5.4.174-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.4.174-rc1 review
This is the start of the stable review cycle for the 5.4.174 release. There are 320 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Jan 2022 18:39:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.174-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.174-rc1
Masami Hiramatsu <[email protected]>
Revert "ia64: kprobes: Use generic kretprobe trampoline handler"
Doyle, Patrick <[email protected]>
mtd: nand: bbt: Fix corner case in bad block table handling
Andrey Konovalov <[email protected]>
lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
Miaoqian Lin <[email protected]>
lib82596: Fix IRQ check in sni_82596_probe
Matthias Schiffer <[email protected]>
scripts/dtc: dtx_diff: remove broken example from help text
Alexander Stein <[email protected]>
dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
Alexander Stein <[email protected]>
dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
Tom Rix <[email protected]>
net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
Sergey Shtylyov <[email protected]>
bcmgenet: add WOL IRQ check
Kevin Bracey <[email protected]>
net_sched: restore "mpu xxx" handling
David Heidelberg <[email protected]>
arm64: dts: qcom: msm8996: drop not documented adreno properties
Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Fix lld view setting
Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Fix concurrency over xfers_list
Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Print debug message after realeasing the lock
Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Don't start transactions at tx_submit level
Adrian Hunter <[email protected]>
perf script: Fix hex dump character output
Guillaume Nault <[email protected]>
libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
Guillaume Nault <[email protected]>
gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
Guillaume Nault <[email protected]>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
Eric Dumazet <[email protected]>
netns: add schedule point in ops_exit_list()
Eric Dumazet <[email protected]>
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
Laurence de Bruxelles <[email protected]>
rtc: pxa: fix null pointer dereference
Robert Hancock <[email protected]>
net: axienet: increase default TX ring size to 128
Robert Hancock <[email protected]>
net: axienet: fix number of TX ring slots for available check
Robert Hancock <[email protected]>
net: axienet: limit minimum TX ring size
Robert Hancock <[email protected]>
clk: si5341: Fix clock HW provider cleanup
Eric Dumazet <[email protected]>
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
Chao Yu <[email protected]>
f2fs: fix to reserve space for IO align feature
Miaoqian Lin <[email protected]>
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
Tobias Waldekranz <[email protected]>
net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
Eric Dumazet <[email protected]>
ipv4: avoid quadratic behavior in netns dismantle
Quentin Monnet <[email protected]>
bpftool: Remove inclusion of utilities.mak from Makefiles
Tobias Waldekranz <[email protected]>
powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
Anders Roxell <[email protected]>
powerpc/cell: Fix clang -Wimplicit-fallthrough warning
Moshe Shemesh <[email protected]>
Revert "net/mlx5: Add retry mechanism to the command entry index allocation"
Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK
Chengguang Xu <[email protected]>
RDMA/rxe: Fix a typo in opcode name
Yixing Liu <[email protected]>
RDMA/hns: Modify the mapping attribute of doorbell to device
Bart Van Assche <[email protected]>
scsi: core: Show SCMD_LAST in text form
Randy Dunlap <[email protected]>
Documentation: fix firewire.rst ABI file path error
Lukas Bulwahn <[email protected]>
Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
Sakari Ailus <[email protected]>
Documentation: ACPI: Fix data node reference documentation
Daniel Thompson <[email protected]>
Documentation: dmaengine: Correctly describe dmatest with channel unset
Suresh Udipi <[email protected]>
media: rcar-csi2: Optimize the selection PHTW register
Ben Hutchings <[email protected]>
firmware: Update Kconfig help text for Google firmware
Baruch Siach <[email protected]>
of: base: Improve argument length mismatch error
Christian König <[email protected]>
drm/radeon: fix error handling in radeon_driver_open_kms
Theodore Ts'o <[email protected]>
ext4: don't use the orphan list when migrating an inode
Ye Bin <[email protected]>
ext4: Fix BUG_ON in ext4_bread when write quota data
Luís Henriques <[email protected]>
ext4: set csum seed in tmp inode while migrating to extents
Jan Kara <[email protected]>
ext4: make sure quota gets properly shutdown on error
Jan Kara <[email protected]>
ext4: make sure to reset inode lockdep class when quota enabling fails
Filipe Manana <[email protected]>
btrfs: respect the max size in the header when activating swap file
Josef Bacik <[email protected]>
btrfs: check the root node for uptodate before returning it
Filipe Manana <[email protected]>
btrfs: fix deadlock between quota enable and other quota operations
Ghalem Boudour <[email protected]>
xfrm: fix policy lookup for ipv6 gre packets
Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device
Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Correctly set PCIe capabilities
Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space
Lukas Wunner <[email protected]>
PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
John David Anglin <[email protected]>
parisc: Fix lpa and lpa_user defines
Brian Norris <[email protected]>
drm/bridge: analogix_dp: Make PSR-exit block less
Ilia Mirkin <[email protected]>
drm/nouveau/kms/nv04: use vzalloc for nv04_display
Lucas Stach <[email protected]>
drm/etnaviv: limit submit sizes
Alexander Gordeev <[email protected]>
s390/mm: fix 2KB pgtable release race
Ilan Peer <[email protected]>
iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
Xiangyang Zhang <[email protected]>
tracing/kprobes: 'nmissed' not showed correctly for kretprobe
Andrey Ryabinin <[email protected]>
cputime, cpuacct: Include guest time in user time in cpuacct.stat
Lukas Wunner <[email protected]>
serial: Fix incorrect rs485 polarity on uart open
Xie Yongji <[email protected]>
fuse: Pass correct lend value to filemap_write_and_wait_range()
Petr Cvachoucek <[email protected]>
ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
Meng Li <[email protected]>
crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
Marek Vasut <[email protected]>
crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
Heiner Kallweit <[email protected]>
crypto: omap-aes - Fix broken pm_runtime_and_get() usage
Arnaud Pouliquen <[email protected]>
rpmsg: core: Clean up resources on announce_create failure.
Yauhen Kharuzhy <[email protected]>
power: bq25890: Enable continuous conversion for ADC at charging
Tzung-Bi Shih <[email protected]>
ASoC: mediatek: mt8173: fix device_node leak
Christoph Hellwig <[email protected]>
scsi: sr: Don't use GFP_DMA
Tianjia Zhang <[email protected]>
MIPS: Octeon: Fix build errors using clang
Lakshmi Sowjanya D <[email protected]>
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
Ye Guojin <[email protected]>
MIPS: OCTEON: add put_device() after of_find_device_by_node()
Hari Bathini <[email protected]>
powerpc: handle kdump appropriately with crash_kexec_post_notifiers option
Takashi Iwai <[email protected]>
ALSA: seq: Set upper limit of processed events
James Smart <[email protected]>
scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup
Christophe Leroy <[email protected]>
w1: Misuse of get_user()/put_user() reported by sparse
Alexey Kardashevskiy <[email protected]>
KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST
Christophe Leroy <[email protected]>
powerpc/powermac: Add missing lockdep_register_key()
Martin Blumenstingl <[email protected]>
clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB
Joakim Tjernlund <[email protected]>
i2c: mpc: Correct I2C reset procedure
Michael Ellerman <[email protected]>
powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
Heiner Kallweit <[email protected]>
i2c: i801: Don't silently correct invalid transfer size
Nicholas Piggin <[email protected]>
powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
Julia Lawall <[email protected]>
powerpc/btext: add missing of_node_put
Julia Lawall <[email protected]>
powerpc/cell: add missing of_node_put
Julia Lawall <[email protected]>
powerpc/powernv: add missing of_node_put
Julia Lawall <[email protected]>
powerpc/6xx: add missing of_node_put
John David Anglin <[email protected]>
parisc: Avoid calling faulthandler_disabled() twice
Jason A. Donenfeld <[email protected]>
random: do not throw away excess input to crng_fast_load
Lukas Wunner <[email protected]>
serial: core: Keep mctrl register state and cached copy in sync
Lukas Wunner <[email protected]>
serial: pl010: Drop CR register reset on set_termios
Konrad Dybcio <[email protected]>
regulator: qcom_smd: Align probe function with rpmh-regulator
Russell King (Oracle) <[email protected]>
net: gemini: allow any RGMII interface mode
Russell King (Oracle) <[email protected]>
net: phy: marvell: configure RGMII delays for 88E1118
Joe Thornber <[email protected]>
dm space map common: add bounds check to sm_ll_lookup_bitmap()
Joe Thornber <[email protected]>
dm btree: add a defensive bounds check to insert_at()
Ping-Ke Shih <[email protected]>
mac80211: allow non-standard VHT MCS-10/11
Florian Fainelli <[email protected]>
net: mdio: Demote probed message to debug print
Josef Bacik <[email protected]>
btrfs: remove BUG_ON(!eie) in find_parent_nodes
Josef Bacik <[email protected]>
btrfs: remove BUG_ON() in find_parent_nodes()
Thomas Weißschuh <[email protected]>
ACPI: battery: Add the ThinkPad "Not Charging" quirk
Zongmin Zhou <[email protected]>
drm/amdgpu: fixup bad vram size on gmc v8
Kirill A. Shutemov <[email protected]>
ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
Sudeep Holla <[email protected]>
ACPICA: Fix wrong interpretation of PCC address
Rafael J. Wysocki <[email protected]>
ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
Rafael J. Wysocki <[email protected]>
ACPICA: Utilities: Avoid deleting the same object twice in a row
Mark Langsdorf <[email protected]>
ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
Kyeong Yoo <[email protected]>
jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
Randy Dunlap <[email protected]>
um: registers: Rename function names to avoid conflicts and build problems
Ilan Peer <[email protected]>
iwlwifi: mvm: Fix calculation of frame length
Johannes Berg <[email protected]>
iwlwifi: remove module loading failure message
Johannes Berg <[email protected]>
iwlwifi: fix leaks/bad data after failed firmware load
Zekun Shen <[email protected]>
ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
Kai-Heng Feng <[email protected]>
usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
Rafael J. Wysocki <[email protected]>
cpufreq: Fix initialization of min and max frequency QoS requests
Thierry Reding <[email protected]>
arm64: tegra: Adjust length of CCPLEX cluster MMIO region
Biwen Li <[email protected]>
arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
Paul Moore <[email protected]>
audit: ensure userspace is penalized the same as the kernel when under pressure
Ulf Hansson <[email protected]>
mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
Zhou Qingyang <[email protected]>
media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
Sean Young <[email protected]>
media: igorplugusb: receiver overflow should be reported
Alistair Francis <[email protected]>
HID: quirks: Allow inverting the absolute X/Y values
Paolo Abeni <[email protected]>
bpf: Do not WARN in bpf_warn_invalid_xdp_action()
Suresh Kumar <[email protected]>
net: bonding: debug: avoid printing debug logs when bond is not notifying peers
Borislav Petkov <[email protected]>
x86/mce: Mark mce_read_aux() noinstr
Borislav Petkov <[email protected]>
x86/mce: Mark mce_end() noinstr
Borislav Petkov <[email protected]>
x86/mce: Mark mce_panic() noinstr
Iwona Winiarska <[email protected]>
gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
Russell King (Oracle) <[email protected]>
net: phy: prefer 1000baseT over 1000baseKX
Antoine Tenart <[email protected]>
net-sysfs: update the queue counts in the unregistration path
Sebastian Gottschall <[email protected]>
ath10k: Fix tx hanging
Johannes Berg <[email protected]>
iwlwifi: mvm: synchronize with FW after multicast commands
Mauro Carvalho Chehab <[email protected]>
media: m920x: don't use stack on USB reads
Zhou Qingyang <[email protected]>
media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
James Hilliard <[email protected]>
media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
Joerg Roedel <[email protected]>
x86/mm: Flush global TLB when switching to trampoline page-table
Xiongwei Song <[email protected]>
floppy: Add max size check for user space request
Neal Liu <[email protected]>
usb: uhci: add aspeed ast2600 uhci support
Zekun Shen <[email protected]>
rsi: Fix out-of-bounds read in rsi_read_pkt()
Zekun Shen <[email protected]>
rsi: Fix use-after-free in rsi_rx_done_handler()
Zekun Shen <[email protected]>
mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
Chengfeng Ye <[email protected]>
HSI: core: Fix return freed object in hsi_new_client
Hans de Goede <[email protected]>
gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
Martyn Welch <[email protected]>
drm/bridge: megachips: Ensure both bridges are probed before registration
Danielle Ratson <[email protected]>
mlxsw: pci: Add shutdown method in PCI driver
Lukas Bulwahn <[email protected]>
ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART
Dinh Nguyen <[email protected]>
EDAC/synopsys: Use the quirk for version instead of ddr version
Zheyu Ma <[email protected]>
media: b2c2: Add missing check in flexcop_pci_isr:
José Expósito <[email protected]>
HID: apple: Do not reset quirks when the Fn key is not found
Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
Pavankumar Kondeti <[email protected]>
usb: gadget: f_fs: Use stream_open() for endpoint files
Linus Lüssing <[email protected]>
batman-adv: allow netlink usage in unprivileged containers
Wan Jiabing <[email protected]>
ARM: shmobile: rcar-gen2: Add missing of_node_put()
Ben Skeggs <[email protected]>
drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
Zekun Shen <[email protected]>
ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
Qiang Yu <[email protected]>
drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
Andrii Nakryiko <[email protected]>
libbpf: Validate that .BTF and .BTF.ext sections contain data
Alexander Aring <[email protected]>
fs: dlm: filter user dlm messages for kernel locks
Wei Yongjun <[email protected]>
Bluetooth: Fix debugfs entry leak in hci_register_dev()
Baruch Siach <[email protected]>
of: base: Fix phandle argument length mismatch error message
Kamal Heib <[email protected]>
RDMA/cxgb4: Set queue pair state when being queried
Randy Dunlap <[email protected]>
mips: bcm63xx: add support for clk_set_parent()
Randy Dunlap <[email protected]>
mips: lantiq: add support for clk_set_parent()
Wei Yongjun <[email protected]>
misc: lattice-ecp3-config: Fix task hung when firmware load failed
Jiasheng Jiang <[email protected]>
ASoC: samsung: idma: Check of ioremap return value
Jiasheng Jiang <[email protected]>
ASoC: mediatek: Check for error clk pointer
Ryuta NAKANISHI <[email protected]>
phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
Xiongfeng Wang <[email protected]>
iommu/iova: Fix race between FQ timeout and teardown
Arnd Bergmann <[email protected]>
dmaengine: pxa/mmp: stop referencing config->slave_id
Dillon Min <[email protected]>
clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell
Jiasheng Jiang <[email protected]>
ASoC: rt5663: Handle device_property_read_u32_array error codes
Avihai Horon <[email protected]>
RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
Avihai Horon <[email protected]>
RDMA/core: Let ib_find_gid() continue search even after empty entry
Christophe Leroy <[email protected]>
powerpc/powermac: Add additional missing lockdep_register_key()
Thomas Gleixner <[email protected]>
PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
Bart Van Assche <[email protected]>
scsi: ufs: Fix race conditions related to driver data
Hector Martin <[email protected]>
iommu/io-pgtable-arm: Fix table descriptor paddr formatting
Jiasheng Jiang <[email protected]>
uio: uio_dmem_genirq: Catch the Exception
Todd Kjos <[email protected]>
binder: fix handling of error during copy
Kees Cook <[email protected]>
char/mwave: Adjust io port register size
Bixuan Cui <[email protected]>
ALSA: oss: fix compile error when OSS_DEBUG is enabled
Lukas Bulwahn <[email protected]>
ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
Peiwei Hu <[email protected]>
powerpc/prom_init: Fix improper check of prom_getprop()
Adam Ford <[email protected]>
clk: imx8mn: Fix imx8mn_clko1_sels
Kamal Heib <[email protected]>
RDMA/hns: Validate the pkey index
Takashi Iwai <[email protected]>
ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
Takashi Iwai <[email protected]>
ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
Takashi Iwai <[email protected]>
ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
Jan Kara <[email protected]>
ext4: avoid trim error on fs with small groups
Pavel Skripkin <[email protected]>
net: mcs7830: handle usb read errors properly
Dominik Brodowski <[email protected]>
pcmcia: fix setting of kthread task states
Jiasheng Jiang <[email protected]>
can: xilinx_can: xcan_probe(): check for error irq
Marc Kleine-Budde <[email protected]>
can: softing: softing_startstop(): fix set but not used variable warning
Chen Jun <[email protected]>
tpm: add request_locality before write TPM_INT_ENABLE
Miaoqian Lin <[email protected]>
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
Moshe Shemesh <[email protected]>
net/mlx5: Set command entry semaphore up once got index free
Aya Levin <[email protected]>
Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
Maor Dickman <[email protected]>
net/mlx5e: Don't block routes with nexthop objects in SW
Michal Suchanek <[email protected]>
debugfs: lockdown: Allow reading debugfs files that are not world readable
José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad
José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
Jiasheng Jiang <[email protected]>
Bluetooth: hci_bcm: Check for error irq
Jiasheng Jiang <[email protected]>
fsl/fman: Check for null pointer after calling devm_ioremap
Jiasheng Jiang <[email protected]>
staging: greybus: audio: Check null pointer
Dan Carpenter <[email protected]>
rocker: fix a sleeping in atomic bug
Eric Dumazet <[email protected]>
ppp: ensure minimum packet size in ppp_write()
Kuniyuki Iwashima <[email protected]>
bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
Xin Xiong <[email protected]>
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
Zhou Qingyang <[email protected]>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
Zhou Qingyang <[email protected]>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
Hans de Goede <[email protected]>
ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
Zhang Zixun <[email protected]>
x86/mce/inject: Avoid out-of-bounds write when setting flags
Paul Chaignon <[email protected]>
bpftool: Enable line buffering for stdout
Bernard Zhao <[email protected]>
selinux: fix potential memleak in selinux_add_opt()
Sergey Shtylyov <[email protected]>
mmc: meson-mx-sdio: add IRQ check
Marek Behún <[email protected]>
ARM: dts: armada-38x: Add generic compatible to UART nodes
Wei Yongjun <[email protected]>
usb: ftdi-elan: fix memory leak on device disconnect
Andre Przywara <[email protected]>
ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
Antony Antony <[email protected]>
xfrm: state and policy should fail if XFRMA_IF_ID 0
Antony Antony <[email protected]>
xfrm: interface with if_id 0 should return error
Jernej Skrabec <[email protected]>
media: hantro: Fix probe func error path
Stephen Boyd <[email protected]>
drm/bridge: ti-sn65dsi86: Set max register for regmap
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: fix safe status debugfs file
Jiasheng Jiang <[email protected]>
media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
Wang Hai <[email protected]>
media: msi001: fix possible null-ptr-deref in msi001_probe()
Anton Vasilyev <[email protected]>
media: dw2102: Fix use after free
Christian Lamparter <[email protected]>
ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix lrw chaining mode
Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix double pm exit
Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
Eric Dumazet <[email protected]>
xfrm: fix a small bug in xfrm_sa_len()
Brian Norris <[email protected]>
mwifiex: Fix possible ABBA deadlock
Frederic Weisbecker <[email protected]>
rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
Li Hua <[email protected]>
sched/rt: Try to restart rt period timer when rt runtime exceeded
Robert Schlabbach <[email protected]>
media: si2157: Fix "warm" tuner state detection
Zhou Qingyang <[email protected]>
media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
Zhou Qingyang <[email protected]>
media: dib8000: Fix a memleak in dib8000_init()
Sean Wang <[email protected]>
Bluetooth: btmtksdio: fix resume failure
Yang Yingliang <[email protected]>
staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
Yang Yingliang <[email protected]>
staging: rtl8192e: return error code from rtllib_softmac_init()
Tasos Sahanidis <[email protected]>
floppy: Fix hang in watchdog when disk is ejected
Lino Sanfilippo <[email protected]>
serial: amba-pl011: do not request memory region twice
Lizhi Hou <[email protected]>
tty: serial: uartlite: allow 64 bit address
Nishanth Menon <[email protected]>
arm64: dts: ti: k3-j721e: Fix the L2 cache sets
Zhou Qingyang <[email protected]>
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
Zhou Qingyang <[email protected]>
drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Rework flushing of EC work while suspended to idle
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8916: fix MMC controller aliases
Florian Westphal <[email protected]>
netfilter: bridge: add support for pppoe filtering
Christophe JAILLET <[email protected]>
media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'
Dafna Hirschfeld <[email protected]>
media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
Yang Yingliang <[email protected]>
media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
Fabio Estevam <[email protected]>
media: imx-pxp: Initialize the spinlock prior to using it
Suresh Udipi <[email protected]>
media: rcar-csi2: Correct the selection of hsfreqrange
Tudor Ambarus <[email protected]>
tty: serial: atmel: Call dma_async_issue_pending()
Tudor Ambarus <[email protected]>
tty: serial: atmel: Check return code of dmaengine_submit()
Peng Fan <[email protected]>
arm64: dts: ti: k3-j721e: correct cache-sets info
Chengfeng Ye <[email protected]>
crypto: qce - fix uaf on qce_ahash_register_one
Wang Hai <[email protected]>
media: dmxdev: fix UAF when dvb_register_device() fails
Jens Wiklander <[email protected]>
tee: fix put order in teedev_close_context()
Pavel Skripkin <[email protected]>
Bluetooth: stop proccessing malicious adv data
Christian Hewitt <[email protected]>
arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
Christian Hewitt <[email protected]>
arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
Jammy Huang <[email protected]>
media: aspeed: Update signal status immediately to ensure sane hw state
Dongliang Mu <[email protected]>
media: em28xx: fix memory leak in em28xx_init_dev
Jammy Huang <[email protected]>
media: aspeed: fix mode-detect always time out at 2nd run
Dillon Min <[email protected]>
media: videobuf2: Fix the size printk format
Bryan O'Donoghue <[email protected]>
wcn36xx: Release DMA channel descriptor allocations
Bryan O'Donoghue <[email protected]>
wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
Maxime Ripard <[email protected]>
clk: bcm-2835: Remove rounding up the dividers
Maxime Ripard <[email protected]>
clk: bcm-2835: Pick the closest clock rate
Wang Hai <[email protected]>
Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
Brian Norris <[email protected]>
drm/rockchip: dsi: Fix unbalanced clock on probe error
Brian Norris <[email protected]>
drm/panel: innolux-p079zca: Delete panel on attach() failure
Brian Norris <[email protected]>
drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
Brian Norris <[email protected]>
drm/rockchip: dsi: Reconfigure hardware on resume()
Brian Norris <[email protected]>
drm/rockchip: dsi: Hold pm-runtime across bind/unbind
Gang Li <[email protected]>
shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
Baoquan He <[email protected]>
mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
Baoquan He <[email protected]>
mm_zone: add function to check if managed dma zone exists
Yifeng Li <[email protected]>
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
Thomas Hellström <[email protected]>
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
Yunfei Wang <[email protected]>
iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
Christophe Leroy <[email protected]>
lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
Johan Hovold <[email protected]>
can: softing_cs: softingcs_probe(): fix memleak on registration failure
Johan Hovold <[email protected]>
media: stk1160: fix control-message timeouts
Johan Hovold <[email protected]>
media: pvrusb2: fix control-message timeouts
Johan Hovold <[email protected]>
media: redrat3: fix control-message timeouts
Michael Kuron <[email protected]>
media: dib0700: fix undefined behavior in tuner shutdown
Johan Hovold <[email protected]>
media: s2255: fix control-message timeouts
Johan Hovold <[email protected]>
media: cpia2: fix control-message timeouts
Johan Hovold <[email protected]>
media: em28xx: fix control-message timeouts
Johan Hovold <[email protected]>
media: mceusb: fix control-message timeouts
Johan Hovold <[email protected]>
media: flexcop-usb: fix control-message timeouts
Hans Verkuil <[email protected]>
media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
Mateusz Jończyk <[email protected]>
rtc: cmos: take rtc_lock while reading from CMOS
Willy Tarreau <[email protected]>
tools/nolibc: fix incorrect truncation of exit code
Willy Tarreau <[email protected]>
tools/nolibc: i386: fix initial stack alignment
Ammar Faizi <[email protected]>
tools/nolibc: x86-64: Fix startup code bug
Lucas De Marchi <[email protected]>
x86/gpu: Reserve stolen memory for first integrated Intel GPU
Stefan Riedmueller <[email protected]>
mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
Christian Eggers <[email protected]>
mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
Krzysztof Kozlowski <[email protected]>
nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
Chao Yu <[email protected]>
f2fs: fix to do sanity check in is_alive()
Jason Gerecke <[email protected]>
HID: wacom: Avoid using stale array indicies to read contact count
Jason Gerecke <[email protected]>
HID: wacom: Ignore the confidence flag when a touch is removed
Jason Gerecke <[email protected]>
HID: wacom: Reset expected and received contact counts at the same time
Jann Horn <[email protected]>
HID: uhid: Fix worker destroying device without any protection
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/spectre.rst | 2 +- .../bindings/display/amlogic,meson-dw-hdmi.yaml | 5 + .../bindings/display/amlogic,meson-vpu.yaml | 6 + Documentation/driver-api/dmaengine/dmatest.rst | 7 +- Documentation/driver-api/firewire.rst | 4 +- .../acpi/dsd/data-node-references.rst | 10 +- Makefile | 4 +- arch/arm/Kconfig.debug | 14 +- arch/arm/boot/compressed/efi-header.S | 22 +- arch/arm/boot/compressed/head.S | 3 +- arch/arm/boot/dts/armada-38x.dtsi | 4 +- arch/arm/boot/dts/gemini-nas4220b.dts | 2 +- arch/arm/include/debug/imx-uart.h | 18 +- arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c | 5 +- arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 3 + arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts | 14 +- arch/arm64/boot/dts/nvidia/tegra186.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 - arch/arm64/boot/dts/ti/k3-j721e.dtsi | 6 +- arch/ia64/kernel/kprobes.c | 78 ++++- arch/mips/bcm63xx/clk.c | 6 + arch/mips/cavium-octeon/octeon-platform.c | 2 + arch/mips/cavium-octeon/octeon-usb.c | 1 + arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 +- arch/mips/lantiq/clk.c | 6 + arch/parisc/include/asm/special_insns.h | 44 +-- arch/parisc/kernel/traps.c | 2 +- arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi | 2 + arch/powerpc/kernel/btext.c | 4 +- arch/powerpc/kernel/prom_init.c | 2 +- arch/powerpc/kernel/smp.c | 32 ++ arch/powerpc/kernel/watchdog.c | 41 ++- arch/powerpc/kvm/book3s_hv_nested.c | 2 +- arch/powerpc/platforms/cell/iommu.c | 1 + arch/powerpc/platforms/cell/pervasive.c | 1 + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 + arch/powerpc/platforms/powermac/low_i2c.c | 3 + arch/powerpc/platforms/powernv/opal-lpc.c | 1 + arch/s390/mm/pgalloc.c | 4 +- arch/um/include/shared/registers.h | 4 +- arch/um/os-Linux/registers.c | 4 +- arch/um/os-Linux/start_up.c | 2 +- arch/x86/include/asm/realmode.h | 1 + arch/x86/kernel/cpu/mce/core.c | 31 +- arch/x86/kernel/cpu/mce/inject.c | 2 +- arch/x86/kernel/early-quirks.c | 10 +- arch/x86/kernel/reboot.c | 12 +- arch/x86/realmode/init.c | 26 ++ arch/x86/um/syscalls_64.c | 3 +- drivers/acpi/acpica/exfield.c | 7 +- drivers/acpi/acpica/exoparg1.c | 3 +- drivers/acpi/acpica/hwesleep.c | 4 +- drivers/acpi/acpica/hwsleep.c | 4 +- drivers/acpi/acpica/hwxfsleep.c | 2 - drivers/acpi/acpica/utdelete.c | 1 + drivers/acpi/battery.c | 22 ++ drivers/acpi/ec.c | 57 +++- drivers/acpi/internal.h | 2 + drivers/acpi/scan.c | 13 +- drivers/android/binder.c | 4 +- drivers/block/floppy.c | 6 +- drivers/bluetooth/btmtksdio.c | 2 + drivers/bluetooth/hci_bcm.c | 7 +- drivers/char/mwave/3780i.h | 2 +- drivers/char/random.c | 19 +- drivers/char/tpm/tpm_tis_core.c | 8 + drivers/clk/bcm/clk-bcm2835.c | 13 +- drivers/clk/clk-si5341.c | 2 +- drivers/clk/clk-stm32f4.c | 4 - drivers/clk/imx/clk-imx8mn.c | 6 +- drivers/clk/meson/gxbb.c | 44 ++- drivers/cpufreq/cpufreq.c | 4 +- drivers/crypto/caam/caamalg_qi2.c | 2 +- drivers/crypto/omap-aes.c | 2 +- drivers/crypto/qce/sha.c | 2 +- drivers/crypto/stm32/stm32-crc32.c | 4 +- drivers/crypto/stm32/stm32-cryp.c | 6 +- drivers/dma-buf/dma-fence-array.c | 6 +- drivers/dma/at_xdmac.c | 49 +-- drivers/dma/mmp_pdma.c | 6 - drivers/dma/pxa_dma.c | 7 - drivers/dma/stm32-mdma.c | 2 +- drivers/edac/synopsys_edac.c | 3 +- drivers/firmware/google/Kconfig | 6 +- drivers/gpio/gpio-aspeed.c | 52 ++-- drivers/gpio/gpiolib-acpi.c | 15 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 + drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 +- drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 14 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 40 ++- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 1 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 6 + drivers/gpu/drm/lima/lima_device.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +- drivers/gpu/drm/nouveau/dispnv04/disp.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 ++- drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +- drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +- drivers/gpu/drm/radeon/radeon_kms.c | 42 +-- drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 80 +++-- drivers/hid/hid-apple.c | 2 +- drivers/hid/hid-input.c | 6 + drivers/hid/hid-uclogic-params.c | 31 +- drivers/hid/uhid.c | 29 +- drivers/hid/wacom_wac.c | 39 ++- drivers/hsi/hsi_core.c | 1 + drivers/i2c/busses/i2c-designware-pcidrv.c | 8 +- drivers/i2c/busses/i2c-i801.c | 15 +- drivers/i2c/busses/i2c-mpc.c | 23 +- drivers/infiniband/core/cma.c | 12 +- drivers/infiniband/core/device.c | 3 +- drivers/infiniband/hw/cxgb4/qp.c | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 5 +- drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +- drivers/iommu/io-pgtable-arm-v7s.c | 6 +- drivers/iommu/io-pgtable-arm.c | 9 +- drivers/iommu/iova.c | 3 +- drivers/md/persistent-data/dm-btree.c | 8 +- drivers/md/persistent-data/dm-space-map-common.c | 5 + drivers/media/common/saa7146/saa7146_fops.c | 2 +- .../media/common/videobuf2/videobuf2-dma-contig.c | 8 +- drivers/media/dvb-core/dmxdev.c | 18 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/pci/b2c2/flexcop-pci.c | 3 + drivers/media/pci/saa7146/hexium_gemini.c | 7 +- drivers/media/pci/saa7146/hexium_orion.c | 8 +- drivers/media/pci/saa7146/mxb.c | 8 +- drivers/media/platform/aspeed-video.c | 14 +- drivers/media/platform/coda/imx-vdoa.c | 6 +- drivers/media/platform/imx-pxp.c | 4 +- .../media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +- drivers/media/platform/qcom/venus/core.c | 8 +- drivers/media/platform/rcar-vin/rcar-csi2.c | 18 +- drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +- drivers/media/rc/igorplugusb.c | 4 +- drivers/media/rc/mceusb.c | 8 +- drivers/media/rc/redrat3.c | 22 +- drivers/media/tuners/msi001.c | 7 + drivers/media/tuners/si2157.c | 2 +- drivers/media/usb/b2c2/flexcop-usb.c | 10 +- drivers/media/usb/b2c2/flexcop-usb.h | 12 +- drivers/media/usb/cpia2/cpia2_usb.c | 4 +- drivers/media/usb/dvb-usb/dib0700_core.c | 2 - drivers/media/usb/dvb-usb/dw2102.c | 338 +++++++++++++-------- drivers/media/usb/dvb-usb/m920x.c | 12 +- drivers/media/usb/em28xx/em28xx-cards.c | 18 +- drivers/media/usb/em28xx/em28xx-core.c | 4 +- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 +- drivers/media/usb/s2255/s2255drv.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 4 +- drivers/media/usb/uvc/uvcvideo.h | 2 +- drivers/media/v4l2-core/v4l2-ioctl.c | 4 +- drivers/misc/lattice-ecp3-config.c | 12 +- drivers/misc/lkdtm/Makefile | 2 +- drivers/mmc/core/sdio.c | 4 +- drivers/mmc/host/meson-mx-sdio.c | 5 + drivers/mtd/nand/bbt.c | 2 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 37 ++- drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/softing/softing_cs.c | 2 +- drivers/net/can/softing/softing_fw.c | 11 +- drivers/net/can/xilinx_can.c | 7 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 +- drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 +- drivers/net/ethernet/cortina/gemini.c | 9 +- drivers/net/ethernet/freescale/fman/mac.c | 21 +- drivers/net/ethernet/freescale/xgmac_mdio.c | 3 +- drivers/net/ethernet/i825xx/sni_82596.c | 3 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 36 +-- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 6 +- drivers/net/ethernet/mellanox/mlxsw/pci.c | 1 + drivers/net/ethernet/rocker/rocker_ofdpa.c | 3 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 +- drivers/net/phy/marvell.c | 6 + drivers/net/phy/mdio_bus.c | 2 +- drivers/net/phy/phy-core.c | 2 +- drivers/net/ppp/ppp_generic.c | 7 +- drivers/net/usb/mcs7830.c | 12 +- drivers/net/wireless/ath/ar5523/ar5523.c | 4 + drivers/net/wireless/ath/ath10k/htt_tx.c | 3 + drivers/net/wireless/ath/ath10k/txrx.c | 2 - drivers/net/wireless/ath/ath9k/hif_usb.c | 7 + drivers/net/wireless/ath/wcn36xx/dxe.c | 5 + drivers/net/wireless/ath/wcn36xx/smd.c | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 17 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 ++ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 27 ++ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/sta_event.c | 8 +- drivers/net/wireless/marvell/mwifiex/usb.c | 3 +- drivers/net/wireless/rsi/rsi_91x_main.c | 4 + drivers/net/wireless/rsi/rsi_91x_usb.c | 9 +- drivers/net/wireless/rsi/rsi_usb.h | 2 + drivers/of/base.c | 11 +- drivers/parisc/pdc_stable.c | 4 +- drivers/pci/controller/pci-aardvark.c | 4 +- drivers/pci/controller/pci-mvebu.c | 8 + drivers/pci/hotplug/pciehp_hpc.c | 7 +- drivers/pci/msi.c | 26 +- drivers/pci/pci-bridge-emul.c | 27 +- drivers/pci/quirks.c | 3 + drivers/pcmcia/cs.c | 8 +- drivers/pcmcia/rsrc_nonstatic.c | 6 + drivers/phy/socionext/phy-uniphier-usb3ss.c | 10 +- drivers/power/supply/bq25890_charger.c | 4 +- drivers/regulator/qcom_smd-regulator.c | 100 ++++-- drivers/rpmsg/rpmsg_core.c | 20 +- drivers/rtc/rtc-cmos.c | 3 + drivers/rtc/rtc-pxa.c | 4 + drivers/scsi/lpfc/lpfc.h | 2 +- drivers/scsi/lpfc/lpfc_attr.c | 62 ++-- drivers/scsi/lpfc/lpfc_hbadisc.c | 8 +- drivers/scsi/lpfc/lpfc_sli.c | 6 - drivers/scsi/scsi_debugfs.c | 1 + drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 +- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 - drivers/scsi/ufs/ufshcd.c | 7 + drivers/soc/mediatek/mtk-scpsys.c | 15 +- drivers/spi/spi-meson-spifc.c | 1 + drivers/staging/greybus/audio_topology.c | 15 + drivers/staging/media/hantro/hantro_drv.c | 3 +- drivers/staging/rtl8192e/rtllib.h | 2 +- drivers/staging/rtl8192e/rtllib_module.c | 16 +- drivers/staging/rtl8192e/rtllib_softmac.c | 6 +- drivers/tee/tee_core.c | 4 +- drivers/tty/serial/amba-pl010.c | 3 - drivers/tty/serial/amba-pl011.c | 27 +- drivers/tty/serial/atmel_serial.c | 14 + drivers/tty/serial/serial_core.c | 7 +- drivers/tty/serial/uartlite.c | 2 +- drivers/uio/uio_dmem_genirq.c | 6 +- drivers/usb/core/hub.c | 5 +- drivers/usb/gadget/function/f_fs.c | 4 +- drivers/usb/host/uhci-platform.c | 3 +- drivers/usb/misc/ftdi-elan.c | 1 + drivers/w1/slaves/w1_ds28e04.c | 26 +- fs/btrfs/backref.c | 21 +- fs/btrfs/ctree.c | 19 +- fs/btrfs/inode.c | 11 + fs/btrfs/qgroup.c | 19 ++ fs/debugfs/file.c | 2 +- fs/dlm/lock.c | 9 + fs/ext4/ioctl.c | 2 - fs/ext4/mballoc.c | 8 + fs/ext4/migrate.c | 23 +- fs/ext4/super.c | 25 +- fs/f2fs/f2fs.h | 11 + fs/f2fs/gc.c | 3 + fs/f2fs/segment.h | 3 +- fs/f2fs/super.c | 44 +++ fs/f2fs/sysfs.c | 4 +- fs/fuse/file.c | 2 +- fs/jffs2/file.c | 40 ++- fs/ubifs/super.c | 1 - include/acpi/actypes.h | 10 +- include/linux/hid.h | 2 + include/linux/mmzone.h | 9 + include/net/inet_frag.h | 11 +- include/net/ipv6_frag.h | 3 +- include/net/sch_generic.h | 5 + kernel/audit.c | 18 +- kernel/rcu/tree_exp.h | 1 + kernel/sched/cputime.c | 4 +- kernel/sched/rt.c | 23 +- kernel/trace/trace_kprobe.c | 5 +- lib/test_meminit.c | 1 + mm/page_alloc.c | 19 +- mm/shmem.c | 37 ++- net/batman-adv/netlink.c | 30 +- net/bluetooth/cmtp/core.c | 4 +- net/bluetooth/hci_core.c | 1 + net/bluetooth/hci_event.c | 8 +- net/bridge/br_netfilter_hooks.c | 7 +- net/core/filter.c | 8 +- net/core/net-sysfs.c | 3 + net/core/net_namespace.c | 4 +- net/ipv4/fib_semantics.c | 36 ++- net/ipv4/inet_fragment.c | 8 +- net/ipv4/ip_fragment.c | 3 +- net/ipv4/ip_gre.c | 5 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +- net/ipv6/ip6_gre.c | 5 +- net/mac80211/rx.c | 2 +- net/nfc/llcp_sock.c | 5 + net/sched/sch_generic.c | 1 + net/unix/garbage.c | 14 +- net/unix/scm.c | 6 +- net/xfrm/xfrm_interface.c | 14 +- net/xfrm/xfrm_policy.c | 24 +- net/xfrm/xfrm_user.c | 23 +- scripts/dtc/dtx_diff | 8 +- security/selinux/hooks.c | 12 +- sound/core/jack.c | 3 + sound/core/oss/pcm_oss.c | 2 +- sound/core/pcm.c | 6 +- sound/core/seq/seq_queue.c | 14 +- sound/pci/hda/hda_codec.c | 3 + sound/soc/codecs/rt5663.c | 12 +- sound/soc/mediatek/mt8173/mt8173-max98090.c | 3 + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 + sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 + sound/soc/samsung/idma.c | 2 + sound/soc/uniphier/Kconfig | 2 - tools/bpf/bpftool/Documentation/Makefile | 1 - tools/bpf/bpftool/Makefile | 1 - tools/bpf/bpftool/main.c | 2 + tools/include/nolibc/nolibc.h | 33 +- tools/lib/bpf/libbpf.c | 4 + tools/perf/util/debug.c | 2 +- 316 files changed, 2448 insertions(+), 1053 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/320 HID: uhid: Fix worker destroying device without any protection
From: Jann Horn <[email protected]>
commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream.
uhid has to run hid_add_device() from workqueue context while allowing parallel use of the userspace API (which is protected with ->devlock). But hid_add_device() can fail. Currently, that is handled by immediately destroying the associated HID device, without using ->devlock - but if there are concurrent requests from userspace, that's wrong and leads to NULL dereferences and/or memory corruption (via use-after-free).
Fix it by leaving the HID device as-is in the worker. We can clean it up later, either in the UHID_DESTROY command handler or in the ->release() handler.
--- drivers/hid/uhid.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
drivers/hid/uhid.c +25 -4
@@ -28,11 +28,22 @@struct uhid_device {struct mutex devlock; + +/* This flag tracks whether the HID device is usable for commands from +* userspace. The flag is already set before hid_add_device(), which +* runs in workqueue context, to allow hid_add_device() to communicate +* with userspace. +* However, if hid_add_device() fails, the flag is cleared without +* holding devlock. +* We guarantee that if @running changes from true to false while you're +* holding @devlock, it's still fine to access @hid. +*/ bool running;__u8 *rd_data;uint rd_size; +/* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */ struct hid_device *hid;struct uhid_event input_buf;
@@ -63,9 +74,18 @@ static void uhid_device_add_worker(strucif (ret) {hid_err (uhid->hid,"Cannot register HID device: error %d\n" , ret); -hid_destroy_device (uhid->hid); - uhid->hid =NULL ; +/* We used to call hid_destroy_device() here, but that's really +* messy to get right because we have to coordinate with +* concurrent writes from userspace that might be in the middle +* of using uhid->hid. +* Just leave uhid->hid as-is for now, and clean it up when +* userspace tries to close or reinitialize the uhid instance. +* +* However, we do have to clear the ->running flag and do a +* wakeup to make sure userspace knows that the device is gone. +*/ uhid->running = false; +wake_up_interruptible (&uhid->report_wait); } }
@@ -474,7 +494,7 @@ static int uhid_dev_create2(struct uhid_void *rd_data;int ret; -if (uhid->running) +if (uhid->hid)return -EALREADY ; rd_size = ev->u.create2.rd_size;
@@ -556,7 +576,7 @@ static int uhid_dev_create(struct uhid_dstatic int uhid_dev_destroy (struct uhid_device *uhid) { -if (!uhid->running) +if (!uhid->hid)return -EINVAL ; uhid->running = false;
@@ -565,6 +585,7 @@ static int uhid_dev_destroy(struct uhid_cancel_work_sync (&uhid->worker);hid_destroy_device (uhid->hid); + uhid->hid =NULL ;kfree (uhid->rd_data);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 2/320 HID: wacom: Reset expected and received contact counts at the same time
In reply to Greg Kroah-HartmanFrom: Jason Gerecke <[email protected]>
commit 546e41ac994cc185ef3de610ca849a294b5df3ba upstream.
These two values go hand-in-hand and must be valid for the driver to behave correctly. We are currently lazy about updating the values and rely on the "expected" code flow to take care of making sure they're valid at the point they're needed. The "expected" flow changed somewhat with commit f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report"), however. This led to problems with the DTH-2452 due (in part) to *all* contacts being fully processed -- even those past the expected contact count. Specifically, the received count gets reset to 0 once all expected fingers are processed, but not the expected count. The rest of the contacts in the report are then *also* processed since now the driver thinks we've only processed 0 of N expected contacts.
Later commits such as 7fb0413baa7f (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts) worked around the DTH-2452 issue by skipping the invalid contacts at the end of the report, but this is not a complete fix. The confidence flag cannot be relied on when a contact is removed (see the following patch), and dealing with that condition re-introduces the DTH-2452 issue unless we also address this contact count laziness. By resetting expected and received counts at the same time we ensure the driver understands that there are 0 more contacts expected in the report. Similarly, we also make sure to reset the received count if for some reason we're out of sync in the pre-report phase.
--- drivers/hid/wacom_wac.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hid/wacom_wac.c +5 -1
@@ -2664,11 +2664,14 @@ static void wacom_wac_finger_pre_report( hid_data->cc_index >= 0) {struct hid_field *field = report->field[hid_data->cc_index];int value = field->value[hid_data->cc_value_index]; - if (value) +if (value) { hid_data->num_expected = value; + hid_data->num_received =0 ; + } } else { hid_data->num_expected = wacom_wac->features.touch_max; + hid_data->num_received =0 ; } }
@@ -2692,6 +2695,7 @@ static void wacom_wac_finger_report(struinput_sync (input); wacom_wac->hid_data.num_received =0 ; + wacom_wac->hid_data.num_expected =0 ;/* keep touch state for pen event */ wacom_wac->shared->touch_down =wacom_wac_finger_count_touches (wacom_wac);
Greg Kroah-Hartman
maintainerPATCH 3/320 HID: wacom: Ignore the confidence flag when a touch is removed
In reply to Greg Kroah-HartmanFrom: Jason Gerecke <[email protected]>
commit df03e9bd6d4806619b4cdc91a3d7695818a8e2b7 upstream.
AES hardware may internally re-classify a contact that it thought was intentional as a palm. Intentional contacts are reported as "down" with the confidence bit set. When this re-classification occurs, however, the state transitions to "up" with the confidence bit cleared. This kind of transition appears to be legal according to Microsoft docs, but we do not handle it correctly. Because the confidence bit is clear, we don't call wacom_wac_finger_slot and update userspace. This causes hung touches that confuse userspace and interfere with pen arbitration.
This commit adds a special case to ignore the confidence flag if a contact is reported as removed. This ensures we do not leave a hung touch if one of these re-classification events occured. Ideally we'd have some way to also let userspace know that the touch has been re-classified as a palm and needs to be canceled, but that's not possible right now :)
--- drivers/hid/wacom_wac.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
drivers/hid/wacom_wac.c +26 -3
@@ -2566,6 +2566,24 @@ static void wacom_wac_finger_slot(struct } } +static bool wacom_wac_slot_is_active (struct input_dev *dev,int key) +{ +struct input_mt *mt = dev->mt; +struct input_mt_slot *s; + +if (!mt) +return false; + +for (s = mt->slots; s != mt->slots + mt->num_slots; s++) { +if (s->key == key && +input_mt_get_value (s,ABS_MT_TRACKING_ID ) >=0 ) { +return true; + } + } + +return false; +} +static void wacom_wac_finger_event (struct hid_device *hdev,struct hid_field *field,struct hid_usage *usage,__s32 value) {
@@ -2613,9 +2631,14 @@ static void wacom_wac_finger_event(struc }if (usage->usage_index +1 == field->report_count) { -if (equivalent_usage == wacom_wac->hid_data.last_slot_field && - wacom_wac->hid_data.confidence) -wacom_wac_finger_slot (wacom_wac, wacom_wac->touch_input); +if (equivalent_usage == wacom_wac->hid_data.last_slot_field) { +bool touch_removed =wacom_wac_slot_is_active (wacom_wac->touch_input, + wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch; + +if (wacom_wac->hid_data.confidence || touch_removed) { +wacom_wac_finger_slot (wacom_wac, wacom_wac->touch_input); + } + } } }
Greg Kroah-Hartman
maintainerPATCH 4/320 HID: wacom: Avoid using stale array indicies to read contact count
In reply to Greg Kroah-HartmanFrom: Jason Gerecke <[email protected]>
commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream.
If we ever see a touch report with contact count data we initialize several variables used to read the contact count in the pre-report phase. These variables are never reset if we process a report which doesn't contain a contact count, however. This can cause the pre- report function to trigger a read of arbitrary memory (e.g. NULL if we're lucky) and potentially crash the driver.
This commit restores resetting of the variables back to default "none" values that were used prior to the commit mentioned below.
--- drivers/hid/wacom_wac.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hid/wacom_wac.c +4 -0
@@ -2654,6 +2654,10 @@ static void wacom_wac_finger_pre_report( hid_data->confidence = true; + hid_data->cc_report =0 ; + hid_data->cc_index =-1 ; + hid_data->cc_value_index =-1 ; +for (i =0 ; i < report->maxfield; i++) {struct hid_field *field = report->field[i];int j;
Greg Kroah-Hartman
maintainerPATCH 5/320 f2fs: fix to do sanity check in is_alive()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit 77900c45ee5cd5da63bd4d818a41dbdf367e81cd upstream.
In fuzzed image, SSA table may indicate that a data block belongs to invalid node, which node ID is out-of-range (0, 1, 2 or max_nid), in order to avoid migrating inconsistent data in such corrupted image, let's do sanity check anyway before data block migration.
--- fs/f2fs/gc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/f2fs/gc.c +3 -0
@@ -633,6 +633,9 @@ static bool is_alive(struct f2fs_sb_infoset_sbi_flag (sbi,SBI_NEED_FSCK ); } +if (f2fs_check_nid_range (sbi, dni->ino)) +return false; + *nofs =ofs_of_node (node_page); source_blkaddr =datablock_addr (NULL , node_page, ofs_in_node);f2fs_put_page (node_page,1 );
Greg Kroah-Hartman
maintainerPATCH 6/320 nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit dded08927ca3c31a5c37f8e7f95fe98770475dd4 upstream.
Syzbot detected a NULL pointer dereference of nfc_llcp_sock->dev pointer (which is a 'struct nfc_dev *') with calls to llcp_sock_sendmsg() after a failed llcp_sock_bind(). The message being sent is a SOCK_DGRAM.
KASAN report:
BUG: KASAN: null-ptr-deref in nfc_alloc_send_skb+0x2d/0xc0 Read of size 4 at addr 00000000000005c8 by task llcp_sock_nfc_a/899 CPU: 5 PID: 899 Comm: llcp_sock_nfc_a Not tainted 5.16.0-rc6-next-20211224-00001-gc6437fbf18b0 #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x45/0x59 ? nfc_alloc_send_skb+0x2d/0xc0 __kasan_report.cold+0x117/0x11c ? mark_lock+0x480/0x4f0 ? nfc_alloc_send_skb+0x2d/0xc0 kasan_report+0x38/0x50 nfc_alloc_send_skb+0x2d/0xc0 nfc_llcp_send_ui_frame+0x18c/0x2a0 ? nfc_llcp_send_i_frame+0x230/0x230 ? __local_bh_enable_ip+0x86/0xe0 ? llcp_sock_connect+0x470/0x470 ? llcp_sock_connect+0x470/0x470 sock_sendmsg+0x8e/0xa0 ____sys_sendmsg+0x253/0x3f0 ...
The issue was visible only with multiple simultaneous calls to bind() and sendmsg(), which resulted in most of the bind() calls to fail. The bind() was failing on checking if there is available WKS/SDP/SAP (respective bit in 'struct nfc_llcp_local' fields). When there was no available WKS/SDP/SAP, the bind returned error but the sendmsg() to such socket was able to trigger mentioned NULL pointer dereference of nfc_llcp_sock->dev.
The code looks simply racy and currently it protects several paths against race with checks for (!nfc_llcp_sock->local) which is NULL-ified in error paths of bind(). The llcp_sock_sendmsg() did not have such check but called function nfc_llcp_send_ui_frame() had, although not protected with lock_sock().
Therefore the race could look like (same socket is used all the time):
CPU0 CPU1
==== ====
llcp_sock_bind()
- lock_sock()
- success
- release_sock()
- return 0
llcp_sock_sendmsg()
- lock_sock()
- release_sock()
llcp_sock_bind(), same socket
- lock_sock()
- error
- nfc_llcp_send_ui_frame()
- if (!llcp_sock->local)
- llcp_sock->local = NULL
- nfc_put_device(dev)
- dereference llcp_sock->dev
- release_sock()
- return -ERRNO
The nfc_llcp_send_ui_frame() checked llcp_sock->local outside of the lock, which is racy and ineffective check. Instead, its caller llcp_sock_sendmsg(), should perform the check inside lock_sock().
--- net/nfc/llcp_sock.c | 5 +++++ 1 file changed, 5 insertions(+)
net/nfc/llcp_sock.c +5 -0
@@ -789,6 +789,11 @@ static int llcp_sock_sendmsg(struct socklock_sock (sk); +if (!llcp_sock->local) { +release_sock (sk); +return -ENODEV ; + } +if (sk->sk_type ==SOCK_DGRAM ) { DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, msg->msg_name);
Greg Kroah-Hartman
maintainerPATCH 7/320 mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
In reply to Greg Kroah-HartmanFrom: Christian Eggers <[email protected]>
commit f53d4c109a666bf1a4883b45d546fba079258717 upstream.
gpmi_io clock needs to be gated off when changing the parent/dividers of enfc_clk_root (i.MX6Q/i.MX6UL) respectively qspi2_clk_root (i.MX6SX). Otherwise this rate change can lead to an unresponsive GPMI core which results in DMA timeouts and failed driver probe:
[ 4.072318] gpmi-nand 112000.gpmi-nand: DMA timeout, last DMA ... [ 4.370355] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -110 ... [ 4.375988] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22 [ 4.381524] gpmi-nand 112000.gpmi-nand: Error in ECC-based read: -22 [ 4.387988] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22 [ 4.393535] gpmi-nand 112000.gpmi-nand: Chip: 0, Error -22
...
Other than stated in i.MX 6 erratum ERR007117, it should be sufficient to gate only gpmi_io because all other bch/nand clocks are derived from different clock roots.
The i.MX6 reference manuals state that changing clock muxers can cause glitches but are silent about changing dividers. But tests showed that these glitches can definitely happen on i.MX6ULL. For i.MX7D/8MM in turn, the manual guarantees that no glitches can happen when changing dividers.
--- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-)
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +25 -3
@@ -710,14 +710,32 @@ static void gpmi_nfc_compute_timings(str (use_half_period ?BM_GPMI_CTRL1_HALF_PERIOD :0 ); } -static void gpmi_nfc_apply_timings (struct gpmi_nand_data *this) +static int gpmi_nfc_apply_timings (struct gpmi_nand_data *this) {struct gpmi_nfc_hardware_timing *hw = &this->hw;struct resources *r = &this->resources;void __iomem *gpmi_regs = r->gpmi_regs;unsigned int dll_wait_time_us; +int ret; + +/* Clock dividers do NOT guarantee a clean clock signal on its output +* during the change of the divide factor on i.MX6Q/UL/SX. On i.MX7/8, +* all clock dividers provide these guarantee. +*/ +if (GPMI_IS_MX6Q (this) ||GPMI_IS_MX6SX (this)) +clk_disable_unprepare (r->clock[0 ]); + + ret =clk_set_rate (r->clock[0 ], hw->clk_rate); +if (ret) { +dev_err (this->dev,"cannot set clock rate to %lu Hz: %d\n" , hw->clk_rate, ret); +return ret; + } -clk_set_rate (r->clock[0 ], hw->clk_rate); +if (GPMI_IS_MX6Q (this) ||GPMI_IS_MX6SX (this)) { + ret =clk_prepare_enable (r->clock[0 ]); +if (ret) +return ret; + }writel (hw->timing0, gpmi_regs +HW_GPMI_TIMING0 );writel (hw->timing1, gpmi_regs +HW_GPMI_TIMING1 );
@@ -736,6 +754,8 @@ static void gpmi_nfc_apply_timings(struc/* Wait for the DLL to settle. */ udelay (dll_wait_time_us); + +return 0 ; } static int gpmi_setup_data_interface(struct nand_chip *chip, int chipnr,
@@ -2429,7 +2449,9 @@ static int gpmi_nfc_exec_op(struct nand_*/ if (this->hw.must_apply_timings) { this->hw.must_apply_timings = false; -gpmi_nfc_apply_timings (this); + ret =gpmi_nfc_apply_timings (this); +if (ret) +return ret; }dev_dbg (this->dev,"%s: %d instructions\n" , __func__, op->ninstrs);
Re: [PATCH 5.4 007/320] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
Hi!
Quoted 6 lines
commit
f53d4c109a666bf1a4883b45d546fba079258717upstream.
gpmi_ioclock needs to be gated off when changing the parent/dividers ofenfc_clk_root(i.MX6Q/i.MX6UL) respectivelyqspi2_clk_root(i.MX6SX). Otherwise this rate change can lead to an unresponsive GPMI core which results in DMA timeouts and failed driver probe:
...
Review static int gpmi_nfc_exec_op(struct nand_ · line 2457
Quoted 12 lines
(quoted diff) +3
-1@@ -2429,7 +2449,9 @@ static int gpmi_nfc_exec_op(struct nand_ */ if (this->hw.must_apply_timings) { this->hw.must_apply_timings = false; - gpmi_nfc_apply_timings(this); + ret = gpmi_nfc_apply_timings(this); + if (ret) + return ret; } dev_dbg(this->dev, "%s: %d instructions\n", __func__, op->ninstrs);
AFAICT this leaks pm reference in the error case. Not sure what variant is right, there, so...
Best regards,
Pavel
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +3 -1
@@ -2284,8 +2284,10 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,if (this->hw.must_apply_timings) { this->hw.must_apply_timings = false; ret =gpmi_nfc_apply_timings (this); -if (ret) +if (ret) { + pm_runtime_put_....(this->dev);return ret; + } }dev_dbg (this->dev,"%s: %d instructions\n" , __func__, op->ninstrs);
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: [PATCH 5.4 007/320] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings
Hi Pavel,
Quoted 20 lines · Pavel Machek
Hi!
Quoted 6 lines
commit
f53d4c109a666bf1a4883b45d546fba079258717upstream.
gpmi_ioclock needs to be gated off when changing the parent/dividers ofenfc_clk_root(i.MX6Q/i.MX6UL) respectivelyqspi2_clk_root(i.MX6SX). Otherwise this rate change can lead to an unresponsive GPMI core which results in DMA timeouts and failed driver probe:...
Quoted 10 lines
(quoted diff) +3
-1@@ -2429,7 +2449,9 @@ static int gpmi_nfc_exec_op(struct nand_ */ if (this->hw.must_apply_timings) { this->hw.must_apply_timings = false; - gpmi_nfc_apply_timings(this); + ret = gpmi_nfc_apply_timings(this); + if (ret) + return ret; }
Quoted 5 lines
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c static int gpmi_nfc_exec_op(struct nand_chip *chip, · line 2293
Quoted 2 lines
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +0
-0dev_dbg (this->dev,"%s: %d instructions\n" , __func__, op->ninstrs);AFAICT this leaks pm reference in the error case. Not sure what variant is right, there, so...
You're right, thanks for pointing this out. I think that the error path currently should not appear in practice, but I plan to add further patches in future where this could happen then.
Although there's a potential new error, I think that this patch should improve the situation.
Quoted 10 lines
Best regards,
Paveldrivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +0
-0@@ -2284,8 +2284,10 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,if (this->hw.must_apply_timings) {
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c static int gpmi_nfc_exec_op(struct nand_chip *chip, · line 2293
Quoted 10 lines
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +3
-1this->hw.must_apply_timings = false; ret =gpmi_nfc_apply_timings (this); -if (ret) +if (ret) { + pm_runtime_put_....(this->dev);return ret; + } }dev_dbg (this->dev,"%s: %d instructions\n" , __func__, op->ninstrs);
I'll prepare and send a new patch tomorrow.
regards
Christian
Greg Kroah-Hartman
maintainerPATCH 8/320 mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6
In reply to Greg Kroah-HartmanFrom: Stefan Riedmueller <[email protected]>
commit aa1baa0e6c1aa4872e481dce4fc7fd6f3dd8496b upstream.
There is no need to explicitly set the default gpmi clock rate during boot for the i.MX 6 since this is done during nand_detect anyway.
--- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +0 -9
@@ -1204,15 +1204,6 @@ static int gpmi_get_clks(struct gpmi_nan r->clock[i] = clk; } -if (GPMI_IS_MX6 (this)) -/* -* Set the default value for the gpmi clock. -* -* If you want to use the ONFI nand which is in the -* Synchronous Mode, you should change the clock as you need. -*/ -clk_set_rate (r->clock[0 ],22000000 ); -return 0 ; err_clock:
Greg Kroah-Hartman
maintainerPATCH 9/320 x86/gpu: Reserve stolen memory for first integrated Intel GPU
In reply to Greg Kroah-HartmanFrom: Lucas De Marchi <[email protected]>
commit 9c494ca4d3a535f9ca11ad6af1813983c1c6cbdd upstream.
"Stolen memory" is memory set aside for use by an Intel integrated GPU. The intel_graphics_quirks() early quirk reserves this memory when it is called for a GPU that appears in the intel_early_ids[] table of integrated GPUs.
Previously intel_graphics_quirks() was marked as QFLAG_APPLY_ONCE, so it was called only for the first Intel GPU found. If a discrete GPU happened to be enumerated first, intel_graphics_quirks() was called for it but not for any integrated GPU found later. Therefore, stolen memory for such an integrated GPU was never reserved.
For example, this problem occurs in this Alderlake-P (integrated) + DG2 (discrete) topology where the DG2 is found first, but stolen memory is associated with the integrated GPU:
- 00:01.0 Bridge
`- 03:00.0 DG2 discrete GPU
- 00:02.0 Integrated GPU (with stolen memory)
Remove the QFLAG_APPLY_ONCE flag and call intel_graphics_quirks() for every Intel GPU. Reserve stolen memory for the first GPU that appears in intel_early_ids[].
[bhelgaas: commit log, add code comment, squash in
https://lore.kernel.org/r/20220118190558.2ququ4vdfjuahicm@ldmartin-desk2]
--- arch/x86/kernel/early-quirks.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/x86/kernel/early-quirks.c +9 -1
@@ -515,6 +515,7 @@ static const struct intel_early_ops gen1 .stolen_size = gen9_stolen_size, }; +/* Intel integrated GPUs for which we need to reserve "stolen memory" */ static const struct pci_device_id intel_early_ids[]__initconst = {INTEL_I830_IDS (&i830_early_ops),INTEL_I845G_IDS (&i845_early_ops),
@@ -587,6 +588,13 @@ static void __init intel_graphics_quirksu16 device;int i; +/* +* Reserve "stolen memory" for an integrated GPU. If we've already +* found one, there's nothing to do for other (discrete) GPUs. +*/ +if (resource_size (&intel_graphics_stolen_res)) +return ; + device =read_pci_config_16 (num, slot, func,PCI_DEVICE_ID );for (i =0 ; i <ARRAY_SIZE (intel_early_ids); i++) {
@@ -699,7 +707,7 @@ static struct chipset early_qrk[] __init {PCI_VENDOR_ID_INTEL ,0x3406 ,PCI_CLASS_BRIDGE_HOST , PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check }, { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID, - QFLAG_APPLY_ONCE, intel_graphics_quirks }, + 0, intel_graphics_quirks },/* * HPET on the current version of the Baytrail platform has accuracy * problems: it will halt in deep idle state - so we disable it.
Greg Kroah-Hartman
maintainerPATCH 10/320 tools/nolibc: x86-64: Fix startup code bug
In reply to Greg Kroah-HartmanFrom: Ammar Faizi <[email protected]>
commit 937ed91c712273131de6d2a02caafd3ee84e0c72 upstream.
Before this patch, the _start function looks like this:
```
0000000000001170 <_start>:
1170: pop %rdi
1171: mov %rsp,%rsi
1174: lea 0x8(%rsi,%rdi,8),%rdx
1179: and $0xfffffffffffffff0,%rsp
117d: sub $0x8,%rsp
1181: call 1000 <main>
1186: movzbq %al,%rdi
118a: mov $0x3c,%rax
1191: syscall
1193: hlt
1194: data16 cs nopw 0x0(%rax,%rax,1)
119f: nop
```Note the "and" to %rsp with $-16, it makes the %rsp be 16-byte aligned, but then there is a "sub" with $0x8 which makes the %rsp no longer 16-byte aligned, then it calls main. That's the bug!
What actually the x86-64 System V ABI mandates is that right before the "call", the %rsp must be 16-byte aligned, not after the "call". So the "sub" with $0x8 here breaks the alignment. Remove it.
An example where this rule matters is when the callee needs to align its stack at 16-byte for aligned move instruction, like movdqa and movaps. If the callee can't align its stack properly, it will result in segmentation fault.
x86-64 System V ABI also mandates the deepest stack frame should be zero. Just to be safe, let's zero the %rbp on startup as the content of %rbp may be unspecified when the program starts. Now it looks like this:
```
0000000000001170 <_start>:
1170: pop %rdi
1171: mov %rsp,%rsi
1174: lea 0x8(%rsi,%rdi,8),%rdx
1179: xor %ebp,%ebp # zero the %rbp
117b: and $0xfffffffffffffff0,%rsp # align the %rsp
117f: call 1000 <main>
1184: movzbq %al,%rdi
1188: mov $0x3c,%rax
118f: syscall
1191: hlt
1192: data16 cs nopw 0x0(%rax,%rax,1)
119d: nopl (%rax)
```[wt: I did this on purpose due to a misunderstanding of the spec, other
archs will thus have to be rechecked, particularly i386]
--- tools/include/nolibc/nolibc.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
tools/include/nolibc/nolibc.h +8 -2
@@ -422,14 +422,20 @@ struct stat { })/* startup code */ +/* +* x86-64 System V ABI mandates: +* 1) %rsp must be 16-byte aligned right before the function call. +* 2) The deepest stack frame should be zero (the %rbp). +* +*/ asm(".section .text\n" ".global _start\n" "_start:\n" "pop %rdi\n" // argc (first arg, %rdi) "mov %rsp, %rsi\n" // argv[] (second arg, %rsi) "lea 8(%rsi,%rdi,8),%rdx\n" // then a NULL then envp (third arg, %rdx) -"and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned when -"sub $8, %rsp\n" // entering the callee +"xor %ebp, %ebp\n" // zero the stack frame +"and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned before call "call main\n" // main() returns the status code, we'll exit with it. "movzb %al, %rdi\n" // retrieve exit code from 8 lower bits "mov $60, %rax\n" // NR_exit == 60
Greg Kroah-Hartman
maintainerPATCH 11/320 tools/nolibc: i386: fix initial stack alignment
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
commit ebbe0d8a449d183fa43b42d84fcb248e25303985 upstream.
After re-checking in the spec and comparing stack offsets with glibc, The last pushed argument must be 16-byte aligned (i.e. aligned before the call) so that in the callee esp+4 is multiple of 16, so the principle is the 32-bit equivalent to what Ammar fixed for x86_64. It's possible that 32-bit code using SSE2 or MMX could have been affected. In addition the frame pointer ought to be zero at the deepest level.
--- tools/include/nolibc/nolibc.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
tools/include/nolibc/nolibc.h +9 -1
@@ -606,13 +606,21 @@ struct sys_stat_struct { })/* startup code */ +/* +* i386 System V ABI mandates: +* 1) last pushed argument must be 16-byte aligned. +* 2) The deepest stack frame should be set to zero +* +*/ asm(".section .text\n" ".global _start\n" "_start:\n" "pop %eax\n" // argc (first arg, %eax) "mov %esp, %ebx\n" // argv[] (second arg, %ebx) "lea 4(%ebx,%eax,4),%ecx\n" // then a NULL then envp (third arg, %ecx) -"and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned when +"xor %ebp, %ebp\n" // zero the stack frame +"and $-16, %esp\n" // x86 ABI : esp must be 16-byte aligned before +"sub $4, %esp\n" // the call instruction (args are aligned) "push %ecx\n" // push all registers on the stack so that we "push %ebx\n" // support both regparm and plain stack modes "push %eax\n"
Greg Kroah-Hartman
maintainerPATCH 12/320 tools/nolibc: fix incorrect truncation of exit code
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
commit de0244ae40ae91145faaf164a4252347607c3711 upstream.
Ammar Faizi reported that our exit code handling is wrong. We truncate it to the lowest 8 bits but the syscall itself is expected to take a regular 32-bit signed integer, not an unsigned char. It's the kernel that later truncates it to the lowest 8 bits. The difference is visible in strace, where the program below used to show exit(255) instead of exit(-1):
int main(void)
{
return -1;
}This patch applies the fix to all archs. x86_64, i386, arm64, armv7 and mips were all tested and confirmed to work fine now. Risc-v was not tested but the change is trivial and exactly the same as for other archs.
--- tools/include/nolibc/nolibc.h | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
tools/include/nolibc/nolibc.h +5 -8
@@ -437,7 +437,7 @@ asm(".section .text\n""xor %ebp, %ebp\n" // zero the stack frame "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned before call "call main\n" // main() returns the status code, we'll exit with it. -"movzb %al, %rdi\n" // retrieve exit code from 8 lower bits +"mov %eax, %edi\n" // retrieve exit code (32 bit) "mov $60, %rax\n" // NR_exit == 60 "syscall\n" // really exit "hlt\n" // ensure it does not return
@@ -625,9 +625,9 @@ asm(".section .text\n""push %ebx\n" // support both regparm and plain stack modes "push %eax\n" "call main\n" // main() returns the status code in %eax -"movzbl %al, %ebx\n" // retrieve exit code from lower 8 bits -"movl $1, %eax\n" // NR_exit == 1 -"int $0x80\n" // exit now +"mov %eax, %ebx\n" // retrieve exit code (32-bit int) +"movl $1, %eax\n" // NR_exit == 1 +"int $0x80\n" // exit now "hlt\n" // ensure it does not "");
@@ -811,7 +811,6 @@ asm(".section .text\n""and %r3, %r1, $-8\n" // AAPCS : sp must be 8-byte aligned in the "mov %sp, %r3\n" // callee, an bl doesn't push (lr=pc) "bl main\n" // main() returns the status code, we'll exit with it. -"and %r0, %r0, $0xff\n" // limit exit code to 8 bits "movs r7, $1\n" // NR_exit == 1 "svc $0x00\n" "");
@@ -1008,7 +1007,6 @@ asm(".section .text\n""add x2, x2, x1\n" // + argv "and sp, x1, -16\n" // sp must be 16-byte aligned in the callee "bl main\n" // main() returns the status code, we'll exit with it. -"and x0, x0, 0xff\n" // limit exit code to 8 bits "mov x8, 93\n" // NR_exit == 93 "svc #0\n" "");
@@ -1213,7 +1211,7 @@ asm(".section .text\n""addiu $sp,$sp,-16\n" // the callee expects to save a0..a3 there! "jal main\n" // main() returns the status code, we'll exit with it. "nop\n" // delayed slot -"and $a0, $v0, 0xff\n" // limit exit code to 8 bits +"move $a0, $v0\n" // retrieve 32-bit exit code from v0 "li $v0, 4001\n" // NR_exit == 4001 "syscall\n" ".end __start\n"
@@ -1411,7 +1409,6 @@ asm(".section .text\n""add a2,a2,a1\n" // + argv "andi sp,a1,-16\n" // sp must be 16-byte aligned "call main\n" // main() returns the status code, we'll exit with it. -"andi a0, a0, 0xff\n" // limit exit code to 8 bits "li a7, 93\n" // NR_exit == 93 "ecall\n" "");
Greg Kroah-Hartman
maintainerPATCH 13/320 rtc: cmos: take rtc_lock while reading from CMOS
In reply to Greg Kroah-HartmanFrom: Mateusz Jończyk <[email protected]>
commit 454f47ff464325223129b9b5b8d0b61946ec704d upstream.
Reading from the CMOS involves writing to the index register and then reading from the data register. Therefore access to the CMOS has to be serialized with rtc_lock. This invocation of CMOS_READ was not serialized, which could cause trouble when other code is accessing CMOS at the same time.
Use spin_lock_irq() like the rest of the function.
Nothing in kernel modifies the RTC_DM_BINARY bit, so there could be a separate pair of spin_lock_irq() / spin_unlock_irq() before doing the math.
--- drivers/rtc/rtc-cmos.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/rtc/rtc-cmos.c +3 -0
@@ -463,7 +463,10 @@ static int cmos_set_alarm(struct device min = t->time.tm_min; sec = t->time.tm_sec; +spin_lock_irq (&rtc_lock); rtc_control =CMOS_READ (RTC_CONTROL ); +spin_unlock_irq (&rtc_lock); +if (!(rtc_control &RTC_DM_BINARY ) ||RTC_ALWAYS_BCD ) {/* Writing 0xff means "don't care" or "match all". */ mon = (mon <=12 ) ?bin2bcd (mon) :0xff ;
Greg Kroah-Hartman
maintainerPATCH 14/320 media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
commit cd9d9377ed235b294a492a094e1666178a5e78fd upstream.
If V4L2_CAP_READWRITE is not set, then readbuffers must be set to 0, otherwise v4l2-compliance will complain.
A note on the Fixes tag below: this patch does not really fix that commit, but it can be applied from that commit onwards. For older code there is no guarantee that device_caps is set, so even though this patch would apply, it will not work reliably.
--- drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/v4l2-core/v4l2-ioctl.c +3 -1
@@ -2046,6 +2046,7 @@ static int v4l_prepare_buf(const structstatic int v4l_g_parm (const struct v4l2_ioctl_ops *ops,struct file *file,void *fh,void *arg) { +struct video_device *vfd =video_devdata (file);struct v4l2_streamparm *p = arg;v4l2_std_id std;int ret =check_fmt (file, p->type);
@@ -2057,7 +2058,8 @@ static int v4l_g_parm(const struct v4l2_if (p->type !=V4L2_BUF_TYPE_VIDEO_CAPTURE && p->type !=V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE )return -EINVAL ; - p->parm.capture.readbuffers =2 ; +if (vfd->device_caps &V4L2_CAP_READWRITE ) + p->parm.capture.readbuffers =2 ; ret = ops->vidioc_g_std (file, fh, &std);if (ret ==0 )v4l2_video_std_frame_period (std, &p->parm.capture.timeperframe);
Greg Kroah-Hartman
maintainerPATCH 15/320 media: flexcop-usb: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit cd1798a387825cc4a51282f5a611ad05bb1ad75f upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
Note that the driver was multiplying some of the timeout values with HZ twice resulting in 3000-second timeouts with HZ=1000.
Also note that two of the timeout defines are currently unused.
--- drivers/media/usb/b2c2/flexcop-usb.c | 10 +++++----- drivers/media/usb/b2c2/flexcop-usb.h | 12 ++++++------ 2 files changed, 11 insertions(+), 11 deletions(-)
drivers/media/usb/b2c2/flexcop-usb.c +5 -5
@@ -87,7 +87,7 @@ static int flexcop_usb_readwrite_dw(stru0 , fc_usb->data,sizeof (u32), - B2C2_WAIT_FOR_OPERATION_RDW * HZ); + B2C2_WAIT_FOR_OPERATION_RDW);if (ret !=sizeof (u32)) { err("error while %s dword from %d (%d).", read ? "reading" :
@@ -155,7 +155,7 @@ static int flexcop_usb_v8_memory_req(str wIndex, fc_usb->data, buflen, - nWaitTime * HZ); + nWaitTime);if (ret != buflen) ret = -EIO ;
@@ -249,13 +249,13 @@ static int flexcop_usb_i2c_req(struct fl/* DKT 020208 - add this to support special case of DiSEqC */ case USB_FUNC_I2C_CHECKWRITE : pipe =B2C2_USB_CTRL_PIPE_OUT ; - nWaitTime =2 ; + nWaitTime =2000 ; request_type |=USB_DIR_OUT ;break ;case USB_FUNC_I2C_READ :case USB_FUNC_I2C_REPEATREAD : pipe =B2C2_USB_CTRL_PIPE_IN ; - nWaitTime =2 ; + nWaitTime =2000 ; request_type |=USB_DIR_IN ;break ;default :
@@ -282,7 +282,7 @@ static int flexcop_usb_i2c_req(struct fl wIndex, fc_usb->data, buflen, - nWaitTime * HZ); + nWaitTime);if (ret != buflen) ret = -EIO ;
drivers/media/usb/b2c2/flexcop-usb.h +6 -6
@@ -91,13 +91,13 @@ typedef enum {UTILITY_SRAM_TESTVERIFY =0x16 , } flexcop_usb_utility_function_t; -#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ) -#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ) +#define B2C2_WAIT_FOR_OPERATION_RW 1000 +#define B2C2_WAIT_FOR_OPERATION_RDW 3000 +#define B2C2_WAIT_FOR_OPERATION_WDW 1000 -#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ) +#define B2C2_WAIT_FOR_OPERATION_V8READ 3000 +#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000 +#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000 typedef enum { V8_MEMORY_PAGE_DVB_CI = 0x20,
Greg Kroah-Hartman
maintainerPATCH 16/320 media: mceusb: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 16394e998cbb050730536bdf7e89f5a70efbd974 upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/media/rc/mceusb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/rc/mceusb.c +4 -4
@@ -1430,7 +1430,7 @@ static void mceusb_gen1_init(struct mceu*/ ret =usb_control_msg (ir->usbdev,usb_rcvctrlpipe (ir->usbdev,0 ),USB_REQ_SET_ADDRESS ,USB_TYPE_VENDOR ,0 ,0 , - data,USB_CTRL_MSG_SZ ,HZ *3 ); + data,USB_CTRL_MSG_SZ ,3000 );dev_dbg (dev,"set address - ret = %d" , ret);dev_dbg (dev,"set address - data[0] = %d, data[1] = %d" , data[0 ], data[1 ]);
@@ -1438,20 +1438,20 @@ static void mceusb_gen1_init(struct mceu/* set feature: bit rate 38400 bps */ ret =usb_control_msg (ir->usbdev,usb_sndctrlpipe (ir->usbdev,0 ),USB_REQ_SET_FEATURE ,USB_TYPE_VENDOR , -0xc04e ,0x0000 ,NULL ,0 ,HZ *3 ); +0xc04e ,0x0000 ,NULL ,0 ,3000 );dev_dbg (dev,"set feature - ret = %d" , ret);/* bRequest 4: set char length to 8 bits */ ret =usb_control_msg (ir->usbdev,usb_sndctrlpipe (ir->usbdev,0 ),4 ,USB_TYPE_VENDOR , -0x0808 ,0x0000 ,NULL ,0 ,HZ *3 ); +0x0808 ,0x0000 ,NULL ,0 ,3000 );dev_dbg (dev,"set char length - retB = %d" , ret);/* bRequest 2: set handshaking to use DTR/DSR */ ret =usb_control_msg (ir->usbdev,usb_sndctrlpipe (ir->usbdev,0 ),2 ,USB_TYPE_VENDOR , -0x0000 ,0x0100 ,NULL ,0 ,HZ *3 ); +0x0000 ,0x0100 ,NULL ,0 ,3000 );dev_dbg (dev,"set handshake - retC = %d" , ret);/* device resume */
Greg Kroah-Hartman
maintainerPATCH 17/320 media: em28xx: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/media/usb/em28xx/em28xx-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/usb/em28xx/em28xx-core.c +2 -2
@@ -89,7 +89,7 @@ int em28xx_read_reg_req_len(struct em28xmutex_lock (&dev->ctrl_urb_lock); ret =usb_control_msg (udev, pipe, req,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , -0x0000 , reg, dev->urb_buf, len,HZ ); +0x0000 , reg, dev->urb_buf, len,1000 );if (ret <0 ) { em28xx_regdbg("(pipe 0x%08x): IN: %02x %02x %02x %02x %02x %02x %02x %02x failed with error %i\n", pipe,
@@ -158,7 +158,7 @@ int em28xx_write_regs_req(struct em28xxmemcpy (dev->urb_buf, buf, len); ret =usb_control_msg (udev, pipe, req,USB_DIR_OUT |USB_TYPE_VENDOR |USB_RECIP_DEVICE , -0x0000 , reg, dev->urb_buf, len,HZ ); +0x0000 , reg, dev->urb_buf, len,1000 );mutex_unlock (&dev->ctrl_urb_lock);if (ret <0 ) {
Greg Kroah-Hartman
maintainerPATCH 18/320 media: cpia2: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 10729be03327f53258cb196362015ad5c6eabe02 upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/media/usb/cpia2/cpia2_usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/usb/cpia2/cpia2_usb.c +2 -2
@@ -550,7 +550,7 @@ static int write_packet(struct usb_devic0 ,/* index */ buf,/* buffer */ size, - HZ); + 1000);kfree (buf);return ret;
@@ -582,7 +582,7 @@ static int read_packet(struct usb_device0 ,/* index */ buf,/* buffer */ size, - HZ); + 1000);if (ret >=0 )memcpy (registers, buf, size);
Greg Kroah-Hartman
maintainerPATCH 19/320 media: s2255: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit f71d272ad4e354097020a4e6b1dc6e4b59feb50f upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
Use the common control-message timeout define for the five-second timeouts.
--- drivers/media/usb/s2255/s2255drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/usb/s2255/s2255drv.c +2 -2
@@ -1884,7 +1884,7 @@ static long s2255_vendor_req(struct s225USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN , Value, Index, buf, - TransferBufferLength, HZ * 5); + TransferBufferLength, USB_CTRL_SET_TIMEOUT);if (r >=0 )memcpy (TransferBuffer, buf, TransferBufferLength);
@@ -1893,7 +1893,7 @@ static long s2255_vendor_req(struct s225 r =usb_control_msg (dev->udev,usb_sndctrlpipe (dev->udev,0 ), Request,USB_TYPE_VENDOR |USB_RECIP_DEVICE , Value, Index, buf, - TransferBufferLength,HZ *5 ); + TransferBufferLength,USB_CTRL_SET_TIMEOUT ); }kfree (buf);return r;
Greg Kroah-Hartman
maintainerPATCH 20/320 media: dib0700: fix undefined behavior in tuner shutdown
In reply to Greg Kroah-HartmanFrom: Michael Kuron <[email protected]>
commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream.
This fixes a problem where closing the tuner would leave it in a state where it would not tune to any channel when reopened. This problem was discovered as part of https://github.com/hselasky/webcamd/issues/16.
Since adap->id is 0 or 1, this bit-shift overflows, which is undefined behavior. The driver still worked in practice as the overflow would in most environments result in 0, which rendered the line a no-op. When running the driver as part of webcamd however, the overflow could lead to 0xff due to optimizations by the compiler, which would, in the end, improperly shut down the tuner.
The bug is a regression introduced in the commit referenced below. The present patch causes identical behavior to before that commit for adap->id equal to 0 or 1. The driver does not contain support for dib0700 devices with more adapters, assuming such even exist.
Tests have been performed with the Xbox One Digital TV Tuner on amd64. Not all dib0700 devices are expected to be affected by the regression; this code path is only taken by those with incorrect endpoint numbers.
--- drivers/media/usb/dvb-usb/dib0700_core.c | 2 -- 1 file changed, 2 deletions(-)
drivers/media/usb/dvb-usb/dib0700_core.c +0 -2
@@ -616,8 +616,6 @@ int dib0700_streaming_ctrl(struct dvb_usdeb_info ("the endpoint number (%i) is not correct, use the adapter id instead" , adap->fe_adap[0 ].stream.props.endpoint);if (onoff) st->channel_state |=1 << (adap->id); -else - st->channel_state |=1 << ~(adap->id); }else {if (onoff) st->channel_state |=1 << (adap->fe_adap[0 ].stream.props.endpoint-2 );
Greg Kroah-Hartman
maintainerPATCH 21/320 media: redrat3: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 2adc965c8bfa224e11ecccf9c92fd458c4236428 upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/media/rc/redrat3.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/media/rc/redrat3.c +11 -11
@@ -405,7 +405,7 @@ static int redrat3_send_cmd(int cmd, str udev = rr3->udev; res =usb_control_msg (udev,usb_rcvctrlpipe (udev,0 ), cmd,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN , -0x0000 ,0x0000 , data,sizeof (u8),HZ *10 ); +0x0000 ,0x0000 , data,sizeof (u8),10000 );if (res <0 ) { dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d",
@@ -481,7 +481,7 @@ static u32 redrat3_get_timeout(struct re pipe =usb_rcvctrlpipe (rr3->udev,0 ); ret =usb_control_msg (rr3->udev, pipe,RR3_GET_IR_PARAM ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN , -RR3_IR_IO_SIG_TIMEOUT ,0 , tmp, len,HZ *5 ); +RR3_IR_IO_SIG_TIMEOUT ,0 , tmp, len,5000 );if (ret != len)dev_warn (rr3->dev,"Failed to read timeout from hardware\n" );else {
@@ -511,7 +511,7 @@ static int redrat3_set_timeout(struct rc ret =usb_control_msg (udev,usb_sndctrlpipe (udev,0 ),RR3_SET_IR_PARAM ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT ,RR3_IR_IO_SIG_TIMEOUT ,0 , timeout,sizeof (*timeout), -HZ *25 ); +25000 );dev_dbg (dev,"set ir parm timeout %d ret 0x%02x\n" ,be32_to_cpu (*timeout), ret);
@@ -543,32 +543,32 @@ static void redrat3_reset(struct redrat3 *val =0x01 ; rc =usb_control_msg (udev, rxpipe,RR3_RESET ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN , -RR3_CPUCS_REG_ADDR ,0 , val, len,HZ *25 ); +RR3_CPUCS_REG_ADDR ,0 , val, len,25000 );dev_dbg (dev,"reset returned 0x%02x\n" , rc); *val = length_fuzz; rc =usb_control_msg (udev, txpipe,RR3_SET_IR_PARAM ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT , -RR3_IR_IO_LENGTH_FUZZ ,0 , val, len,HZ *25 ); +RR3_IR_IO_LENGTH_FUZZ ,0 , val, len,25000 );dev_dbg (dev,"set ir parm len fuzz %d rc 0x%02x\n" , *val, rc); *val = (65536 - (minimum_pause *2000 )) /256 ; rc =usb_control_msg (udev, txpipe,RR3_SET_IR_PARAM ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT , -RR3_IR_IO_MIN_PAUSE ,0 , val, len,HZ *25 ); +RR3_IR_IO_MIN_PAUSE ,0 , val, len,25000 );dev_dbg (dev,"set ir parm min pause %d rc 0x%02x\n" , *val, rc); *val = periods_measure_carrier; rc =usb_control_msg (udev, txpipe,RR3_SET_IR_PARAM ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT , -RR3_IR_IO_PERIODS_MF ,0 , val, len,HZ *25 ); +RR3_IR_IO_PERIODS_MF ,0 , val, len,25000 );dev_dbg (dev,"set ir parm periods measure carrier %d rc 0x%02x" , *val, rc); *val =RR3_DRIVER_MAXLENS ; rc =usb_control_msg (udev, txpipe,RR3_SET_IR_PARAM ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_OUT , -RR3_IR_IO_MAX_LENGTHS ,0 , val, len,HZ *25 ); +RR3_IR_IO_MAX_LENGTHS ,0 , val, len,25000 );dev_dbg (dev,"set ir parm max lens %d rc 0x%02x\n" , *val, rc);kfree (val);
@@ -586,7 +586,7 @@ static void redrat3_get_firmware_rev(str rc =usb_control_msg (rr3->udev,usb_rcvctrlpipe (rr3->udev,0 ),RR3_FW_VERSION ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN , -0 ,0 , buffer,RR3_FW_VERSION_LEN ,HZ *5 ); +0 ,0 , buffer,RR3_FW_VERSION_LEN ,5000 );if (rc >=0 )dev_info (rr3->dev,"Firmware rev: %s" , buffer);
@@ -826,14 +826,14 @@ static int redrat3_transmit_ir(struct rc pipe =usb_sndbulkpipe (rr3->udev, rr3->ep_out->bEndpointAddress); ret =usb_bulk_msg (rr3->udev, pipe, irdata, - sendbuf_len, &ret_len,10 *HZ ); + sendbuf_len, &ret_len,10000 );dev_dbg (dev,"sent %d bytes, (ret %d)\n" , ret_len, ret);/* now tell the hardware to transmit what we sent it */ pipe =usb_rcvctrlpipe (rr3->udev,0 ); ret =usb_control_msg (rr3->udev, pipe,RR3_TX_SEND_SIGNAL ,USB_TYPE_VENDOR |USB_RECIP_DEVICE |USB_DIR_IN , -0 ,0 , irdata,2 ,HZ *10 ); +0 ,0 , irdata,2 ,10000 );if (ret <0 )dev_err (dev,"Error: control msg send failed, rc %d\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 22/320 media: pvrusb2: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit b82bf9b9dc305d7d3d93eab106d70dbf2171b43e upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/usb/pvrusb2/pvrusb2-hdw.c +4 -4
@@ -1468,7 +1468,7 @@ static int pvr2_upload_firmware1(structfor (address =0 ; address < fwsize; address +=0x800 ) {memcpy (fw_ptr, fw_entry->data + address,0x800 ); ret +=usb_control_msg (hdw->usb_dev, pipe,0xa0 ,0x40 , address, -0 , fw_ptr,0x800 ,HZ ); +0 , fw_ptr,0x800 ,1000 ); }trace_firmware ("Upload done, releasing device's CPU" );
@@ -1606,7 +1606,7 @@ int pvr2_upload_firmware2(struct pvr2_hd ((u32 *)fw_ptr)[icnt] =swab32 (((u32 *)fw_ptr)[icnt]); ret |=usb_bulk_msg (hdw->usb_dev, pipe, fw_ptr,bcnt, - &actual_length,HZ ); + &actual_length,1000 ); ret |= (actual_length != bcnt);if (ret)break ; fw_done += bcnt;
@@ -3439,7 +3439,7 @@ void pvr2_hdw_cpufw_set_enabled(struct p0xa0 ,0xc0 , address,0 , hdw->fw_buffer+address, - 0x800,HZ); + 0x800,1000);if (ret <0 )break ; }
@@ -3978,7 +3978,7 @@ void pvr2_hdw_cpureset_assert(struct pvr/* Write the CPUCS register on the 8051. The lsb of the register is the reset bit; a 1 asserts reset while a 0 clears it. */ pipe =usb_sndctrlpipe (hdw->usb_dev,0 ); - ret =usb_control_msg (hdw->usb_dev,pipe,0xa0 ,0x40 ,0xe600 ,0 ,da,1 ,HZ ); + ret =usb_control_msg (hdw->usb_dev,pipe,0xa0 ,0x40 ,0xe600 ,0 ,da,1 ,1000 );if (ret <0 ) {pvr2_trace (PVR2_TRACE_ERROR_LEGS ,"cpureset_assert(%d) error=%d" ,val,ret);
Greg Kroah-Hartman
maintainerPATCH 23/320 media: stk1160: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d upstream.
USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.
--- drivers/media/usb/stk1160/stk1160-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/usb/stk1160/stk1160-core.c +2 -2
@@ -65,7 +65,7 @@ int stk1160_read_reg(struct stk1160 *devreturn -ENOMEM ; ret =usb_control_msg (dev->udev, pipe,0x00 ,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , -0x00 , reg, buf,sizeof (u8),HZ ); +0x00 , reg, buf,sizeof (u8),1000 );if (ret <0 ) {stk1160_err ("read failed on reg 0x%x (%d)\n" , reg, ret);
@@ -85,7 +85,7 @@ int stk1160_write_reg(struct stk1160 *de ret =usb_control_msg (dev->udev, pipe,0x01 ,USB_DIR_OUT |USB_TYPE_VENDOR |USB_RECIP_DEVICE , - value, reg,NULL ,0 ,HZ ); + value, reg,NULL ,0 ,1000 );if (ret <0 ) {stk1160_err ("write failed on reg 0x%x (%d)\n" , reg, ret);
Greg Kroah-Hartman
maintainerPATCH 24/320 can: softing_cs: softingcs_probe(): fix memleak on registration failure
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit ced4913efb0acc844ed65cc01d091a85d83a2082 upstream.
In case device registration fails during probe, the driver state and the embedded platform device structure needs to be freed using platform_device_put() to properly free all resources (e.g. the device name).
--- drivers/net/can/softing/softing_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/softing/softing_cs.c +1 -1
@@ -293,7 +293,7 @@ static int softingcs_probe(struct pcmciareturn 0 ; platform_failed: -kfree (dev); +platform_device_put (pdev); mem_failed: pcmcia_bad: pcmcia_failed:
Greg Kroah-Hartman
maintainerPATCH 25/320 lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
commit bc93a22a19eb2b68a16ecf04cdf4b2ed65aaf398 upstream.
On a kernel without CONFIG_STRICT_KERNEL_RWX, running EXEC_RODATA test leads to "Illegal instruction" failure.
Looking at the content of rodata_objcopy.o, we see that the function content zeroes only:
Disassembly of section .rodata: 0000000000000000 <.lkdtm_rodata_do_nothing>: 0: 00 00 00 00 .long 0x0
Add the contents flag in order to keep the content of the section while renaming it.
Disassembly of section .rodata: 0000000000000000 <.lkdtm_rodata_do_nothing>: 0: 4e 80 00 20 blr
--- drivers/misc/lkdtm/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/lkdtm/Makefile +1 -1
@@ -16,7 +16,7 @@ KCOV_INSTRUMENT_rodata.o := n OBJCOPYFLAGS := OBJCOPYFLAGS_rodata_objcopy.o := \ - --rename-section .noinstr.text=.rodata,alloc,readonly,load + --rename-section .noinstr.text=.rodata,alloc,readonly,load,contents targets += rodata.o rodata_objcopy.o $(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE $(call if_changed,objcopy)
Greg Kroah-Hartman
maintainerPATCH 26/320 iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
In reply to Greg Kroah-HartmanFrom: Yunfei Wang <[email protected]>
commit a556cfe4cabc6d79cbb7733f118bbb420b376fe6 upstream.
In __arm_v7s_alloc_table function:
iommu call kmem_cache_alloc to allocate page table, this function allocate memory may fail, when kmem_cache_alloc fails to allocate table, call virt_to_phys will be abnomal and return unexpected phys and goto out_free, then call kmem_cache_free to release table will trigger KE, __get_free_pages and free_pages have similar problem, so add error handle for page table allocation failure.
--- drivers/iommu/io-pgtable-arm-v7s.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/iommu/io-pgtable-arm-v7s.c +5 -1
@@ -244,13 +244,17 @@ static void *__arm_v7s_alloc_table(int l __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size)); else if (lvl == 2) table =kmem_cache_zalloc (data->l2_tables, gfp); + +if (!table) +return NULL ; + phys =virt_to_phys (table);if (phys != (arm_v7s_iopte )phys) {/* Doesn't fit in PTE */ dev_err (dev,"Page table does not fit in PTE: %pa" , &phys); goto out_free; } -if (table && !cfg->coherent_walk) { +if (!cfg->coherent_walk) { dma =dma_map_single (dev, table, size,DMA_TO_DEVICE );if (dma_mapping_error (dev, dma)) goto out_free;
Greg Kroah-Hartman
maintainerPATCH 27/320 dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
In reply to Greg Kroah-HartmanFrom: Thomas Hellström <[email protected]>
commit 95d35838880fb040ccb9fe4a48816bd0c8b62df5 upstream.
If a dma_fence_array is reported signaled by a call to dma_fence_is_signaled(), it may leak the PENDING_ERROR status.
Fix this by clearing the PENDING_ERROR status if we return true in dma_fence_array_signaled().
v2:
- Update Cc list, and add R-b.
--- drivers/dma-buf/dma-fence-array.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/dma-buf/dma-fence-array.c +5 -1
@@ -104,7 +104,11 @@ static bool dma_fence_array_signaled(str {struct dma_fence_array *array =to_dma_fence_array (fence); -return atomic_read (&array->num_pending) <=0 ; +if (atomic_read (&array->num_pending) >0 ) +return false; + +dma_fence_array_clear_pending_error (array); +return true; }static void dma_fence_array_release (struct dma_fence *fence)
Greg Kroah-Hartman
maintainerPATCH 28/320 PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
In reply to Greg Kroah-HartmanFrom: Yifeng Li <[email protected]>
commit e445375882883f69018aa669b67cbb37ec873406 upstream.
Like other SATA controller chips in the Marvell 88SE91xx series, the Marvell 88SE9125 has the same DMA requester ID hardware bug that prevents it from working under IOMMU. Add it to the list of devices that need the quirk.
Without this patch, device initialization fails with DMA errors:
ata8: softreset failed (1st FIS failed)
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Write NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Read NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear
After applying the patch, the controller can be successfully initialized:
ata8: SATA link up 1.5 Gbps (SStatus 113 SControl 330)
ata8.00: ATAPI: PIONEER BD-RW BDR-207M, 1.21, max UDMA/100
ata8.00: configured for UDMA/100
scsi 7:0:0:0: CD-ROM PIONEER BD-RW BDR-207M 1.21 PQ: 0 ANSI: 5
--- drivers/pci/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pci/quirks.c +3 -0
@@ -4134,6 +4134,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_M quirk_dma_func1_alias);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MARVELL_EXT ,0x9123 , quirk_dma_func1_alias); +/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c136 */ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MARVELL_EXT ,0x9125 , + quirk_dma_func1_alias);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MARVELL_EXT ,0x9128 , quirk_dma_func1_alias);/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
Greg Kroah-Hartman
maintainerPATCH 29/320 mm_zone: add function to check if managed dma zone exists
In reply to Greg Kroah-HartmanFrom: Baoquan He <[email protected]>
commit 62b3107073646e0946bd97ff926832bafb846d17 upstream.
Patch series "Handle warning of allocation failure on DMA zone w/o managed pages", v4.
**Problem observed:
On x86_64, when crash is triggered and entering into kdump kernel, page allocation failure can always be seen.
---------------------------------
DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
swapper/0: page allocation failure: order:5, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 1 Comm: swapper/0 Call Trace: dump_stack+0x7f/0xa1 warn_alloc.cold+0x72/0xd6 ...... __alloc_pages+0x24d/0x2c0 ...... dma_atomic_pool_init+0xdb/0x176 do_one_initcall+0x67/0x320 ? rcu_read_lock_sched_held+0x3f/0x80 kernel_init_freeable+0x290/0x2dc ? rest_init+0x24f/0x24f kernel_init+0xa/0x111 ret_from_fork+0x22/0x30 Mem-Info: ------------------------------------
***Root cause:
In the current kernel, it assumes that DMA zone must have managed pages and try to request pages if CONFIG_ZONE_DMA is enabled. While this is not always true. E.g in kdump kernel of x86_64, only low 1M is presented and locked down at very early stage of boot, so that this low 1M won't be added into buddy allocator to become managed pages of DMA zone. This exception will always cause page allocation failure if page is requested from DMA zone.
***Investigation:
This failure happens since below commit merged into linus's tree.
1a6a9044b967 x86/setup: Remove CONFIG_X86_RESERVE_LOW and reservelow= options 23721c8e92f7 x86/crash: Remove crash_reserve_low_1M()
f1d4d47c5851 x86/setup: Always reserve the first 1M of RAM
7c321eb2b843 x86/kdump: Remove the backup region handling
6f599d84231f x86/kdump: Always reserve the low 1M when the crashkernel option is specified
Before them, on x86_64, the low 640K area will be reused by kdump kernel. So in kdump kernel, the content of low 640K area is copied into a backup region for dumping before jumping into kdump. Then except of those firmware reserved region in [0, 640K], the left area will be added into buddy allocator to become available managed pages of DMA zone.
However, after above commits applied, in kdump kernel of x86_64, the low 1M is reserved by memblock, but not released to buddy allocator. So any later page allocation requested from DMA zone will fail.
At the beginning, if crashkernel is reserved, the low 1M need be locked down because AMD SME encrypts memory making the old backup region mechanims impossible when switching into kdump kernel.
Later, it was also observed that there are BIOSes corrupting memory under 1M. To solve this, in commit f1d4d47c5851, the entire region of low 1M is always reserved after the real mode trampoline is allocated.
Besides, recently, Intel engineer mentioned their TDX (Trusted domain extensions) which is under development in kernel also needs to lock down the low 1M. So we can't simply revert above commits to fix the page allocation failure from DMA zone as someone suggested.
***Solution:
Currently, only DMA atomic pool and dma-kmalloc will initialize and request page allocation with GFP_DMA during bootup.
So only initializ DMA atomic pool when DMA zone has available managed pages, otherwise just skip the initialization.
For dma-kmalloc(), for the time being, let's mute the warning of allocation failure if requesting pages from DMA zone while no manged pages. Meanwhile, change code to use dma_alloc_xx/dma_map_xx API to replace kmalloc(GFP_DMA), or do not use GFP_DMA when calling kmalloc() if not necessary. Christoph is posting patches to fix those under drivers/scsi/. Finally, we can remove the need of dma-kmalloc() as people suggested.
This patch (of 3):
In some places of the current kernel, it assumes that dma zone must have managed pages if CONFIG_ZONE_DMA is enabled. While this is not always true. E.g in kdump kernel of x86_64, only low 1M is presented and locked down at very early stage of boot, so that there's no managed pages at all in DMA zone. This exception will always cause page allocation failure if page is requested from DMA zone.
Here add function has_managed_dma() and the relevant helper functions to check if there's DMA zone with managed pages. It will be used in later patches.
--- include/linux/mmzone.h | 9 +++++++++ mm/page_alloc.c | 15 +++++++++++++++ 2 files changed, 24 insertions(+)
include/linux/mmzone.h +9 -0
@@ -929,6 +929,15 @@ static inline int is_highmem_idx(enum zo#endif } +#ifdef CONFIG_ZONE_DMA +bool has_managed_dma (void ); +#else +static inline bool has_managed_dma (void ) +{ +return false; +} +#endif +/** * is_highmem - helper function to quickly check if a struct zone is a * highmem zone or not. This is an attempt to keep references
mm/page_alloc.c +15 -0
@@ -8694,3 +8694,18 @@ bool set_hwpoison_free_buddy_page(struct return hwpoisoned; }#endif + +#ifdef CONFIG_ZONE_DMA +bool has_managed_dma (void ) +{ +struct pglist_data *pgdat; + +for_each_online_pgdat (pgdat) { +struct zone *zone = &pgdat->node_zones[ZONE_DMA ]; + +if (managed_zone (zone)) +return true; + } +return false; +} +#endif /* CONFIG_ZONE_DMA */
Greg Kroah-Hartman
maintainerPATCH 30/320 mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages
In reply to Greg Kroah-HartmanFrom: Baoquan He <[email protected]>
commit c4dc63f0032c77464fbd4e7a6afc22fa6913c4a7 upstream.
In kdump kernel of x86_64, page allocation failure is observed:
kworker/u2:2: page allocation failure: order:0, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0
CPU: 0 PID: 55 Comm: kworker/u2:2 Not tainted 5.16.0-rc4+ #5 Hardware name: AMD Dinar/Dinar, BIOS RDN1505B 06/05/2013 Workqueue: events_unbound async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x48/0x5e warn_alloc.cold+0x72/0xd6 __alloc_pages_slowpath.constprop.0+0xc69/0xcd0 __alloc_pages+0x1df/0x210 new_slab+0x389/0x4d0 ___slab_alloc+0x58f/0x770 __slab_alloc.constprop.0+0x4a/0x80 kmem_cache_alloc_trace+0x24b/0x2c0 sr_probe+0x1db/0x620 ...... device_add+0x405/0x920 ...... __scsi_add_device+0xe5/0x100 ata_scsi_scan_host+0x97/0x1d0 async_run_entry_fn+0x30/0x130 process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x350/0x350 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Mem-Info: ......
The above failure happened when calling kmalloc() to allocate buffer with GFP_DMA. It requests to allocate slab page from DMA zone while no managed pages at all in there.
sr_probe()
--> get_capabilities()
--> buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
Because in the current kernel, dma-kmalloc will be created as long as CONFIG_ZONE_DMA is enabled. However, kdump kernel of x86_64 doesn't have managed pages on DMA zone since commit 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified"). The failure can be always reproduced.
For now, let's mute the warning of allocation failure if requesting pages from DMA zone while no managed pages.
[[email protected]: fix warning]
--- mm/page_alloc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
mm/page_alloc.c +3 -1
@@ -3767,7 +3767,9 @@ void warn_alloc(gfp_t gfp_mask, nodemaskva_list args; static DEFINE_RATELIMIT_STATE(nopage_rs, 10*HZ, 1); -if ((gfp_mask & __GFP_NOWARN) || !__ratelimit (&nopage_rs)) +if ((gfp_mask & __GFP_NOWARN) || + !__ratelimit (&nopage_rs) || + ((gfp_mask & __GFP_DMA) && !has_managed_dma ()))return ;va_start (args, fmt);
Greg Kroah-Hartman
maintainerPATCH 31/320 shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
In reply to Greg Kroah-HartmanFrom: Gang Li <[email protected]>
commit 62c9827cbb996c2c04f615ecd783ce28bcea894b upstream.
Fix a data race in commit 779750d20b93 ("shmem: split huge pages beyond i_size under memory pressure").
Here are call traces causing race:
Call Trace 1:
shmem_unused_huge_shrink+0x3ae/0x410
? __list_lru_walk_one.isra.5+0x33/0x160
super_cache_scan+0x17c/0x190
shrink_slab.part.55+0x1ef/0x3f0
shrink_node+0x10e/0x330
kswapd+0x380/0x740
kthread+0xfc/0x130
? mem_cgroup_shrink_node+0x170/0x170
? kthread_create_on_node+0x70/0x70
ret_from_fork+0x1f/0x30Call Trace 2:
shmem_evict_inode+0xd8/0x190
evict+0xbe/0x1c0
do_unlinkat+0x137/0x330
do_syscall_64+0x76/0x120
entry_SYSCALL_64_after_hwframe+0x3d/0xa2A simple explanation:
Image there are 3 items in the local list (@list). In the first traversal, A is not deleted from @list.
1) A->B->C
^
|
pos (leave)In the second traversal, B is deleted from @list. Concurrently, A is deleted from @list through shmem_evict_inode() since last reference counter of inode is dropped by other thread. Then the @list is corrupted.
2) A->B->C
^ ^
| |
evict pos (drop)We should make sure the inode is either on the global list or deleted from any local list before iput().
Fixed by moving inodes back to global list before we put them.
[[email protected]: coding style fixes]
--- mm/shmem.c | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-)
mm/shmem.c +21 -16
@@ -466,7 +466,7 @@ static unsigned long shmem_unused_huge_sstruct shmem_inode_info *info;struct page *page;unsigned long batch = sc ? sc->nr_to_scan :128 ; -int removed =0 , split =0 ; +int split =0 ;if (list_empty (&sbinfo->shrinklist))return SHRINK_STOP ;
@@ -481,7 +481,6 @@ static unsigned long shmem_unused_huge_s/* inode is about to be evicted */ if (!inode) {list_del_init (&info->shrinklist); - removed++; goto next; }
@@ -489,12 +488,12 @@ static unsigned long shmem_unused_huge_sif (round_up (inode->i_size,PAGE_SIZE ) ==round_up (inode->i_size,HPAGE_PMD_SIZE )) {list_move (&info->shrinklist, &to_remove); - removed++; goto next; }list_move (&info->shrinklist, &list); next: + sbinfo->shrinklist_len--;if (!--batch)break ; }
@@ -514,7 +513,7 @@ next: inode = &info->vfs_inode;if (nr_to_split && split >= nr_to_split) - goto leave; + goto move_back; page =find_get_page (inode->i_mapping, (inode->i_size &HPAGE_PMD_MASK ) >>PAGE_SHIFT );
@@ -528,38 +527,44 @@ next: }/* -* Leave the inode on the list if we failed to lock -* the page at this time. +* Move the inode on the list back to shrinklist if we failed +* to lock the page at this time. * * Waiting for the lock may lead to deadlock in the * reclaim path. */ if (!trylock_page (page)) {put_page (page); - goto leave; + goto move_back; } ret =split_huge_page (page);unlock_page (page);put_page (page); -/* If split failed leave the inode on the list */ +/* If split failed move the inode on the list back to shrinklist */ if (ret) - goto leave; + goto move_back; split++; drop:list_del_init (&info->shrinklist); - removed++; -leave: + goto put; +move_back: +/* +* Make sure the inode is either on the global list or deleted +* from any local list before iput() since it could be deleted +* in another thread once we put the inode (then the local list +* is corrupted). +*/ +spin_lock (&sbinfo->shrinklist_lock); +list_move (&info->shrinklist, &sbinfo->shrinklist); + sbinfo->shrinklist_len++; +spin_unlock (&sbinfo->shrinklist_lock); +put:iput (inode); } -spin_lock (&sbinfo->shrinklist_lock); -list_splice_tail (&list, &sbinfo->shrinklist); - sbinfo->shrinklist_len -= removed; -spin_unlock (&sbinfo->shrinklist_lock); -return split; }
Greg Kroah-Hartman
maintainerPATCH 32/320 drm/rockchip: dsi: Hold pm-runtime across bind/unbind
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit 514db871922f103886ad4d221cf406b4fcc5e74a upstream.
In commit 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except LCDC mux to bind()"), we moved most HW configuration to bind(), but we didn't move the runtime PM management. Therefore, depending on initial boot state, runtime-PM workqueue delays, and other timing factors, we may disable our power domain in between the hardware configuration (bind()) and when we enable the display. This can cause us to lose hardware state and fail to configure our display. For example:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO panel-innolux-p079zca ff960000.mipi.0: failed to write command 0
or:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO panel-kingdisplay-kd097d04 ff960000.mipi.0: failed write init cmds: -110
We should match the runtime PM to the lifetime of the bind()/unbind() cycle.
Tested on Acer Chrometab 10 (RK3399 Gru-Scarlet), with panel drivers built either as modules or built-in.
Side notes: it seems one is more likely to see this problem when the panel driver is built into the kernel. I've also seen this problem bisect down to commits that simply changed Kconfig dependencies, because it changed the order in which driver init functions were compiled into the kernel, and therefore the ordering and timing of built-in device probe.
--- drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 37 ++++++++++++------------ 1 file changed, 19 insertions(+), 18 deletions(-)
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +19 -18
@@ -625,10 +625,6 @@ static void dw_mipi_dsi_encoder_enable(sif (mux <0 )return ; -pm_runtime_get_sync (dsi->dev); -if (dsi->slave) -pm_runtime_get_sync (dsi->slave->dev); -/* * For the RK3399, the clk of grf must be enabled before writing grf * register. And for RK3288 or other soc, this grf_clk must be NULL,
@@ -647,20 +643,10 @@ static void dw_mipi_dsi_encoder_enable(sclk_disable_unprepare (dsi->grf_clk); } -static void dw_mipi_dsi_encoder_disable (struct drm_encoder *encoder) -{ -struct dw_mipi_dsi_rockchip *dsi =to_dsi (encoder); - -if (dsi->slave) -pm_runtime_put (dsi->slave->dev); -pm_runtime_put (dsi->dev); -} -static const struct drm_encoder_helper_funcs dw_mipi_dsi_encoder_helper_funcs = { .atomic_check = dw_mipi_dsi_encoder_atomic_check, .enable = dw_mipi_dsi_encoder_enable, - .disable = dw_mipi_dsi_encoder_disable, };static const struct drm_encoder_funcs dw_mipi_dsi_encoder_funcs = {
@@ -795,10 +781,14 @@ static int dw_mipi_dsi_rockchip_bind(strput_device (second); } +pm_runtime_get_sync (dsi->dev); +if (dsi->slave) +pm_runtime_get_sync (dsi->slave->dev); + ret =clk_prepare_enable (dsi->pllref_clk);if (ret) {DRM_DEV_ERROR (dev,"Failed to enable pllref_clk: %d\n" , ret); -return ret; + goto out_pm_runtime; }/*
@@ -810,7 +800,7 @@ static int dw_mipi_dsi_rockchip_bind(str ret =clk_prepare_enable (dsi->grf_clk);if (ret) {DRM_DEV_ERROR (dsi->dev,"Failed to enable grf_clk: %d\n" , ret); -return ret; + goto out_pm_runtime; }dw_mipi_dsi_rockchip_config (dsi);
@@ -822,16 +812,23 @@ static int dw_mipi_dsi_rockchip_bind(str ret =rockchip_dsi_drm_create_encoder (dsi, drm_dev);if (ret) {DRM_DEV_ERROR (dev,"Failed to create drm encoder\n" ); -return ret; + goto out_pm_runtime; } ret =dw_mipi_dsi_bind (dsi->dmd, &dsi->encoder);if (ret) {DRM_DEV_ERROR (dev,"Failed to bind: %d\n" , ret); -return ret; + goto out_pm_runtime; }return 0 ; + +out_pm_runtime: +pm_runtime_put (dsi->dev); +if (dsi->slave) +pm_runtime_put (dsi->slave->dev); + +return ret; } static void dw_mipi_dsi_rockchip_unbind(struct device *dev,
@@ -846,6 +843,10 @@ static void dw_mipi_dsi_rockchip_unbind(dw_mipi_dsi_unbind (dsi->dmd);clk_disable_unprepare (dsi->pllref_clk); + +pm_runtime_put (dsi->dev); +if (dsi->slave) +pm_runtime_put (dsi->slave->dev); }static const struct component_ops dw_mipi_dsi_rockchip_ops = {
Greg Kroah-Hartman
maintainerPATCH 33/320 drm/rockchip: dsi: Reconfigure hardware on resume()
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit e584cdc1549932f87a2707b56bc588cfac5d89e0 upstream.
Since commit 43c2de1002d2 ("drm/rockchip: dsi: move all lane config except LCDC mux to bind()"), we perform most HW configuration in the bind() function. This configuration may be lost on suspend/resume, so we need to call it again. That may lead to errors like this after system suspend/resume:
dw-mipi-dsi-rockchip ff968000.mipi: failed to write command FIFO panel-kingdisplay-kd097d04 ff960000.mipi.0: failed write init cmds: -110
Tested on Acer Chromebook Tab 10 (RK3399 Gru-Scarlet).
Note that early mailing list versions of this driver borrowed Rockchip's downstream/BSP solution, to do HW configuration in mode_set() (which *is* called at the appropriate pre-enable() times), but that was discarded along the way. I've avoided that still, because mode_set() documentation doesn't suggest this kind of purpose as far as I can tell.
--- drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 37 ++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +37 -0
@@ -231,6 +231,8 @@ struct dw_mipi_dsi_rockchip {struct dw_mipi_dsi *dmd;const struct rockchip_dw_dsi_chip_data *cdata;struct dw_mipi_dsi_plat_data pdata; + +bool dsi_bound; };struct dphy_pll_parameter_map {
@@ -821,6 +823,8 @@ static int dw_mipi_dsi_rockchip_bind(str goto out_pm_runtime; } + dsi->dsi_bound = true; +return 0 ; out_pm_runtime:
@@ -840,6 +844,8 @@ static void dw_mipi_dsi_rockchip_unbind(if (dsi->is_slave)return ; + dsi->dsi_bound = false; +dw_mipi_dsi_unbind (dsi->dmd);clk_disable_unprepare (dsi->pllref_clk);
@@ -904,6 +910,36 @@ static const struct dw_mipi_dsi_host_ops .detach = dw_mipi_dsi_rockchip_host_detach, }; +static int __maybe_unused dw_mipi_dsi_rockchip_resume (struct device *dev) +{ +struct dw_mipi_dsi_rockchip *dsi =dev_get_drvdata (dev); +int ret; + +/* +* Re-configure DSI state, if we were previously initialized. We need +* to do this before rockchip_drm_drv tries to re-enable() any panels. +*/ +if (dsi->dsi_bound) { + ret =clk_prepare_enable (dsi->grf_clk); +if (ret) { +DRM_DEV_ERROR (dsi->dev,"Failed to enable grf_clk: %d\n" , ret); +return ret; + } + +dw_mipi_dsi_rockchip_config (dsi); +if (dsi->slave) +dw_mipi_dsi_rockchip_config (dsi->slave); + +clk_disable_unprepare (dsi->grf_clk); + } + +return 0 ; +} + +static const struct dev_pm_ops dw_mipi_dsi_rockchip_pm_ops = { +SET_LATE_SYSTEM_SLEEP_PM_OPS (NULL , dw_mipi_dsi_rockchip_resume) +}; +static int dw_mipi_dsi_rockchip_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -1089,6 +1125,7 @@ struct platform_driver dw_mipi_dsi_rockc .remove = dw_mipi_dsi_rockchip_remove, .driver = { .of_match_table = dw_mipi_dsi_rockchip_dt_ids, + .pm = &dw_mipi_dsi_rockchip_pm_ops, .name = "dw-mipi-dsi-rockchip", }, };
Greg Kroah-Hartman
maintainerPATCH 34/320 drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit 5f31dbeae8a88f31c3eb4eb526ab4807c40da241 ]
If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't ready), we leave a dangling drm_panel reference to freed memory. Clean that up on failure.
--- drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c +7 -1
@@ -424,7 +424,13 @@ static int kingdisplay_panel_probe(struct mipi_dsi_device *dsi)if (err <0 )return err; -return mipi_dsi_attach (dsi); + err =mipi_dsi_attach (dsi); +if (err <0 ) { +kingdisplay_panel_del (kingdisplay); +return err; + } + +return 0 ; }static int kingdisplay_panel_remove (struct mipi_dsi_device *dsi)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 35/320 drm/panel: innolux-p079zca: Delete panel on attach() failure
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit 32a267e9c057e1636e7afdd20599aa5741a73079 ]
If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't ready), we leave a dangling drm_panel reference to freed memory. Clean that up on failure.
This problem exists since the driver's introduction, but is especially relevant after refactored for dual-DSI variants.
--- drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-innolux-p079zca.c +9 -1
@@ -509,6 +509,7 @@ static void innolux_panel_del(struct innolux_panel *innolux)static int innolux_panel_probe (struct mipi_dsi_device *dsi) {const struct panel_desc *desc; +struct innolux_panel *innolux;int err; desc =of_device_get_match_data (&dsi->dev);
@@ -520,7 +521,14 @@ static int innolux_panel_probe(struct mipi_dsi_device *dsi)if (err <0 )return err; -return mipi_dsi_attach (dsi); + err =mipi_dsi_attach (dsi); +if (err <0 ) { + innolux =mipi_dsi_get_drvdata (dsi); +innolux_panel_del (innolux); +return err; + } + +return 0 ; }static int innolux_panel_remove (struct mipi_dsi_device *dsi)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 36/320 drm/rockchip: dsi: Fix unbalanced clock on probe error
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit 251888398753924059f3bb247a44153a2853137f ]
Our probe() function never enabled this clock, so we shouldn't disable it if we fail to probe the bridge.
Noted by inspection.
--- drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +1 -5
@@ -1023,14 +1023,10 @@ static int dw_mipi_dsi_rockchip_probe(stif (ret != -EPROBE_DEFER )DRM_DEV_ERROR (dev,"Failed to probe dw_mipi_dsi: %d\n" , ret); - goto err_clkdisable; +return ret; }return 0 ; - -err_clkdisable: -clk_disable_unprepare (dsi->pllref_clk); -return ret; }static int dw_mipi_dsi_rockchip_remove (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 37/320 Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ]
I got a kernel BUG report when doing fault injection test:
------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! ... RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d ... Call Trace: proto_unregister+0x83/0x220 cmtp_cleanup_sockets+0x37/0x40 [cmtp] cmtp_exit+0xe/0x1f [cmtp] do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns success. This will cause a kernel bug when accessing uncreated ctmp related data when the module exits.
--- net/bluetooth/cmtp/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/bluetooth/cmtp/core.c +1 -3
@@ -501,9 +501,7 @@ static int __init cmtp_init(void) {BT_INFO ("CMTP (CAPI Emulation) ver %s" ,VERSION ); -cmtp_init_sockets (); - -return 0 ; +return cmtp_init_sockets (); } static void __exit cmtp_exit(void)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 38/320 clk: bcm-2835: Pick the closest clock rate
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 5517357a4733d7cf7c17fc79d0530cfa47add372 ]
The driver currently tries to pick the closest rate that is lower than the rate being requested.
This causes an issue with clk_set_min_rate() since it actively checks for the rounded rate to be above the minimum that was just set.
Let's change the logic a bit to pick the closest rate to the requested rate, no matter if it's actually higher or lower.
--- drivers/clk/bcm/clk-bcm2835.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/bcm/clk-bcm2835.c +1 -1
@@ -1216,7 +1216,7 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw, rate =bcm2835_clock_choose_div_and_prate (hw, i, req->rate, &div, &prate, &avgrate); -if (rate > best_rate && rate <= req->rate) { +if (abs (req->rate - rate) <abs (req->rate - best_rate)) { best_parent = parent; best_prate = prate; best_rate = rate;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 39/320 clk: bcm-2835: Remove rounding up the dividers
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 8ca011ef4af48a7af7b15afd8a4a44039dd04cea ]
The driver, once it found a divider, tries to round it up by increasing the least significant bit of the fractional part by one when the round_up argument is set and there's a remainder.
However, since it increases the divider it will actually reduce the clock rate below what we were asking for, leading to issues with clk_set_min_rate() that will complain that our rounded clock rate is below the minimum of the rate.
Since the dividers are fairly precise already, let's remove that part so that we can have clk_set_min_rate() working.
This is effectively a revert of 9c95b32ca093 ("clk: bcm2835: add a round up ability to the clock divisor").
--- drivers/clk/bcm/clk-bcm2835.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/clk/bcm/clk-bcm2835.c +3 -8
@@ -932,8 +932,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw)static u32 bcm2835_clock_choose_div (struct clk_hw *hw,unsigned long rate, -unsigned long parent_rate, -bool round_up) +unsigned long parent_rate) {struct bcm2835_clock *clock =bcm2835_clock_from_hw (hw);const struct bcm2835_clock_data *data = clock->data;
@@ -945,10 +944,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw, rem =do_div (temp, rate); div = temp; - -/* Round up and mask off the unused bits */ -if (round_up && ((div & unused_frac_mask) !=0 || rem !=0 )) - div += unused_frac_mask +1 ; div &= ~unused_frac_mask;/* different clamping limits apply for a mash clock */
@@ -1079,7 +1074,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,struct bcm2835_clock *clock =bcm2835_clock_from_hw (hw);struct bcm2835_cprman *cprman = clock->cprman;const struct bcm2835_clock_data *data = clock->data; -u32 div =bcm2835_clock_choose_div (hw, rate, parent_rate, false); +u32 div =bcm2835_clock_choose_div (hw, rate, parent_rate);u32 ctl;spin_lock (&cprman->regs_lock);
@@ -1130,7 +1125,7 @@ static unsigned long bcm2835_clock_choose_div_and_prate(struct clk_hw *hw,if (!(BIT (parent_idx) & data->set_rate_parent)) { *prate =clk_hw_get_rate (parent); - *div =bcm2835_clock_choose_div (hw, rate, *prate, true); + *div =bcm2835_clock_choose_div (hw, rate, *prate); *avgrate =bcm2835_clock_rate_from_divisor (clock, *prate, *div);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 40/320 wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
[ Upstream commit 588b45c88ae130fe373a8c50edaf54735c3f4fe3 ]
Firmware can trigger a missed beacon indication, this is not the same as a lost signal.
Flag to Linux the missed beacon and let the WiFi stack decide for itself if the link is up or down by sending its own probe to determine this.
We should only be signalling the link is lost when the firmware indicates
--- drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/wcn36xx/smd.c +2 -2
@@ -2311,7 +2311,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,wcn36xx_dbg (WCN36XX_DBG_HAL ,"beacon missed bss_index %d\n" , tmp->bss_index); vif =wcn36xx_priv_to_vif (tmp); -ieee80211_connection_loss (vif); +ieee80211_beacon_loss (vif); }return 0 ; }
@@ -2326,7 +2326,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,wcn36xx_dbg (WCN36XX_DBG_HAL ,"beacon missed bss_index %d\n" , rsp->bss_index); vif =wcn36xx_priv_to_vif (tmp); -ieee80211_connection_loss (vif); +ieee80211_beacon_loss (vif);return 0 ; } }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 41/320 wcn36xx: Release DMA channel descriptor allocations
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
[ Upstream commit 3652096e5263ad67604b0323f71d133485f410e5 ]
When unloading the driver we are not releasing the DMA descriptors which we previously allocated.
--- drivers/net/wireless/ath/wcn36xx/dxe.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/ath/wcn36xx/dxe.c +5 -0
@@ -952,4 +952,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)wcn36xx_dxe_ch_free_skbs (wcn, &wcn->dxe_rx_l_ch);wcn36xx_dxe_ch_free_skbs (wcn, &wcn->dxe_rx_h_ch); + +wcn36xx_dxe_deinit_descs (wcn->dev, &wcn->dxe_tx_l_ch); +wcn36xx_dxe_deinit_descs (wcn->dev, &wcn->dxe_tx_h_ch); +wcn36xx_dxe_deinit_descs (wcn->dev, &wcn->dxe_rx_l_ch); +wcn36xx_dxe_deinit_descs (wcn->dev, &wcn->dxe_rx_h_ch); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 42/320 media: videobuf2: Fix the size printk format
In reply to Greg Kroah-HartmanFrom: Dillon Min <[email protected]>
[ Upstream commit c9ee220d76775e42f35d634479c978d9350077d3 ]
Since the type of parameter size is unsigned long, it should printk by %lu, instead of %ld, fix it.
--- drivers/media/common/videobuf2/videobuf2-dma-contig.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/common/videobuf2/videobuf2-dma-contig.c +4 -4
@@ -154,7 +154,7 @@ static void *vb2_dc_alloc(struct device *dev, unsigned long attrs, buf->cookie =dma_alloc_attrs (dev, size, &buf->dma_addr,GFP_KERNEL | gfp_flags, buf->attrs);if (!buf->cookie) { -dev_err (dev,"dma_alloc_coherent of size %ld failed\n" , size); +dev_err (dev,"dma_alloc_coherent of size %lu failed\n" , size);kfree (buf);return ERR_PTR (-ENOMEM ); }
@@ -200,9 +200,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_struct *vma) vma->vm_ops->open (vma); -pr_debug ("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n" , - __func__, (unsigned long )buf->dma_addr, vma->vm_start, - buf->size); +pr_debug ("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n" , + __func__, (unsigned long )buf->dma_addr, vma->vm_start, + buf->size);return 0 ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 43/320 media: aspeed: fix mode-detect always time out at 2nd run
In reply to Greg Kroah-HartmanFrom: Jammy Huang <[email protected]>
[ Upstream commit 62cea52ad4bead0ae4be2cfe1142eb0aae0e9fbd ]
aspeed_video_get_resolution() will try to do res-detect again if the timing got in last try is invalid. But it will always time out because VE_SEQ_CTRL_TRIG_MODE_DET is only cleared after 1st mode-detect.
To fix the problem, just clear VE_SEQ_CTRL_TRIG_MODE_DET before setting it in aspeed_video_enable_mode_detect().
--- drivers/media/platform/aspeed-video.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/platform/aspeed-video.c +4 -4
@@ -477,6 +477,10 @@ static void aspeed_video_enable_mode_detect(struct aspeed_video *video)aspeed_video_update (video,VE_INTERRUPT_CTRL ,0 ,VE_INTERRUPT_MODE_DETECT ); +/* Disable mode detect in order to re-trigger */ +aspeed_video_update (video,VE_SEQ_CTRL , +VE_SEQ_CTRL_TRIG_MODE_DET ,0 ); +/* Trigger mode detect */ aspeed_video_update (video,VE_SEQ_CTRL ,0 ,VE_SEQ_CTRL_TRIG_MODE_DET ); }
@@ -764,10 +768,6 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)return ; } -/* Disable mode detect in order to re-trigger */ -aspeed_video_update (video,VE_SEQ_CTRL , -VE_SEQ_CTRL_TRIG_MODE_DET ,0 ); -aspeed_video_check_and_set_polarity (video);aspeed_video_enable_mode_detect (video);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 44/320 media: em28xx: fix memory leak in em28xx_init_dev
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 22be5a10d0b24eec9e45decd15d7e6112b25f080 ]
In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails to deallocate the media_dev allocated in the em28xx_media_device_init.
Fix this by adding em28xx_unregister_media_device to free media_dev.
BTW, this patch is tested in my local syzkaller instance, and it can prevent the memory leak from occurring again.
--- drivers/media/usb/em28xx/em28xx-cards.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/media/usb/em28xx/em28xx-cards.c +12 -6
@@ -3515,8 +3515,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,if (dev->is_audio_only) { retval =em28xx_audio_setup (dev); -if (retval) -return -ENODEV ; +if (retval) { + retval = -ENODEV ; + goto err_deinit_media; + }em28xx_init_extension (dev);return 0 ;
@@ -3535,7 +3537,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,dev_err (&dev->intf->dev,"%s: em28xx_i2c_register bus 0 - error [%d]!\n" , __func__, retval); -return retval; + goto err_deinit_media; }/* register i2c bus 1 */
@@ -3551,9 +3553,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,"%s: em28xx_i2c_register bus 1 - error [%d]!\n" , __func__, retval); -em28xx_i2c_unregister (dev,0 ); - -return retval; + goto err_unreg_i2c; } }
@@ -3561,6 +3561,12 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,em28xx_card_setup (dev);return 0 ; + +err_unreg_i2c: +em28xx_i2c_unregister (dev,0 ); +err_deinit_media: +em28xx_unregister_media_device (dev); +return retval; }static int em28xx_duplicate_dev (struct em28xx *dev)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 45/320 media: aspeed: Update signal status immediately to ensure sane hw state
In reply to Greg Kroah-HartmanFrom: Jammy Huang <[email protected]>
[ Upstream commit af6d1bde395cac174ee71adcd3fa43f6435c7206 ]
If res-chg, VE_INTERRUPT_MODE_DETECT_WD irq will be raised. But v4l2_input_status won't be updated to no-signal immediately until aspeed_video_get_resolution() in aspeed_video_resolution_work().
During the period of time, aspeed_video_start_frame() could be called because it doesn't know signal becomes unstable now. If it goes with aspeed_video_init_regs() of aspeed_video_irq_res_change() simultaneously, it will mess up hw state.
To fix this problem, v4l2_input_status is updated to no-signal immediately for VE_INTERRUPT_MODE_DETECT_WD irq.
--- drivers/media/platform/aspeed-video.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/aspeed-video.c +3 -3
@@ -533,6 +533,8 @@ static void aspeed_video_irq_res_change(struct aspeed_video *video, ulong delay)set_bit (VIDEO_RES_CHANGE , &video->flags);clear_bit (VIDEO_FRAME_INPRG , &video->flags); + video->v4l2_input_status =V4L2_IN_ST_NO_SIGNAL ; +aspeed_video_off (video);aspeed_video_bufs_done (video,VB2_BUF_STATE_ERROR );
@@ -1315,7 +1317,6 @@ static void aspeed_video_resolution_work(struct work_struct *work)struct delayed_work *dwork =to_delayed_work (work); struct aspeed_video *video = container_of(dwork, struct aspeed_video, res_work); -u32 input_status = video->v4l2_input_status;aspeed_video_on (video);
@@ -1328,8 +1329,7 @@ static void aspeed_video_resolution_work(struct work_struct *work)aspeed_video_get_resolution (video);if (video->detected_timings.width != video->active_timings.width || - video->detected_timings.height != video->active_timings.height || - input_status != video->v4l2_input_status) { + video->detected_timings.height != video->active_timings.height) {static const struct v4l2_event ev = { .type =V4L2_EVENT_SOURCE_CHANGE , .u.src_change.changes =V4L2_EVENT_SRC_CH_RESOLUTION ,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 46/320 arm64: dts: meson-gxbb-wetek: fix HDMI in early boot
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit 8182a35868db5f053111d5d9d4da8fcb3f99259d ]
Mark the VDDIO_AO18 regulator always-on and set hdmi-supply for the hdmi_tx node to ensure HDMI is powered in the early stages of boot.
--- arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +2 -0
@@ -64,6 +64,7 @@ regulator-name = "VDDIO_AO18"; regulator-min-microvolt = <1800000>; regulator-max-microvolt = <1800000>; + regulator-always-on; }; vcc_3v3: regulator-vcc_3v3 {
@@ -157,6 +158,7 @@ status = "okay"; pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>; pinctrl-names = "default"; + hdmi-supply = <&vddio_ao18>; }; &hdmi_tx_tmds_port {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 47/320 arm64: dts: meson-gxbb-wetek: fix missing GPIO binding
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit c019abb2feba3cbbd7cf7178f8e6499c4fa6fced ]
The absence of this binding appears to be harmless in Linux but it breaks Ethernet support in mainline u-boot. So add the binding (which is present in all other u-boot supported GXBB device-trees).
--- arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +1 -0
@@ -6,6 +6,7 @@ */ #include "meson-gxbb.dtsi" +#include <dt-bindings/gpio/gpio.h> / { aliases {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 48/320 Bluetooth: stop proccessing malicious adv data
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ]
Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The problem was in missing validaion check.
We should check if data is not malicious and we can read next data block. If we won't check ptr validness, code can read a way beyond skb->end and it can cause problems, of course.
--- net/bluetooth/hci_event.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/bluetooth/hci_event.c +7 -1
@@ -5506,7 +5506,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)struct hci_ev_le_advertising_info *ev = ptr;s8 rssi; -if (ev->length <=HCI_MAX_AD_LENGTH ) { +if (ev->length <=HCI_MAX_AD_LENGTH && + ev->data + ev->length <=skb_tail_pointer (skb)) { rssi = ev->data[ev->length]; process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ev->bdaddr_type, NULL, 0, rssi,
@@ -5516,6 +5517,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) } ptr +=sizeof (*ev) + ev->length +1 ; + +if (ptr > (void *)skb_tail_pointer (skb) -sizeof (*ev)) { +bt_dev_err (hdev,"Malicious advertising data. Stopping processing" ); +break ; + } }hci_dev_unlock (hdev);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 49/320 tee: fix put order in teedev_close_context()
In reply to Greg Kroah-HartmanFrom: Jens Wiklander <[email protected]>
[ Upstream commit f18397ab3ae23e8e43bba9986e66af6d4497f2ad ]
Prior to this patch was teedev_close_context() calling tee_device_put() before teedev_ctx_put() leading to teedev_ctx_release() accessing ctx->teedev just after the reference counter was decreased on the teedev. Fix this by calling teedev_ctx_put() before tee_device_put().
--- drivers/tee/tee_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tee/tee_core.c +3 -1
@@ -84,8 +84,10 @@ void teedev_ctx_put(struct tee_context *ctx)static void teedev_close_context (struct tee_context *ctx) { -tee_device_put (ctx->teedev); +struct tee_device *teedev = ctx->teedev; +teedev_ctx_put (ctx); +tee_device_put (teedev); }static int tee_open (struct inode *inode,struct file *filp)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 50/320 media: dmxdev: fix UAF when dvb_register_device() fails
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit ab599eb11882f834951c436cc080c3455ba32b9b ]
I got a use-after-free report:
dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12)
...
==================================================================
BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0 ... Call Trace: dump_stack_lvl+0x6c/0x8b print_address_description.constprop.0+0x48/0x70 kasan_report.cold+0x82/0xdb __asan_load4+0x6b/0x90 dvb_dmxdev_release+0xce/0x2f0 ... Allocated by task 7666: kasan_save_stack+0x23/0x50 __kasan_kmalloc+0x83/0xa0 kmem_cache_alloc_trace+0x22e/0x470 dvb_register_device+0x12f/0x980 dvb_dmxdev_init+0x1f3/0x230 ... Freed by task 7666: kasan_save_stack+0x23/0x50 kasan_set_track+0x20/0x30 kasan_set_free_info+0x24/0x40 __kasan_slab_free+0xf2/0x130 kfree+0xd1/0x5c0 dvb_register_device.cold+0x1ac/0x1fa dvb_dmxdev_init+0x1f3/0x230
...
When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init() does not return a failure, and the memory pointed to by dvbdev or dvr_dvbdev is invalid at this point. If they are used subsequently, it will result in UFA or null-ptr-deref.
If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making dvb_dmxdev_init() return an error as well.
--- drivers/media/dvb-core/dmxdev.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/media/dvb-core/dmxdev.c +15 -3
@@ -1413,7 +1413,7 @@ static const struct dvb_device dvbdev_dvr = { };int dvb_dmxdev_init (struct dmxdev *dmxdev,struct dvb_adapter *dvb_adapter) { -int i; +int i, ret;if (dmxdev->demux->open (dmxdev->demux) <0 )return -EUSERS ;
@@ -1432,14 +1432,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) DMXDEV_STATE_FREE); } -dvb_register_device (dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, + ret =dvb_register_device (dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev,DVB_DEVICE_DEMUX , dmxdev->filternum); -dvb_register_device (dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, +if (ret <0 ) + goto err_register_dvbdev; + + ret =dvb_register_device (dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, dmxdev,DVB_DEVICE_DVR , dmxdev->filternum); +if (ret <0 ) + goto err_register_dvr_dvbdev;dvb_ringbuffer_init (&dmxdev->dvr_buffer,NULL ,8192 );return 0 ; + +err_register_dvr_dvbdev: +dvb_unregister_device (dmxdev->dvbdev); +err_register_dvbdev: +vfree (dmxdev->filter); + dmxdev->filter =NULL ; +return ret; }EXPORT_SYMBOL (dvb_dmxdev_init);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 51/320 crypto: qce - fix uaf on qce_ahash_register_one
In reply to Greg Kroah-HartmanFrom: Chengfeng Ye <[email protected]>
[ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ]
Pointer base points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing base before free tmpl.
--- drivers/crypto/qce/sha.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/qce/sha.c +1 -1
@@ -512,8 +512,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def, ret =crypto_register_ahash (alg);if (ret) { -kfree (tmpl);dev_err (qce->dev,"%s registration failed\n" , base->cra_name); +kfree (tmpl);return ret; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 52/320 arm64: dts: ti: k3-j721e: correct cache-sets info
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 7a0df1f969c14939f60a7f9a6af72adcc314675f ]
A72 Cluster has 48KB Icache, 32KB Dcache and 1MB L2 Cache
- ICache is 3-way set-associative
- Dcache is 2-way set-associative
- Line size are 64bytes
So correct the cache-sets info.
--- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/ti/k3-j721e.dtsi +2 -2
@@ -60,7 +60,7 @@ i-cache-sets = <256>; d-cache-size = <0x8000>; d-cache-line-size = <64>; - d-cache-sets = <128>; + d-cache-sets = <256>; next-level-cache = <&L2_0>; };
@@ -74,7 +74,7 @@ i-cache-sets = <256>; d-cache-size = <0x8000>; d-cache-line-size = <64>; - d-cache-sets = <128>; + d-cache-sets = <256>; next-level-cache = <&L2_0>; }; };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 53/320 tty: serial: atmel: Check return code of dmaengine_submit()
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
[ Upstream commit 1e67bd2b8cb90b66e89562598e9c2046246832d3 ]
The tx_submit() method of struct dma_async_tx_descriptor is entitled to do sanity checks and return errors if encountered. It's not the case for the DMA controller drivers that this client is using (at_h/xdmac), because they currently don't do sanity checks and always return a positive cookie at tx_submit() method. In case the controller drivers will implement sanity checks and return errors, print a message so that the client will be informed that something went wrong at tx_submit() level.
--- drivers/tty/serial/atmel_serial.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/tty/serial/atmel_serial.c +10 -0
@@ -1002,6 +1002,11 @@ static void atmel_tx_dma(struct uart_port *port) desc->callback = atmel_complete_tx_dma; desc->callback_param = atmel_port; atmel_port->cookie_tx =dmaengine_submit (desc); +if (dma_submit_error (atmel_port->cookie_tx)) { +dev_err (port->dev,"dma_submit_error %d\n" , + atmel_port->cookie_tx); +return ; + } }if (uart_circ_chars_pending (xmit) <WAKEUP_CHARS )
@@ -1262,6 +1267,11 @@ static int atmel_prepare_rx_dma(struct uart_port *port) desc->callback_param = port; atmel_port->desc_rx = desc; atmel_port->cookie_rx =dmaengine_submit (desc); +if (dma_submit_error (atmel_port->cookie_rx)) { +dev_err (port->dev,"dma_submit_error %d\n" , + atmel_port->cookie_rx); + goto chan_err; + }return 0 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 54/320 tty: serial: atmel: Call dma_async_issue_pending()
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
[ Upstream commit 4f4b9b5895614eb2e2b5f4cab7858f44bd113e1b ]
The driver wrongly assummed that tx_submit() will start the transfer, which is not the case, now that the at_xdmac driver is fixed. tx_submit is supposed to push the current transaction descriptor to a pending queue, waiting for issue_pending to be called. issue_pending must start the transfer, not tx_submit.
--- drivers/tty/serial/atmel_serial.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/tty/serial/atmel_serial.c +4 -0
@@ -1007,6 +1007,8 @@ static void atmel_tx_dma(struct uart_port *port) atmel_port->cookie_tx);return ; } + +dma_async_issue_pending (chan); }if (uart_circ_chars_pending (xmit) <WAKEUP_CHARS )
@@ -1273,6 +1275,8 @@ static int atmel_prepare_rx_dma(struct uart_port *port) goto chan_err; } +dma_async_issue_pending (atmel_port->chan_rx); +return 0 ; chan_err:
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 55/320 media: rcar-csi2: Correct the selection of hsfreqrange
In reply to Greg Kroah-HartmanFrom: Suresh Udipi <[email protected]>
[ Upstream commit cee44d4fbacbbdfe62697ec94e76c6e4f726c5df ]
hsfreqrange should be chosen based on the calculated mbps which is closer to the default bit rate and within the range as per table[1]. But current calculation always selects first value which is greater than or equal to the calculated mbps which may lead to chosing a wrong range in some cases.
For example for 360 mbps for H3/M3N
Existing logic selects
Calculated value 360Mbps : Default 400Mbps Range [368.125 -433.125 mbps]
This hsfreqrange is out of range.
The logic is changed to get the default value which is closest to the calculated value [1]
Calculated value 360Mbps : Default 350Mbps Range [320.625 -380.625 mpbs]
[1] specs r19uh0105ej0200-r-car-3rd-generation.pdf [Table 25.9]
Please note that According to Renesas in Table 25.9 the range for 220 default value is corrected as below
|Range (Mbps) | Default Bit rate (Mbps) |
-----------------------------------------------
| 197.125-244.125 | 220 |
-----------------------------------------------
--- drivers/media/platform/rcar-vin/rcar-csi2.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/media/platform/rcar-vin/rcar-csi2.c +8 -1
@@ -430,16 +430,23 @@ static int rcsi2_wait_phy_start(struct rcar_csi2 *priv)static int rcsi2_set_phypll (struct rcar_csi2 *priv,unsigned int mbps) {const struct rcsi2_mbps_reg *hsfreq; +const struct rcsi2_mbps_reg *hsfreq_prev =NULL ; -for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps !=0 ; hsfreq++) +for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps !=0 ; hsfreq++) {if (hsfreq->mbps >= mbps)break ; + hsfreq_prev = hsfreq; + }if (!hsfreq->mbps) {dev_err (priv->dev,"Unsupported PHY speed (%u Mbps)" , mbps);return -ERANGE ; } +if (hsfreq_prev && + ((mbps - hsfreq_prev->mbps) <= (hsfreq->mbps - mbps))) + hsfreq = hsfreq_prev; +rcsi2_write (priv,PHYPLL_REG ,PHYPLL_HSFREQRANGE (hsfreq->reg));return 0 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 56/320 media: imx-pxp: Initialize the spinlock prior to using it
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit ed2f97ad4b21072f849cf4ae6645d1f2b1d3f550 ]
After devm_request_threaded_irq() is called there is a chance that an interrupt may occur before the spinlock is initialized, which will trigger a kernel oops.
To prevent that, move the initialization of the spinlock prior to requesting the interrupts.
--- drivers/media/platform/imx-pxp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/imx-pxp.c +2 -2
@@ -1664,6 +1664,8 @@ static int pxp_probe(struct platform_device *pdev)if (irq <0 )return irq; +spin_lock_init (&dev->irqlock); + ret =devm_request_threaded_irq (&pdev->dev, irq,NULL , pxp_irq_handler,IRQF_ONESHOT ,dev_name (&pdev->dev), dev);if (ret <0 ) {
@@ -1681,8 +1683,6 @@ static int pxp_probe(struct platform_device *pdev) goto err_clk; } -spin_lock_init (&dev->irqlock); - ret =v4l2_device_register (&pdev->dev, &dev->v4l2_dev);if (ret) goto err_clk;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 57/320 media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit ef054e345ed8c79ce1121a3599b5a2dfd78e57a0 ]
n the 'radio->hdl.error' error handling, ctrl handler allocated by v4l2_ctrl_new_std() does not released, and caused memory leak as follows:
unreferenced object 0xffff888033d54200 (size 256):
comm "i2c-si470x-19", pid 909, jiffies 4294914203 (age 8.072s) hex dump (first 32 bytes):
e8 69 11 03 80 88 ff ff 00 46 d5 33 80 88 ff ff .i.......F.3....
10 42 d5 33 80 88 ff ff 10 42 d5 33 80 88 ff ff .B.3.....B.3....
backtrace:
[<00000000086bd4ed>] __kmalloc_node+0x1eb/0x360
[<00000000bdb68871>] kvmalloc_node+0x66/0x120
[<00000000fac74e4c>] v4l2_ctrl_new+0x7b9/0x1c60 [videodev]
[<00000000693bf940>] v4l2_ctrl_new_std+0x19b/0x270 [videodev]
[<00000000c0cb91bc>] si470x_i2c_probe+0x2d3/0x9a0 [radio_si470x_i2c]
[<0000000056a6f01f>] i2c_device_probe+0x4d8/0xbe0Fix the error handling path to avoid memory leak.
--- drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/radio/si470x/radio-si470x-i2c.c +1 -2
@@ -368,7 +368,7 @@ static int si470x_i2c_probe(struct i2c_client *client)if (radio->hdl.error) { retval = radio->hdl.error;dev_err (&client->dev,"couldn't register control\n" ); - goto err_dev; + goto err_all; }/* video device initialization */
@@ -463,7 +463,6 @@ static int si470x_i2c_probe(struct i2c_client *client)return 0 ; err_all:v4l2_ctrl_handler_free (&radio->hdl); -err_dev:v4l2_device_unregister (&radio->v4l2_dev); err_initial:return retval;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 58/320 media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
In reply to Greg Kroah-HartmanFrom: Dafna Hirschfeld <[email protected]>
[ Upstream commit 9f89c881bffbdffe4060ffaef3489a2830a6dd9c ]
The func v4l2_m2m_ctx_release waits for currently running jobs to finish and then stop streaming both queues and frees the buffers. All this should be done before the call to mtk_vcodec_enc_release which frees the encoder handler. This fixes null-pointer dereference bug:
[ 638.028076] Mem abort info: [ 638.030932] ESR = 0x96000004 [ 638.033978] EC = 0x25: DABT (current EL), IL = 32 bits [ 638.039293] SET = 0, FnV = 0 [ 638.042338] EA = 0, S1PTW = 0 [ 638.045474] FSC = 0x04: level 0 translation fault [ 638.050349] Data abort info: [ 638.053224] ISV = 0, ISS = 0x00000004 [ 638.057055] CM = 0, WnR = 0 [ 638.060018] user pgtable: 4k pages, 48-bit VAs, pgdp=000000012b6db000 [ 638.066485] [00000000000001a0] pgd=0000000000000000, p4d=0000000000000000 [ 638.073277] Internal error: Oops: 96000004 [#1] SMP [ 638.078145] Modules linked in: rfkill mtk_vcodec_dec mtk_vcodec_enc uvcvideo mtk_mdp mtk_vcodec_common videobuf2_dma_contig v4l2_h264 cdc_ether v4l2_mem2mem videobuf2_vmalloc usbnet videobuf2_memops videobuf2_v4l2 r8152 videobuf2_common videodev cros_ec_sensors cros_ec_sensors_core industrialio_triggered_buffer kfifo_buf elan_i2c elants_i2c sbs_battery mc cros_usbpd_charger cros_ec_chardev cros_usbpd_logger crct10dif_ce mtk_vpu fuse ip_tables x_tables ipv6 [ 638.118583] CPU: 0 PID: 212 Comm: kworker/u8:5 Not tainted 5.15.0-06427-g58a1d4dcfc74-dirty #109 [ 638.127357] Hardware name: Google Elm (DT) [ 638.131444] Workqueue: mtk-vcodec-enc mtk_venc_worker [mtk_vcodec_enc] [ 638.137974] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 638.144925] pc : vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc] [ 638.150493] lr : venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc] [ 638.156060] sp : ffff8000124d3c40 [ 638.159364] x29: ffff8000124d3c40 x28: 0000000000000000 x27: 0000000000000000 [ 638.166493] x26: 0000000000000000 x25: ffff0000e7f252d0 x24: ffff8000124d3d58 [ 638.173621] x23: ffff8000124d3d58 x22: ffff8000124d3d60 x21: 0000000000000001 [ 638.180750] x20: ffff80001137e000 x19: 0000000000000000 x18: 0000000000000001 [ 638.187878] x17: 000000040044ffff x16: 00400032b5503510 x15: 0000000000000000 [ 638.195006] x14: ffff8000118536c0 x13: ffff8000ee1da000 x12: 0000000030d4d91d [ 638.202134] x11: 0000000000000000 x10: 0000000000000980 x9 : ffff8000124d3b20 [ 638.209262] x8 : ffff0000c18d4ea0 x7 : ffff0000c18d44c0 x6 : ffff0000c18d44c0 [ 638.216391] x5 : ffff80000904a3b0 x4 : ffff8000124d3d58 x3 : ffff8000124d3d60 [ 638.223519] x2 : ffff8000124d3d78 x1 : 0000000000000001 x0 : ffff80001137efb8 [ 638.230648] Call trace: [ 638.233084] vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc] [ 638.238304] venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc] [ 638.243525] mtk_venc_worker+0x110/0x250 [mtk_vcodec_enc] [ 638.248918] process_one_work+0x1f8/0x498 [ 638.252923] worker_thread+0x140/0x538 [ 638.256664] kthread+0x148/0x158 [ 638.259884] ret_from_fork+0x10/0x20 [ 638.263455] Code: f90023f9 2a0103f5 aa0303f6 aa0403f8 (f940d277) [ 638.269538] ---[ end trace e374fc10f8e181f5 ]---
[gst-master] root@debian:~/gst-build# [ 638.019193] Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a0
--- drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c +1 -1
@@ -209,11 +209,11 @@ static int fops_vcodec_release(struct file *file)mtk_v4l2_debug (1 ,"[%d] encoder" , ctx->id);mutex_lock (&dev->dev_mutex); +v4l2_m2m_ctx_release (ctx->m2m_ctx);mtk_vcodec_enc_release (ctx);v4l2_fh_del (&ctx->fh);v4l2_fh_exit (&ctx->fh);v4l2_ctrl_handler_free (&ctx->ctrl_hdl); -v4l2_m2m_ctx_release (ctx->m2m_ctx);list_del_init (&ctx->list);kfree (ctx);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 59/320 media: venus: core: Fix a resource leak in the error handling path of venus_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 8cc7a1b2aca067397a016cdb971a5e6ad9b640c7 ]
A successful 'of_platform_populate()' call should be balanced by a corresponding 'of_platform_depopulate()' call in the error handling path of the probe, as already done in the remove function.
A successful 'venus_firmware_init()' call should be balanced by a corresponding 'venus_firmware_deinit()' call in the error handling path of the probe, as already done in the remove function.
Update the error handling path accordingly.
--- drivers/media/platform/qcom/venus/core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/media/platform/qcom/venus/core.c +6 -2
@@ -289,11 +289,11 @@ static int venus_probe(struct platform_device *pdev) ret =venus_firmware_init (core);if (ret) - goto err_runtime_disable; + goto err_of_depopulate; ret =venus_boot (core);if (ret) - goto err_runtime_disable; + goto err_firmware_deinit; ret =hfi_core_resume (core, true);if (ret)
@@ -329,6 +329,10 @@ err_core_deinit:hfi_core_deinit (core, false); err_venus_shutdown:venus_shutdown (core); +err_firmware_deinit: +venus_firmware_deinit (core); +err_of_depopulate: +of_platform_depopulate (dev); err_runtime_disable:pm_runtime_put_noidle (dev);pm_runtime_set_suspended (dev);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 60/320 netfilter: bridge: add support for pppoe filtering
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ]
This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for bridged traffic.
Looking at the original commit it doesn't appear this ever worked:
static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
[..]
if (skb->protocol == htons(ETH_P_8021Q)) {
skb_pull(skb, VLAN_HLEN);
skb->network_header += VLAN_HLEN;
+ } else if (skb->protocol == htons(ETH_P_PPP_SES)) {
+ skb_pull(skb, PPPOE_SES_HLEN);
+ skb->network_header += PPPOE_SES_HLEN;
}
[..]
NF_HOOK(... POST_ROUTING, ...)... but the adjusted offsets are never restored.
The alternative would be to rip this code out for good, but otoh we'd have to keep this anyway for the vlan handling (which works because vlan tag info is in the skb, not the packet
payload).
--- net/bridge/br_netfilter_hooks.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
net/bridge/br_netfilter_hooks.c +3 -4
@@ -743,6 +743,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buffif (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) mtu = nf_bridge->frag_max_size; +nf_bridge_update_protocol (skb); +nf_bridge_push_encap_header (skb); +if (skb_is_gso (skb) || skb->len + mtu_reserved <= mtu) {nf_bridge_info_free (skb);return br_dev_queue_push_xmit (net, sk, skb);
@@ -760,8 +763,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buffIPCB (skb)->frag_max_size = nf_bridge->frag_max_size; -nf_bridge_update_protocol (skb); - data =this_cpu_ptr (&brnf_frag_data_storage);if (skb_vlan_tag_present (skb)) {
@@ -789,8 +790,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buffIP6CB (skb)->frag_max_size = nf_bridge->frag_max_size; -nf_bridge_update_protocol (skb); - data =this_cpu_ptr (&brnf_frag_data_storage); data->encap_size =nf_bridge_encap_header_len (skb); data->size =ETH_HLEN + data->encap_size;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 61/320 arm64: dts: qcom: msm8916: fix MMC controller aliases
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit b0293c19d42f6d6951c2fab9a47fed50baf2c14d ]
Change sdhcN aliases to mmcN to make them actually work. Currently the board uses non-standard aliases sdhcN, which do not work, resulting in mmc0 and mmc1 hosts randomly changing indices between boots.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -2
@@ -16,8 +16,8 @@ #size-cells = <2>; aliases { - sdhc1 = &sdhc_1; /* SDC1 eMMC slot */ - sdhc2 = &sdhc_2; /* SDC2 SD card slot */ + mmc0 = &sdhc_1; /* SDC1 eMMC slot */ + mmc1 = &sdhc_2; /* SDC2 SD card slot */ }; chosen { };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 62/320 ACPI: EC: Rework flushing of EC work while suspended to idle
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 4a9af6cac050dce2e895ec3205c4615383ad9112 ]
The flushing of pending work in the EC driver uses drain_workqueue() to flush the event handling work that can requeue itself via advance_transaction(), but this is problematic, because that work may also be requeued from the query workqueue.
Namely, if an EC transaction is carried out during the execution of a query handler, it involves calling advance_transaction() which may queue up the event handling work again. This causes the kernel to complain about attempts to add a work item to the EC event workqueue while it is being drained and worst-case it may cause a valid event to be skipped.
To avoid this problem, introduce two new counters, events_in_progress and queries_in_progress, incremented when a work item is queued on the event workqueue or the query workqueue, respectively, and decremented at the end of the corresponding work function, and make acpi_ec_dispatch_gpe() the workqueues in a loop until the both of these counters are zero (or system wakeup is pending) instead of calling acpi_ec_flush_work().
At the same time, change __acpi_ec_flush_work() to call flush_workqueue() instead of drain_workqueue() to flush the event workqueue.
While at it, use the observation that the work item queued in acpi_ec_query() cannot be pending at that time, because it is used only once, to simplify the code in there.
Additionally, clean up a comment in acpi_ec_query() and adjust white space in acpi_ec_event_processor().
--- drivers/acpi/ec.c | 57 +++++++++++++++++++++++++++++++---------- drivers/acpi/internal.h | 2 ++ 2 files changed, 45 insertions(+), 14 deletions(-)
drivers/acpi/ec.c +43 -14
@@ -167,6 +167,7 @@ struct acpi_ec_query {struct transaction transaction;struct work_struct work;struct acpi_ec_query_handler *handler; +struct acpi_ec *ec; };static int acpi_ec_query (struct acpi_ec *ec,u8 *data);
@@ -462,6 +463,7 @@ static void acpi_ec_submit_query(struct acpi_ec *ec)ec_dbg_evt ("Command(%s) submitted/blocked" ,acpi_ec_cmd_string (ACPI_EC_COMMAND_QUERY )); ec->nr_pending_queries++; + ec->events_in_progress++;queue_work (ec_wq, &ec->work); } }
@@ -528,7 +530,7 @@ static void acpi_ec_enable_event(struct acpi_ec *ec)#ifdef CONFIG_PM_SLEEP static void __acpi_ec_flush_work (void ) { -drain_workqueue (ec_wq);/* flush ec->work */ +flush_workqueue (ec_wq);/* flush ec->work */ flush_workqueue (ec_query_wq);/* flush queries */ }
@@ -1119,7 +1121,7 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) }EXPORT_SYMBOL_GPL (acpi_ec_remove_query_handler); -static struct acpi_ec_query *acpi_ec_create_query (u8 *pval) +static struct acpi_ec_query *acpi_ec_create_query (struct acpi_ec *ec,u8 *pval) {struct acpi_ec_query *q;struct transaction *t;
@@ -1127,11 +1129,13 @@ static struct acpi_ec_query *acpi_ec_create_query(u8 *pval) q =kzalloc (sizeof (struct acpi_ec_query ),GFP_KERNEL );if (!q)return NULL ; +INIT_WORK (&q->work, acpi_ec_event_processor); t = &q->transaction; t->command =ACPI_EC_COMMAND_QUERY ; t->rdata = pval; t->rlen =1 ; + q->ec = ec;return q; }
@@ -1148,13 +1152,21 @@ static void acpi_ec_event_processor(struct work_struct *work) { struct acpi_ec_query *q = container_of(work, struct acpi_ec_query, work);struct acpi_ec_query_handler *handler = q->handler; +struct acpi_ec *ec = q->ec;ec_dbg_evt ("Query(0x%02x) started" , handler->query_bit); +if (handler->func) handler->func (handler->data);else if (handler->handle)acpi_evaluate_object (handler->handle,NULL ,NULL ,NULL ); +ec_dbg_evt ("Query(0x%02x) stopped" , handler->query_bit); + +spin_lock_irq (&ec->lock); + ec->queries_in_progress--; +spin_unlock_irq (&ec->lock); +acpi_ec_delete_query (q); }
@@ -1164,7 +1176,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data)int result;struct acpi_ec_query *q; - q =acpi_ec_create_query (&value); + q =acpi_ec_create_query (ec, &value);if (!q)return -ENOMEM ;
@@ -1186,19 +1198,20 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data) }/* -* It is reported that _Qxx are evaluated in a parallel way on -* Windows: +* It is reported that _Qxx are evaluated in a parallel way on Windows: * https://bugzilla.kernel.org/show_bug.cgi?id=94411 * -* Put this log entry before schedule_work() in order to make -* it appearing before any other log entries occurred during the -* work queue execution. +* Put this log entry before queue_work() to make it appear in the log +* before any other messages emitted during workqueue handling. */ ec_dbg_evt ("Query(0x%02x) scheduled" , value); -if (!queue_work (ec_query_wq, &q->work)) { -ec_dbg_evt ("Query(0x%02x) overlapped" , value); - result = -EBUSY ; - } + +spin_lock_irq (&ec->lock); + + ec->queries_in_progress++; +queue_work (ec_query_wq, &q->work); + +spin_unlock_irq (&ec->lock); err_exit:if (result)
@@ -1256,6 +1269,10 @@ static void acpi_ec_event_handler(struct work_struct *work)ec_dbg_evt ("Event stopped" );acpi_ec_check_event (ec); + +spin_lock_irqsave (&ec->lock, flags); + ec->events_in_progress--; +spin_unlock_irqrestore (&ec->lock, flags); } static u32 acpi_ec_gpe_handler(acpi_handle gpe_device,
@@ -1972,6 +1989,7 @@ void acpi_ec_set_gpe_wake_mask(u8 action)bool acpi_ec_dispatch_gpe (void ) { +bool work_in_progress;u32 ret;if (!first_ec)
@@ -1992,8 +2010,19 @@ bool acpi_ec_dispatch_gpe(void)if (ret ==ACPI_INTERRUPT_HANDLED )pm_pr_dbg ("EC GPE dispatched\n" ); -/* Flush the event and query workqueues. */ -acpi_ec_flush_work (); +/* Drain EC work. */ +do { +acpi_ec_flush_work (); + +pm_pr_dbg ("ACPI EC work flushed\n" ); + +spin_lock_irq (&first_ec->lock); + + work_in_progress = first_ec->events_in_progress + + first_ec->queries_in_progress >0 ; + +spin_unlock_irq (&first_ec->lock); + }while (work_in_progress && !pm_wakeup_pending ());return false; }
drivers/acpi/internal.h +2 -0
@@ -183,6 +183,8 @@ struct acpi_ec {struct work_struct work;unsigned long timestamp;unsigned long nr_pending_queries; +unsigned int events_in_progress; +unsigned int queries_in_progress;bool busy_polling;unsigned int polling_guard; };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 63/320 drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
[ Upstream commit b220110e4cd442156f36e1d9b4914bb9e87b0d00 ]
In amdgpu_connector_lcd_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, and there is a dereference of it in amdgpu_connector_lcd_native_mode(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate().
Fix this bug add a check of mode.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_DRM_AMDGPU=m show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +6 -0
@@ -389,6 +389,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder) native_mode->vdisplay != 0 && native_mode->clock != 0) { mode =drm_mode_duplicate (dev, native_mode); +if (!mode) +return NULL ; + mode->type =DRM_MODE_TYPE_PREFERRED |DRM_MODE_TYPE_DRIVER ;drm_mode_set_name (mode);
@@ -403,6 +406,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder)* simpler. */ mode =drm_cvt_mode (dev, native_mode->hdisplay, native_mode->vdisplay,60 , true, false, false); +if (!mode) +return NULL ; + mode->type =DRM_MODE_TYPE_PREFERRED |DRM_MODE_TYPE_DRIVER ;DRM_DEBUG_KMS ("Adding cvt approximation of native panel mode %s\n" , mode->name); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 64/320 drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
[ Upstream commit ab50cb9df8896b39aae65c537a30de2c79c19735 ]
In radeon_driver_open_kms(), radeon_vm_bo_add() is assigned to vm->ib_bo_va and passes and used in radeon_vm_bo_set_addr(). In radeon_vm_bo_set_addr(), there is a dereference of vm->ib_bo_va, which could lead to a NULL pointer dereference on failure of radeon_vm_bo_add().
Fix this bug by adding a check of vm->ib_bo_va.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_DRM_RADEON=m show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/gpu/drm/radeon/radeon_kms.c | 36 ++++++++++++++++------------- 1 file changed, 20 insertions(+), 16 deletions(-)
drivers/gpu/drm/radeon/radeon_kms.c +20 -16
@@ -634,6 +634,8 @@ void radeon_driver_lastclose_kms(struct drm_device *dev)int radeon_driver_open_kms (struct drm_device *dev,struct drm_file *file_priv) {struct radeon_device *rdev = dev->dev_private; +struct radeon_fpriv *fpriv; +struct radeon_vm *vm;int r; file_priv->driver_priv =NULL ;
@@ -646,8 +648,6 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)/* new gpu have virtual address space support */ if (rdev->family >=CHIP_CAYMAN ) { -struct radeon_fpriv *fpriv; -struct radeon_vm *vm; fpriv =kzalloc (sizeof (*fpriv),GFP_KERNEL );if (unlikely (!fpriv)) {
@@ -658,35 +658,39 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)if (rdev->accel_working) { vm = &fpriv->vm; r =radeon_vm_init (rdev, vm); -if (r) { -kfree (fpriv); - goto out_suspend; - } +if (r) + goto out_fpriv; r =radeon_bo_reserve (rdev->ring_tmp_bo.bo, false); -if (r) { -radeon_vm_fini (rdev, vm); -kfree (fpriv); - goto out_suspend; - } +if (r) + goto out_vm_fini;/* map the ib pool buffer read only into * virtual address space */ vm->ib_bo_va =radeon_vm_bo_add (rdev, vm, rdev->ring_tmp_bo.bo); +if (!vm->ib_bo_va) { + r = -ENOMEM ; + goto out_vm_fini; + } + r =radeon_vm_bo_set_addr (rdev, vm->ib_bo_va,RADEON_VA_IB_OFFSET ,RADEON_VM_PAGE_READABLE |RADEON_VM_PAGE_SNOOPED ); -if (r) { -radeon_vm_fini (rdev, vm); -kfree (fpriv); - goto out_suspend; - } +if (r) + goto out_vm_fini; } file_priv->driver_priv = fpriv; } +if (!r) + goto out_suspend; + +out_vm_fini: +radeon_vm_fini (rdev, vm); +out_fpriv: +kfree (fpriv); out_suspend:pm_runtime_mark_last_busy (dev->dev);pm_runtime_put_autosuspend (dev->dev);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 65/320 arm64: dts: ti: k3-j721e: Fix the L2 cache sets
In reply to Greg Kroah-HartmanFrom: Nishanth Menon <[email protected]>
[ Upstream commit e9ba3a5bc6fdc2c796c69fdaf5ed6c9957cf9f9d ]
A72's L2 cache[1] on J721e[2] is 1MB. A72's L2 is fixed line length of 64 bytes and 16-way set-associative cache structure.
1MB of L2 / 64 (line length) = 16384 ways
16384 ways / 16 = 1024 sets
Fix the l2 cache-sets.
[1] https://developer.arm.com/documentation/100095/0003/Level-2-Memory-System/About-the-L2-memory-system
[2] http://www.ti.com/lit/pdf/spruil1
--- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-j721e.dtsi +1 -1
@@ -84,7 +84,7 @@ cache-level = <2>; cache-size = <0x100000>; cache-line-size = <64>; - cache-sets = <2048>; + cache-sets = <1024>; next-level-cache = <&msmc_l3>; };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 66/320 tty: serial: uartlite: allow 64 bit address
In reply to Greg Kroah-HartmanFrom: Lizhi Hou <[email protected]>
[ Upstream commit 3672fb65155530b5eea6225685c75329b6debec3 ]
The base address of uartlite registers could be 64 bit address which is from device resource. When ulite_probe() calls ulite_assign(), this 64 bit address is casted to 32-bit. The fix is to replace "u32" type with "phys_addr_t" type for the base address in ulite_assign() argument list.
--- drivers/tty/serial/uartlite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/uartlite.c +1 -1
@@ -618,7 +618,7 @@ static struct uart_driver ulite_uart_driver = {* * Returns: 0 on success, <0 otherwise */ -static int ulite_assign (struct device *dev,int id,u32 base,int irq, +static int ulite_assign (struct device *dev,int id,phys_addr_t base,int irq,struct uartlite_data *pdata) {struct uart_port *port;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 67/320 serial: amba-pl011: do not request memory region twice
In reply to Greg Kroah-HartmanFrom: Lino Sanfilippo <[email protected]>
[ Upstream commit d1180405c7b5c7a1c6bde79d5fc24fe931430737 ]
With commit 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") the function devm_ioremap() called from pl011_setup_port() was replaced with devm_ioremap_resource(). Since this function not only remaps but also requests the ports io memory region it now collides with the .config_port() callback which requests the same region at uart port registration.
Since devm_ioremap_resource() already claims the memory successfully, the request in .config_port() fails.
Later at uart port deregistration the attempt to release the unclaimed memory also fails. The failure results in a “Trying to free nonexistent resource" warning.
Fix these issues by removing the callbacks that implement the redundant memory allocation/release. Also make sure that changing the drivers io memory base address via TIOCSSERIAL is not allowed any more.
--- drivers/tty/serial/amba-pl011.c | 27 +++------------------------ 1 file changed, 3 insertions(+), 24 deletions(-)
drivers/tty/serial/amba-pl011.c +3 -24
@@ -2094,32 +2094,13 @@ static const char *pl011_type(struct uart_port *port)return uap->port.type ==PORT_AMBA ? uap->type :NULL ; } -/* -* Release the memory region(s) being used by 'port' -*/ -static void pl011_release_port (struct uart_port *port) -{ -release_mem_region (port->mapbase,SZ_4K ); -} - -/* -* Request the memory region(s) being used by 'port' -*/ -static int pl011_request_port (struct uart_port *port) -{ -return request_mem_region (port->mapbase,SZ_4K ,"uart-pl011" ) - !=NULL ?0 : -EBUSY ; -} -/* * Configure/autoconfigure the port. */ static void pl011_config_port (struct uart_port *port,int flags) { -if (flags &UART_CONFIG_TYPE ) { +if (flags &UART_CONFIG_TYPE ) port->type =PORT_AMBA ; -pl011_request_port (port); - } }/*
@@ -2134,6 +2115,8 @@ static int pl011_verify_port(struct uart_port *port, struct serial_struct *ser) ret = -EINVAL ;if (ser->baud_base <9600 ) ret = -EINVAL ; +if (port->mapbase != (unsigned long ) ser->iomem_base) + ret = -EINVAL ;return ret; }
@@ -2151,8 +2134,6 @@ static const struct uart_ops amba_pl011_pops = { .flush_buffer = pl011_dma_flush_buffer, .set_termios = pl011_set_termios, .type = pl011_type, - .release_port = pl011_release_port, - .request_port = pl011_request_port, .config_port = pl011_config_port, .verify_port = pl011_verify_port,#ifdef CONFIG_CONSOLE_POLL
@@ -2182,8 +2163,6 @@ static const struct uart_ops sbsa_uart_pops = { .shutdown = sbsa_uart_shutdown, .set_termios = sbsa_uart_set_termios, .type = pl011_type, - .release_port = pl011_release_port, - .request_port = pl011_request_port, .config_port = pl011_config_port, .verify_port = pl011_verify_port,#ifdef CONFIG_CONSOLE_POLL
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 68/320 floppy: Fix hang in watchdog when disk is ejected
In reply to Greg Kroah-HartmanFrom: Tasos Sahanidis <[email protected]>
[ Upstream commit fb48febce7e30baed94dd791e19521abd2c3fd83 ]
When the watchdog detects a disk change, it calls cancel_activity(), which in turn tries to cancel the fd_timer delayed work.
In the above scenario, fd_timer_fn is set to fd_watchdog(), meaning it is trying to cancel its own work.
This results in a hang as cancel_delayed_work_sync() is waiting for the watchdog (itself) to return, which never happens.
This can be reproduced relatively consistently by attempting to read a broken floppy, and ejecting it while IO is being attempted and retried.
To resolve this, this patch calls cancel_delayed_work() instead, which cancels the work without waiting for the watchdog to return and finish.
Before this regression was introduced, the code in this section used del_timer(), and not del_timer_sync() to delete the watchdog timer.
--- drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/floppy.c +1 -1
@@ -1003,7 +1003,7 @@ static DECLARE_DELAYED_WORK(fd_timer, fd_timer_workfn);static void cancel_activity (void ) { do_floppy =NULL ; -cancel_delayed_work_sync (&fd_timer); +cancel_delayed_work (&fd_timer);cancel_work_sync (&floppy_work); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 69/320 staging: rtl8192e: return error code from rtllib_softmac_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 68bf78ff59a0891eb1239948e94ce10f73a9dd30 ]
If it fails to allocate 'dot11d_info', rtllib_softmac_init() should return error code. And remove unneccessary error message.
--- drivers/staging/rtl8192e/rtllib.h | 2 +- drivers/staging/rtl8192e/rtllib_softmac.c | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-)
drivers/staging/rtl8192e/rtllib.h +1 -1
@@ -1982,7 +1982,7 @@ void rtllib_softmac_xmit(struct rtllib_txb *txb, struct rtllib_device *ieee);void rtllib_stop_send_beacons (struct rtllib_device *ieee);void notify_wx_assoc_event (struct rtllib_device *ieee);void rtllib_start_ibss (struct rtllib_device *ieee); -void rtllib_softmac_init (struct rtllib_device *ieee); +int rtllib_softmac_init (struct rtllib_device *ieee);void rtllib_softmac_free (struct rtllib_device *ieee);void rtllib_disassociate (struct rtllib_device *ieee);void rtllib_stop_scan (struct rtllib_device *ieee);
drivers/staging/rtl8192e/rtllib_softmac.c +4 -2
@@ -2952,7 +2952,7 @@ void rtllib_start_protocol(struct rtllib_device *ieee) } } -void rtllib_softmac_init (struct rtllib_device *ieee) +int rtllib_softmac_init (struct rtllib_device *ieee) {int i;
@@ -2963,7 +2963,8 @@ void rtllib_softmac_init(struct rtllib_device *ieee) ieee->seq_ctrl[i] =0 ; ieee->dot11d_info =kzalloc (sizeof (struct rt_dot11d_info ),GFP_ATOMIC );if (!ieee->dot11d_info) -netdev_err (ieee->dev,"Can't alloc memory for DOT11D\n" ); +return -ENOMEM ; + ieee->LinkDetectInfo.SlotIndex =0 ; ieee->LinkDetectInfo.SlotNum =2 ; ieee->LinkDetectInfo.NumRecvBcnInPeriod =0 ;
@@ -3031,6 +3032,7 @@ void rtllib_softmac_init(struct rtllib_device *ieee) (void (*)(unsigned long )) rtllib_sta_ps, (unsigned long)ieee); +return 0 ; }void rtllib_softmac_free (struct rtllib_device *ieee)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 70/320 staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit e730cd57ac2dfe94bca0f14a3be8e1b21de41a9c ]
Some variables are leaked in the error handling in alloc_rtllib(), free the variables in the error path.
--- drivers/staging/rtl8192e/rtllib_module.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/staging/rtl8192e/rtllib_module.c +12 -4
@@ -88,7 +88,7 @@ struct net_device *alloc_rtllib(int sizeof_priv) err =rtllib_networks_allocate (ieee);if (err) {pr_err ("Unable to allocate beacon storage: %d\n" , err); - goto failed; + goto free_netdev; }rtllib_networks_initialize (ieee);
@@ -121,11 +121,13 @@ struct net_device *alloc_rtllib(int sizeof_priv) ieee->hwsec_active =0 ;memset (ieee->swcamtable,0 ,sizeof (struct sw_cam_table ) *32 ); -rtllib_softmac_init (ieee); + err =rtllib_softmac_init (ieee); +if (err) + goto free_crypt_info; ieee->pHTInfo =kzalloc (sizeof (struct rt_hi_throughput ),GFP_KERNEL );if (!ieee->pHTInfo) -return NULL ; + goto free_softmac;HTUpdateDefaultSetting (ieee);HTInitializeHTInfo (ieee);
@@ -141,8 +143,14 @@ struct net_device *alloc_rtllib(int sizeof_priv)return dev; - failed: +free_softmac: +rtllib_softmac_free (ieee); +free_crypt_info: +lib80211_crypt_info_free (&ieee->crypt_info); +rtllib_networks_free (ieee); +free_netdev:free_netdev (dev); +return NULL ; }EXPORT_SYMBOL (alloc_rtllib);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 71/320 Bluetooth: btmtksdio: fix resume failure
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 561ae1d46a8ddcbc13162d5771f5ed6c8249e730 ]
btmtksdio have to rely on MMC_PM_KEEP_POWER in pm_flags to avoid that SDIO power is being shut off during the device is in suspend. That fixes the SDIO command fails to access the bus after the device is resumed.
--- drivers/bluetooth/btmtksdio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btmtksdio.c +2 -0
@@ -1041,6 +1041,8 @@ static int btmtksdio_runtime_suspend(struct device *dev)if (!bdev)return 0 ; +sdio_set_host_pm_flags (func,MMC_PM_KEEP_POWER ); +sdio_claim_host (bdev->func);sdio_writel (bdev->func,C_FW_OWN_REQ_SET ,MTK_REG_CHLPCR , &err);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 72/320 media: dib8000: Fix a memleak in dib8000_init()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
[ Upstream commit 8dbdcc7269a83305ee9d677b75064d3530a48ee2 ]
In dib8000_init(), the variable fe is not freed or passed out on the failure of dib8000_identify(&state->i2c), which could lead to a memleak.
Fix this bug by adding a kfree of fe in the error path.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_DVB_DIB8000=m show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/media/dvb-frontends/dib8000.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/dib8000.c +3 -1
@@ -4473,8 +4473,10 @@ static struct dvb_frontend *dib8000_init(struct i2c_adapter *i2c_adap, u8 i2c_ad state->timf_default = cfg->pll->timf; -if (dib8000_identify (&state->i2c) ==0 ) +if (dib8000_identify (&state->i2c) ==0 ) { +kfree (fe); goto error; + }dibx000_init_i2c_master (&state->i2c_master,DIB8000 , state->i2c.adap, state->i2c.addr);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 73/320 media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
[ Upstream commit 0407c49ebe330333478440157c640fffd986f41b ]
In mxb_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. saa7146_vv_release() will be called on failure of mxb_probe(dev). There is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init().
Fix this bug by adding a check of saa7146_vv_init().
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_VIDEO_MXB=m show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/media/pci/saa7146/mxb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/pci/saa7146/mxb.c +7 -1
@@ -683,10 +683,16 @@ static struct saa7146_ext_vv vv_data;static int mxb_attach (struct saa7146_dev *dev,struct saa7146_pci_extension_data *info) {struct mxb *mxb; +int ret;DEB_EE ("dev:%p\n" , dev); -saa7146_vv_init (dev, &vv_data); + ret =saa7146_vv_init (dev, &vv_data); +if (ret) { +ERR ("Error in saa7146_vv_init()" ); +return ret; + } +if (mxb_probe (dev)) {saa7146_vv_release (dev);return -1 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 74/320 media: si2157: Fix "warm" tuner state detection
In reply to Greg Kroah-HartmanFrom: Robert Schlabbach <[email protected]>
[ Upstream commit a6441ea29cb2c9314654e093a1cd8020b9b851c8 ]
Commit e955f959ac52 ("media: si2157: Better check for running tuner in init") completely broke the "warm" tuner detection of the si2157 driver due to a simple endian error: The Si2157 CRYSTAL_TRIM property code is 0x0402 and needs to be transmitted LSB first. However, it was inserted MSB first, causing the warm detection to always fail and spam the kernel log with tuner initialization messages each time the DVB frontend device was closed and reopened:
[ 312.215682] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 312.264334] si2157 16-0060: firmware version: 3.0.5 [ 342.248593] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 342.295743] si2157 16-0060: firmware version: 3.0.5 [ 372.328574] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 372.385035] si2157 16-0060: firmware version: 3.0.5
Also, the reinitializations were observed disturb _other_ tuners on multi-tuner cards such as the Hauppauge WinTV-QuadHD, leading to missed or errored packets when one of the other DVB frontend devices on that card was opened.
Fix the order of the property code bytes to make the warm detection work again, also reducing the tuner initialization message in the kernel log to once per power-on, as well as fixing the interference with other tuners.
--- drivers/media/tuners/si2157.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/tuners/si2157.c +1 -1
@@ -80,7 +80,7 @@ static int si2157_init(struct dvb_frontend *fe)dev_dbg (&client->dev,"\n" );/* Try to get Xtal trim property, to verify tuner still running */ -memcpy (cmd.args,"\x15\x00\x04\x02" ,4 ); +memcpy (cmd.args,"\x15\x00\x02\x04" ,4 ); cmd.wlen =4 ; cmd.rlen =4 ; ret =si2157_cmd_execute (client, &cmd);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 75/320 sched/rt: Try to restart rt period timer when rt runtime exceeded
In reply to Greg Kroah-HartmanFrom: Li Hua <[email protected]>
[ Upstream commit 9b58e976b3b391c0cf02e038d53dd0478ed3013c ]
When rt_runtime is modified from -1 to a valid control value, it may cause the task to be throttled all the time. Operations like the following will trigger the bug. E.g:
1. echo -1 > /proc/sys/kernel/sched_rt_runtime_us
2. Run a FIFO task named A that executes while(1)
3. echo 950000 > /proc/sys/kernel/sched_rt_runtime_us
When rt_runtime is -1, The rt period timer will not be activated when task A enqueued. And then the task will be throttled after setting rt_runtime to 950,000. The task will always be throttled because the rt period timer is not activated.
--- kernel/sched/rt.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
kernel/sched/rt.c +18 -5
@@ -52,11 +52,8 @@ void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 period, u64 runtime) rt_b->rt_period_timer.function = sched_rt_period_timer; } -static void start_rt_bandwidth (struct rt_bandwidth *rt_b) +static inline void do_start_rt_bandwidth (struct rt_bandwidth *rt_b) { -if (!rt_bandwidth_enabled () || rt_b->rt_runtime ==RUNTIME_INF ) -return ; -raw_spin_lock (&rt_b->rt_runtime_lock);if (!rt_b->rt_period_active) { rt_b->rt_period_active =1 ;
@@ -75,6 +72,14 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b)raw_spin_unlock (&rt_b->rt_runtime_lock); } +static void start_rt_bandwidth (struct rt_bandwidth *rt_b) +{ +if (!rt_bandwidth_enabled () || rt_b->rt_runtime ==RUNTIME_INF ) +return ; + +do_start_rt_bandwidth (rt_b); +} +void init_rt_rq (struct rt_rq *rt_rq) {struct rt_prio_array *array;
@@ -983,13 +988,17 @@ static void update_curr_rt(struct rq *rq)for_each_sched_rt_entity (rt_se) {struct rt_rq *rt_rq =rt_rq_of_se (rt_se); +int exceeded;if (sched_rt_runtime (rt_rq) !=RUNTIME_INF ) {raw_spin_lock (&rt_rq->rt_runtime_lock); rt_rq->rt_time += delta_exec; -if (sched_rt_runtime_exceeded (rt_rq)) + exceeded =sched_rt_runtime_exceeded (rt_rq); +if (exceeded)resched_curr (rq);raw_spin_unlock (&rt_rq->rt_runtime_lock); +if (exceeded) +do_start_rt_bandwidth (sched_rt_bandwidth (rt_rq)); } } }
@@ -2659,8 +2668,12 @@ static int sched_rt_global_validate(void)static void sched_rt_do_global (void ) { +unsigned long flags; + +raw_spin_lock_irqsave (&def_rt_bandwidth.rt_runtime_lock, flags); def_rt_bandwidth.rt_runtime =global_rt_runtime (); def_rt_bandwidth.rt_period =ns_to_ktime (global_rt_period ()); +raw_spin_unlock_irqrestore (&def_rt_bandwidth.rt_runtime_lock, flags); } int sched_rt_handler(struct ctl_table *table, int write,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 76/320 rcu/exp: Mark current CPU as exp-QS in IPI loop second pass
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
[ Upstream commit 81f6d49cce2d2fe507e3fddcc4a6db021d9c2e7b ]
Expedited RCU grace periods invoke sync_rcu_exp_select_node_cpus(), which takes two passes over the leaf rcu_node structure's CPUs. The first pass gathers up the current CPU and CPUs that are in dynticks idle mode. The workqueue will report a quiescent state on their behalf later. The second pass sends IPIs to the rest of the CPUs, but excludes the current CPU, incorrectly assuming it has been included in the first pass's list of CPUs.
Unfortunately the current CPU may have changed between the first and second pass, due to the fact that the various rcu_node structures' ->lock fields have been dropped, thus momentarily enabling preemption. This means that if the second pass's CPU was not on the first pass's list, it will be ignored completely. There will be no IPI sent to it, and there will be no reporting of quiescent states on its behalf. Unfortunately, the expedited grace period will nevertheless be waiting for that CPU to report a quiescent state, but with that CPU having no reason to believe that such a report is needed.
The result will be an expedited grace period stall.
Fix this by no longer excluding the current CPU from consideration during the second pass.
--- kernel/rcu/tree_exp.h | 1 + 1 file changed, 1 insertion(+)
kernel/rcu/tree_exp.h +1 -0
@@ -382,6 +382,7 @@ retry_ipi:continue ; }if (get_cpu () == cpu) { + mask_ofl_test |= mask;put_cpu ();continue ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 77/320 mwifiex: Fix possible ABBA deadlock
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit 1b8bb8919ef81bfc8873d223b9361f1685f2106d ]
Quoting Jia-Ju Bai <[email protected]>:
mwifiex_dequeue_tx_packet()
spin_lock_bh(&priv->wmm.ra_list_spinlock); --> Line 1432 (Lock A)
mwifiex_send_addba()
spin_lock_bh(&priv->sta_list_spinlock); --> Line 608 (Lock B) mwifiex_process_sta_tx_pause()
spin_lock_bh(&priv->sta_list_spinlock); --> Line 398 (Lock B)
mwifiex_update_ralist_tx_pause()
spin_lock_bh(&priv->wmm.ra_list_spinlock); --> Line 941 (Lock A)Similar report for mwifiex_process_uap_tx_pause().
While the locking expectations in this driver are a bit unclear, the Fixed commit only intended to protect the sta_ptr, so we can drop the lock as soon as we're done with it.
IIUC, this deadlock cannot actually happen, because command event processing (which calls mwifiex_process_sta_tx_pause()) is sequentialized with TX packet processing (e.g., mwifiex_dequeue_tx_packet()) via the main loop (mwifiex_main_process()). But it's good not to leave this potential issue lurking.
--- drivers/net/wireless/marvell/mwifiex/sta_event.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/marvell/mwifiex/sta_event.c +6 -2
@@ -364,10 +364,12 @@ static void mwifiex_process_uap_tx_pause(struct mwifiex_private *priv, sta_ptr =mwifiex_get_sta_entry (priv, tp->peermac);if (sta_ptr && sta_ptr->tx_pause != tp->tx_pause) { sta_ptr->tx_pause = tp->tx_pause; +spin_unlock_bh (&priv->sta_list_spinlock);mwifiex_update_ralist_tx_pause (priv, tp->peermac, tp->tx_pause); + }else { +spin_unlock_bh (&priv->sta_list_spinlock); } -spin_unlock_bh (&priv->sta_list_spinlock); } }
@@ -399,11 +401,13 @@ static void mwifiex_process_sta_tx_pause(struct mwifiex_private *priv, sta_ptr =mwifiex_get_sta_entry (priv, tp->peermac);if (sta_ptr && sta_ptr->tx_pause != tp->tx_pause) { sta_ptr->tx_pause = tp->tx_pause; +spin_unlock_bh (&priv->sta_list_spinlock);mwifiex_update_ralist_tx_pause (priv, tp->peermac, tp->tx_pause); + }else { +spin_unlock_bh (&priv->sta_list_spinlock); } -spin_unlock_bh (&priv->sta_list_spinlock); } } }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 78/320 xfrm: fix a small bug in xfrm_sa_len()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 7770a39d7c63faec6c4f33666d49a8cb664d0482 ]
copy_user_offload() will actually push a struct struct xfrm_user_offload, which is different than (struct xfrm_state *)->xso
(struct xfrm_state_offload)
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -2816,7 +2816,7 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x)if (x->props.extra_flags) l +=nla_total_size (sizeof (x->props.extra_flags));if (x->xso.dev) - l +=nla_total_size (sizeof (x->xso)); + l +=nla_total_size (sizeof (struct xfrm_user_offload ));if (x->props.smark.v | x->props.smark.m) { l +=nla_total_size (sizeof (x->props.smark.v)); l +=nla_total_size (sizeof (x->props.smark.m));
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 79/320 crypto: stm32/cryp - fix xts and race condition in crypto_engine requests
In reply to Greg Kroah-HartmanFrom: Nicolas Toromanoff <[email protected]>
[ Upstream commit d703c7a994ee34b7fa89baf21631fca0aa9f17fc ]
Don't erase key:
If key is erased before the crypto_finalize_.*_request() call, some pending process will run with a key={ 0 }.
Moreover if the key is reset at end of request, it breaks xts chaining mode, as for last xts block (in case input len is not a multiple of block) a new AES request is started without calling again set_key().
--- drivers/crypto/stm32/stm32-cryp.c | 2 -- 1 file changed, 2 deletions(-)
drivers/crypto/stm32/stm32-cryp.c +0 -2
@@ -669,8 +669,6 @@ static void stm32_cryp_finish_req(struct stm32_cryp *cryp, int err)else crypto_finalize_ablkcipher_request (cryp->engine, cryp->req, err); - -memset (cryp->ctx->key,0 , cryp->ctx->keylen); }static int stm32_cryp_cpu_start (struct stm32_cryp *cryp)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 80/320 crypto: stm32/cryp - fix double pm exit
In reply to Greg Kroah-HartmanFrom: Nicolas Toromanoff <[email protected]>
[ Upstream commit 6c12e742785bf9333faf60bfb96575bdd763448e ]
Delete extraneous lines in probe error handling code: pm was disabled twice.
--- drivers/crypto/stm32/stm32-cryp.c | 2 -- 1 file changed, 2 deletions(-)
drivers/crypto/stm32/stm32-cryp.c +0 -2
@@ -2034,8 +2034,6 @@ err_engine1:list_del (&cryp->list);spin_unlock (&cryp_list.lock); -pm_runtime_disable (dev); -pm_runtime_put_noidle (dev);pm_runtime_disable (dev);pm_runtime_put_noidle (dev);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 81/320 crypto: stm32/cryp - fix lrw chaining mode
In reply to Greg Kroah-HartmanFrom: Nicolas Toromanoff <[email protected]>
[ Upstream commit fa97dc2d48b476ea98199d808d3248d285987e99 ]
This fixes the lrw autotest if lrw uses the CRYP as the AES block cipher provider (as ecb(aes)). At end of request, CRYP should not update the IV in case of ECB chaining mode. Indeed the ECB chaining mode never uses the IV, but the software LRW chaining mode uses the IV field as a counter and due to the (unexpected) update done by CRYP while the AES block process, the counter get a wrong value when the IV overflow.
--- drivers/crypto/stm32/stm32-cryp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/stm32/stm32-cryp.c +1 -1
@@ -639,7 +639,7 @@ static void stm32_cryp_finish_req(struct stm32_cryp *cryp, int err)/* Phase 4 : output tag */ err =stm32_cryp_read_auth_tag (cryp); -if (!err && (!(is_gcm (cryp) ||is_ccm (cryp)))) +if (!err && (!(is_gcm (cryp) ||is_ccm (cryp) ||is_ecb (cryp))))stm32_cryp_get_iv (cryp);if (cryp->sgs_copied) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 82/320 ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors
In reply to Greg Kroah-HartmanFrom: Christian Lamparter <[email protected]>
[ Upstream commit 4754eab7e5a78bdefe7a960c5c260c95ebbb5fa6 ]
Steven Maddox reported in the OpenWrt bugzilla, that his RaidSonic IB-NAS4220-B was no longer booting with the new OpenWrt 21.02 (uses linux 5.10's device-tree). However, it was working with the previous OpenWrt 19.07 series (uses 4.14).
|[ 5.548038] No RedBoot partition table detected in 30000000.flash |[ 5.618553] Searching for RedBoot partition table in 30000000.flash at offset 0x0 |[ 5.739093] No RedBoot partition table detected in 30000000.flash |... |[ 7.039504] Waiting for root device /dev/mtdblock3...
The provided bootlog shows that the RedBoot partition parser was looking for the partition table "at offset 0x0". Which is strange since the comment in the device-tree says it should be at 0xfe0000.
Further digging on the internet led to a review site that took some useful PCB pictures of their review unit back in February 2009. Their picture shows a Spansion S29GL128N11TFI01 flash chip.
Quoted 1 line
From Spansion's Datasheet:
"S29GL128N: One hundred twenty-eight 64 Kword (128 Kbyte) sectors" Steven also provided a "cat /sys/class/mtd/mtd0/erasesize" from his
unit: "131072".
With the 128 KiB Sector/Erasesize in mind. This patch changes the fis-index-block property to (0xfe0000 / 0x20000) = 0x7f.
Bugzilla: https://bugs.openwrt.org/index.php?do=details&task_id=4137
--- arch/arm/boot/dts/gemini-nas4220b.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/gemini-nas4220b.dts +1 -1
@@ -84,7 +84,7 @@ partitions { compatible = "redboot-fis"; /* Eraseblock at 0xfe0000 */ - fis-index-block = <0x1fc>; + fis-index-block = <0x7f>; }; };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 83/320 media: dw2102: Fix use after free
In reply to Greg Kroah-HartmanFrom: Anton Vasilyev <[email protected]>
[ Upstream commit 589a9f0eb799f77de2c09583bf5bad221fa5d685 ]
dvb_usb_device_init stores parts of properties at d->props and d->desc and uses it on dvb_usb_device_exit. Free of properties on module probe leads to use after free.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204597
The patch makes properties static instead of allocated on heap to prevent memleak and use after free.
Also fixes s421_properties.devices initialization to have 2 element instead of 6 copied from p7500_properties.
--- drivers/media/usb/dvb-usb/dw2102.c | 338 ++++++++++++++++++----------- 1 file changed, 215 insertions(+), 123 deletions(-)
drivers/media/usb/dvb-usb/dw2102.c +215 -123
@@ -2098,46 +2098,153 @@ static struct dvb_usb_device_properties s6x0_properties = { } }; -static const struct dvb_usb_device_description d1100 = { -"Prof 1100 USB " , - {&dw2102_table[PROF_1100 ],NULL }, - {NULL }, -}; +static struct dvb_usb_device_properties p1100_properties = { + .caps =DVB_USB_IS_AN_I2C_ADAPTER , + .usb_ctrl =DEVICE_SPECIFIC , + .size_of_priv =sizeof (struct dw2102_state ), + .firmware =P1100_FIRMWARE , + .no_reconnect =1 , -static const struct dvb_usb_device_description d660 = { -"TeVii S660 USB" , - {&dw2102_table[TEVII_S660 ],NULL }, - {NULL }, -}; + .i2c_algo = &s6x0_i2c_algo, + .rc.core = { + .rc_interval =150 , + .rc_codes =RC_MAP_TBS_NEC , + .module_name ="dw2102" , + .allowed_protos =RC_PROTO_BIT_NEC , + .rc_query = prof_rc_query, + }, -static const struct dvb_usb_device_description d480_1 = { -"TeVii S480.1 USB" , - {&dw2102_table[TEVII_S480_1 ],NULL }, - {NULL }, + .generic_bulk_ctrl_endpoint =0x81 , + .num_adapters =1 , + .download_firmware = dw2102_load_firmware, + .read_mac_address = s6x0_read_mac_address, + .adapter = { + { + .num_frontends =1 , + .fe = {{ + .frontend_attach = stv0288_frontend_attach, + .stream = { + .type =USB_BULK , + .count =8 , + .endpoint =0x82 , + .u = { + .bulk = { + .buffersize =4096 , + } + } + }, + } }, + } + }, + .num_device_descs =1 , + .devices = { + {"Prof 1100 USB " , + {&dw2102_table[PROF_1100 ],NULL }, + {NULL }, + }, + } }; -static const struct dvb_usb_device_description d480_2 = { -"TeVii S480.2 USB" , - {&dw2102_table[TEVII_S480_2 ],NULL }, - {NULL }, -}; +static struct dvb_usb_device_properties s660_properties = { + .caps =DVB_USB_IS_AN_I2C_ADAPTER , + .usb_ctrl =DEVICE_SPECIFIC , + .size_of_priv =sizeof (struct dw2102_state ), + .firmware =S660_FIRMWARE , + .no_reconnect =1 , -static const struct dvb_usb_device_description d7500 = { -"Prof 7500 USB DVB-S2" , - {&dw2102_table[PROF_7500 ],NULL }, - {NULL }, -}; + .i2c_algo = &s6x0_i2c_algo, + .rc.core = { + .rc_interval =150 , + .rc_codes =RC_MAP_TEVII_NEC , + .module_name ="dw2102" , + .allowed_protos =RC_PROTO_BIT_NEC , + .rc_query = dw2102_rc_query, + }, -static const struct dvb_usb_device_description d421 = { -"TeVii S421 PCI" , - {&dw2102_table[TEVII_S421 ],NULL }, - {NULL }, + .generic_bulk_ctrl_endpoint =0x81 , + .num_adapters =1 , + .download_firmware = dw2102_load_firmware, + .read_mac_address = s6x0_read_mac_address, + .adapter = { + { + .num_frontends =1 , + .fe = {{ + .frontend_attach = ds3000_frontend_attach, + .stream = { + .type =USB_BULK , + .count =8 , + .endpoint =0x82 , + .u = { + .bulk = { + .buffersize =4096 , + } + } + }, + } }, + } + }, + .num_device_descs =3 , + .devices = { + {"TeVii S660 USB" , + {&dw2102_table[TEVII_S660 ],NULL }, + {NULL }, + }, + {"TeVii S480.1 USB" , + {&dw2102_table[TEVII_S480_1 ],NULL }, + {NULL }, + }, + {"TeVii S480.2 USB" , + {&dw2102_table[TEVII_S480_2 ],NULL }, + {NULL }, + }, + } }; -static const struct dvb_usb_device_description d632 = { -"TeVii S632 USB" , - {&dw2102_table[TEVII_S632 ],NULL }, - {NULL }, +static struct dvb_usb_device_properties p7500_properties = { + .caps =DVB_USB_IS_AN_I2C_ADAPTER , + .usb_ctrl =DEVICE_SPECIFIC , + .size_of_priv =sizeof (struct dw2102_state ), + .firmware =P7500_FIRMWARE , + .no_reconnect =1 , + + .i2c_algo = &s6x0_i2c_algo, + .rc.core = { + .rc_interval =150 , + .rc_codes =RC_MAP_TBS_NEC , + .module_name ="dw2102" , + .allowed_protos =RC_PROTO_BIT_NEC , + .rc_query = prof_rc_query, + }, + + .generic_bulk_ctrl_endpoint =0x81 , + .num_adapters =1 , + .download_firmware = dw2102_load_firmware, + .read_mac_address = s6x0_read_mac_address, + .adapter = { + { + .num_frontends =1 , + .fe = {{ + .frontend_attach = prof_7500_frontend_attach, + .stream = { + .type =USB_BULK , + .count =8 , + .endpoint =0x82 , + .u = { + .bulk = { + .buffersize =4096 , + } + } + }, + } }, + } + }, + .num_device_descs =1 , + .devices = { + {"Prof 7500 USB DVB-S2" , + {&dw2102_table[PROF_7500 ],NULL }, + {NULL }, + }, + } };static struct dvb_usb_device_properties su3000_properties = {
@@ -2209,6 +2316,59 @@ static struct dvb_usb_device_properties su3000_properties = { } }; +static struct dvb_usb_device_properties s421_properties = { + .caps =DVB_USB_IS_AN_I2C_ADAPTER , + .usb_ctrl =DEVICE_SPECIFIC , + .size_of_priv =sizeof (struct dw2102_state ), + .power_ctrl = su3000_power_ctrl, + .num_adapters =1 , + .identify_state = su3000_identify_state, + .i2c_algo = &su3000_i2c_algo, + + .rc.core = { + .rc_interval =150 , + .rc_codes =RC_MAP_SU3000 , + .module_name ="dw2102" , + .allowed_protos =RC_PROTO_BIT_RC5 , + .rc_query = su3000_rc_query, + }, + + .read_mac_address = su3000_read_mac_address, + + .generic_bulk_ctrl_endpoint =0x01 , + + .adapter = { + { + .num_frontends =1 , + .fe = {{ + .streaming_ctrl = su3000_streaming_ctrl, + .frontend_attach = m88rs2000_frontend_attach, + .stream = { + .type =USB_BULK , + .count =8 , + .endpoint =0x82 , + .u = { + .bulk = { + .buffersize =4096 , + } + } + } + } }, + } + }, + .num_device_descs =2 , + .devices = { + {"TeVii S421 PCI" , + { &dw2102_table[TEVII_S421 ],NULL }, + {NULL }, + }, + {"TeVii S632 USB" , + { &dw2102_table[TEVII_S632 ],NULL }, + {NULL }, + }, + } +}; +static struct dvb_usb_device_properties t220_properties = { .caps =DVB_USB_IS_AN_I2C_ADAPTER , .usb_ctrl =DEVICE_SPECIFIC ,
@@ -2326,101 +2486,33 @@ static struct dvb_usb_device_properties tt_s2_4600_properties = {static int dw2102_probe (struct usb_interface *intf,const struct usb_device_id *id) { -int retval = -ENOMEM ; -struct dvb_usb_device_properties *p1100; -struct dvb_usb_device_properties *s660; -struct dvb_usb_device_properties *p7500; -struct dvb_usb_device_properties *s421; - - p1100 =kmemdup (&s6x0_properties, -sizeof (struct dvb_usb_device_properties ),GFP_KERNEL ); -if (!p1100) - goto err0; - -/* copy default structure */ -/* fill only different fields */ - p1100->firmware =P1100_FIRMWARE ; - p1100->devices[0 ] = d1100; - p1100->rc.core.rc_query = prof_rc_query; - p1100->rc.core.rc_codes =RC_MAP_TBS_NEC ; - p1100->adapter->fe[0 ].frontend_attach = stv0288_frontend_attach; - - s660 =kmemdup (&s6x0_properties, -sizeof (struct dvb_usb_device_properties ),GFP_KERNEL ); -if (!s660) - goto err1; - - s660->firmware =S660_FIRMWARE ; - s660->num_device_descs =3 ; - s660->devices[0 ] = d660; - s660->devices[1 ] = d480_1; - s660->devices[2 ] = d480_2; - s660->adapter->fe[0 ].frontend_attach = ds3000_frontend_attach; - - p7500 =kmemdup (&s6x0_properties, -sizeof (struct dvb_usb_device_properties ),GFP_KERNEL ); -if (!p7500) - goto err2; - - p7500->firmware =P7500_FIRMWARE ; - p7500->devices[0 ] = d7500; - p7500->rc.core.rc_query = prof_rc_query; - p7500->rc.core.rc_codes =RC_MAP_TBS_NEC ; - p7500->adapter->fe[0 ].frontend_attach = prof_7500_frontend_attach; - - - s421 =kmemdup (&su3000_properties, -sizeof (struct dvb_usb_device_properties ),GFP_KERNEL ); -if (!s421) - goto err3; - - s421->num_device_descs =2 ; - s421->devices[0 ] = d421; - s421->devices[1 ] = d632; - s421->adapter->fe[0 ].frontend_attach = m88rs2000_frontend_attach; - -if (0 ==dvb_usb_device_init (intf, &dw2102_properties, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, &dw2104_properties, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, &dw3101_properties, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, &s6x0_properties, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, p1100, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, s660, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, p7500, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, s421, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, &su3000_properties, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, &t220_properties, -THIS_MODULE ,NULL , adapter_nr) || -0 ==dvb_usb_device_init (intf, &tt_s2_4600_properties, -THIS_MODULE ,NULL , adapter_nr)) { - -/* clean up copied properties */ -kfree (s421); -kfree (p7500); -kfree (s660); -kfree (p1100); +if (!(dvb_usb_device_init (intf, &dw2102_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &dw2104_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &dw3101_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &s6x0_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &p1100_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &s660_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &p7500_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &s421_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &su3000_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &t220_properties, +THIS_MODULE ,NULL , adapter_nr) && +dvb_usb_device_init (intf, &tt_s2_4600_properties, +THIS_MODULE ,NULL , adapter_nr))) {return 0 ; } - retval = -ENODEV ; -kfree (s421); -err3: -kfree (p7500); -err2: -kfree (s660); -err1: -kfree (p1100); -err0: -return retval; +return -ENODEV ; }static void dw2102_disconnect (struct usb_interface *intf)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 84/320 media: msi001: fix possible null-ptr-deref in msi001_probe()
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 3d5831a40d3464eea158180eb12cbd81c5edfb6a ]
I got a null-ptr-deref report:
BUG: kernel NULL pointer dereference, address: 0000000000000060 ... RIP: 0010:v4l2_ctrl_auto_cluster+0x57/0x270 ... Call Trace: msi001_probe+0x13b/0x24b [msi001] spi_probe+0xeb/0x130
...
do_syscall_64+0x35/0xb0
In msi001_probe(), if the creation of control for bandwidth_auto fails, there will be a null-ptr-deref issue when it is used in v4l2_ctrl_auto_cluster().
Check dev->hdl.error before v4l2_ctrl_auto_cluster() to fix this bug.
--- drivers/media/tuners/msi001.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/media/tuners/msi001.c +7 -0
@@ -442,6 +442,13 @@ static int msi001_probe(struct spi_device *spi) V4L2_CID_RF_TUNER_BANDWIDTH_AUTO, 0, 1, 1, 1); dev->bandwidth =v4l2_ctrl_new_std (&dev->hdl, &msi001_ctrl_ops,V4L2_CID_RF_TUNER_BANDWIDTH ,200000 ,8000000 ,1 ,200000 ); +if (dev->hdl.error) { + ret = dev->hdl.error; +dev_err (&spi->dev,"Could not initialize controls\n" ); +/* control init failed, free handler */ + goto err_ctrl_handler_free; + } +v4l2_ctrl_auto_cluster (2 , &dev->bandwidth_auto,0 , false); dev->lna_gain =v4l2_ctrl_new_std (&dev->hdl, &msi001_ctrl_ops,V4L2_CID_RF_TUNER_LNA_GAIN ,0 ,1 ,1 ,1 );
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 85/320 media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 43f0633f89947df57fe0b5025bdd741768007708 ]
The return value of dma_set_coherent_mask() is not always 0. To catch the exception in case that dma is not support the mask.
--- drivers/media/platform/coda/imx-vdoa.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/media/platform/coda/imx-vdoa.c +5 -1
@@ -287,7 +287,11 @@ static int vdoa_probe(struct platform_device *pdev)struct resource *res;int ret; -dma_set_coherent_mask (&pdev->dev,DMA_BIT_MASK (32 )); + ret =dma_set_coherent_mask (&pdev->dev,DMA_BIT_MASK (32 )); +if (ret) { +dev_err (&pdev->dev,"DMA enable failed\n" ); +return ret; + } vdoa =devm_kzalloc (&pdev->dev,sizeof (*vdoa),GFP_KERNEL );if (!vdoa)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 86/320 drm/msm/dpu: fix safe status debugfs file
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit f31b0e24d31e18b4503eeaf0032baeacc0beaff6 ]
Make safe_status debugfs fs file actually return safe status rather than danger status data.
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +2 -2
@@ -88,8 +88,8 @@ static int _dpu_danger_signal_status(struct seq_file *s, &status); }else {seq_puts (s,"\nSafe signal status:\n" ); -if (kms->hw_mdp->ops.get_danger_status) - kms->hw_mdp->ops.get_danger_status (kms->hw_mdp, +if (kms->hw_mdp->ops.get_safe_status) + kms->hw_mdp->ops.get_safe_status (kms->hw_mdp, &status); }pm_runtime_put_sync (&kms->pdev->dev);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 87/320 drm/bridge: ti-sn65dsi86: Set max register for regmap
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
[ Upstream commit 0b665d4af35837f0a0ae63135b84a3c187c1db3b ]
Set the maximum register to 0xff so we can dump the registers for this device in debugfs.
--- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/bridge/ti-sn65dsi86.c +1 -0
@@ -115,6 +115,7 @@ static const struct regmap_config ti_sn_bridge_regmap_config = { .val_bits = 8, .volatile_table = &ti_sn_bridge_volatile_table, .cache_type = REGCACHE_NONE, + .max_register = 0xFF, }; static void ti_sn_bridge_write_u16(struct ti_sn_bridge *pdata,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 88/320 media: hantro: Fix probe func error path
In reply to Greg Kroah-HartmanFrom: Jernej Skrabec <[email protected]>
[ Upstream commit 37af43b250fda6162005d47bf7c959c70d52b107 ]
If clocks for some reason couldn't be enabled, probe function returns immediately, without disabling PM. This obviously leaves PM ref counters unbalanced.
Fix that by jumping to appropriate error path, so effects of PM functions are reversed.
--- drivers/staging/media/hantro/hantro_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/media/hantro/hantro_drv.c +2 -1
@@ -823,7 +823,7 @@ static int hantro_probe(struct platform_device *pdev) ret =clk_bulk_prepare (vpu->variant->num_clocks, vpu->clocks);if (ret) {dev_err (&pdev->dev,"Failed to prepare clocks\n" ); -return ret; + goto err_pm_disable; } ret =v4l2_device_register (&pdev->dev, &vpu->v4l2_dev);
@@ -879,6 +879,7 @@ err_v4l2_unreg:v4l2_device_unregister (&vpu->v4l2_dev); err_clk_unprepare:clk_bulk_unprepare (vpu->variant->num_clocks, vpu->clocks); +err_pm_disable:pm_runtime_dont_use_autosuspend (vpu->dev);pm_runtime_disable (vpu->dev);return ret;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 89/320 xfrm: interface with if_id 0 should return error
In reply to Greg Kroah-HartmanFrom: Antony Antony <[email protected]>
[ Upstream commit 8dce43919566f06e865f7e8949f5c10d8c2493f5 ]
xfrm interface if_id = 0 would cause xfrm policy lookup errors since Commit 9f8550e4bd9d.
Now explicitly fail to create an xfrm interface when if_id = 0
With this commit:
ip link add ipsec0 type xfrm dev lo if_id 0
Error: if_id must be non zero.
v1->v2 change:
- add Fixes: tag
--- net/xfrm/xfrm_interface.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/xfrm/xfrm_interface.c +12 -2
@@ -659,11 +659,16 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev, struct netlink_ext_ack *extack) {struct net *net =dev_net (dev); -struct xfrm_if_parms p; +struct xfrm_if_parms p = {};struct xfrm_if *xi;int err;xfrmi_netlink_parms (data, &p); +if (!p.if_id) { +NL_SET_ERR_MSG (extack,"if_id must be non zero" ); +return -EINVAL ; + } + xi =xfrmi_locate (net, &p);if (xi)return -EEXIST ;
@@ -688,7 +693,12 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], {struct xfrm_if *xi =netdev_priv (dev);struct net *net = xi->net; -struct xfrm_if_parms p; +struct xfrm_if_parms p = {}; + +if (!p.if_id) { +NL_SET_ERR_MSG (extack,"if_id must be non zero" ); +return -EINVAL ; + }xfrmi_netlink_parms (data, &p); xi =xfrmi_locate (net, &p);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 90/320 xfrm: state and policy should fail if XFRMA_IF_ID 0
In reply to Greg Kroah-HartmanFrom: Antony Antony <[email protected]>
[ Upstream commit 68ac0f3810e76a853b5f7b90601a05c3048b8b54 ]
xfrm ineterface does not allow xfrm if_id = 0
fail to create or update xfrm state and policy.
With this commit:
ip xfrm policy add src 192.0.2.1 dst 192.0.2.2 dir out if_id 0 RTNETLINK answers: Invalid argument
ip xfrm state add src 192.0.2.1 dst 192.0.2.2 proto esp spi 1 \
reqid 1 mode tunnel aead 'rfc4106(gcm(aes))' \
0x1111111111111111111111111111111111111111 96 if_id 0RTNETLINK answers: Invalid argument
v1->v2 change:
- add Fixes: tag
--- net/xfrm/xfrm_user.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
net/xfrm/xfrm_user.c +18 -3
@@ -621,8 +621,13 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,xfrm_smark_init (attrs, &x->props.smark); -if (attrs[XFRMA_IF_ID ]) +if (attrs[XFRMA_IF_ID ]) { x->if_id =nla_get_u32 (attrs[XFRMA_IF_ID ]); +if (!x->if_id) { + err = -EINVAL ; + goto error; + } + } err =__xfrm_init_state (x, false, attrs[XFRMA_OFFLOAD_DEV ]);if (err)
@@ -1328,8 +1333,13 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, mark =xfrm_mark_get (attrs, &m); -if (attrs[XFRMA_IF_ID ]) +if (attrs[XFRMA_IF_ID ]) { if_id =nla_get_u32 (attrs[XFRMA_IF_ID ]); +if (!if_id) { + err = -EINVAL ; + goto out_noput; + } + }if (p->info.seq) { x =xfrm_find_acq_byseq (net, mark, p->info.seq);
@@ -1631,8 +1641,13 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_usxfrm_mark_get (attrs, &xp->mark); -if (attrs[XFRMA_IF_ID ]) +if (attrs[XFRMA_IF_ID ]) { xp->if_id =nla_get_u32 (attrs[XFRMA_IF_ID ]); +if (!xp->if_id) { + err = -EINVAL ; + goto error; + } + }return xp; error:
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 91/320 ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit a92882a4d270fbcc021ee6848de5e48b7f0d27f3 ]
In the decompressor's head.S we need to start with an instruction that is some kind of NOP, but also mimics as the PE/COFF header, when the kernel is linked as an UEFI application. The clever solution here is "tstne r0, #0x4d000", which in the worst case just clobbers the condition flags, and bears the magic "MZ" signature in the lowest 16 bits.
However the encoding used (0x13105a4d) is actually not valid, since bits [15:12] are supposed to be 0 (written as "(0)" in the ARM ARM). Violating this is UNPREDICTABLE, and *can* trigger an UNDEFINED exception. Common Cortex cores seem to ignore those bits, but QEMU chooses to trap, so the code goes fishing because of a missing exception handler at this point. We are just saved by the fact that commonly (with -kernel or when running from U-Boot) the "Z" bit is set, so the instruction is never executed. See [0] for more details.
To make things more robust and avoid UNPREDICTABLE behaviour in the kernel code, lets replace this with a "two-instruction NOP":
The first instruction is an exclusive OR, the effect of which the second instruction reverts. This does not leave any trace, neither in a register nor in the condition flags. Also it's a perfectly valid encoding. Kudos to Peter Maydell for coming up with this gem.
[0] https://lore.kernel.org/qemu-devel/YTPIdbUCmwagL5%[email protected]/T/
--- arch/arm/boot/compressed/efi-header.S | 22 ++++++++++++++-------- arch/arm/boot/compressed/head.S | 3 ++- 2 files changed, 16 insertions(+), 9 deletions(-)
arch/arm/boot/compressed/efi-header.S +14 -8
@@ -9,16 +9,22 @@ #include <linux/sizes.h> .macro __nop -#ifdef CONFIG_EFI_STUB - @ This is almost but not quite a NOP, since it does clobber the - @ condition flags. But it is the best we can do for EFI, since - @ PE/COFF expects the magic string "MZ" at offset 0, while the - @ ARM/Linux boot protocol expects an executable instruction - @ there. - .inst MZ_MAGIC | (0x1310 << 16) @ tstne r0, #0x4d000 -#else AR_CLASS( mov r0, r0 ) M_CLASS( nop.w ) + .endm + + .macro __initial_nops +#ifdef CONFIG_EFI_STUB + @ This is a two-instruction NOP, which happens to bear the + @ PE/COFF signature "MZ" in the first two bytes, so the kernel + @ is accepted as an EFI binary. Booting via the UEFI stub + @ will not execute those instructions, but the ARM/Linux + @ boot protocol does, so we need some NOPs here. + .inst MZ_MAGIC | (0xe225 << 16) @ eor r5, r5, 0x4d000 + eor r5, r5, 0x4d000 @ undo previous insn +#else + __nop + __nop #endif .endm
arch/arm/boot/compressed/head.S +2 -1
@@ -165,7 +165,8 @@ start: * were patching the initial instructions of the kernel, i.e * had started to exploit this "patch area". */ - .rept 7 + __initial_nops + .rept 5 __nop .endr #ifndef CONFIG_THUMB2_KERNEL
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 92/320 usb: ftdi-elan: fix memory leak on device disconnect
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 1646566b5e0c556f779180a8514e521ac735de1e ]
'ftdi' is alloced when probe device, but not free on device disconnect, this cause a memory leak as follows:
unreferenced object 0xffff88800d584000 (size 8400):
comm "kworker/0:2", pid 3809, jiffies 4295453055 (age 13.784s) hex dump (first 32 bytes):
00 40 58 0d 80 88 ff ff 00 40 58 0d 80 88 ff ff .@X......@X.....
00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N..
backtrace:
[<000000000d47f947>] kmalloc_order_trace+0x19/0x110 mm/slab_common.c:960
[<000000008548ac68>] ftdi_elan_probe+0x8c/0x880 drivers/usb/misc/ftdi-elan.c:2647
[<000000007f73e422>] usb_probe_interface+0x31b/0x800 drivers/usb/core/driver.c:396
[<00000000fe8d07fc>] really_probe+0x299/0xc30 drivers/base/dd.c:517
[<0000000005da7d32>] __driver_probe_device+0x357/0x500 drivers/base/dd.c:751
[<000000003c2c9579>] driver_probe_device+0x4e/0x140 drivers/base/dd.c:781Fix it by freeing 'ftdi' after nobody use it.
--- drivers/usb/misc/ftdi-elan.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/ftdi-elan.c +1 -0
@@ -202,6 +202,7 @@ static void ftdi_elan_delete(struct kref *kref)mutex_unlock (&ftdi_module_lock);kfree (ftdi->bulk_in_buffer); ftdi->bulk_in_buffer =NULL ; +kfree (ftdi); }static void ftdi_elan_put_kref (struct usb_ftdi *ftdi)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 93/320 ARM: dts: armada-38x: Add generic compatible to UART nodes
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
[ Upstream commit 62480772263ab6b52e758f2346c70a526abd1d28 ]
Add generic compatible string "ns16550a" to serial port nodes of Armada 38x.
This makes it possible to use earlycon.
--- arch/arm/boot/dts/armada-38x.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/armada-38x.dtsi +2 -2
@@ -165,7 +165,7 @@ }; uart0: serial@12000 { - compatible = "marvell,armada-38x-uart"; + compatible = "marvell,armada-38x-uart", "ns16550a"; reg = <0x12000 0x100>; reg-shift = <2>; interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
@@ -175,7 +175,7 @@ }; uart1: serial@12100 { - compatible = "marvell,armada-38x-uart"; + compatible = "marvell,armada-38x-uart", "ns16550a"; reg = <0x12100 0x100>; reg-shift = <2>; interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 94/320 mmc: meson-mx-sdio: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 8fc9a77bc64e1f23d07953439817d8402ac9706f ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_threaded_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_threaded_irq() with the invalid IRQ #s.
--- drivers/mmc/host/meson-mx-sdio.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/mmc/host/meson-mx-sdio.c +5 -0
@@ -665,6 +665,11 @@ static int meson_mx_mmc_probe(struct platform_device *pdev) } irq =platform_get_irq (pdev,0 ); +if (irq <0 ) { + ret = irq; + goto error_free_mmc; + } + ret = devm_request_threaded_irq(host->controller_dev, irq, meson_mx_mmc_irq, meson_mx_mmc_irq_thread, IRQF_ONESHOT,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 95/320 selinux: fix potential memleak in selinux_add_opt()
In reply to Greg Kroah-HartmanFrom: Bernard Zhao <[email protected]>
[ Upstream commit 2e08df3c7c4e4e74e3dd5104c100f0bf6288aaa8 ]
This patch try to fix potential memleak in error branch.
--- security/selinux/hooks.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
security/selinux/hooks.c +10 -2
@@ -995,18 +995,22 @@ out:static int selinux_add_opt (int token,const char *s,void **mnt_opts) {struct selinux_mnt_opts *opts = *mnt_opts; +bool is_alloc_opts = false;if (token == Opt_seclabel)/* eaten and completely ignored */ return 0 ; +if (!s) +return -ENOMEM ; +if (!opts) { opts =kzalloc (sizeof (struct selinux_mnt_opts ),GFP_KERNEL );if (!opts)return -ENOMEM ; *mnt_opts = opts; + is_alloc_opts = true; } -if (!s) -return -ENOMEM ; +switch (token) {case Opt_context:if (opts->context || opts->defcontext)
@@ -1031,6 +1035,10 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts) }return 0 ; Einval: +if (is_alloc_opts) { +kfree (opts); + *mnt_opts =NULL ; + }pr_warn (SEL_MOUNT_FAIL_MSG );return -EINVAL ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 96/320 bpftool: Enable line buffering for stdout
In reply to Greg Kroah-HartmanFrom: Paul Chaignon <[email protected]>
[ Upstream commit 1a1a0b0364ad291bd8e509da104ac8b5b1afec5d ]
The output of bpftool prog tracelog is currently buffered, which is inconvenient when piping the output into other commands. A simple tracelog | grep will typically not display anything. This patch fixes it by enabling line buffering on stdout for the whole bpftool binary.
--- tools/bpf/bpftool/main.c | 2 ++ 1 file changed, 2 insertions(+)
tools/bpf/bpftool/main.c +2 -0
@@ -362,6 +362,8 @@ int main(int argc, char **argv) };int opt, ret; +setlinebuf (stdout); + last_do_help = do_help; pretty_output = false; json_output = false;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 97/320 x86/mce/inject: Avoid out-of-bounds write when setting flags
In reply to Greg Kroah-HartmanFrom: Zhang Zixun <[email protected]>
[ Upstream commit de768416b203ac84e02a757b782a32efb388476f ]
A contrived zero-length write, for example, by using write(2):
... ret = write(fd, str, 0); ...
to the "flags" file causes:
BUG: KASAN: stack-out-of-bounds in flags_write Write of size 1 at addr ffff888019be7ddf by task writefile/3787 CPU: 4 PID: 3787 Comm: writefile Not tainted 5.16.0-rc7+ #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
due to accessing buf one char before its start.
Prevent such out-of-bounds access.
[ bp: Productize into a proper patch. Link below is the next best
thing because the original mail didn't get archived on lore. ]
--- arch/x86/kernel/cpu/mce/inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/mce/inject.c +1 -1
@@ -347,7 +347,7 @@ static ssize_t flags_write(struct file *filp, const char __user *ubuf,char buf[MAX_FLAG_OPT_SIZE ], *__buf;int err; -if (cnt >MAX_FLAG_OPT_SIZE ) +if (!cnt || cnt >MAX_FLAG_OPT_SIZE )return -EINVAL ;if (copy_from_user (&buf, ubuf, cnt))
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 98/320 ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit f85196bdd5a50da74670250564740fc852b3c239 ]
BCM4752 and LNV4752 ACPI nodes describe a Broadcom 4752 GPS module attached to an UART of the system.
The GPS modules talk a custom protocol which only works with a closed- source Android gpsd daemon which knows this protocol.
The ACPI nodes also describe GPIOs to turn the GPS on/off these are handled by the net/rfkill/rfkill-gpio.c code. This handling predates the addition of enumeration of ACPI instantiated serdevs to the kernel and was broken by that addition, because the ACPI scan code now no longer instantiates platform_device-s for these nodes.
Rename the i2c_multi_instantiate_ids HID list to ignore_serial_bus_ids and add the BCM4752 and LNV4752 HIDs, so that rfkill-gpio gets a platform_device to bind to again; and so that a tty cdev for gpsd gets created for these.
--- drivers/acpi/scan.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/acpi/scan.c +10 -3
@@ -1577,6 +1577,7 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) {struct list_head resource_list;bool is_serial_bus_slave = false; +static const struct acpi_device_id ignore_serial_bus_ids[] = {/* * These devices have multiple I2cSerialBus resources and an i2c-client * must be instantiated for each, each with its own i2c_device_id.
@@ -1585,11 +1586,18 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)* drivers/platform/x86/i2c-multi-instantiate.c driver, which knows * which i2c_device_id to use for each resource. */ -static const struct acpi_device_id i2c_multi_instantiate_ids[] = { {"BSG1160", }, {"BSG2150", }, {"INT33FE", }, {"INT3515", }, + /* + * HIDs of device with an UartSerialBusV2 resource for which userspace + * expects a regular tty cdev to be created (instead of the in kernel + * serdev) and which have a kernel driver which expects a platform_dev + * such as the rfkill-gpio driver. + */ + {"BCM4752", }, + {"LNV4752", }, {} };
@@ -1603,8 +1611,7 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) fwnode_property_present(&device->fwnode, "baud")))return true; -/* Instantiate a pdev for the i2c-multi-instantiate drv to bind to */ -if (!acpi_match_device_ids (device, i2c_multi_instantiate_ids)) +if (!acpi_match_device_ids (device, ignore_serial_bus_ids))return false;INIT_LIST_HEAD (&resource_list);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 99/320 pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
[ Upstream commit ca0fe0d7c35c97528bdf621fdca75f13157c27af ]
In __nonstatic_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource().
Fix this bug by adding a check of res.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_PCCARD_NONSTATIC=y show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pcmcia/rsrc_nonstatic.c +3 -0
@@ -690,6 +690,9 @@ static struct resource *__nonstatic_find_io_region(struct pcmcia_socket *s,unsigned long min = base;int ret; +if (!res) +return NULL ; + data.mask = align -1 ; data.offset = base & data.mask; data.map = &s_data->io_db;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 100/320 pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
[ Upstream commit 977d2e7c63c3d04d07ba340b39987742e3241554 ]
In nonstatic_find_mem_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource().
Fix this bug by adding a check of res.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_PCCARD_NONSTATIC=y show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pcmcia/rsrc_nonstatic.c +3 -0
@@ -812,6 +812,9 @@ static struct resource *nonstatic_find_mem_region(u_long base, u_long num,unsigned long min, max;int ret, i, j; +if (!res) +return NULL ; + low = low || !(s->features &SS_CAP_PAGE_REGS ); data.mask = align -1 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 101/320 netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()
In reply to Greg Kroah-HartmanFrom: Xin Xiong <[email protected]>
[ Upstream commit d94a69cb2cfa77294921aae9afcfb866e723a2da ]
The issue takes place in one error path of clusterip_tg_check(). When memcmp() returns nonzero, the function simply returns the error code, forgetting to decrease the reference count of a clusterip_config object, which is bumped earlier by clusterip_config_find_get(). This may incur reference count leak.
Fix this issue by decrementing the refcount of the object in specific error path.
--- net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/ipv4/netfilter/ipt_CLUSTERIP.c +4 -1
@@ -505,8 +505,11 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)if (IS_ERR (config))return PTR_ERR (config); } - }else if (memcmp (&config->clustermac, &cipinfo->clustermac,ETH_ALEN )) + }else if (memcmp (&config->clustermac, &cipinfo->clustermac,ETH_ALEN )) { +clusterip_config_entry_put (config); +clusterip_config_put (config);return -EINVAL ; + } ret =nf_ct_netns_get (par->net, par->family);if (ret <0 ) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 102/320 bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 04c350b1ae6bdb12b84009a4d0bf5ab4e621c47b ]
The commit 4057765f2dee ("sock: consistent handling of extreme SO_SNDBUF/SO_RCVBUF values") added a change to prevent underflow in setsockopt() around SO_SNDBUF/SO_RCVBUF.
This patch adds the same change to _bpf_setsockopt().
--- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/filter.c +2 -0
@@ -4248,12 +4248,14 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,switch (optname) {case SO_RCVBUF : val =min_t (u32, val, sysctl_rmem_max); + val =min_t (int, val,INT_MAX /2 ); sk->sk_userlocks |=SOCK_RCVBUF_LOCK ;WRITE_ONCE (sk->sk_rcvbuf,max_t (int, val *2 ,SOCK_MIN_RCVBUF ));break ;case SO_SNDBUF : val =min_t (u32, val, sysctl_wmem_max); + val =min_t (int, val,INT_MAX /2 ); sk->sk_userlocks |=SOCK_SNDBUF_LOCK ;WRITE_ONCE (sk->sk_sndbuf,max_t (int, val *2 ,SOCK_MIN_SNDBUF ));
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 103/320 ppp: ensure minimum packet size in ppp_write()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 44073187990d5629804ce0627525f6ea5cfef171 ]
It seems pretty clear ppp layer assumed user space would always be kind to provide enough data in their write() to a ppp device.
This patch makes sure user provides at least 2 bytes.
It adds PPP_PROTO_LEN macro that could replace in net-next many occurrences of hard-coded 2 value.
I replaced only one occurrence to ease backports to stable kernels.
The bug manifests in the following report:
BUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640 ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661 ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
Uninit was created at:
slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/net/ppp/ppp_generic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ppp/ppp_generic.c +6 -1
@@ -69,6 +69,8 @@#define MPHDRLEN 6/* multilink protocol header length */ #define MPHDRLEN_SSN 4/* ditto with short sequence numbers */ +#define PPP_PROTO_LEN 2 +/* * An instance of /dev/ppp can be associated with either a ppp * interface unit or a ppp channel. In both cases, file->private_data
@@ -498,6 +500,9 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,if (!pf)return -ENXIO ; +/* All PPP packets should start with the 2-byte protocol */ +if (count <PPP_PROTO_LEN ) +return -EINVAL ; ret = -ENOMEM ; skb =alloc_skb (count + pf->hdrlen,GFP_KERNEL );if (!skb)
@@ -1544,7 +1549,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) } ++ppp->stats64.tx_packets; - ppp->stats64.tx_bytes += skb->len -2 ; + ppp->stats64.tx_bytes += skb->len -PPP_PROTO_LEN ;switch (proto) {case PPP_IP :
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 104/320 rocker: fix a sleeping in atomic bug
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 43d012123122cc69feacab55b71369f386c19566 ]
This code is holding the &ofdpa->flow_tbl_lock spinlock so it is not allowed to sleep. That means we have to pass the OFDPA_OP_FLAG_NOWAIT flag to ofdpa_flow_tbl_del().
--- drivers/net/ethernet/rocker/rocker_ofdpa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/rocker/rocker_ofdpa.c +2 -1
@@ -2795,7 +2795,8 @@ static void ofdpa_fib4_abort(struct rocker *rocker)if (!ofdpa_port)continue ; nh->fib_nh_flags &= ~RTNH_F_OFFLOAD ; -ofdpa_flow_tbl_del (ofdpa_port,OFDPA_OP_FLAG_REMOVE , +ofdpa_flow_tbl_del (ofdpa_port, +OFDPA_OP_FLAG_REMOVE |OFDPA_OP_FLAG_NOWAIT , flow_entry); }spin_unlock_irqrestore (&ofdpa->flow_tbl_lock, flags);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 105/320 staging: greybus: audio: Check null pointer
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 2e81948177d769106754085c3e03534e6cc1f623 ]
As the possible alloc failure of devm_kcalloc(), it could return null pointer.
Therefore, 'strings' should be checked and return NULL if alloc fails to prevent the dereference of the NULL pointer.
Also, the caller should also deal with the return value of the gb_generate_enum_strings() and return -ENOMEM if returns NULL. Moreover, because the memory allocated with devm_kzalloc() will be freed automatically when the last reference to the device is dropped, the 'gbe' in gbaudio_tplg_create_enum_kctl() and gbaudio_tplg_create_enum_ctl() do not need to free manually. But the 'control' in gbaudio_tplg_create_widget() and gbaudio_tplg_process_kcontrols() has a specially error handle to cleanup.
So it should be better to cleanup 'control' when fails.
--- drivers/staging/greybus/audio_topology.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/staging/greybus/audio_topology.c +15 -0
@@ -145,6 +145,9 @@ static const char **gb_generate_enum_strings(struct gbaudio_module_info *gb, items =le32_to_cpu (gbenum->items); strings =devm_kcalloc (gb->dev, items,sizeof (char *),GFP_KERNEL ); +if (!strings) +return NULL ; + data = gbenum->names;for (i =0 ; i < items; i++) {
@@ -662,6 +665,8 @@ static int gbaudio_tplg_create_enum_kctl(struct gbaudio_module_info *gb,/* since count=1, and reg is dummy */ gbe->max =le32_to_cpu (gb_enum->items); gbe->texts =gb_generate_enum_strings (gb, gb_enum); +if (!gbe->texts) +return -ENOMEM ;/* debug enum info */ dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max,
@@ -871,6 +876,8 @@ static int gbaudio_tplg_create_enum_ctl(struct gbaudio_module_info *gb,/* since count=1, and reg is dummy */ gbe->max =le32_to_cpu (gb_enum->items); gbe->texts =gb_generate_enum_strings (gb, gb_enum); +if (!gbe->texts) +return -ENOMEM ;/* debug enum info */ dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max,
@@ -1081,6 +1088,10 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module, csize +=le16_to_cpu (gbenum->names_length); control->texts = (const char *const *)gb_generate_enum_strings (module, gbenum); +if (!control->texts) { + ret = -ENOMEM ; + goto error; + } control->items =le32_to_cpu (gbenum->items); }else { csize =sizeof (struct gb_audio_control );
@@ -1190,6 +1201,10 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module, csize +=le16_to_cpu (gbenum->names_length); control->texts = (const char *const *)gb_generate_enum_strings (module, gbenum); +if (!control->texts) { + ret = -ENOMEM ; + goto error; + } control->items =le32_to_cpu (gbenum->items); }else { csize =sizeof (struct gb_audio_control );
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 106/320 fsl/fman: Check for null pointer after calling devm_ioremap
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 ]
As the possible failure of the allocation, the devm_ioremap() may return NULL pointer.
Take tgec_initialization() as an example.
If allocation fails, the params->base_addr will be NULL pointer and will be assigned to tgec->regs in tgec_config().
Then it will cause the dereference of NULL pointer in set_mac_address(), which is called by tgec_init().
Therefore, it should be better to add the sanity check after the calling of the devm_ioremap().
--- drivers/net/ethernet/freescale/fman/mac.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/net/ethernet/freescale/fman/mac.c +16 -5
@@ -94,14 +94,17 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex) __func__, ex); } -static void set_fman_mac_params (struct mac_device *mac_dev, -struct fman_mac_params *params) +static int set_fman_mac_params (struct mac_device *mac_dev, +struct fman_mac_params *params) {struct mac_priv_s *priv = mac_dev->priv; params->base_addr = (typeof(params->base_addr))devm_ioremap (priv->dev, mac_dev->res->start,resource_size (mac_dev->res)); +if (!params->base_addr) +return -ENOMEM ; +memcpy (¶ms->addr, mac_dev->addr,sizeof (mac_dev->addr)); params->max_speed = priv->max_speed; params->phy_if = mac_dev->phy_if;
@@ -112,6 +115,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev, params->event_cb = mac_exception; params->dev_id = mac_dev; params->internal_phy_node = priv->internal_phy_node; + +return 0 ; }static int tgec_initialization (struct mac_device *mac_dev)
@@ -123,7 +128,9 @@ static int tgec_initialization(struct mac_device *mac_dev) priv = mac_dev->priv; -set_fman_mac_params (mac_dev, ¶ms); + err =set_fman_mac_params (mac_dev, ¶ms); +if (err) + goto _return; mac_dev->fman_mac =tgec_config (¶ms);if (!mac_dev->fman_mac) {
@@ -169,7 +176,9 @@ static int dtsec_initialization(struct mac_device *mac_dev) priv = mac_dev->priv; -set_fman_mac_params (mac_dev, ¶ms); + err =set_fman_mac_params (mac_dev, ¶ms); +if (err) + goto _return; mac_dev->fman_mac =dtsec_config (¶ms);if (!mac_dev->fman_mac) {
@@ -218,7 +227,9 @@ static int memac_initialization(struct mac_device *mac_dev) priv = mac_dev->priv; -set_fman_mac_params (mac_dev, ¶ms); + err =set_fman_mac_params (mac_dev, ¶ms); +if (err) + goto _return;if (priv->max_speed ==SPEED_10000 ) params.phy_if =PHY_INTERFACE_MODE_XGMII ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 107/320 Bluetooth: hci_bcm: Check for error irq
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit b38cd3b42fba66cc538edb9cf77e07881f43f8e2 ]
For the possible failure of the platform_get_irq(), the returned irq could be error number and will finally cause the failure of the request_irq().
Consider that platform_get_irq() can now in certain cases return -EPROBE_DEFER, and the consequences of letting request_irq() effectively convert that into -EINVAL, even at probe time rather than later on. So it might be better to check just now.
--- drivers/bluetooth/hci_bcm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/bluetooth/hci_bcm.c +6 -1
@@ -1127,7 +1127,12 @@ static int bcm_probe(struct platform_device *pdev)return -ENOMEM ; dev->dev = &pdev->dev; - dev->irq =platform_get_irq (pdev,0 ); + + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; + + dev->irq = ret;if (has_acpi_companion (&pdev->dev)) { ret =bcm_acpi_probe (dev);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 108/320 HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
[ Upstream commit f364c571a5c77e96de2d32062ff019d6b8d2e2bc ]
The function performs a check on its input parameters, however, the hdev parameter is used before the check.
Initialize the stack variables after checking the input parameters to avoid a possible NULL pointer dereference.
Addresses-Coverity-ID: 1443831 ("Null pointer dereference")
--- drivers/hid/hid-uclogic-params.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/hid/hid-uclogic-params.c +9 -4
@@ -832,10 +832,10 @@ int uclogic_params_init(struct uclogic_params *params, struct hid_device *hdev) {int rc; -struct usb_device *udev =hid_to_usb_dev (hdev); -__u8 bNumInterfaces = udev->config->desc.bNumInterfaces; -struct usb_interface *iface =to_usb_interface (hdev->dev.parent); -__u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; +struct usb_device *udev; +__u8 bNumInterfaces; +struct usb_interface *iface; +__u8 bInterfaceNumber;bool found;/* The resulting parameters (noop) */ struct uclogic_params p = {0 , };
@@ -846,6 +846,11 @@ int uclogic_params_init(struct uclogic_params *params, goto cleanup; } + udev =hid_to_usb_dev (hdev); + bNumInterfaces = udev->config->desc.bNumInterfaces; + iface =to_usb_interface (hdev->dev.parent); + bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; +/* * Set replacement report descriptor if the original matches the * specified size. Otherwise keep interface unchanged.
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 109/320 HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
[ Upstream commit 0a94131d6920916ccb6a357037c535533af08819 ]
The function performs a check on the hdev input parameters, however, it is used before the check.
Initialize the udev variable after the sanity check to avoid a possible NULL pointer dereference.
Addresses-Coverity-ID: 1443827 ("Null pointer dereference")
--- drivers/hid/hid-uclogic-params.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-uclogic-params.c +3 -1
@@ -65,7 +65,7 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev, __u8 idx, size_t len) {int rc; -struct usb_device *udev =hid_to_usb_dev (hdev); +struct usb_device *udev;__u8 *buf =NULL ;/* Check arguments */
@@ -74,6 +74,8 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev, goto cleanup; } + udev =hid_to_usb_dev (hdev); + buf =kmalloc (len,GFP_KERNEL );if (buf ==NULL ) { rc = -ENOMEM ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 110/320 HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
[ Upstream commit ff6b548afe4d9d1ff3a0f6ef79e8cbca25d8f905 ]
The function performs a check on its input parameters, however, the hdev parameter is used before the check.
Initialize the stack variables after checking the input parameters to avoid a possible NULL pointer dereference.
Addresses-Coverity-ID: 1443804 ("Null pointer dereference")
--- drivers/hid/hid-uclogic-params.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/hid/hid-uclogic-params.c +7 -3
@@ -707,9 +707,9 @@ static int uclogic_params_huion_init(struct uclogic_params *params, struct hid_device *hdev) {int rc; -struct usb_device *udev =hid_to_usb_dev (hdev); -struct usb_interface *iface =to_usb_interface (hdev->dev.parent); -__u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; +struct usb_device *udev; +struct usb_interface *iface; +__u8 bInterfaceNumber;bool found;/* The resulting parameters (noop) */ struct uclogic_params p = {0 , };
@@ -723,6 +723,10 @@ static int uclogic_params_huion_init(struct uclogic_params *params, goto cleanup; } + udev =hid_to_usb_dev (hdev); + iface =to_usb_interface (hdev->dev.parent); + bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; +/* If it's not a pen interface */ if (bInterfaceNumber !=0 ) {/* TODO: Consider marking the interface invalid */
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 111/320 HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
[ Upstream commit aa320fdbbbb482c19100f51461bd0069753ce3d7 ]
The function performs a check on the hdev input parameters, however, it is used before the check.
Initialize the udev variable after the sanity check to avoid a possible NULL pointer dereference.
Addresses-Coverity-ID: 1443763 ("Null pointer dereference")
--- drivers/hid/hid-uclogic-params.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-uclogic-params.c +3 -1
@@ -451,7 +451,7 @@ static int uclogic_params_frame_init_v1_buttonpad( {int rc;bool found = false; -struct usb_device *usb_dev =hid_to_usb_dev (hdev); +struct usb_device *usb_dev;char *str_buf =NULL ;const size_t str_len =16 ;
@@ -461,6 +461,8 @@ static int uclogic_params_frame_init_v1_buttonpad( goto cleanup; } + usb_dev =hid_to_usb_dev (hdev); +/* * Enable generic button mode */
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 112/320 debugfs: lockdown: Allow reading debugfs files that are not world readable
In reply to Greg Kroah-HartmanFrom: Michal Suchanek <[email protected]>
[ Upstream commit 358fcf5ddbec4e6706405847d6a666f5933a6c25 ]
When the kernel is locked down the kernel allows reading only debugfs files with mode 444. Mode 400 is also valid but is not allowed.
Make the 444 into a mask.
--- fs/debugfs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/debugfs/file.c +1 -1
@@ -146,7 +146,7 @@ static int debugfs_locked_down(struct inode *inode, struct file *filp, const struct file_operations *real_fops) { - if ((inode->i_mode & 07777) == 0444 && + if ((inode->i_mode & 07777 & ~0444) == 0 && !(filp->f_mode & FMODE_WRITE) && !real_fops->unlocked_ioctl && !real_fops->compat_ioctl &&
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 113/320 net/mlx5e: Dont block routes with nexthop objects in SW
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit 9e72a55a3c9d54b38a704bb7292d984574a81d9d ]
Routes with nexthop objects is currently not supported by multipath offload and any attempts to use it is blocked, however this also block adding SW routes with nexthop.
Resolve this by returning NOTIFY_DONE instead of an error which will allow such a route to be created in SW but not offloaded.
This fix also solve an issue which block adding such routes on different devices due to missing check if the route FIB device is one of multipath devices.
--- drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +2 -4
@@ -265,10 +265,8 @@ static int mlx5_lag_fib_event(struct notifier_block *nb, fen_info = container_of(info, struct fib_entry_notifier_info, info); fi = fen_info->fi; -if (fi->nh) { -NL_SET_ERR_MSG_MOD (info->extack,"IPv4 route with nexthop objects is not supported" ); -return notifier_from_errno (-EINVAL ); - } +if (fi->nh) +return NOTIFY_DONE ; fib_dev =fib_info_nh (fen_info->fi,0 )->fib_nh_dev;if (fib_dev != ldev->pf[0 ].netdev && fib_dev != ldev->pf[1 ].netdev) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 114/320 Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 64050cdad0983ad8060e33c3f4b5aee2366bcebd ]
This reverts commit 6d6727dddc7f93fcc155cb8d0c49c29ae0e71122.
Although the NIC doesn't support offload of outer header CSUM, using gso_partial_features allows offloading the tunnel's segmentation. The driver relies on the stack CSUM calculation of the outer header. For this, NETIF_F_GSO_UDP_TUNNEL_CSUM must be a member of the device's features.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +7 -3
@@ -5053,9 +5053,13 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) }if (mlx5_vxlan_allowed (mdev->vxlan) ||mlx5_geneve_tx_allowed (mdev)) { - netdev->hw_features |=NETIF_F_GSO_UDP_TUNNEL ; - netdev->hw_enc_features |=NETIF_F_GSO_UDP_TUNNEL ; - netdev->vlan_features |=NETIF_F_GSO_UDP_TUNNEL ; + netdev->hw_features |=NETIF_F_GSO_UDP_TUNNEL | +NETIF_F_GSO_UDP_TUNNEL_CSUM ; + netdev->hw_enc_features |=NETIF_F_GSO_UDP_TUNNEL | +NETIF_F_GSO_UDP_TUNNEL_CSUM ; + netdev->gso_partial_features =NETIF_F_GSO_UDP_TUNNEL_CSUM ; + netdev->vlan_features |=NETIF_F_GSO_UDP_TUNNEL | +NETIF_F_GSO_UDP_TUNNEL_CSUM ; }if (mlx5e_tunnel_proto_supported (mdev,IPPROTO_GRE )) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 115/320 net/mlx5: Set command entry semaphore up once got index free
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit 8e715cd613a1e872b9d918e912d90b399785761a ]
Avoid a race where command work handler may fail to allocate command entry index, by holding the command semaphore down till command entry index is being freed.
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +6 -9
@@ -147,8 +147,12 @@ static void cmd_ent_put(struct mlx5_cmd_work_ent *ent)if (!refcount_dec_and_test (&ent->refcnt))return ; -if (ent->idx >=0 ) -cmd_free_index (ent->cmd, ent->idx); +if (ent->idx >=0 ) { +struct mlx5_cmd *cmd = ent->cmd; + +cmd_free_index (cmd, ent->idx); +up (ent->page_queue ? &cmd->pages_sem : &cmd->sem); + }cmd_free_ent (ent); }
@@ -1577,8 +1581,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force vector = vec &0xffffffff ;for (i =0 ; i < (1 << cmd->log_sz); i++) {if (test_bit (i, &vector)) { -struct semaphore *sem; - ent = cmd->ent_arr[i];/* if we already completed the command, ignore it */
@@ -1601,10 +1603,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)cmd_ent_put (ent); -if (ent->page_queue) - sem = &cmd->pages_sem; -else - sem = &cmd->sem; ent->ts2 =ktime_get_ns ();memcpy (ent->out->first.data, ent->lay->out,sizeof (ent->lay->out));dump_command (dev, ent,0 );
@@ -1658,7 +1656,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force*/ complete (&ent->done); } -up (sem); } } }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 116/320 spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 69c1b87516e327a60b39f96b778fe683259408bf ]
If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
Add missing pm_runtime_disable() for meson_spifc_probe.
--- drivers/spi/spi-meson-spifc.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-meson-spifc.c +1 -0
@@ -349,6 +349,7 @@ static int meson_spifc_probe(struct platform_device *pdev)return 0 ; out_clk:clk_disable_unprepare (spifc->clk); +pm_runtime_disable (spifc->dev); out_err:spi_master_put (master);return ret;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 117/320 tpm: add request_locality before write TPM_INT_ENABLE
In reply to Greg Kroah-HartmanFrom: Chen Jun <[email protected]>
[ Upstream commit 0ef333f5ba7f24f5d8478425c163d3097f1c7afd ]
Locality is not appropriately requested before writing the int mask. Add the missing boilerplate.
--- drivers/char/tpm/tpm_tis_core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/char/tpm/tpm_tis_core.c +8 -0
@@ -877,7 +877,15 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, intmask |=TPM_INTF_CMD_READY_INT |TPM_INTF_LOCALITY_CHANGE_INT |TPM_INTF_DATA_AVAIL_INT |TPM_INTF_STS_VALID_INT ; intmask &= ~TPM_GLOBAL_INT_ENABLE ; + + rc =request_locality (chip,0 ); +if (rc <0 ) { + rc = -ENODEV ; + goto out_err; + } +tpm_tis_write32 (priv,TPM_INT_ENABLE (priv->locality), intmask); +release_locality (chip,0 ); rc =tpm_chip_start (chip);if (rc)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 118/320 can: softing: softing_startstop(): fix set but not used variable warning
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit 370d988cc529598ebaec6487d4f84c2115dc696b ]
In the function softing_startstop() the variable error_reporting is assigned but not used. The code that uses this variable is commented out. Its stated that the functionality is not finally verified.
To fix the warning:
| drivers/net/can/softing/softing_fw.c:424:9: error: variable 'error_reporting' set but not used [-Werror,-Wunused-but-set-variable]
remove the comment, activate the code, but add a "0 &&" to the if expression and rely on the optimizer rather than the preprocessor to remove the code.
--- drivers/net/can/softing/softing_fw.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/can/softing/softing_fw.c +6 -5
@@ -565,18 +565,19 @@ int softing_startstop(struct net_device *dev, int up)if (ret <0 ) goto failed; } -/* enable_error_frame */ -/* + +/* enable_error_frame +* * Error reporting is switched off at the moment since * the receiving of them is not yet 100% verified * This should be enabled sooner or later -* -if (error_reporting) { +*/ +if (0 && error_reporting) { ret =softing_fct_cmd (card,51 ,"enable_error_frame" );if (ret <0 ) goto failed; } -*/ +/* initialize interface */ iowrite16 (1 , &card->dpram[DPRAM_FCT_PARAM +2 ]);iowrite16 (1 , &card->dpram[DPRAM_FCT_PARAM +4 ]);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 119/320 can: xilinx_can: xcan_probe(): check for error irq
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit c6564c13dae25cd7f8e1de5127b4da4500ee5844 ]
For the possible failure of the platform_get_irq(), the returned irq could be error number and will finally cause the failure of the request_irq().
Consider that platform_get_irq() can now in certain cases return -EPROBE_DEFER, and the consequences of letting request_irq() effectively convert that into -EINVAL, even at probe time rather than later on. So it might be better to check just now.
--- drivers/net/can/xilinx_can.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/can/xilinx_can.c +6 -1
@@ -1753,7 +1753,12 @@ static int xcan_probe(struct platform_device *pdev)spin_lock_init (&priv->tx_lock);/* Get IRQ for the device */ - ndev->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto err_free; + + ndev->irq = ret; + ndev->flags |=IFF_ECHO ;/* We support local echo */ platform_set_drvdata (pdev, ndev);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 120/320 pcmcia: fix setting of kthread task states
In reply to Greg Kroah-HartmanFrom: Dominik Brodowski <[email protected]>
[ Upstream commit fbb3485f1f931102d8ba606f1c28123f5b48afa3 ]
We need to set TASK_INTERRUPTIBLE before calling kthread_should_stop(). Otherwise, kthread_stop() might see that the pccardd thread is still in TASK_RUNNING state and fail to wake it up.
Additionally, we only need to set the state back to TASK_RUNNING if kthread_should_stop() breaks the loop.
--- drivers/pcmcia/cs.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/pcmcia/cs.c +3 -5
@@ -666,18 +666,16 @@ static int pccardd(void *__skt)if (events || sysfs_events)continue ; +set_current_state (TASK_INTERRUPTIBLE );if (kthread_should_stop ())break ; -set_current_state (TASK_INTERRUPTIBLE ); -schedule (); -/* make sure we are running */ -__set_current_state (TASK_RUNNING ); -try_to_freeze (); } +/* make sure we are running before we exit */ +__set_current_state (TASK_RUNNING );/* shut down socket, if a device is still present */ if (skt->state &SOCKET_PRESENT ) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 121/320 net: mcs7830: handle usb read errors properly
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit d668769eb9c52b150753f1653f7f5a0aeb8239d2 ]
Syzbot reported uninit value in mcs7830_bind(). The problem was in missing validation check for bytes read via usbnet_read_cmd().
usbnet_read_cmd() internally calls usb_control_msg(), that returns number of bytes read. Code should validate that requested number of bytes was actually read.
So, this patch adds missing size validation check inside mcs7830_get_reg() to prevent uninit value bugs
--- drivers/net/usb/mcs7830.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/usb/mcs7830.c +10 -2
@@ -108,8 +108,16 @@ static const char driver_name[] = "MOSCHIP usb-ethernet driver";static int mcs7830_get_reg (struct usbnet *dev,u16 index,u16 size,void *data) { -return usbnet_read_cmd (dev,MCS7830_RD_BREQ ,MCS7830_RD_BMREQ , -0x0000 , index, data, size); +int ret; + + ret =usbnet_read_cmd (dev,MCS7830_RD_BREQ ,MCS7830_RD_BMREQ , +0x0000 , index, data, size); +if (ret <0 ) +return ret; +else if (ret < size) +return -ENODATA ; + +return ret; }static int mcs7830_set_reg (struct usbnet *dev,u16 index,u16 size,const void *data)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 122/320 ext4: avoid trim error on fs with small groups
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 173b6e383d2a204c9921ffc1eca3b87aa2106c33 ]
A user reported FITRIM ioctl failing for him on ext4 on some devices without apparent reason. After some debugging we've found out that these devices (being LVM volumes) report rather large discard granularity of 42MB and the filesystem had 1k blocksize and thus group size of 8MB. Because ext4 FITRIM implementation puts discard granularity into minlen, ext4_trim_fs() declared the trim request as invalid. However just silently doing nothing seems to be a more appropriate reaction to such combination of parameters since user did not specify anything wrong.
--- fs/ext4/ioctl.c | 2 -- fs/ext4/mballoc.c | 8 ++++++++ 2 files changed, 8 insertions(+), 2 deletions(-)
fs/ext4/ioctl.c +0 -2
@@ -1120,8 +1120,6 @@ resizefs_out: sizeof(range)))return -EFAULT ; - range.minlen =max ((unsigned int )range.minlen, - q->limits.discard_granularity); ret =ext4_trim_fs (sb, &range);if (ret <0 )return ret;
fs/ext4/mballoc.c +8 -0
@@ -5270,6 +5270,7 @@ out:*/ int ext4_trim_fs (struct super_block *sb,struct fstrim_range *range) { +struct request_queue *q =bdev_get_queue (sb->s_bdev);struct ext4_group_info *grp;ext4_group_t group, first_group, last_group;ext4_grpblk_t cnt =0 , first_cluster, last_cluster;
@@ -5288,6 +5289,13 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) start >= max_blks || range->len < sb->s_blocksize) return -EINVAL; +/* No point to try to trim less than discard granularity */ +if (range->minlen < q->limits.discard_granularity) { + minlen =EXT4_NUM_B2C (EXT4_SB (sb), + q->limits.discard_granularity >> sb->s_blocksize_bits); +if (minlen >EXT4_CLUSTERS_PER_GROUP (sb)) + goto out; + }if (end >= max_blks) end = max_blks -1 ;if (end <= first_data_blk)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 123/320 ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 06764dc931848c3a9bc01a63bbf76a605408bb54 ]
snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it.
--- sound/core/jack.c | 3 +++ 1 file changed, 3 insertions(+)
sound/core/jack.c +3 -0
@@ -54,10 +54,13 @@ static int snd_jack_dev_free(struct snd_device *device)struct snd_card *card = device->card;struct snd_jack_kctl *jack_kctl, *tmp_jack_kctl; +down_write (&card->controls_rwsem);list_for_each_entry_safe (jack_kctl, tmp_jack_kctl, &jack->kctl_list, list) {list_del_init (&jack_kctl->list);snd_ctl_remove (card, jack_kctl->kctl); } +up_write (&card->controls_rwsem); +if (jack->private_free) jack->private_free (jack);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 124/320 ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 5471e9762e1af4b7df057a96bfd46cc250979b88 ]
snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it.
--- sound/core/pcm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/core/pcm.c +5 -1
@@ -810,7 +810,11 @@ EXPORT_SYMBOL(snd_pcm_new_internal);static void free_chmap (struct snd_pcm_str *pstr) {if (pstr->chmap_kctl) { -snd_ctl_remove (pstr->pcm->card, pstr->chmap_kctl); +struct snd_card *card = pstr->pcm->card; + +down_write (&card->controls_rwsem); +snd_ctl_remove (card, pstr->chmap_kctl); +up_write (&card->controls_rwsem); pstr->chmap_kctl =NULL ; } }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 125/320 ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 80bd64af75b4bb11c0329bc66c35da2ddfb66d88 ]
snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it.
--- sound/pci/hda/hda_codec.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/hda_codec.c +3 -0
@@ -1721,8 +1721,11 @@ void snd_hda_ctls_clear(struct hda_codec *codec) {int i;struct hda_nid_item *items = codec->mixers.list; + +down_write (&codec->card->controls_rwsem);for (i =0 ; i < codec->mixers.used; i++)snd_ctl_remove (codec->card, items[i].kctl); +up_write (&codec->card->controls_rwsem);snd_array_free (&codec->mixers);snd_array_free (&codec->nids); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 126/320 RDMA/hns: Validate the pkey index
In reply to Greg Kroah-HartmanFrom: Kamal Heib <[email protected]>
[ Upstream commit 2a67fcfa0db6b4075515bd23497750849b88850f ]
Before query pkey, make sure that the queried index is valid.
--- drivers/infiniband/hw/hns/hns_roce_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/infiniband/hw/hns/hns_roce_main.c +3 -0
@@ -279,6 +279,9 @@ static enum rdma_link_layer hns_roce_get_link_layer(struct ib_device *device,static int hns_roce_query_pkey (struct ib_device *ib_dev,u8 port,u16 index,u16 *pkey) { +if (index >0 ) +return -EINVAL ; + *pkey =PKEY_ID ;return 0 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 127/320 clk: imx8mn: Fix imx8mn_clko1_sels
In reply to Greg Kroah-HartmanFrom: Adam Ford <[email protected]>
[ Upstream commit 570727e9acfac1c2330a01dd5e1272e9c3acec08 ]
When attempting to use sys_pll1_80m as the parent for clko1, the system hangs. This is due to the fact that the source select for sys_pll1_80m was incorrectly pointing to m7_alt_pll_clk, which doesn't yet exist.
According to Rev 3 of the TRM, The imx8mn_clko1_sels also incorrectly references an osc_27m which does not exist, nor does an entry for source select bits 010b. Fix both by inserting a dummy clock into the missing space in the table and renaming the incorrectly name clock with dummy.
--- drivers/clk/imx/clk-imx8mn.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/imx/clk-imx8mn.c +3 -3
@@ -358,9 +358,9 @@ static const char * const imx8mn_pdm_sels[] = {"osc_24m", "sys_pll2_100m", "audistatic const char *const imx8mn_dram_core_sels[] = {"dram_pll_out" ,"dram_alt_root" , }; -static const char *const imx8mn_clko1_sels[] = {"osc_24m" ,"sys_pll1_800m" ,"osc_27m" , -"sys_pll1_200m" ,"audio_pll2_out" ,"vpu_pll" , -"sys_pll1_80m" , }; +static const char *const imx8mn_clko1_sels[] = {"osc_24m" ,"sys_pll1_800m" ,"dummy" , +"sys_pll1_200m" ,"audio_pll2_out" ,"sys_pll2_500m" , +"dummy" ,"sys_pll1_80m" , };static const char *const imx8mn_clko2_sels[] = {"osc_24m" ,"sys_pll2_200m" ,"sys_pll1_400m" ,"sys_pll2_166m" ,"sys_pll3_out" ,"audio_pll1_out" ,"video_pll1_out" ,"osc_32k" , };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 128/320 powerpc/prom_init: Fix improper check of prom_getprop()
In reply to Greg Kroah-HartmanFrom: Peiwei Hu <[email protected]>
[ Upstream commit 869fb7e5aecbc163003f93f36dcc26d0554319f6 ]
prom_getprop() can return PROM_ERROR. Binary operator can not identify it.
--- arch/powerpc/kernel/prom_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/prom_init.c +1 -1
@@ -2919,7 +2919,7 @@ static void __init fixup_device_tree_efika_add_phy(void)/* Check if the phy-handle property exists - bail if it does */ rv =prom_getprop (node,"phy-handle" , prop,sizeof (prop)); -if (!rv) +if (rv <=0 )return ;/*
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 129/320 ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA
In reply to Greg Kroah-HartmanFrom: Lukas Bulwahn <[email protected]>
[ Upstream commit 49f893253ab43566e34332a969324531fea463f6 ]
Commit f37fe2f9987b ("ASoC: uniphier: add support for UniPhier AIO common driver") adds configs SND_SOC_UNIPHIER_{LD11,PXS2}, which select the non-existing config SND_SOC_UNIPHIER_AIO_DMA.
Hence, ./scripts/checkkconfigsymbols.py warns:
SND_SOC_UNIPHIER_AIO_DMA
Referencing files: sound/soc/uniphier/Kconfig
Probably, there is actually no further config intended to be selected here. So, just drop selecting the non-existing config.
--- sound/soc/uniphier/Kconfig | 2 -- 1 file changed, 2 deletions(-)
sound/soc/uniphier/Kconfig +0 -2
@@ -23,7 +23,6 @@ config SND_SOC_UNIPHIER_LD11 tristate "UniPhier LD11/LD20 Device Driver" depends on SND_SOC_UNIPHIER select SND_SOC_UNIPHIER_AIO - select SND_SOC_UNIPHIER_AIO_DMA help This adds ASoC driver for Socionext UniPhier LD11/LD20 input and output that can be used with other codecs.
@@ -34,7 +33,6 @@ config SND_SOC_UNIPHIER_PXS2 tristate "UniPhier PXs2 Device Driver" depends on SND_SOC_UNIPHIER select SND_SOC_UNIPHIER_AIO - select SND_SOC_UNIPHIER_AIO_DMA help This adds ASoC driver for Socionext UniPhier PXs2 input and output that can be used with other codecs.
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 130/320 ALSA: oss: fix compile error when OSS_DEBUG is enabled
In reply to Greg Kroah-HartmanFrom: Bixuan Cui <[email protected]>
[ Upstream commit 8e7daf318d97f25e18b2fc7eb5909e34cd903575 ]
Fix compile error when OSS_DEBUG is enabled:
sound/core/oss/pcm_oss.c: In function 'snd_pcm_oss_set_trigger':
sound/core/oss/pcm_oss.c:2055:10: error: 'substream' undeclared (first
use in this function); did you mean 'csubstream'?
pcm_dbg(substream->pcm, "pcm_oss: trigger = 0x%x\n", trigger);
^--- sound/core/oss/pcm_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/oss/pcm_oss.c +1 -1
@@ -2055,7 +2055,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int trint err, cmd;#ifdef OSS_DEBUG -pcm_dbg (substream->pcm,"pcm_oss: trigger = 0x%x\n" , trigger); +pr_debug ("pcm_oss: trigger = 0x%x\n" , trigger);#endif psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK ];
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 131/320 char/mwave: Adjust io port register size
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit f5912cc19acd7c24b2dbf65a6340bf194244f085 ]
Using MKWORD() on a byte-sized variable results in OOB read. Expand the size of the reserved area so both MKWORD and MKBYTE continue to work without overflow. Silences this warning on a -Warray-bounds build:
drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned int[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werror=array-bounds]
346 | #define MKWORD(var) (*((unsigned short *)(&var)))
| ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp'
356 | #define OutWordDsp(index,value) outw(value,usDspBaseIO+index)
| ^~~~~drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD'
373 | OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl));
| ^~~~~~drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl'
358 | DSP_ISA_SLAVE_CONTROL rSlaveControl;
| ^~~~~~~~~~~~~--- drivers/char/mwave/3780i.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/mwave/3780i.h +1 -1
@@ -68,7 +68,7 @@ typedef struct { unsigned char ClockControl:1; /* RW: Clock control: 0=normal, 1=stop 3780i clocks */ unsigned char SoftReset:1; /* RW: Soft reset 0=normal, 1=soft reset active */ unsigned char ConfigMode:1; /* RW: Configuration mode, 0=normal, 1=config mode */ - unsigned char Reserved:5; /* 0: Reserved */ + unsigned short Reserved:13; /* 0: Reserved */ }DSP_ISA_SLAVE_CONTROL ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 132/320 binder: fix handling of error during copy
In reply to Greg Kroah-HartmanFrom: Todd Kjos <[email protected]>
[ Upstream commit fe6b1869243f23a485a106c214bcfdc7aa0ed593 ]
If a memory copy function fails to copy the whole buffer, a positive integar with the remaining bytes is returned. In binder_translate_fd_array() this can result in an fd being skipped due to the failed copy, but the loop continues processing fds since the early return condition expects a negative integer on error.
Fix by returning "ret > 0 ? -EINVAL : ret" to handle this case.
--- drivers/android/binder.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/android/binder.c +2 -2
@@ -2660,8 +2660,8 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,if (!ret) ret =binder_translate_fd (fd, offset, t, thread, in_reply_to); -if (ret <0 ) -return ret; +if (ret) +return ret >0 ? -EINVAL : ret; }return 0 ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 133/320 uio: uio_dmem_genirq: Catch the Exception
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit eec91694f927d1026974444eb6a3adccd4f1cbc2 ]
The return value of dma_set_coherent_mask() is not always 0. To catch the exception in case that dma is not support the mask.
--- drivers/uio/uio_dmem_genirq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/uio/uio_dmem_genirq.c +5 -1
@@ -192,7 +192,11 @@ static int uio_dmem_genirq_probe(struct platform_device *pdev) goto bad0; } -dma_set_coherent_mask (&pdev->dev,DMA_BIT_MASK (32 )); + ret =dma_set_coherent_mask (&pdev->dev,DMA_BIT_MASK (32 )); +if (ret) { +dev_err (&pdev->dev,"DMA enable failed\n" ); +return ret; + } priv->uioinfo = uioinfo;spin_lock_init (&priv->lock);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 134/320 iommu/io-pgtable-arm: Fix table descriptor paddr formatting
In reply to Greg Kroah-HartmanFrom: Hector Martin <[email protected]>
[ Upstream commit 9abe2ac834851a7d0b0756e295cf7a292c45ca53 ]
Table descriptors were being installed without properly formatting the address using paddr_to_iopte, which does not match up with the iopte_deref in __arm_lpae_map. This is incorrect for the LPAE pte format, as it does not handle the high bits properly.
This was found on Apple T6000 DARTs, which require a new pte format (different shift); adding support for that to paddr_to_iopte/iopte_to_paddr caused it to break badly, as even <48-bit addresses would end up incorrect in that case.
--- drivers/iommu/io-pgtable-arm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/iommu/io-pgtable-arm.c +5 -4
@@ -351,11 +351,12 @@ static int arm_lpae_init_pte(struct arm_lpae_io_pgtable *data,static arm_lpae_iopte arm_lpae_install_table (arm_lpae_iopte *table,arm_lpae_iopte *ptep,arm_lpae_iopte curr, -struct io_pgtable_cfg *cfg) +struct arm_lpae_io_pgtable *data) {arm_lpae_iopte old, new; +struct io_pgtable_cfg *cfg = &data->iop.cfg; - new =__pa (table) |ARM_LPAE_PTE_TYPE_TABLE ; + new =paddr_to_iopte (__pa (table), data) |ARM_LPAE_PTE_TYPE_TABLE ;if (cfg->quirks &IO_PGTABLE_QUIRK_ARM_NS ) new |=ARM_LPAE_PTE_NSTABLE ;
@@ -406,7 +407,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova,if (!cptep)return -ENOMEM ; - pte =arm_lpae_install_table (cptep, ptep,0 , cfg); + pte =arm_lpae_install_table (cptep, ptep,0 , data);if (pte)__arm_lpae_free_pages (cptep, tblsz, cfg); }else if (!cfg->coherent_walk && !(pte &ARM_LPAE_PTE_SW_SYNC )) {
@@ -575,7 +576,7 @@ static size_t arm_lpae_split_blk_unmap(struct arm_lpae_io_pgtable *data,__arm_lpae_init_pte (data, blk_paddr, pte, lvl, &tablep[i]); } - pte =arm_lpae_install_table (tablep, ptep, blk_pte, cfg); + pte =arm_lpae_install_table (tablep, ptep, blk_pte, data);if (pte != blk_pte) {__arm_lpae_free_pages (tablep, tablesz, cfg);/*
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 135/320 scsi: ufs: Fix race conditions related to driver data
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 21ad0e49085deb22c094f91f9da57319a97188e4 ]
The driver data pointer must be set before any callbacks are registered that use that pointer. Hence move the initialization of that pointer from after the ufshcd_init() call to inside ufshcd_init().
--- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 -- drivers/scsi/ufs/ufshcd.c | 7 +++++++ 3 files changed, 7 insertions(+), 3 deletions(-)
drivers/scsi/ufs/tc-dwc-g210-pci.c +0 -1
@@ -135,7 +135,6 @@ tc_dwc_g210_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)return err; } -pci_set_drvdata (pdev, hba);pm_runtime_put_noidle (&pdev->dev);pm_runtime_allow (&pdev->dev);
drivers/scsi/ufs/ufshcd-pltfrm.c +0 -2
@@ -436,8 +436,6 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, goto dealloc_host; } -platform_set_drvdata (pdev, hba); -pm_runtime_set_active (&pdev->dev);pm_runtime_enable (&pdev->dev);
drivers/scsi/ufs/ufshcd.c +7 -0
@@ -8328,6 +8328,13 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)struct Scsi_Host *host = hba->host;struct device *dev = hba->dev; +/* +* dev_set_drvdata() must be called before any callbacks are registered +* that use dev_get_drvdata() (frequency scaling, clock scaling, hwmon, +* sysfs). +*/ +dev_set_drvdata (dev, hba); +if (!mmio_base) {dev_err (hba->dev,"Invalid memory reference for mmio_base is NULL\n" );
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 136/320 PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit 29bbc35e29d9b6347780dcacde2deb4b39344167 ]
pci_irq_vector() and pci_irq_get_affinity() use the list position to find the MSI-X descriptor at a given index. That's correct for the normal case where the entry number is the same as the list position.
But it's wrong for cases where MSI-X was allocated with an entries array describing sparse entry numbers into the hardware message descriptor table. That's inconsistent at best.
Make it always check the entry number because that's what the zero base index really means. This change won't break existing users which use a sparse entries array for allocation because these users retrieve the Linux interrupt number from the entries array after allocation and none of them uses pci_irq_vector() or pci_irq_get_affinity().
--- drivers/pci/msi.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/pci/msi.c +18 -8
@@ -1294,19 +1294,24 @@ EXPORT_SYMBOL(pci_free_irq_vectors);/** * pci_irq_vector - return Linux IRQ number of a device vector -* @dev: PCI device to operate on -* @nr: device-relative interrupt vector index (0-based). +* @dev: PCI device to operate on +* @nr: Interrupt vector index (0-based) +* +* @nr has the following meanings depending on the interrupt mode: +* MSI-X: The index in the MSI-X vector table +* MSI: The index of the enabled MSI vectors +* INTx: Must be 0 +* +* Return: The Linux interrupt number or -EINVAl if @nr is out of range. */ int pci_irq_vector (struct pci_dev *dev,unsigned int nr) {if (dev->msix_enabled) {struct msi_desc *entry; -int i =0 ;for_each_pci_msi_entry (entry, dev) { -if (i == nr) +if (entry->msi_attrib.entry_nr == nr)return entry->irq; - i++; }WARN_ON_ONCE (1 );return -EINVAL ;
@@ -1330,17 +1335,22 @@ EXPORT_SYMBOL(pci_irq_vector);* pci_irq_get_affinity - return the affinity of a particular MSI vector * @dev: PCI device to operate on * @nr: device-relative interrupt vector index (0-based). +* +* @nr has the following meanings depending on the interrupt mode: +* MSI-X: The index in the MSI-X vector table +* MSI: The index of the enabled MSI vectors +* INTx: Must be 0 +* +* Return: A cpumask pointer or NULL if @nr is out of range */ const struct cpumask *pci_irq_get_affinity (struct pci_dev *dev,int nr) {if (dev->msix_enabled) {struct msi_desc *entry; -int i =0 ;for_each_pci_msi_entry (entry, dev) { -if (i == nr) +if (entry->msi_attrib.entry_nr == nr)return &entry->affinity->mask; - i++; }WARN_ON_ONCE (1 );return NULL ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 137/320 powerpc/powermac: Add additional missing lockdep_register_key()
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit b149d5d45ac9171ed699a256f026c8ebef901112 ]
Commit df1f679d19ed ("powerpc/powermac: Add missing lockdep_register_key()") fixed a problem that was causing a WARNING.
There are two other places in the same file with the same problem originating from commit 9e607f72748d ("i2c_powermac: shut up lockdep warning").
Add missing lockdep_register_key()
Depends-on: df1f679d19ed ("powerpc/powermac: Add missing lockdep_register_key()")
--- arch/powerpc/platforms/powermac/low_i2c.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/platforms/powermac/low_i2c.c +2 -0
@@ -811,6 +811,7 @@ static void __init pmu_i2c_probe(void) bus->hostdata = bus +1 ; bus->xfer = pmu_i2c_xfer;mutex_init (&bus->mutex); +lockdep_register_key (&bus->lock_key);lockdep_set_class (&bus->mutex, &bus->lock_key); bus->flags = pmac_i2c_multibus;list_add (&bus->link, &pmac_i2c_busses);
@@ -934,6 +935,7 @@ static void __init smu_i2c_probe(void) bus->hostdata = bus +1 ; bus->xfer = smu_i2c_xfer;mutex_init (&bus->mutex); +lockdep_register_key (&bus->lock_key);lockdep_set_class (&bus->mutex, &bus->lock_key); bus->flags =0 ;list_add (&bus->link, &pmac_i2c_busses);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 138/320 RDMA/core: Let ib_find_gid() continue search even after empty entry
In reply to Greg Kroah-HartmanFrom: Avihai Horon <[email protected]>
[ Upstream commit 483d805191a23191f8294bbf9b4e94836f5d92e4 ]
Currently, ib_find_gid() will stop searching after encountering the first empty GID table entry. This behavior is wrong since neither IB nor RoCE spec enforce tightly packed GID tables.
For example, when a valid GID entry exists at index N, and if a GID entry is empty at index N-1, ib_find_gid() will fail to find the valid entry.
Fix it by making ib_find_gid() continue searching even after encountering missing entries.
--- drivers/infiniband/core/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/core/device.c +2 -1
@@ -2438,7 +2438,8 @@ int ib_find_gid(struct ib_device *device, union ib_gid *gid, ++i) { ret =rdma_query_gid (device, port, i, &tmp_gid);if (ret) -return ret; +continue ; +if (!memcmp (&tmp_gid, gid,sizeof *gid)) { *port_num = port;if (index)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 139/320 RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry
In reply to Greg Kroah-HartmanFrom: Avihai Horon <[email protected]>
[ Upstream commit 20679094a0161c94faf77e373fa3f7428a8e14bd ]
Currently, when cma_resolve_ib_dev() searches for a matching GID it will stop searching after encountering the first empty GID table entry. This behavior is wrong since neither IB nor RoCE spec enforce tightly packed GID tables.
For example, when the matching valid GID entry exists at index N, and if a GID entry is empty at index N-1, cma_resolve_ib_dev() will fail to find the matching valid entry.
Fix it by making cma_resolve_ib_dev() continue searching even after encountering missing entries.
--- drivers/infiniband/core/cma.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/infiniband/core/cma.c +9 -3
@@ -820,6 +820,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)u16 pkey, index;u8 p;enum ib_port_state port_state; +int ret;int i; cma_dev =NULL ;
@@ -838,9 +839,14 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)if (ib_get_cached_port_state (cur_dev->device, p, &port_state))continue ; -for (i =0 ; !rdma_query_gid (cur_dev->device, - p, i, &gid); - i++) { + +for (i =0 ; i < cur_dev->device->port_data[p].immutable.gid_tbl_len; + ++i) { + ret =rdma_query_gid (cur_dev->device, p, i, + &gid); +if (ret) +continue ; +if (!memcmp (&gid, dgid,sizeof (gid))) { cma_dev = cur_dev; sgid = gid;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 140/320 ASoC: rt5663: Handle device_property_read_u32_array error codes
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 2167c0b205960607fb136b4bb3c556a62be1569a ]
The return value of device_property_read_u32_array() is not always 0. To catch the exception in case that devm_kzalloc failed and the rt5663->imp_table was NULL, which caused the failure of device_property_read_u32_array.
--- sound/soc/codecs/rt5663.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
sound/soc/codecs/rt5663.c +9 -3
@@ -3461,6 +3461,7 @@ static void rt5663_calibrate(struct rt5663_priv *rt5663)static int rt5663_parse_dp (struct rt5663_priv *rt5663,struct device *dev) {int table_size; +int ret;device_property_read_u32 (dev,"realtek,dc_offset_l_manual" , &rt5663->pdata.dc_offset_l_manual);
@@ -3477,9 +3478,11 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) table_size =sizeof (struct impedance_mapping_table ) * rt5663->pdata.impedance_sensing_num; rt5663->imp_table =devm_kzalloc (dev, table_size,GFP_KERNEL ); -device_property_read_u32_array (dev, + ret =device_property_read_u32_array (dev,"realtek,impedance_sensing_table" , (u32 *)rt5663->imp_table, table_size); +if (ret) +return ret; }return 0 ;
@@ -3504,8 +3507,11 @@ static int rt5663_i2c_probe(struct i2c_client *i2c,if (pdata) rt5663->pdata = *pdata; -else -rt5663_parse_dp (rt5663, &i2c->dev); +else { + ret =rt5663_parse_dp (rt5663, &i2c->dev); +if (ret) +return ret; + }for (i =0 ; i <ARRAY_SIZE (rt5663->supplies); i++) rt5663->supplies[i].supply = rt5663_supply_names[i];
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 141/320 clk: stm32: Fix ltdcs clock turn off by clk_disable_unused() after system enter shell
In reply to Greg Kroah-HartmanFrom: Dillon Min <[email protected]>
[ Upstream commit 6fc058a72f3b7b07fc4de6d66ad1f68951b00f6e ]
stm32's clk driver register two ltdc gate clk to clk core by clk_hw_register_gate() and clk_hw_register_composite()
first: 'stm32f429_gates[]', clk name is 'ltdc', which no user to use.
second: 'stm32f429_aux_clk[]', clk name is 'lcd-tft', used by ltdc driver
both of them point to the same offset of stm32's RCC register. after kernel enter console, clk core turn off ltdc's clk as 'stm32f429_gates[]' is no one to use. but, actually 'stm32f429_aux_clk[]' is in use.
stm32f469/746/769 have the same issue, fix it.
--- drivers/clk/clk-stm32f4.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/clk/clk-stm32f4.c +0 -4
@@ -129,7 +129,6 @@ static const struct stm32f4_gate_data stm32f429_gates[] __initconst = { { STM32F4_RCC_APB2ENR, 20, "spi5", "apb2_div" }, { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, }; static const struct stm32f4_gate_data stm32f469_gates[] __initconst = {
@@ -211,7 +210,6 @@ static const struct stm32f4_gate_data stm32f469_gates[] __initconst = { { STM32F4_RCC_APB2ENR, 20, "spi5", "apb2_div" }, { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, }; static const struct stm32f4_gate_data stm32f746_gates[] __initconst = {
@@ -286,7 +284,6 @@ static const struct stm32f4_gate_data stm32f746_gates[] __initconst = { { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, { STM32F4_RCC_APB2ENR, 23, "sai2", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, }; static const struct stm32f4_gate_data stm32f769_gates[] __initconst = {
@@ -364,7 +361,6 @@ static const struct stm32f4_gate_data stm32f769_gates[] __initconst = { { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, { STM32F4_RCC_APB2ENR, 23, "sai2", "apb2_div" }, - { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, { STM32F4_RCC_APB2ENR, 30, "mdio", "apb2_div" }, };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 142/320 dmaengine: pxa/mmp: stop referencing config->slave_id
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 134c37fa250a87a7e77c80a7c59ae16c462e46e0 ]
The last driver referencing the slave_id on Marvell PXA and MMP platforms was the SPI driver, but this stopped doing so a long time ago, so the TODO from the earlier patch can no be removed.
--- drivers/dma/mmp_pdma.c | 6 ------ drivers/dma/pxa_dma.c | 7 ------- 2 files changed, 13 deletions(-)
drivers/dma/mmp_pdma.c +0 -6
@@ -728,12 +728,6 @@ static int mmp_pdma_config_write(struct dma_chan *dchan, chan->dir = direction; chan->dev_addr = addr; -/* FIXME: drivers should be ported over to use the filter -* function. Once that's done, the following two lines can -* be removed. -*/ -if (cfg->slave_id) - chan->drcmr = cfg->slave_id;return 0 ; }
drivers/dma/pxa_dma.c +0 -7
@@ -911,13 +911,6 @@ static void pxad_get_config(struct pxad_chan *chan, *dcmd |=PXA_DCMD_BURST16 ; else if (maxburst == 32) *dcmd |= PXA_DCMD_BURST32; - - /* FIXME: drivers should be ported over to use the filter - * function. Once that's done, the following two lines can - * be removed. - */ - if (chan->cfg.slave_id) - chan->drcmr = chan->cfg.slave_id; } static struct dma_async_tx_descriptor *
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 143/320 iommu/iova: Fix race between FQ timeout and teardown
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
[ Upstream commit d7061627d701c90e1cac1e1e60c45292f64f3470 ]
It turns out to be possible for hotplugging out a device to reach the stage of tearing down the device's group and default domain before the domain's flush queue has drained naturally. At this point, it is then possible for the timeout to expire just before the del_timer() call in free_iova_flush_queue(), such that we then proceed to free the FQ resources while fq_flush_timeout() is still accessing them on another CPU. Crashes due to this have been observed in the wild while removing NVMe devices.
Close the race window by using del_timer_sync() to safely wait for any active timeout handler to finish before we start to free things. We already avoid any locking in free_iova_flush_queue() since the FQ is supposed to be inactive anyway, so the potential deadlock scenario does not apply.
--- drivers/iommu/iova.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/iommu/iova.c +1 -2
@@ -64,8 +64,7 @@ static void free_iova_flush_queue(struct iova_domain *iovad)if (!has_iova_flush_queue (iovad))return ; -if (timer_pending (&iovad->fq_timer)) -del_timer (&iovad->fq_timer); +del_timer_sync (&iovad->fq_timer);fq_destroy_all_entries (iovad);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 144/320 phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
In reply to Greg Kroah-HartmanFrom: Ryuta NAKANISHI <[email protected]>
[ Upstream commit 898c7a9ec81620125f2463714a0f4dea18ad6e54 ]
Similar to commit 4a90bbb478db ("phy: uniphier-pcie: Fix updating phy parameters"), in function uniphier_u3ssphy_set_param(), unintentionally write zeros to other fields when writing PHY registers.
--- drivers/phy/socionext/phy-uniphier-usb3ss.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/phy/socionext/phy-uniphier-usb3ss.c +6 -4
@@ -22,11 +22,13 @@#include <linux/reset.h> #define SSPHY_TESTI 0x0 -#define SSPHY_TESTO 0x4#define TESTI_DAT_MASK GENMASK(13, 6)#define TESTI_ADR_MASK GENMASK(5, 1)#define TESTI_WR_EN BIT(0) +#define SSPHY_TESTO 0x4 +#define TESTO_DAT_MASK GENMASK(7, 0) +#define PHY_F (regno, msb, lsb) { (regno), (msb), (lsb) }#define CDR_CPD_TRIM PHY_F(7, 3, 0)/* RxPLL charge pump current */
@@ -84,12 +86,12 @@ static void uniphier_u3ssphy_set_param(struct uniphier_u3ssphy_priv *priv, val =FIELD_PREP (TESTI_DAT_MASK ,1 ); val |=FIELD_PREP (TESTI_ADR_MASK , p->field.reg_no);uniphier_u3ssphy_testio_write (priv, val); - val =readl (priv->base +SSPHY_TESTO ); + val =readl (priv->base +SSPHY_TESTO ) &TESTO_DAT_MASK ;/* update value */ - val &= ~FIELD_PREP (TESTI_DAT_MASK , field_mask); + val &= ~field_mask; data = field_mask & (p->value << p->field.lsb); - val =FIELD_PREP (TESTI_DAT_MASK , data); + val =FIELD_PREP (TESTI_DAT_MASK , data | val); val |=FIELD_PREP (TESTI_ADR_MASK , p->field.reg_no);uniphier_u3ssphy_testio_write (priv, val);uniphier_u3ssphy_testio_write (priv, val |TESTI_WR_EN );
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 145/320 ASoC: mediatek: Check for error clk pointer
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 9de2b9286a6dd16966959b3cb34fc2ddfd39213e ]
Yes, you are right and now the return code depending on the init_clks().
--- drivers/soc/mediatek/mtk-scpsys.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/soc/mediatek/mtk-scpsys.c +11 -4
@@ -333,12 +333,17 @@ out:return ret; } -static void init_clks (struct platform_device *pdev,struct clk **clk) +static int init_clks (struct platform_device *pdev,struct clk **clk) {int i; -for (i =CLK_NONE +1 ; i <CLK_MAX ; i++) +for (i =CLK_NONE +1 ; i <CLK_MAX ; i++) { clk[i] =devm_clk_get (&pdev->dev, clk_names[i]); +if (IS_ERR (clk[i])) +return PTR_ERR (clk[i]); + } + +return 0 ; } static struct scp *init_scp(struct platform_device *pdev,
@@ -348,7 +353,7 @@ static struct scp *init_scp(struct platform_device *pdev, {struct genpd_onecell_data *pd_data;struct resource *res; -int i, j; +int i, j, ret;struct scp *scp;struct clk *clk[CLK_MAX ];
@@ -403,7 +408,9 @@ static struct scp *init_scp(struct platform_device *pdev, pd_data->num_domains = num; -init_clks (pdev, clk); + ret =init_clks (pdev, clk); +if (ret) +return ERR_PTR (ret);for (i =0 ; i < num; i++) {struct scp_domain *scpd = &scp->domains[i];
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 146/320 ASoC: samsung: idma: Check of ioremap return value
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 3ecb46755eb85456b459a1a9f952c52986bce8ec ]
Because of the potential failure of the ioremap(), the buf->area could be NULL.
Therefore, we need to check it and return -ENOMEM in order to transfer the error.
--- sound/soc/samsung/idma.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/samsung/idma.c +2 -0
@@ -363,6 +363,8 @@ static int preallocate_idma_buffer(struct snd_pcm *pcm, int stream) buf->addr = idma.lp_tx_addr; buf->bytes = idma_hardware.buffer_bytes_max; buf->area = (unsigned char *__force )ioremap (buf->addr, buf->bytes); +if (!buf->area) +return -ENOMEM ;return 0 ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 147/320 misc: lattice-ecp3-config: Fix task hung when firmware load failed
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit fcee5ce50bdb21116711e38635e3865594af907e ]
When firmware load failed, kernel report task hung as follows:
INFO: task xrun:5191 blocked for more than 147 seconds.
Tainted: G W 5.16.0-rc5-next-20211220+ #11
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:xrun state:D stack: 0 pid: 5191 ppid: 270 flags:0x00000004
Call Trace:
__schedule+0xc12/0x4b50 kernel/sched/core.c:4986
schedule+0xd7/0x260 kernel/sched/core.c:6369 (discriminator 1)
schedule_timeout+0x7aa/0xa80 kernel/time/timer.c:1857
wait_for_completion+0x181/0x290 kernel/sched/completion.c:85
lattice_ecp3_remove+0x32/0x40 drivers/misc/lattice-ecp3-config.c:221
spi_remove+0x72/0xb0 drivers/spi/spi.c:409lattice_ecp3_remove() wait for signals from firmware loading, but when load failed, firmware_load() does not send this signal. This cause device remove hung. Fix it by sending signal even if load failed.
--- drivers/misc/lattice-ecp3-config.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/misc/lattice-ecp3-config.c +6 -6
@@ -77,12 +77,12 @@ static void firmware_load(const struct firmware *fw, void *context)if (fw ==NULL ) {dev_err (&spi->dev,"Cannot load firmware, aborting\n" ); -return ; + goto out; }if (fw->size ==0 ) {dev_err (&spi->dev,"Error: Firmware size is 0!\n" ); -return ; + goto out; }/* Fill dummy data (24 stuffing bits for commands) */
@@ -104,7 +104,7 @@ static void firmware_load(const struct firmware *fw, void *context)dev_err (&spi->dev,"Error: No supported FPGA detected (JEDEC_ID=%08x)!\n" , jedec_id); -return ; + goto out; }dev_info (&spi->dev,"FPGA %s detected\n" , ecp3_dev[i].name);
@@ -117,7 +117,7 @@ static void firmware_load(const struct firmware *fw, void *context) buffer =kzalloc (fw->size +8 ,GFP_KERNEL );if (!buffer) {dev_err (&spi->dev,"Error: Can't allocate memory!\n" ); -return ; + goto out; }/*
@@ -156,7 +156,7 @@ static void firmware_load(const struct firmware *fw, void *context)"Error: Timeout waiting for FPGA to clear (status=%08x)!\n" , status);kfree (buffer); -return ; + goto out; }dev_info (&spi->dev,"Configuring the FPGA...\n" );
@@ -182,7 +182,7 @@ static void firmware_load(const struct firmware *fw, void *context)release_firmware (fw);kfree (buffer); - +out:complete (&data->fw_loaded); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 148/320 mips: lantiq: add support for clk_set_parent()
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 76f66dfd60dc5d2f9dec22d99091fea1035c5d03 ]
Provide a simple implementation of clk_set_parent() in the lantiq subarch so that callers of it will build without errors.
Fixes these build errors:
ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] undefined!
ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] undefined!
[email protected] --cc="John Crispin <[email protected]>" --cc="Jonathan Cameron <[email protected]>" --cc="Russell King <[email protected]>" --cc="Andy Shevchenko <[email protected]>" [email protected] --to="Thomas Bogendoerfer <[email protected]>"
--- arch/mips/lantiq/clk.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/mips/lantiq/clk.c +6 -0
@@ -164,6 +164,12 @@ struct clk *clk_get_parent(struct clk *clk) }EXPORT_SYMBOL (clk_get_parent); +int clk_set_parent (struct clk *clk,struct clk *parent) +{ +return 0 ; +} +EXPORT_SYMBOL (clk_set_parent); +static inline u32 get_counter_resolution (void ) {u32 res;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 149/320 mips: bcm63xx: add support for clk_set_parent()
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 6f03055d508ff4feb8db02ba3df9303a1db8d381 ]
The MIPS BMC63XX subarch does not provide/support clk_set_parent(). This causes build errors in a few drivers, so add a simple implementation of that function so that callers of it will build without errors.
Fixes these build errors:
ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] undefined!
ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] undefined!
--- arch/mips/bcm63xx/clk.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/mips/bcm63xx/clk.c +6 -0
@@ -387,6 +387,12 @@ struct clk *clk_get_parent(struct clk *clk) }EXPORT_SYMBOL (clk_get_parent); +int clk_set_parent (struct clk *clk,struct clk *parent) +{ +return 0 ; +} +EXPORT_SYMBOL (clk_set_parent); +unsigned long clk_get_rate (struct clk *clk) {if (!clk)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 150/320 RDMA/cxgb4: Set queue pair state when being queried
In reply to Greg Kroah-HartmanFrom: Kamal Heib <[email protected]>
[ Upstream commit e375b9c92985e409c4bb95dd43d34915ea7f5e28 ]
The API for ib_query_qp requires the driver to set cur_qp_state on return, add the missing set.
--- drivers/infiniband/hw/cxgb4/qp.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/cxgb4/qp.c +1 -0
@@ -2469,6 +2469,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,memset (attr,0 ,sizeof (*attr));memset (init_attr,0 ,sizeof (*init_attr)); attr->qp_state =to_ib_qp_state (qhp->attr.state); + attr->cur_qp_state =to_ib_qp_state (qhp->attr.state); init_attr->cap.max_send_wr = qhp->attr.sq_num_entries; init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries; init_attr->cap.max_send_sge = qhp->attr.sq_max_sges;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 151/320 of: base: Fix phandle argument length mismatch error message
In reply to Greg Kroah-HartmanFrom: Baruch Siach <[email protected]>
[ Upstream commit 94a4950a4acff39b5847cc1fee4f65e160813493 ]
The cell_count field of of_phandle_iterator is the number of cells we expect in the phandle arguments list when cells_name is missing. The error message should show the number of cells we actually see.
--- drivers/of/base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/of/base.c +2 -2
@@ -1366,9 +1366,9 @@ int of_phandle_iterator_next(struct of_phandle_iterator *it)* property data length */ if (it->cur + count > it->list_end) { -pr_err ("%pOF: %s = %d found %d\n" , +pr_err ("%pOF: %s = %d found %td\n" , it->parent, it->cells_name, - count, it->cell_count); + count, it->list_end - it->cur); goto err; } }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 152/320 Bluetooth: Fix debugfs entry leak in hci_register_dev()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 5a4bb6a8e981d3d0d492aa38412ee80b21033177 ]
Fault injection test report debugfs entry leak as follows:
debugfs: Directory 'hci0' with parent 'bluetooth' already present!
When register_pm_notifier() failed in hci_register_dev(), the debugfs create by debugfs_create_dir() do not removed in the error handing path.
Add the remove debugfs code to fix it.
--- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/hci_core.c +1 -0
@@ -3387,6 +3387,7 @@ int hci_register_dev(struct hci_dev *hdev)return id; err_wqueue: +debugfs_remove_recursive (hdev->debugfs);destroy_workqueue (hdev->workqueue);destroy_workqueue (hdev->req_workqueue); err:
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 153/320 fs: dlm: filter user dlm messages for kernel locks
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 6c2e3bf68f3e5e5a647aa52be246d5f552d7496d ]
This patch fixes the following crash by receiving a invalid message:
[ 160.672220] ================================================================== [ 160.676206] BUG: KASAN: user-memory-access in dlm_user_add_ast+0xc3/0x370 [ 160.679659] Read of size 8 at addr 00000000deadbeef by task kworker/u32:13/319 [ 160.681447] [ 160.681824] CPU: 10 PID: 319 Comm: kworker/u32:13 Not tainted 5.14.0-rc2+ #399 [ 160.683472] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.14.0-1.module+el8.6.0+12648+6ede71a5 04/01/2014 [ 160.685574] Workqueue: dlm_recv process_recv_sockets [ 160.686721] Call Trace: [ 160.687310] dump_stack_lvl+0x56/0x6f [ 160.688169] ? dlm_user_add_ast+0xc3/0x370 [ 160.689116] kasan_report.cold.14+0x116/0x11b [ 160.690138] ? dlm_user_add_ast+0xc3/0x370 [ 160.690832] dlm_user_add_ast+0xc3/0x370 [ 160.691502] _receive_unlock_reply+0x103/0x170 [ 160.692241] _receive_message+0x11df/0x1ec0 [ 160.692926] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.693700] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.694427] ? lock_acquire+0x175/0x400 [ 160.695058] ? do_purge.isra.51+0x200/0x200 [ 160.695744] ? lock_acquired+0x360/0x5d0 [ 160.696400] ? lock_contended+0x6a0/0x6a0 [ 160.697055] ? lock_release+0x21d/0x5e0 [ 160.697686] ? lock_is_held_type+0xe0/0x110 [ 160.698352] ? lock_is_held_type+0xe0/0x110 [ 160.699026] ? ___might_sleep+0x1cc/0x1e0 [ 160.699698] ? dlm_wait_requestqueue+0x94/0x140 [ 160.700451] ? dlm_process_requestqueue+0x240/0x240 [ 160.701249] ? down_write_killable+0x2b0/0x2b0 [ 160.701988] ? do_raw_spin_unlock+0xa2/0x130 [ 160.702690] dlm_receive_buffer+0x1a5/0x210 [ 160.703385] dlm_process_incoming_buffer+0x726/0x9f0 [ 160.704210] receive_from_sock+0x1c0/0x3b0 [ 160.704886] ? dlm_tcp_shutdown+0x30/0x30 [ 160.705561] ? lock_acquire+0x175/0x400 [ 160.706197] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.706941] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.707681] process_recv_sockets+0x32/0x40 [ 160.708366] process_one_work+0x55e/0xad0 [ 160.709045] ? pwq_dec_nr_in_flight+0x110/0x110 [ 160.709820] worker_thread+0x65/0x5e0 [ 160.710423] ? process_one_work+0xad0/0xad0 [ 160.711087] kthread+0x1ed/0x220 [ 160.711628] ? set_kthread_struct+0x80/0x80 [ 160.712314] ret_from_fork+0x22/0x30
The issue is that we received a DLM message for a user lock but the destination lock is a kernel lock. Note that the address which is trying to derefence is 00000000deadbeef, which is in a kernel lock lkb->lkb_astparam, this field should never be derefenced by the DLM kernel stack. In case of a user lock lkb->lkb_astparam is lkb->lkb_ua (memory is shared by a union field). The struct lkb_ua will be handled by the DLM kernel stack but on a kernel lock it will contain invalid data and ends in most likely crashing the kernel.
It can be reproduced with two cluster nodes.
node 2:dlm_tool join test
echo "862 fooobaar 1 2 1" > /sys/kernel/debug/dlm/test_locks echo "862 3 1" > /sys/kernel/debug/dlm/test_waiters
node 1:dlm_tool join test
python:
foo = DLM(h_cmd=3, o_nextcmd=1, h_nodeid=1, h_lockspace=0x77222027, \
m_type=7, m_flags=0x1, m_remid=0x862, m_result=0xFFFEFFFE)newFile = open("/sys/kernel/debug/dlm/comms/2/rawmsg", "wb") newFile.write(bytes(foo))
--- fs/dlm/lock.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/dlm/lock.c +9 -0
@@ -3975,6 +3975,14 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms)int from = ms->m_header.h_nodeid;int error =0 ; +/* currently mixing of user/kernel locks are not supported */ +if (ms->m_flags &DLM_IFL_USER && ~lkb->lkb_flags &DLM_IFL_USER ) { +log_error (lkb->lkb_resource->res_ls, +"got user dlm message for a kernel lock" ); + error = -EINVAL ; + goto out; + } +switch (ms->m_type) {case DLM_MSG_CONVERT :case DLM_MSG_UNLOCK :
@@ -4003,6 +4011,7 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms) error = -EINVAL ; } +out:if (error) log_error(lkb->lkb_resource->res_ls, "ignore invalid message %d from %d %x %x %x %d",
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 154/320 libbpf: Validate that .BTF and .BTF.ext sections contain data
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 62554d52e71797eefa3fc15b54008038837bb2d4 ]
.BTF and .BTF.ext ELF sections should have SHT_PROGBITS type and contain data. If they are not, ELF is invalid or corrupted, so bail out. Otherwise this can lead to data->d_buf being NULL and SIGSEGV later on. Reported by oss-fuzz project.
--- tools/lib/bpf/libbpf.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/lib/bpf/libbpf.c +4 -0
@@ -1578,8 +1578,12 @@ static int bpf_object__elf_collect(struct bpf_object *obj, int flags) }else if (strcmp (name,MAPS_ELF_SEC ) ==0 ) { obj->efile.btf_maps_shndx = idx; }else if (strcmp (name,BTF_ELF_SEC ) ==0 ) { +if (sh->sh_type !=SHT_PROGBITS ) +return -LIBBPF_ERRNO__FORMAT ; btf_data = data; }else if (strcmp (name,BTF_EXT_ELF_SEC ) ==0 ) { +if (sh->sh_type !=SHT_PROGBITS ) +return -LIBBPF_ERRNO__FORMAT ; btf_ext_data = data; }else if (sh.sh_type ==SHT_SYMTAB ) {if (obj->efile.symbols) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 155/320 drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y
In reply to Greg Kroah-HartmanFrom: Qiang Yu <[email protected]>
[ Upstream commit 89636a06fa2ee7826a19c39c19a9bc99ab9340a9 ]
Otherwise get following warning:
DMA-API: lima 1c40000.gpu: mapping sg segment longer than device claims to support [len=4149248] [max=65536]
See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5496
--- drivers/gpu/drm/lima/lima_device.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/lima/lima_device.c +1 -0
@@ -293,6 +293,7 @@ int lima_device_init(struct lima_device *ldev)struct resource *res;dma_set_coherent_mask (ldev->dev,DMA_BIT_MASK (32 )); +dma_set_max_seg_size (ldev->dev,UINT_MAX ); err =lima_clk_init (ldev);if (err)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 156/320 ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
In reply to Greg Kroah-HartmanFrom: Zekun Shen <[email protected]>
[ Upstream commit ae80b6033834342601e99f74f6a62ff5092b1cee ]
Unexpected WDCMSG_TARGET_START replay can lead to null-ptr-deref when ar->tx_cmd->odata is NULL. The patch adds a null check to prevent such case.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] ar5523_cmd+0x46a/0x581 [ar5523] ar5523_probe.cold+0x1b7/0x18da [ar5523] ? ar5523_cmd_rx_cb+0x7a0/0x7a0 [ar5523] ? __pm_runtime_set_status+0x54a/0x8f0 ? _raw_spin_trylock_bh+0x120/0x120 ? pm_runtime_barrier+0x220/0x220 ? __pm_runtime_resume+0xb1/0xf0 usb_probe_interface+0x25b/0x710 really_probe+0x209/0x5d0 driver_probe_device+0xc6/0x1b0 device_driver_attach+0xe2/0x120
I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU.
After fixing the code (fourth byte in usb packet) to WDCMSG_TARGET_START, I got the null-ptr-deref bug. I believe the bug is triggerable whenever cmd->odata is NULL. After patching, I tested with the same input and no longer see the KASAN report.
This was NOT tested on a real device.
--- drivers/net/wireless/ath/ar5523/ar5523.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ar5523/ar5523.c +4 -0
@@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb)ar5523_err (ar,"Invalid reply to WDCMSG_TARGET_START" );return ; } +if (!cmd->odata) { +ar5523_err (ar,"Unexpected WDCMSG_TARGET_START reply" ); +return ; + }memcpy (cmd->odata, hdr +1 ,sizeof (u32)); cmd->olen =sizeof (u32); cmd->res =0 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 157/320 drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
[ Upstream commit 1d2271d2fb85e54bfc9630a6c30ac0feb9ffb983 ]
There have been reports of the WFI timing out on some boards, and a patch was proposed to just remove it. This stuff is rather fragile, and I believe the WFI might be needed with our FW prior to GM200.
However, we probably should not be touching PMU during init on GPUs where we depend on NVIDIA FW, outside of limited circumstances, so this should be a somewhat safer change that achieves the desired result.
--- .../gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 +++++++++++-------- 1 file changed, 21 insertions(+), 16 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c +21 -16
@@ -88,20 +88,13 @@ nvkm_pmu_fini(struct nvkm_subdev *subdev, bool suspend)return 0 ; } -static int +static void nvkm_pmu_reset (struct nvkm_pmu *pmu) {struct nvkm_device *device = pmu->subdev.device;if (!pmu->func->enabled (pmu)) -return 0 ; - -/* Inhibit interrupts, and wait for idle. */ -nvkm_wr32 (device,0x10a014 ,0x0000ffff ); -nvkm_msec (device,2000 , - if (!nvkm_rd32(device, 0x10a04c)) - break; - ); +return ;/* Reset. */ if (pmu->func->reset)
@@ -112,25 +105,37 @@ nvkm_pmu_reset(struct nvkm_pmu *pmu)if (!(nvkm_rd32 (device,0x10a10c ) &0x00000006 ))break ; ); - -return 0 ; }static int nvkm_pmu_preinit (struct nvkm_subdev *subdev) {struct nvkm_pmu *pmu =nvkm_pmu (subdev); -return nvkm_pmu_reset (pmu); +nvkm_pmu_reset (pmu); +return 0 ; }static int nvkm_pmu_init (struct nvkm_subdev *subdev) {struct nvkm_pmu *pmu =nvkm_pmu (subdev); -int ret =nvkm_pmu_reset (pmu); -if (ret ==0 && pmu->func->init) - ret = pmu->func->init (pmu); -return ret; +struct nvkm_device *device = pmu->subdev.device; + +if (!pmu->func->init) +return 0 ; + +if (pmu->func->enabled (pmu)) { +/* Inhibit interrupts, and wait for idle. */ +nvkm_wr32 (device,0x10a014 ,0x0000ffff ); +nvkm_msec (device,2000 , + if (!nvkm_rd32(device, 0x10a04c)) + break; + ); + +nvkm_pmu_reset (pmu); + } + +return pmu->func->init (pmu); } static int
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 158/320 ARM: shmobile: rcar-gen2: Add missing of_node_put()
In reply to Greg Kroah-HartmanFrom: Wan Jiabing <[email protected]>
[ Upstream commit 85744f2d938c5f3cfc44cb6533c157469634da93 ]
Fix following coccicheck warning:
./arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c:156:1-33: Function for_each_matching_node_and_match should have of_node_put() before break and goto.
Early exits from for_each_matching_node_and_match() should decrement the node reference counter.
--- arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +4 -1
@@ -154,8 +154,10 @@ static int __init rcar_gen2_regulator_quirk(void)return -ENODEV ;for_each_matching_node_and_match (np, rcar_gen2_quirk_match, &id) { -if (!of_device_is_available (np)) +if (!of_device_is_available (np)) { +of_node_put (np);break ; + } ret =of_property_read_u32 (np,"reg" , &addr);if (ret)/* Skip invalid entry and continue */
@@ -164,6 +166,7 @@ static int __init rcar_gen2_regulator_quirk(void) quirk =kzalloc (sizeof (*quirk),GFP_KERNEL );if (!quirk) { ret = -ENOMEM ; +of_node_put (np); goto err_mem; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 159/320 batman-adv: allow netlink usage in unprivileged containers
In reply to Greg Kroah-HartmanFrom: Linus Lüssing <[email protected]>
[ Upstream commit 9057d6c23e7388ee9d037fccc9a7bc8557ce277b ]
Currently, creating a batman-adv interface in an unprivileged LXD container and attaching secondary interfaces to it with "ip" or "batctl" works fine. However all batctl debug and configuration commands fail:
root@container:~# batctl originators Error received: Operation not permitted root@container:~# batctl orig_interval 1000 root@container:~# batctl orig_interval 2000 root@container:~# batctl orig_interval 1000
To fix this change the generic netlink permissions from GENL_ADMIN_PERM to GENL_UNS_ADMIN_PERM. This way a batman-adv interface is fully maintainable as root from within a user namespace, from an unprivileged container.
All except one batman-adv netlink setting are per interface and do not leak information or change settings from the host system and are therefore save to retrieve or modify as root from within an unprivileged container.
"batctl routing_algo" / BATADV_CMD_GET_ROUTING_ALGOS is the only
exception: It provides the batman-adv kernel module wide default routing algorithm. However it is read-only from netlink and an unprivileged container is still not allowed to modify /sys/module/batman_adv/parameters/routing_algo. Instead it is advised to use the newly introduced "batctl if create routing_algo RA_NAME" / IFLA_BATADV_ALGO_NAME to set the routing algorithm on interface creation, which already works fine in an unprivileged container.
--- net/batman-adv/netlink.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
net/batman-adv/netlink.c +15 -15
@@ -1351,21 +1351,21 @@ static const struct genl_ops batadv_netlink_ops[] = { { .cmd = BATADV_CMD_TP_METER, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .doit = batadv_netlink_tp_meter_start, .internal_flags = BATADV_FLAG_NEED_MESH, }, { .cmd = BATADV_CMD_TP_METER_CANCEL, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .doit = batadv_netlink_tp_meter_cancel, .internal_flags = BATADV_FLAG_NEED_MESH, }, { .cmd = BATADV_CMD_GET_ROUTING_ALGOS, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_algo_dump, }, {
@@ -1380,68 +1380,68 @@ static const struct genl_ops batadv_netlink_ops[] = { { .cmd = BATADV_CMD_GET_TRANSTABLE_LOCAL, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_tt_local_dump, }, { .cmd = BATADV_CMD_GET_TRANSTABLE_GLOBAL, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_tt_global_dump, }, { .cmd = BATADV_CMD_GET_ORIGINATORS, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_orig_dump, }, { .cmd = BATADV_CMD_GET_NEIGHBORS, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_hardif_neigh_dump, }, { .cmd = BATADV_CMD_GET_GATEWAYS, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_gw_dump, }, { .cmd = BATADV_CMD_GET_BLA_CLAIM, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_bla_claim_dump, }, { .cmd = BATADV_CMD_GET_BLA_BACKBONE, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_bla_backbone_dump, }, { .cmd = BATADV_CMD_GET_DAT_CACHE, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_dat_cache_dump, }, { .cmd = BATADV_CMD_GET_MCAST_FLAGS, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .dumpit = batadv_mcast_flags_dump, }, { .cmd = BATADV_CMD_SET_MESH, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .doit = batadv_netlink_set_mesh, .internal_flags = BATADV_FLAG_NEED_MESH, }, { .cmd = BATADV_CMD_SET_HARDIF, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .doit = batadv_netlink_set_hardif, .internal_flags = BATADV_FLAG_NEED_MESH | BATADV_FLAG_NEED_HARDIF,
@@ -1457,7 +1457,7 @@ static const struct genl_ops batadv_netlink_ops[] = { { .cmd = BATADV_CMD_SET_VLAN, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, + .flags = GENL_UNS_ADMIN_PERM, .doit = batadv_netlink_set_vlan, .internal_flags =BATADV_FLAG_NEED_MESH | BATADV_FLAG_NEED_VLAN,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 160/320 usb: gadget: f_fs: Use stream_open() for endpoint files
In reply to Greg Kroah-HartmanFrom: Pavankumar Kondeti <[email protected]>
[ Upstream commit c76ef96fc00eb398c8fc836b0eb2f82bcc619dc7 ]
Function fs endpoint file operations are synchronized via an interruptible mutex wait. However we see threads that do ep file operations concurrently are getting blocked for the mutex lock in __fdget_pos(). This is an uninterruptible wait and we see hung task warnings and kernel panic if hung_task_panic systcl is enabled if host does not send/receive the data for long time.
The reason for threads getting blocked in __fdget_pos() is due to the file position protection introduced by the commit 9c225f2655e3 ("vfs: atomic f_pos accesses as per POSIX"). Since function fs endpoint files does not have the notion of the file position, switch to the stream mode. This will bypass the file position mutex and threads will be blocked in interruptible state for the function fs mutex.
It should not affects user space as we are only changing the task state changes the task state from UNINTERRUPTIBLE to INTERRUPTIBLE while waiting for the USB transfers to be finished. However there is a slight change to the O_NONBLOCK behavior. Earlier threads that are using O_NONBLOCK are also getting blocked inside fdget_pos(). Now they reach to function fs and error code is returned. The non blocking behavior is actually honoured now.
--- drivers/usb/gadget/function/f_fs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_fs.c +2 -2
@@ -614,7 +614,7 @@ static int ffs_ep0_open(struct inode *inode, struct file *file) file->private_data = ffs;ffs_data_opened (ffs); -return 0 ; +return stream_open (inode, file); }static int ffs_ep0_release (struct inode *inode,struct file *file)
@@ -1156,7 +1156,7 @@ ffs_epfile_open(struct inode *inode, struct file *file) file->private_data = epfile;ffs_data_opened (epfile->ffs); -return 0 ; +return stream_open (inode, file); }static int ffs_aio_cancel (struct kiocb *kiocb)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 161/320 drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit bc30c3b0c8a1904d83d5f0d60fb8650a334b207b ]
The Lenovo Yoga Book X91F/L uses a panel which has been mounted 90 degrees rotated. Add a quirk for this.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -248,6 +248,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), }, .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Lenovo Yoga Book X90F / X91F / X91L */ + .matches = { +/* Non exact match to match all versions */ + DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X9"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, }, { /* OneGX1 Pro */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SYSTEM_MANUFACTURER"),
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 162/320 HID: apple: Do not reset quirks when the Fn key is not found
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
[ Upstream commit a5fe7864d8ada170f19cc47d176bf8260ffb4263 ]
When a keyboard without a function key is detected, instead of removing all quirks, remove only the APPLE_HAS_FN quirk.
--- drivers/hid/hid-apple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-apple.c +1 -1
@@ -389,7 +389,7 @@ static int apple_input_configured(struct hid_device *hdev,if ((asc->quirks &APPLE_HAS_FN ) && !asc->fn_found) {hid_info (hdev,"Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n" ); - asc->quirks =0 ; + asc->quirks &= ~APPLE_HAS_FN ; }return 0 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 163/320 media: b2c2: Add missing check in flexcop_pci_isr:
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit b13203032e679674c7c518f52a7ec0801ca3a829 ]
A out-of-bounds bug can be triggered by an interrupt, the reason for this bug is the lack of checking of register values.
In flexcop_pci_isr, the driver reads value from a register and uses it as a dma address. Finally, this address will be passed to the count parameter of find_next_packet. If this value is larger than the size of dma, the index of buffer will be out-of-bounds.
Fix this by adding a check after reading the value of the register.
The following KASAN report reveals it:
BUG: KASAN: slab-out-of-bounds in find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] BUG: KASAN: slab-out-of-bounds in _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] BUG: KASAN: slab-out-of-bounds in dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 Read of size 1 at addr ffff8880608c00a0 by task swapper/2/0 CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xec/0x156 lib/dump_stack.c:118 print_address_description+0x78/0x290 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x25b/0x380 mm/kasan/report.c:412 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:430 find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 flexcop_pass_dmx_data+0x2e/0x40 drivers/media/common/b2c2/flexcop.c:167 flexcop_pci_isr+0x3d1/0x5d0 drivers/media/pci/b2c2/flexcop-pci.c:212 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 </IRQ> RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 62 2f 8c 48 89 e5 e8 fb 31
e8 f8 8b 05 75 4f 8e 03 85 c0 7e 07 0f 00 2d 8a 61 66 00 fb f4 <5d> c3 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41
RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde
RAX: 0000000000000000 RBX: ffffffff8bde44c8 RCX: ffffffff88a11285
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2f6200
RBP: ffff88806b71fcc8 R08: fffffbfff185ec40 R09: fffffbfff185ec40
R10: 0000000000000001 R11: fffffbfff185ec40 R12: 0000000000000002
R13: ffffffff8be9d6e0 R14: 0000000000000000 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Allocated by task 1: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2741 [inline] slab_alloc mm/slub.c:2749 [inline] kmem_cache_alloc+0xeb/0x280 mm/slub.c:2754 kmem_cache_zalloc include/linux/slab.h:699 [inline] __kernfs_new_node+0xe2/0x6f0 fs/kernfs/dir.c:633 kernfs_new_node+0x9a/0x120 fs/kernfs/dir.c:693 __kernfs_create_file+0x5f/0x340 fs/kernfs/file.c:992 sysfs_add_file_mode_ns+0x22a/0x4e0 fs/sysfs/file.c:306 create_files fs/sysfs/group.c:63 [inline] internal_create_group+0x34e/0xc30 fs/sysfs/group.c:147 sysfs_create_group fs/sysfs/group.c:173 [inline] sysfs_create_groups+0x9c/0x140 fs/sysfs/group.c:200 driver_add_groups+0x3e/0x50 drivers/base/driver.c:129 bus_add_driver+0x3a5/0x790 drivers/base/bus.c:684 driver_register+0x1cd/0x410 drivers/base/driver.c:170 __pci_register_driver+0x197/0x200 drivers/pci/pci-driver.c:1411 cx88_audio_pci_driver_init+0x23/0x25 drivers/media/pci/cx88/cx88-alsa.c: 1017 do_one_initcall+0xe0/0x610 init/main.c:884 do_initcall_level init/main.c:952 [inline] do_initcalls init/main.c:960 [inline] do_basic_setup init/main.c:978 [inline] kernel_init_freeable+0x4d0/0x592 init/main.c:1145 kernel_init+0x18/0x190 init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff8880608c0000
which belongs to the cache kernfs_node_cache of size 160
The buggy address is located 0 bytes to the right of
160-byte region [ffff8880608c0000, ffff8880608c00a0)
The buggy address belongs to the page:
page:ffffea0001823000 count:1 mapcount:0 mapping:ffff88806bed1e00
index:0x0 compound_mapcount: 0
flags: 0x100000000008100(slab|head)
raw: 0100000000008100 dead000000000100 dead000000000200 ffff88806bed1e00
raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880608bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880608c0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880608c0080: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00
^
ffff8880608c0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880608c0180: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================--- drivers/media/pci/b2c2/flexcop-pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/pci/b2c2/flexcop-pci.c +3 -0
@@ -185,6 +185,8 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id)dma_addr_t cur_addr = fc->read_ibi_reg (fc,dma1_008).dma_0x8.dma_cur_addr <<2 ;u32 cur_pos = cur_addr - fc_pci->dma[0 ].dma_addr0; +if (cur_pos > fc_pci->dma[0 ].size *2 ) + goto error; deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, last_cur_pos: %08x ", jiffies_to_usecs(jiffies - fc_pci->last_irq),
@@ -225,6 +227,7 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id) ret =IRQ_NONE ; } +error:spin_unlock_irqrestore (&fc_pci->irq_lock, flags);return ret; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 164/320 EDAC/synopsys: Use the quirk for version instead of ddr version
In reply to Greg Kroah-HartmanFrom: Dinh Nguyen <[email protected]>
[ Upstream commit bd1d6da17c296bd005bfa656952710d256e77dd3 ]
Version 2.40a supports DDR_ECC_INTR_SUPPORT for a quirk, so use that quirk to determine a call to setup_address_map().
--- drivers/edac/synopsys_edac.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/edac/synopsys_edac.c +1 -2
@@ -1351,8 +1351,7 @@ static int mc_probe(struct platform_device *pdev) } } -if (of_device_is_compatible (pdev->dev.of_node, -"xlnx,zynqmp-ddrc-2.40a" )) +if (priv->p_data->quirks &DDR_ECC_INTR_SUPPORT )setup_address_map (priv);#endif
Signature · 1 line
2.34.1