->count))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 11/251 media: ite-cir: IR receiver stop working after receive overflow
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit fdc881783099c6343921ff017450831c8766d12a upstream.
On an Intel NUC6iSYK, no IR is reported after a receive overflow.
When a receiver overflow occurs, this condition is only cleared by reading the fifo. Make sure we read anything in the fifo.
--- drivers/media/rc/ite-cir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/ite-cir.c +1 -1
@@ -292,7 +292,7 @@ static irqreturn_t ite_cir_isr(int irq, }/* check for the receive interrupt */ -if (iflags &ITE_IRQ_RX_FIFO ) { +if (iflags & (ITE_IRQ_RX_FIFO |ITE_IRQ_RX_FIFO_OVERRUN )) {/* read the FIFO bytes */ rx_bytes = dev->params.get_rx_bytes(dev, rx_buf,
Greg Kroah-Hartman
maintainerPATCH 12/251 ALSA: ua101: fix division by zero at probe
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 55f261b73a7e1cb254577c3536cef8f415de220a upstream.
Add the missing endpoint max-packet sanity check to probe() to avoid division by zero in alloc_stream_buffers() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")).
--- sound/usb/misc/ua101.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/usb/misc/ua101.c +2 -2
@@ -1032,7 +1032,7 @@ static int detect_usb_format(struct ua10 fmt_playback->bSubframeSize * ua->playback.channels; epd = &ua->intf[INTF_CAPTURE ]->altsetting[1 ].endpoint[0 ].desc; -if (!usb_endpoint_is_isoc_in (epd)) { +if (!usb_endpoint_is_isoc_in (epd) ||usb_endpoint_maxp (epd) ==0 ) {dev_err (&ua->dev->dev,"invalid capture endpoint\n" );return -ENXIO ; }
@@ -1040,7 +1040,7 @@ static int detect_usb_format(struct ua10 ua->capture.max_packet_bytes =usb_endpoint_maxp (epd); epd = &ua->intf[INTF_PLAYBACK ]->altsetting[1 ].endpoint[0 ].desc; -if (!usb_endpoint_is_isoc_out (epd)) { +if (!usb_endpoint_is_isoc_out (epd) ||usb_endpoint_maxp (epd) ==0 ) {dev_err (&ua->dev->dev,"invalid playback endpoint\n" );return -ENXIO ; }
Greg Kroah-Hartman
maintainerPATCH 13/251 ALSA: 6fire: fix control and bulk message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 9b371c6cc37f954360989eec41c2ddc5a6b83917 upstream.
USB control and bulk message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- sound/usb/6fire/comm.c | 2 +- sound/usb/6fire/firmware.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
sound/usb/6fire/comm.c +1 -1
@@ -99,7 +99,7 @@ static int usb6fire_comm_send_buffer(u8int actual_len; ret =usb_interrupt_msg (dev,usb_sndintpipe (dev,COMM_EP ), - buffer, buffer[1 ] +2 , &actual_len,HZ ); + buffer, buffer[1 ] +2 , &actual_len,1000 );if (ret <0 )return ret;else if (actual_len != buffer[1 ] +2 )
sound/usb/6fire/firmware.c +3 -3
@@ -166,7 +166,7 @@ static int usb6fire_fw_ezusb_write(struc ret =usb_control_msg (device,usb_sndctrlpipe (device,0 ), type,USB_DIR_OUT |USB_TYPE_VENDOR |USB_RECIP_DEVICE , - value,0 , data, len,HZ ); + value,0 , data, len,1000 );if (ret <0 )return ret;else if (ret != len)
@@ -179,7 +179,7 @@ static int usb6fire_fw_ezusb_read(struct {int ret =usb_control_msg (device,usb_rcvctrlpipe (device,0 ), type,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , value, -0 , data, len,HZ ); +0 , data, len,1000 );if (ret <0 )return ret;else if (ret != len)
@@ -194,7 +194,7 @@ static int usb6fire_fw_fpga_write(structint ret; ret =usb_bulk_msg (device,usb_sndbulkpipe (device,FPGA_EP ), data, len, - &actual_len,HZ ); + &actual_len,1000 );if (ret <0 )return ret;else if (actual_len != len)
Greg Kroah-Hartman
maintainerPATCH 14/251 ALSA: line6: fix control and interrupt message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit f4000b58b64344871d7b27c05e73932f137cfef6 upstream.
USB control and interrupt message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- sound/usb/line6/driver.c | 14 +++++++------- sound/usb/line6/driver.h | 2 +- sound/usb/line6/podhd.c | 6 +++--- sound/usb/line6/toneport.c | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-)
sound/usb/line6/driver.c +7 -7
@@ -117,12 +117,12 @@ static int line6_send_raw_message(struct retval =usb_interrupt_msg (line6->usbdev,usb_sndintpipe (line6->usbdev, properties->ep_ctrl_w), (char *)frag_buf, frag_size, - &partial,LINE6_TIMEOUT *HZ ); + &partial,LINE6_TIMEOUT ); }else { retval =usb_bulk_msg (line6->usbdev,usb_sndbulkpipe (line6->usbdev, properties->ep_ctrl_w), (char *)frag_buf, frag_size, - &partial,LINE6_TIMEOUT *HZ ); + &partial,LINE6_TIMEOUT ); }if (retval) {
@@ -358,7 +358,7 @@ int line6_read_data(struct usb_line6 *li ret =usb_control_msg (usbdev,usb_sndctrlpipe (usbdev,0 ),0x67 ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT , (datalen <<8 ) |0x21 , address, -NULL ,0 ,LINE6_TIMEOUT *HZ ); +NULL ,0 ,LINE6_TIMEOUT );if (ret <0 ) {dev_err (line6->ifcdev,"read request failed (error %d)\n" , ret);
@@ -373,7 +373,7 @@ int line6_read_data(struct usb_line6 *liUSB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN ,0x0012 ,0x0000 , len,1 , - LINE6_TIMEOUT * HZ); + LINE6_TIMEOUT);if (ret <0 ) {dev_err (line6->ifcdev,"receive length failed (error %d)\n" , ret);
@@ -401,7 +401,7 @@ int line6_read_data(struct usb_line6 *li ret =usb_control_msg (usbdev,usb_rcvctrlpipe (usbdev,0 ),0x67 ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN ,0x0013 ,0x0000 , data, datalen, -LINE6_TIMEOUT *HZ ); +LINE6_TIMEOUT );if (ret <0 )dev_err (line6->ifcdev,"read failed (error %d)\n" , ret);
@@ -433,7 +433,7 @@ int line6_write_data(struct usb_line6 *l ret =usb_control_msg (usbdev,usb_sndctrlpipe (usbdev,0 ),0x67 ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT ,0x0022 , address, data, datalen, -LINE6_TIMEOUT *HZ ); +LINE6_TIMEOUT );if (ret <0 ) { dev_err(line6->ifcdev,
@@ -449,7 +449,7 @@ int line6_write_data(struct usb_line6 *lUSB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN ,0x0012 ,0x0000 , - status, 1, LINE6_TIMEOUT * HZ); + status, 1, LINE6_TIMEOUT);if (ret <0 ) { dev_err(line6->ifcdev,
sound/usb/line6/driver.h +1 -1
@@ -31,7 +31,7 @@#define LINE6_FALLBACK_INTERVAL 10#define LINE6_FALLBACK_MAXPACKETSIZE 16 -#define LINE6_TIMEOUT 1 +#define LINE6_TIMEOUT 1000#define LINE6_BUFSIZE_LISTEN 64#define LINE6_MIDI_MESSAGE_MAXLEN 256
sound/usb/line6/podhd.c +3 -3
@@ -235,7 +235,7 @@ static int podhd_dev_start(struct usb_li ret =usb_control_msg (usbdev,usb_sndctrlpipe (usbdev,0 ),0x67 ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT ,0x11 ,0 , -NULL ,0 ,LINE6_TIMEOUT *HZ ); +NULL ,0 ,LINE6_TIMEOUT );if (ret <0 ) {dev_err (pod->line6.ifcdev,"read request failed (error %d)\n" , ret); goto exit;
@@ -245,7 +245,7 @@ static int podhd_dev_start(struct usb_li ret =usb_control_msg (usbdev,usb_rcvctrlpipe (usbdev,0 ),0x67 ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN ,0x11 ,0x0 , - init_bytes,3 ,LINE6_TIMEOUT *HZ ); + init_bytes,3 ,LINE6_TIMEOUT );if (ret <0 ) {dev_err (pod->line6.ifcdev,"receive length failed (error %d)\n" , ret);
@@ -265,7 +265,7 @@ static int podhd_dev_start(struct usb_liUSB_REQ_SET_FEATURE ,USB_TYPE_STANDARD |USB_RECIP_DEVICE |USB_DIR_OUT ,1 ,0 , - NULL, 0, LINE6_TIMEOUT * HZ); + NULL, 0, LINE6_TIMEOUT); exit:kfree (init_bytes);return ret;
sound/usb/line6/toneport.c +1 -1
@@ -133,7 +133,7 @@ static int toneport_send_cmd(struct usb_ ret =usb_control_msg (usbdev,usb_sndctrlpipe (usbdev,0 ),0x67 ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT , - cmd1, cmd2,NULL ,0 ,LINE6_TIMEOUT *HZ ); + cmd1, cmd2,NULL ,0 ,LINE6_TIMEOUT );if (ret <0 ) {dev_err (&usbdev->dev,"send failed (error %d)\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 15/251 ALSA: synth: missing check for possible NULL after the call to kstrdup
In reply to Greg Kroah-HartmanFrom: Austin Kim <[email protected]>
commit d159037abbe3412285c271bdfb9cdf19e62678ff upstream.
If kcalloc() return NULL due to memory starvation, it is possible for kstrdup() to return NULL in similar case. So add null check after the call to kstrdup() is made.
[ minor coding-style fix by tiwai ]
--- sound/synth/emux/emux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/synth/emux/emux.c +1 -1
@@ -101,7 +101,7 @@ int snd_emux_register(struct snd_emux *e emu->name =kstrdup (name,GFP_KERNEL ); emu->voices =kcalloc (emu->max_voices,sizeof (struct snd_emux_voice ),GFP_KERNEL ); -if (emu->voices ==NULL ) +if (emu->name ==NULL || emu->voices ==NULL )return -ENOMEM ;/* create soundfont list */
Greg Kroah-Hartman
maintainerPATCH 16/251 ALSA: timer: Fix use-after-free problem
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
commit c0317c0e87094f5b5782b6fdef5ae0a4b150496c upstream.
When the timer instance was add into ack_list but was not currently in process, the user could stop it via snd_timer_stop1() without delete it from the ack_list. Then the user could free the timer instance and when it was actually processed UAF occurred.
This issue could be reproduced via testcase snd_timer01 in ltp - running several instances of that testcase at the same time.
What I actually met was that the ack_list of the timer broken and the kernel went into deadloop with irqoff. That could be detected by hardlockup detector on board or when we run it on qemu, we could use gdb to dump the ack_list when the console has no response.
To fix this issue, we delete the timer instance from ack_list and active_list unconditionally in snd_timer_stop1().
--- sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/timer.c +2 -2
@@ -583,13 +583,13 @@ static int snd_timer_stop1(struct snd_tiif (!timer)return -EINVAL ;spin_lock_irqsave (&timer->lock, flags); +list_del_init (&timeri->ack_list); +list_del_init (&timeri->active_list);if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |SNDRV_TIMER_IFLG_START ))) { result = -EBUSY ; goto unlock; } -list_del_init (&timeri->ack_list); -list_del_init (&timeri->active_list);if (timer->card && timer->card->shutdown) goto unlock;if (stop) {
Greg Kroah-Hartman
maintainerPATCH 17/251 ALSA: timer: Unconditionally unlink slave instances, too
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit ffdd98277f0a1d15a67a74ae09bee713df4c0dbc upstream.
Like the previous fix (commit c0317c0e8709 "ALSA: timer: Fix use-after-free problem"), we have to unlink slave timer instances immediately at snd_timer_stop(), too. Otherwise it may leave a stale entry in the list if the slave instance is freed before actually running.
--- sound/core/timer.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
sound/core/timer.c +6 -7
@@ -624,23 +624,22 @@ static int snd_timer_stop1(struct snd_tistatic int snd_timer_stop_slave (struct snd_timer_instance *timeri,bool stop) {unsigned long flags; +bool running;spin_lock_irqsave (&slave_active_lock, flags); -if (!(timeri->flags &SNDRV_TIMER_IFLG_RUNNING )) { -spin_unlock_irqrestore (&slave_active_lock, flags); -return -EBUSY ; - } + running = timeri->flags &SNDRV_TIMER_IFLG_RUNNING ; timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;if (timeri->timer) {spin_lock (&timeri->timer->lock);list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list); -snd_timer_notify1 (timeri, stop ?SNDRV_TIMER_EVENT_STOP : -SNDRV_TIMER_EVENT_PAUSE ); +if (running) +snd_timer_notify1 (timeri, stop ?SNDRV_TIMER_EVENT_STOP : +SNDRV_TIMER_EVENT_PAUSE );spin_unlock (&timeri->timer->lock); }spin_unlock_irqrestore (&slave_active_lock, flags); -return 0 ; +return running ?0 : -EBUSY ; }/*
Greg Kroah-Hartman
maintainerPATCH 18/251 fuse: fix page stealing
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 712a951025c0667ff00b25afc360f74e639dfabe upstream.
It is possible to trigger a crash by splicing anon pipe bufs to the fuse device.
The reason for this is that anon_pipe_buf_release() will reuse buf->page if the refcount is 1, but that page might have already been stolen and its flags modified (e.g. PG_lru added).
This happens in the unlikely case of fuse_dev_splice_write() getting around to calling pipe_buf_release() after a page has been stolen, added to the page cache and removed from the page cache.
Fix by calling pipe_buf_release() right after the page was inserted into the page cache. In this case the page has an elevated refcount so any release function will know that the page isn't reusable.
--- fs/fuse/dev.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
fs/fuse/dev.c +12 -2
@@ -897,6 +897,12 @@ static int fuse_try_move_page(struct fus goto out_put_old; } +/* +* Release while we have extra ref on stolen page. Otherwise +* anon_pipe_buf_release() might think the page can be reused. +*/ +pipe_buf_release (cs->pipe, buf); +get_page (newpage);if (!(buf->flags &PIPE_BUF_FLAG_LRU ))
@@ -2046,8 +2052,12 @@ static ssize_t fuse_dev_splice_write(strpipe_lock (pipe); out_free: -for (idx =0 ; idx < nbuf; idx++) -pipe_buf_release (pipe, &bufs[idx]); +for (idx =0 ; idx < nbuf; idx++) { +struct pipe_buffer *buf = &bufs[idx]; + +if (buf->ops) +pipe_buf_release (pipe, buf); + }pipe_unlock (pipe);kfree (bufs);
Greg Kroah-Hartman
maintainerPATCH 19/251 x86/irq: Ensure PI wakeup handler is unregistered before module unload
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 6ff53f6a438f72998f56e82e76694a1df9d1ea2c upstream.
Add a synchronize_rcu() after clearing the posted interrupt wakeup handler to ensure all readers, i.e. in-flight IRQ handlers, see the new handler before returning to the caller. If the caller is an exiting module and is unregistering its handler, failure to wait could result in the IRQ handler jumping into an unloaded module.
The registration path doesn't require synchronization, as it's the caller's responsibility to not generate interrupts it cares about until after its handler is registered.
Message-Id: <[email protected]>
--- arch/x86/kernel/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kernel/irq.c +3 -1
@@ -274,8 +274,10 @@ void kvm_set_posted_intr_wakeup_handler( {if (handler) kvm_posted_intr_wakeup_handler = handler; -else +else { kvm_posted_intr_wakeup_handler = dummy_handler; +synchronize_rcu (); + } }EXPORT_SYMBOL_GPL (kvm_set_posted_intr_wakeup_handler);
Greg Kroah-Hartman
maintainerPATCH 20/251 cavium: Return negative value when pci_alloc_irq_vectors() fails
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ]
During the process of driver probing, the probe function should return < 0 for failure, otherwise, the kernel will treat value > 0 as success.
--- drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/thunder/nic_main.c +1 -1
@@ -1128,7 +1128,7 @@ static int nic_register_interrupts(struct nicpf *nic)dev_err (&nic->pdev->dev,"Request for #%d msix vectors failed, returned %d\n" , nic->num_vec, ret); -return 1 ; +return ret; }/* Register mailbox interrupt handler */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 21/251 scsi: qla2xxx: Fix unmap of already freed sgl
In reply to Greg Kroah-HartmanFrom: Dmitry Bogdanov <[email protected]>
[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ]
The sgl is freed in the target stack in target_release_cmd_kref() before calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that causes a panic if sgl is not yet DMA unmapped:
NIP dma_direct_unmap_sg+0xdc/0x180
LR dma_direct_unmap_sg+0xc8/0x180
Call Trace: ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable) dma_unmap_sg_attrs+0x54/0xf0 qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx] qlt_free_cmd+0x124/0x1d0 [qla2xxx] tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx] target_put_sess_cmd+0x198/0x370 [target_core_mod] transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod] tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx]
The sgl may be left unmapped in error cases of response sending. For instance, qlt_rdy_to_xfer() maps sgl and exits when session is being deleted keeping the sgl mapped.
This patch removes use-after-free of the sgl and ensures that the sgl is unmapped for any command that was not sent to firmware.
--- drivers/scsi/qla2xxx/qla_target.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/scsi/qla2xxx/qla_target.c +5 -9
@@ -3095,8 +3095,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,"RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n" , vha->flags.online,qla2x00_reset_active (vha), cmd->reset_count, qpair->chip_reset); -spin_unlock_irqrestore (qpair->qp_lock_ptr, flags); -return 0 ; + goto out_unmap_unlock; }/* Does F/W have an IOCBs for this request */
@@ -3218,10 +3217,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) prm.sg =NULL ; prm.req_cnt =1 ; -/* Calculate number of entries and segments required */ -if (qlt_pci_map_calc_cnt (&prm) !=0 ) -return -EAGAIN ; -if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || (cmd->sess && cmd->sess->deleted)) {/*
@@ -3237,6 +3232,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)return 0 ; } +/* Calculate number of entries and segments required */ +if (qlt_pci_map_calc_cnt (&prm) !=0 ) +return -EAGAIN ; +spin_lock_irqsave (qpair->qp_lock_ptr, flags);/* Does F/W have an IOCBs for this request */ res =qlt_check_reserve_free_req (qpair, prm.req_cnt);
@@ -3671,9 +3670,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)BUG_ON (cmd->cmd_in_wq); -if (cmd->sg_mapped) -qlt_unmap_sg (cmd->vha, cmd); -if (!cmd->q_full)qlt_decr_num_pend_cmds (cmd->vha);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 22/251 cavium: Fix return values of the probe function
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ]
During the process of driver probing, the probe function should return < 0 for failure, otherwise, the kernel will treat value > 0 as success.
--- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/cavium/thunder/nicvf_main.c +2 -2
@@ -1152,7 +1152,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)if (ret <0 ) {netdev_err (nic->netdev,"Req for #%d msix vectors failed\n" , nic->num_vec); -return 1 ; +return ret; }sprintf (nic->irq_name[irq],"%s Mbox" ,"NICVF" );
@@ -1171,7 +1171,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)if (!nicvf_check_pf_ready (nic)) {nicvf_disable_intr (nic,NICVF_INTR_MBOX ,0 );nicvf_unregister_interrupts (nic); -return 1 ; +return -EIO ; }return 0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 23/251 sfc: Dont use netif_info before net_device setup
In reply to Greg Kroah-HartmanFrom: Erik Ekman <[email protected]>
[ Upstream commit bf6abf345dfa77786aca554bc58c64bd428ecb1d ]
Use pci_info instead to avoid unnamed/uninitialized noise:
[197088.688729] sfc 0000:01:00.0: Solarflare NIC detected [197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F [197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed [197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support
Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before net_device is registered") from Heiner Kallweit.
--- drivers/net/ethernet/sfc/ptp.c | 4 ++-- drivers/net/ethernet/sfc/siena_sriov.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/sfc/ptp.c +2 -2
@@ -494,7 +494,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx) }else if (rc == -EINVAL ) { fmt =MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS ; }else if (rc == -EPERM ) { -netif_info (efx, probe, efx->net_dev,"no PTP support\n" ); +pci_info (efx->pci_dev,"no PTP support\n" );return rc; }else { efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf),
@@ -613,7 +613,7 @@ static int efx_ptp_disable(struct efx_nic *efx)* should only have been called during probe. */ if (rc == -ENOSYS || rc == -EPERM ) -netif_info (efx, probe, efx->net_dev,"no PTP support\n" ); +pci_info (efx->pci_dev,"no PTP support\n" );else if (rc) efx_mcdi_display_error(efx, MC_CMD_PTP, MC_CMD_PTP_IN_DISABLE_LEN,
drivers/net/ethernet/sfc/siena_sriov.c +1 -1
@@ -1059,7 +1059,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx)return ;if (efx_siena_sriov_cmd (efx, false, &efx->vi_scale, &count)) { -netif_info (efx, probe, efx->net_dev,"no SR-IOV VFs probed\n" ); +pci_info (efx->pci_dev,"no SR-IOV VFs probed\n" );return ; }if (count >0 && count > max_vfs)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 24/251 hyperv/vmbus: include linux/bitops.h
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 8017c99680fa65e1e8d999df1583de476a187830 ]
On arm64 randconfig builds, hyperv sometimes fails with this error:
In file included from drivers/hv/hv_trace.c:3:
In file included from drivers/hv/hyperv_vmbus.h:16:
In file included from arch/arm64/include/asm/sync_bitops.h:5:arch/arm64/include/asm/bitops.h:11:2: error: only <linux/bitops.h> can be included directly
In file included from include/asm-generic/bitops/hweight.h:5:include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration] include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration]
Include the correct header first.
--- drivers/hv/hyperv_vmbus.h | 1 + 1 file changed, 1 insertion(+)
drivers/hv/hyperv_vmbus.h +1 -0
@@ -26,6 +26,7 @@#define _HYPERV_VMBUS_H#include <linux/list.h> +#include <linux/bitops.h> #include <asm/sync_bitops.h> #include <linux/atomic.h> #include <linux/hyperv.h>
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 25/251 mmc: winbond: dont build on M68K
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 162079f2dccd02cb4b6654defd32ca387dd6d4d4 ]
The Winbond MMC driver fails to build on ARCH=m68k so prevent that build config. Silences these build errors:
../drivers/mmc/host/wbsd.c: In function 'wbsd_request_end':../drivers/mmc/host/wbsd.c:212:28: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration]
212 | dmaflags = claim_dma_lock();../drivers/mmc/host/wbsd.c:215:17: error: implicit declaration of function 'release_dma_lock'; did you mean 'release_task'? [-Werror=implicit-function-declaration]
215 | release_dma_lock(dmaflags);
--- drivers/mmc/host/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/Kconfig +1 -1
@@ -397,7 +397,7 @@ config MMC_OMAP_HS config MMC_WBSD tristate "Winbond W83L51xD SD/MMC Card Interface support" - depends on ISA_DMA_API + depends on ISA_DMA_API && !M68K help This selects the Winbond(R) W83L51xD Secure digital and Multimedia card Interface.
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 26/251 bpf: Prevent increasing bpf_jit_limit above max
In reply to Greg Kroah-HartmanFrom: Lorenz Bauer <[email protected]>
[ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ]
Restrict bpf_jit_limit to the maximum supported by the arch's JIT.
--- include/linux/filter.h | 1 + kernel/bpf/core.c | 4 +++- net/core/sysctl_net_core.c | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-)
include/linux/filter.h +1 -0
@@ -730,6 +730,7 @@ extern int bpf_jit_enable;extern int bpf_jit_harden;extern int bpf_jit_kallsyms;extern long bpf_jit_limit; +extern long bpf_jit_limit_max;typedef void (*bpf_jit_fill_hole_t )(void *area,unsigned int size);
kernel/bpf/core.c +3 -1
@@ -295,6 +295,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);int bpf_jit_harden__read_mostly ;int bpf_jit_kallsyms__read_mostly ;long bpf_jit_limit__read_mostly ; +long bpf_jit_limit_max__read_mostly ; static __always_inline void bpf_get_prog_addr_region(const struct bpf_prog *prog,
@@ -508,7 +509,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)static int __init bpf_jit_charge_init (void ) {/* Only used as heuristic here to derive limit. */ - bpf_jit_limit =min_t (u64,round_up (bpf_jit_alloc_exec_limit () >>2 , + bpf_jit_limit_max =bpf_jit_alloc_exec_limit (); + bpf_jit_limit =min_t (u64,round_up (bpf_jit_limit_max >>2 ,PAGE_SIZE ),LONG_MAX );return 0 ; }
net/core/sysctl_net_core.c +1 -1
@@ -410,7 +410,7 @@ static struct ctl_table net_core_table[] = { .mode = 0600, .proc_handler = proc_dolongvec_minmax_bpf_restricted, .extra1 = &long_one, - .extra2 = &long_max, + .extra2 = &bpf_jit_limit_max, },#endif {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 27/251 xen/netfront: stop tx queues during live migration
In reply to Greg Kroah-HartmanFrom: Dongli Zhang <[email protected]>
[ Upstream commit 042b2046d0f05cf8124c26ff65dbb6148a4404fb ]
The tx queues are not stopped during the live migration. As a result, the ndo_start_xmit() may access netfront_info->queues which is freed by talk_to_netback()->xennet_destroy_queues().
This patch is to netif_device_detach() at the beginning of xen-netfront resuming, and netif_device_attach() at the end of resuming.
CPU A CPU B
talk_to_netback()
-> if (info->queues)
xennet_destroy_queues(info);
to free netfront_info->queues
xennet_start_xmit()
to access netfront_info->queues-> err = xennet_create_queues(info, &num_queues);
The idea is borrowed from virtio-net.
--- drivers/net/xen-netfront.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/xen-netfront.c +8 -0
@@ -1441,6 +1441,10 @@ static int netfront_resume(struct xenbus_device *dev)dev_dbg (&dev->dev,"%s\n" , dev->nodename); +netif_tx_lock_bh (info->netdev); +netif_device_detach (info->netdev); +netif_tx_unlock_bh (info->netdev); +xennet_disconnect_backend (info);return 0 ; }
@@ -1990,6 +1994,10 @@ static int xennet_connect(struct net_device *dev)* domain a kick because we've probably just requeued some * packets. */ +netif_tx_lock_bh (np->netdev); +netif_device_attach (np->netdev); +netif_tx_unlock_bh (np->netdev); +netif_carrier_on (np->netdev);for (j =0 ; j < num_queues; ++j) { queue = &np->queues[j];
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 28/251 spi: spl022: fix Microwire full duplex mode
In reply to Greg Kroah-HartmanFrom: Thomas Perrot <[email protected]>
[ Upstream commit d81d0e41ed5fe7229a2c9a29d13bad288c7cf2d2 ]
There are missing braces in the function that verify controller parameters, then an error is always returned when the parameter to select Microwire frames operation is used on devices allowing it.
--- drivers/spi/spi-pl022.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/spi/spi-pl022.c +3 -2
@@ -1703,12 +1703,13 @@ static int verify_controller_parameters(struct pl022 *pl022,return -EINVAL ; } }else { -if (chip_info->duplex !=SSP_MICROWIRE_CHANNEL_FULL_DUPLEX ) +if (chip_info->duplex !=SSP_MICROWIRE_CHANNEL_FULL_DUPLEX ) {dev_err (&pl022->adev->dev,"Microwire half duplex mode requested," " but this is only available in the" " ST version of PL022\n" ); -return -EINVAL ; +return -EINVAL ; + } } }return 0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 29/251 watchdog: Fix OMAP watchdog early handling
In reply to Greg Kroah-HartmanFrom: Walter Stoll <[email protected]>
[ Upstream commit cd004d8299f1dc6cfa6a4eea8f94cb45eaedf070 ]
TI's implementation does not service the watchdog even if the kernel command line parameter omap_wdt.early_enable is set to 1. This patch fixes the issue.
--- drivers/watchdog/omap_wdt.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/watchdog/omap_wdt.c +5 -1
@@ -271,8 +271,12 @@ static int omap_wdt_probe(struct platform_device *pdev) wdev->wdog.bootstatus =WDIOF_CARDRESET ; } -if (!early_enable) +if (early_enable) { +omap_wdt_start (&wdev->wdog); +set_bit (WDOG_HW_RUNNING , &wdev->wdog.status); + }else {omap_wdt_disable (wdev); + } ret =watchdog_register_device (&wdev->wdog);if (ret) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 30/251 vmxnet3: do not stop tx queues after netif_device_detach()
In reply to Greg Kroah-HartmanFrom: Dongli Zhang <[email protected]>
[ Upstream commit 9159f102402a64ac85e676b75cc1f9c62c5b4b73 ]
The netif_device_detach() conditionally stops all tx queues if the queues are running. There is no need to call netif_tx_stop_all_queues() again.
--- drivers/net/vmxnet3/vmxnet3_drv.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/vmxnet3/vmxnet3_drv.c +0 -1
@@ -3623,7 +3623,6 @@ vmxnet3_suspend(struct device *device)vmxnet3_free_intr_resources (adapter);netif_device_detach (netdev); -netif_tx_stop_all_queues (netdev);/* Create wake-up filters. */ pmConf = adapter->pm_conf;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 31/251 btrfs: fix lost error handling when replaying directory deletes
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 10adb1152d957a4d570ad630f93a88bb961616c1 upstream.
At replay_dir_deletes(), if find_dir_range() returns an error we break out of the main while loop and then assign a value of 0 (success) to the 'ret' variable, resulting in completely ignoring that an error happened. Fix that by jumping to the 'out' label when find_dir_range() returns an error (negative value).
--- fs/btrfs/tree-log.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/tree-log.c +3 -1
@@ -2286,7 +2286,9 @@ again:else { ret =find_dir_range (log, path, dirid, key_type, &range_start, &range_end); -if (ret !=0 ) +if (ret <0 ) + goto out; +else if (ret >0 )break ; }
Greg Kroah-Hartman
maintainerPATCH 32/251 hwmon: (pmbus/lm25066) Add offset coefficients
In reply to Greg Kroah-HartmanFrom: Zev Weiss <[email protected]>
commit ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 upstream.
With the exception of the lm5066i, all the devices handled by this driver had been missing their offset ('b') coefficients for direct format readings.
--- drivers/hwmon/pmbus/lm25066.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/hwmon/pmbus/lm25066.c +23 -0
@@ -69,22 +69,27 @@ static struct __coeff lm25066_coeff[6][P [lm25056] = { [PSC_VOLTAGE_IN] = { .m = 16296, + .b = 1343, .R = -2, }, [PSC_CURRENT_IN] = { .m = 13797, + .b = -1833, .R = -2, }, [PSC_CURRENT_IN_L] = { .m = 6726, + .b = -537, .R = -2, }, [PSC_POWER] = { .m = 5501, + .b = -2908, .R = -3, }, [PSC_POWER_L] = { .m = 26882, + .b = -5646, .R = -4, }, [PSC_TEMPERATURE] = {
@@ -96,26 +101,32 @@ static struct __coeff lm25066_coeff[6][P [lm25066] = { [PSC_VOLTAGE_IN] = { .m = 22070, + .b = -1800, .R = -2, }, [PSC_VOLTAGE_OUT] = { .m = 22070, + .b = -1800, .R = -2, }, [PSC_CURRENT_IN] = { .m = 13661, + .b = -5200, .R = -2, }, [PSC_CURRENT_IN_L] = { .m = 6852, + .b = -3100, .R = -2, }, [PSC_POWER] = { .m = 736, + .b = -3300, .R = -2, }, [PSC_POWER_L] = { .m = 369, + .b = -1900, .R = -2, }, [PSC_TEMPERATURE] = {
@@ -155,26 +166,32 @@ static struct __coeff lm25066_coeff[6][P [lm5064] = { [PSC_VOLTAGE_IN] = { .m = 4611, + .b = -642, .R = -2, }, [PSC_VOLTAGE_OUT] = { .m = 4621, + .b = 423, .R = -2, }, [PSC_CURRENT_IN] = { .m = 10742, + .b = 1552, .R = -2, }, [PSC_CURRENT_IN_L] = { .m = 5456, + .b = 2118, .R = -2, }, [PSC_POWER] = { .m = 1204, + .b = 8524, .R = -3, }, [PSC_POWER_L] = { .m = 612, + .b = 11202, .R = -3, }, [PSC_TEMPERATURE] = {
@@ -184,26 +201,32 @@ static struct __coeff lm25066_coeff[6][P [lm5066] = { [PSC_VOLTAGE_IN] = { .m = 4587, + .b = -1200, .R = -2, }, [PSC_VOLTAGE_OUT] = { .m = 4587, + .b = -2400, .R = -2, }, [PSC_CURRENT_IN] = { .m = 10753, + .b = -1200, .R = -2, }, [PSC_CURRENT_IN_L] = { .m = 5405, + .b = -600, .R = -2, }, [PSC_POWER] = { .m = 1204, + .b = -6000, .R = -3, }, [PSC_POWER_L] = { .m = 605, + .b = -8000, .R = -3, }, [PSC_TEMPERATURE] = {
Greg Kroah-Hartman
maintainerPATCH 33/251 regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit b16bef60a9112b1e6daf3afd16484eb06e7ce792 upstream.
The driver and its bindings, before commit 04f9f068a619 ("regulator:
s5m8767: Modify parsing method of the voltage table of buck2/3/4") were requiring to provide at least one safe/default voltage for DVS registers if DVS GPIO is not being enabled.
IOW, if s5m8767,pmic-buck2-uses-gpio-dvs is missing, the s5m8767,pmic-buck2-dvs-voltage should still be present and contain one voltage.
This requirement was coming from driver behavior matching this condition (none of DVS GPIO is enabled): it was always initializing the DVS selector pins to 0 and keeping the DVS enable setting at reset value (enabled). Therefore if none of DVS GPIO is enabled in devicetree, driver was configuring the first DVS voltage for buck[234].
Mentioned commit 04f9f068a619 ("regulator: s5m8767: Modify parsing method of the voltage table of buck2/3/4") broke it because DVS voltage won't be parsed from devicetree if DVS GPIO is not enabled. After the change, driver will configure bucks to use the register reset value as voltage which might have unpleasant effects.
Fix this by relaxing the bindings constrain: if DVS GPIO is not enabled in devicetree (therefore DVS voltage is also not parsed), explicitly disable it.
Message-Id: <[email protected]>
--- Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 21 +++------- drivers/regulator/s5m8767.c | 21 ++++------ 2 files changed, 17 insertions(+), 25 deletions(-)
Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +8 -13
@@ -13,6 +13,14 @@ common regulator binding documented in: Required properties of the main device node (the parent!): + - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used + for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. + + [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional + property is specified, then all the eight voltage values for the + 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. + +Optional properties of the main device node (the parent!): - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV) units for buck2 when changing voltage using gpio dvs. Refer to [1] below for additional information.
@@ -25,19 +33,6 @@ Required properties of the main device n units for buck4 when changing voltage using gpio dvs. Refer to [1] below for additional information. - - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used - for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. - - [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional - property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage' - property should specify atleast one voltage level (which would be a - safe operating voltage). - - If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional - property is specified, then all the eight voltage values for the - 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. - -Optional properties of the main device node (the parent!): - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs. - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs. - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs.
drivers/regulator/s5m8767.c +9 -12
@@ -845,18 +845,15 @@ static int s5m8767_pmic_probe(struct pla/* DS4 GPIO */ gpio_direction_output (pdata->buck_ds[2 ],0x0 ); -if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs || - pdata->buck4_gpiodvs) { -regmap_update_bits (s5m8767->iodev->regmap_pmic, -S5M8767_REG_BUCK2CTRL ,1 <<1 , - (pdata->buck2_gpiodvs) ? (1 <<1 ) : (0 <<1 )); -regmap_update_bits (s5m8767->iodev->regmap_pmic, -S5M8767_REG_BUCK3CTRL ,1 <<1 , - (pdata->buck3_gpiodvs) ? (1 <<1 ) : (0 <<1 )); -regmap_update_bits (s5m8767->iodev->regmap_pmic, -S5M8767_REG_BUCK4CTRL ,1 <<1 , - (pdata->buck4_gpiodvs) ? (1 <<1 ) : (0 <<1 )); - } +regmap_update_bits (s5m8767->iodev->regmap_pmic, +S5M8767_REG_BUCK2CTRL ,1 <<1 , + (pdata->buck2_gpiodvs) ? (1 <<1 ) : (0 <<1 )); +regmap_update_bits (s5m8767->iodev->regmap_pmic, +S5M8767_REG_BUCK3CTRL ,1 <<1 , + (pdata->buck3_gpiodvs) ? (1 <<1 ) : (0 <<1 )); +regmap_update_bits (s5m8767->iodev->regmap_pmic, +S5M8767_REG_BUCK4CTRL ,1 <<1 , + (pdata->buck4_gpiodvs) ? (1 <<1 ) : (0 <<1 ));/* Initialize GPIO DVS registers */ for (i =0 ; i <8 ; i++) {
Greg Kroah-Hartman
maintainerPATCH 34/251 regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a upstream.
The driver was always parsing "s5m8767,pmic-buck-default-dvs-idx", not "s5m8767,pmic-buck234-default-dvs-idx".
Message-Id: <[email protected]>
--- Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +1 -1
@@ -39,7 +39,7 @@ Optional properties of the main device n Additional properties required if either of the optional properties are used: - - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from + - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from the possible 8 options selectable by the dvs gpios. The value of this property should be between 0 and 7. If not specified or if out of range, the default value of this property is set to 0.
Greg Kroah-Hartman
maintainerPATCH 35/251 EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
In reply to Greg Kroah-HartmanFrom: Eric Badger <[email protected]>
commit 537bddd069c743759addf422d0b8f028ff0f8dbc upstream.
The computation of TOHM is off by one bit. This missed bit results in too low a value for TOHM, which can cause errors in regular memory to incorrectly report:
EDAC MC0: 1 CE Error at MMIOH area, on addr 0x000000207fffa680 on any memory
--- drivers/edac/sb_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/sb_edac.c +1 -1
@@ -1014,7 +1014,7 @@ static u64 haswell_get_tohm(struct sbridpci_read_config_dword (pvt->info.pci_vtd,HASWELL_TOHM_1 , ®); rc = ((reg <<6 ) | rc) <<26 ; -return rc |0x1ffffff ; +return rc |0x3ffffff ; }static u64 knl_get_tolm (struct sbridge_pvt *pvt)
Greg Kroah-Hartman
maintainerPATCH 36/251 mwifiex: fix division by zero in fw download path
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 89f8765a11d8df49296d92c404067f9b5c58ee26 upstream.
Add the missing endpoint sanity checks to probe() to avoid division by zero in mwifiex_write_data_sync() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing).
Only add checks for the firmware-download boot stage, which require both command endpoints, for now. The driver looks like it will handle a missing endpoint during normal operation without oopsing, albeit not very gracefully as it will try to submit URBs to the default pipe and fail.
Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")).
--- drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/net/wireless/marvell/mwifiex/usb.c +16 -0
@@ -491,6 +491,22 @@ static int mwifiex_usb_probe(struct usb_ } } +switch (card->usb_boot_state) { +case USB8XXX_FW_DNLD : +/* Reject broken descriptors. */ +if (!card->rx_cmd_ep || !card->tx_cmd_ep) +return -ENODEV ; +if (card->bulk_out_maxpktsize ==0 ) +return -ENODEV ; +break ; +case USB8XXX_FW_READY : +/* Assume the driver can handle missing endpoints for now. */ +break ; +default : +WARN_ON (1 ); +return -ENODEV ; + } +usb_set_intfdata (intf, card); ret = mwifiex_add_card(card, &card->fw_done, &usb_ops,
Greg Kroah-Hartman
maintainerPATCH 37/251 ath6kl: fix division by zero in send path
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit c1b9ca365deae667192be9fe24db244919971234 upstream.
Add the missing endpoint max-packet sanity check to probe() to avoid division by zero in ath10k_usb_hif_tx_sg() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")).
--- drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/ath/ath6kl/usb.c +5 -0
@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resourcle16_to_cpu (endpoint->wMaxPacketSize), endpoint->bInterval); } + +/* Ignore broken descriptors. */ +if (usb_endpoint_maxp (endpoint) ==0 ) +continue ; + urbcount =0 ; pipe_num =
Greg Kroah-Hartman
maintainerPATCH 38/251 ath6kl: fix control-message timeout
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit a066d28a7e729f808a3e6eff22e70c003091544e upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/net/wireless/ath/ath6kl/usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath6kl/usb.c +1 -1
@@ -912,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(str req,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , value, index, buf, - size, 2 * HZ); + size, 2000);if (ret <0 ) {ath6kl_warn ("Failed to read usb control message: %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 39/251 ath10k: fix control-message timeout
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 5286132324230168d3fab6ffc16bfd7de85bdfb4 upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/net/wireless/ath/ath10k/usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/usb.c +1 -1
@@ -536,7 +536,7 @@ static int ath10k_usb_submit_ctrl_in(str req,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , value, index, buf, - size, 2 * HZ); + size, 2000);if (ret <0 ) { ath10k_warn(ar, "Failed to read usb control message: %d\n",
Greg Kroah-Hartman
maintainerPATCH 40/251 ath10k: fix division by zero in send path
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit a006acb931317aad3a8dd41333ebb0453caf49b8 upstream.
Add the missing endpoint max-packet sanity check to probe() to avoid division by zero in ath10k_usb_hif_tx_sg() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")).
--- drivers/net/wireless/ath/ath10k/usb.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/ath/ath10k/usb.c +5 -0
@@ -875,6 +875,11 @@ static int ath10k_usb_setup_pipe_resourcle16_to_cpu (endpoint->wMaxPacketSize), endpoint->bInterval); } + +/* Ignore broken descriptors. */ +if (usb_endpoint_maxp (endpoint) ==0 ) +continue ; + urbcount =0 ; pipe_num =
Greg Kroah-Hartman
maintainerPATCH 41/251 PCI: Mark Atheros QCA6174 to avoid bus reset
In reply to Greg Kroah-HartmanFrom: Ingmar Klein <[email protected]>
commit e3f4bd3462f6f796594ecc0dda7144ed2d1e5a26 upstream.
When passing the Atheros QCA6174 through to a virtual machine, the VM hangs at the point where the ath10k driver loads.
Add a quirk to avoid bus resets on this device, which avoids the hang.
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -3414,6 +3414,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ADECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_ATHEROS ,0x003c , quirk_no_bus_reset);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_ATHEROS ,0x0033 , quirk_no_bus_reset);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_ATHEROS ,0x0034 , quirk_no_bus_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_ATHEROS ,0x003e , quirk_no_bus_reset);/* * Some TI KeyStone C667X devices do not support bus/hot reset. The PCIESS
Greg Kroah-Hartman
maintainerPATCH 42/251 rtl8187: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 2e9be536a213e838daed6ba42024dd68954ac061 upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +7 -7
@@ -31,7 +31,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_prusb_control_msg (priv->udev,usb_rcvctrlpipe (priv->udev,0 ),RTL8187_REQ_GET_REG ,RTL8187_REQT_READ , (unsigned long )addr, idx &0x03 , - &priv->io_dmabuf->bits8,sizeof (val),HZ /2 ); + &priv->io_dmabuf->bits8,sizeof (val),500 ); val = priv->io_dmabuf->bits8;mutex_unlock (&priv->io_mutex);
@@ -48,7 +48,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_usb_control_msg (priv->udev,usb_rcvctrlpipe (priv->udev,0 ),RTL8187_REQ_GET_REG ,RTL8187_REQT_READ , (unsigned long )addr, idx &0x03 , - &priv->io_dmabuf->bits16,sizeof (val),HZ /2 ); + &priv->io_dmabuf->bits16,sizeof (val),500 ); val = priv->io_dmabuf->bits16;mutex_unlock (&priv->io_mutex);
@@ -65,7 +65,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_usb_control_msg (priv->udev,usb_rcvctrlpipe (priv->udev,0 ),RTL8187_REQ_GET_REG ,RTL8187_REQT_READ , (unsigned long )addr, idx &0x03 , - &priv->io_dmabuf->bits32,sizeof (val),HZ /2 ); + &priv->io_dmabuf->bits32,sizeof (val),500 ); val = priv->io_dmabuf->bits32;mutex_unlock (&priv->io_mutex);
@@ -82,7 +82,7 @@ void rtl818x_iowrite8_idx(struct rtl8187usb_control_msg (priv->udev,usb_sndctrlpipe (priv->udev,0 ),RTL8187_REQ_SET_REG ,RTL8187_REQT_WRITE , (unsigned long )addr, idx &0x03 , - &priv->io_dmabuf->bits8,sizeof (val),HZ /2 ); + &priv->io_dmabuf->bits8,sizeof (val),500 );mutex_unlock (&priv->io_mutex); }
@@ -96,7 +96,7 @@ void rtl818x_iowrite16_idx(struct rtl818usb_control_msg (priv->udev,usb_sndctrlpipe (priv->udev,0 ),RTL8187_REQ_SET_REG ,RTL8187_REQT_WRITE , (unsigned long )addr, idx &0x03 , - &priv->io_dmabuf->bits16,sizeof (val),HZ /2 ); + &priv->io_dmabuf->bits16,sizeof (val),500 );mutex_unlock (&priv->io_mutex); }
@@ -110,7 +110,7 @@ void rtl818x_iowrite32_idx(struct rtl818usb_control_msg (priv->udev,usb_sndctrlpipe (priv->udev,0 ),RTL8187_REQ_SET_REG ,RTL8187_REQT_WRITE , (unsigned long )addr, idx &0x03 , - &priv->io_dmabuf->bits32,sizeof (val),HZ /2 ); + &priv->io_dmabuf->bits32,sizeof (val),500 );mutex_unlock (&priv->io_mutex); }
@@ -186,7 +186,7 @@ static void rtl8225_write_8051(struct ieusb_control_msg (priv->udev,usb_sndctrlpipe (priv->udev,0 ),RTL8187_REQ_SET_REG ,RTL8187_REQT_WRITE , addr,0x8225 , &priv->io_dmabuf->bits16,sizeof (data), -HZ /2 ); +500 );mutex_unlock (&priv->io_mutex);
Greg Kroah-Hartman
maintainerPATCH 43/251 evm: mark evm_fixmode as __ro_after_init
In reply to Greg Kroah-HartmanFrom: Austin Kim <[email protected]>
commit 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 upstream.
The evm_fixmode is only configurable by command-line option and it is never modified outside initcalls, so declaring it with __ro_after_init is better.
--- security/integrity/evm/evm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/evm/evm_main.c +1 -1
@@ -56,7 +56,7 @@ char *evm_config_xattrnames[] = { NULL }; -static int evm_fixmode; +static int evm_fixmode__ro_after_init ;static int __init evm_set_fixmode (char *str) {if (strncmp (str,"fix" ,3 ) ==0 )
Greg Kroah-Hartman
maintainerPATCH 44/251 wcn36xx: Fix HT40 capability for 2Ghz band
In reply to Greg Kroah-HartmanFrom: Loic Poulain <[email protected]>
commit 960ae77f25631bbe4e3aafefe209b52e044baf31 upstream.
All wcn36xx controllers are supposed to support HT40 (and SGI40), This doubles the maximum bitrate/throughput with compatible APs.
Tested with wcn3620 & wcn3680B.
--- drivers/net/wireless/ath/wcn36xx/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/wcn36xx/main.c +3 -1
@@ -133,7 +133,9 @@ static struct ieee80211_supported_band w .cap = IEEE80211_HT_CAP_GRN_FLD |IEEE80211_HT_CAP_SGI_20 |IEEE80211_HT_CAP_DSSSCCK40 | - IEEE80211_HT_CAP_LSIG_TXOP_PROT, +IEEE80211_HT_CAP_LSIG_TXOP_PROT | +IEEE80211_HT_CAP_SGI_40 | + IEEE80211_HT_CAP_SUP_WIDTH_20_40, .ht_supported = true, .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
Greg Kroah-Hartman
maintainerPATCH 45/251 mwifiex: Read a PCI register after writing the TX ring write pointer
In reply to Greg Kroah-HartmanFrom: Jonas Dreßler <[email protected]>
commit e5f4eb8223aa740237cd463246a7debcddf4eda1 upstream.
On the 88W8897 PCIe+USB card the firmware randomly crashes after setting the TX ring write pointer. The issue is present in the latest firmware version 15.68.19.p21 of the PCIe+USB card.
Those firmware crashes can be worked around by reading any PCI register of the card after setting that register, so read the PCI_VENDOR_ID register here. The reason this works is probably because we keep the bus from entering an ASPM state for a bit longer, because that's what causes the cards firmware to crash.
This fixes a bug where during RX/TX traffic and with ASPM L1 substates enabled (the specific substates where the issue happens appear to be platform dependent), the firmware crashes and eventually a command timeout appears in the logs.
--- drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/marvell/mwifiex/pcie.c +8 -0
@@ -1316,6 +1316,14 @@ mwifiex_pcie_send_data(struct mwifiex_ad ret =-1 ; goto done_unmap; } + +/* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card +* seems to crash randomly after setting the TX ring write pointer when +* ASPM powersaving is enabled. A workaround seems to be keeping the bus +* busy by reading a random register afterwards. +*/ +mwifiex_read_reg (adapter,PCI_VENDOR_ID , &rx_val); +if ((mwifiex_pcie_txbd_not_full (card)) && tx_param->next_pkt_len) {/* have more packets and TxBD still can hold more */
Greg Kroah-Hartman
maintainerPATCH 46/251 libata: fix checking of DMA state
In reply to Greg Kroah-HartmanFrom: Reimar Döffinger <[email protected]>
commit f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b upstream.
Checking if DMA is enabled should be done via the ata_dma_enabled helper function, since the init state 0xff indicates disabled.
This meant that ATA_CMD_READ_LOG_DMA_EXT was used and probed for before DMA was enabled, which caused hangs for some combinations of controllers and devices.
It might also have caused it to be incorrectly disabled as broken, but there have been no reports of that.
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -2081,7 +2081,7 @@ unsigned int ata_read_log_page(struct at retry:ata_tf_init (dev, &tf); -if (dev->dma_mode &&ata_id_has_read_log_dma_ext (dev->id) && +if (ata_dma_enabled (dev) &&ata_id_has_read_log_dma_ext (dev->id) && !(dev->horkage &ATA_HORKAGE_NO_DMA_LOG )) { tf.command =ATA_CMD_READ_LOG_DMA_EXT ; tf.protocol =ATA_PROT_DMA ;
Greg Kroah-Hartman
maintainerPATCH 47/251 wcn36xx: handle connection loss indication
In reply to Greg Kroah-HartmanFrom: Benjamin Li <[email protected]>
commit d6dbce453b19c64b96f3e927b10230f9a704b504 upstream.
Firmware sends delete_sta_context_ind when it detects the AP has gone away in STA mode. Right now the handler for that indication only handles AP mode; fix it to also handle STA mode.
--- drivers/net/wireless/ath/wcn36xx/smd.c | 44 ++++++++++++++++++++++++--------- 1 file changed, 33 insertions(+), 11 deletions(-)
drivers/net/wireless/ath/wcn36xx/smd.c +33 -11
@@ -2082,30 +2082,52 @@ static int wcn36xx_smd_delete_sta_contex size_t len) {struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf; -struct wcn36xx_vif *tmp; +struct wcn36xx_vif *vif_priv; +struct ieee80211_vif *vif; +struct ieee80211_bss_conf *bss_conf;struct ieee80211_sta *sta; +bool found = false;if (len !=sizeof (*rsp)) {wcn36xx_warn ("Corrupted delete sta indication\n" );return -EIO ; } -wcn36xx_dbg (WCN36XX_DBG_HAL ,"delete station indication %pM index %d\n" , - rsp->addr2, rsp->sta_id); +wcn36xx_dbg (WCN36XX_DBG_HAL , +"delete station indication %pM index %d reason %d\n" , + rsp->addr2, rsp->sta_id, rsp->reason_code); -list_for_each_entry (tmp, &wcn->vif_list, list) { +list_for_each_entry (vif_priv, &wcn->vif_list, list) {rcu_read_lock (); - sta =ieee80211_find_sta (wcn36xx_priv_to_vif (tmp), rsp->addr2); -if (sta) -ieee80211_report_low_ack (sta,0 ); + vif =wcn36xx_priv_to_vif (vif_priv); + +if (vif->type ==NL80211_IFTYPE_STATION ) { +/* We could call ieee80211_find_sta too, but checking +* bss_conf is clearer. +*/ + bss_conf = &vif->bss_conf; +if (vif_priv->sta_assoc && + !memcmp (bss_conf->bssid, rsp->addr2,ETH_ALEN )) { + found = true; +wcn36xx_dbg (WCN36XX_DBG_HAL , +"connection loss bss_index %d\n" , + vif_priv->bss_index); +ieee80211_connection_loss (vif); + } + }else { + sta =ieee80211_find_sta (vif, rsp->addr2); +if (sta) { + found = true; +ieee80211_report_low_ack (sta,0 ); + } + } +rcu_read_unlock (); -if (sta) +if (found)return 0 ; } -wcn36xx_warn ("STA with addr %pM and index %d not found\n" , - rsp->addr2, - rsp->sta_id); +wcn36xx_warn ("BSS or STA with addr %pM not found\n" , rsp->addr2);return -ENOENT ; }
Greg Kroah-Hartman
maintainerPATCH 48/251 RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
In reply to Greg Kroah-HartmanFrom: Alok Prasad <[email protected]>
commit 4f960393a0ee9a39469ceb7c8077ae8db665cc12 upstream.
This patch fixes a crash caused by querying the QP via netlink, and corrects the state of GSI qp. GSI qp's have a NULL qed_qp.
The call trace is generated by:
$ rdma res show
BUG: kernel NULL pointer dereference, address: 0000000000000034 Hardware name: Dell Inc. PowerEdge R720/0M1GCR, BIOS 1.2.6 05/10/2012 RIP: 0010:qed_rdma_query_qp+0x33/0x1a0 [qed] RSP: 0018:ffffba560a08f580 EFLAGS: 00010206 RAX: 0000000200000000 RBX: ffffba560a08f5b8 RCX: 0000000000000000 RDX: ffffba560a08f5b8 RSI: 0000000000000000 RDI: ffff9807ee458090 RBP: ffffba560a08f5a0 R08: 0000000000000000 R09: ffff9807890e7048 R10: ffffba560a08f658 R11: 0000000000000000 R12: 0000000000000000 R13: ffff9807ee458090 R14: ffff9807f0afb000 R15: ffffba560a08f7ec FS: 00007fbbf8bfe740(0000) GS:ffff980aafa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000034 CR3: 00000001720ba001 CR4: 00000000000606f0 Call Trace: qedr_query_qp+0x82/0x360 [qedr] ib_query_qp+0x34/0x40 [ib_core] ? ib_query_qp+0x34/0x40 [ib_core] fill_res_qp_entry_query.isra.26+0x47/0x1d0 [ib_core] ? __nla_put+0x20/0x30 ? nla_put+0x33/0x40 fill_res_qp_entry+0xe3/0x120 [ib_core] res_get_common_dumpit+0x3f8/0x5d0 [ib_core] ? fill_res_cm_id_entry+0x1f0/0x1f0 [ib_core] nldev_res_get_qp_dumpit+0x1a/0x20 [ib_core] netlink_dump+0x156/0x2f0 __netlink_dump_start+0x1ab/0x260 rdma_nl_rcv+0x1de/0x330 [ib_core] ? nldev_res_get_cm_id_dumpit+0x20/0x20 [ib_core] netlink_unicast+0x1b8/0x270 netlink_sendmsg+0x33e/0x470 sock_sendmsg+0x63/0x70 __sys_sendto+0x13f/0x180 ? setup_sgl.isra.12+0x70/0xc0 __x64_sys_sendto+0x28/0x30 do_syscall_64+0x3a/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/infiniband/hw/qedr/verbs.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/infiniband/hw/qedr/verbs.c +9 -6
@@ -2045,15 +2045,18 @@ int qedr_query_qp(struct ib_qp *ibqp,int rc =0 ;memset (¶ms,0 ,sizeof (params)); - - rc = dev->ops->rdma_query_qp (dev->rdma_ctx, qp->qed_qp, ¶ms); -if (rc) - goto err; -memset (qp_attr,0 ,sizeof (*qp_attr));memset (qp_init_attr,0 ,sizeof (*qp_init_attr)); - qp_attr->qp_state =qedr_get_ibqp_state (params.state); +if (qp->qp_type !=IB_QPT_GSI ) { + rc = dev->ops->rdma_query_qp (dev->rdma_ctx, qp->qed_qp, ¶ms); +if (rc) + goto err; + qp_attr->qp_state =qedr_get_ibqp_state (params.state); + }else { + qp_attr->qp_state =qedr_get_ibqp_state (QED_ROCE_QP_STATE_RTS ); + } + qp_attr->cur_qp_state =qedr_get_ibqp_state (params.state); qp_attr->path_mtu =ib_mtu_int_to_enum (params.mtu); qp_attr->path_mig_state =IB_MIG_MIGRATED ;
Greg Kroah-Hartman
maintainerPATCH 49/251 signal: Remove the bogus sigkill_pending in ptrace_stop
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit 7d613f9f72ec8f90ddefcae038fdae5adb8404b3 upstream.
The existence of sigkill_pending is a little silly as it is functionally a duplicate of fatal_signal_pending that is used in exactly one place.
Checking for pending fatal signals and returning early in ptrace_stop is actively harmful. It casues the ptrace_stop called by ptrace_signal to return early before setting current->exit_code. Later when ptrace_signal reads the signal number from current->exit_code is undefined, making it unpredictable what will happen.
Instead rely on the fact that schedule will not sleep if there is a pending signal that can awaken a task.
Removing the explict sigkill_pending test fixes fixes ptrace_signal when ptrace_stop does not stop because current->exit_code is always set to to signr.
--- kernel/signal.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-)
kernel/signal.c +4 -15
@@ -1839,16 +1839,6 @@ static inline int may_ptrace_stop(void) }/* -* Return non-zero if there is a SIGKILL that should be waking us up. -* Called with the siglock held. -*/ -static int sigkill_pending (struct task_struct *tsk) -{ -return sigismember (&tsk->pending.signal,SIGKILL ) || -sigismember (&tsk->signal->shared_pending.signal,SIGKILL ); -} - -/* * This must be called with current->sighand->siglock held. * * This should be the path for all ptrace stops.
@@ -1873,17 +1863,16 @@ static void ptrace_stop(int exit_code, i* calling arch_ptrace_stop, so we must release it now. * To preserve proper semantics, we must do this before * any signal bookkeeping like checking group_stop_count. -* Meanwhile, a SIGKILL could come in before we retake the -* siglock. That must prevent us from sleeping in TASK_TRACED. -* So after regaining the lock, we must check for SIGKILL. */ spin_unlock_irq (¤t->sighand->siglock);arch_ptrace_stop (exit_code, info);spin_lock_irq (¤t->sighand->siglock); -if (sigkill_pending (current)) -return ; } +/* +* schedule() will not sleep if there is a pending signal that +* can awaken the task. +*/ set_special_state (TASK_TRACED );/*
Greg Kroah-Hartman
maintainerPATCH 50/251 signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit 95bf9d646c3c3f95cb0be7e703b371db8da5be68 upstream.
When an instruction to save or restore a register from the stack fails in _save_fp_context or _restore_fp_context return with -EFAULT. This change was made to r2300_fpu.S[1] but it looks like it got lost with the introduction of EX2[2]. This is also what the other implementation of _save_fp_context and _restore_fp_context in r4k_fpu.S does, and what is needed for the callers to be able to handle the error.
Furthermore calling do_exit(SIGSEGV) from bad_stack is wrong because it does not terminate the entire process it just terminates a single thread.
As the changed code was the only caller of arch/mips/kernel/syscall.c:bad_stack remove the problematic and now unused helper function.
Cc: Thomas Bogendoerfer <[email protected]>
Cc: Maciej Rozycki <[email protected]>
Cc: [email protected]
[1] 35938a00ba86 ("MIPS: Fix ISA I FP sigcontext access violation handling")
[2] f92722dc4545 ("MIPS: Correct MIPS I FP sigcontext layout")
--- arch/mips/kernel/r2300_fpu.S | 4 ++-- arch/mips/kernel/syscall.c | 9 --------- 2 files changed, 2 insertions(+), 11 deletions(-)
arch/mips/kernel/r2300_fpu.S +2 -2
@@ -29,8 +29,8 @@ #define EX2(a,b) \ 9: a,##b; \ .section __ex_table,"a"; \ - PTR 9b,bad_stack; \ - PTR 9b+4,bad_stack; \ + PTR 9b,fault; \ + PTR 9b+4,fault; \ .previous .set mips1
arch/mips/kernel/syscall.c +0 -9
@@ -233,12 +233,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr, {return -ENOSYS ; } - -/* -* If we ever come here the user sp is bad. Zap the process right away. -* Due to the bad stack signaling wouldn't work. -*/ -asmlinkage void bad_stack(void) -{ -do_exit (SIGSEGV ); -}
Greg Kroah-Hartman
maintainerPATCH 51/251 power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
In reply to Greg Kroah-HartmanFrom: Sebastian Krzyszkowiak <[email protected]>
commit e660dbb68c6b3f7b9eb8b9775846a44f9798b719 upstream.
max17042_set_soc_threshold gets called with offset set to 1, which means that minimum threshold value would underflow once SOC got down to 0, causing invalid alerts from the gauge.
--- drivers/power/supply/max17042_battery.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +2 -1
@@ -825,7 +825,8 @@ static void max17042_set_soc_threshold(sregmap_read (map, MAX17042_RepSOC, &soc); soc >>=8 ; soc_tr = (soc + off) <<8 ; - soc_tr |= (soc - off); +if (off < soc) + soc_tr |= soc - off;regmap_write (map, MAX17042_SALRT_Th, soc_tr); }
Greg Kroah-Hartman
maintainerPATCH 52/251 power: supply: max17042_battery: use VFSOC for capacity when no rsns
In reply to Greg Kroah-HartmanFrom: Henrik Grimler <[email protected]>
commit 223a3b82834f036a62aa831f67cbf1f1d644c6e2 upstream.
On Galaxy S3 (i9300/i9305), which has the max17047 fuel gauge and no current sense resistor (rsns), the RepSOC register does not provide an accurate state of charge value. The reported value is wrong, and does not change over time. VFSOC however, which uses the voltage fuel gauge to determine the state of charge, always shows an accurate value.
For devices without current sense, VFSOC is already used for the soc-alert (0x0003 is written to MiscCFG register), so with this change the source of the alert and the PROP_CAPACITY value match.
--- drivers/power/supply/max17042_battery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +4 -1
@@ -303,7 +303,10 @@ static int max17042_get_property(struct val->intval = data *625 /8 ;break ;case POWER_SUPPLY_PROP_CAPACITY : - ret =regmap_read (map, MAX17042_RepSOC, &data); +if (chip->pdata->enable_current_sense) + ret =regmap_read (map, MAX17042_RepSOC, &data); +else + ret =regmap_read (map,MAX17042_VFSOC , &data);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 53/251 powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
In reply to Greg Kroah-HartmanFrom: Xiaoming Ni <[email protected]>
commit 3c2172c1c47b4079c29f0e6637d764a99355ebcd upstream.
When the field described in mpc85xx_smp_guts_ids[] is not configured in dtb, the mpc85xx_setup_pmc() does not assign a value to the "guts" variable. As a result, the oops is triggered when mpc85xx_freeze_time_base() is executed.
--- arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c +1 -2
@@ -98,9 +98,8 @@ int __init mpc85xx_setup_pmc(void)pr_err ("Could not map guts node address\n" );return -ENOMEM ; } + qoriq_pm_ops = &mpc85xx_pm_ops; } - qoriq_pm_ops = &mpc85xx_pm_ops; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 54/251 serial: core: Fix initializing and restoring termios speed
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 027b57170bf8bb6999a28e4a5f3d78bf1db0f90c upstream.
Since commit edc6afc54968 ("tty: switch to ktermios and new framework") termios speed is no longer stored only in c_cflag member but also in new additional c_ispeed and c_ospeed members. If BOTHER flag is set in c_cflag then termios speed is stored only in these new members.
Therefore to correctly restore termios speed it is required to store also ispeed and ospeed members, not only cflag member.
In case only cflag member with BOTHER flag is restored then functions tty_termios_baud_rate() and tty_termios_input_baud_rate() returns baudrate stored in c_ospeed / c_ispeed member, which is zero as it was not restored too. If reported baudrate is invalid (e.g. zero) then serial core functions report fallback baudrate value 9600. So it means that in this case original baudrate is lost and kernel changes it to value 9600.
Simple reproducer of this issue is to boot kernel with following command line argument: "console=ttyXXX,86400" (where ttyXXX is the device name). For speed 86400 there is no Bnnn constant and therefore kernel has to represent this speed via BOTHER c_cflag. Which means that speed is stored only in c_ospeed and c_ispeed members, not in c_cflag anymore.
If bootloader correctly configures serial device to speed 86400 then kernel prints boot log to early console at speed speed 86400 without any issue. But after kernel starts initializing real console device ttyXXX then speed is changed to fallback value 9600 because information about speed was lost.
This patch fixes above issue by storing and restoring also ispeed and ospeed members, which are required for BOTHER flag.
--- drivers/tty/serial/serial_core.c | 16 ++++++++++++++-- include/linux/console.h | 2 ++ 2 files changed, 16 insertions(+), 2 deletions(-)
drivers/tty/serial/serial_core.c +14 -2
@@ -232,7 +232,11 @@ static int uart_port_startup(struct tty_if (retval ==0 ) {if (uart_console (uport) && uport->cons->cflag) { tty->termios.c_cflag = uport->cons->cflag; + tty->termios.c_ispeed = uport->cons->ispeed; + tty->termios.c_ospeed = uport->cons->ospeed; uport->cons->cflag =0 ; + uport->cons->ispeed =0 ; + uport->cons->ospeed =0 ; }/* * Initialise the hardware port settings.
@@ -300,8 +304,11 @@ static void uart_shutdown(struct tty_str/* * Turn off DTR and RTS early. */ -if (uport &&uart_console (uport) && tty) +if (uport &&uart_console (uport) && tty) { uport->cons->cflag = tty->termios.c_cflag; + uport->cons->ispeed = tty->termios.c_ispeed; + uport->cons->ospeed = tty->termios.c_ospeed; + }if (!tty ||C_HUPCL (tty))uart_port_dtr_rts (uport,0 );
@@ -2076,8 +2083,11 @@ uart_set_options(struct uart_port *port,* Allow the setting of the UART parameters with a NULL console * too: */ -if (co) +if (co) { co->cflag = termios.c_cflag; + co->ispeed = termios.c_ispeed; + co->ospeed = termios.c_ospeed; + }return 0 ; }
@@ -2211,6 +2221,8 @@ int uart_resume_port(struct uart_driver*/ memset (&termios,0 ,sizeof (struct ktermios )); termios.c_cflag = uport->cons->cflag; + termios.c_ispeed = uport->cons->ispeed; + termios.c_ospeed = uport->cons->ospeed;/* * If that's unset, use the tty termios setting.
include/linux/console.h +2 -0
@@ -145,6 +145,8 @@ struct console {short flags;short index;int cflag; +uint ispeed; +uint ospeed;void *data;struct console *next; };
Greg Kroah-Hartman
maintainerPATCH 55/251 ALSA: mixer: oss: Fix racy access to slots
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 411cef6adfb38a5bb6bd9af3941b28198e7fb680 upstream.
The OSS mixer can reassign the mapping slots dynamically via proc file. Although the addition and deletion of those slots are protected by mixer->reg_mutex, the access to slots aren't, hence this may cause UAF when the slots in use are deleted concurrently.
This patch applies the mixer->reg_mutex in all appropriate code paths (i.e. the ioctl functions) that may access slots.
--- sound/core/oss/mixer_oss.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-)
sound/core/oss/mixer_oss.c +33 -10
@@ -145,11 +145,13 @@ static int snd_mixer_oss_devmask(structif (mixer ==NULL )return -EIO ; +mutex_lock (&mixer->reg_mutex);for (chn =0 ; chn <31 ; chn++) { pslot = &mixer->slots[chn];if (pslot->put_volume || pslot->put_recsrc) result |=1 << chn; } +mutex_unlock (&mixer->reg_mutex);return result; }
@@ -161,11 +163,13 @@ static int snd_mixer_oss_stereodevs(struif (mixer ==NULL )return -EIO ; +mutex_lock (&mixer->reg_mutex);for (chn =0 ; chn <31 ; chn++) { pslot = &mixer->slots[chn];if (pslot->put_volume && pslot->stereo) result |=1 << chn; } +mutex_unlock (&mixer->reg_mutex);return result; }
@@ -176,6 +180,7 @@ static int snd_mixer_oss_recmask(structif (mixer ==NULL )return -EIO ; +mutex_lock (&mixer->reg_mutex);if (mixer->put_recsrc && mixer->get_recsrc) {/* exclusive */ result = mixer->mask_recsrc; }else {
@@ -187,6 +192,7 @@ static int snd_mixer_oss_recmask(struct result |=1 << chn; } } +mutex_unlock (&mixer->reg_mutex);return result; }
@@ -197,11 +203,12 @@ static int snd_mixer_oss_get_recsrc(struif (mixer ==NULL )return -EIO ; +mutex_lock (&mixer->reg_mutex);if (mixer->put_recsrc && mixer->get_recsrc) {/* exclusive */ -int err;unsigned int index; -if ((err = mixer->get_recsrc (fmixer, &index)) <0 ) -return err; + result = mixer->get_recsrc (fmixer, &index); +if (result <0 ) + goto unlock; result =1 << index; }else {struct snd_mixer_oss_slot *pslot;
@@ -216,7 +223,10 @@ static int snd_mixer_oss_get_recsrc(stru } } } -return mixer->oss_recsrc = result; + mixer->oss_recsrc = result; + unlock: +mutex_unlock (&mixer->reg_mutex); +return result; }static int snd_mixer_oss_set_recsrc (struct snd_mixer_oss_file *fmixer,int recsrc)
@@ -229,6 +239,7 @@ static int snd_mixer_oss_set_recsrc(struif (mixer ==NULL )return -EIO ; +mutex_lock (&mixer->reg_mutex);if (mixer->get_recsrc && mixer->put_recsrc) {/* exclusive input */ if (recsrc & ~mixer->oss_recsrc) recsrc &= ~mixer->oss_recsrc;
@@ -254,6 +265,7 @@ static int snd_mixer_oss_set_recsrc(stru } } } +mutex_unlock (&mixer->reg_mutex);return result; }
@@ -265,6 +277,7 @@ static int snd_mixer_oss_get_volume(struif (mixer ==NULL || slot >30 )return -EIO ; +mutex_lock (&mixer->reg_mutex); pslot = &mixer->slots[slot]; left = pslot->volume[0 ]; right = pslot->volume[1 ];
@@ -272,15 +285,21 @@ static int snd_mixer_oss_get_volume(stru result = pslot->get_volume (fmixer, pslot, &left, &right);if (!pslot->stereo) right = left; -if (snd_BUG_ON (left <0 || left >100 )) -return -EIO ; -if (snd_BUG_ON (right <0 || right >100 )) -return -EIO ; +if (snd_BUG_ON (left <0 || left >100 )) { + result = -EIO ; + goto unlock; + } +if (snd_BUG_ON (right <0 || right >100 )) { + result = -EIO ; + goto unlock; + }if (result >=0 ) { pslot->volume[0 ] = left; pslot->volume[1 ] = right; result = (left &0xff ) | ((right &0xff ) <<8 ); } + unlock: +mutex_unlock (&mixer->reg_mutex);return result; }
@@ -293,6 +312,7 @@ static int snd_mixer_oss_set_volume(struif (mixer ==NULL || slot >30 )return -EIO ; +mutex_lock (&mixer->reg_mutex); pslot = &mixer->slots[slot];if (left >100 ) left =100 ;
@@ -303,10 +323,13 @@ static int snd_mixer_oss_set_volume(struif (pslot->put_volume) result = pslot->put_volume (fmixer, pslot, left, right);if (result <0 ) -return result; + goto unlock; pslot->volume[0 ] = left; pslot->volume[1 ] = right; -return (left &0xff ) | ((right &0xff ) <<8 ); + result = (left &0xff ) | ((right &0xff ) <<8 ); + unlock: +mutex_lock (&mixer->reg_mutex); +return result; }static int snd_mixer_oss_ioctl1 (struct snd_mixer_oss_file *fmixer,unsigned int cmd,unsigned long arg)
Greg Kroah-Hartman
maintainerPATCH 56/251 ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit 3ab7992018455ac63c33e9b3eaa7264e293e40f4 upstream.
In commit 411cef6adfb3 ("ALSA: mixer: oss: Fix racy access to slots") added mutex protection in snd_mixer_oss_set_volume(). Second mutex_lock() in same function looks like typo, fix it.
--- sound/core/oss/mixer_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/oss/mixer_oss.c +1 -1
@@ -328,7 +328,7 @@ static int snd_mixer_oss_set_volume(stru pslot->volume[1 ] = right; result = (left &0xff ) | ((right &0xff ) <<8 ); unlock: -mutex_lock (&mixer->reg_mutex); +mutex_unlock (&mixer->reg_mutex);return result; }
Greg Kroah-Hartman
maintainerPATCH 57/251 xen/balloon: add late_initcall_sync() for initial ballooning done
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 40fdea0284bb20814399da0484a658a96c735d90 upstream.
When running as PVH or HVM guest with actual memory < max memory the hypervisor is using "populate on demand" in order to allow the guest to balloon down from its maximum memory size. For this to work correctly the guest must not touch more memory pages than its target memory size as otherwise the PoD cache will be exhausted and the guest is crashed as a result of that.
In extreme cases ballooning down might not be finished today before the init process is started, which can consume lots of memory.
In order to avoid random boot crashes in such cases, add a late init call to wait for ballooning down having finished for PVH/HVM guests.
Warn on console if initial ballooning fails, panic() after stalling for more than 3 minutes per default. Add a module parameter for changing this timeout.
[boris: replaced pr_info() with pr_notice()]
--- Documentation/admin-guide/kernel-parameters.txt | 7 + drivers/xen/balloon.c | 86 +++++++++++++++++------- 2 files changed, 70 insertions(+), 23 deletions(-)
Documentation/admin-guide/kernel-parameters.txt +7 -0
@@ -5030,6 +5030,13 @@ Disables the PV optimizations forcing the HVM guest to run as generic HVM guest with no PV drivers. + xen.balloon_boot_timeout= [XEN] + The time (in seconds) to wait before giving up to boot + in case initial ballooning fails to free enough memory. + Applies only when running as HVM or PVH guest and + started with less memory configured than allowed at + max. Default is 180. + xen.event_eoi_delay= [XEN] How long to delay EOI handling in case of event storms (jiffies). Default is 10.
drivers/xen/balloon.c +63 -23
173 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 58/251 PCI: aardvark: Do not clear status bits of masked interrupts
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit a7ca6d7fa3c02c032db5440ff392d96c04684c21 upstream.
The PCIE_ISR1_REG says which interrupts are currently set / active, including those which are masked.
The driver currently reads this register and looks if some unmasked interrupts are active, and if not, it clears status bits of _all_ interrupts, including the masked ones.
This is incorrect, since, for example, some drivers may poll these bits.
Remove this clearing, and also remove this early return statement completely, since it does not change functionality in any way.
--- drivers/pci/host/pci-aardvark.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/pci/host/pci-aardvark.c +0 -6
@@ -863,12 +863,6 @@ static void advk_pcie_handle_int(struct isr1_mask =advk_readl (pcie,PCIE_ISR1_MASK_REG ); isr1_status = isr1_val & ((~isr1_mask) &PCIE_ISR1_ALL_MASK ); -if (!isr0_status && !isr1_status) { -advk_writel (pcie, isr0_val,PCIE_ISR0_REG ); -advk_writel (pcie, isr1_val,PCIE_ISR1_REG ); -return ; - } -/* Process MSI interrupts */ if (isr0_status &PCIE_ISR0_MSI_INT_PENDING )advk_pcie_handle_msi (pcie);
Greg Kroah-Hartman
maintainerPATCH 59/251 PCI: aardvark: Do not unmask unused interrupts
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 1fb95d7d3c7a926b002fe8a6bd27a1cb428b46dc upstream.
There are lot of undocumented interrupt bits. To prevent unwanted spurious interrupts, fix all *_ALL_MASK macros to define all interrupt bits, so that driver can properly mask all interrupts, including those which are undocumented.
--- drivers/pci/host/pci-aardvark.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/host/pci-aardvark.c +3 -3
@@ -100,13 +100,13 @@#define PCIE_ISR0_MSI_INT_PENDING BIT(24)#define PCIE_ISR0_INTX_ASSERT (val) BIT(16 + (val))#define PCIE_ISR0_INTX_DEASSERT (val) BIT(20 + (val)) -#define PCIE_ISR0_ALL_MASK GENMASK(26, 0) +#define PCIE_ISR0_ALL_MASK GENMASK(31, 0)#define PCIE_ISR1_REG (CONTROL_BASE_ADDR + 0x48)#define PCIE_ISR1_MASK_REG (CONTROL_BASE_ADDR + 0x4C)#define PCIE_ISR1_POWER_STATE_CHANGE BIT(4)#define PCIE_ISR1_FLUSH BIT(5)#define PCIE_ISR1_INTX_ASSERT (val) BIT(8 + (val)) -#define PCIE_ISR1_ALL_MASK GENMASK(11, 4) +#define PCIE_ISR1_ALL_MASK GENMASK(31, 0)#define PCIE_MSI_ADDR_LOW_REG (CONTROL_BASE_ADDR + 0x50)#define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54)#define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58)
@@ -169,7 +169,7 @@#define PCIE_IRQ_MSI_INT2_DET BIT(21)#define PCIE_IRQ_RC_DBELL_DET BIT(22)#define PCIE_IRQ_EP_STATUS BIT(23) -#define PCIE_IRQ_ALL_MASK 0xfff0fb +#define PCIE_IRQ_ALL_MASK GENMASK(31, 0)#define PCIE_IRQ_ENABLE_INTS_MASK PCIE_IRQ_CORE_INT/* Transaction types */
Greg Kroah-Hartman
maintainerPATCH 60/251 PCI: aardvark: Fix return value of MSI domain .alloc() method
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit e4313be1599d397625c14fb7826996813622decf upstream.
MSI domain callback .alloc() (implemented by advk_msi_irq_domain_alloc() function) should return zero on success, since non-zero value indicates failure.
When the driver was converted to generic MSI API in commit f21a8b1b6837 ("PCI: aardvark: Move to MSI handling using generic MSI support"), it was converted so that it returns hwirq number.
Fix this.
--- drivers/pci/host/pci-aardvark.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/host/pci-aardvark.c +1 -1
@@ -662,7 +662,7 @@ static int advk_msi_irq_domain_alloc(str domain->host_data, handle_simple_irq, NULL, NULL); -return hwirq; +return 0 ; } static void advk_msi_irq_domain_free(struct irq_domain *domain,
Greg Kroah-Hartman
maintainerPATCH 61/251 PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit 95997723b6402cd6c53e0f9e7ac640ec64eaaff8 upstream.
The PCIE_MSI_PAYLOAD_REG contains 16-bit MSI number, not only lower 8 bits. Fix reading content of this register and add a comment describing the access to this register.
--- drivers/pci/host/pci-aardvark.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/pci/host/pci-aardvark.c +6 -1
@@ -112,6 +112,7 @@#define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58)#define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C)#define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) +#define PCIE_MSI_DATA_MASK GENMASK(15, 0)/* PCIe window configuration */ #define OB_WIN_BASE_ADDR 0x4c00
@@ -840,8 +841,12 @@ static void advk_pcie_handle_msi(structif (!(BIT (msi_idx) & msi_status))continue ; +/* +* msi_idx contains bits [4:0] of the msi_data and msi_data +* contains 16bit MSI interrupt number +*/ advk_writel (pcie,BIT (msi_idx),PCIE_MSI_STATUS_REG ); - msi_data =advk_readl (pcie,PCIE_MSI_PAYLOAD_REG ) &0xFF ; + msi_data =advk_readl (pcie,PCIE_MSI_PAYLOAD_REG ) &PCIE_MSI_DATA_MASK ;generic_handle_irq (msi_data); }
Greg Kroah-Hartman
maintainerPATCH 62/251 quota: check block number when reading the block in quota file
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
commit 9bf3d20331295b1ecb81f4ed9ef358c51699a050 upstream.
The block number in the quota tree on disk should be smaller than the v2_disk_dqinfo.dqi_blocks. If the quota file was corrupted, we may be allocating an 'allocated' block and that would lead to a loop in a tree, which will probably trigger oops later. This patch adds a check for the block number in the quota tree to prevent such potential issue.
--- fs/quota/quota_tree.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/quota/quota_tree.c +14 -0
@@ -487,6 +487,13 @@ static int remove_tree(struct qtree_mem_ goto out_buf; } newblk =le32_to_cpu (ref[get_index (info, dquot->dq_id, depth)]); +if (newblk <QT_TREEOFF || newblk >= info->dqi_blocks) { +quota_error (dquot->dq_sb,"Getting block too big (%u >= %u)" , + newblk, info->dqi_blocks); + ret = -EUCLEAN ; + goto out_buf; + } +if (depth == info->dqi_qtree_depth -1 ) { ret =free_dqentry (info, dquot, newblk); newblk =0 ;
@@ -586,6 +593,13 @@ static loff_t find_tree_dqentry(struct q blk =le32_to_cpu (ref[get_index (info, dquot->dq_id, depth)]);if (!blk)/* No reference? */ goto out_buf; +if (blk <QT_TREEOFF || blk >= info->dqi_blocks) { +quota_error (dquot->dq_sb,"Getting block too big (%u >= %u)" , + blk, info->dqi_blocks); + ret = -EUCLEAN ; + goto out_buf; + } +if (depth < info->dqi_qtree_depth -1 ) ret =find_tree_dqentry (info, dquot, blk, depth+1 );else
Greg Kroah-Hartman
maintainerPATCH 63/251 quota: correct error number in free_dqentry()
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
commit d0e36a62bd4c60c09acc40e06ba4831a4d0bc75b upstream.
Fix the error path in free_dqentry(), pass out the error number if the block to free is not correct.
--- fs/quota/quota_tree.c | 1 + 1 file changed, 1 insertion(+)
fs/quota/quota_tree.c +1 -0
@@ -422,6 +422,7 @@ static int free_dqentry(struct qtree_memquota_error (dquot->dq_sb,"Quota structure has offset to " "other block (%u) than it should (%u)" , blk, (uint)(dquot->dq_off >> info->dqi_blocksize_bits)); + ret = -EIO ; goto out_buf; } ret =read_blk (info, blk, buf);
Greg Kroah-Hartman
maintainerPATCH 64/251 pinctrl: core: fix possible memory leak in pinctrl_enable()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit c7892ae13e461ed20154321eb792e07ebe38f5b3 upstream.
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888020a7a680 (size 64):
comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s) hex dump (first 32 bytes):
00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff .H........V.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360
[<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70
[<0000000064346707>] pinctrl_register+0x27/0x80
[<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0
[<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08]
[<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c]If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin() need be freed.
--- drivers/pinctrl/core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/core.c +2 -0
@@ -2061,6 +2061,8 @@ int pinctrl_enable(struct pinctrl_dev *pif (error) {dev_err (pctldev->dev,"could not claim hogs: %i\n" , error); +pinctrl_free_pindescs (pctldev, pctldev->desc->pins, + pctldev->desc->npins);mutex_destroy (&pctldev->mutex);kfree (pctldev);
Greg Kroah-Hartman
maintainerPATCH 65/251 iio: dac: ad5446: Fix ad5622_write() return value
In reply to Greg Kroah-HartmanFrom: Pekka Korpinen <[email protected]>
commit 558df982d4ead9cac628153d0d7b60feae05ddc8 upstream.
On success i2c_master_send() returns the number of bytes written. The call from iio_write_channel_info(), however, expects the return value to be zero on success.
This bug causes incorrect consumption of the sysfs buffer in iio_write_channel_info(). When writing more than two characters to out_voltage0_raw, the ad5446 write handler is called multiple times causing unexpected behavior.
--- drivers/iio/dac/ad5446.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/iio/dac/ad5446.c +8 -1
@@ -510,8 +510,15 @@ static int ad5622_write(struct ad5446_st {struct i2c_client *client =to_i2c_client (st->dev);__be16 data =cpu_to_be16 (val); +int ret; -return i2c_master_send (client, (char *)&data,sizeof (data)); + ret =i2c_master_send (client, (char *)&data,sizeof (data)); +if (ret <0 ) +return ret; +if (ret !=sizeof (data)) +return -EIO ; + +return 0 ; }/**
Greg Kroah-Hartman
maintainerPATCH 66/251 USB: serial: keyspan: fix memleak on probe errors
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
commit 910c996335c37552ee30fcb837375b808bb4f33b upstream.
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888258228440 (size 64):
comm "kworker/7:2", pid 2005, jiffies 4294989509 (age 824.540s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
[<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
[<ffffffffa02ac0e4>] keyspan_port_probe+0xa4/0x5d0 [keyspan]
[<ffffffffa0294c07>] usb_serial_device_probe+0x97/0x1d0 [usbserial]
[<ffffffff82b50ca7>] really_probe+0x167/0x460
[<ffffffff82b51099>] __driver_probe_device+0xf9/0x180
[<ffffffff82b51173>] driver_probe_device+0x53/0x130
[<ffffffff82b516f5>] __device_attach_driver+0x105/0x130
[<ffffffff82b4cfe9>] bus_for_each_drv+0x129/0x190
[<ffffffff82b50a69>] __device_attach+0x1c9/0x270
[<ffffffff82b518d0>] device_initial_probe+0x20/0x30
[<ffffffff82b4f062>] bus_probe_device+0x142/0x160
[<ffffffff82b4a4e9>] device_add+0x829/0x1300
[<ffffffffa0295fda>] usb_serial_probe.cold+0xc9b/0x14ac [usbserial]
[<ffffffffa02266aa>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
[<ffffffff82b50ca7>] really_probe+0x167/0x460If keyspan_port_probe() fails to allocate memory for an out_buffer[i] or in_buffer[i], the previously allocated memory for out_buffer or in_buffer needs to be freed on the error handling path, otherwise a memory leak will result.
--- drivers/usb/serial/keyspan.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/usb/serial/keyspan.c +7 -8
@@ -2914,22 +2914,22 @@ static int keyspan_port_probe(struct usbfor (i =0 ; i <ARRAY_SIZE (p_priv->in_buffer); ++i) { p_priv->in_buffer[i] =kzalloc (IN_BUFLEN ,GFP_KERNEL );if (!p_priv->in_buffer[i]) - goto err_in_buffer; + goto err_free_in_buffer; }for (i =0 ; i <ARRAY_SIZE (p_priv->out_buffer); ++i) { p_priv->out_buffer[i] =kzalloc (OUT_BUFLEN ,GFP_KERNEL );if (!p_priv->out_buffer[i]) - goto err_out_buffer; + goto err_free_out_buffer; } p_priv->inack_buffer =kzalloc (INACK_BUFLEN ,GFP_KERNEL );if (!p_priv->inack_buffer) - goto err_inack_buffer; + goto err_free_out_buffer; p_priv->outcont_buffer =kzalloc (OUTCONT_BUFLEN ,GFP_KERNEL );if (!p_priv->outcont_buffer) - goto err_outcont_buffer; + goto err_free_inack_buffer; p_priv->device_details = d_details;
@@ -2975,15 +2975,14 @@ static int keyspan_port_probe(struct usbreturn 0 ; -err_outcont_buffer: +err_free_inack_buffer:kfree (p_priv->inack_buffer); -err_inack_buffer: +err_free_out_buffer:for (i =0 ; i <ARRAY_SIZE (p_priv->out_buffer); ++i)kfree (p_priv->out_buffer[i]); -err_out_buffer: +err_free_in_buffer:for (i =0 ; i <ARRAY_SIZE (p_priv->in_buffer); ++i)kfree (p_priv->in_buffer[i]); -err_in_buffer:kfree (p_priv);return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 67/251 USB: iowarrior: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 79a4479a17b83310deb0b1a2a274fe5be12d2318 upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
Use the common control-message timeout define for the five-second timeout and drop the driver-specific one.
--- drivers/usb/misc/iowarrior.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/usb/misc/iowarrior.c +2 -6
@@ -103,10 +103,6 @@ struct iowarrior {/* globals */ /*--------------*/ -/* -* USB spec identifies 5 second timeouts. -*/ -#define GET_TIMEOUT 5#define USB_REQ_GET_REPORT 0x01//#if 0 static int usb_get_report(struct usb_device *dev,
@@ -118,7 +114,7 @@ static int usb_get_report(struct usb_devUSB_DIR_IN |USB_TYPE_CLASS |USB_RECIP_INTERFACE , (type <<8 ) + id, inter->desc.bInterfaceNumber, buf, size, - GET_TIMEOUT*HZ); + USB_CTRL_GET_TIMEOUT); }//#endif
@@ -133,7 +129,7 @@ static int usb_set_report(struct usb_intUSB_TYPE_CLASS |USB_RECIP_INTERFACE , (type <<8 ) + id, intf->cur_altsetting->desc.bInterfaceNumber, buf, - size, HZ); + size, 1000); }/*---------------------*/
Greg Kroah-Hartman
maintainerPATCH 68/251 Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 99c23da0eed4fd20cae8243f2b51e10e66aa0951 ]
The sco_send_frame() also takes lock_sock() during memcpy_from_msg() call that may be endlessly blocked by a task with userfaultd technique, and this will result in a hung task watchdog trigger.
Just like the similar fix for hci_sock_sendmsg() in commit 92c685dc5de0 ("Bluetooth: reorganize functions..."), this patch moves the memcpy_from_msg() out of lock_sock() for addressing the hang.
This should be the last piece for fixing CVE-2021-3640 after a few already queued fixes.
--- net/bluetooth/sco.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
net/bluetooth/sco.c +16 -8
@@ -255,7 +255,8 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)return err; } -static int sco_send_frame (struct sock *sk,struct msghdr *msg,int len) +static int sco_send_frame (struct sock *sk,void *buf,int len, +unsigned int msg_flags) {struct sco_conn *conn =sco_pi (sk)->conn;struct sk_buff *skb;
@@ -267,15 +268,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)BT_DBG ("sk %p len %d" , sk, len); - skb =bt_skb_send_alloc (sk, len, msg->msg_flags &MSG_DONTWAIT , &err); + skb =bt_skb_send_alloc (sk, len, msg_flags &MSG_DONTWAIT , &err);if (!skb)return err; -if (memcpy_from_msg (skb_put (skb, len), msg, len)) { -kfree_skb (skb); -return -EFAULT ; - } - +memcpy (skb_put (skb, len), buf, len);hci_send_sco (conn->hcon, skb);return len;
@@ -692,6 +689,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) {struct sock *sk = sock->sk; +void *buf;int err;BT_DBG ("sock %p, sk %p" , sock, sk);
@@ -703,14 +701,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,if (msg->msg_flags &MSG_OOB )return -EOPNOTSUPP ; + buf =kmalloc (len,GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + +if (memcpy_from_msg (buf, msg, len)) { +kfree (buf); +return -EFAULT ; + } +lock_sock (sk);if (sk->sk_state ==BT_CONNECTED ) - err =sco_send_frame (sk, msg, len); + err =sco_send_frame (sk, buf, len, msg->msg_flags);else err = -ENOTCONN ;release_sock (sk); +kfree (buf);return err; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 69/251 Bluetooth: fix use-after-free error in lock_sock_nested()
In reply to Greg Kroah-HartmanFrom: Wang ShaoBo <[email protected]>
[ Upstream commit 1bff51ea59a9afb67d2dd78518ab0582a54a472c ]
use-after-free error in lock_sock_nested is reported:
[ 179.140137][ T3731] ===================================================== [ 179.142675][ T3731] BUG: KMSAN: use-after-free in lock_sock_nested+0x280/0x2c0 [ 179.145494][ T3731] CPU: 4 PID: 3731 Comm: kworker/4:2 Not tainted 5.12.0-rc6+ #54 [ 179.148432][ T3731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 179.151806][ T3731] Workqueue: events l2cap_chan_timeout [ 179.152730][ T3731] Call Trace: [ 179.153301][ T3731] dump_stack+0x24c/0x2e0 [ 179.154063][ T3731] kmsan_report+0xfb/0x1e0 [ 179.154855][ T3731] __msan_warning+0x5c/0xa0 [ 179.155579][ T3731] lock_sock_nested+0x280/0x2c0 [ 179.156436][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.157257][ T3731] l2cap_sock_teardown_cb+0xb8/0x890 [ 179.158154][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.159141][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.159994][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.160959][ T3731] ? l2cap_sock_recv_cb+0x420/0x420 [ 179.161834][ T3731] l2cap_chan_del+0x3e1/0x1d50 [ 179.162608][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.163435][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.164406][ T3731] l2cap_chan_close+0xeea/0x1050 [ 179.165189][ T3731] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 179.166180][ T3731] l2cap_chan_timeout+0x1da/0x590 [ 179.167066][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.168023][ T3731] ? l2cap_chan_create+0x560/0x560 [ 179.168818][ T3731] process_one_work+0x121d/0x1ff0 [ 179.169598][ T3731] worker_thread+0x121b/0x2370 [ 179.170346][ T3731] kthread+0x4ef/0x610 [ 179.171010][ T3731] ? process_one_work+0x1ff0/0x1ff0 [ 179.171828][ T3731] ? kthread_blkcg+0x110/0x110 [ 179.172587][ T3731] ret_from_fork+0x1f/0x30 [ 179.173348][ T3731] [ 179.173752][ T3731] Uninit was created at: [ 179.174409][ T3731] kmsan_internal_poison_shadow+0x5c/0xf0 [ 179.175373][ T3731] kmsan_slab_free+0x76/0xc0 [ 179.176060][ T3731] kfree+0x3a5/0x1180 [ 179.176664][ T3731] __sk_destruct+0x8af/0xb80 [ 179.177375][ T3731] __sk_free+0x812/0x8c0 [ 179.178032][ T3731] sk_free+0x97/0x130 [ 179.178686][ T3731] l2cap_sock_release+0x3d5/0x4d0 [ 179.179457][ T3731] sock_close+0x150/0x450 [ 179.180117][ T3731] __fput+0x6bd/0xf00 [ 179.180787][ T3731] ____fput+0x37/0x40 [ 179.181481][ T3731] task_work_run+0x140/0x280 [ 179.182219][ T3731] do_exit+0xe51/0x3e60 [ 179.182930][ T3731] do_group_exit+0x20e/0x450 [ 179.183656][ T3731] get_signal+0x2dfb/0x38f0 [ 179.184344][ T3731] arch_do_signal_or_restart+0xaa/0xe10 [ 179.185266][ T3731] exit_to_user_mode_prepare+0x2d2/0x560 [ 179.186136][ T3731] syscall_exit_to_user_mode+0x35/0x60 [ 179.186984][ T3731] do_syscall_64+0xc5/0x140 [ 179.187681][ T3731] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 179.188604][ T3731] =====================================================
In our case, there are two Thread A and B:
Context: Thread A: Context: Thread B:
l2cap_chan_timeout() __se_sys_shutdown()
l2cap_chan_close() l2cap_sock_shutdown()
l2cap_chan_del() l2cap_chan_close()
l2cap_sock_teardown_cb() l2cap_sock_teardown_cb()
Once l2cap_sock_teardown_cb() excuted, this sock will be marked as SOCK_ZAPPED, and can be treated as killable in l2cap_sock_kill() if sock_orphan() has excuted, at this time we close sock through sock_close() which end to call l2cap_sock_kill() like Thread C:
Context: Thread C:
sock_close()
l2cap_sock_release()
sock_orphan()
l2cap_sock_kill() #free sock if refcnt is 1
If C completed, Once A or B reaches l2cap_sock_teardown_cb() again, use-after-free happened.
We should set chan->data to NULL if sock is destructed, for telling teardown operation is not allowed in l2cap_sock_teardown_cb(), and also we should avoid killing an already killed socket in l2cap_sock_close_cb().
--- net/bluetooth/l2cap_sock.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/bluetooth/l2cap_sock.c +9 -1
@@ -1329,6 +1329,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan) {struct sock *sk = chan->data; +if (!sk) +return ; +l2cap_sock_kill (sk); }
@@ -1337,6 +1340,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)struct sock *sk = chan->data;struct sock *parent; +if (!sk) +return ; +BT_DBG ("chan %p state %s" , chan,state_to_string (chan->state));/* This callback can be called both for server (BT_LISTEN)
@@ -1520,8 +1526,10 @@ static void l2cap_sock_destruct(struct sock *sk) {BT_DBG ("sk %p" , sk); -if (l2cap_pi (sk)->chan) +if (l2cap_pi (sk)->chan) { +l2cap_pi (sk)->chan->data =NULL ;l2cap_chan_put (l2cap_pi (sk)->chan); + }if (l2cap_pi (sk)->rx_busy_skb) {kfree_skb (l2cap_pi (sk)->rx_busy_skb);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 70/251 platform/x86: wmi: do not fail if disabling fails
In reply to Greg Kroah-HartmanFrom: Barnabás Pőcze <[email protected]>
[ Upstream commit 1975718c488a39128f1f515b23ae61a5a214cc3d ]
Previously, __query_block() would fail if the second WCxx method call failed. However, the WQxx method might have succeeded, and potentially allocated memory for the result. Instead of throwing away the result and potentially leaking memory, ignore the result of
the second WCxx call.
--- drivers/platform/x86/wmi.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/platform/x86/wmi.c +8 -1
@@ -307,7 +307,14 @@ static acpi_status __query_block(struct wmi_block *wblock, u8 instance,* the WQxx method failed - we should disable collection anyway. */ if ((block->flags &ACPI_WMI_EXPENSIVE ) &&ACPI_SUCCESS (wc_status)) { - status =acpi_execute_simple_method (handle, wc_method,0 ); +/* +* Ignore whether this WCxx call succeeds or not since +* the previously executed WQxx method call might have +* succeeded, and returning the failing status code +* of this call would throw away the result of the WQxx +* call, potentially leaking memory. +*/ +acpi_execute_simple_method (handle, wc_method,0 ); }return status;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 71/251 MIPS: lantiq: dma: add small delay after reset
In reply to Greg Kroah-HartmanFrom: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit c12aa581f6d5e80c3c3675ab26a52c2b3b62f76e ]
Reading the DMA registers immediately after the reset causes Data Bus Error. Adding a small delay fixes this issue.
--- arch/mips/lantiq/xway/dma.c | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/lantiq/xway/dma.c +3 -0
@@ -22,6 +22,7 @@#include <linux/export.h> #include <linux/spinlock.h> #include <linux/clk.h> +#include <linux/delay.h> #include <linux/err.h> #include <lantiq_soc.h>
@@ -234,6 +235,8 @@ ltq_dma_init(struct platform_device *pdev)clk_enable (clk);ltq_dma_w32_mask (0 ,DMA_RESET ,LTQ_DMA_CTRL ); +usleep_range (1 ,10 ); +/* disable all interrupts */ ltq_dma_w32 (0 ,LTQ_DMA_IRNEN );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 72/251 MIPS: lantiq: dma: reset correct number of channel
In reply to Greg Kroah-HartmanFrom: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 5ca9ce2ba4d5884cd94d1a856c675ab1242cd242 ]
Different SoCs have a different number of channels, e.g .:
* amazon-se has 10 channels,
* danube+ar9 have 20 channels,
* vr9 has 28 channels,
* ar10 has 24 channels.
We can read the ID register and, depending on the reported number of channels, reset the appropriate number of channels.
--- arch/mips/lantiq/xway/dma.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/mips/lantiq/xway/dma.c +6 -5
@@ -41,6 +41,7 @@#define LTQ_DMA_PCTRL 0x44#define LTQ_DMA_IRNEN 0xf4 +#define DMA_ID_CHNR GENMASK(26, 20)/* channel number */ #define DMA_DESCPT BIT(3)/* descriptor complete irq */ #define DMA_TX BIT(8)/* TX channel direction */ #define DMA_CHAN_ON BIT(0)/* channel on / off bit */
@@ -51,7 +52,6 @@#define DMA_POLL BIT(31)/* turn on channel polling */ #define DMA_CLK_DIV4 BIT(6)/* polling clock divider */ #define DMA_2W_BURST BIT(1)/* 2 word burst length */ -#define DMA_MAX_CHANNEL 20/* the soc has 20 channels */ #define DMA_ETOP_ENDIANNESS (0xf << 8)/* endianness swap etop channels */ #define DMA_WEIGHT (BIT(17) | BIT(16))/* default channel wheight */
@@ -219,7 +219,7 @@ ltq_dma_init(struct platform_device *pdev) {struct clk *clk;struct resource *res; -unsigned id; +unsigned int id, nchannels;int i; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );
@@ -241,17 +241,18 @@ ltq_dma_init(struct platform_device *pdev)ltq_dma_w32 (0 ,LTQ_DMA_IRNEN );/* reset/configure each channel */ -for (i =0 ; i <DMA_MAX_CHANNEL ; i++) { + id =ltq_dma_r32 (LTQ_DMA_ID ); + nchannels = ((id &DMA_ID_CHNR ) >>20 ); +for (i =0 ; i < nchannels; i++) {ltq_dma_w32 (i,LTQ_DMA_CS );ltq_dma_w32 (DMA_CHAN_RST ,LTQ_DMA_CCTRL );ltq_dma_w32 (DMA_POLL |DMA_CLK_DIV4 ,LTQ_DMA_CPOLL );ltq_dma_w32_mask (DMA_CHAN_ON ,0 ,LTQ_DMA_CCTRL ); } - id =ltq_dma_r32 (LTQ_DMA_ID );dev_info (&pdev->dev,"Init done - hw rev: %X, ports: %d, channels: %d\n" , - id &0x1f , (id >>16 ) &0xf , id >>20 ); + id &0x1f , (id >>16 ) &0xf , nchannels);return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 73/251 locking/lockdep: Avoid RCU-induced noinstr fail
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
--- kernel/locking/lockdep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/locking/lockdep.c +1 -1
@@ -713,7 +713,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)if (DEBUG_LOCKS_WARN_ON (!irqs_disabled ()))return NULL ; -hlist_for_each_entry_rcu (class, hash_head, hash_entry) { +hlist_for_each_entry_rcu_notrace (class, hash_head, hash_entry) {if (class->key == key) {/* * Huh! same key, different name? Did someone trample
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 74/251 smackfs: Fix use-after-free in netlbl_catmap_walk()
In reply to Greg Kroah-HartmanFrom: Pawan Gupta <[email protected]>
[ Upstream commit 0817534ff9ea809fac1322c5c8c574be8483ea57 ]
Syzkaller reported use-after-free bug as described in [1]. The bug is triggered when smk_set_cipso() tries to free stale category bitmaps while there are concurrent reader(s) using the same bitmaps.
Wait for RCU grace period to finish before freeing the category bitmaps in smk_set_cipso(). This makes sure that there are no more readers using the stale bitmaps and freeing them should be safe.
[1] https://lore.kernel.org/netdev/[email protected]/
--- security/smack/smackfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
security/smack/smackfs.c +4 -1
@@ -859,6 +859,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file)static ssize_t smk_set_cipso (struct file *file,const char __user *buf,size_t count,loff_t *ppos,int format) { +struct netlbl_lsm_catmap *old_cat;struct smack_known *skp;struct netlbl_lsm_secattr ncats;char mapcatset[SMK_CIPSOLEN ];
@@ -948,9 +949,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, rc =smk_netlbl_mls (maplevel, mapcatset, &ncats,SMK_CIPSOLEN );if (rc >=0 ) { -netlbl_catmap_free (skp->smk_netlabel.attr.mls.cat); + old_cat = skp->smk_netlabel.attr.mls.cat; skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat; skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; +synchronize_rcu (); +netlbl_catmap_free (old_cat); rc = count; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 75/251 x86: Increase exception stack sizes
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 7fae4c24a2b84a66c7be399727aca11e7a888462 ]
It turns out that a single page of stack is trivial to overflow with all the tracing gunk enabled. Raise the exception stacks to 2 pages, which is still half the interrupt stacks, which are at 4 pages.
--- arch/x86/include/asm/page_64_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/page_64_types.h +1 -1
@@ -20,7 +20,7 @@#define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)#define CURRENT_MASK (~(THREAD_SIZE - 1)) -#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER) +#define EXCEPTION_STACK_ORDER (1 + KASAN_STACK_ORDER)#define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)#define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 76/251 mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
In reply to Greg Kroah-HartmanFrom: Jonas Dreßler <[email protected]>
[ Upstream commit c2e9666cdffd347460a2b17988db4cfaf2a68fb9 ]
We currently handle changing from the P2P to the STATION virtual interface type slightly different than changing from P2P to ADHOC: When changing to STATION, we don't send the SET_BSS_MODE command. We do send that command on all other type-changes though, and it probably makes sense to send the command since after all we just changed our BSS_MODE. Looking at prior changes to this part of the code, it seems that this is simply a leftover from old refactorings.
Since sending the SET_BSS_MODE command is the only difference between mwifiex_change_vif_to_sta_adhoc() and the current code, we can now use mwifiex_change_vif_to_sta_adhoc() for both switching to ADHOC and STATION interface type.
This does not fix any particular bug and just "looked right", so there's a small chance it might be a regression.
--- .../net/wireless/marvell/mwifiex/cfg80211.c | 22 ++++--------------- 1 file changed, 4 insertions(+), 18 deletions(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +4 -18
@@ -1217,29 +1217,15 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,break ;case NL80211_IFTYPE_P2P_CLIENT :case NL80211_IFTYPE_P2P_GO : +if (mwifiex_cfg80211_deinit_p2p (priv)) +return -EFAULT ; +switch (type) { -case NL80211_IFTYPE_STATION : -if (mwifiex_cfg80211_deinit_p2p (priv)) -return -EFAULT ; - priv->adapter->curr_iface_comb.p2p_intf--; - priv->adapter->curr_iface_comb.sta_intf++; - dev->ieee80211_ptr->iftype = type; -if (mwifiex_deinit_priv_params (priv)) -return -1 ; -if (mwifiex_init_new_priv_params (priv, dev, type)) -return -1 ; -if (mwifiex_sta_init_cmd (priv, false, false)) -return -1 ; -break ;case NL80211_IFTYPE_ADHOC : -if (mwifiex_cfg80211_deinit_p2p (priv)) -return -EFAULT ; +case NL80211_IFTYPE_STATION :return mwifiex_change_vif_to_sta_adhoc (dev, curr_iftype, type, params); -break ;case NL80211_IFTYPE_AP : -if (mwifiex_cfg80211_deinit_p2p (priv)) -return -EFAULT ;return mwifiex_change_vif_to_ap (dev, curr_iftype, type, params);case NL80211_IFTYPE_UNSPECIFIED :
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 77/251 mwifiex: Properly initialize private structure on interface type changes
In reply to Greg Kroah-HartmanFrom: Jonas Dreßler <[email protected]>
[ Upstream commit c606008b70627a2fc485732a53cc22f0f66d0981 ]
When creating a new virtual interface in mwifiex_add_virtual_intf(), we update our internal driver states like bss_type, bss_priority, bss_role and bss_mode to reflect the mode the firmware will be set to.
When switching virtual interface mode using mwifiex_init_new_priv_params() though, we currently only update bss_mode and bss_role. In order for the interface mode switch to actually work, we also need to update bss_type to its proper value, so do that.
This fixes a crash of the firmware (because the driver tries to execute commands that are invalid in AP mode) when switching from station mode to AP mode.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +7 -3
@@ -898,16 +898,20 @@ mwifiex_init_new_priv_params(struct mwifiex_private *priv,switch (type) {case NL80211_IFTYPE_STATION :case NL80211_IFTYPE_ADHOC : - priv->bss_role =MWIFIEX_BSS_ROLE_STA ; + priv->bss_role =MWIFIEX_BSS_ROLE_STA ; + priv->bss_type =MWIFIEX_BSS_TYPE_STA ;break ;case NL80211_IFTYPE_P2P_CLIENT : - priv->bss_role =MWIFIEX_BSS_ROLE_STA ; + priv->bss_role =MWIFIEX_BSS_ROLE_STA ; + priv->bss_type =MWIFIEX_BSS_TYPE_P2P ;break ;case NL80211_IFTYPE_P2P_GO : - priv->bss_role =MWIFIEX_BSS_ROLE_UAP ; + priv->bss_role =MWIFIEX_BSS_ROLE_UAP ; + priv->bss_type =MWIFIEX_BSS_TYPE_P2P ;break ;case NL80211_IFTYPE_AP : priv->bss_role =MWIFIEX_BSS_ROLE_UAP ; + priv->bss_type =MWIFIEX_BSS_TYPE_UAP ;break ;default : mwifiex_dbg(adapter, ERROR,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 78/251 media: mt9p031: Fix corrupted frame after restarting stream
In reply to Greg Kroah-HartmanFrom: Dirk Bender <[email protected]>
[ Upstream commit 0961ba6dd211a4a52d1dd4c2d59be60ac2dc08c7 ]
To prevent corrupted frames after starting and stopping the sensor its datasheet specifies a specific pause sequence to follow:
Stopping:
Set Pause_Restart Bit -> Set Restart Bit -> Set Chip_Enable Off
Restarting:
Set Chip_Enable On -> Clear Pause_Restart Bit
The Restart Bit is cleared automatically and must not be cleared manually as this would cause undefined behavior.
--- drivers/media/i2c/mt9p031.c | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-)
drivers/media/i2c/mt9p031.c +27 -1
@@ -81,7 +81,9 @@#define MT9P031_PIXEL_CLOCK_INVERT (1 << 15)#define MT9P031_PIXEL_CLOCK_SHIFT (n) ((n) << 8)#define MT9P031_PIXEL_CLOCK_DIVIDE (n) ((n) << 0) -#define MT9P031_FRAME_RESTART 0x0b +#define MT9P031_RESTART 0x0b +#define MT9P031_FRAME_PAUSE_RESTART (1 << 1) +#define MT9P031_FRAME_RESTART (1 << 0)#define MT9P031_SHUTTER_DELAY 0x0c#define MT9P031_RST 0x0d#define MT9P031_RST_ENABLE 1
@@ -448,9 +450,23 @@ static int mt9p031_set_params(struct mt9p031 *mt9p031)static int mt9p031_s_stream (struct v4l2_subdev *subdev,int enable) {struct mt9p031 *mt9p031 =to_mt9p031 (subdev); +struct i2c_client *client =v4l2_get_subdevdata (subdev); +int val;int ret;if (!enable) { +/* enable pause restart */ + val =MT9P031_FRAME_PAUSE_RESTART ; + ret =mt9p031_write (client,MT9P031_RESTART , val); +if (ret <0 ) +return ret; + +/* enable restart + keep pause restart set */ + val |=MT9P031_FRAME_RESTART ; + ret =mt9p031_write (client,MT9P031_RESTART , val); +if (ret <0 ) +return ret; +/* Stop sensor readout */ ret =mt9p031_set_output_control (mt9p031,MT9P031_OUTPUT_CONTROL_CEN ,0 );
@@ -470,6 +486,16 @@ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable)if (ret <0 )return ret; +/* +* - clear pause restart +* - don't clear restart as clearing restart manually can cause +* undefined behavior +*/ + val =MT9P031_FRAME_RESTART ; + ret =mt9p031_write (client,MT9P031_RESTART , val); +if (ret <0 ) +return ret; +return mt9p031_pll_enable (mt9p031); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 79/251 media: netup_unidvb: handle interrupt properly according to the firmware
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit dbb4cfea6efe979ed153bd59a6a527a90d3d0ab3 ]
The interrupt handling should be related to the firmware version. If the driver matches an old firmware, then the driver should not handle interrupt such as i2c or dma, otherwise it will cause some errors.
This log reveals it:
[ 27.708641] INFO: trying to register non-static key. [ 27.710851] The code is fine but needs lockdep annotation, or maybe [ 27.712010] you didn't initialize this object before use? [ 27.712396] turning off the locking correctness validator. [ 27.712787] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4-g70e7f0549188-dirty #169 [ 27.713349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 27.714149] Call Trace: [ 27.714329] <IRQ> [ 27.714480] dump_stack+0xba/0xf5 [ 27.714737] register_lock_class+0x873/0x8f0 [ 27.715052] ? __lock_acquire+0x323/0x1930 [ 27.715353] __lock_acquire+0x75/0x1930 [ 27.715636] lock_acquire+0x1dd/0x3e0 [ 27.715905] ? netup_i2c_interrupt+0x19/0x310 [ 27.716226] _raw_spin_lock_irqsave+0x4b/0x60 [ 27.716544] ? netup_i2c_interrupt+0x19/0x310 [ 27.716863] netup_i2c_interrupt+0x19/0x310 [ 27.717178] netup_unidvb_isr+0xd3/0x160 [ 27.717467] __handle_irq_event_percpu+0x53/0x3e0 [ 27.717808] handle_irq_event_percpu+0x35/0x90 [ 27.718129] handle_irq_event+0x39/0x60 [ 27.718409] handle_fasteoi_irq+0xc2/0x1d0 [ 27.718707] __common_interrupt+0x7f/0x150 [ 27.719008] common_interrupt+0xb4/0xd0 [ 27.719289] </IRQ> [ 27.719446] asm_common_interrupt+0x1e/0x40 [ 27.719747] RIP: 0010:native_safe_halt+0x17/0x20 [ 27.720084] Code: 07 0f 00 2d 8b ee 4c 00 f4 5d c3 0f 1f 84 00 00 00 00 00 8b 05 72 95 17 02 55 48 89 e5 85 c0 7e 07 0f 00 2d 6b ee 4c 00 fb f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d 29 f6 [ 27.721386] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246 [ 27.721758] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 27.722262] RDX: 0000000000000000 RSI: ffffffff85f7c054 RDI: ffffffff85ded4e6 [ 27.722770] RBP: ffffc9000008fe90 R08: 0000000000000001 R09: 0000000000000001 [ 27.723277] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff86a75408 [ 27.723781] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888100260000 [ 27.724289] default_idle+0x9/0x10 [ 27.724537] arch_cpu_idle+0xa/0x10 [ 27.724791] default_idle_call+0x6e/0x250 [ 27.725082] do_idle+0x1f0/0x2d0 [ 27.725326] cpu_startup_entry+0x18/0x20 [ 27.725613] start_secondary+0x11f/0x160 [ 27.725902] secondary_startup_64_no_verify+0xb0/0xbb [ 27.726272] BUG: kernel NULL pointer dereference, address: 0000000000000002 [ 27.726768] #PF: supervisor read access in kernel mode [ 27.727138] #PF: error_code(0x0000) - not-present page [ 27.727507] PGD 8000000118688067 P4D 8000000118688067 PUD 10feab067 PMD 0 [ 27.727999] Oops: 0000 [#1] PREEMPT SMP PTI [ 27.728302] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4-g70e7f0549188-dirty #169 [ 27.728861] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 27.729660] RIP: 0010:netup_i2c_interrupt+0x23/0x310 [ 27.730019] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 89 fb e8 af 6e 95 fd 48 89 df e8 e7 9f 1c 01 49 89 c5 48 8b 83 48 08 00 00 <66> 44 8b 60 02 44 89 e0 48 8b 93 48 08 00 00 83 e0 f8 66 89 42 02 [ 27.731339] RSP: 0018:ffffc90000118e90 EFLAGS: 00010046 [ 27.731716] RAX: 0000000000000000 RBX: ffff88810803c4d8 RCX: 0000000000000000 [ 27.732223] RDX: 0000000000000001 RSI: ffffffff85d37b94 RDI: ffff88810803c4d8 [ 27.732727] RBP: ffffc90000118ea8 R08: 0000000000000000 R09: 0000000000000001 [ 27.733239] R10: ffff88810803c4f0 R11: 61646e6f63657320 R12: 0000000000000000 [ 27.733745] R13: 0000000000000046 R14: ffff888101041000 R15: ffff8881081b2400 [ 27.734251] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000 [ 27.734821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.735228] CR2: 0000000000000002 CR3: 0000000108194000 CR4: 00000000000006e0 [ 27.735735] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.736241] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.736744] Call Trace: [ 27.736924] <IRQ> [ 27.737074] netup_unidvb_isr+0xd3/0x160 [ 27.737363] __handle_irq_event_percpu+0x53/0x3e0 [ 27.737706] handle_irq_event_percpu+0x35/0x90 [ 27.738028] handle_irq_event+0x39/0x60 [ 27.738306] handle_fasteoi_irq+0xc2/0x1d0 [ 27.738602] __common_interrupt+0x7f/0x150 [ 27.738899] common_interrupt+0xb4/0xd0 [ 27.739176] </IRQ> [ 27.739331] asm_common_interrupt+0x1e/0x40 [ 27.739633] RIP: 0010:native_safe_halt+0x17/0x20 [ 27.739967] Code: 07 0f 00 2d 8b ee 4c 00 f4 5d c3 0f 1f 84 00 00 00 00 00 8b 05 72 95 17 02 55 48 89 e5 85 c0 7e 07 0f 00 2d 6b ee 4c 00 fb f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d 29 f6 [ 27.741275] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246 [ 27.741647] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 27.742148] RDX: 0000000000000000 RSI: ffffffff85f7c054 RDI: ffffffff85ded4e6 [ 27.742652] RBP: ffffc9000008fe90 R08: 0000000000000001 R09: 0000000000000001 [ 27.743154] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff86a75408 [ 27.743652] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888100260000 [ 27.744157] default_idle+0x9/0x10 [ 27.744405] arch_cpu_idle+0xa/0x10 [ 27.744658] default_idle_call+0x6e/0x250 [ 27.744948] do_idle+0x1f0/0x2d0 [ 27.745190] cpu_startup_entry+0x18/0x20 [ 27.745475] start_secondary+0x11f/0x160 [ 27.745761] secondary_startup_64_no_verify+0xb0/0xbb [ 27.746123] Modules linked in: [ 27.746348] Dumping ftrace buffer: [ 27.746596] (ftrace buffer empty) [ 27.746852] CR2: 0000000000000002 [ 27.747094] ---[ end trace ebafd46f83ab946d ]--- [ 27.747424] RIP: 0010:netup_i2c_interrupt+0x23/0x310 [ 27.747778] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 89 fb e8 af 6e 95 fd 48 89 df e8 e7 9f 1c 01 49 89 c5 48 8b 83 48 08 00 00 <66> 44 8b 60 02 44 89 e0 48 8b 93 48 08 00 00 83 e0 f8 66 89 42 02 [ 27.749082] RSP: 0018:ffffc90000118e90 EFLAGS: 00010046 [ 27.749461] RAX: 0000000000000000 RBX: ffff88810803c4d8 RCX: 0000000000000000 [ 27.749966] RDX: 0000000000000001 RSI: ffffffff85d37b94 RDI: ffff88810803c4d8 [ 27.750471] RBP: ffffc90000118ea8 R08: 0000000000000000 R09: 0000000000000001 [ 27.750976] R10: ffff88810803c4f0 R11: 61646e6f63657320 R12: 0000000000000000 [ 27.751480] R13: 0000000000000046 R14: ffff888101041000 R15: ffff8881081b2400 [ 27.751986] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000 [ 27.752560] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.752970] CR2: 0000000000000002 CR3: 0000000108194000 CR4: 00000000000006e0 [ 27.753481] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.753984] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.754487] Kernel panic - not syncing: Fatal exception in interrupt [ 27.755033] Dumping ftrace buffer: [ 27.755279] (ftrace buffer empty) [ 27.755534] Kernel Offset: disabled [ 27.755785] Rebooting in 1 seconds..
--- .../pci/netup_unidvb/netup_unidvb_core.c | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-)
drivers/media/pci/netup_unidvb/netup_unidvb_core.c +16 -11
@@ -267,19 +267,24 @@ static irqreturn_t netup_unidvb_isr(int irq, void *dev_id)if ((reg40 &AVL_IRQ_ASSERTED ) !=0 ) {/* IRQ is being signaled */ reg_isr =readw (ndev->bmmio0 +REG_ISR ); -if (reg_isr &NETUP_UNIDVB_IRQ_I2C0 ) { - iret =netup_i2c_interrupt (&ndev->i2c[0 ]); - }else if (reg_isr &NETUP_UNIDVB_IRQ_I2C1 ) { - iret =netup_i2c_interrupt (&ndev->i2c[1 ]); - }else if (reg_isr &NETUP_UNIDVB_IRQ_SPI ) { +if (reg_isr &NETUP_UNIDVB_IRQ_SPI ) iret =netup_spi_interrupt (ndev->spi); - }else if (reg_isr &NETUP_UNIDVB_IRQ_DMA1 ) { - iret =netup_dma_interrupt (&ndev->dma[0 ]); - }else if (reg_isr &NETUP_UNIDVB_IRQ_DMA2 ) { - iret =netup_dma_interrupt (&ndev->dma[1 ]); - }else if (reg_isr &NETUP_UNIDVB_IRQ_CI ) { - iret =netup_ci_interrupt (ndev); +else if (!ndev->old_fw) { +if (reg_isr &NETUP_UNIDVB_IRQ_I2C0 ) { + iret =netup_i2c_interrupt (&ndev->i2c[0 ]); + }else if (reg_isr &NETUP_UNIDVB_IRQ_I2C1 ) { + iret =netup_i2c_interrupt (&ndev->i2c[1 ]); + }else if (reg_isr &NETUP_UNIDVB_IRQ_DMA1 ) { + iret =netup_dma_interrupt (&ndev->dma[0 ]); + }else if (reg_isr &NETUP_UNIDVB_IRQ_DMA2 ) { + iret =netup_dma_interrupt (&ndev->dma[1 ]); + }else if (reg_isr &NETUP_UNIDVB_IRQ_CI ) { + iret =netup_ci_interrupt (ndev); + }else { + goto err; + } }else { +err:dev_err (&pci_dev->dev,"%s(): unknown interrupt 0x%x\n" , __func__, reg_isr);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 80/251 media: uvcvideo: Set capability in s_param
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
[ Upstream commit 97a2777a96070afb7da5d587834086c0b586c8cc ]
Fixes v4l2-compliance:
Format ioctls (Input 0):
warn: v4l2-test-formats.cpp(1339): S_PARM is supported but doesn't report V4L2_CAP_TIMEPERFRAME
fail: v4l2-test-formats.cpp(1241): node->has_frmintervals && !cap->capability
--- drivers/media/usb/uvc/uvc_v4l2.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +5 -2
@@ -446,10 +446,13 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream,uvc_simplify_fraction (&timeperframe.numerator, &timeperframe.denominator,8 ,333 ); -if (parm->type ==V4L2_BUF_TYPE_VIDEO_CAPTURE ) +if (parm->type ==V4L2_BUF_TYPE_VIDEO_CAPTURE ) { parm->parm.capture.timeperframe = timeperframe; -else + parm->parm.capture.capability =V4L2_CAP_TIMEPERFRAME ; + }else { parm->parm.output.timeperframe = timeperframe; + parm->parm.output.capability =V4L2_CAP_TIMEPERFRAME ; + }return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 81/251 media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
In reply to Greg Kroah-HartmanFrom: Tuo Li <[email protected]>
[ Upstream commit 8515965e5e33f4feb56134348c95953f3eadfb26 ]
The variable pdev is assigned to dev->plat_dev, and dev->plat_dev is checked in:
if (!dev->plat_dev)
This indicates both dev->plat_dev and pdev can be NULL. If so, the function dev_err() is called to print error information.
dev_err(&pdev->dev, "No platform data specified\n");
However, &pdev->dev is an illegal address, and it is dereferenced in dev_err().
To fix this possible null-pointer dereference, replace dev_err() with mfc_err().
--- drivers/media/platform/s5p-mfc/s5p_mfc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/s5p-mfc/s5p_mfc.c +1 -1
@@ -1280,7 +1280,7 @@ static int s5p_mfc_probe(struct platform_device *pdev)spin_lock_init (&dev->condlock); dev->plat_dev = pdev;if (!dev->plat_dev) { -dev_err (&pdev->dev,"No platform data specified\n" ); +mfc_err ("No platform data specified\n" );return -ENODEV ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 82/251 media: s5p-mfc: Add checking to s5p_mfc_probe().
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
[ Upstream commit cdfaf4752e6915a4b455ad4400133e540e4dc965 ]
If of_device_get_match_data() return NULL,
then null pointer dereference occurs in s5p_mfc_init_pm(). The patch adds checking if dev->variant is NULL.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/media/platform/s5p-mfc/s5p_mfc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/platform/s5p-mfc/s5p_mfc.c +4 -0
@@ -1285,6 +1285,10 @@ static int s5p_mfc_probe(struct platform_device *pdev) } dev->variant =of_device_get_match_data (&pdev->dev); +if (!dev->variant) { +dev_err (&pdev->dev,"Failed to get device MFC hardware variant information\n" ); +return -ENOENT ; + } res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); dev->regs_base =devm_ioremap_resource (&pdev->dev, res);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 83/251 media: mceusb: return without resubmitting URB in case of -EPROTO error.
In reply to Greg Kroah-HartmanFrom: Rajat Asthana <[email protected]>
[ Upstream commit 476db72e521983ecb847e4013b263072bb1110fc ]
Syzkaller reported a warning called "rcu detected stall in dummy_timer".
The error seems to be an error in mceusb_dev_recv(). In the case of -EPROTO error, the routine immediately resubmits the URB. Instead it should return without resubmitting URB.
--- drivers/media/rc/mceusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/rc/mceusb.c +1 -0
@@ -1080,6 +1080,7 @@ static void mceusb_dev_recv(struct urb *urb)case -ECONNRESET :case -ENOENT :case -EILSEQ : +case -EPROTO :case -ESHUTDOWN :usb_unlink_urb (urb);return ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 84/251 ia64: dont do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit c15b5fc054c3d6c97e953617605235c5cb8ce979 ]
When CONFIG_PRINTK is not set, the CMPXCHG_BUGCHECK() macro calls _printk(), but _printk() is a static inline function, not available as an extern.
Since the purpose of the macro is to print the BUGCHECK info, make this config option depend on PRINTK.
Fixes multiple occurrences of this build error:
../include/linux/printk.h:208:5: error: static declaration of '_printk' follows non-static declaration
208 | int _printk(const char *s, ...)
| ^~~~~~~
In file included from ../arch/ia64/include/asm/cmpxchg.h:5, ../arch/ia64/include/uapi/asm/cmpxchg.h:146:28: note: previous declaration of '_printk' with type 'int(const char *, ...)'
146 | extern int _printk(const char *fmt, ...);
--- arch/ia64/Kconfig.debug | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/Kconfig.debug +1 -1
@@ -42,7 +42,7 @@ config DISABLE_VHPT config IA64_DEBUG_CMPXCHG bool "Turn on compare-and-exchange bug checking (slow!)" - depends on DEBUG_KERNEL + depends on DEBUG_KERNEL && PRINTK help Selecting this option turns on bug checking for the IA-64 compare-and-exchange instructions. This is slow! Itaniums
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 85/251 ACPICA: Avoid evaluating methods too early during system resume
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit d3c4b6f64ad356c0d9ddbcf73fa471e6a841cc5c ]
ACPICA commit 0762982923f95eb652cf7ded27356b247c9774de
During wakeup from system-wide sleep states, acpi_get_sleep_type_data() is called and it tries to get memory from the slab allocator in order to evaluate a control method, but if KFENCE is enabled in the kernel, the memory allocation attempt causes an IRQ work to be queued and a self-IPI to be sent to the CPU running the code which requires the memory controller to be ready, so if that happens too early in the wakeup path, it doesn't work.
Prevent that from taking place by calling acpi_get_sleep_type_data() for S0 upfront, when preparing to enter a given sleep state, and saving the data obtained by it for later use during system wakeup.
--- drivers/acpi/acpica/acglobal.h | 2 ++ drivers/acpi/acpica/hwesleep.c | 8 ++------ drivers/acpi/acpica/hwsleep.c | 11 ++++------- drivers/acpi/acpica/hwxfsleep.c | 7 +++++++ 4 files changed, 15 insertions(+), 13 deletions(-)
drivers/acpi/acpica/acglobal.h +2 -0
@@ -255,6 +255,8 @@ extern struct acpi_bit_register_infoACPI_GLOBAL (u8, acpi_gbl_sleep_type_a);ACPI_GLOBAL (u8, acpi_gbl_sleep_type_b); +ACPI_GLOBAL (u8, acpi_gbl_sleep_type_a_s0); +ACPI_GLOBAL (u8, acpi_gbl_sleep_type_b_s0);/***************************************************************************** *
drivers/acpi/acpica/hwesleep.c +2 -6
@@ -181,17 +181,13 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state)acpi_status acpi_hw_extended_wake_prep (u8 sleep_state) { -acpi_status status;u8 sleep_type_value;ACPI_FUNCTION_TRACE (hw_extended_wake_prep); - status =acpi_get_sleep_type_data (ACPI_STATE_S0 , - &acpi_gbl_sleep_type_a, - &acpi_gbl_sleep_type_b); -if (ACPI_SUCCESS (status)) { +if (acpi_gbl_sleep_type_a_s0 !=ACPI_SLEEP_TYPE_INVALID ) { sleep_type_value = - ((acpi_gbl_sleep_type_a <<ACPI_X_SLEEP_TYPE_POSITION ) & + ((acpi_gbl_sleep_type_a_s0 <<ACPI_X_SLEEP_TYPE_POSITION ) &ACPI_X_SLEEP_TYPE_MASK ); (void)acpi_write((u64)(sleep_type_value | ACPI_X_SLEEP_ENABLE),
drivers/acpi/acpica/hwsleep.c +4 -7
@@ -218,7 +218,7 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state)acpi_status acpi_hw_legacy_wake_prep (u8 sleep_state) { -acpi_status status; +acpi_status status =AE_OK ;struct acpi_bit_register_info *sleep_type_reg_info;struct acpi_bit_register_info *sleep_enable_reg_info;u32 pm1a_control;
@@ -231,10 +231,7 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)* This is unclear from the ACPI Spec, but it is required * by some machines. */ - status =acpi_get_sleep_type_data (ACPI_STATE_S0 , - &acpi_gbl_sleep_type_a, - &acpi_gbl_sleep_type_b); -if (ACPI_SUCCESS (status)) { +if (acpi_gbl_sleep_type_a_s0 !=ACPI_SLEEP_TYPE_INVALID ) { sleep_type_reg_info =acpi_hw_get_bit_register_info (ACPI_BITREG_SLEEP_TYPE ); sleep_enable_reg_info =
@@ -255,9 +252,9 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)/* Insert the SLP_TYP bits */ - pm1a_control |= (acpi_gbl_sleep_type_a << + pm1a_control |= (acpi_gbl_sleep_type_a_s0 << sleep_type_reg_info->bit_position); - pm1b_control |= (acpi_gbl_sleep_type_b << + pm1b_control |= (acpi_gbl_sleep_type_b_s0 << sleep_type_reg_info->bit_position);/* Write the control registers and ignore any errors */
drivers/acpi/acpica/hwxfsleep.c +7 -0
@@ -322,6 +322,13 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state)return_ACPI_STATUS (status); } + status =acpi_get_sleep_type_data (ACPI_STATE_S0 , + &acpi_gbl_sleep_type_a_s0, + &acpi_gbl_sleep_type_b_s0); +if (ACPI_FAILURE (status)) { + acpi_gbl_sleep_type_a_s0 =ACPI_SLEEP_TYPE_INVALID ; + } +/* Execute the _PTS method (Prepare To Sleep) */ arg_list.count =1 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 86/251 media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
In reply to Greg Kroah-HartmanFrom: Anant Thazhemadam <[email protected]>
[ Upstream commit 899a61a3305d49e8a712e9ab20d0db94bde5929f ]
In dibusb_read_eeprom_byte(), if dibusb_i2c_msg() fails, val gets assigned an value that's not properly initialized.
Using kzalloc() in place of kmalloc() for the buffer fixes this issue, as the val can now be set to 0 in the event dibusb_i2c_msg() fails.
--- drivers/media/usb/dvb-usb/dibusb-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/dibusb-common.c +1 -1
@@ -226,7 +226,7 @@ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val)u8 *buf;int rc; - buf =kmalloc (2 ,GFP_KERNEL ); + buf =kzalloc (2 ,GFP_KERNEL );if (!buf)return -ENOMEM ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 87/251 tracefs: Have tracefs directories not set OTH permission bits by default
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
[ Upstream commit 49d67e445742bbcb03106b735b2ab39f6e5c56bc ]
The tracefs file system is by default mounted such that only root user can access it. But there are legitimate reasons to create a group and allow those added to the group to have access to tracing. By changing the permissions of the tracefs mount point to allow access, it will allow group access to the tracefs directory.
There should not be any real reason to allow all access to the tracefs directory as it contains sensitive information. Have the default permission of directories being created not have any OTH (other) bits set, such that an admin that wants to give permission to a group has to first disable all OTH bits in the file system.
--- fs/tracefs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/tracefs/inode.c +2 -1
@@ -427,7 +427,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,if (unlikely (!inode))return failed_creating (dentry); - inode->i_mode =S_IFDIR |S_IRWXU |S_IRUGO |S_IXUGO ; +/* Do not set bits for OTH */ + inode->i_mode =S_IFDIR |S_IRWXU |S_IRUSR |S_IRGRP |S_IXUSR |S_IXGRP ; inode->i_op = ops; inode->i_fop = &simple_dir_operations;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 88/251 ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
In reply to Greg Kroah-HartmanFrom: Tuo Li <[email protected]>
[ Upstream commit 4b6012a7830b813799a7faf40daa02a837e0fd5b ]
kzalloc() is used to allocate memory for cd->detectors, and if it fails, channel_detector_exit() behind the label fail will be called:
channel_detector_exit(dpd, cd);
In channel_detector_exit(), cd->detectors is dereferenced through:
struct pri_detector *de = cd->detectors[i];
To fix this possible null-pointer dereference, check cd->detectors before the for loop to dereference cd->detectors.
--- drivers/net/wireless/ath/dfs_pattern_detector.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/dfs_pattern_detector.c +6 -4
@@ -182,10 +182,12 @@ static void channel_detector_exit(struct dfs_pattern_detector *dpd,if (cd ==NULL )return ;list_del (&cd->head); -for (i =0 ; i < dpd->num_radar_types; i++) { -struct pri_detector *de = cd->detectors[i]; -if (de !=NULL ) - de->exit (de); +if (cd->detectors) { +for (i =0 ; i < dpd->num_radar_types; i++) { +struct pri_detector *de = cd->detectors[i]; +if (de !=NULL ) + de->exit (de); + } }kfree (cd->detectors);kfree (cd);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 89/251 ACPI: battery: Accept charges over the design capacity as full
In reply to Greg Kroah-HartmanFrom: André Almeida <[email protected]>
[ Upstream commit 2835f327bd1240508db2c89fe94a056faa53c49a ]
Some buggy firmware and/or brand new batteries can support a charge that's slightly over the reported design capacity. In such cases, the kernel will report to userspace that the charging state of the battery is "Unknown", when in reality the battery charge is "Full", at least from the design capacity point of view. Make the fallback condition accepts capacities over the designed capacity so userspace knows that is full.
--- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/battery.c +1 -1
@@ -193,7 +193,7 @@ static int acpi_battery_is_charged(struct acpi_battery *battery)return 1 ;/* fallback to using design values for broken batteries */ -if (battery->design_capacity == battery->capacity_now) +if (battery->design_capacity <= battery->capacity_now)return 1 ;/* we don't do any sort of metric based on percentages */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 90/251 leaking_addresses: Always print a trailing newline
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit cf2a85efdade117e2169d6e26641016cbbf03ef0 ]
For files that lack trailing newlines and match a leaking address (e.g. wchan[1]), the leaking_addresses.pl report would run together with the next line, making things look corrupted.
Unconditionally remove the newline on input, and write it back out on output.
[1] https://lore.kernel.org/all/20210103142726.GC30643@xsang-OptiPlex-9020/
--- scripts/leaking_addresses.pl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
scripts/leaking_addresses.pl +2 -1
@@ -262,8 +262,9 @@ sub parse_file open my $fh, "<", $file or return; while ( <$fh> ) { + chomp; if (may_leak_address($_)) { - print $file . ': ' . $_; + printf("$file: $_\n"); } } close $fh;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 91/251 memstick: r592: Fix a UAF bug when removing the driver
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 738216c1953e802aa9f930c5d15b8f9092c847ff ]
In r592_remove(), the driver will free dma after freeing the host, which may cause a UAF bug.
The following log reveals it:
[ 45.361796 ] BUG: KASAN: use-after-free in r592_remove+0x269/0x350 [r592] [ 45.364286 ] Call Trace: [ 45.364472 ] dump_stack_lvl+0xa8/0xd1 [ 45.364751 ] print_address_description+0x87/0x3b0 [ 45.365137 ] kasan_report+0x172/0x1c0 [ 45.365415 ] ? r592_remove+0x269/0x350 [r592] [ 45.365834 ] ? r592_remove+0x269/0x350 [r592] [ 45.366168 ] __asan_report_load8_noabort+0x14/0x20 [ 45.366531 ] r592_remove+0x269/0x350 [r592] [ 45.378785 ] [ 45.378903 ] Allocated by task 4674: [ 45.379162 ] ____kasan_kmalloc+0xb5/0xe0 [ 45.379455 ] __kasan_kmalloc+0x9/0x10 [ 45.379730 ] __kmalloc+0x150/0x280 [ 45.379984 ] memstick_alloc_host+0x2a/0x190 [ 45.380664 ] [ 45.380781 ] Freed by task 5509: [ 45.381014 ] kasan_set_track+0x3d/0x70 [ 45.381293 ] kasan_set_free_info+0x23/0x40 [ 45.381635 ] ____kasan_slab_free+0x10b/0x140 [ 45.381950 ] __kasan_slab_free+0x11/0x20 [ 45.382241 ] slab_free_freelist_hook+0x81/0x150 [ 45.382575 ] kfree+0x13e/0x290 [ 45.382805 ] memstick_free+0x1c/0x20 [ 45.383070 ] device_release+0x9c/0x1d0 [ 45.383349 ] kobject_put+0x2ef/0x4c0 [ 45.383616 ] put_device+0x1f/0x30 [ 45.383865 ] memstick_free_host+0x24/0x30 [ 45.384162 ] r592_remove+0x242/0x350 [r592] [ 45.384473 ] pci_device_remove+0xa9/0x250
--- drivers/memstick/host/r592.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/memstick/host/r592.c +4 -4
@@ -841,15 +841,15 @@ static void r592_remove(struct pci_dev *pdev) }memstick_remove_host (dev->host); +if (dev->dummy_dma_page) +dma_free_coherent (&pdev->dev,PAGE_SIZE , dev->dummy_dma_page, + dev->dummy_dma_page_physical_address); +free_irq (dev->irq, dev);iounmap (dev->mmio);pci_release_regions (pdev);pci_disable_device (pdev);memstick_free_host (dev->host); - -if (dev->dummy_dma_page) -dma_free_coherent (&pdev->dev,PAGE_SIZE , dev->dummy_dma_page, - dev->dummy_dma_page_physical_address); }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 92/251 lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
In reply to Greg Kroah-HartmanFrom: Lasse Collin <[email protected]>
[ Upstream commit 83d3c4f22a36d005b55f44628f46cc0d319a75e8 ]
With valid files, the safety margin described in lib/decompress_unxz.c ensures that these buffers cannot overlap. But if the uncompressed size of the input is larger than the caller thought, which is possible when the input file is invalid/corrupt, the buffers can overlap. Obviously the result will then be garbage (and usually the decoder will return an error too) but no other harm will happen when such an over-run occurs.
This change only affects uncompressed LZMA2 chunks and so this should have no effect on performance.
--- lib/decompress_unxz.c | 2 +- lib/xz/xz_dec_lzma2.c | 21 +++++++++++++++++++-- 2 files changed, 20 insertions(+), 3 deletions(-)
lib/decompress_unxz.c +1 -1
@@ -167,7 +167,7 @@* memeq and memzero are not used much and any remotely sane implementation * is fast enough. memcpy/memmove speed matters in multi-call mode, but * the kernel image is decompressed in single-call mode, in which only -* memcpy speed can matter and only if there is a lot of uncompressible data +* memmove speed can matter and only if there is a lot of uncompressible data * (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the * functions below should just be kept small; it's probably not worth * optimizing for speed.
lib/xz/xz_dec_lzma2.c +19 -2
@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, *left -= copy_size; -memcpy (dict->buf + dict->pos, b->in + b->in_pos, copy_size); +/* +* If doing in-place decompression in single-call mode and the +* uncompressed size of the file is larger than the caller +* thought (i.e. it is invalid input!), the buffers below may +* overlap and cause undefined behavior with memcpy(). +* With valid inputs memcpy() would be fine here. +*/ +memmove (dict->buf + dict->pos, b->in + b->in_pos, copy_size); dict->pos += copy_size;if (dict->full < dict->pos)
@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,if (dict->pos == dict->end) dict->pos =0 ; -memcpy (b->out + b->out_pos, b->in + b->in_pos, +/* +* Like above but for multi-call mode: use memmove() +* to avoid undefined behavior with invalid input. +*/ +memmove (b->out + b->out_pos, b->in + b->in_pos, copy_size); }
@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b)if (dict->pos == dict->end) dict->pos =0 ; +/* +* These buffers cannot overlap even if doing in-place +* decompression because in multi-call mode dict->buf +* has been allocated by us in this file; it's not +* provided by the caller like in single-call mode. +*/ memcpy (b->out + b->out_pos, dict->buf + dict->start, copy_size); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 93/251 lib/xz: Validate the value before assigning it to an enum variable
In reply to Greg Kroah-HartmanFrom: Lasse Collin <[email protected]>
[ Upstream commit 4f8d7abaa413c34da9d751289849dbfb7c977d05 ]
This might matter, for example, if the underlying type of enum xz_check was a signed char. In such a case the validation wouldn't have caught an unsupported header. I don't know if this problem can occur in the kernel on any arch but it's still good to fix it because some people might copy the XZ code to their own projects from Linux instead of the upstream XZ Embedded repository.
This change may increase the code size by a few bytes. An alternative would have been to use an unsigned int instead of enum xz_check but using an enumeration looks cleaner.
--- lib/xz/xz_dec_stream.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/xz/xz_dec_stream.c +3 -3
@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s)* we will accept other check types too, but then the check won't * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given. */ +if (s->temp.buf[HEADER_MAGIC_SIZE +1 ] >XZ_CHECK_MAX ) +return XZ_OPTIONS_ERROR ; + s->check_type = s->temp.buf[HEADER_MAGIC_SIZE +1 ];#ifdef XZ_DEC_ANY_CHECK -if (s->check_type >XZ_CHECK_MAX ) -return XZ_OPTIONS_ERROR ; -if (s->check_type >XZ_CHECK_CRC32 )return XZ_UNSUPPORTED_CHECK ;#else
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 94/251 tracing/cfi: Fix cmp_entries_* functions signature mismatch
In reply to Greg Kroah-HartmanFrom: Kalesh Singh <[email protected]>
[ Upstream commit 7ce1bb83a14019f8c396d57ec704d19478747716 ]
If CONFIG_CFI_CLANG=y, attempting to read an event histogram will cause the kernel to panic due to failed CFI check.
1. echo 'hist:keys=common_pid' >> events/sched/sched_switch/trigger
2. cat events/sched/sched_switch/hist
3. kernel panics on attempting to read hist
This happens because the sort() function expects a generic int (*)(const void *, const void *) pointer for the compare function. To prevent this CFI failure, change tracing map cmp_entries_* function signatures to match this.
Also, fix the build error reported by the kernel test robot [1].
[1] https://lore.kernel.org/r/[email protected]/
--- kernel/trace/tracing_map.c | 40 ++++++++++++++++++++++---------------- 1 file changed, 23 insertions(+), 17 deletions(-)
kernel/trace/tracing_map.c +23 -17
@@ -703,29 +703,35 @@ int tracing_map_init(struct tracing_map *map)return err; } -static int cmp_entries_dup (const struct tracing_map_sort_entry **a, -const struct tracing_map_sort_entry **b) +static int cmp_entries_dup (const void *A ,const void *B ) { +const struct tracing_map_sort_entry *a, *b;int ret =0 ; -if (memcmp ((*a)->key, (*b)->key, (*a)->elt->map->key_size)) + a = *(const struct tracing_map_sort_entry **)A ; + b = *(const struct tracing_map_sort_entry **)B ; + +if (memcmp (a->key, b->key, a->elt->map->key_size)) ret =1 ;return ret; } -static int cmp_entries_sum (const struct tracing_map_sort_entry **a, -const struct tracing_map_sort_entry **b) +static int cmp_entries_sum (const void *A ,const void *B ) {const struct tracing_map_elt *elt_a, *elt_b; +const struct tracing_map_sort_entry *a, *b;struct tracing_map_sort_key *sort_key;struct tracing_map_field *field;tracing_map_cmp_fn_t cmp_fn;void *val_a, *val_b;int ret =0 ; - elt_a = (*a)->elt; - elt_b = (*b)->elt; + a = *(const struct tracing_map_sort_entry **)A ; + b = *(const struct tracing_map_sort_entry **)B ; + + elt_a = a->elt; + elt_b = b->elt; sort_key = &elt_a->map->sort_key;
@@ -742,18 +748,21 @@ static int cmp_entries_sum(const struct tracing_map_sort_entry **a,return ret; } -static int cmp_entries_key (const struct tracing_map_sort_entry **a, -const struct tracing_map_sort_entry **b) +static int cmp_entries_key (const void *A ,const void *B ) {const struct tracing_map_elt *elt_a, *elt_b; +const struct tracing_map_sort_entry *a, *b;struct tracing_map_sort_key *sort_key;struct tracing_map_field *field;tracing_map_cmp_fn_t cmp_fn;void *val_a, *val_b;int ret =0 ; - elt_a = (*a)->elt; - elt_b = (*b)->elt; + a = *(const struct tracing_map_sort_entry **)A ; + b = *(const struct tracing_map_sort_entry **)B ; + + elt_a = a->elt; + elt_b = b->elt; sort_key = &elt_a->map->sort_key;
@@ -926,10 +935,8 @@ static void sort_secondary(struct tracing_map *map, struct tracing_map_sort_key *primary_key, struct tracing_map_sort_key *secondary_key) { -int (*primary_fn)(const struct tracing_map_sort_entry **, -const struct tracing_map_sort_entry **); -int (*secondary_fn)(const struct tracing_map_sort_entry **, -const struct tracing_map_sort_entry **); +int (*primary_fn)(const void *,const void *); +int (*secondary_fn)(const void *,const void *);unsigned i, start =0 , n_sub =1 ;if (is_key (map, primary_key->field_idx))
@@ -998,8 +1005,7 @@ int tracing_map_sort_entries(struct tracing_map *map, unsigned int n_sort_keys, struct tracing_map_sort_entry ***sort_entries) { -int (*cmp_entries_fn)(const struct tracing_map_sort_entry **, -const struct tracing_map_sort_entry **); +int (*cmp_entries_fn)(const void *,const void *);struct tracing_map_sort_entry *sort_entry, **entries;int i, n_entries, ret;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 95/251 mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 257051a235c17e33782b6e24a4b17f2d7915aaec ]
When the driver fails to request the firmware, it calls its error handler. In the error handler, the driver detaches device from driver first before releasing the firmware, which can cause a use-after-free bug.
Fix this by releasing firmware first.
The following log reveals it:
[ 9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0 [ 9.010143 ] Workqueue: events request_firmware_work_func [ 9.010830 ] Call Trace: [ 9.010830 ] dump_stack_lvl+0xa8/0xd1 [ 9.010830 ] print_address_description+0x87/0x3b0 [ 9.010830 ] kasan_report+0x172/0x1c0 [ 9.010830 ] ? mutex_unlock+0xd/0x10 [ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0 [ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0 [ 9.010830 ] __asan_report_load8_noabort+0x14/0x20 [ 9.010830 ] mwl8k_fw_state_machine+0x320/0xba0 [ 9.010830 ] ? mwl8k_load_firmware+0x5f0/0x5f0 [ 9.010830 ] request_firmware_work_func+0x172/0x250 [ 9.010830 ] ? read_lock_is_recursive+0x20/0x20 [ 9.010830 ] ? process_one_work+0x7a1/0x1100 [ 9.010830 ] ? request_firmware_nowait+0x460/0x460 [ 9.010830 ] ? __this_cpu_preempt_check+0x13/0x20 [ 9.010830 ] process_one_work+0x9bb/0x1100
--- drivers/net/wireless/marvell/mwl8k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/mwl8k.c +1 -1
@@ -5788,8 +5788,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context) fail: priv->fw_state =FW_STATE_ERROR ;complete (&priv->firmware_loading_complete); -device_release_driver (&priv->pdev->dev);mwl8k_release_firmware (priv); +device_release_driver (&priv->pdev->dev); }#define MAX_RESTART_ATTEMPTS 1
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 96/251 PM: hibernate: Get block device exclusively in swsusp_check()
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
[ Upstream commit 39fbef4b0f77f9c89c8f014749ca533643a37c9f ]
The following kernel crash can be triggered:
[ 89.266592] ------------[ cut here ]------------ [ 89.267427] kernel BUG at fs/buffer.c:3020! [ 89.268264] invalid opcode: 0000 [#1] SMP KASAN PTI [ 89.269116] CPU: 7 PID: 1750 Comm: kmmpd-loop0 Not tainted 5.10.0-862.14.0.6.x86_64-08610-gc932cda3cef4-dirty #20 [ 89.273169] RIP: 0010:submit_bh_wbc.isra.0+0x538/0x6d0 [ 89.277157] RSP: 0018:ffff888105ddfd08 EFLAGS: 00010246 [ 89.278093] RAX: 0000000000000005 RBX: ffff888124231498 RCX: ffffffffb2772612 [ 89.279332] RDX: 1ffff11024846293 RSI: 0000000000000008 RDI: ffff888124231498 [ 89.280591] RBP: ffff8881248cc000 R08: 0000000000000001 R09: ffffed1024846294 [ 89.281851] R10: ffff88812423149f R11: ffffed1024846293 R12: 0000000000003800 [ 89.283095] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8881161f7000 [ 89.284342] FS: 0000000000000000(0000) GS:ffff88839b5c0000(0000) knlGS:0000000000000000 [ 89.285711] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.286701] CR2: 00007f166ebc01a0 CR3: 0000000435c0e000 CR4: 00000000000006e0 [ 89.287919] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 89.289138] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 89.290368] Call Trace: [ 89.290842] write_mmp_block+0x2ca/0x510 [ 89.292218] kmmpd+0x433/0x9a0 [ 89.294902] kthread+0x2dd/0x3e0 [ 89.296268] ret_from_fork+0x22/0x30 [ 89.296906] Modules linked in:
by running the following commands:
1. mkfs.ext4 -O mmp /dev/sda -b 1024
2. mount /dev/sda /home/test
3. echo "/dev/sda" > /sys/power/resume
That happens because swsusp_check() calls set_blocksize() on the target partition which confuses the file system:
Thread1 Thread2
mount /dev/sda /home/test
get s_mmp_bh --> has mapped flag
start kmmpd thread
echo "/dev/sda" > /sys/power/resume
resume_store
software_resume
swsusp_check
set_blocksize
truncate_inode_pages_range
truncate_cleanup_page
block_invalidatepage
discard_buffer --> clean mapped flag
write_mmp_block
submit_bh
submit_bh_wbc
BUG_ON(!buffer_mapped(bh))To address this issue, modify swsusp_check() to open the target block device with exclusive access.
--- kernel/power/swap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/power/swap.c +3 -2
@@ -1526,9 +1526,10 @@ end:int swsusp_check (void ) {int error; +void *holder; hib_resume_bdev =blkdev_get_by_dev (swsusp_resume_device, -FMODE_READ ,NULL ); +FMODE_READ |FMODE_EXCL , &holder);if (!IS_ERR (hib_resume_bdev)) {set_blocksize (hib_resume_bdev,PAGE_SIZE );clear_page (swsusp_header);
@@ -1550,7 +1551,7 @@ int swsusp_check(void) put:if (error) -blkdev_put (hib_resume_bdev,FMODE_READ ); +blkdev_put (hib_resume_bdev,FMODE_READ |FMODE_EXCL );else pr_debug ("PM: Image signature found, resuming\n" ); }else {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 97/251 iwlwifi: mvm: disable RX-diversity in powersave
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit e5322b9ab5f63536c41301150b7ce64605ce52cc ]
Just like we have default SMPS mode as dynamic in powersave, we should not enable RX-diversity in powersave, to reduce power consumption when connected to a non-MIMO AP.
--- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/utils.c +3 -0
@@ -1029,6 +1029,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)lockdep_assert_held (&mvm->mutex); +if (iwlmvm_mod_params.power_scheme !=IWL_POWER_SCHEME_CAM ) +return false; +if (num_of_ant (iwl_mvm_get_valid_rx_ant (mvm)) ==1 )return false;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 98/251 smackfs: use __GFP_NOFAIL for smk_cipso_doi()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit f91488ee15bd3cac467e2d6a361fc2d34d1052ae ]
syzbot is reporting kernel panic at smk_cipso_doi() due to memory allocation fault injection [1]. The reason for need to use panic() was not explained. But since no fix was proposed for 18 months, for now let's use __GFP_NOFAIL for utilizing syzbot resource on other bugs.
--- security/smack/smackfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
security/smack/smackfs.c +1 -3
@@ -721,9 +721,7 @@ static void smk_cipso_doi(void)printk (KERN_WARNING "%s:%d remove rc = %d\n" , __func__, __LINE__, rc); - doip =kmalloc (sizeof (struct cipso_v4_doi ),GFP_KERNEL ); -if (doip ==NULL ) -panic ("smack: Failed to initialize cipso DOI.\n" ); + doip =kmalloc (sizeof (struct cipso_v4_doi ),GFP_KERNEL | __GFP_NOFAIL); doip->map.std =NULL ; doip->doi = smk_cipso_doi_value; doip->type =CIPSO_V4_MAP_PASS ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 99/251 ARM: clang: Do not rely on lr register for stacktrace
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit b3ea5d56f212ad81328c82454829a736197ebccc ]
Currently the stacktrace on clang compiled arm kernel uses the 'lr' register to find the first frame address from pt_regs. However, that is wrong after calling another function, because the 'lr' register is used by 'bl' instruction and never be recovered.
As same as gcc arm kernel, directly use the frame pointer (r11) of the pt_regs to find the first frame address.
Note that this fixes kretprobe stacktrace issue only with CONFIG_UNWINDER_FRAME_POINTER=y. For the CONFIG_UNWINDER_ARM, we need another fix.
--- arch/arm/kernel/stacktrace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm/kernel/stacktrace.c +1 -2
@@ -52,8 +52,7 @@ int notrace unwind_frame(struct stackframe *frame) frame->sp = frame->fp; frame->fp = *(unsigned long *)(fp); - frame->pc = frame->lr; - frame->lr = *(unsigned long *)(fp +4 ); + frame->pc = *(unsigned long *)(fp +4 );#else /* check current frame pointer is within bounds */ if (fp < low +12 || fp > high -4 )
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 100/251 gre/sit: Dont generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
In reply to Greg Kroah-HartmanFrom: Stephen Suryaputra <[email protected]>
[ Upstream commit 61e18ce7348bfefb5688a8bcd4b4d6b37c0f9b2a ]
When addr_gen_mode is set to IN6_ADDR_GEN_MODE_NONE, the link-local addr should not be generated. But it isn't the case for GRE (as well as GRE6) and SIT tunnels. Make it so that tunnels consider the addr_gen_mode, especially for IN6_ADDR_GEN_MODE_NONE.
Do this in add_v4_addrs() to cover both GRE and SIT only if the addr scope is link.
--- net/ipv6/addrconf.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/addrconf.c +3 -0
@@ -2996,6 +2996,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)memcpy (&addr.s6_addr32[3 ], idev->dev->dev_addr,4 );if (idev->dev->flags&IFF_POINTOPOINT ) { +if (idev->cnf.addr_gen_mode ==IN6_ADDR_GEN_MODE_NONE ) +return ; + addr.s6_addr32[0 ] =htonl (0xfe800000 ); scope =IFA_LINK ; plen =64 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 101/251 ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 345dac33f58894a56d17b92a41be10e16585ceff ]
When configuring the kernel for big-endian, we set either BE-8 or BE-32 based on the CPU architecture level. Until linux-4.4, we did not have any ARMv7-M platform allowing big-endian builds, but now i.MX/Vybrid is in that category, adn we get a build error because of this:
arch/arm/kernel/module-plts.c: In function 'get_module_plt':arch/arm/kernel/module-plts.c:60:46: error: implicit declaration of function '__opcode_to_mem_thumb32' [-Werror=implicit-function-declaration]
This comes down to picking the wrong default, ARMv7-M uses BE8 like ARMv7-A does. Changing the default gets the kernel to compile and presumably works.
https://lore.kernel.org/all/[email protected]/
--- arch/arm/mm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mm/Kconfig +1 -1
@@ -757,7 +757,7 @@ config CPU_BIG_ENDIAN config CPU_ENDIAN_BE8 bool depends on CPU_BIG_ENDIAN - default CPU_V6 || CPU_V6K || CPU_V7 + default CPU_V6 || CPU_V6K || CPU_V7 || CPU_V7M help Support for the BE-8 (big-endian) mode on ARMv6 and ARMv7 processors.
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 102/251 spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit ca9b8f56ec089d3a436050afefd17b7237301f47 ]
Fix the missing clk_disable_unprepare() before return from bcm_qspi_probe() in the error handling case.
--- drivers/spi/spi-bcm-qspi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/spi/spi-bcm-qspi.c +3 -2
@@ -1301,7 +1301,7 @@ int bcm_qspi_probe(struct platform_device *pdev, &qspi->dev_ids[val]);if (ret <0 ) {dev_err (&pdev->dev,"IRQ %s not found\n" , name); - goto qspi_probe_err; + goto qspi_unprepare_err; } qspi->dev_ids[val].dev = qspi;
@@ -1316,7 +1316,7 @@ int bcm_qspi_probe(struct platform_device *pdev,if (!num_ints) {dev_err (&pdev->dev,"no IRQs registered, cannot init driver\n" ); ret = -EINVAL ; - goto qspi_probe_err; + goto qspi_unprepare_err; }/*
@@ -1367,6 +1367,7 @@ int bcm_qspi_probe(struct platform_device *pdev, qspi_reg_err:bcm_qspi_hw_uninit (qspi); +qspi_unprepare_err:clk_disable_unprepare (qspi->clk); qspi_probe_err:kfree (qspi->dev_ids);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 103/251 parisc: fix warning in flush_tlb_all
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
[ Upstream commit 1030d681319b43869e0d5b568b9d0226652d1a6f ]
I've got the following splat after enabling preemption:
[ 3.724721] BUG: using __this_cpu_add() in preemptible [00000000] code: swapper/0/1 [ 3.734630] caller is __this_cpu_preempt_check+0x38/0x50 [ 3.740635] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc4-64bit+ #324 [ 3.744605] Hardware name: 9000/785/C8000 [ 3.744605] Backtrace: [ 3.744605] [<00000000401d9d58>] show_stack+0x74/0xb0 [ 3.744605] [<0000000040c27bd4>] dump_stack_lvl+0x10c/0x188 [ 3.744605] [<0000000040c27c84>] dump_stack+0x34/0x48 [ 3.744605] [<0000000040c33438>] check_preemption_disabled+0x178/0x1b0 [ 3.744605] [<0000000040c334f8>] __this_cpu_preempt_check+0x38/0x50 [ 3.744605] [<00000000401d632c>] flush_tlb_all+0x58/0x2e0 [ 3.744605] [<00000000401075c0>] 0x401075c0 [ 3.744605] [<000000004010b8fc>] 0x4010b8fc [ 3.744605] [<00000000401080fc>] 0x401080fc [ 3.744605] [<00000000401d5224>] do_one_initcall+0x128/0x378 [ 3.744605] [<0000000040102de8>] 0x40102de8 [ 3.744605] [<0000000040c33864>] kernel_init+0x60/0x3a8 [ 3.744605] [<00000000401d1020>] ret_from_kernel_thread+0x20/0x28 [ 3.744605]
Fix this by moving the __inc_irq_stat() into the locked section.
--- arch/parisc/mm/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/parisc/mm/init.c +2 -2
@@ -895,9 +895,9 @@ void flush_tlb_all(void) {int do_recycle; -__inc_irq_stat (irq_tlb_count); do_recycle =0 ;spin_lock (&sid_lock); +__inc_irq_stat (irq_tlb_count);if (dirty_space_ids >RECYCLE_THRESHOLD ) {BUG_ON (recycle_inuse);/* FIXME: Use a semaphore/wait queue here */ get_dirty_sids (&recycle_ndirty,recycle_dirty_array);
@@ -916,8 +916,8 @@ void flush_tlb_all(void)#else void flush_tlb_all (void ) { -__inc_irq_stat (irq_tlb_count);spin_lock (&sid_lock); +__inc_irq_stat (irq_tlb_count);flush_tlb_all_local (NULL );recycle_sids ();spin_unlock (&sid_lock);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 104/251 task_stack: Fix end_of_stack() for architectures with upwards-growing stack
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
[ Upstream commit 9cc2fa4f4a92ccc6760d764e7341be46ee8aaaa1 ]
The function end_of_stack() returns a pointer to the last entry of a stack. For architectures like parisc where the stack grows upwards return the pointer to the highest address in the stack.
Without this change I faced a crash on parisc, because the stackleak functionality wrote STACKLEAK_POISON to the lowest address and thus overwrote the first 4 bytes of the task_struct which included the TIF_FLAGS.
--- include/linux/sched/task_stack.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/sched/task_stack.h +4 -0
@@ -25,7 +25,11 @@ static inline void *task_stack_page(const struct task_struct *task)static inline unsigned long *end_of_stack (const struct task_struct *task) { +#ifdef CONFIG_STACK_GROWSUP +return (unsigned long *)((unsigned long )task->stack +THREAD_SIZE ) -1 ; +#else return task->stack; +#endif }#elif !defined(__HAVE_THREAD_FUNCTIONS)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 105/251 parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
[ Upstream commit 66e29fcda1824f0427966fbee2bd2c85bf362c82 ]
With idle polling, IPIs are not sent when a CPU idle, but queued and run later from do_idle(). The default kgdb_call_nmi_hook() implementation gets the pointer to struct pt_regs from get_irq_reqs(), which doesn't work in that case because it was not called from the IPI interrupt handler. Fix it by defining our own kgdb_roundup() function which sents an IPI_ENTER_KGDB. When that IPI is received on the target CPU kgdb_nmicallback() is called.
--- arch/parisc/kernel/smp.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
arch/parisc/kernel/smp.c +17 -2
@@ -32,6 +32,7 @@#include <linux/bitops.h> #include <linux/ftrace.h> #include <linux/cpu.h> +#include <linux/kgdb.h> #include <linux/atomic.h> #include <asm/current.h>
@@ -74,7 +75,10 @@ enum ipi_message_type {IPI_CALL_FUNC ,IPI_CPU_START ,IPI_CPU_STOP , - IPI_CPU_TEST +IPI_CPU_TEST , +#ifdef CONFIG_KGDB + IPI_ENTER_KGDB, +#endif };
@@ -170,7 +174,12 @@ ipi_interrupt(int irq, void *dev_id)case IPI_CPU_TEST :smp_debug (100 ,KERN_DEBUG "CPU%d is alive!\n" , this_cpu);break ; - +#ifdef CONFIG_KGDB +case IPI_ENTER_KGDB : +smp_debug (100 ,KERN_DEBUG "CPU%d ENTER_KGDB\n" , this_cpu); +kgdb_nmicallback (raw_smp_processor_id (),get_irq_regs ()); +break ; +#endif default :printk (KERN_CRIT "Unknown IPI num on CPU%d: %lu\n" , this_cpu, which);
@@ -226,6 +235,12 @@ send_IPI_allbutself(enum ipi_message_type op) } } +#ifdef CONFIG_KGDB +void kgdb_roundup_cpus (void ) +{ +send_IPI_allbutself (IPI_ENTER_KGDB ); +} +#endif inline void smp_send_stop (void ) {send_IPI_allbutself (IPI_CPU_STOP ); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 106/251 cgroup: Make rebind_subsystems() disable v2 controllers all at once
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
[ Upstream commit 7ee285395b211cad474b2b989db52666e0430daf ]
It was found that the following warning was displayed when remounting controllers from cgroup v2 to v1:
[ 8042.997778] WARNING: CPU: 88 PID: 80682 at kernel/cgroup/cgroup.c:3130 cgroup_apply_control_disable+0x158/0x190 : [ 8043.091109] RIP: 0010:cgroup_apply_control_disable+0x158/0x190 [ 8043.096946] Code: ff f6 45 54 01 74 39 48 8d 7d 10 48 c7 c6 e0 46 5a a4 e8 7b 67 33 00 e9 41 ff ff ff 49 8b 84 24 e8 01 00 00 0f b7 40 08 eb 95 <0f> 0b e9 5f ff ff ff 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 [ 8043.115692] RSP: 0018:ffffba8a47c23d28 EFLAGS: 00010202 [ 8043.120916] RAX: 0000000000000036 RBX: ffffffffa624ce40 RCX: 000000000000181a [ 8043.128047] RDX: ffffffffa63c43e0 RSI: ffffffffa63c43e0 RDI: ffff9d7284ee1000 [ 8043.135180] RBP: ffff9d72874c5800 R08: ffffffffa624b090 R09: 0000000000000004 [ 8043.142314] R10: ffffffffa624b080 R11: 0000000000002000 R12: ffff9d7284ee1000 [ 8043.149447] R13: ffff9d7284ee1000 R14: ffffffffa624ce70 R15: ffffffffa6269e20 [ 8043.156576] FS: 00007f7747cff740(0000) GS:ffff9d7a5fc00000(0000) knlGS:0000000000000000 [ 8043.164663] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8043.170409] CR2: 00007f7747e96680 CR3: 0000000887d60001 CR4: 00000000007706e0 [ 8043.177539] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8043.184673] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8043.191804] PKRU: 55555554 [ 8043.194517] Call Trace: [ 8043.196970] rebind_subsystems+0x18c/0x470 [ 8043.201070] cgroup_setup_root+0x16c/0x2f0 [ 8043.205177] cgroup1_root_to_use+0x204/0x2a0 [ 8043.209456] cgroup1_get_tree+0x3e/0x120 [ 8043.213384] vfs_get_tree+0x22/0xb0 [ 8043.216883] do_new_mount+0x176/0x2d0 [ 8043.220550] __x64_sys_mount+0x103/0x140 [ 8043.224474] do_syscall_64+0x38/0x90 [ 8043.228063] entry_SYSCALL_64_after_hwframe+0x44/0xae
It was caused by the fact that rebind_subsystem() disables controllers to be rebound one by one. If more than one disabled controllers are originally from the default hierarchy, it means that cgroup_apply_control_disable() will be called multiple times for the same default hierarchy. A controller may be killed by css_kill() in the first round. In the second round, the killed controller may not be completely dead yet leading to the warning.
To avoid this problem, we collect all the ssid's of controllers that needed to be disabled from the default hierarchy and then disable them in one go instead of one by one.
--- kernel/cgroup/cgroup.c | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-)
kernel/cgroup/cgroup.c +27 -4
@@ -1599,6 +1599,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)struct cgroup *dcgrp = &dst_root->cgrp;struct cgroup_subsys *ss;int ssid, i, ret; +u16 dfl_disable_ss_mask =0 ;lockdep_assert_held (&cgroup_mutex);
@@ -1615,8 +1616,28 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)/* can't move between two non-dummy roots either */ if (ss->root != &cgrp_dfl_root && dst_root != &cgrp_dfl_root)return -EBUSY ; + +/* +* Collect ssid's that need to be disabled from default +* hierarchy. +*/ +if (ss->root == &cgrp_dfl_root) + dfl_disable_ss_mask |=1 << ssid; + }while_each_subsys_mask (); +if (dfl_disable_ss_mask) { +struct cgroup *scgrp = &cgrp_dfl_root.cgrp; + +/* +* Controllers from default hierarchy that need to be rebound +* are all disabled together in one go. +*/ + cgrp_dfl_root.subsys_mask &= ~dfl_disable_ss_mask; +WARN_ON (cgroup_apply_control (scgrp)); +cgroup_finalize_control (scgrp,0 ); + } + do_each_subsys_mask(ss, ssid, ss_mask) {struct cgroup_root *src_root = ss->root;struct cgroup *scgrp = &src_root->cgrp;
@@ -1625,10 +1646,12 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)WARN_ON (!css ||cgroup_css (dcgrp, ss)); -/* disable from the source */ - src_root->subsys_mask &= ~(1 << ssid); -WARN_ON (cgroup_apply_control (scgrp)); -cgroup_finalize_control (scgrp,0 ); +if (src_root != &cgrp_dfl_root) { +/* disable from the source */ + src_root->subsys_mask &= ~(1 << ssid); +WARN_ON (cgroup_apply_control (scgrp)); +cgroup_finalize_control (scgrp,0 ); + }/* rebind */ RCU_INIT_POINTER (scgrp->subsys[ssid],NULL );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 107/251 media: dvb-usb: fix ununit-value in az6027_rc_query
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit afae4ef7d5ad913cab1316137854a36bea6268a5 ]
Syzbot reported ununit-value bug in az6027_rc_query(). The problem was in missing state pointer initialization. Since this function does nothing we can simply initialize state to REMOTE_NO_KEY_PRESSED.
--- drivers/media/usb/dvb-usb/az6027.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/usb/dvb-usb/az6027.c +1 -0
@@ -394,6 +394,7 @@ static struct rc_map_table rc_map_az6027_table[] = {/* remote control stuff (does not work with my box) */ static int az6027_rc_query (struct dvb_usb_device *d,u32 *event,int *state) { + *state =REMOTE_NO_KEY_PRESSED ;return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 108/251 media: mtk-vpu: Fix a resource leak in the error handling path of mtk_vpu_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 2143ad413c05c7be24c3a92760e367b7f6aaac92 ]
A successful 'clk_prepare()' call should be balanced by a corresponding 'clk_unprepare()' call in the error handling path of the probe, as already done in the remove function.
Update the error handling path accordingly.
--- drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/platform/mtk-vpu/mtk_vpu.c +4 -1
@@ -817,7 +817,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) vpu->wdt.wq =create_singlethread_workqueue ("vpu_wdt" );if (!vpu->wdt.wq) {dev_err (dev,"initialize wdt workqueue failed\n" ); -return -ENOMEM ; + ret = -ENOMEM ; + goto clk_unprepare; }INIT_WORK (&vpu->wdt.ws, vpu_wdt_reset_func);mutex_init (&vpu->vpu_mutex);
@@ -916,6 +917,8 @@ disable_vpu_clk:vpu_clock_disable (vpu); workqueue_destroy:destroy_workqueue (vpu->wdt.wq); +clk_unprepare: +clk_unprepare (vpu->clk);return ret; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 109/251 media: si470x: Avoid card name truncation
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 2908249f3878a591f7918368fdf0b7b0a6c3158c ]
The "card" string only holds 31 characters (and the terminating NUL). In order to avoid truncation, use a shorter card description instead of the current result, "Silicon Labs Si470x FM Radio Re".
--- drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- drivers/media/radio/si470x/radio-si470x-usb.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/media/radio/si470x/radio-si470x-i2c.c +1 -1
@@ -20,7 +20,7 @@/* driver definitions */ #define DRIVER_AUTHOR "Joonyoung Shim <[email protected]>"; -#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" +#define DRIVER_CARD "Silicon Labs Si470x FM Radio"#define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers"#define DRIVER_VERSION "1.0.2"
drivers/media/radio/si470x/radio-si470x-usb.c +1 -1
@@ -25,7 +25,7 @@/* driver definitions */ #define DRIVER_AUTHOR "Tobias Lorenz <[email protected]>" -#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" +#define DRIVER_CARD "Silicon Labs Si470x FM Radio"#define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers"#define DRIVER_VERSION "1.0.10"
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 110/251 media: cx23885: Fix snd_card_free call on null card pointer
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 7266dda2f1dfe151b12ef0c14eb4d4e622fb211c ]
Currently a call to snd_card_new that fails will set card with a NULL pointer, this causes a null pointer dereference on the error cleanup path when card it passed to snd_card_free. Fix this by adding a new error exit path that does not call snd_card_free and exiting via this new path.
Addresses-Coverity: ("Explicit null dereference")
--- drivers/media/pci/cx23885/cx23885-alsa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/pci/cx23885/cx23885-alsa.c +2 -1
@@ -560,7 +560,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev)SNDRV_DEFAULT_IDX1 ,SNDRV_DEFAULT_STR1 , THIS_MODULE, sizeof(struct cx23885_audio_dev), &card);if (err <0 ) - goto error; + goto error_msg; chip = (struct cx23885_audio_dev *) card->private_data; chip->dev = dev;
@@ -586,6 +586,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) error:snd_card_free (card); +error_msg:pr_err ("%s(): Failed to register analog audio adapter\n" , __func__);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 111/251 cpuidle: Fix kobject memory leaks in error paths
In reply to Greg Kroah-HartmanFrom: Anel Orazgaliyeva <[email protected]>
[ Upstream commit e5f5a66c9aa9c331da5527c2e3fd9394e7091e01 ]
Commit c343bf1ba5ef ("cpuidle: Fix three reference count leaks") fixes the cleanup of kobjects; however, it removes kfree() calls altogether, leading to memory leaks.
Fix those and also defer the initialization of dev->kobj_dev until after the error check, so that we do not end up with a dangling pointer.
--- drivers/cpuidle/sysfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/cpuidle/sysfs.c +4 -1
@@ -415,6 +415,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device) &kdev->kobj, "state%d", i);if (ret) {kobject_put (&kobj->kobj); +kfree (kobj); goto error_state; }kobject_uevent (&kobj->kobj,KOBJ_ADD );
@@ -545,6 +546,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev) &kdev->kobj, "driver");if (ret) {kobject_put (&kdrv->kobj); +kfree (kdrv);return ret; }
@@ -631,7 +633,6 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)if (!kdev)return -ENOMEM ; kdev->dev = dev; - dev->kobj_dev = kdev;init_completion (&kdev->kobj_unregister);
@@ -639,9 +640,11 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) "cpuidle");if (error) {kobject_put (&kdev->kobj); +kfree (kdev);return error; } + dev->kobj_dev = kdev;kobject_uevent (&kdev->kobj,KOBJ_ADD );return 0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 112/251 ath9k: Fix potential interrupt storm on queue reset
In reply to Greg Kroah-HartmanFrom: Linus Lüssing <[email protected]>
[ Upstream commit 4925642d541278575ad1948c5924d71ffd57ef14 ]
In tests with two Lima boards from 8devices (QCA4531 based) on OpenWrt 19.07 we could force a silent restart of a device with no serial output when we were sending a high amount of UDP traffic (iperf3 at 80 MBit/s in both directions from external hosts, saturating the wifi and causing a load of about 4.5 to 6) and were then triggering an ath9k_queue_reset().
Further debugging showed that the restart was caused by the ath79 watchdog. With disabled watchdog we could observe that the device was constantly going into ath_isr() interrupt handler and was returning early after the ATH_OP_HW_RESET flag test, without clearing any interrupts. Even though ath9k_queue_reset() calls ath9k_hw_kill_interrupts().
With JTAG we could observe the following race condition:
1) ath9k_queue_reset()
...
-> ath9k_hw_kill_interrupts()
-> set_bit(ATH_OP_HW_RESET, &common->op_flags);
...
<- returns
2) ath9k_tasklet()
...
-> ath9k_hw_resume_interrupts()
...
<- returns
3) loops around:
...
handle_int()
-> ath_isr()
...
-> if (test_bit(ATH_OP_HW_RESET,
&common->op_flags))
return IRQ_HANDLED;
x) ath_reset_internal():
=> never reached <=And in ath_isr() we would typically see the following interrupts / interrupt causes:
* status: 0x00111030 or 0x00110030
* async_cause: 2 (AR_INTR_MAC_IPQ)
* sync_cause: 0
So the ath9k_tasklet() reenables the ath9k interrupts through ath9k_hw_resume_interrupts() which ath9k_queue_reset() had just disabled. And ath_isr() then keeps firing because it returns IRQ_HANDLED without actually clearing the interrupt.
To fix this IRQ storm also clear/disable the interrupts again when we are in reset state.
--- drivers/net/wireless/ath/ath9k/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/main.c +3 -1
@@ -529,8 +529,10 @@ irqreturn_t ath_isr(int irq, void *dev)ath9k_debug_sync_cause (sc, sync_cause); status &= ah->imask;/* discard unasked-for bits */ -if (test_bit (ATH_OP_HW_RESET , &common->op_flags)) +if (test_bit (ATH_OP_HW_RESET , &common->op_flags)) { +ath9k_hw_kill_interrupts (sc->sc_ah);return IRQ_HANDLED ; + }/* * If there are no status bits set, then this interrupt was not
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 113/251 crypto: qat - detect PFVF collision after ACK
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 9b768e8a3909ac1ab39ed44a3933716da7761a6f ]
Detect a PFVF collision between the local and the remote function by checking if the message on the PFVF CSR has been overwritten. This is done after the remote function confirms that the message has been received, by clearing the interrupt bit, or the maximum number of attempts (ADF_IOV_MSG_ACK_MAX_RETRY) to check the CSR has been exceeded.
--- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +7 -0
@@ -195,6 +195,13 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr) val =ADF_CSR_RD (pmisc_bar_addr, pf2vf_offset); }while ((val & int_bit) && (count++ <ADF_IOV_MSG_ACK_MAX_RETRY )); +if (val != msg) { +dev_dbg (&GET_DEV (accel_dev), +"Collision - PFVF CSR overwritten by remote function\n" ); + ret = -EIO ; + goto out; + } +if (val & int_bit) {dev_dbg (&GET_DEV (accel_dev),"ACK not received from remote\n" ); val &= ~int_bit;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 114/251 crypto: qat - disregard spurious PFVF interrupts
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 18fcba469ba5359c1de7e3fb16f7b9e8cd1b8e02 ]
Upon receiving a PFVF message, check if the interrupt bit is set in the message. If it is not, that means that the interrupt was probably triggered by a collision. In this case, disregard the message and re-enable the interrupts.
--- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 6 ++++++ drivers/crypto/qat/qat_common/adf_vf_isr.c | 6 ++++++ 2 files changed, 12 insertions(+)
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +6 -0
@@ -250,6 +250,11 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)/* Read message from the VF */ msg =ADF_CSR_RD (pmisc_addr, hw_data->get_pf2vf_offset (vf_nr)); +if (!(msg &ADF_VF2PF_INT )) { +dev_info (&GET_DEV (accel_dev), +"Spurious VF2PF interrupt, msg %X. Ignored\n" , msg); + goto out; + }/* To ACK, clear the VF2PFINT bit */ msg &= ~ADF_VF2PF_INT ;
@@ -333,6 +338,7 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)if (resp &&adf_iov_putmsg (accel_dev, resp, vf_nr))dev_err (&GET_DEV (accel_dev),"Failed to send response to VF\n" ); +out:/* re-enable interrupt on PF from this VF */ adf_enable_vf2pf_interrupts (accel_dev, (1 << vf_nr));return ;
drivers/crypto/qat/qat_common/adf_vf_isr.c +6 -0
@@ -123,6 +123,11 @@ static void adf_pf2vf_bh_handler(void *data)/* Read the message from PF */ msg =ADF_CSR_RD (pmisc_bar_addr, hw_data->get_pf2vf_offset (0 )); +if (!(msg &ADF_PF2VF_INT )) { +dev_info (&GET_DEV (accel_dev), +"Spurious PF2VF interrupt, msg %X. Ignored\n" , msg); + goto out; + }if (!(msg &ADF_PF2VF_MSGORIGIN_SYSTEM ))/* Ignore legacy non-system (non-kernel) PF2VF messages */
@@ -171,6 +176,7 @@ static void adf_pf2vf_bh_handler(void *data) msg &= ~ADF_PF2VF_INT ;ADF_CSR_WR (pmisc_bar_addr, hw_data->get_pf2vf_offset (0 ), msg); +out:/* Re-enable PF2VF interrupts */ adf_enable_pf2vf_interrupts (accel_dev);return ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 115/251 hwrng: mtk - Force runtime pm ops for sleep ops
In reply to Greg Kroah-HartmanFrom: Markus Schneider-Pargmann <[email protected]>
[ Upstream commit b6f5f0c8f72d348b2d07b20d7b680ef13a7ffe98 ]
Currently mtk_rng_runtime_suspend/resume is called for both runtime pm and system sleep operations.
This is wrong as these should only be runtime ops as the name already suggests. Currently freezing the system will lead to a call to mtk_rng_runtime_suspend even if the device currently isn't active. This leads to a clock warning because it is disabled/unprepared although it isn't enabled/prepared currently.
This patch fixes this by only setting the runtime pm ops and forces to call the runtime pm ops from the system sleep ops as well if active but not otherwise.
--- drivers/char/hw_random/mtk-rng.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/char/hw_random/mtk-rng.c +7 -2
@@ -181,8 +181,13 @@ static int mtk_rng_runtime_resume(struct device *dev)return mtk_rng_init (&priv->rng); } -static UNIVERSAL_DEV_PM_OPS(mtk_rng_pm_ops, mtk_rng_runtime_suspend, - mtk_rng_runtime_resume, NULL); +static const struct dev_pm_ops mtk_rng_pm_ops = { + SET_RUNTIME_PM_OPS(mtk_rng_runtime_suspend, + mtk_rng_runtime_resume, NULL) +SET_SYSTEM_SLEEP_PM_OPS (pm_runtime_force_suspend, + pm_runtime_force_resume) +}; +#define MTK_RNG_PM_OPS (&mtk_rng_pm_ops)#else /* CONFIG_PM */ #define MTK_RNG_PM_OPS NULL
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 116/251 b43legacy: fix a lower bounds test
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit c1c8380b0320ab757e60ed90efc8b1992a943256 ]
The problem is that "channel" is an unsigned int, when it's less 5 the value of "channel - 5" is not a negative number as one would expect but is very high positive value instead.
This means that "start" becomes a very high positive value. The result of that is that we never enter the "for (i = start; i <= end; i++) {" loop. Instead of storing the result from b43legacy_radio_aci_detect() it just uses zero.
--- drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/b43legacy/radio.c +1 -1
@@ -299,7 +299,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) & 0x7FFF);b43legacy_set_all_gains (dev,3 ,8 ,1 ); - start = (channel -5 >0 ) ? channel -5 :1 ; + start = (channel >5 ) ? channel -5 :1 ; end = (channel +5 <14 ) ? channel +5 :13 ;for (i = start; i <= end; i++) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 117/251 b43: fix a lower bounds test
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 9b793db5fca44d01f72d3564a168171acf7c4076 ]
The problem is that "channel" is an unsigned int, when it's less 5 the value of "channel - 5" is not a negative number as one would expect but is very high positive value instead.
This means that "start" becomes a very high positive value. The result of that is that we never enter the "for (i = start; i <= end; i++) {" loop. Instead of storing the result from b43legacy_radio_aci_detect() it just uses zero.
--- drivers/net/wireless/broadcom/b43/phy_g.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/b43/phy_g.c +1 -1
@@ -2310,7 +2310,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev)b43_phy_mask (dev,B43_PHY_G_CRS ,0x7FFF );b43_set_all_gains (dev,3 ,8 ,1 ); - start = (channel -5 >0 ) ? channel -5 :1 ; + start = (channel >5 ) ? channel -5 :1 ; end = (channel +5 <14 ) ? channel +5 :13 ;for (i = start; i <= end; i++) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 118/251 memstick: avoid out-of-range warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 4853396f03c3019eccf5cd113e464231e9ddf0b3 ]
clang-14 complains about a sanity check that always passes when the page size is 64KB or larger:
drivers/memstick/core/ms_block.c:1739:21: error: result of comparison of constant 65536 with expression of type 'unsigned short' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
if (msb->page_size > PAGE_SIZE) {
~~~~~~~~~~~~~~ ^ ~~~~~~~~~This is fine, it will still work on all architectures, so just shut up that warning with a cast.
--- drivers/memstick/core/ms_block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memstick/core/ms_block.c +1 -1
@@ -1730,7 +1730,7 @@ static int msb_init_card(struct memstick_dev *card) msb->pages_in_block = boot_block->attr.block_size *2 ; msb->block_size = msb->page_size * msb->pages_in_block; -if (msb->page_size >PAGE_SIZE ) { +if ((size_t )msb->page_size >PAGE_SIZE ) {/* this isn't supported by linux at all, anyway*/ dbg ("device page %d size isn't supported" , msb->page_size);return -EINVAL ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 119/251 memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit beae4a6258e64af609ad5995cc6b6056eb0d898e ]
The "msh" pointer is device managed, meaning that memstick_alloc_host() calls device_initialize() on it. That means that it can't be free using kfree() but must instead be freed with memstick_free_host(). Otherwise it leads to a tiny memory leak of device resources.
--- drivers/memstick/host/jmb38x_ms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/memstick/host/jmb38x_ms.c +1 -1
@@ -905,7 +905,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt)iounmap (host->addr); err_out_free: -kfree (msh); +memstick_free_host (msh);return NULL ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 120/251 hwmon: Fix possible memleak in __hwmon_device_register()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit ada61aa0b1184a8fda1a89a340c7d6cc4e59aee5 ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888102740438 (size 8):
comm "27", pid 859, jiffies 4295031351 (age 143.992s) hex dump (first 8 bytes):
68 77 6d 6f 6e 30 00 00 hwmon0..
backtrace:
[<00000000544b5996>] __kmalloc_track_caller+0x1a6/0x300
[<00000000df0d62b9>] kvasprintf+0xad/0x140
[<00000000d3d2a3da>] kvasprintf_const+0x62/0x190
[<000000005f8f0f29>] kobject_set_name_vargs+0x56/0x140
[<00000000b739e4b9>] dev_set_name+0xb0/0xe0
[<0000000095b69c25>] __hwmon_device_register+0xf19/0x1e50 [hwmon]
[<00000000a7e65b52>] hwmon_device_register_with_info+0xcb/0x110 [hwmon]
[<000000006f181e86>] devm_hwmon_device_register_with_info+0x85/0x100 [hwmon]
[<0000000081bdc567>] tmp421_probe+0x2d2/0x465 [tmp421]
[<00000000502cc3f8>] i2c_device_probe+0x4e1/0xbb0
[<00000000f90bda3b>] really_probe+0x285/0xc30
[<000000007eac7b77>] __driver_probe_device+0x35f/0x4f0
[<000000004953d43d>] driver_probe_device+0x4f/0x140
[<000000002ada2d41>] __device_attach_driver+0x24c/0x330
[<00000000b3977977>] bus_for_each_drv+0x15d/0x1e0
[<000000005bf2a8e3>] __device_attach+0x267/0x410When device_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used instead of calling hwmon_dev_release() to give up the device reference, then the name will be freed in kobject_cleanup().
--- drivers/hwmon/hwmon.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/hwmon/hwmon.c +4 -2
@@ -627,8 +627,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,dev_set_drvdata (hdev, drvdata);dev_set_name (hdev,HWMON_ID_FORMAT , id); err =device_register (hdev); -if (err) - goto free_hwmon; +if (err) { +put_device (hdev); + goto ida_remove; + } if (dev && dev->of_node && chip && chip->ops->read && chip->info[0]->type == hwmon_chip &&
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 121/251 ath10k: fix max antenna gain unit
In reply to Greg Kroah-HartmanFrom: Sven Eckelmann <[email protected]>
[ Upstream commit 0a491167fe0cf9f26062462de2a8688b96125d48 ]
Most of the txpower for the ath10k firmware is stored as twicepower (0.5 dB steps). This isn't the case for max_antenna_gain - which is still expected by the firmware as dB.
The firmware is converting it from dB to the internal (twicepower) representation when it calculates the limits of a channel. This can be seen in tpc_stats when configuring "12" as max_antenna_gain. Instead of the expected 12 (6 dB), the tpc_stats shows 24 (12 dB).
Tested on QCA9888 and IPQ4019 with firmware 10.4-3.5.3-00057.
--- drivers/net/wireless/ath/ath10k/mac.c | 6 +++--- drivers/net/wireless/ath/ath10k/wmi.h | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath10k/mac.c +3 -3
@@ -990,7 +990,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id) arg.channel.min_power =0 ; arg.channel.max_power = channel->max_power *2 ; arg.channel.max_reg_power = channel->max_reg_power *2 ; - arg.channel.max_antenna_gain = channel->max_antenna_gain *2 ; + arg.channel.max_antenna_gain = channel->max_antenna_gain;reinit_completion (&ar->vdev_setup_done);
@@ -1432,7 +1432,7 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif, arg.channel.min_power =0 ; arg.channel.max_power = chandef->chan->max_power *2 ; arg.channel.max_reg_power = chandef->chan->max_reg_power *2 ; - arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain *2 ; + arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;if (arvif->vdev_type ==WMI_VDEV_TYPE_AP ) { arg.ssid = arvif->u.ap.ssid;
@@ -3091,7 +3091,7 @@ static int ath10k_update_channel_list(struct ath10k *ar) ch->min_power =0 ; ch->max_power = channel->max_power *2 ; ch->max_reg_power = channel->max_reg_power *2 ; - ch->max_antenna_gain = channel->max_antenna_gain *2 ; + ch->max_antenna_gain = channel->max_antenna_gain; ch->reg_class_id =0 ;/* FIXME */ /* FIXME: why use only legacy modes, why not any
drivers/net/wireless/ath/ath10k/wmi.h +3 -0
@@ -1945,7 +1945,9 @@ struct wmi_channel {union {__le32 reginfo1;struct { +/* note: power unit is 1 dBm */ u8 antenna_max; +/* note: power unit is 0.5 dBm */ u8 max_tx_power; } __packed; } __packed;
@@ -1965,6 +1967,7 @@ struct wmi_channel_arg {u32 min_power;u32 max_power;u32 max_reg_power; +/* note: power unit is 1 dBm */ u32 max_antenna_gain;u32 reg_class_id;enum wmi_phy_mode mode;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 122/251 drm/msm: uninitialized variable in msm_gem_import()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 2203bd0e5c12ffc53ffdd4fbd7b12d6ba27e0424 ]
The msm_gem_new_impl() function cleans up after itself so there is no need to call drm_gem_object_put(). Conceptually, it does not make sense to call a kref_put() function until after the reference counting has been initialized which happens immediately after this call in the drm_gem_(private_)object_init() functions.
In the msm_gem_import() function the "obj" pointer is uninitialized, so it will lead to a crash.
--- drivers/gpu/drm/msm/msm_gem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/msm_gem.c +2 -2
@@ -959,7 +959,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, ret =msm_gem_new_impl (dev, size, flags,NULL , &obj, struct_mutex_locked);if (ret) - goto fail; +return ERR_PTR (ret);if (use_vram) {struct msm_gem_vma *vma;
@@ -1029,7 +1029,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, ret =msm_gem_new_impl (dev, size,MSM_BO_WC , dmabuf->resv, &obj, false);if (ret) - goto fail; +return ERR_PTR (ret);drm_gem_private_object_init (dev, obj, size);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 123/251 net: stream: dont purge sk_error_queue in sk_stream_kill_queues()
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 ]
sk_stream_kill_queues() can be called on close when there are still outstanding skbs to transmit. Those skbs may try to queue notifications to the error queue (e.g. timestamps). If sk_stream_kill_queues() purges the queue without taking its lock the queue may get corrupted, and skbs leaked.
This shows up as a warning about an rmem leak:
WARNING: CPU: 24 PID: 0 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x...
The leak is always a multiple of 0x300 bytes (the value is in %rax on my builds, so RAX: 0000000000000300). 0x300 is truesize of an empty sk_buff. Indeed if we dump the socket state at the time of the warning the sk_error_queue is often (but not always) corrupted. The ->next pointer points back at the list head, but not the ->prev pointer. Indeed we can find the leaked skb by scanning the kernel memory for something that looks like an skb with ->sk = socket in question, and ->truesize = 0x300. The contents of ->cb[] of the skb confirms the suspicion that it is indeed a timestamp notification (as generated in __skb_complete_tx_timestamp()).
Removing purging of sk_error_queue should be okay, since inet_sock_destruct() does it again once all socket refs are gone. Eric suggests this may cause sockets that go thru disconnect() to maintain notifications from the previous incarnations of the socket, but that should be okay since the race was there anyway, and disconnect() is not exactly dependable.
Thanks to Jonathan Lemon and Omar Sandoval for help at various stages of tracing the issue.
--- net/core/stream.c | 3 --- 1 file changed, 3 deletions(-)
net/core/stream.c +0 -3
@@ -195,9 +195,6 @@ void sk_stream_kill_queues(struct sock *sk)/* First the read buffer. */ __skb_queue_purge (&sk->sk_receive_queue); -/* Next, the error queue. */ -__skb_queue_purge (&sk->sk_error_queue); -/* Next, the write queue. */ WARN_ON (!skb_queue_empty (&sk->sk_write_queue));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 124/251 mmc: mxs-mmc: disable regulator on error and in the remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit ce5f6c2c9b0fcb4094f8e162cfd37fb4294204f7 ]
The 'reg_vmmc' regulator is enabled in the probe. It is never disabled. Neither in the error handling path of the probe nor in the remove function.
Register a devm_action to disable it when needed.
--- drivers/mmc/host/mxs-mmc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/mmc/host/mxs-mmc.c +10 -0
@@ -579,6 +579,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = { };MODULE_DEVICE_TABLE (of, mxs_mmc_dt_ids); +static void mxs_mmc_regulator_disable (void *regulator) +{ +regulator_disable (regulator); +} +static int mxs_mmc_probe (struct platform_device *pdev) { const struct of_device_id *of_id =
@@ -622,6 +627,11 @@ static int mxs_mmc_probe(struct platform_device *pdev) "Failed to enable vmmc regulator: %d\n", ret); goto out_mmc_free; } + + ret =devm_add_action_or_reset (&pdev->dev, mxs_mmc_regulator_disable, + reg_vmmc); +if (ret) + goto out_mmc_free; } ssp->clk =devm_clk_get (&pdev->dev,NULL );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 125/251 platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit fd96e35ea7b95f1e216277805be89d66e4ae962d ]
A new warning in clang points out a use of bitwise OR with boolean expressions in this driver:
drivers/platform/x86/thinkpad_acpi.c:9061:11: error: use of bitwise '|' with boolean operands [-Werror,-Wbitwise-instead-of-logical]
else if ((strlencmp(cmd, "level disengaged") == 0) |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
||drivers/platform/x86/thinkpad_acpi.c:9061:11: note: cast one or both operands to int to silence this warning 1 error generated.
This should clearly be a logical OR so change it to fix the warning.
--- drivers/platform/x86/thinkpad_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/thinkpad_acpi.c +1 -1
@@ -8978,7 +8978,7 @@ static int fan_write_cmd_level(const char *cmd, int *rc)if (strlencmp (cmd,"level auto" ) ==0 ) level =TP_EC_FAN_AUTO ; -else if ((strlencmp (cmd,"level disengaged" ) ==0 ) | +else if ((strlencmp (cmd,"level disengaged" ) ==0 ) || (strlencmp (cmd,"level full-speed" ) ==0 )) level =TP_EC_FAN_FULLSPEED ;else if (sscanf (cmd,"level %d" , &level) !=1 )
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 126/251 mwifiex: Send DELBA requests according to spec
In reply to Greg Kroah-HartmanFrom: Jonas Dreßler <[email protected]>
[ Upstream commit cc8a8bc37466f79b24d972555237f3d591150602 ]
While looking at on-air packets using Wireshark, I noticed we're never setting the initiator bit when sending DELBA requests to the AP: While we set the bit on our del_ba_param_set bitmask, we forget to actually copy that bitmask over to the command struct, which means we never actually set the initiator bit.
Fix that and copy the bitmask over to the host_cmd_ds_11n_delba command struct.
--- drivers/net/wireless/marvell/mwifiex/11n.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/marvell/mwifiex/11n.c +3 -2
@@ -632,14 +632,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac,uint16_t del_ba_param_set;memset (&delba,0 ,sizeof (delba)); - delba.del_ba_param_set =cpu_to_le16 (tid <<DELBA_TID_POS ); - del_ba_param_set =le16_to_cpu (delba.del_ba_param_set); + del_ba_param_set = tid <<DELBA_TID_POS ; +if (initiator) del_ba_param_set |=IEEE80211_DELBA_PARAM_INITIATOR_MASK ;else del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK ; + delba.del_ba_param_set =cpu_to_le16 (del_ba_param_set);memcpy (&delba.peer_mac_addr, peer_mac,ETH_ALEN );/* We don't wait for the response of this command */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 127/251 phy: micrel: ksz8041nl: do not use power down mode
In reply to Greg Kroah-HartmanFrom: Stefan Agner <[email protected]>
[ Upstream commit 2641b62d2fab52648e34cdc6994b2eacde2d27c1 ]
Some Micrel KSZ8041NL PHY chips exhibit continuous RX errors after using the power down mode bit (0.11). If the PHY is taken out of power down mode in a certain temperature range, the PHY enters a weird state which leads to continuously reporting RX errors. In that state, the MAC is not able to receive or send any Ethernet frames and the activity LED is constantly blinking. Since Linux is using the suspend callback when the interface is taken down, ending up in that state can easily happen during a normal startup.
Micrel confirmed the issue in errata DS80000700A [*], caused by abnormal clock recovery when using power down mode. Even the latest revision (A4, Revision ID 0x1513) seems to suffer that problem, and according to the errata is not going to be fixed.
Remove the suspend/resume callback to avoid using the power down mode completely.
[*] https://ww1.microchip.com/downloads/en/DeviceDoc/80000700A.pdf
--- drivers/net/phy/micrel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/phy/micrel.c +3 -2
@@ -876,8 +876,9 @@ static struct phy_driver ksphy_driver[] = { .get_sset_count = kszphy_get_sset_count, .get_strings = kszphy_get_strings, .get_stats = kszphy_get_stats, - .suspend = genphy_suspend, - .resume = genphy_resume, +/* No suspend/resume callbacks because of errata DS80000700A, +* receiver error following software power down. +*/ }, { .phy_id = PHY_ID_KSZ8041RNLI, .phy_id_mask = MICREL_PHY_ID_MASK,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 128/251 PM: hibernate: fix sparse warnings
In reply to Greg Kroah-HartmanFrom: Anders Roxell <[email protected]>
[ Upstream commit 01de5fcd8b1ac0ca28d2bb0921226a54fdd62684 ]
When building the kernel with sparse enabled 'C=1' the following warnings shows up:
kernel/power/swap.c:390:29: warning: incorrect type in assignment (different base types)kernel/power/swap.c:390:29: expected int retkernel/power/swap.c:390:29: got restricted blk_status_t
This is due to function hib_wait_io() returns a 'blk_status_t' which is a bitwise u8. Commit 5416da01ff6e ("PM: hibernate: Remove blk_status_to_errno in hib_wait_io") seemed to have mixed up the return type. However, the 4e4cbee93d56 ("block: switch bios to blk_status_t") actually broke the behaviour by returning the wrong type.
Rework so function hib_wait_io() returns a 'int' instead of 'blk_status_t' and make sure to call function blk_status_to_errno(hb->error)' when returning from function hib_wait_io() a int gets returned.
--- kernel/power/swap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/power/swap.c +1 -1
@@ -292,7 +292,7 @@ static int hib_submit_io(int op, int op_flags, pgoff_t page_off, void *addr,return error; } -static blk_status_t hib_wait_io (struct hib_bio_batch *hb) +static int hib_wait_io (struct hib_bio_batch *hb) {wait_event (hb->wait,atomic_read (&hb->count) ==0 );return blk_status_to_errno (hb->error);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 129/251 smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit 0934ad42bb2c5df90a1b9de690f93de735b622fe ]
syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi() is calling kfree() without removing from the cipso_v4_doi_list list after netlbl_cfg_cipsov4_map_add() returned an error. We need to use netlbl_cfg_cipsov4_del() in order to remove from the list and wait for RCU grace period before kfree().
--- security/smack/smackfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/smack/smackfs.c +1 -1
@@ -740,7 +740,7 @@ static void smk_cipso_doi(void)if (rc !=0 ) {printk (KERN_WARNING "%s:%d map add rc = %d\n" , __func__, __LINE__, rc); -kfree (doip); +netlbl_cfg_cipsov4_del (doip->doi, &nai);return ; } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 130/251 s390/gmap: dont unconditionally call pte_unmap_unlock() in __gmap_zap()
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
[ Upstream commit b159f94c86b43cf7e73e654bc527255b1f4eafc4 ]
... otherwise we will try unlocking a spinlock that was never locked via a garbage pointer.
At the time we reach this code path, we usually successfully looked up a PGSTE already; however, evil user space could have manipulated the VMA layout in the meantime and triggered removal of the page table.
--- arch/s390/mm/gmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/s390/mm/gmap.c +3 -2
@@ -665,9 +665,10 @@ void __gmap_zap(struct gmap *gmap, unsig vmaddr |= gaddr & ~PMD_MASK ;/* Get pointer to the page table entry */ ptep =get_locked_pte (gmap->mm, vmaddr, &ptl); -if (likely (ptep)) +if (likely (ptep)) {ptep_zap_unused (gmap->mm, vmaddr, ptep,0 ); -pte_unmap_unlock (ptep, ptl); +pte_unmap_unlock (ptep, ptl); + } } }EXPORT_SYMBOL_GPL (__gmap_zap);
Greg Kroah-Hartman
maintainerPATCH 131/251 irq: mips: avoid nested irq_enter()
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit c65b52d02f6c1a06ddb20cba175ad49eccd6410d ]
As bcm6345_l1_irq_handle() is a chained irqchip handler, it will be invoked within the context of the root irqchip handler, which must have entered IRQ context already.
When bcm6345_l1_irq_handle() calls arch/mips's do_IRQ() , this will nest another call to irq_enter(), and the resulting nested increment to rcu_data.dynticks_nmi_nesting will cause rcu_is_cpu_rrupt_from_idle() to fail to identify wakeups from idle, resulting in failure to preempt, and RCU stalls.
Chained irqchip handlers must invoke IRQ handlers by way of thee core irqchip code, i.e. generic_handle_irq() or generic_handle_domain_irq() and should not call do_IRQ(), which is intended only for root irqchip handlers.
Fix bcm6345_l1_irq_handle() by calling generic_handle_irq() directly.
--- drivers/irqchip/irq-bcm6345-l1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-bcm6345-l1.c +1 -1
@@ -143,7 +143,7 @@ static void bcm6345_l1_irq_handle(struct irq_desc *desc)for_each_set_bit (hwirq, &pending,IRQS_PER_WORD ) { irq =irq_linear_revmap (intc->domain, base + hwirq);if (irq) -do_IRQ (irq); +generic_handle_irq (irq);else spurious_interrupt (); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 132/251 samples/kretprobes: Fix return value if register_kretprobe() failed
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit f76fbbbb5061fe14824ba5807c44bd7400a6b4e1 ]
Use the actual return value instead of always -1 if register_kretprobe() failed.
E.g. without this patch:
# insmod samples/kprobes/kretprobe_example.ko func=no_such_func insmod: ERROR: could not insert module samples/kprobes/kretprobe_example.ko: Operation not permitted
With this patch:
# insmod samples/kprobes/kretprobe_example.ko func=no_such_func insmod: ERROR: could not insert module samples/kprobes/kretprobe_example.ko: Unknown symbol in module
--- samples/kprobes/kretprobe_example.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/kprobes/kretprobe_example.c +1 -1
@@ -83,7 +83,7 @@ static int __init kretprobe_init(void) ret =register_kretprobe (&my_kretprobe);if (ret <0 ) {pr_err ("register_kretprobe failed, returned %d\n" , ret); -return -1 ; +return ret; }pr_info ("Planted return probe at %s: %p\n" , my_kretprobe.kp.symbol_name, my_kretprobe.kp.addr);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 133/251 libertas_tf: Fix possible memory leak in probe and disconnect
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit d549107305b4634c81223a853701c06bcf657bc3 ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff88810a2ddc00 (size 512):
comm "kworker/6:1", pid 176, jiffies 4295009893 (age 757.220s) hex dump (first 32 bytes):
00 50 05 18 81 88 ff ff 00 00 00 00 00 00 00 00 .P..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
[<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
[<ffffffffa02a1530>] if_usb_probe+0x60/0x37c [libertas_tf_usb]
[<ffffffffa022668a>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
[<ffffffff82b59630>] really_probe+0x190/0x480
[<ffffffff82b59a19>] __driver_probe_device+0xf9/0x180
[<ffffffff82b59af3>] driver_probe_device+0x53/0x130
[<ffffffff82b5a075>] __device_attach_driver+0x105/0x130
[<ffffffff82b55949>] bus_for_each_drv+0x129/0x190
[<ffffffff82b593c9>] __device_attach+0x1c9/0x270
[<ffffffff82b5a250>] device_initial_probe+0x20/0x30
[<ffffffff82b579c2>] bus_probe_device+0x142/0x160
[<ffffffff82b52e49>] device_add+0x829/0x1300
[<ffffffffa02229b1>] usb_set_configuration+0xb01/0xcc0 [usbcore]
[<ffffffffa0235c4e>] usb_generic_driver_probe+0x6e/0x90 [usbcore]
[<ffffffffa022641f>] usb_probe_device+0x6f/0x130 [usbcore]cardp is missing being freed in the error handling path of the probe and the path of the disconnect, which will cause memory leak.
This patch adds the missing kfree().
--- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/marvell/libertas_tf/if_usb.c +2 -0
@@ -234,6 +234,7 @@ static int if_usb_probe(struct usb_interface *intf, dealloc:if_usb_free (cardp); +kfree (cardp); error:lbtf_deb_leave (LBTF_DEB_MAIN );return -ENOMEM ;
@@ -258,6 +259,7 @@ static void if_usb_disconnect(struct usb_interface *intf)/* Unlink and free urb */ if_usb_free (cardp); +kfree (cardp);usb_set_intfdata (intf,NULL );usb_put_dev (interface_to_usbdev (intf));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 134/251 libertas: Fix possible memory leak in probe and disconnect
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 9692151e2fe7a326bafe99836fd1f20a2cc3a049 ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff88812c7d7400 (size 512):
comm "kworker/6:1", pid 176, jiffies 4295003332 (age 822.830s) hex dump (first 32 bytes):
00 68 1e 04 81 88 ff ff 01 00 00 00 00 00 00 00 .h..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
[<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
[<ffffffffa02c9873>] if_usb_probe+0x63/0x446 [usb8xxx]
[<ffffffffa022668a>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
[<ffffffff82b59630>] really_probe+0x190/0x480
[<ffffffff82b59a19>] __driver_probe_device+0xf9/0x180
[<ffffffff82b59af3>] driver_probe_device+0x53/0x130
[<ffffffff82b5a075>] __device_attach_driver+0x105/0x130
[<ffffffff82b55949>] bus_for_each_drv+0x129/0x190
[<ffffffff82b593c9>] __device_attach+0x1c9/0x270
[<ffffffff82b5a250>] device_initial_probe+0x20/0x30
[<ffffffff82b579c2>] bus_probe_device+0x142/0x160
[<ffffffff82b52e49>] device_add+0x829/0x1300
[<ffffffffa02229b1>] usb_set_configuration+0xb01/0xcc0 [usbcore]
[<ffffffffa0235c4e>] usb_generic_driver_probe+0x6e/0x90 [usbcore]
[<ffffffffa022641f>] usb_probe_device+0x6f/0x130 [usbcore]cardp is missing being freed in the error handling path of the probe and the path of the disconnect, which will cause memory leak.
This patch adds the missing kfree().
--- drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/marvell/libertas/if_usb.c +2 -0
@@ -288,6 +288,7 @@ err_add_card:if_usb_reset_device (cardp); dealloc:if_usb_free (cardp); +kfree (cardp); error:return r;
@@ -312,6 +313,7 @@ static void if_usb_disconnect(struct usb_interface *intf)/* Unlink and free urb */ if_usb_free (cardp); +kfree (cardp);usb_set_intfdata (intf,NULL );usb_put_dev (interface_to_usbdev (intf));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 135/251 net: amd-xgbe: Toggle PLL settings during rate change
In reply to Greg Kroah-HartmanFrom: Shyam Sundar S K <[email protected]>
[ Upstream commit daf182d360e509a494db18666799f4e85d83dda0 ]
For each rate change command submission, the FW has to do a phy power off sequence internally. For this to happen correctly, the PLL re-initialization control setting has to be turned off before sending mailbox commands and re-enabled once the command submission is complete.
Without the PLL control setting, the link up takes longer time in a fixed phy configuration.
--- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 ++++++++ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 20 +++++++++++++++++++- 2 files changed, 27 insertions(+), 1 deletion(-)
drivers/net/ethernet/amd/xgbe/xgbe-common.h +8 -0
@@ -1331,6 +1331,10 @@#define MDIO_VEND2_PMA_CDR_CONTROL 0x8056#endif +#ifndef MDIO_VEND2_PMA_MISC_CTRL0 +#define MDIO_VEND2_PMA_MISC_CTRL0 0x8090 +#endif +#ifndef MDIO_CTRL1_SPEED1G #define MDIO_CTRL1_SPEED1G (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)#endif
@@ -1389,6 +1393,10 @@#define XGBE_PMA_RX_RST_0_RESET_ON 0x10#define XGBE_PMA_RX_RST_0_RESET_OFF 0x00 +#define XGBE_PMA_PLL_CTRL_MASK BIT(15) +#define XGBE_PMA_PLL_CTRL_ENABLE BIT(15) +#define XGBE_PMA_PLL_CTRL_DISABLE 0x0000 +/* Bit setting and getting macros * The get macro will extract the current bit field value from within * the variable
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +19 -1
@@ -1803,12 +1803,26 @@ static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata) } } +static void xgbe_phy_pll_ctrl (struct xgbe_prv_data *pdata,bool enable) +{ +XMDIO_WRITE_BITS (pdata,MDIO_MMD_PMAPMD ,MDIO_VEND2_PMA_MISC_CTRL0 , +XGBE_PMA_PLL_CTRL_MASK , + enable ?XGBE_PMA_PLL_CTRL_ENABLE + :XGBE_PMA_PLL_CTRL_DISABLE ); + +/* Wait for command to complete */ +usleep_range (100 ,200 ); +} +static void xgbe_phy_perform_ratechange (struct xgbe_prv_data *pdata,unsigned int cmd,unsigned int sub_cmd) {unsigned int s0 =0 ;unsigned int wait; +/* Disable PLL re-initialization during FW command processing */ +xgbe_phy_pll_ctrl (pdata, false); +/* Log if a previous command did not complete */ if (XP_IOREAD_BITS (pdata,XP_DRIVER_INT_RO ,STATUS )) { netif_dbg(pdata, link, pdata->netdev,
@@ -1829,7 +1843,7 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, wait =XGBE_RATECHANGE_COUNT ;while (wait--) {if (!XP_IOREAD_BITS (pdata,XP_DRIVER_INT_RO ,STATUS )) -return ; + goto reenable_pll;usleep_range (1000 ,2000 ); }
@@ -1839,6 +1853,10 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,/* Reset on error */ xgbe_phy_rx_reset (pdata); + +reenable_pll: +/* Enable PLL re-initialization */ +xgbe_phy_pll_ctrl (pdata, true); }static void xgbe_phy_rrc (struct xgbe_prv_data *pdata)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 136/251 net: phylink: avoid mvneta warning when setting pause parameters
In reply to Greg Kroah-HartmanFrom: Russell King (Oracle) <[email protected]>
[ Upstream commit fd8d9731bcdfb22d28e45bce789bcb211c868c78 ]
mvneta does not support asymetric pause modes, and it flags this by the lack of AsymPause in the supported field. When setting pause modes, we check that pause->rx_pause == pause->tx_pause, but only when pause autoneg is enabled. When pause autoneg is disabled, we still allow pause->rx_pause != pause->tx_pause, which is incorrect when the MAC does not support asymetric pause, and causes mvneta to issue a warning.
Fix this by removing the test for pause->autoneg, so we always check that pause->rx_pause == pause->tx_pause for network devices that do not support AsymPause.
--- drivers/net/phy/phylink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/phylink.c +1 -1
@@ -1022,7 +1022,7 @@ int phylink_ethtool_set_pauseparam(struct phylink *pl,return -EOPNOTSUPP ;if (!phylink_test (pl->supported, Asym_Pause) && - !pause->autoneg && pause->rx_pause != pause->tx_pause) + pause->rx_pause != pause->tx_pause)return -EINVAL ; config->pause &= ~(MLO_PAUSE_AN |MLO_PAUSE_TXRX_MASK );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 137/251 crypto: pcrypt - Delay write to padata->info
In reply to Greg Kroah-HartmanFrom: Daniel Jordan <[email protected]>
[ Upstream commit 68b6dea802cea0dbdd8bd7ccc60716b5a32a5d8a ]
These three events can race when pcrypt is used multiple times in a template ("pcrypt(pcrypt(...))"):
1. [taskA] The caller makes the crypto request via crypto_aead_encrypt() 2. [kworkerB] padata serializes the inner pcrypt request 3. [kworkerC] padata serializes the outer pcrypt request
3 might finish before the call to crypto_aead_encrypt() returns in 1, resulting in two possible issues.
First, a use-after-free of the crypto request's memory when, for example, taskA writes to the outer pcrypt request's padata->info in pcrypt_aead_enc() after kworkerC completes the request.
Second, the outer pcrypt request overwrites the inner pcrypt request's return code with -EINPROGRESS, making a successful request appear to fail. For instance, kworkerB writes the outer pcrypt request's padata->info in pcrypt_aead_done() and then taskA overwrites it in pcrypt_aead_enc().
Avoid both situations by delaying the write of padata->info until after the inner crypto request's return code is checked. This prevents the use-after-free by not touching the crypto request's memory after the next-inner crypto request is made, and stops padata->info from being overwritten.
--- crypto/pcrypt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
crypto/pcrypt.c +8 -4
@@ -138,12 +138,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata) {struct pcrypt_request *preq =pcrypt_padata_request (padata);struct aead_request *req =pcrypt_request_ctx (preq); +int ret; - padata->info =crypto_aead_encrypt (req); + ret =crypto_aead_encrypt (req); -if (padata->info == -EINPROGRESS ) +if (ret == -EINPROGRESS )return ; + padata->info = ret;padata_do_serial (padata); }
@@ -180,12 +182,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata) {struct pcrypt_request *preq =pcrypt_padata_request (padata);struct aead_request *req =pcrypt_request_ctx (preq); +int ret; - padata->info =crypto_aead_decrypt (req); + ret =crypto_aead_decrypt (req); -if (padata->info == -EINPROGRESS ) +if (ret == -EINPROGRESS )return ; + padata->info = ret;padata_do_serial (padata); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 138/251 ibmvnic: Process crqs after enabling interrupts
In reply to Greg Kroah-HartmanFrom: Sukadev Bhattiprolu <[email protected]>
[ Upstream commit 6e20d00158f31f7631d68b86996b7e951c4451c8 ]
Soon after registering a CRQ it is possible that we get a fail over or maybe a CRQ_INIT from the VIOS while interrupts were disabled.
Look for any such CRQs after enabling interrupts.
Otherwise we can intermittently fail to bring up ibmvnic adapters during boot, specially in kexec/kdump kernels.
--- drivers/net/ethernet/ibm/ibmvnic.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/ibm/ibmvnic.c +3 -0
@@ -3835,6 +3835,9 @@ static int init_crq_queue(struct ibmvnic_adapter *adapter) crq->cur =0 ;spin_lock_init (&crq->lock); +/* process any CRQs that were queued before we enabled interrupts */ +tasklet_schedule (&adapter->tasklet); +return retrc; req_irq_failed:
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 139/251 RDMA/rxe: Fix wrong port_cap_flags
In reply to Greg Kroah-HartmanFrom: Junji Wei <[email protected]>
[ Upstream commit dcd3f985b20ffcc375f82ca0ca9f241c7025eb5e ]
The port->attr.port_cap_flags should be set to enum ib_port_capability_mask_bits in ib_mad.h, not RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP.
--- drivers/infiniband/sw/rxe/rxe_param.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_param.h +1 -1
@@ -143,7 +143,7 @@ enum rxe_port_param {RXE_PORT_MAX_MTU =IB_MTU_4096 ,RXE_PORT_ACTIVE_MTU =IB_MTU_256 ,RXE_PORT_GID_TBL_LEN =1024 , -RXE_PORT_PORT_CAP_FLAGS =RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP , +RXE_PORT_PORT_CAP_FLAGS =IB_PORT_CM_SUP ,RXE_PORT_MAX_MSG_SZ =0x800000 ,RXE_PORT_BAD_PKEY_CNTR =0 , RXE_PORT_QKEY_VIOL_CNTR = 0,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 140/251 ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
In reply to Greg Kroah-HartmanFrom: Jackie Liu <[email protected]>
[ Upstream commit 2aa717473ce96c93ae43a5dc8c23cedc8ce7dd9f ]
The s3c24xx_init_intc() returns an error pointer upon failure, not NULL. let's add an error pointer check in s3c24xx_handle_irq.
s3c_intc[0] is not NULL or ERR, we can simplify the code.
--- drivers/irqchip/irq-s3c24xx.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/irqchip/irq-s3c24xx.c +18 -4
@@ -368,11 +368,25 @@ static inline int s3c24xx_handle_intc(struct s3c_irq_intc *intc, asmlinkage void __exception_irq_entry s3c24xx_handle_irq(struct pt_regs *regs) { do { - if (likely(s3c_intc[0])) - if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) - continue; + /* + * For platform based machines, neither ERR nor NULL can happen here. + * The s3c24xx_handle_irq() will be set as IRQ handler iff this succeeds: + * + * s3c_intc[0] = s3c24xx_init_intc() + * + * If this fails, the next calls to s3c24xx_init_intc() won't be executed. + * + * For DT machine, s3c_init_intc_of() could set the IRQ handler without + * setting s3c_intc[0] only if it was called with num_ctrl=0. There is no + * such code path, so again the s3c_intc[0] will have a valid pointer if + * set_handle_irq() is called. + * + * Therefore in s3c24xx_handle_irq(), the s3c_intc[0] is always something. + */ + if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) + continue; - if (s3c_intc[2]) + if (!IS_ERR_OR_NULL(s3c_intc[2])) if (s3c24xx_handle_intc(s3c_intc[2], regs, 64)) continue;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 141/251 ARM: dts: at91: tse850: the emac<->phy interface is rmii
In reply to Greg Kroah-HartmanFrom: Peter Rosin <[email protected]>
[ Upstream commit dcdbc335a91a26e022a803e1a6b837266989c032 ]
This went unnoticed until commit 7897b071ac3b ("net: macb: convert to phylink") which tickled the problem. The sama5d3 emac has never been capable of rgmii, and it all just happened to work before that commit.
--- arch/arm/boot/dts/at91-tse850-3.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/at91-tse850-3.dts +1 -1
@@ -267,7 +267,7 @@ &macb1 { status = "okay"; - phy-mode = "rgmii"; + phy-mode = "rmii"; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 142/251 scsi: dc395: Fix error case unwinding
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit cbd9a3347c757383f3d2b50cf7cfd03eb479c481 ]
dc395x_init_one()->adapter_init() might fail. In this case, the acb is already cleaned up by adapter_init(), no need to do that in adapter_uninit(acb) again.
[ 1.252251] dc395x: adapter init failed [ 1.254900] RIP: 0010:adapter_uninit+0x94/0x170 [dc395x] [ 1.260307] Call Trace: [ 1.260442] dc395x_init_one.cold+0x72a/0x9bb [dc395x]
--- drivers/scsi/dc395x.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/dc395x.c +1 -0
@@ -4809,6 +4809,7 @@ static int dc395x_init_one(struct pci_dev *dev, const struct pci_device_id *id)/* initialise the adapter and everything we need */ if (adapter_init (acb, io_port_base, io_port_len, irq)) {dprintkl (KERN_INFO ,"adapter init failed\n" ); + acb =NULL ; goto fail; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 143/251 MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
In reply to Greg Kroah-HartmanFrom: Jackie Liu <[email protected]>
[ Upstream commit 7f3b3c2bfa9c93ab9b5595543496f570983dc330 ]
mach/loongson64 fails to build when the FPU support is disabled:
arch/mips/loongson64/cop2-ex.c:45:15: error: implicit declaration of function ‘__is_fpu_owner’; did you mean ‘is_fpu_owner’? [-Werror=implicit-function-declaration] arch/mips/loongson64/cop2-ex.c:98:30: error: ‘struct thread_struct’ has no member named ‘fpu’arch/mips/loongson64/cop2-ex.c:99:30: error: ‘struct thread_struct’ has no member named ‘fpu’arch/mips/loongson64/cop2-ex.c:131:43: error: ‘struct thread_struct’ has no member named ‘fpu’arch/mips/loongson64/cop2-ex.c:137:38: error: ‘struct thread_struct’ has no member named ‘fpu’arch/mips/loongson64/cop2-ex.c:203:30: error: ‘struct thread_struct’ has no member named ‘fpu’arch/mips/loongson64/cop2-ex.c:219:30: error: ‘struct thread_struct’ has no member named ‘fpu’arch/mips/loongson64/cop2-ex.c:283:38: error: ‘struct thread_struct’ has no member named ‘fpu’arch/mips/loongson64/cop2-ex.c:301:38: error: ‘struct thread_struct’ has no member named ‘fpu’
--- arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/mips/Kconfig +1 -0
@@ -1383,6 +1383,7 @@ config CPU_LOONGSON3 select WEAK_REORDERING_BEYOND_LLSC select MIPS_PGD_C0_CONTEXT select MIPS_L1_CACHE_SHIFT_6 + select MIPS_FP_SUPPORT select GPIOLIB help The Loongson 3 processor implements the MIPS64R2 instruction
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 144/251 JFS: fix memleak in jfs_mount
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit c48a14dca2cb57527dde6b960adbe69953935f10 ]
In jfs_mount, when diMount(ipaimap2) fails, it goes to errout35. However, the following code does not free ipaimap2 allocated by diReadSpecial.
Fix this by refactoring the error handling code of jfs_mount. To be specific, modify the lable name and free ipaimap2 when the above error ocurrs.
--- fs/jfs/jfs_mount.c | 51 ++++++++++++++++++++-------------------------- 1 file changed, 22 insertions(+), 29 deletions(-)
fs/jfs/jfs_mount.c +22 -29
@@ -93,14 +93,14 @@ int jfs_mount(struct super_block *sb)* (initialize mount inode from the superblock) */ if ((rc =chkSuper (sb))) { - goto errout20; + goto out; } ipaimap =diReadSpecial (sb,AGGREGATE_I ,0 );if (ipaimap ==NULL ) {jfs_err ("jfs_mount: Failed to read AGGREGATE_I" ); rc = -EIO ; - goto errout20; + goto out; } sbi->ipaimap = ipaimap;
@@ -111,7 +111,7 @@ int jfs_mount(struct super_block *sb)*/ if ((rc =diMount (ipaimap))) {jfs_err ("jfs_mount: diMount(ipaimap) failed w/rc = %d" , rc); - goto errout21; + goto err_ipaimap; }/*
@@ -120,7 +120,7 @@ int jfs_mount(struct super_block *sb) ipbmap =diReadSpecial (sb,BMAP_I ,0 );if (ipbmap ==NULL ) { rc = -EIO ; - goto errout22; + goto err_umount_ipaimap; }jfs_info ("jfs_mount: ipbmap:0x%p" , ipbmap);
@@ -132,7 +132,7 @@ int jfs_mount(struct super_block *sb)*/ if ((rc =dbMount (ipbmap))) {jfs_err ("jfs_mount: dbMount failed w/rc = %d" , rc); - goto errout22; + goto err_ipbmap; }/*
@@ -151,7 +151,7 @@ int jfs_mount(struct super_block *sb)if (!ipaimap2) {jfs_err ("jfs_mount: Failed to read AGGREGATE_I" ); rc = -EIO ; - goto errout35; + goto err_umount_ipbmap; } sbi->ipaimap2 = ipaimap2;
@@ -163,7 +163,7 @@ int jfs_mount(struct super_block *sb)if ((rc =diMount (ipaimap2))) {jfs_err ("jfs_mount: diMount(ipaimap2) failed, rc = %d" , rc); - goto errout35; + goto err_ipaimap2; } }else /* Secondary aggregate inode table is not valid */
@@ -180,7 +180,7 @@ int jfs_mount(struct super_block *sb)jfs_err ("jfs_mount: Failed to read FILESYSTEM_I" );/* open fileset secondary inode allocation map */ rc = -EIO ; - goto errout40; + goto err_umount_ipaimap2; }jfs_info ("jfs_mount: ipimap:0x%p" , ipimap);
@@ -190,41 +190,34 @@ int jfs_mount(struct super_block *sb)/* initialize fileset inode allocation map */ if ((rc =diMount (ipimap))) {jfs_err ("jfs_mount: diMount failed w/rc = %d" , rc); - goto errout41; + goto err_ipimap; } - goto out; +return rc;/* * unwind on error */ - errout41:/* close fileset inode allocation map inode */ +err_ipimap: +/* close fileset inode allocation map inode */ diFreeSpecial (ipimap); - - errout40:/* fileset closed */ - +err_umount_ipaimap2:/* close secondary aggregate inode allocation map */ -if (ipaimap2) { +if (ipaimap2)diUnmount (ipaimap2,1 ); +err_ipaimap2: +/* close aggregate inodes */ +if (ipaimap2)diFreeSpecial (ipaimap2); - } - - errout35: - -/* close aggregate block allocation map */ +err_umount_ipbmap:/* close aggregate block allocation map */ dbUnmount (ipbmap,1 ); +err_ipbmap:/* close aggregate inodes */ diFreeSpecial (ipbmap); - - errout22:/* close aggregate inode allocation map */ - +err_umount_ipaimap:/* close aggregate inode allocation map */ diUnmount (ipaimap,1 ); - - errout21:/* close aggregate inodes */ +err_ipaimap:/* close aggregate inodes */ diFreeSpecial (ipaimap); - errout20:/* aggregate closed */ - - out: - +out:if (rc)jfs_err ("Mount JFS Failure: %d" , rc);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 145/251 ALSA: hda: Reduce udelay() at SKL+ position reporting
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 46243b85b0ec5d2cee7545e5ce18c015ce91957e ]
The position reporting on Intel Skylake and later chips via azx_get_pos_skl() contains a udelay(20) call for the capture streams. A call for this alone doesn't sound too harmful. However, as the pointer PCM ops is one of the hottest path in the PCM operations -- especially for the timer-scheduled operations like PulseAudio -- such a delay hogs CPU usage significantly in the total performance.
The code there was taken from the original code in ASoC SST Skylake driver blindly. The udelay() is a workaround for the case where the reported position is behind the period boundary at the timing triggered from interrupts; applications often expect that the full data is available for the whole period when returned (and also that's the definition of the ALSA PCM period).
OTOH, HD-audio (legacy) driver has already some workarounds for the delayed position reporting due to its relatively large FIFO, such as the BDL position adjustment and the delayed period-elapsed call in the work. That said, the udelay() is almost superfluous for HD-audio driver unlike SST, and we can drop the udelay().
Though, the current code doesn't guarantee the full period readiness as mentioned in the above, but rather it checks the wallclock and detects the unexpected jump. That's one missing piece, and the drop of udelay() needs a bit more sanity checks for the delayed handling.
This patch implements those: the drop of udelay() call in azx_get_pos_skl() and the more proper check of hwptr in azx_position_ok(). The latter change is applied only for the case where the stream is running in the normal mode without no_period_wakeup flag. When no_period_wakeup is set, it essentially ignores the period handling and rather concentrates only on the current position; which implies that we don't need to care about the period boundary at all.
--- sound/pci/hda/hda_intel.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-)
sound/pci/hda/hda_intel.c +23 -5
@@ -742,13 +742,17 @@ static int azx_intel_link_power(struct azx *chip, bool enable)* the update-IRQ timing. The IRQ is issued before actually the * data is processed. So, we need to process it afterwords in a * workqueue. +* +* Returns 1 if OK to proceed, 0 for delay handling, -1 for skipping update */ static int azx_position_ok (struct azx *chip,struct azx_dev *azx_dev) {struct snd_pcm_substream *substream = azx_dev->core.substream; +struct snd_pcm_runtime *runtime = substream->runtime;int stream = substream->stream;u32 wallclk;unsigned int pos; +snd_pcm_uframes_t hwptr, target; wallclk =azx_readl (chip,WALLCLK ) - azx_dev->core.start_wallclk;if (wallclk < (azx_dev->core.period_wallclk *2 ) /3 )
@@ -785,6 +789,24 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)/* NG - it's below the first next period boundary */ return chip->bdl_pos_adj ?0 :-1 ; azx_dev->core.start_wallclk += wallclk; + +if (azx_dev->core.no_period_wakeup) +return 1 ;/* OK, no need to check period boundary */ + +if (runtime->hw_ptr_base != runtime->hw_ptr_interrupt) +return 1 ;/* OK, already in hwptr updating process */ + +/* check whether the period gets really elapsed */ + pos =bytes_to_frames (runtime, pos); + hwptr = runtime->hw_ptr_base + pos; +if (hwptr < runtime->status->hw_ptr) + hwptr += runtime->buffer_size; + target = runtime->hw_ptr_interrupt + runtime->period_size; +if (hwptr < target) { +/* too early wakeup, process it later */ +return chip->bdl_pos_adj ?0 :-1 ; + } +return 1 ;/* OK, it's fine */ }
@@ -982,11 +1004,7 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev)if (azx_dev->core.substream->stream ==SNDRV_PCM_STREAM_PLAYBACK )return azx_skl_get_dpib_pos (chip, azx_dev); -/* For capture, we need to read posbuf, but it requires a delay -* for the possible boundary overlap; the read of DPIB fetches the -* actual posbuf -*/ -udelay (20 ); +/* read of DPIB fetches the actual posbuf */ azx_skl_get_dpib_pos (chip, azx_dev);return azx_get_pos_posbuf (chip, azx_dev); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 146/251 arm: dts: omap3-gta04a4: accelerometer irq fix
In reply to Greg Kroah-HartmanFrom: Andreas Kemnade <[email protected]>
[ Upstream commit 884ea75d79a36faf3731ad9d6b9c29f58697638d ]
Fix typo in pinctrl. It did only work because the bootloader seems to have initialized it.
--- arch/arm/boot/dts/omap3-gta04.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/omap3-gta04.dtsi +1 -1
@@ -353,7 +353,7 @@ compatible = "bosch,bma180"; reg = <0x41>; pinctrl-names = "default"; - pintcrl-0 = <&bma180_pins>; + pinctrl-0 = <&bma180_pins>; interrupt-parent = <&gpio4>; interrupts = <19 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_115 */ };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 147/251 soc/tegra: Fix an error handling path in tegra_powergate_power_up()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 986b5094708e508baa452a23ffe809870934a7df ]
If an error occurs after a successful tegra_powergate_enable_clocks() call, it must be undone by a tegra_powergate_disable_clocks() call, as already done in the below and above error handling paths of this function.
Update the 'goto' to branch at the correct place of the error handling path.
--- drivers/soc/tegra/pmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/tegra/pmc.c +1 -1
@@ -407,7 +407,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg, err =tegra_powergate_reset_deassert (pg);if (err) - goto powergate_off; + goto disable_clks;usleep_range (10 ,20 );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 148/251 memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 4ed2f3545c2e5acfbccd7f85fea5b1a82e9862d7 ]
The error handling code of fsl_ifc_ctrl_probe is problematic. When fsl_ifc_ctrl_init fails or request_irq of fsl_ifc_ctrl_dev->irq fails, it forgets to free the irq and nand_irq. Meanwhile, if request_irq of fsl_ifc_ctrl_dev->nand_irq fails, it will still free nand_irq even if the request_irq is not successful.
Fix this by refactoring the error handling code.
--- drivers/memory/fsl_ifc.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/memory/fsl_ifc.c +6 -7
@@ -276,7 +276,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) ret =fsl_ifc_ctrl_init (fsl_ifc_ctrl_dev);if (ret <0 ) - goto err; + goto err_unmap_nandirq;init_waitqueue_head (&fsl_ifc_ctrl_dev->nand_wait);
@@ -285,7 +285,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)if (ret !=0 ) {dev_err (&dev->dev,"failed to install irq (%d)\n" , fsl_ifc_ctrl_dev->irq); - goto err_irq; + goto err_unmap_nandirq; }if (fsl_ifc_ctrl_dev->nand_irq) {
@@ -294,17 +294,16 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)if (ret !=0 ) {dev_err (&dev->dev,"failed to install irq (%d)\n" , fsl_ifc_ctrl_dev->nand_irq); - goto err_nandirq; + goto err_free_irq; } }return 0 ; -err_nandirq: -free_irq (fsl_ifc_ctrl_dev->nand_irq, fsl_ifc_ctrl_dev); -irq_dispose_mapping (fsl_ifc_ctrl_dev->nand_irq); -err_irq: +err_free_irq:free_irq (fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev); +err_unmap_nandirq: +irq_dispose_mapping (fsl_ifc_ctrl_dev->nand_irq);irq_dispose_mapping (fsl_ifc_ctrl_dev->irq); err:iounmap (fsl_ifc_ctrl_dev->gregs);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 149/251 video: fbdev: chipsfb: use memset_io() instead of memset()
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit f2719b26ae27282c145202ffd656d5ff1fe737cc ]
While investigating a lockup at startup on Powerbook 3400C, it was identified that the fbdev driver generates alignment exception at startup:
--- interrupt: 600 at memset+0x60/0xc0
NIP: c0021414 LR: c03fc49c CTR: 00007fff
REGS: ca021c10 TRAP: 0600 Tainted: G W (5.14.2-pmac-00727-g12a41fa69492)
MSR: 00009032 <EE,ME,IR,DR,RI> CR: 44008442 XER: 20000100
DAR: cab80020 DSISR: 00017c07
GPR00: 00000007 ca021cd0 c14412e0 cab80000 00000000 00100000 cab8001c 00000004
GPR08: 00100000 00007fff 00000000 00000000 84008442 00000000 c0006fb4 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000
GPR24: 00000000 81800000 00000320 c15fa400 c14d1878 00000000 c14d1800 c094e19c NIP [c0021414] memset+0x60/0xc0
LR [c03fc49c] chipsfb_pci_init+0x160/0x580
--- interrupt: 600
[ca021cd0] [c03fc46c] chipsfb_pci_init+0x130/0x580 (unreliable) [ca021d20] [c03a3a70] pci_device_probe+0xf8/0x1b8
[ca021d50] [c043d584] really_probe.part.0+0xac/0x388
[ca021d70] [c043d914] __driver_probe_device+0xb4/0x170
[ca021d90] [c043da18] driver_probe_device+0x48/0x144
[ca021dc0] [c043e318] __driver_attach+0x11c/0x1c4
[ca021de0] [c043ad30] bus_for_each_dev+0x88/0xf0
[ca021e10] [c043c724] bus_add_driver+0x190/0x22c
[ca021e40] [c043ee94] driver_register+0x9c/0x170
[ca021e60] [c0006c28] do_one_initcall+0x54/0x1ec
[ca021ed0] [c08246e4] kernel_init_freeable+0x1c0/0x270
[ca021f10] [c0006fdc] kernel_init+0x28/0x11c
[ca021f30] [c0017148] ret_from_kernel_thread+0x14/0x1c Instruction dump:
7d4601a4 39490777 7d4701a4 39490888 7d4801a4 39490999 7d4901a4 39290aaa 7d2a01a4 4c00012c 4bfffe88 0fe00000 <4bfffe80> 9421fff0 38210010 48001970
This is due to 'dcbz' instruction being used on non-cached memory. 'dcbz' instruction is used by memset() to zeroize a complete cacheline at once, and memset() is not expected to be used on non cached memory.
When performing a 'sparse' check on fbdev driver, it also appears that the use of memset() is unexpected:
drivers/video/fbdev/chipsfb.c:334:17: warning: incorrect type in argument 1 (different address spaces)
drivers/video/fbdev/chipsfb.c:334:17: expected void *
drivers/video/fbdev/chipsfb.c:334:17: got char [noderef] __iomem *screen_base
drivers/video/fbdev/chipsfb.c:334:15: warning: memset with byte count of 1048576
Use fb_memset() instead of memset(). fb_memset() is defined as memset_io() for powerpc.
--- drivers/video/fbdev/chipsfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/chipsfb.c +1 -1
@@ -332,7 +332,7 @@ static const struct fb_var_screeninfo chipsfb_var = {static void init_chips (struct fb_info *p,unsigned long addr) { -memset (p->screen_base,0 ,0x100000 ); +fb_memset (p->screen_base,0 ,0x100000 ); p->fix = chipsfb_fix; p->fix.smem_start = addr;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 150/251 serial: 8250_dw: Drop wrong use of ACPI_PTR()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit ebabb77a2a115b6c5e68f7364b598310b5f61fb2 ]
ACPI_PTR() is more harmful than helpful. For example, in this case if CONFIG_ACPI=n, the ID table left unused which is not what we want.
Instead of adding ifdeffery here and there, drop ACPI_PTR().
--- drivers/tty/serial/8250/8250_dw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_dw.c +1 -1
@@ -683,7 +683,7 @@ static struct platform_driver dw8250_platform_driver = { .name = "dw-apb-uart", .pm = &dw8250_pm_ops, .of_match_table = dw8250_of_match, - .acpi_match_table = ACPI_PTR(dw8250_acpi_match), + .acpi_match_table = dw8250_acpi_match, }, .probe = dw8250_probe, .remove = dw8250_remove,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 151/251 usb: gadget: hid: fix error code in do_config()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 68e7c510fdf4f6167404609da52e1979165649f6 ]
Return an error code if usb_get_function() fails. Don't return success.
--- drivers/usb/gadget/legacy/hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/legacy/hid.c +3 -1
@@ -103,8 +103,10 @@ static int do_config(struct usb_configuration *c)list_for_each_entry (e, &hidg_func_list, node) { e->f =usb_get_function (e->fi); -if (IS_ERR (e->f)) +if (IS_ERR (e->f)) { + status =PTR_ERR (e->f); goto put; + } status =usb_add_function (c, e->f);if (status <0 ) {usb_put_function (e->f);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 152/251 =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:=20Change=20voltage?= =?UTF-8?q?=20values=20to=20=C2=B5V?=
In reply to Greg Kroah-HartmanFrom: Jakob Hauser <[email protected]>
[ Upstream commit bf895295e9a73411889816f1a0c1f4f1a2d9c678 ]
Currently the rt5033_battery driver provides voltage values in mV. It should be µV as stated in Documentation/power/power_supply_class.rst.
--- drivers/power/supply/rt5033_battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/rt5033_battery.c +1 -1
@@ -63,7 +63,7 @@ static int rt5033_battery_get_watt_prop(struct i2c_client *client,regmap_read (battery->regmap, regh, &msb);regmap_read (battery->regmap, regl, &lsb); - ret = ((msb <<4 ) + (lsb >>4 )) *1250 /1000 ; + ret = ((msb <<4 ) + (lsb >>4 )) *1250 ;return ret; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 153/251 scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f4875d509a0a78ad294a1a538d534b5ba94e685a ]
This variable is just a temporary variable, used to do an endian conversion. The problem is that the last byte is not initialized. After the conversion is completely done, the last byte is discarded so it doesn't cause a problem. But static checkers and the KMSan runtime checker can detect the uninitialized read and will complain about it.
--- drivers/scsi/csiostor/csio_lnode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/csiostor/csio_lnode.c +1 -1
@@ -611,7 +611,7 @@ csio_ln_vnp_read_cbfn(struct csio_hw *hw, struct csio_mb *mbp)struct fc_els_csp *csp;struct fc_els_cssp *clsp;enum fw_retval retval; -__be32 nport_id; +__be32 nport_id =0 ; retval =FW_CMD_RETVAL_G (ntohl (rsp->alloc_to_len16));if (retval !=FW_SUCCESS ) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 154/251 RDMA/mlx4: Return missed an error if device doesnt support steering
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit f4e56ec4452f48b8292dcf0e1c4bdac83506fb8b ]
The error flow fixed in this patch is not possible because all kernel users of create QP interface check that device supports steering before set IB_QP_CREATE_NETIF_QP flag.
--- drivers/infiniband/hw/mlx4/qp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/qp.c +3 -1
@@ -1144,8 +1144,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,if (dev->steering_support ==MLX4_STEERING_MODE_DEVICE_MANAGED ) qp->flags |=MLX4_IB_QP_NETIF ; -else +else { + err = -EINVAL ; goto err; + } }memcpy (&backup_cap, &init_attr->cap,sizeof (backup_cap));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 155/251 ASoC: cs42l42: Correct some register default values
In reply to Greg Kroah-HartmanFrom: Richard Fitzgerald <[email protected]>
[ Upstream commit d591d4b32aa9552af14a0c7c586a2d3fe9ecc6e0 ]
Some registers had wrong default values in cs42l42_reg_defaults[].
--- sound/soc/codecs/cs42l42.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/cs42l42.c +2 -2
@@ -95,7 +95,7 @@ static const struct reg_default cs42l42_reg_defaults[] = { { CS42L42_ASP_RX_INT_MASK, 0x1F }, { CS42L42_ASP_TX_INT_MASK, 0x0F }, { CS42L42_CODEC_INT_MASK, 0x03 }, - { CS42L42_SRCPL_INT_MASK, 0xFF }, + { CS42L42_SRCPL_INT_MASK, 0x7F }, { CS42L42_VPMON_INT_MASK, 0x01 }, { CS42L42_PLL_LOCK_INT_MASK, 0x01 }, { CS42L42_TSRS_PLUG_INT_MASK, 0x0F },
@@ -132,7 +132,7 @@ static const struct reg_default cs42l42_reg_defaults[] = { { CS42L42_MIXER_CHA_VOL, 0x3F }, { CS42L42_MIXER_ADC_VOL, 0x3F }, { CS42L42_MIXER_CHB_VOL, 0x3F }, - { CS42L42_EQ_COEF_IN0, 0x22 }, + { CS42L42_EQ_COEF_IN0, 0x00 }, { CS42L42_EQ_COEF_IN1, 0x00 }, { CS42L42_EQ_COEF_IN2, 0x00 }, { CS42L42_EQ_COEF_IN3, 0x00 },
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 156/251 ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
In reply to Greg Kroah-HartmanFrom: Richard Fitzgerald <[email protected]>
[ Upstream commit 0306988789d9d91a18ff70bd2bf165d3ae0ef1dd ]
The driver can run without an interrupt so if devm_request_threaded_irq() failed, the probe() just carried on. But if this was EPROBE_DEFER the driver would continue without an interrupt instead of deferring to wait for the interrupt to become available.
--- sound/soc/codecs/cs42l42.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/cs42l42.c +3 -2
@@ -1805,8 +1805,9 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,NULL , cs42l42_irq_thread,IRQF_ONESHOT |IRQF_TRIGGER_LOW , "cs42l42", cs42l42); - -if (ret !=0 ) +if (ret == -EPROBE_DEFER ) + goto err_disable; +else if (ret !=0 )dev_err (&i2c_client->dev,"Failed to request IRQ: %d\n" , ret);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 157/251 serial: xilinx_uartps: Fix race condition causing stuck TX
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
[ Upstream commit 88b20f84f0fe47409342669caf3e58a3fc64c316 ]
xilinx_uartps .start_tx() clears TXEMPTY when enabling TXEMPTY to avoid any previous TXEVENT event asserting the UART interrupt. This clear operation is done immediately after filling the TX FIFO.
However, if the bytes inserted by cdns_uart_handle_tx() are consumed by the UART before the TXEMPTY is cleared, the clear operation eats the new TXEMPTY event as well, causing cdns_uart_isr() to never receive the TXEMPTY event. If there are bytes still queued in circbuf, TX will get stuck as they will never get transferred to FIFO (unless new bytes are queued to circbuf in which case .start_tx() is called again).
While the racy missed TXEMPTY occurs fairly often with short data sequences (e.g. write 1 byte), in those cases circbuf is usually empty so no action on TXEMPTY would have been needed anyway. On the other hand, longer data sequences make the race much more unlikely as UART takes longer to consume the TX FIFO. Therefore it is rare for this race to cause visible issues in general.
Fix the race by clearing the TXEMPTY bit in ISR *before* filling the FIFO.
The TXEMPTY bit in ISR will only get asserted at the exact moment the TX FIFO *becomes* empty, so clearing the bit before filling FIFO does not cause an extra immediate assertion even if the FIFO is initially empty.
This is hard to reproduce directly on a normal system, but inserting e.g. udelay(200) after cdns_uart_handle_tx(port), setting 4000000 baud, and then running "dd if=/dev/zero bs=128 of=/dev/ttyPS0 count=50" reliably reproduces the issue on my ZynqMP test system unless this fix is applied.
--- drivers/tty/serial/xilinx_uartps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/serial/xilinx_uartps.c +2 -1
@@ -595,9 +595,10 @@ static void cdns_uart_start_tx(struct uart_port *port)if (uart_circ_empty (&port->state->xmit))return ; +writel (CDNS_UART_IXR_TXEMPTY , port->membase +CDNS_UART_ISR ); +cdns_uart_handle_tx (port); -writel (CDNS_UART_IXR_TXEMPTY , port->membase +CDNS_UART_ISR );/* Enable the TX Empty interrupt */ writel (CDNS_UART_IXR_TXEMPTY , port->membase +CDNS_UART_IER ); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 158/251 mips: cm: Convert to bitfield API to fix out-of-bounds access
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 18b8f5b6fc53d097cadb94a93d8d6566ba88e389 ]
mips_cm_error_report() extracts the cause and other cause from the error register using shifts. This works fine for the former, as it is stored in the top bits, and the shift will thus remove all non-related bits. However, the latter is stored in the bottom bits, hence thus needs masking to get rid of non-related bits. Without such masking, using it as an index into the cm2_causes[] array will lead to an out-of-bounds access, probably causing a crash.
Fix this by using FIELD_GET() instead. Bite the bullet and convert all MIPS CM handling to the bitfield API, to improve readability and safety.
--- arch/mips/include/asm/mips-cm.h | 12 ++++++------ arch/mips/kernel/mips-cm.c | 21 ++++++++++----------- 2 files changed, 16 insertions(+), 17 deletions(-)
arch/mips/include/asm/mips-cm.h +6 -6
@@ -15,6 +15,7 @@#ifndef __MIPS_ASM_MIPS_CM_H__#define __MIPS_ASM_MIPS_CM_H__ +#include <linux/bitfield.h> #include <linux/bitops.h> #include <linux/errno.h>
@@ -157,8 +158,8 @@ GCR_ACCESSOR_RO(32, 0x030, rev)#define CM_GCR_REV_MINOR GENMASK(7, 0)#define CM_ENCODE_REV (major, minor) \ - (((major) << __ffs(CM_GCR_REV_MAJOR)) | \ - ((minor) << __ffs(CM_GCR_REV_MINOR))) + (FIELD_PREP(CM_GCR_REV_MAJOR, major) | \ + FIELD_PREP(CM_GCR_REV_MINOR, minor))#define CM_REV_CM2 CM_ENCODE_REV(6, 0)#define CM_REV_CM2_5 CM_ENCODE_REV(7, 0)
@@ -366,10 +367,10 @@ static inline int mips_cm_revision(void)static inline unsigned int mips_cm_max_vp_width (void ) {extern int smp_num_siblings; -uint32_t cfg;if (mips_cm_revision () >=CM_REV_CM3 ) -return read_gcr_sys_config2 () &CM_GCR_SYS_CONFIG2_MAXVPW ; +return FIELD_GET (CM_GCR_SYS_CONFIG2_MAXVPW , +read_gcr_sys_config2 ());if (mips_cm_present ()) {/*
@@ -377,8 +378,7 @@ static inline unsigned int mips_cm_max_vp_width(void)* number of VP(E)s, and if that ever changes then this will * need revisiting. */ - cfg =read_gcr_cl_config () & CM_GCR_Cx_CONFIG_PVPE; -return (cfg >>__ffs (CM_GCR_Cx_CONFIG_PVPE)) +1 ; +return FIELD_GET (CM_GCR_Cx_CONFIG_PVPE,read_gcr_cl_config ()) +1 ; }if (IS_ENABLED (CONFIG_SMP ))
arch/mips/kernel/mips-cm.c +10 -11
@@ -183,8 +183,7 @@ static void mips_cm_probe_l2sync(void)phys_addr_t addr;/* L2-only sync was introduced with CM major revision 6 */ - major_rev = (read_gcr_rev () &CM_GCR_REV_MAJOR ) >> -__ffs (CM_GCR_REV_MAJOR ); + major_rev =FIELD_GET (CM_GCR_REV_MAJOR ,read_gcr_rev ());if (major_rev <6 )return ;
@@ -267,13 +266,13 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,preempt_disable ();if (cm_rev >=CM_REV_CM3 ) { - val = core <<__ffs (CM3_GCR_Cx_OTHER_CORE); - val |= vp <<__ffs (CM3_GCR_Cx_OTHER_VP); + val =FIELD_PREP (CM3_GCR_Cx_OTHER_CORE, core) | +FIELD_PREP (CM3_GCR_Cx_OTHER_VP, vp);if (cm_rev >=CM_REV_CM3_5 ) { val |= CM_GCR_Cx_OTHER_CLUSTER_EN; - val |= cluster <<__ffs (CM_GCR_Cx_OTHER_CLUSTER); - val |= block <<__ffs (CM_GCR_Cx_OTHER_BLOCK); + val |=FIELD_PREP (CM_GCR_Cx_OTHER_CLUSTER, cluster); + val |=FIELD_PREP (CM_GCR_Cx_OTHER_BLOCK, block); }else {WARN_ON (cluster !=0 );WARN_ON (block != CM_GCR_Cx_OTHER_BLOCK_LOCAL);
@@ -303,7 +302,7 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,spin_lock_irqsave (&per_cpu (cm_core_lock, curr_core),per_cpu (cm_core_lock_flags, curr_core)); - val = core <<__ffs (CM_GCR_Cx_OTHER_CORENUM); + val =FIELD_PREP (CM_GCR_Cx_OTHER_CORENUM, core); }write_gcr_cl_other (val);
@@ -347,8 +346,8 @@ void mips_cm_error_report(void) cm_other =read_gcr_error_mult ();if (revision <CM_REV_CM3 ) {/* CM2 */ - cause = cm_error >>__ffs (CM_GCR_ERROR_CAUSE_ERRTYPE ); - ocause = cm_other >>__ffs (CM_GCR_ERROR_MULT_ERR2ND ); + cause =FIELD_GET (CM_GCR_ERROR_CAUSE_ERRTYPE , cm_error); + ocause =FIELD_GET (CM_GCR_ERROR_MULT_ERR2ND , cm_other);if (!cause)return ;
@@ -390,8 +389,8 @@ void mips_cm_error_report(void)ulong core_id_bits, vp_id_bits, cmd_bits, cmd_group_bits;ulong cm3_cca_bits, mcp_bits, cm3_tr_bits, sched_bit; - cause = cm_error >>__ffs64 (CM3_GCR_ERROR_CAUSE_ERRTYPE ); - ocause = cm_other >>__ffs (CM_GCR_ERROR_MULT_ERR2ND ); + cause =FIELD_GET (CM3_GCR_ERROR_CAUSE_ERRTYPE , cm_error); + ocause =FIELD_GET (CM_GCR_ERROR_MULT_ERR2ND , cm_other);if (!cause)return ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 159/251 power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit cdf10ffe8f626d8a2edc354abf063df0078b2d71 ]
When registering the IRQ handler fails, do not just return the error code, this will free the devm_kzalloc()-ed data struct while leaving the queued work queued and the registered power_supply registered with both of them now pointing to free-ed memory, resulting in various kernel crashes soon afterwards.
Instead properly tear-down things on IRQ handler register errors.
--- drivers/power/supply/bq27xxx_battery_i2c.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/bq27xxx_battery_i2c.c +2 -1
@@ -195,7 +195,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,dev_err (&client->dev,"Unable to register IRQ %d error %d\n" , client->irq, ret); -return ret; +bq27xxx_battery_teardown (di); + goto err_failed; } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 160/251 apparmor: fix error check
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit d108370c644b153382632b3e5511ade575c91c86 ]
clang static analysis reports this representative problem:
label.c:1463:16: warning: Assigned value is garbage or undefined
label->hname = name;
^ ~~~~In aa_update_label_name(), this the problem block of code
if (aa_label_acntsxprint(&name, ...) == -1) return res;
On failure, aa_label_acntsxprint() has a more complicated return that just -1. So check for a negative return.
It was also noted that the aa_label_acntsxprint() main comment refers to a nonexistent parameter, so clean up the comment.
--- security/apparmor/label.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/apparmor/label.c +2 -2
@@ -1431,7 +1431,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)if (label->hname ||labels_ns (label) != ns)return res; -if (aa_label_acntsxprint (&name, ns, label,FLAGS_NONE , gfp) ==-1 ) +if (aa_label_acntsxprint (&name, ns, label,FLAGS_NONE , gfp) <0 )return res; ls =labels_set (label);
@@ -1681,7 +1681,7 @@ int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,/** * aa_label_acntsxprint - allocate a __counted string buffer and print label -* @strp: buffer to write to. (MAY BE NULL if @size == 0) +* @strp: buffer to write to. * @ns: namespace profile is being viewed from * @label: label to view (NOT NULL) * @flags: flags controlling what label info is printed
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 161/251 rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
In reply to Greg Kroah-HartmanFrom: Arnaud Pouliquen <[email protected]>
[ Upstream commit 537d3af1bee8ad1415fda9b622d1ea6d1ae76dfa ]
According to the description of the rpmsg_create_ept in rpmsg_core.c the function should return NULL on error.
--- include/linux/rpmsg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/rpmsg.h +1 -1
@@ -202,7 +202,7 @@ static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev/* This shouldn't be possible */ WARN_ON (1 ); -return ERR_PTR (-ENXIO ); +return NULL ; }static inline int rpmsg_send (struct rpmsg_endpoint *ept,void *data,int len)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 162/251 pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
In reply to Greg Kroah-HartmanFrom: Baptiste Lepers <[email protected]>
[ Upstream commit a2915fa06227b056a8f9b0d79b61dca08ad5cfc6 ]
_nfs4_pnfs_v3/v4_ds_connect do
some work
smp_wmb
ds->ds_clp = clp;
And nfs4_ff_layout_prepare_ds currently does
smp_rmb
if(ds->ds_clp)
...
This patch places the smp_rmb after the if. This ensures that following reads only happen once nfs4_ff_layout_prepare_ds has checked that data has been properly initialized.
--- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 ++-- fs/nfs/pnfs_nfs.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
fs/nfs/flexfilelayout/flexfilelayoutdev.c +2 -2
@@ -428,10 +428,10 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx, goto out_fail; ds = mirror->mirror_ds->ds; +if (READ_ONCE (ds->ds_clp)) + goto out;/* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */ smp_rmb (); -if (ds->ds_clp) - goto out;/* FIXME: For now we assume the server sent only one version of NFS * to use for the DS.
fs/nfs/pnfs_nfs.c +2 -2
@@ -635,7 +635,7 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv, }smp_wmb (); - ds->ds_clp = clp; +WRITE_ONCE (ds->ds_clp, clp);dprintk ("%s [new] addr: %s\n" , __func__, ds->ds_remotestr); out:return status;
@@ -708,7 +708,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, }smp_wmb (); - ds->ds_clp = clp; +WRITE_ONCE (ds->ds_clp, clp);dprintk ("%s [new] addr: %s\n" , __func__, ds->ds_remotestr); out:return status;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 163/251 drm/plane-helper: fix uninitialized variable reference
In reply to Greg Kroah-HartmanFrom: Alex Xu (Hello71) <[email protected]>
[ Upstream commit 7be28bd73f23e53d6e7f5fe891ba9503fc0c7210 ]
drivers/gpu/drm/drm_plane_helper.c: In function 'drm_primary_helper_update':drivers/gpu/drm/drm_plane_helper.c:113:32: error: 'visible' is used uninitialized [-Werror=uninitialized]
113 | struct drm_plane_state plane_state = {
| ^~~~~~~~~~~
drivers/gpu/drm/drm_plane_helper.c:178:14: note: 'visible' was declared here
178 | bool visible;
| ^~~~~~~cc1: all warnings being treated as errors
visible is an output, not an input. in practice this use might turn out OK but it's still UB.
--- drivers/gpu/drm/drm_plane_helper.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/drm_plane_helper.c +0 -1
@@ -243,7 +243,6 @@ int drm_plane_helper_check_update(struct drm_plane *plane, .crtc_w = drm_rect_width(dst), .crtc_h = drm_rect_height(dst), .rotation = rotation, - .visible = *visible, };int ret;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 164/251 PCI: aardvark: Dont spam about PIO Response Status
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
[ Upstream commit 464de7e7fff767e87429cd7be09c4f2cb50a6ccb ]
Use dev_dbg() instead of dev_err() in advk_pcie_check_pio_status().
For example CRS is not an error status, it just says that the request should be retried.
--- drivers/pci/host/pci-aardvark.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/host/pci-aardvark.c +1 -1
@@ -448,7 +448,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)else str_posted ="Posted" ; -dev_err (dev,"%s PIO Response Status: %s, %#x @ %#x\n" , +dev_dbg (dev,"%s PIO Response Status: %s, %#x @ %#x\n" , str_posted, strcomp_status, reg,advk_readl (pcie,PIO_ADDR_LS ));return -EFAULT ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 165/251 NFS: Fix deadlocks in nfs_scan_commit_list()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 64a93dbf25d3a1368bb58ddf0f61d0a92d7479e3 ]
Partially revert commit 2ce209c42c01 ("NFS: Wait for requests that are locked on the commit list"), since it can lead to deadlocks between commit requests and nfs_join_page_group().
For now we should assume that any locked requests on the commit list are either about to be removed and committed by another task, or the writes they describe are about to be retransmitted. In either case, we should not need to worry.
--- fs/nfs/write.c | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-)
fs/nfs/write.c +2 -15
@@ -1037,25 +1037,11 @@ nfs_scan_commit_list(struct list_head *src, struct list_head *dst,struct nfs_page *req, *tmp;int ret =0 ; -restart:list_for_each_entry_safe (req, tmp, src, wb_list) {kref_get (&req->wb_kref);if (!nfs_lock_request (req)) { -int status; - -/* Prevent deadlock with nfs_lock_and_join_requests */ -if (!list_empty (dst)) { -nfs_release_request (req); -continue ; - } -/* Ensure we make progress to prevent livelock */ -mutex_unlock (&NFS_I (cinfo->inode)->commit_mutex); - status =nfs_wait_on_request (req);nfs_release_request (req); -mutex_lock (&NFS_I (cinfo->inode)->commit_mutex); -if (status <0 ) -break ; - goto restart; +continue ; }nfs_request_remove_commit_list (req, cinfo);clear_bit (PG_COMMIT_TO_DS , &req->wb_flags);
@@ -1904,6 +1890,7 @@ static int __nfs_commit_inode(struct inode *inode, int how,int may_wait = how &FLUSH_SYNC ;int ret, nscan; + how &= ~FLUSH_SYNC ;nfs_init_cinfo_from_inode (&cinfo, inode);nfs_commit_begin (cinfo.mds);for (;;) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 166/251 fs: orangefs: fix error return code of orangefs_revalidate_lookup()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 4c2b46c824a78fc8190d8eafaaea5a9078fe7479 ]
When op_alloc() returns NULL to new_op, no error return code of orangefs_revalidate_lookup() is assigned.
To fix this bug, ret is assigned with -ENOMEM in this case.
--- fs/orangefs/dcache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/orangefs/dcache.c +3 -1
@@ -26,8 +26,10 @@ static int orangefs_revalidate_lookup(struct dentry *dentry)gossip_debug (GOSSIP_DCACHE_DEBUG ,"%s: attempting lookup.\n" , __func__); new_op =op_alloc (ORANGEFS_VFS_OP_LOOKUP ); -if (!new_op) +if (!new_op) { + ret = -ENOMEM ; goto out_put_parent; + } new_op->upcall.req.lookup.sym_follow =ORANGEFS_LOOKUP_LINK_NO_FOLLOW ; new_op->upcall.req.lookup.parent_refn = parent->refn;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 167/251 mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 78e4d342187625585932bb437ec26e1060f7fc6f ]
hisi_spi_nor_probe() invokes clk_disable_unprepare() on all paths after successful call of clk_prepare_enable(). Besides, the clock is enabled by hispi_spi_nor_prep() and disabled by hispi_spi_nor_unprep(). So at remove time it is not possible to have the clock enabled. The patch removes excessive clk_disable_unprepare() from hisi_spi_nor_remove().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/mtd/spi-nor/hisi-sfc.c | 1 - 1 file changed, 1 deletion(-)
drivers/mtd/spi-nor/hisi-sfc.c +0 -1
@@ -485,7 +485,6 @@ static int hisi_spi_nor_remove(struct platform_device *pdev)hisi_spi_nor_unregister_all (host);mutex_destroy (&host->lock); -clk_disable_unprepare (host->clk);return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 168/251 dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 320c88a3104dc955f928a1eecebd551ff89530c0 ]
AT_XDMAC_CC_PERID() should be used to setup bits 24..30 of XDMAC_CC register. Using it without parenthesis around 0x7f & (i) will lead to setting all the time zero for bits 24..30 of XDMAC_CC as the << operator has higher precedence over bitwise &. Thus, add paranthesis around 0x7f & (i).
--- drivers/dma/at_xdmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/at_xdmac.c +1 -1
@@ -156,7 +156,7 @@#define AT_XDMAC_CC_WRIP (0x1 << 23)/* Write in Progress (read only) */ #define AT_XDMAC_CC_WRIP_DONE (0x0 << 23)#define AT_XDMAC_CC_WRIP_IN_PROGRESS (0x1 << 23) -#define AT_XDMAC_CC_PERID (i) (0x7f & (i) << 24)/* Channel Peripheral Identifier */ +#define AT_XDMAC_CC_PERID (i) ((0x7f & (i)) << 24)/* Channel Peripheral Identifier */ #define AT_XDMAC_CDS_MSP 0x2C/* Channel Data Stride Memory Set Pattern */ #define AT_XDMAC_CSUS 0x30/* Channel Source Microblock Stride */ #define AT_XDMAC_CDUS 0x34/* Channel Destination Microblock Stride */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 169/251 auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit afcb5a811ff3ab3969f09666535eb6018a160358 ]
While writing an empty string to a device attribute is a no-op, and thus does not need explicit safeguards, the user can still write a single newline to an attribute file:
echo > .../message
If that happens, img_ascii_lcd_display() trims the newline, yielding an empty string, and causing an infinite loop in img_ascii_lcd_scroll().
Fix this by adding a check for empty strings. Clear the display in case one is encountered.
--- drivers/auxdisplay/img-ascii-lcd.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/auxdisplay/img-ascii-lcd.c +10 -0
@@ -284,6 +284,16 @@ static int img_ascii_lcd_display(struct img_ascii_lcd_ctx *ctx,if (msg[count -1 ] =='\n' ) count--; +if (!count) { +/* clear the LCD */ +devm_kfree (&ctx->pdev->dev, ctx->message); + ctx->message =NULL ; + ctx->message_len =0 ; +memset (ctx->curr,' ' , ctx->cfg->num_chars); + ctx->cfg->update (ctx); +return 0 ; + } + new_msg =devm_kmalloc (&ctx->pdev->dev, count +1 ,GFP_KERNEL );if (!new_msg)return -ENOMEM ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 170/251 auxdisplay: ht16k33: Connect backlight to fbdev
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 80f9eb70fd9276938f0a131f76d438021bfd8b34 ]
Currently /sys/class/graphics/fb0/bl_curve is not accessible (-ENODEV), as the driver does not connect the backlight to the frame buffer device. Fix this moving backlight initialization up, and filling in fb_info.bl_dev.
--- drivers/auxdisplay/ht16k33.c | 56 ++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 28 deletions(-)
drivers/auxdisplay/ht16k33.c +28 -28
@@ -426,6 +426,33 @@ static int ht16k33_probe(struct i2c_client *client,if (err)return err; +/* Backlight */ +memset (&bl_props,0 ,sizeof (struct backlight_properties )); + bl_props.type =BACKLIGHT_RAW ; + bl_props.max_brightness =MAX_BRIGHTNESS ; + + bl =devm_backlight_device_register (&client->dev,DRIVER_NAME "-bl" , + &client->dev, priv, + &ht16k33_bl_ops, &bl_props); +if (IS_ERR (bl)) { +dev_err (&client->dev,"failed to register backlight\n" ); +return PTR_ERR (bl); + } + + err =of_property_read_u32 (node,"default-brightness-level" , + &dft_brightness); +if (err) { + dft_brightness =MAX_BRIGHTNESS ; + }else if (dft_brightness >MAX_BRIGHTNESS ) { +dev_warn (&client->dev, +"invalid default brightness level: %u, using %u\n" , + dft_brightness,MAX_BRIGHTNESS ); + dft_brightness =MAX_BRIGHTNESS ; + } + + bl->props.brightness = dft_brightness; +ht16k33_bl_update_status (bl); +/* Framebuffer (2 bytes per column) */ BUILD_BUG_ON (PAGE_SIZE <HT16K33_FB_SIZE ); fbdev->buffer = (unsigned char *)get_zeroed_page (GFP_KERNEL );
@@ -458,6 +485,7 @@ static int ht16k33_probe(struct i2c_client *client, fbdev->info->screen_size =HT16K33_FB_SIZE ; fbdev->info->fix = ht16k33_fb_fix; fbdev->info->var = ht16k33_fb_var; + fbdev->info->bl_dev = bl; fbdev->info->pseudo_palette =NULL ; fbdev->info->flags =FBINFO_FLAG_DEFAULT ; fbdev->info->par = priv;
@@ -470,34 +498,6 @@ static int ht16k33_probe(struct i2c_client *client,if (err) goto err_fbdev_unregister; -/* Backlight */ -memset (&bl_props,0 ,sizeof (struct backlight_properties )); - bl_props.type =BACKLIGHT_RAW ; - bl_props.max_brightness =MAX_BRIGHTNESS ; - - bl =devm_backlight_device_register (&client->dev,DRIVER_NAME "-bl" , - &client->dev, priv, - &ht16k33_bl_ops, &bl_props); -if (IS_ERR (bl)) { -dev_err (&client->dev,"failed to register backlight\n" ); - err =PTR_ERR (bl); - goto err_fbdev_unregister; - } - - err =of_property_read_u32 (node,"default-brightness-level" , - &dft_brightness); -if (err) { - dft_brightness =MAX_BRIGHTNESS ; - }else if (dft_brightness >MAX_BRIGHTNESS ) { -dev_warn (&client->dev, -"invalid default brightness level: %u, using %u\n" , - dft_brightness,MAX_BRIGHTNESS ); - dft_brightness =MAX_BRIGHTNESS ; - } - - bl->props.brightness = dft_brightness; -ht16k33_bl_update_status (bl); -ht16k33_fb_queue (priv);return 0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 171/251 auxdisplay: ht16k33: Fix frame buffer device blanking
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 840fe258332544aa7321921e1723d37b772af7a9 ]
As the ht16k33 frame buffer sub-driver does not register an fb_ops.fb_blank() handler, blanking does not work:
$ echo 1 > /sys/class/graphics/fb0/blank
sh: write error: Invalid argumentFix this by providing a handler that always returns zero, to make sure blank events will be sent to the actual device handling the backlight.
--- drivers/auxdisplay/ht16k33.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/auxdisplay/ht16k33.c +10 -0
@@ -227,6 +227,15 @@ static const struct backlight_ops ht16k33_bl_ops = { .check_fb = ht16k33_bl_check_fb, }; +/* +* Blank events will be passed to the actual device handling the backlight when +* we return zero here. +*/ +static int ht16k33_blank (int blank,struct fb_info *info) +{ +return 0 ; +} +static int ht16k33_mmap (struct fb_info *info,struct vm_area_struct *vma) {struct ht16k33_priv *priv = info->par;
@@ -239,6 +248,7 @@ static struct fb_ops ht16k33_fb_ops = { .owner = THIS_MODULE, .fb_read = fb_sys_read, .fb_write = fb_sys_write, + .fb_blank = ht16k33_blank, .fb_fillrect = sys_fillrect, .fb_copyarea = sys_copyarea, .fb_imageblit = sys_imageblit,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 172/251 netfilter: nfnetlink_queue: fix OOB when mac header was cleared
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 5648b5e1169ff1d6d6a46c35c0b5fbebd2a5cbb2 ]
On 64bit platforms the MAC header is set to 0xffff on allocation and also when a helper like skb_unset_mac_header() is called.
dev_parse_header may call skb_mac_header() which assumes valid mac offset:
BUG: KASAN: use-after-free in eth_header_parse+0x75/0x90 Read of size 6 at addr ffff8881075a5c05 by task nf-queue/1364 Call Trace: memcpy+0x20/0x60 eth_header_parse+0x75/0x90 __nfqnl_enqueue_packet+0x1a61/0x3380 __nf_queue+0x597/0x1300 nf_queue+0xf/0x40 nf_hook_slow+0xed/0x190 nf_hook+0x184/0x440 ip_output+0x1c0/0x2a0 nf_reinject+0x26f/0x700 nfqnl_recv_verdict+0xa16/0x18b0 nfnetlink_rcv_msg+0x506/0xe70
The existing code only works if the skb has a mac header.
--- net/netfilter/nfnetlink_queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nfnetlink_queue.c +1 -1
@@ -543,7 +543,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, goto nla_put_failure;if (indev && entskb->dev && - entskb->mac_header != entskb->network_header) { +skb_mac_header_was_set (entskb)) {struct nfqnl_msg_packet_hw phw;int len;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 173/251 dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
[ Upstream commit e7e1e880b114ca640a2f280b0d5d38aed98f98c6 ]
Before the callback_result callback was introduced drivers coded their invocation to the callback in a similar way to:
if (cb->callback) {
spin_unlock(&dma->lock);
cb->callback(cb->callback_param);
spin_lock(&dma->lock);
}With the introduction of callback_result two helpers where introduced to transparently handle both types of callbacks. And drivers where updated to look like this:
if (dmaengine_desc_callback_valid(cb)) {
spin_unlock(&dma->lock);
dmaengine_desc_callback_invoke(cb, ...);
spin_lock(&dma->lock);
}dmaengine_desc_callback_invoke() correctly handles both callback_result and callback. But we forgot to update the dmaengine_desc_callback_valid() function to check for callback_result. As a result DMA descriptors that use the callback_result rather than callback don't have their callback invoked by drivers that follow the pattern above.
Fix this by checking for both callback and callback_result in dmaengine_desc_callback_valid().
--- drivers/dma/dmaengine.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/dmaengine.h +1 -1
@@ -168,7 +168,7 @@ dmaengine_desc_get_callback_invoke(struct dma_async_tx_descriptor *tx,static inline bool dmaengine_desc_callback_valid (struct dmaengine_desc_callback *cb) { -return (cb->callback) ? true : false; +return cb->callback || cb->callback_result; }#endif
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 174/251 m68k: set a default value for MEMORY_RESERVE
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1aaa557b2db95c9506ed0981bc34505c32d6b62b ]
'make randconfig' can produce a .config file with "CONFIG_MEMORY_RESERVE=" (no value) since it has no default. When a subsequent 'make all' is done, kconfig restarts the config and prompts for a value for MEMORY_RESERVE. This breaks scripting/automation where there is no interactive user input.
Add a default value for MEMORY_RESERVE. (Any integer value will work here for kconfig.)
Fixes a kconfig warning:
.config:214:warning: symbol value '' invalid for MEMORY_RESERVE
* Restart config...
Memory reservation (MiB) (MEMORY_RESERVE) [] (NEW)
--- arch/m68k/Kconfig.machine | 1 + 1 file changed, 1 insertion(+)
arch/m68k/Kconfig.machine +1 -0
@@ -185,6 +185,7 @@ config INIT_LCD config MEMORY_RESERVE int "Memory reservation (MiB)" depends on (UCSIMM || UCDIMM) + default 0 help Reserve certain memory regions on 68x328 based boards.
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 175/251 watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
[ Upstream commit 164483c735190775f29d0dcbac0363adc51a068d ]
The fintek watchdog timer can configure timeouts of second granularity only up to 255 seconds. Beyond that, the timeout needs to be configured with minute granularity. WDIOC_GETTIMEOUT should report the actual timeout configured, not just echo back the timeout configured by the user. Do so.
--- drivers/watchdog/f71808e_wdt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/watchdog/f71808e_wdt.c +3 -1
@@ -237,15 +237,17 @@ static int watchdog_set_timeout(int timeout)mutex_lock (&watchdog.lock); - watchdog.timeout = timeout;if (timeout >0xff ) { watchdog.timer_val =DIV_ROUND_UP (timeout,60 ); watchdog.minutes_mode = true; + timeout = watchdog.timer_val *60 ; }else { watchdog.timer_val = timeout; watchdog.minutes_mode = false; } + watchdog.timeout = timeout; +mutex_unlock (&watchdog.lock);return 0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 176/251 ar7: fix kernel builds for compiler test
In reply to Greg Kroah-HartmanFrom: Jackie Liu <[email protected]>
[ Upstream commit 28b7ee33a2122569ac065cad578bf23f50cc65c3 ]
TI AR7 Watchdog Timer is only build for 32bit.
Avoid error like:
In file included from drivers/watchdog/ar7_wdt.c:29:./arch/mips/include/asm/mach-ar7/ar7.h: In function ‘ar7_is_titan’:./arch/mips/include/asm/mach-ar7/ar7.h:111:24: error: implicit declaration of function ‘KSEG1ADDR’; did you mean ‘CKSEG1ADDR’? [-Werror=implicit-function-declaration]
111 | return (readl((void *)KSEG1ADDR(AR7_REGS_GPIO + 0x24)) & 0xffff) ==
| ^~~~~~~~~
| CKSEG1ADDR--- drivers/watchdog/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/Kconfig +1 -1
@@ -1499,7 +1499,7 @@ config SIBYTE_WDOG config AR7_WDT tristate "TI AR7 Watchdog Timer" - depends on AR7 || (MIPS && COMPILE_TEST) + depends on AR7 || (MIPS && 32BIT && COMPILE_TEST) help Hardware driver for the TI AR7 Watchdog Timer.
Signature · 1 line
2.33.0