5.10.121-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.10.121-rc1 review
This is the start of the stable review cycle for the 5.10.121 release. There are 452 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 09 Jun 2022 16:48:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.121-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.121-rc1
Jia-Ju Bai <[email protected]>
md: bcache: check the return value of kzalloc() in detached_dev_do_request()
Eric Biggers <[email protected]>
ext4: only allow test_dummy_encryption when supported
Maciej W. Rozycki <[email protected]>
MIPS: IP30: Remove incorrect `cpu_has_fpu' override
Maciej W. Rozycki <[email protected]>
MIPS: IP27: Remove incorrect `cpu_has_fpu' override
Xiao Yang <[email protected]>
RDMA/rxe: Generate a completion for unsupported/invalid opcode
Jason A. Donenfeld <[email protected]>
Revert "random: use static branch for crng_ready()"
Jan Kara <[email protected]>
block: fix bio_clone_blkg_association() to associate with proper blkcg_gq
Jan Kara <[email protected]>
bfq: Make sure bfqg for which we are queueing requests is online
Jan Kara <[email protected]>
bfq: Get rid of __bio_blkcg() usage
Jan Kara <[email protected]>
bfq: Remove pointless bfq_init_rq() calls
Jan Kara <[email protected]>
bfq: Drop pointless unlock-lock pair
Jan Kara <[email protected]>
bfq: Avoid merging queues with different parents
Daniel Lezcano <[email protected]>
thermal/core: Fix memory leak in the error path
Ziyang Xuan <[email protected]>
thermal/core: fix a UAF bug in __thermal_cooling_device_register()
Waiman Long <[email protected]>
kseltest/cgroup: Make test_stress.sh work if run interactively
Dave Chinner <[email protected]>
xfs: assert in xfs_btree_del_cursor should take into account error
Brian Foster <[email protected]>
xfs: consider shutdown in bmapbt cursor delete assert
Darrick J. Wong <[email protected]>
xfs: force log and push AIL to clear pinned inodes when aborting mount
Brian Foster <[email protected]>
xfs: restore shutdown check in mapped write fault path
Darrick J. Wong <[email protected]>
xfs: fix incorrect root dquot corruption error when switching group/project quota types
Darrick J. Wong <[email protected]>
xfs: fix chown leaking delalloc quota blocks when fssetxattr fails
Brian Foster <[email protected]>
xfs: sync lazy sb accounting on quiesce of read-only mounts
Jeffrey Mitchell <[email protected]>
xfs: set inode size after creating symlink
Alex Elder <[email protected]>
net: ipa: fix page free in ipa_endpoint_replenish_one()
Alex Elder <[email protected]>
net: ipa: fix page free in ipa_endpoint_trans_release()
Johan Hovold <[email protected]>
phy: qcom-qmp: fix reset-controller leak on probe errors
Mao Jinlong <[email protected]>
coresight: core: Fix coresight device probe failure issue
Tejun Heo <[email protected]>
blk-iolatency: Fix inflight count imbalances and IO hangs on offline
Eugenio Pérez <[email protected]>
vdpasim: allow to enable a vq repeatedly
Dinh Nguyen <[email protected]>
dt-bindings: gpio: altera: correct interrupt-cells
Akira Yokosawa <[email protected]>
docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
Steve French <[email protected]>
SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op
Arnd Bergmann <[email protected]>
ARM: pxa: maybe fix gpio lookup tables
Jonathan Bakker <[email protected]>
ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries
Johan Hovold <[email protected]>
phy: qcom-qmp: fix struct clk leak on probe errors
Kathiravan T <[email protected]>
arm64: dts: qcom: ipq8074: fix the sleep clock frequency
Xiaomeng Tong <[email protected]>
gma500: fix an incorrect NULL check on list iterator
Xiaomeng Tong <[email protected]>
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
Jiri Slaby <[email protected]>
serial: pch: don't overwrite xmit->buf[0] by x_char
Coly Li <[email protected]>
bcache: avoid journal no-space deadlock by reserving 1 journal bucket
Coly Li <[email protected]>
bcache: remove incremental dirty sector counting for bch_sectors_dirty_init()
Coly Li <[email protected]>
bcache: improve multithreaded bch_sectors_dirty_init()
Coly Li <[email protected]>
bcache: improve multithreaded bch_btree_check()
Xiaomeng Tong <[email protected]>
stm: ltdc: fix two incorrect NULL checks on list iterator
Xiaomeng Tong <[email protected]>
carl9170: tx: fix an incorrect use of list iterator
Mark Brown <[email protected]>
ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
Alexander Wetzel <[email protected]>
rtl818x: Prevent using not initialized queues
Yi Yang <[email protected]>
xtensa/simdisk: fix proc_read_simdisk()
Mike Kravetz <[email protected]>
hugetlb: fix huge_pmd_unshare address update
Christophe de Dinechin <[email protected]>
nodemask.h: fix compilation error with GCC12
Xiaomeng Tong <[email protected]>
iommu/msm: Fix an incorrect NULL check on list iterator
Song Liu <[email protected]>
ftrace: Clean up hash direct_functions on register failures
Naveen N. Rao <[email protected]>
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
Vincent Whitchurch <[email protected]>
um: Fix out-of-bounds read in LDT setup
Johannes Berg <[email protected]>
um: chan_user: Fix winch_tramp() return value
Felix Fietkau <[email protected]>
mac80211: upgrade passive scan to active scan on DFS channels after beacon rx
Dimitri John Ledkov <[email protected]>
cfg80211: declare MODULE_FIRMWARE for regulatory.db
Max Filippov <[email protected]>
irqchip: irq-xtensa-mx: fix initial IRQ affinity
Pali Rohár <[email protected]>
irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x
Guo Ren <[email protected]>
csky: patch_text: Fixup last cpu should be master
Dennis Dalessandro <[email protected]>
RDMA/hfi1: Fix potential integer multiplication overflow errors
Sean Christopherson <[email protected]>
Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug
GUO Zihua <[email protected]>
ima: remove the IMA_TEMPLATE Kconfig option
Nicolas Dufresne <[email protected]>
media: coda: Add more H264 levels for CODA960
Nicolas Dufresne <[email protected]>
media: coda: Fix reported H264 profile
Tokunori Ikegami <[email protected]>
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
Tokunori Ikegami <[email protected]>
mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write
Xiaomeng Tong <[email protected]>
md: fix an incorrect NULL check in md_reload_sb
Xiaomeng Tong <[email protected]>
md: fix an incorrect NULL check in does_sb_need_changing
Jani Nikula <[email protected]>
drm/i915/dsi: fix VBT send packet port selection for ICL+
Brian Norris <[email protected]>
drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
Xiaomeng Tong <[email protected]>
drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator
Xiaomeng Tong <[email protected]>
drm/nouveau/clk: Fix an incorrect NULL check on list iterator
Lucas Stach <[email protected]>
drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem
Dave Airlie <[email protected]>
drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
Manivannan Sadhasivam <[email protected]>
scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
Xiaomeng Tong <[email protected]>
scsi: dc395x: Fix a missing check on list iterator
Junxiao Bi via Ocfs2-devel <[email protected]>
ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
Alexander Aring <[email protected]>
dlm: fix missing lkb refcount handling
Alexander Aring <[email protected]>
dlm: fix plock invalid read
Nico Boehr <[email protected]>
s390/perf: obtain sie_block from the right address
Rei Yamamoto <[email protected]>
mm, compaction: fast_find_migrateblock() should return pfn in the target zone
Johan Hovold <[email protected]>
PCI: qcom: Fix unbalanced PHY init on probe errors
Johan Hovold <[email protected]>
PCI: qcom: Fix runtime PM imbalance on probe errors
Bjorn Helgaas <[email protected]>
PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299
Keita Suzuki <[email protected]>
tracing: Fix potential double free in create_var_ref()
Sakari Ailus <[email protected]>
ACPI: property: Release subnode properties with data nodes
Jan Kara <[email protected]>
ext4: avoid cycles in directory h-tree
Jan Kara <[email protected]>
ext4: verify dir block before splitting it
Baokun Li <[email protected]>
ext4: fix bug_on in __es_tree_search
Theodore Ts'o <[email protected]>
ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state
Ye Bin <[email protected]>
ext4: fix bug_on in ext4_writepages
Ye Bin <[email protected]>
ext4: fix warning in ext4_handle_inode_extension
Ye Bin <[email protected]>
ext4: fix use-after-free in ext4_rename_dir_prepare
Jan Kara <[email protected]>
bfq: Track whether bfq_group is still online
Jan Kara <[email protected]>
bfq: Update cgroup information before merging bio
Jan Kara <[email protected]>
bfq: Split shared queues on move between cgroups
Aditya Garg <[email protected]>
efi: Do not import certificates from UEFI Secure Boot for T2 Macs
Zhihao Cheng <[email protected]>
fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix assert 1F04 upon reconfig
Johannes Berg <[email protected]>
wifi: mac80211: fix use-after-free in chanctx code
Chao Yu <[email protected]>
f2fs: fix to do sanity check for inline inode
Chao Yu <[email protected]>
f2fs: fix fallocate to use file_modified to update permissions consistently
Chao Yu <[email protected]>
f2fs: fix to do sanity check on total_data_blocks
Jaegeuk Kim <[email protected]>
f2fs: don't need inode lock for system hidden quota
Chao Yu <[email protected]>
f2fs: fix deadloop in foreground GC
Chao Yu <[email protected]>
f2fs: fix to clear dirty inode in f2fs_evict_inode()
Chao Yu <[email protected]>
f2fs: fix to do sanity check on block address in f2fs_do_zero_range()
Chao Yu <[email protected]>
f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()
Zhengjun Xing <[email protected]>
perf jevents: Fix event syntax error caused by ExtSel
Leo Yan <[email protected]>
perf c2c: Use stdio interface if slang is not supported
Kuninori Morimoto <[email protected]>
i2c: rcar: fix PM ref counts in probe error paths
Tali Perry <[email protected]>
i2c: npcm: Handle spurious interrupts
Tyrone Ting <[email protected]>
i2c: npcm: Correct register access width
Tali Perry <[email protected]>
i2c: npcm: Fix timeout calculation
Joerg Roedel <[email protected]>
iommu/amd: Increase timeout waiting for GA log enablement
Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()
Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: rework interrupt handler
Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: remove GISR1 register
Miaoqian Lin <[email protected]>
video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
Trond Myklebust <[email protected]>
NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout
Trond Myklebust <[email protected]>
NFS: Don't report errors from nfs_pageio_complete() more than once
Trond Myklebust <[email protected]>
NFS: Do not report flush errors in nfs_write_end()
Trond Myklebust <[email protected]>
NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS
Trond Myklebust <[email protected]>
NFS: Do not report EINTR/ERESTARTSYS as mapping errors
Christophe JAILLET <[email protected]>
dmaengine: idxd: Fix the error handling path in idxd_cdev_register()
Nathan Chancellor <[email protected]>
i2c: at91: Initialize dma_buf in at91_twi_xfer()
Guenter Roeck <[email protected]>
MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon
Rex-BC Chen <[email protected]>
cpufreq: mediatek: Unregister platform device on exit
Jia-Wei Chang <[email protected]>
cpufreq: mediatek: Use module_init and add module_exit
Qinglang Miao <[email protected]>
cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init
Michael Walle <[email protected]>
i2c: at91: use dma safe buffers
Yong Wu <[email protected]>
iommu/mediatek: Add list_del in mtk_iommu_remove
Jakob Koschel <[email protected]>
f2fs: fix dereference of stale list iterator after loop body
Dan Carpenter <[email protected]>
OPP: call of_node_put() on error path in _bandwidth_supported()
Dmitry Torokhov <[email protected]>
Input: stmfts - do not leave device disabled in stmfts_input_open
Douglas Miller <[email protected]>
RDMA/hfi1: Prevent use of lock before it is initialized
Björn Ardö <[email protected]>
mailbox: forward the hrtimer if not queued and under a lock
Yang Yingliang <[email protected]>
mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()
Miaoqian Lin <[email protected]>
powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup
Randy Dunlap <[email protected]>
macintosh: via-pmu and via-cuda need RTC_LIB
Kajol Jain <[email protected]>
powerpc/perf: Fix the threshold compare group constraint for power9
Michael Ellerman <[email protected]>
powerpc/64: Only WARN if __pa()/__va() called with bad addresses
Yang Yingliang <[email protected]>
hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume()
Kuppuswamy Sathyanarayanan <[email protected]>
PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits
Miaoqian Lin <[email protected]>
Input: sparcspkr - fix refcount leak in bbc_beep_probe
Sebastian Andrzej Siewior <[email protected]>
crypto: cryptd - Protect per-CPU resource by disabling BH.
Corentin Labbe <[email protected]>
crypto: sun8i-ss - handle zero sized sg
Corentin Labbe <[email protected]>
crypto: sun8i-ss - rework handling of IV
Qi Zheng <[email protected]>
tty: fix deadlock caused by calling printk() under tty_port->lock
Francesco Dolcini <[email protected]>
PCI: imx6: Fix PERST# start-up sequence
Waiman Long <[email protected]>
ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()
Alexey Dobriyan <[email protected]>
proc: fix dentry/inode overinstantiating under /proc/${pid}/netCharles Keepax <[email protected]>
ASoC: atmel-classd: Remove endianness flag on class d component
Charles Keepax <[email protected]>
ASoC: atmel-pdmic: Remove endianness flag on pdmic component
Randy Dunlap <[email protected]>
powerpc/4xx/cpm: Fix return value of __setup() handler
Randy Dunlap <[email protected]>
powerpc/idle: Fix return value of __setup() handler
Yang Yingliang <[email protected]>
pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()
Randy Dunlap <[email protected]>
powerpc/8xx: export 'cpm_setbrg' for modules
Christophe JAILLET <[email protected]>
drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block()
Muchun Song <[email protected]>
dax: fix cache flush on PMD-mapped pages
Miaohe Lin <[email protected]>
drivers/base/node.c: fix compaction sysfs file leak
Krzysztof Kozlowski <[email protected]>
pinctrl: mvebu: Fix irq_of_parse_and_map() return value
Dan Williams <[email protected]>
nvdimm: Allow overwrite in the presence of disabled dimms
Dan Williams <[email protected]>
nvdimm: Fix firmware activation deadlock scenarios
Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix list protocols enumeration in the base protocol
Gustavo A. R. Silva <[email protected]>
scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
Lv Ruyi <[email protected]>
mfd: ipaq-micro: Fix error check return value of platform_get_irq()
Hari Bathini <[email protected]>
powerpc/fadump: fix PT_LOAD segment for boot memory area
Chuanhong Guo <[email protected]>
arm: mediatek: select arch timer for mt7629
Stefan Wahren <[email protected]>
pinctrl: bcm2835: implement hook for missing gpio-ranges
Stefan Wahren <[email protected]>
gpiolib: of: Introduce hook for missing gpio-ranges
Corentin Labbe <[email protected]>
crypto: marvell/cesa - ECB does not IV
Hangyu Hua <[email protected]>
misc: ocxl: fix possible double free in ocxl_file_register_afu
Stefan Wahren <[email protected]>
ARM: dts: bcm2835-rpi-b: Fix GPIO line names
Phil Elwell <[email protected]>
ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED
Phil Elwell <[email protected]>
ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C
Phil Elwell <[email protected]>
ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
Marek Vasut <[email protected]>
ARM: dts: stm32: Fix PHY post-reset delay on Avenger96
Marc Kleine-Budde <[email protected]>
can: xilinx_can: mark bit timing constants as const
Guenter Roeck <[email protected]>
platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls
Max Krummenacher <[email protected]>
ARM: dts: imx6dl-colibri: Fix I2C pinmuxing
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec: fix error handling in cros_ec_register()
Sean Christopherson <[email protected]>
KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault
Sean Christopherson <[email protected]>
KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry
Bjorn Andersson <[email protected]>
soc: qcom: llcc: Add MODULE_DEVICE_TABLE()
Thorsten Scherer <[email protected]>
ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks
Jiantao Zhang <[email protected]>
PCI: dwc: Fix setting error return on MSI DMA mapping failure
Dan Carpenter <[email protected]>
PCI: rockchip: Fix find_first_zero_bit() limit
Dan Carpenter <[email protected]>
PCI: cadence: Fix find_first_zero_bit() limit
Miaoqian Lin <[email protected]>
soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
Miaoqian Lin <[email protected]>
soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
Andre Przywara <[email protected]>
ARM: dts: suniv: F1C100: fix watchdog compatible
Christophe JAILLET <[email protected]>
memory: samsung: exynos5422-dmc: Avoid some over memory allocation
Shawn Lin <[email protected]>
arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
liuyacan <[email protected]>
net/smc: postpone sk_refcnt increment in connect()
Christophe JAILLET <[email protected]>
hinic: Avoid some over memory allocation
Gustavo A. R. Silva <[email protected]>
net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()
David Howells <[email protected]>
rxrpc: Fix decision on when to generate an IDLE ACK
David Howells <[email protected]>
rxrpc: Don't let ack.previousPacket regress
David Howells <[email protected]>
rxrpc: Fix overlapping ACK accounting
David Howells <[email protected]>
rxrpc: Don't try to resend the request if we're receiving the reply
David Howells <[email protected]>
rxrpc: Fix listen() setting the bar too high for the prealloc rings
Yongzhi Liu <[email protected]>
hv_netvsc: Fix potential dereference of NULL pointer
Jakub Kicinski <[email protected]>
net: stmmac: fix out-of-bounds access in a selftest
Gustavo A. R. Silva <[email protected]>
net: stmmac: selftests: Use kcalloc() instead of kzalloc()
Alexey Khoroshilov <[email protected]>
ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()
Duoming Zhou <[email protected]>
NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
Yang Yingliang <[email protected]>
ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
Miaoqian Lin <[email protected]>
thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
Yang Yingliang <[email protected]>
thermal/core: Fix memory leak in __thermal_cooling_device_register()
Daniel Lezcano <[email protected]>
thermal/drivers/core: Use a char pointer for the cooling device name
Zheng Yongjun <[email protected]>
thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe
Stefan Wahren <[email protected]>
thermal/drivers/bcm2711: Don't clamp temperature at zero
Nathan Chancellor <[email protected]>
drm/i915: Fix CFI violation with show_dynamic_id()
Abhinav Kumar <[email protected]>
drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
Lai Jiangshan <[email protected]>
x86/sev: Annotate stack change in the #VC handler
Hangyu Hua <[email protected]>
drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
Miaoqian Lin <[email protected]>
drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
Eric Biggers <[email protected]>
ext4: reject the 'commit' option on ext2 filesystems
Jonas Karlman <[email protected]>
media: rkvdec: h264: Fix bit depth wrap in pps packet
Nicolas Dufresne <[email protected]>
media: rkvdec: h264: Fix dpb_valid implementation
Nicolas Dufresne <[email protected]>
media: rkvdec: Stop overclocking the decoder
Cai Huoqing <[email protected]>
media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource()
Dongliang Mu <[email protected]>
media: ov7670: remove ov7670_power_off from ov7670_remove
Miaoqian Lin <[email protected]>
ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
Zheng Bin <[email protected]>
net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
Eric Dumazet <[email protected]>
sctp: read sk->sk_bound_dev_if once in sctp_rcv()
Paul Moore <[email protected]>
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
Geert Uytterhoeven <[email protected]>
m68k: math-emu: Fix dependencies of math emulation support
Keith Busch <[email protected]>
nvme: set dma alignment to dword
Niels Dossche <[email protected]>
Bluetooth: use hdev lock for accept_list and reject_list in conn req
Archie Pusaka <[email protected]>
Bluetooth: use inclusive language when filtering devices
Archie Pusaka <[email protected]>
Bluetooth: use inclusive language in HCI role comments
Sathish Narasimman <[email protected]>
Bluetooth: LL privacy allow RPA
Bhaskar Chowdhury <[email protected]>
Bluetooth: L2CAP: Rudimentary typo fixes
Howard Chung <[email protected]>
Bluetooth: Interleave with allowlist scan
Ying Hsu <[email protected]>
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Michael Rodin <[email protected]>
media: vsp1: Fix offset calculation for plane cropping
Pavel Skripkin <[email protected]>
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
Miaoqian Lin <[email protected]>
media: exynos4-is: Change clk_disable to clk_disable_unprepare
Miaoqian Lin <[email protected]>
media: st-delta: Fix PM disable depth imbalance in delta_probe
Miaoqian Lin <[email protected]>
media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
Christophe JAILLET <[email protected]>
media: aspeed: Fix an error handling path in aspeed_video_probe()
Josh Poimboeuf <[email protected]>
scripts/faddr2line: Fix overlapping text section failures
Phil Auld <[email protected]>
kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
Miaoqian Lin <[email protected]>
ASoC: samsung: Fix refcount leak in aries_audio_probe
Kuninori Morimoto <[email protected]>
ASoC: samsung: Use dev_err_probe() helper
Miaoqian Lin <[email protected]>
regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
Miaoqian Lin <[email protected]>
ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
Miaoqian Lin <[email protected]>
ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
Baochen Qiang <[email protected]>
ath11k: Don't check arvif->is_started before sending management frames
Ravi Bangoria <[email protected]>
perf/amd/ibs: Use interrupt regs ip for stack unwinding
Konrad Dybcio <[email protected]>
regulator: qcom_smd: Fix up PM8950 regulator configuration
Viresh Kumar <[email protected]>
Revert "cpufreq: Fix possible race in cpufreq online error path"
Yang Yingliang <[email protected]>
spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
Andreas Gruenbacher <[email protected]>
iomap: iomap_write_failed fix
Xiaomeng Tong <[email protected]>
media: uvcvideo: Fix missing check to determine if element is found in list
Dan Carpenter <[email protected]>
drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
Jessica Zhang <[email protected]>
drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
Jessica Zhang <[email protected]>
drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
Kuogee Hsieh <[email protected]>
drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
Zev Weiss <[email protected]>
regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
Tong Tiangen <[email protected]>
arm64: fix types in copy_highpage()
Randy Dunlap <[email protected]>
x86/mm: Cleanup the control_va_addr_alignment() __setup handler
Krzysztof Kozlowski <[email protected]>
irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
Krzysztof Kozlowski <[email protected]>
irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
Daniel Thompson <[email protected]>
irqchip/exiu: Fix acknowledgment of edge triggered interrupts
Randy Dunlap <[email protected]>
x86: Fix return value of __setup handlers
Christoph Hellwig <[email protected]>
virtio_blk: fix the discard_granularity and discard_alignment queue limits
James Clark <[email protected]>
perf tools: Use Python devtools for version autodetection rather than runtime
Yang Yingliang <[email protected]>
drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
Jagan Teki <[email protected]>
drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H
Dmitry Baryshkov <[email protected]>
drm/msm: add missing include to msm_drv.c
Lv Ruyi <[email protected]>
drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()
Yang Yingliang <[email protected]>
drm/msm/hdmi: check return value after calling platform_get_resource_byname()
Dmitry Baryshkov <[email protected]>
drm/msm/dsi: fix error checks and return values for DSI xmit functions
Lv Ruyi <[email protected]>
drm/msm/dp: fix error check return value of irq_of_parse_and_map()
Kuogee Hsieh <[email protected]>
drm/msm/dp: stop event kernel thread when DP unbind
Vinod Polimera <[email protected]>
drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
Yang Jihong <[email protected]>
perf tools: Add missing headers needed by util/data.h
Nicolas Frattaroli <[email protected]>
ASoC: rk3328: fix disabling mclk on pclk probe failure
Josh Poimboeuf <[email protected]>
x86/speculation: Add missing prototype for unpriv_ebpf_notify()
Yang Yingliang <[email protected]>
mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()
Matthieu Baerts <[email protected]>
x86/pm: Fix false positive kmemleak report in msr_build_context()
Chen-Tsung Hsieh <[email protected]>
mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check()
Andrii Nakryiko <[email protected]>
libbpf: Fix logic for finding matching program for CO-RE relocation
Colin Ian King <[email protected]>
selftests/resctrl: Fix null pointer dereference on open failed
Kiwoong Kim <[email protected]>
scsi: ufs: core: Exclude UECxx from SFR dump list
Bart Van Assche <[email protected]>
scsi: ufs: qcom: Fix ufs_qcom_resume()
Kuogee Hsieh <[email protected]>
drm/msm/dpu: adjust display_v_end for eDP and DP
Nuno Sá <[email protected]>
of: overlay: do not break notify on NOTIFY_{OK|STOP}Amir Goldstein <[email protected]>
fsnotify: fix wrong lockdep annotations
Amir Goldstein <[email protected]>
inotify: show inotify mask flags in proc fdinfo
Colin Ian King <[email protected]>
ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
Marek Vasut <[email protected]>
drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01
Chen-Yu Tsai <[email protected]>
media: hantro: Empty encoder capture buffers by default
Dan Carpenter <[email protected]>
ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
Schspa Shi <[email protected]>
cpufreq: Fix possible race in cpufreq online error path
Zheng Yongjun <[email protected]>
spi: img-spfi: Fix pm_runtime_get_sync() error checking
Chengming Zhou <[email protected]>
sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
Miaoqian Lin <[email protected]>
drm/bridge: Fix error handling in analogix_dp_probe
Miaoqian Lin <[email protected]>
HID: elan: Fix potential double free in elan_input_configured
Jonathan Teh <[email protected]>
HID: hid-led: fix maximum brightness for Dream Cheeky
Zheyu Ma <[email protected]>
mtd: rawnand: denali: Use managed device resources
Tyler Hicks <[email protected]>
EDAC/dmc520: Don't print an error for each unconfigured interrupt line
Arnd Bergmann <[email protected]>
drbd: fix duplicate array initializer
Christoph Hellwig <[email protected]>
target: remove an incorrect unmap zeroes data deduction
Jan Kiszka <[email protected]>
efi: Add missing prototype for efi_capsule_setup_info
Lin Ma <[email protected]>
NFC: NULL out the dev->rfkill to prevent UAF
Russell King (Oracle) <[email protected]>
net: dsa: mt7530: 1G can also support 1000BASE-X link mode
Paul E. McKenney <[email protected]>
scftorture: Fix distribution of short handler delays
Miaoqian Lin <[email protected]>
spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
Jiasheng Jiang <[email protected]>
drm: mali-dp: potential dereference of null pointer
Zhou Qingyang <[email protected]>
drm/komeda: Fix an undefined behavior bug in komeda_plane_add()
Johannes Berg <[email protected]>
nl80211: show SSID for P2P_GO interfaces
Yuntao Wang <[email protected]>
bpf: Fix excessive memory allocation in stack_map_alloc()
Andrii Nakryiko <[email protected]>
libbpf: Don't error out on CO-RE relos for overriden weak subprogs
Maxime Ripard <[email protected]>
drm/vc4: txp: Force alpha to be 0xff if it's disabled
Maxime Ripard <[email protected]>
drm/vc4: txp: Don't set TXP_VSTART_AT_EOF
Maxime Ripard <[email protected]>
drm/vc4: hvs: Reset muxes at probe time
Miles Chen <[email protected]>
drm/mediatek: Fix mtk_cec_mask()
Paul Cercueil <[email protected]>
drm/ingenic: Reset pixclock rate when parent clock rate changes
Ammar Faizi <[email protected]>
x86/delay: Fix the wrong asm constraint in delay_loop()
Miaoqian Lin <[email protected]>
ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
Miaoqian Lin <[email protected]>
ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
Kuldeep Singh <[email protected]>
spi: qcom-qspi: Add minItems to interconnect-names
Lucas Stach <[email protected]>
drm/bridge: adv7511: clean up CEC adapter when probe fails
Jani Nikula <[email protected]>
drm/edid: fix invalid EDID extension block filtering
Wenli Looi <[email protected]>
ath9k: fix ar9003_get_eepmisc
Niels Dossche <[email protected]>
ath11k: acquire ab->base_lock in unassign when finding the peer by addr
Noralf Trønnes <[email protected]>
dt-bindings: display: sitronix, st7735r: Fix backlight in example
Linus Torvalds <[email protected]>
drm: fix EDID struct for old ARM OABI format
Douglas Miller <[email protected]>
RDMA/hfi1: Prevent panic when SDMA is disabled
Peng Wu <[email protected]>
powerpc/iommu: Add missing of_node_put in iommu_init_early_dart
Finn Thain <[email protected]>
macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
Lv Ruyi <[email protected]>
powerpc/powernv: fix missing of_node_put in uv_init()
Lv Ruyi <[email protected]>
powerpc/xics: fix refcount leak in icp_opal_init()
Haren Myneni <[email protected]>
powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr
Vasily Averin <[email protected]>
tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
Yicong Yang <[email protected]>
PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
Peng Wu <[email protected]>
ARM: hisi: Add missing of_node_put after of_find_compatible_node
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
Peng Wu <[email protected]>
ARM: versatile: Add missing of_node_put in dcscb_init
Yang Yingliang <[email protected]>
pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()
OGAWA Hirofumi <[email protected]>
fat: add ratelimit to fat*_ent_bread()
Hari Bathini <[email protected]>
powerpc/fadump: Fix fadump to work with a different endian capture kernel
Janusz Krzysztofik <[email protected]>
ARM: OMAP1: clock: Fix UART rate reporting algorithm
Zixuan Fu <[email protected]>
fs: jfs: fix possible NULL pointer dereference in dbFree()
QintaoShen <[email protected]>
soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc
Gilad Ben-Yossef <[email protected]>
crypto: ccree - use fine grained DMA mapping dir
Brian Norris <[email protected]>
PM / devfreq: rk3399_dmc: Disable edev on remove()
Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: align DMA channels with dtschema
Krzysztof Kozlowski <[email protected]>
ARM: dts: ox820: align interrupt controller node name with dtschema
Niels Dossche <[email protected]>
IB/rdmavt: add missing locks in rvt_ruc_loopback
Bob Peterson <[email protected]>
gfs2: use i_lock spin_lock for inode qadata
Yonghong Song <[email protected]>
selftests/bpf: fix btf_dump/btf_dump due to recent clang change
Jakub Kicinski <[email protected]>
eth: tg3: silence the GCC 12 array-bounds warning
David Howells <[email protected]>
rxrpc, afs: Fix selection of abort codes
David Howells <[email protected]>
rxrpc: Return an error to sendmsg if call failed
Geert Uytterhoeven <[email protected]>
m68k: atari: Make Atari ROM port I/O write macros return void
Borislav Petkov <[email protected]>
x86/microcode: Add explicit CPU vendor dependency
Vincent Mailhol <[email protected]>
can: mcp251xfd: silence clang's -Wunaligned-access warning
Pierre-Louis Bossart <[email protected]>
ASoC: rt1015p: remove dependency on GPIOLIB
Pierre-Louis Bossart <[email protected]>
ASoC: max98357a: remove dependency on GPIOLIB
Kwanghoon Son <[email protected]>
media: exynos4-is: Fix compile warning
Fabio Estevam <[email protected]>
net: phy: micrel: Allow probing without .driver_data
Xie Yongji <[email protected]>
nbd: Fix hung on disconnect request if socket is closed before
Lin Ma <[email protected]>
ASoC: rt5645: Fix errorenous cleanup order
Smith, Kyle Miller (Nimble Kernel) <[email protected]>
nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
Jason A. Donenfeld <[email protected]>
openrisc: start CPU timer early in boot
Hans Verkuil <[email protected]>
media: cec-adap.c: fix is_configuring state
Tetsuo Handa <[email protected]>
media: imon: reorganize serialization
Philipp Zabel <[email protected]>
media: coda: limit frame interval enumeration to supported encoder frame sizes
Hangyu Hua <[email protected]>
media: rga: fix possible memory leak in rga_probe
Dongliang Mu <[email protected]>
rtlwifi: Use pr_warn instead of WARN_ONCE
Corey Minyard <[email protected]>
ipmi: Fix pr_fmt to avoid compilation issues
Corey Minyard <[email protected]>
ipmi:ssif: Check for NULL msg when handling events and messages
Mario Limonciello <[email protected]>
ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
Mikulas Patocka <[email protected]>
dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
Patrice Chotard <[email protected]>
spi: stm32-qspi: Fix wait_cmd timeout in APM mode
Ravi Bangoria <[email protected]>
perf/amd/ibs: Cascade pmu init functions' return value
Heiko Carstens <[email protected]>
s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES
Eric Dumazet <[email protected]>
net: remove two BUG() from skb_checksum_help()
Charles Keepax <[email protected]>
ASoC: tscs454: Add endianness flag in snd_soc_component_driver
Dongliang Mu <[email protected]>
HID: bigben: fix slab-out-of-bounds Write in bigben_probe
Alice Wong <[email protected]>
drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
Petr Machata <[email protected]>
mlxsw: Treat LLDP packets as control
Petr Machata <[email protected]>
mlxsw: spectrum_dcb: Do not warn about priority changes
Mark Brown <[email protected]>
ASoC: dapm: Don't fold register value changes into notifications
Mark Bloch <[email protected]>
net/mlx5: fs, delete the FTE when there are no rules attached to it
jianghaoran <[email protected]>
ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
Lv Ruyi <[email protected]>
drm: msm: fix error check return value of irq_of_parse_and_map()
Alexandru Elisei <[email protected]>
arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall
Abhishek Kumar <[email protected]>
ath10k: skip ath10k_halt during suspend for driver state RESTARTING
Evan Quan <[email protected]>
drm/amd/pm: fix the compile warning
Steven Price <[email protected]>
drm/plane: Move range check for format_count earlier
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408
Hari Chandrakanthan <[email protected]>
ath11k: disable spectral scan during spectral deinit
James Smart <[email protected]>
scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
Minghao Chi <[email protected]>
scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
Lv Ruyi <[email protected]>
scsi: megaraid: Fix error check return value of register_chrdev()
Vignesh Raghavendra <[email protected]>
drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit
Aidan MacDonald <[email protected]>
mmc: jz4740: Apply DMA engine limits to maximum segment size
Heming Zhao <[email protected]>
md/bitmap: don't set sb values if can't pass sanity check
Zheyu Ma <[email protected]>
media: cx25821: Fix the warning when removing the module
Zheyu Ma <[email protected]>
media: pci: cx23885: Fix the error handling in cx23885_initdev()
Luca Weiss <[email protected]>
media: venus: hfi: avoid null dereference in deinit
Thibaut VARÈNE <[email protected]>
ath9k: fix QCA9561 PA bias level
Keita Suzuki <[email protected]>
drm/amd/pm: fix double free in si_parse_power_table()
Len Brown <[email protected]>
tools/power turbostat: fix ICX DRAM power numbers
Biju Das <[email protected]>
spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction
Amadeusz Sławiński <[email protected]>
ALSA: jack: Access input_dev under mutex
Haowen Bai <[email protected]>
sfc: ef10: Fix assigning negative value to unsigned variable
Paul E. McKenney <[email protected]>
rcu: Make TASKS_RUDE_RCU select IRQ_WORK
Padmanabha Srinivasaiah <[email protected]>
rcu-tasks: Fix race in schedule and flush work
Liviu Dudau <[email protected]>
drm/komeda: return early if drm_universal_plane_init() fails.
Kirill A. Shutemov <[email protected]>
ACPICA: Avoid cache flush inside virtual machines
Mike Travis <[email protected]>
x86/platform/uv: Update TSC sync state for UV5
Daniel Vetter <[email protected]>
fbcon: Consistently protect deferred_takeover with console_lock()
Niels Dossche <[email protected]>
ipv6: fix locking issues with loops over idev->addr_list
Haowen Bai <[email protected]>
ipw2x00: Fix potential NULL dereference in libipw_xmit()
Haowen Bai <[email protected]>
b43: Fix assigning negative value to unsigned variable
Haowen Bai <[email protected]>
b43legacy: Fix assigning negative value to unsigned variable
Niels Dossche <[email protected]>
mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
Nikolay Borisov <[email protected]>
selftests/bpf: Fix vfs_link kprobe definition
Liu Zixian <[email protected]>
drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
Tejas Upadhyay <[email protected]>
iommu/vt-d: Add RPLS to quirk list to skip TE disabling
Qu Wenruo <[email protected]>
btrfs: repair super block num_devices automatically
Qu Wenruo <[email protected]>
btrfs: add "0x" prefix for unsupported optional features
Eric W. Biederman <[email protected]>
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
Eric W. Biederman <[email protected]>
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
Eric W. Biederman <[email protected]>
ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP
Kan Liang <[email protected]>
perf/x86/intel: Fix event constraints for ICL
Ammar Faizi <[email protected]>
x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails
Helge Deller <[email protected]>
parisc/stifb: Keep track of hardware path of graphics card
Peilin Ye <[email protected]>
Fonts: Make font size unsigned in font_desc
Mathias Nyman <[email protected]>
xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI
Ronnie Sahlberg <[email protected]>
cifs: when extending a file with falloc we should make files not-sparse
Kishon Vijay Abraham I <[email protected]>
usb: core: hcd: Add support for deferring roothub registration
Albert Wang <[email protected]>
usb: dwc3: gadget: Move null pinter check to proper place
Monish Kumar R <[email protected]>
USB: new quirk for Dell Gen 2 devices
Carl Yin(殷张成) <[email protected]>
USB: serial: option: add Quectel BG95 modem
Takashi Iwai <[email protected]>
ALSA: usb-audio: Cancel pending work at closing a MIDI substream
Marios Levogiannis <[email protected]>
ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS
Rik van der Kemp <[email protected]>
ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop
Samuel Holland <[email protected]>
riscv: Fix irq_work when SMP is disabled
Alexandre Ghiti <[email protected]>
riscv: Initialize thread pointer before calling C functions
Helge Deller <[email protected]>
parisc/stifb: Implement fb_is_primary_device()
Niklas Cassel <[email protected]>
binfmt_flat: do not stop relocating GOT entries prematurely on riscv
Stephen Boyd <[email protected]>
arm64: Initialize jump labels before setup_machine_fdt()
-------------
Diffstat:
Documentation/conf.py | 2 +- .../bindings/display/sitronix,st7735r.yaml | 1 + .../devicetree/bindings/gpio/gpio-altera.txt | 5 +- .../bindings/spi/qcom,spi-qcom-qspi.yaml | 1 + Makefile | 4 +- arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 +- arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 +- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 +- arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +- arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +- arch/arm/boot/dts/ox820.dtsi | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 3 +- arch/arm/boot/dts/s5pv210.dtsi | 12 +- arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +- arch/arm/mach-hisi/platsmp.c | 4 + arch/arm/mach-mediatek/Kconfig | 1 + arch/arm/mach-omap1/clock.c | 2 +- arch/arm/mach-pxa/cm-x300.c | 8 +- arch/arm/mach-pxa/magician.c | 2 +- arch/arm/mach-pxa/tosa.c | 4 +- arch/arm/mach-vexpress/dcscb.c | 1 + arch/arm64/Kconfig.platforms | 1 + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- arch/arm64/kernel/setup.c | 7 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/mm/copypage.c | 4 +- arch/csky/kernel/probes/kprobes.c | 2 +- arch/m68k/Kconfig.cpu | 2 +- arch/m68k/include/asm/raw_io.h | 6 +- .../include/asm/mach-ip27/cpu-feature-overrides.h | 1 - .../include/asm/mach-ip30/cpu-feature-overrides.h | 1 - arch/openrisc/include/asm/timex.h | 1 + arch/openrisc/kernel/head.S | 9 + arch/parisc/include/asm/fb.h | 4 + arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/include/asm/vas.h | 2 +- arch/powerpc/kernel/fadump.c | 8 +- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/perf/isa207-common.c | 3 +- arch/powerpc/platforms/4xx/cpm.c | 2 +- arch/powerpc/platforms/8xx/cpm1.c | 1 + arch/powerpc/platforms/powernv/opal-fadump.c | 94 +++++---- arch/powerpc/platforms/powernv/opal-fadump.h | 10 +- arch/powerpc/platforms/powernv/ultravisor.c | 1 + arch/powerpc/platforms/powernv/vas-fault.c | 2 +- arch/powerpc/platforms/powernv/vas-window.c | 4 +- arch/powerpc/platforms/powernv/vas.h | 2 +- arch/powerpc/sysdev/dart_iommu.c | 6 +- arch/powerpc/sysdev/fsl_rio.c | 2 + arch/powerpc/sysdev/xics/icp-opal.c | 1 + arch/riscv/include/asm/irq_work.h | 2 +- arch/riscv/kernel/head.S | 1 + arch/s390/include/asm/kexec.h | 10 + arch/s390/include/asm/preempt.h | 15 +- arch/s390/kernel/perf_event.c | 2 +- arch/um/drivers/chan_user.c | 9 +- arch/um/include/asm/thread_info.h | 2 + arch/um/kernel/exec.c | 2 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/ptrace.c | 8 +- arch/um/kernel/signal.c | 4 +- arch/x86/Kconfig | 4 +- arch/x86/entry/entry_64.S | 1 + arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/amd/ibs.c | 55 ++++- arch/x86/events/intel/core.c | 2 +- arch/x86/include/asm/acenv.h | 14 +- arch/x86/include/asm/kexec.h | 8 + arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 8 +- arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/kernel/cpu/mce/amd.c | 32 +-- arch/x86/kernel/step.c | 3 +- arch/x86/kernel/sys_x86_64.c | 7 +- arch/x86/kvm/vmx/nested.c | 45 ++++- arch/x86/kvm/vmx/vmcs.h | 5 + arch/x86/lib/delay.c | 4 +- arch/x86/mm/pat/memtype.c | 2 +- arch/x86/um/ldt.c | 6 +- arch/xtensa/kernel/ptrace.c | 4 +- arch/xtensa/kernel/signal.c | 4 +- arch/xtensa/platforms/iss/simdisk.c | 18 +- block/bfq-cgroup.c | 111 +++++++---- block/bfq-iosched.c | 46 +++-- block/bfq-iosched.h | 6 +- block/blk-cgroup.c | 8 +- block/blk-iolatency.c | 122 ++++++------ crypto/cryptd.c | 23 +-- drivers/acpi/property.c | 18 +- drivers/acpi/sleep.c | 12 ++ drivers/base/memory.c | 5 +- drivers/base/node.c | 1 + drivers/block/drbd/drbd_main.c | 11 +- drivers/block/nbd.c | 13 +- drivers/block/virtio_blk.c | 7 +- drivers/char/hw_random/omap3-rom-rng.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/ipmi/ipmi_ssif.c | 23 +++ drivers/char/random.c | 12 +- drivers/cpufreq/mediatek-cpufreq.c | 19 +- .../crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 +++++++---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 ++- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 +- drivers/crypto/ccree/cc_buffer_mgr.c | 27 +-- drivers/crypto/marvell/cesa/cipher.c | 1 - drivers/crypto/nx/nx-common-powernv.c | 2 +- drivers/devfreq/rk3399_dmc.c | 2 + drivers/dma/idxd/cdev.c | 8 +- drivers/dma/stm32-mdma.c | 87 ++++---- drivers/edac/dmc520_edac.c | 2 +- drivers/firmware/arm_scmi/base.c | 2 +- drivers/gpio/gpiolib-of.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +- drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +- drivers/gpu/drm/arm/display/komeda/komeda_plane.c | 10 +- drivers/gpu/drm/arm/malidp_crtc.c | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 31 ++- drivers/gpu/drm/drm_edid.c | 6 +- drivers/gpu/drm/drm_plane.c | 14 +- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 + drivers/gpu/drm/gma500/psb_intel_display.c | 7 +- drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 33 ++- drivers/gpu/drm/i915/i915_perf.c | 4 +- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 61 +++++- drivers/gpu/drm/mediatek/mtk_cec.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 8 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 14 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 6 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 +- drivers/gpu/drm/msm/dp/dp_display.c | 55 +++-- drivers/gpu/drm/msm/dsi/dsi_host.c | 21 +- drivers/gpu/drm/msm/hdmi/hdmi.c | 10 +- drivers/gpu/drm/msm/msm_drv.c | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 6 +- drivers/gpu/drm/nouveau/dispnv50/crc.c | 27 ++- drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 3 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- drivers/gpu/drm/stm/ltdc.c | 16 +- drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +- drivers/gpu/drm/vc4/vc4_hvs.c | 26 ++- drivers/gpu/drm/vc4/vc4_txp.c | 8 +- drivers/gpu/drm/virtio/virtgpu_display.c | 2 + drivers/hid/hid-bigbenff.c | 6 + drivers/hid/hid-elan.c | 2 - drivers/hid/hid-led.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 33 ++- drivers/i2c/busses/i2c-at91-master.c | 11 + drivers/i2c/busses/i2c-npcm7xx.c | 103 ++++++---- drivers/i2c/busses/i2c-rcar.c | 15 +- drivers/infiniband/hw/hfi1/file_ops.c | 2 + drivers/infiniband/hw/hfi1/init.c | 2 +- drivers/infiniband/hw/hfi1/sdma.c | 12 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/infiniband/sw/rxe/rxe_req.c | 2 +- drivers/input/misc/sparcspkr.c | 1 + drivers/input/touchscreen/stmfts.c | 16 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/msm_iommu.c | 11 +- drivers/iommu/mtk_iommu.c | 3 +- drivers/irqchip/irq-armada-370-xp.c | 11 +- drivers/irqchip/irq-aspeed-i2c-ic.c | 4 +- drivers/irqchip/irq-aspeed-scu-ic.c | 4 +- drivers/irqchip/irq-sni-exiu.c | 25 ++- drivers/irqchip/irq-xtensa-mx.c | 18 +- drivers/macintosh/Kconfig | 6 + drivers/macintosh/Makefile | 3 +- drivers/macintosh/via-pmu.c | 2 +- drivers/mailbox/mailbox.c | 19 +- drivers/md/bcache/btree.c | 58 +++--- drivers/md/bcache/btree.h | 2 +- drivers/md/bcache/journal.c | 31 ++- drivers/md/bcache/journal.h | 2 + drivers/md/bcache/request.c | 6 + drivers/md/bcache/super.c | 1 + drivers/md/bcache/writeback.c | 101 ++++------ drivers/md/bcache/writeback.h | 2 +- drivers/md/md-bitmap.c | 44 ++-- drivers/md/md.c | 18 +- drivers/media/cec/core/cec-adap.c | 6 +- drivers/media/i2c/ov7670.c | 1 - drivers/media/pci/cx23885/cx23885-core.c | 6 +- drivers/media/pci/cx25821/cx25821-core.c | 2 +- drivers/media/platform/aspeed-video.c | 4 +- drivers/media/platform/coda/coda-common.c | 35 ++-- drivers/media/platform/exynos4-is/fimc-is.c | 6 +- drivers/media/platform/exynos4-is/fimc-isp-video.h | 2 +- drivers/media/platform/qcom/venus/hfi.c | 3 + drivers/media/platform/rockchip/rga/rga.c | 6 +- drivers/media/platform/sti/delta/delta-v4l2.c | 6 +- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +- drivers/media/rc/imon.c | 99 +++++---- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +- drivers/media/usb/uvc/uvc_v4l2.c | 20 +- drivers/memory/samsung/exynos5422-dmc.c | 5 +- drivers/mfd/davinci_voicecodec.c | 6 +- drivers/mfd/ipaq-micro.c | 2 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/jz4740_mmc.c | 20 ++ drivers/mmc/host/sdhci_am654.c | 23 ++- drivers/mtd/chips/cfi_cmdset_0002.c | 103 +++++----- drivers/mtd/nand/raw/cadence-nand-controller.c | 5 +- drivers/mtd/nand/raw/denali_pci.c | 15 +- drivers/mtd/spi-nor/core.c | 9 + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- drivers/net/can/xilinx_can.c | 4 +- drivers/net/dsa/mt7530.c | 14 +- drivers/net/ethernet/broadcom/Makefile | 5 + .../chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- .../net/ethernet/huawei/hinic/hinic_hw_api_cmd.c | 5 +- drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 10 +- drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c | 5 +- drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c | 9 +- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 2 + drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 23 +-- drivers/net/ethernet/huawei/hinic/hinic_main.c | 10 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c | 13 -- .../net/ethernet/mellanox/mlxsw/spectrum_trap.c | 2 +- drivers/net/ethernet/sfc/ef10.c | 2 +- .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 15 +- drivers/net/hyperv/netvsc_drv.c | 5 +- drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/net/phy/micrel.c | 11 +- drivers/net/wireguard/socket.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 20 +- drivers/net/wireless/ath/ath11k/mac.c | 16 +- drivers/net/wireless/ath/ath11k/spectral.c | 17 +- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 + drivers/net/wireless/ath/carl9170/tx.c | 3 + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/power.c | 3 + drivers/net/wireless/marvell/mwifiex/11h.c | 2 + drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 8 +- drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- drivers/nfc/st21nfca/se.c | 17 +- drivers/nfc/st21nfca/st21nfca.h | 1 + drivers/nvdimm/core.c | 9 - drivers/nvdimm/security.c | 5 - drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/of/overlay.c | 4 +- drivers/opp/of.c | 2 +- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 23 ++- drivers/pci/controller/dwc/pcie-designware-host.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 9 +- drivers/pci/controller/pcie-rockchip-ep.c | 3 +- drivers/pci/pci.c | 12 +- drivers/pci/pcie/aer.c | 7 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 11 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 18 ++ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- drivers/pinctrl/renesas/core.c | 7 +- drivers/pinctrl/renesas/pinctrl-rzn1.c | 10 +- drivers/platform/chrome/cros_ec.c | 16 +- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 50 ++++- drivers/platform/mips/cpu_hwmon.c | 127 ++++-------- drivers/regulator/core.c | 7 +- drivers/regulator/pfuze100-regulator.c | 2 + drivers/regulator/qcom_smd-regulator.c | 35 ++-- drivers/scsi/dc395x.c | 15 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/lpfc/lpfc_sli.c | 6 +- drivers/scsi/megaraid.c | 2 +- drivers/scsi/ufs/ti-j721e-ufs.c | 6 +- drivers/scsi/ufs/ufs-qcom.c | 14 +- drivers/scsi/ufs/ufshcd.c | 7 +- drivers/soc/qcom/llcc-qcom.c | 1 + drivers/soc/qcom/smp2p.c | 1 + drivers/soc/qcom/smsm.c | 1 + drivers/soc/ti/ti_sci_pm_domains.c | 2 + drivers/spi/spi-fsl-qspi.c | 4 + drivers/spi/spi-img-spfi.c | 2 +- drivers/spi/spi-rspi.c | 15 +- drivers/spi/spi-stm32-qspi.c | 3 +- drivers/spi/spi-ti-qspi.c | 5 +- drivers/staging/media/hantro/hantro_v4l2.c | 8 +- drivers/staging/media/rkvdec/rkvdec-h264.c | 37 +++- drivers/staging/media/rkvdec/rkvdec.c | 10 +- drivers/target/target_core_device.c | 1 - drivers/thermal/broadcom/bcm2711_thermal.c | 5 +- drivers/thermal/broadcom/sr-thermal.c | 3 + drivers/thermal/imx_sc_thermal.c | 6 +- drivers/thermal/thermal_core.c | 42 ++-- drivers/tty/serial/pch_uart.c | 27 +-- drivers/tty/tty_buffer.c | 3 +- drivers/usb/core/hcd.c | 29 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/gadget.c | 6 +- drivers/usb/host/xhci-pci.c | 2 + drivers/usb/serial/option.c | 2 + drivers/vdpa/vdpa_sim/vdpa_sim.c | 5 +- drivers/video/console/sticon.c | 5 +- drivers/video/console/sticore.c | 32 ++- drivers/video/fbdev/amba-clcd.c | 5 +- drivers/video/fbdev/core/fbcon.c | 5 +- drivers/video/fbdev/sticore.h | 3 + drivers/video/fbdev/stifb.c | 4 +- fs/afs/rxrpc.c | 8 +- fs/binfmt_flat.c | 27 ++- fs/btrfs/disk-io.c | 4 +- fs/btrfs/volumes.c | 8 +- fs/cifs/smb2inode.c | 2 - fs/cifs/smb2ops.c | 2 +- fs/dax.c | 3 +- fs/dlm/lock.c | 11 +- fs/dlm/plock.c | 12 +- fs/ext4/ext4.h | 6 - fs/ext4/extents.c | 10 +- fs/ext4/inline.c | 12 ++ fs/ext4/inode.c | 4 + fs/ext4/namei.c | 84 ++++++-- fs/ext4/super.c | 24 ++- fs/f2fs/f2fs.h | 19 +- fs/f2fs/file.c | 20 +- fs/f2fs/inline.c | 29 ++- fs/f2fs/inode.c | 19 +- fs/f2fs/segment.c | 42 ++-- fs/f2fs/segment.h | 33 +-- fs/f2fs/super.c | 6 +- fs/fat/fatent.c | 7 +- fs/fs-writeback.c | 13 +- fs/gfs2/quota.c | 32 +-- fs/iomap/buffered-io.c | 3 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfs/file.c | 16 +- fs/nfs/pnfs.c | 2 + fs/nfs/write.c | 11 +- fs/notify/fdinfo.c | 11 +- fs/notify/inotify/inotify.h | 12 ++ fs/notify/inotify/inotify_user.c | 2 +- fs/notify/mark.c | 6 +- fs/ocfs2/dlmfs/userdlm.c | 16 +- fs/proc/generic.c | 3 + fs/proc/proc_net.c | 3 + fs/xfs/libxfs/xfs_btree.c | 35 ++-- fs/xfs/xfs_dquot.c | 39 +++- fs/xfs/xfs_iomap.c | 3 + fs/xfs/xfs_log.c | 28 ++- fs/xfs/xfs_log.h | 1 + fs/xfs/xfs_mount.c | 93 +++++---- fs/xfs/xfs_qm.c | 92 ++++----- fs/xfs/xfs_symlink.c | 1 + include/drm/drm_edid.h | 6 +- include/linux/bpf.h | 2 + include/linux/efi.h | 2 + include/linux/font.h | 2 +- include/linux/gpio/driver.h | 12 ++ include/linux/kexec.h | 46 ++++- include/linux/lsm_hook_defs.h | 4 +- include/linux/lsm_hooks.h | 2 +- include/linux/mailbox_controller.h | 1 + include/linux/mtd/cfi.h | 1 + include/linux/nodemask.h | 13 +- include/linux/platform_data/cros_ec_proto.h | 3 + include/linux/ptrace.h | 7 - include/linux/security.h | 23 ++- include/linux/thermal.h | 2 +- include/linux/usb/hcd.h | 2 + include/net/bluetooth/hci.h | 16 +- include/net/bluetooth/hci_core.h | 18 +- include/net/flow.h | 10 + include/net/if_inet6.h | 8 + include/net/route.h | 6 +- include/scsi/libfcoe.h | 3 +- include/sound/jack.h | 1 + include/trace/events/rxrpc.h | 2 +- include/trace/events/vmscan.h | 4 +- init/Kconfig | 5 + ipc/mqueue.c | 14 ++ kernel/bpf/stackmap.c | 1 - kernel/dma/debug.c | 2 +- kernel/kexec_file.c | 34 ---- kernel/ptrace.c | 5 +- kernel/rcu/Kconfig | 1 + kernel/rcu/tasks.h | 3 + kernel/scftorture.c | 5 +- kernel/sched/fair.c | 8 +- kernel/sched/pelt.h | 4 +- kernel/sched/sched.h | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace_events_hist.c | 3 + mm/compaction.c | 2 + mm/hugetlb.c | 9 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_core.c | 27 +-- net/bluetooth/hci_debugfs.c | 8 +- net/bluetooth/hci_event.c | 91 +++++---- net/bluetooth/hci_request.c | 221 ++++++++++++++++----- net/bluetooth/hci_sock.c | 12 +- net/bluetooth/l2cap_core.c | 10 +- net/bluetooth/mgmt.c | 14 +- net/bluetooth/mgmt_config.c | 10 + net/bluetooth/sco.c | 21 +- net/bluetooth/smp.c | 6 +- net/core/dev.c | 8 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 +- net/ipv4/icmp.c | 4 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ping.c | 2 +- net/ipv4/raw.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 33 ++- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 6 +- net/ipv6/inet6_connection_sock.c | 4 +- net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/chan.c | 7 +- net/mac80211/ieee80211_i.h | 5 + net/mac80211/scan.c | 20 ++ net/netfilter/nf_synproxy_core.c | 2 +- net/nfc/core.c | 1 + net/rxrpc/ar-internal.h | 13 +- net/rxrpc/call_event.c | 7 +- net/rxrpc/conn_object.c | 2 +- net/rxrpc/input.c | 31 ++- net/rxrpc/output.c | 20 +- net/rxrpc/recvmsg.c | 8 +- net/rxrpc/sendmsg.c | 6 + net/rxrpc/sysctl.c | 4 +- net/sctp/input.c | 4 +- net/smc/af_smc.c | 2 +- net/wireless/nl80211.c | 1 + net/wireless/reg.c | 4 + net/xfrm/xfrm_state.c | 6 +- scripts/faddr2line | 150 +++++++++----- security/integrity/ima/Kconfig | 14 +- .../integrity/platform_certs/keyring_handler.h | 8 + security/integrity/platform_certs/load_uefi.c | 33 +++ security/security.c | 17 +- security/selinux/hooks.c | 4 +- security/selinux/include/xfrm.h | 2 +- security/selinux/xfrm.c | 13 +- sound/core/jack.c | 34 +++- sound/core/pcm_memory.c | 3 +- sound/pci/hda/patch_realtek.c | 11 + sound/soc/atmel/atmel-classd.c | 1 - sound/soc/atmel/atmel-pdmic.c | 1 - sound/soc/codecs/Kconfig | 2 - sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/rk3328_codec.c | 2 +- sound/soc/codecs/rt5514.c | 2 +- sound/soc/codecs/rt5645.c | 7 +- sound/soc/codecs/tscs454.c | 12 +- sound/soc/codecs/wm2000.c | 6 +- sound/soc/fsl/imx-sgtl5000.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 12 ++ sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +- sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 +- sound/soc/mxs/mxs-saif.c | 1 + sound/soc/samsung/aries_wm8994.c | 17 +- sound/soc/samsung/arndale.c | 5 +- sound/soc/samsung/littlemill.c | 5 +- sound/soc/samsung/lowland.c | 5 +- sound/soc/samsung/odroid.c | 4 +- sound/soc/samsung/smdk_wm8994.c | 4 +- sound/soc/samsung/smdk_wm8994pcm.c | 4 +- sound/soc/samsung/snow.c | 9 +- sound/soc/samsung/speyside.c | 5 +- sound/soc/samsung/tm2_wm5110.c | 3 +- sound/soc/samsung/tobermory.c | 5 +- sound/soc/soc-dapm.c | 2 - sound/soc/ti/j721e-evm.c | 44 +++- sound/usb/midi.c | 3 + tools/lib/bpf/libbpf.c | 20 +- tools/perf/Makefile.config | 39 ++-- tools/perf/builtin-c2c.c | 6 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/util/data.h | 1 + tools/power/x86/turbostat/turbostat.c | 1 + .../bpf/progs/btf_dump_test_case_syntax.c | 2 +- tools/testing/selftests/bpf/progs/profiler.inc.h | 5 +- tools/testing/selftests/cgroup/test_stress.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 4 +- 512 files changed, 3868 insertions(+), 2289 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/452 arm64: Initialize jump labels before setup_machine_fdt()
From: Stephen Boyd <[email protected]>
commit 73e2d827a501d48dceeb5b9b267a4cd283d6b1ae upstream.
A static key warning splat appears during early boot on arm64 systems that credit randomness from devicetrees that contain an "rng-seed" property. This is because setup_machine_fdt() is called before jump_label_init() during setup_arch(). Let's swap the order of these two calls so that jump labels are initialized before the devicetree is unflattened and the rng seed is credited.
static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init()
WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : static_key_enable_cpuslocked+0xb0/0xb8 lr : static_key_enable_cpuslocked+0xb0/0xb8 sp : ffffffe51c393cf0 x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10 x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000 x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000 x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020 x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708 x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000 x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000 x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027 x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05 x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065 Call trace: static_key_enable_cpuslocked+0xb0/0xb8 static_key_enable+0x2c/0x40 crng_set_ready+0x24/0x30 execute_in_process_context+0x80/0x90 _credit_init_bits+0x100/0x154 add_bootloader_randomness+0x64/0x78 early_init_dt_scan_chosen+0x140/0x184 early_init_dt_scan_nodes+0x28/0x4c early_init_dt_scan+0x40/0x44 setup_machine_fdt+0x7c/0x120 setup_arch+0x74/0x1d8 start_kernel+0x84/0x44c __primary_switched+0xc0/0xc8 ---[ end trace 0000000000000000 ]--- random: crng init done Machine model: Google Lazor (rev1 - 2) with LTE
--- arch/arm64/kernel/setup.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/arm64/kernel/setup.c +4 -3
@@ -300,13 +300,14 @@ void __init __no_sanitize_address setup_early_fixmap_init ();early_ioremap_init (); -setup_machine_fdt (__fdt_pointer); -/* * Initialise the static keys early as they may be enabled by the -* cpufeature code and early parameters. +* cpufeature code, early parameters, and DT setup. */ jump_label_init (); + +setup_machine_fdt (__fdt_pointer); +parse_early_param ();/*
Re: [PATCH 5.10 001/452] arm64: Initialize jump labels before setup_machine_fdt()
Hi Greg,
Quoted 47 lines · Greg Kroah-Hartman
From: Stephen Boyd <[email protected]>
commit
73e2d827a501d48dceeb5b9b267a4cd283d6b1aeupstream.A static key warning splat appears during early boot on arm64 systems that credit randomness from devicetrees that contain an "rng-seed" property. This is because
setup_machine_fdt()is called beforejump_label_init()duringsetup_arch(). Let's swap the order of these two calls so that jump labels are initialized before the devicetree is unflattened and the rng seed is credited.
static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call tojump_label_init()WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : static_key_enable_cpuslocked+0xb0/0xb8 lr : static_key_enable_cpuslocked+0xb0/0xb8 sp : ffffffe51c393cf0 x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10 x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000 x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000 x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020 x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708 x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000 x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000 x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027 x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05 x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065 Call trace: static_key_enable_cpuslocked+0xb0/0xb8 static_key_enable+0x2c/0x40 crng_set_ready+0x24/0x30 execute_in_process_context+0x80/0x90 _credit_init_bits+0x100/0x154 add_bootloader_randomness+0x64/0x78 early_init_dt_scan_chosen+0x140/0x184 early_init_dt_scan_nodes+0x28/0x4c early_init_dt_scan+0x40/0x44 setup_machine_fdt+0x7c/0x120 setup_arch+0x74/0x1d8 start_kernel+0x84/0x44c __primary_switched+0xc0/0xc8 ---[ end trace 0000000000000000 ]--- random: crng init done Machine model: Google Lazor (rev1 - 2) with LTE
Quoted 13 lines
Cc Hsin-Yi Wang <[email protected]>Cc Douglas Anderson <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Steven Rostedt <[email protected]>Cc Jason A. Donenfeld <[email protected]>Cc Dominik Brodowski <[email protected]>Fixes f5bda35fba61 ("random: use static branch for crng_ready()")Signed-off-by Stephen Boyd <[email protected]>Reviewed-by Jason A. Donenfeld <[email protected]>Signed-off-by Catalin Marinas <[email protected]>Signed-off-by Jason A. Donenfeld <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Since Jason asked for the fixed commit (f5bda35fba61) to be reverted in stable, please don't push this arm64 patch either. Given the risks of breakage as on arm32 (it doesn't look like but you never know), I'm tempted to revert it from mainline as well if Jason finds a better solution for the early crng_reseed() call.
Thanks.
Signature · 1 line
Catalin
Re: [PATCH 5.10 001/452] arm64: Initialize jump labels before setup_machine_fdt()
Quoted 65 lines · Catalin Marinas
Hi Greg,
Quoted 47 lines · Greg Kroah-Hartman
From: Stephen Boyd <[email protected]>
commit
73e2d827a501d48dceeb5b9b267a4cd283d6b1aeupstream.A static key warning splat appears during early boot on arm64 systems that credit randomness from devicetrees that contain an "rng-seed" property. This is because
setup_machine_fdt()is called beforejump_label_init()duringsetup_arch(). Let's swap the order of these two calls so that jump labels are initialized before the devicetree is unflattened and the rng seed is credited.
static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call tojump_label_init()WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : static_key_enable_cpuslocked+0xb0/0xb8 lr : static_key_enable_cpuslocked+0xb0/0xb8 sp : ffffffe51c393cf0 x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10 x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000 x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000 x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020 x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708 x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000 x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000 x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027 x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05 x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065 Call trace: static_key_enable_cpuslocked+0xb0/0xb8 static_key_enable+0x2c/0x40 crng_set_ready+0x24/0x30 execute_in_process_context+0x80/0x90 _credit_init_bits+0x100/0x154 add_bootloader_randomness+0x64/0x78 early_init_dt_scan_chosen+0x140/0x184 early_init_dt_scan_nodes+0x28/0x4c early_init_dt_scan+0x40/0x44 setup_machine_fdt+0x7c/0x120 setup_arch+0x74/0x1d8 start_kernel+0x84/0x44c __primary_switched+0xc0/0xc8 ---[ end trace 0000000000000000 ]--- random: crng init done Machine model: Google Lazor (rev1 - 2) with LTEQuoted 13 lines
Cc Hsin-Yi Wang <[email protected]>Cc Douglas Anderson <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Steven Rostedt <[email protected]>Cc Jason A. Donenfeld <[email protected]>Cc Dominik Brodowski <[email protected]>Fixes f5bda35fba61 ("random: use static branch for crng_ready()")Signed-off-by Stephen Boyd <[email protected]>Reviewed-by Jason A. Donenfeld <[email protected]>Signed-off-by Catalin Marinas <[email protected]>Signed-off-by Jason A. Donenfeld <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 6 lines
Since Jason asked for the fixed commit (
f5bda35fba61) to be reverted in stable, please don't push this arm64 patch either. Given the risks of breakage as on arm32 (it doesn't look like but you never know), I'm tempted to revert it from mainline as well if Jason finds a better solution for the earlycrng_reseed()call.
So as I understand it, there are basically three options:
0. don't use a static branch in the RNG code
1. use a static branch but don't patch it extremely early
2. fix all the arch code so that it is safe to patch static branches extremely early.
We have been digging into the ARM code yesterday, and identified that RISC-V needs to be fixed as well. In fact, every arch that calls early_init_dt_scan() from setup_arch() will need to be vetted to ensure that jump label patching is possible this early.
Jason already proposed an implementation of 1) here
https://lore.kernel.org/lkml/[email protected]/
which seems to me to be the most suitable approach by far, given that it removes the need to fiddle with very early boot code on many different architectures. That would also allow the arm64 of /this/ patch to be reverted from mainline.
Re: [PATCH 5.10 001/452] arm64: Initialize jump labels before setup_machine_fdt()
Hi Ard,
This thread here is about stable review. Catalin mentioned to Greg that the arm64 patch isn't required any more. I also mentioned the same to Greg yesterday when it was in queue. Either way, what happens in 5.19 no longer has any effect on stable any more, since it's been reverted in stable. Therefore, I kindly ask you not to start yet *another* thread about the same topic we've been discussing over the last day. There are already 7 discussions about exactly the same thing; no need to make another. Let's resume working on this all today.
Jason
Greg Kroah-Hartman
maintainerPATCH 2/452 binfmt_flat: do not stop relocating GOT entries prematurely on riscv
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
commit 6045ab5fea4c849153ebeb0acb532da5f29d69c4 upstream.
bFLT binaries are usually created using elf2flt.
The linker script used by elf2flt has defined the .data section like the following for the last 19 years:
.data : {
_sdata = . ;
__data_start = . ;
data_start = . ;
*(.got.plt)
*(.got)
FILL(0) ;
. = ALIGN(0x20) ;
LONG(-1)
. = ALIGN(0x20) ;
...
}It places the .got.plt input section before the .got input section. The same is true for the default linker script (ld --verbose) on most architectures except x86/x86-64.
The binfmt_flat loader should relocate all GOT entries until it encounters a -1 (the LONG(-1) in the linker script).
The problem is that the .got.plt input section starts with a GOTPLT header (which has size 16 bytes on elf64-riscv and 8 bytes on elf32-riscv), where the first word is set to -1. See the binutils implementation for riscv [1].
This causes the binfmt_flat loader to stop relocating GOT entries prematurely and thus causes the application to crash when running.
Fix this by skipping the whole GOTPLT header, since the whole GOTPLT header is reserved for the dynamic linker.
The GOTPLT header will only be skipped for bFLT binaries with flag FLAT_FLAG_GOTPIC set. This flag is unconditionally set by elf2flt if the supplied ELF binary has the symbol _GLOBAL_OFFSET_TABLE_ defined. ELF binaries without a .got input section should thus remain unaffected.
Tested on RISC-V Canaan Kendryte K210 and RISC-V QEMU nommu_virt_defconfig.
[1] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfnn-riscv.c;hb=binutils-2_38#l3275
--- fs/binfmt_flat.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-)
fs/binfmt_flat.c +26 -1
@@ -427,6 +427,30 @@ static void old_reloc(unsigned long rl)/****************************************************************************/ +static inline u32 __user *skip_got_header (u32 __user *rp) +{ +if (IS_ENABLED (CONFIG_RISCV )) { +/* +* RISC-V has a 16 byte GOT PLT header for elf64-riscv +* and 8 byte GOT PLT header for elf32-riscv. +* Skip the whole GOT PLT header, since it is reserved +* for the dynamic linker (ld.so). +*/ +u32 rp_val0, rp_val1; + +if (get_user (rp_val0, rp)) +return rp; +if (get_user (rp_val1, rp +1 )) +return rp; + +if (rp_val0 ==0xffffffff && rp_val1 ==0xffffffff ) + rp +=4 ; +else if (rp_val0 ==0xffffffff ) + rp +=2 ; + } +return rp; +} +static int load_flat_file (struct linux_binprm *bprm,struct lib_info *libinfo,int id,unsigned long *extra_stack) {
@@ -774,7 +798,8 @@ static int load_flat_file(struct linux_b* image. */ if (flags &FLAT_FLAG_GOTPIC ) { -for (rp = (u32 __user *)datapos; ; rp++) { + rp =skip_got_header ((u32 __user *) datapos); +for (; ; rp++) {u32 addr, rp_val;if (get_user (rp_val, rp))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 3/452 parisc/stifb: Implement fb_is_primary_device()
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit cf936af790a3ef5f41ff687ec91bfbffee141278 upstream.
Implement fb_is_primary_device() function, so that fbcon detects if this framebuffer belongs to the default graphics card which was used to start the system.
--- arch/parisc/include/asm/fb.h | 4 ++++ drivers/video/console/sticore.c | 17 +++++++++++++++++ drivers/video/fbdev/stifb.c | 4 ++-- 3 files changed, 23 insertions(+), 2 deletions(-)
arch/parisc/include/asm/fb.h +4 -0
@@ -12,9 +12,13 @@ static inline void fb_pgprotect(struct f pgprot_val(vma->vm_page_prot) |= _PAGE_NO_CACHE; } +#if defined(CONFIG_STI_CONSOLE ) || defined(CONFIG_FB_STI ) +int fb_is_primary_device (struct fb_info *info); +#else static inline int fb_is_primary_device (struct fb_info *info) {return 0 ; } +#endif #endif /* _ASM_FB_H_ */
drivers/video/console/sticore.c +17 -0
@@ -30,6 +30,7 @@#include <asm/pdc.h> #include <asm/cacheflush.h> #include <asm/grfioctl.h> +#include <asm/fb.h> #include "../fbdev/sticore.h"
@@ -1127,6 +1128,22 @@ int sti_call(const struct sti_struct *streturn ret; } +/* check if given fb_info is the primary device */ +int fb_is_primary_device (struct fb_info *info) +{ +struct sti_struct *sti; + + sti =sti_get_rom (0 ); + +/* if no built-in graphics card found, allow any fb driver as default */ +if (!sti) +return true; + +/* return true if it's the default built-in framebuffer driver */ +return (sti->info == info); +} +EXPORT_SYMBOL (fb_is_primary_device); +MODULE_AUTHOR ("Philipp Rumpf, Helge Deller, Thomas Bogendoerfer" );MODULE_DESCRIPTION ("Core STI driver for HP's NGLE series graphics cards in HP PARISC machines" );MODULE_LICENSE ("GPL v2" );
drivers/video/fbdev/stifb.c +2 -2
@@ -1317,11 +1317,11 @@ static int __init stifb_init_fb(struct s goto out_err3; } +/* save for primary gfx device detection & unregister_framebuffer() */ + sti->info = info;if (register_framebuffer (&fb->info) <0 ) goto out_err4; - sti->info = info;/* save for unregister_framebuffer() */ - fb_info(&fb->info, "%s %dx%d-%d frame buffer device, %s, id: %04x, mmio: 0x%04lx\n", fix->id, var->xres,
Greg Kroah-Hartman
maintainerPATCH 4/452 riscv: Initialize thread pointer before calling C functions
In reply to Greg Kroah-HartmanFrom: Alexandre Ghiti <[email protected]>
commit 35d33c76d68dfacc330a8eb477b51cc647c5a847 upstream.
Because of the stack canary feature that reads from the current task structure the stack canary value, the thread pointer register "tp" must be set before calling any C function from head.S: by chance, setup_vm and all the functions that it calls does not seem to be part of the functions where the canary check is done, but in the following commits, some functions will.
--- arch/riscv/kernel/head.S | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kernel/head.S +1 -0
@@ -261,6 +261,7 @@ clear_bss_done: REG_S a0, (a2) /* Initialize page tables and relocate to virtual addresses */ + la tp, init_task la sp, init_thread_union + THREAD_SIZE mv a0, s1 call setup_vm
Greg Kroah-Hartman
maintainerPATCH 5/452 riscv: Fix irq_work when SMP is disabled
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
commit 2273272823db6f67d57761df8116ae32e7f05bed upstream.
irq_work is triggered via an IPI, but the IPI infrastructure is not included in uniprocessor kernels. As a result, irq_work never runs. Fall back to the tick-based irq_work implementation on uniprocessor configurations.
--- arch/riscv/include/asm/irq_work.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/irq_work.h +1 -1
@@ -4,7 +4,7 @@static inline bool arch_irq_work_has_interrupt (void ) { -return true; +return IS_ENABLED (CONFIG_SMP ); }extern void arch_irq_work_raise (void );#endif /* _ASM_RISCV_IRQ_WORK_H */
Greg Kroah-Hartman
maintainerPATCH 6/452 ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop
In reply to Greg Kroah-HartmanFrom: Rik van der Kemp <[email protected]>
commit 15dad62f4bdb5dc0f0efde8181d680db9963544c upstream.
The 2022-model XPS 15 appears to use the same 4-speakers-on-ALC289 audio setup as the Dell XPS 15 9510, so requires the same quirk to enable woofer output. Tested on my own 9520.
[ Move the entry to the right position in the SSID order -- tiwai ]
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8651,6 +8651,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1028 ,0x0a62 ,"Dell Precision 5560" ,ALC289_FIXUP_DUAL_SPK ),SND_PCI_QUIRK (0x1028 ,0x0a9d ,"Dell Latitude 5430" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x0a9e ,"Dell Latitude 5430" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1028 ,0x0b19 ,"Dell XPS 15 9520" ,ALC289_FIXUP_DUAL_SPK ),SND_PCI_QUIRK (0x1028 ,0x164a ,"Dell" ,ALC293_FIXUP_DELL1_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x164b ,"Dell" ,ALC293_FIXUP_DELL1_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
Greg Kroah-Hartman
maintainerPATCH 7/452 ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS
In reply to Greg Kroah-HartmanFrom: Marios Levogiannis <[email protected]>
commit 9bfa7b36343c7d84370bc61c9ed774635b05e4eb upstream.
Set microphone pins 0x18 (rear) and 0x19 (front) to VREF_50 to fix the microphone noise on ASUS TUF B550M-PLUS which uses the ALCS1200A codec. The initial value was VREF_80.
The same issue is also present on Windows using both the default Windows driver and all tested Realtek drivers before version 6.0.9049.1. Comparing Realtek driver 6.0.9049.1 (the first one without the microphone noise) to Realtek driver 6.0.9047.1 (the last one with the microphone noise) revealed that the fix is the result of setting pins 0x18 and 0x19 to VREF_50.
This fix may also work for other boards that have been reported to have the same microphone issue and use the ALC1150 and ALCS1200A codecs, since these codecs are similar and the fix in the Realtek driver on Windows is common for both. However, it is currently enabled only for ASUS TUF B550M-PLUS as this is the only board that could be tested.
--- sound/pci/hda/patch_realtek.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/pci/hda/patch_realtek.c +10 -0
@@ -1990,6 +1990,7 @@ enum {ALC1220_FIXUP_CLEVO_PB51ED_PINS ,ALC887_FIXUP_ASUS_AUDIO ,ALC887_FIXUP_ASUS_HMIC , + ALCS1200A_FIXUP_MIC_VREF, }; static void alc889_fixup_coef(struct hda_codec *codec,
@@ -2535,6 +2536,14 @@ static const struct hda_fixup alc882_fix .chained = true, .chain_id = ALC887_FIXUP_ASUS_AUDIO, }, + [ALCS1200A_FIXUP_MIC_VREF] = { + .type = HDA_FIXUP_PINCTLS, + .v.pins = (const struct hda_pintbl []) { + {0x18 ,PIN_VREF50 },/* rear mic */ + {0x19 ,PIN_VREF50 },/* front mic */ + {} + } + }, };static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2572,6 +2581,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1043 ,0x835f ,"Asus Eee 1601" ,ALC888_FIXUP_EEE1601 ),SND_PCI_QUIRK (0x1043 ,0x84bc ,"ASUS ET2700" ,ALC887_FIXUP_ASUS_BASS ),SND_PCI_QUIRK (0x1043 ,0x8691 ,"ASUS ROG Ranger VIII" ,ALC882_FIXUP_GPIO3 ), +SND_PCI_QUIRK (0x1043 ,0x8797 ,"ASUS TUF B550M-PLUS" ,ALCS1200A_FIXUP_MIC_VREF ),SND_PCI_QUIRK (0x104d ,0x9043 ,"Sony Vaio VGC-LN51JGB" ,ALC882_FIXUP_NO_PRIMARY_HP ),SND_PCI_QUIRK (0x104d ,0x9044 ,"Sony VAIO AiO" ,ALC882_FIXUP_NO_PRIMARY_HP ), SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
Greg Kroah-Hartman
maintainerPATCH 8/452 ALSA: usb-audio: Cancel pending work at closing a MIDI substream
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream.
At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing.
--- sound/usb/midi.c | 3 +++ 1 file changed, 3 insertions(+)
sound/usb/midi.c +3 -0
@@ -1161,6 +1161,9 @@ static int snd_usbmidi_output_open(strucstatic int snd_usbmidi_output_close (struct snd_rawmidi_substream *substream) { +struct usbmidi_out_port *port = substream->runtime->private_data; + +cancel_work_sync (&port->ep->work);return substream_open (substream,0 ,0 ); }
Greg Kroah-Hartman
maintainerPATCH 9/452 USB: serial: option: add Quectel BG95 modem
In reply to Greg Kroah-HartmanFrom: Carl Yin(殷张成) <[email protected]>
commit 33b7af2f459df453feb0d44628d820c47fefe7a8 upstream.
The BG95 modem has 3 USB configurations that are configurable via the AT command AT+QCFGEXT="usbnet",["ecm"|"modem"|"rmnet"] which make the modem enumerate with the following interfaces, respectively:
"modem": Diag + GNSS + Modem + Modem
"ecm" : Diag + GNSS + Modem + ECM
"rmnet": Diag + GNSS + Modem + QMI
Don't support Full QMI messages (e.g WDS_START_NETWORK_INTERFACE)
A detailed description of the USB configuration for each mode follows:
+QCFGEXT: "usbnet","modem"
--------------------------
T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0700 Rev= 0.00 S: Manufacturer=Quectel, Incorporated S: Product=Quectel LPWA Module S: SerialNumber=884328a2 C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+QCFGEXT: "usbnet","ecm"
------------------------
T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0700 Rev= 0.00 S: Manufacturer=Quectel, Incorporated S: Product=Quectel LPWA Module S: SerialNumber=884328a2 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+QCFGEXT: "usbnet","rmnet"
--------------------------
T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0700 Rev= 0.00 S: Manufacturer=Quectel, Incorporated S: Product=Quectel LPWA Module S: SerialNumber=884328a2 C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1137,6 +1137,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0xff, 0x30) }, /* EM160R-GL */ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */ + .driver_info = RSVD(3) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
Greg Kroah-Hartman
maintainerPATCH 10/452 USB: new quirk for Dell Gen 2 devices
In reply to Greg Kroah-HartmanFrom: Monish Kumar R <[email protected]>
commit 97fa5887cf283bb75ffff5f6b2c0e71794c02400 upstream.
Add USB_QUIRK_NO_LPM and USB_QUIRK_RESET_RESUME quirks for Dell usb gen 2 device to not fail during enumeration.
Found this bug on own testing
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -511,6 +511,9 @@ static const struct usb_device_id usb_qu/* DJI CineSSD */ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + /* DELL USB GEN2 */ + { USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME }, + /* VCOM device */ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
Greg Kroah-Hartman
maintainerPATCH 11/452 usb: dwc3: gadget: Move null pinter check to proper place
In reply to Greg Kroah-HartmanFrom: Albert Wang <[email protected]>
commit 3c5880745b4439ac64eccdb040e37fc1cc4c5406 upstream.
When dwc3_gadget_ep_cleanup_completed_requests() called to dwc3_gadget_giveback() where the dwc3 lock is released, other thread is able to execute. In this situation, usb_ep_disable() gets the chance to clear endpoint descriptor pointer which leds to the null pointer dereference problem. So needs to move the null pointer check to a proper place.
Example call stack:
Thread#1:dwc3_thread_interrupt()
spin_lock
-> dwc3_process_event_buf()
-> dwc3_process_event_entry()
-> dwc3_endpoint_interrupt()
-> dwc3_gadget_endpoint_trbs_complete()
-> dwc3_gadget_ep_cleanup_completed_requests()
...
-> dwc3_giveback()
spin_unlock
Thread#2 executesThread#2:configfs_composite_disconnect()
-> __composite_disconnect()
-> ffs_func_disable()
-> ffs_func_set_alt()
-> ffs_func_eps_disable()
-> usb_ep_disable()
wait for dwc3 spin_lock
Thread#1 released lock
clear endpoint.desc--- drivers/usb/dwc3/gadget.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/dwc3/gadget.c +3 -3
@@ -2960,14 +2960,14 @@ static bool dwc3_gadget_endpoint_trbs_costruct dwc3 *dwc = dep->dwc;bool no_started_trb = true; -if (!dep->endpoint.desc) -return no_started_trb; -dwc3_gadget_ep_cleanup_completed_requests (dep, event, status);if (dep->flags &DWC3_EP_END_TRANSFER_PENDING ) goto out; +if (!dep->endpoint.desc) +return no_started_trb; +if (usb_endpoint_xfer_isoc (dep->endpoint.desc) &&list_empty (&dep->started_list) && (list_empty (&dep->pending_list) || status == -EXDEV ))
Re: [PATCH 5.10 011/452] usb: dwc3: gadget: Move null pinter check to proper place
Hi!
Quoted 8 lines
commit
3c5880745b4439ac64eccdb040e37fc1cc4c5406upstream.When
dwc3_gadget_ep_cleanup_completed_requests()called todwc3_gadget_giveback()where the dwc3 lock is released, other thread is able to execute. In this situation,usb_ep_disable()gets the chance to clear endpoint descriptor pointer which leds to the null pointer dereference problem. So needs to move the null pointer check to a proper place.
Ok, but could someone check the error handling there? There's some cleanup at the out label, but moved code does not jump there.
Best regards,
Pavel
Quoted 20 lines
+++
b/drivers/usb/dwc3/gadget.cdrivers/usb/dwc3/gadget.c +3
-3@@ -2960,14 +2960,14 @@ static bool dwc3_gadget_endpoint_trbs_costruct dwc3 *dwc = dep->dwc;bool no_started_trb = true; -if (!dep->endpoint.desc) -return no_started_trb; -dwc3_gadget_ep_cleanup_completed_requests (dep, event, status);if (dep->flags &DWC3_EP_END_TRANSFER_PENDING ) goto out; +if (!dep->endpoint.desc) +return no_started_trb; +if (usb_endpoint_xfer_isoc (dep->endpoint.desc) &&list_empty (&dep->started_list) && (list_empty (&dep->pending_list) || status == -EXDEV ))
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 12/452 usb: core: hcd: Add support for deferring roothub registration
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
commit a44623d9279086c89f631201d993aa332f7c9e66 upstream.
It has been observed with certain PCIe USB cards (like Inateck connected to AM64 EVM or J7200 EVM) that as soon as the primary roothub is registered, port status change is handled even before xHC is running leading to cold plug USB devices not detected. For such cases, registering both the root hubs along with the second HCD is required. Add support for deferring roothub registration in usb_add_hcd(), so that both primary and secondary roothubs are registered along with the second HCD.
This patch has been added and reverted earier as it triggered a race in usb device enumeration.
That race is now fixed in 5.16-rc3, and in stable back to 5.4 commit 6cca13de26ee ("usb: hub: Fix locking issues with address0_mutex") commit 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race")
--- drivers/usb/core/hcd.c | 29 +++++++++++++++++++++++------ include/linux/usb/hcd.h | 2 ++ 2 files changed, 25 insertions(+), 6 deletions(-)
drivers/usb/core/hcd.c +23 -6
@@ -2661,6 +2661,7 @@ int usb_add_hcd(struct usb_hcd *hcd, {int retval;struct usb_device *rhdev; +struct usb_hcd *shared_hcd;if (!hcd->skip_phy_initialization &&usb_hcd_is_primary_hcd (hcd)) { hcd->phy_roothub =usb_phy_roothub_alloc (hcd->self.sysdev);
@@ -2817,13 +2818,26 @@ int usb_add_hcd(struct usb_hcd *hcd, goto err_hcd_driver_start; } +/* starting here, usbcore will pay attention to the shared HCD roothub */ + shared_hcd = hcd->shared_hcd; +if (!usb_hcd_is_primary_hcd (hcd) && shared_hcd &&HCD_DEFER_RH_REGISTER (shared_hcd)) { + retval =register_root_hub (shared_hcd); +if (retval !=0 ) + goto err_register_root_hub; + +if (shared_hcd->uses_new_polling &&HCD_POLL_RH (shared_hcd)) +usb_hcd_poll_rh_status (shared_hcd); + } +/* starting here, usbcore will pay attention to this root hub */ - retval =register_root_hub (hcd); -if (retval !=0 ) - goto err_register_root_hub; +if (!HCD_DEFER_RH_REGISTER (hcd)) { + retval =register_root_hub (hcd); +if (retval !=0 ) + goto err_register_root_hub; -if (hcd->uses_new_polling &&HCD_POLL_RH (hcd)) -usb_hcd_poll_rh_status (hcd); +if (hcd->uses_new_polling &&HCD_POLL_RH (hcd)) +usb_hcd_poll_rh_status (hcd); + }return retval;
@@ -2866,6 +2880,7 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);void usb_remove_hcd (struct usb_hcd *hcd) {struct usb_device *rhdev = hcd->self.root_hub; +bool rh_registered;dev_info (hcd->self.controller,"remove, state %x\n" , hcd->state);
@@ -2876,6 +2891,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)dev_dbg (hcd->self.controller,"roothub graceful disconnect\n" );spin_lock_irq (&hcd_root_hub_lock); + rh_registered = hcd->rh_registered; hcd->rh_registered =0 ;spin_unlock_irq (&hcd_root_hub_lock);
@@ -2885,7 +2901,8 @@ void usb_remove_hcd(struct usb_hcd *hcd)cancel_work_sync (&hcd->died_work);mutex_lock (&usb_bus_idr_lock); -usb_disconnect (&rhdev);/* Sets rhdev to NULL */ +if (rh_registered) +usb_disconnect (&rhdev);/* Sets rhdev to NULL */ mutex_unlock (&usb_bus_idr_lock);/*
include/linux/usb/hcd.h +2 -0
@@ -124,6 +124,7 @@ struct usb_hcd {#define HCD_FLAG_RH_RUNNING 5/* root hub is running? */ #define HCD_FLAG_DEAD 6/* controller has died? */ #define HCD_FLAG_INTF_AUTHORIZED 7/* authorize interfaces? */ +#define HCD_FLAG_DEFER_RH_REGISTER 8/* Defer roothub registration */ /* The flags can be tested using these macros; they are likely to * be slightly faster than test_bit().
@@ -134,6 +135,7 @@ struct usb_hcd {#define HCD_WAKEUP_PENDING (hcd) ((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING))#define HCD_RH_RUNNING (hcd) ((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING))#define HCD_DEAD (hcd) ((hcd)->flags & (1U << HCD_FLAG_DEAD)) +#define HCD_DEFER_RH_REGISTER (hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER))/* * Specifies if interfaces are authorized by default
Greg Kroah-Hartman
maintainerPATCH 13/452 cifs: when extending a file with falloc we should make files not-sparse
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit f66f8b94e7f2f4ac9fffe710be231ca8f25c5057 upstream.
as this is the only way to make sure the region is allocated. Fix the conditional that was wrong and only tried to make already non-sparse files non-sparse.
--- fs/cifs/smb2ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2ops.c +1 -1
@@ -3632,7 +3632,7 @@ static long smb3_simple_falloc(struct fiif (rc) goto out; -if ((cifsi->cifsAttrs &FILE_ATTRIBUTE_SPARSE_FILE ) ==0 ) +if (cifsi->cifsAttrs &FILE_ATTRIBUTE_SPARSE_FILE )smb2_set_sparse (xid, tcon, cfile, inode, false); eof =cpu_to_le64 (off + len);
Greg Kroah-Hartman
maintainerPATCH 14/452 xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 74f55a62c4c354f43a6d75f77dd184c4f57b9a26 upstream.
Alder Lake N TCSS xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3 and thus save energy
--- drivers/usb/host/xhci-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/xhci-pci.c +2 -0
@@ -59,6 +59,7 @@#define PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI 0x9a13#define PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI 0x1138#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI 0x461e +#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI 0x464e#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
@@ -263,6 +264,7 @@ static void xhci_pci_quirks(struct devic pdev->device ==PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI || + pdev->device ==PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI || pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI)) xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
Greg Kroah-Hartman
maintainerPATCH 15/452 Fonts: Make font size unsigned in font_desc
In reply to Greg Kroah-HartmanFrom: Peilin Ye <[email protected]>
commit 7cb415003468d41aecd6877ae088c38f6c0fc174 upstream.
width and height are defined as unsigned in our UAPI font descriptor struct console_font. Make them unsigned in our kernel font descriptor struct font_desc, too.
Also, change the corresponding printk() format identifiers from %d to %u, in sti_select_fbfont().
--- drivers/video/console/sticore.c | 2 +- include/linux/font.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/video/console/sticore.c +1 -1
@@ -503,7 +503,7 @@ sti_select_fbfont(struct sti_cooked_romif (!fbfont)return NULL ; -pr_info ("STI selected %dx%d framebuffer font %s for sticon\n" , +pr_info ("STI selected %ux%u framebuffer font %s for sticon\n" , fbfont->width, fbfont->height, fbfont->name); bpc = ((fbfont->width+7 )/8 ) * fbfont->height;
include/linux/font.h +1 -1
@@ -16,7 +16,7 @@struct font_desc {int idx;const char *name; -int width, height; +unsigned int width, height;const void *data;int pref; };
Greg Kroah-Hartman
maintainerPATCH 16/452 parisc/stifb: Keep track of hardware path of graphics card
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit b046f984814af7985f444150ec28716d42d00d9a upstream.
Keep the pa_path (hardware path) of the graphics card in sti_struct and use this info to give more useful info which card is currently being used.
--- drivers/video/console/sticon.c | 5 ++++- drivers/video/console/sticore.c | 15 +++++++-------- drivers/video/fbdev/sticore.h | 3 +++ 3 files changed, 14 insertions(+), 9 deletions(-)
drivers/video/console/sticon.c +4 -1
@@ -46,6 +46,7 @@#include <linux/slab.h> #include <linux/font.h> #include <linux/crc32.h> +#include <linux/fb.h> #include <asm/io.h>
@@ -392,7 +393,9 @@ static int __init sticonsole_init(void)for (i =0 ; i <MAX_NR_CONSOLES ; i++) font_data[i] =STI_DEF_FONT ; -pr_info ("sticon: Initializing STI text console.\n" ); +pr_info ("sticon: Initializing STI text console on %s at [%s]\n" , + sticon_sti->sti_data->inq_outptr.dev_name, + sticon_sti->pa_path);console_lock (); err =do_take_over_console (&sti_con,0 ,MAX_NR_CONSOLES -1 ,PAGE0 ->mem_cons.cl_class !=CL_DUPLEX );
drivers/video/console/sticore.c +7 -8
@@ -34,7 +34,7 @@#include "../fbdev/sticore.h" -#define STI_DRIVERVERSION "Version 0.9b" +#define STI_DRIVERVERSION "Version 0.9c"static struct sti_struct *default_sti__read_mostly ;
@@ -503,7 +503,7 @@ sti_select_fbfont(struct sti_cooked_romif (!fbfont)return NULL ; -pr_info ("STI selected %ux%u framebuffer font %s for sticon\n" , +pr_info (" using %ux%u framebuffer font %s\n" , fbfont->width, fbfont->height, fbfont->name); bpc = ((fbfont->width+7 )/8 ) * fbfont->height;
@@ -947,6 +947,7 @@ out_err:static void sticore_check_for_default_sti (struct sti_struct *sti,char *path) { +pr_info (" located at [%s]\n" , sti->pa_path);if (strcmp (path, default_sti_path) ==0 ) default_sti = sti; }
@@ -958,7 +959,6 @@ static void sticore_check_for_default_st*/ static int __init sticore_pa_init (struct parisc_device *dev) { -char pa_path[21 ];struct sti_struct *sti =NULL ;int hpa = dev->hpa.start;
@@ -971,8 +971,8 @@ static int __init sticore_pa_init(structif (!sti)return 1 ; -print_pa_hwpath (dev, pa_path); -sticore_check_for_default_sti (sti, pa_path); +print_pa_hwpath (dev, sti->pa_path); +sticore_check_for_default_sti (sti, sti->pa_path);return 0 ; }
@@ -1008,9 +1008,8 @@ static int sticore_pci_init(struct pci_d sti =sti_try_rom_generic (rom_base, fb_base, pd);if (sti) { -char pa_path[30 ]; -print_pci_hwpath (pd, pa_path); -sticore_check_for_default_sti (sti, pa_path); +print_pci_hwpath (pd, sti->pa_path); +sticore_check_for_default_sti (sti, sti->pa_path); }if (!sti) {
drivers/video/fbdev/sticore.h +3 -0
@@ -370,6 +370,9 @@ struct sti_struct {/* pointer to all internal data */ struct sti_all_data *sti_data; + +/* pa_path of this device */ +char pa_path[24 ]; };
Greg Kroah-Hartman
maintainerPATCH 17/452 x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails
In reply to Greg Kroah-HartmanFrom: Ammar Faizi <[email protected]>
commit e5f28623ceb103e13fc3d7bd45edf9818b227fd0 upstream.
In mce_threshold_create_device(), if threshold_create_bank() fails, the previously allocated threshold banks array @bp will be leaked because the call to mce_threshold_remove_device() will not free it.
This happens because mce_threshold_remove_device() fetches the pointer through the threshold_banks per-CPU variable but bp is written there only after the bank creation is successful, and not before, when threshold_create_bank() fails.
Add a helper which unwinds all the bank creation work previously done and pass into it the previously allocated threshold banks array for freeing.
[ bp: Massage. ]
--- arch/x86/kernel/cpu/mce/amd.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-)
arch/x86/kernel/cpu/mce/amd.c +19 -13
@@ -1457,10 +1457,23 @@ out_free:kfree (bank); } +static void __threshold_remove_device (struct threshold_bank **bp) +{ +unsigned int bank, numbanks =this_cpu_read (mce_num_banks); + +for (bank =0 ; bank < numbanks; bank++) { +if (!bp[bank]) +continue ; + +threshold_remove_bank (bp[bank]); + bp[bank] =NULL ; + } +kfree (bp); +} +int mce_threshold_remove_device (unsigned int cpu) {struct threshold_bank **bp =this_cpu_read (threshold_banks); -unsigned int bank, numbanks =this_cpu_read (mce_num_banks);if (!bp)return 0 ;
@@ -1471,13 +1484,7 @@ int mce_threshold_remove_device(unsigned*/ this_cpu_write (threshold_banks,NULL ); -for (bank =0 ; bank < numbanks; bank++) { -if (bp[bank]) { -threshold_remove_bank (bp[bank]); - bp[bank] =NULL ; - } - } -kfree (bp); +__threshold_remove_device (bp);return 0 ; }
@@ -1514,15 +1521,14 @@ int mce_threshold_create_device(unsignedif (!(this_cpu_read (bank_map) & (1 << bank)))continue ; err =threshold_create_bank (bp, cpu, bank); -if (err) - goto out_err; +if (err) { +__threshold_remove_device (bp); +return err; + } }this_cpu_write (threshold_banks, bp);if (thresholding_irq_en) mce_threshold_vector = amd_threshold_interrupt;return 0 ; -out_err: -mce_threshold_remove_device (cpu); -return err; }
Greg Kroah-Hartman
maintainerPATCH 18/452 perf/x86/intel: Fix event constraints for ICL
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
commit 86dca369075b3e310c3c0adb0f81e513c562b5e4 upstream.
According to the latest event list, the event encoding 0x55 INST_DECODED.DECODERS and 0x56 UOPS_DECODED.DEC0 are only available on the first 4 counters. Add them into the event constraints table.
--- arch/x86/events/intel/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/intel/core.c +1 -1
@@ -254,7 +254,7 @@ static struct event_constraint intel_iclINTEL_EVENT_CONSTRAINT_RANGE (0x03 ,0x0a ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0x1f ,0x28 ,0xf ),INTEL_EVENT_CONSTRAINT (0x32 ,0xf ),/* SW_PREFETCH_ACCESS.* */ -INTEL_EVENT_CONSTRAINT_RANGE (0x48 ,0x54 ,0xf ), +INTEL_EVENT_CONSTRAINT_RANGE (0x48 ,0x56 ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0x60 ,0x8b ,0xf ),INTEL_UEVENT_CONSTRAINT (0x04a3 ,0xff ),/* CYCLE_ACTIVITY.STALLS_TOTAL */ INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff), /* CYCLE_ACTIVITY.CYCLES_MEM_ANY */
Greg Kroah-Hartman
maintainerPATCH 19/452 ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit c200e4bb44e80b343c09841e7caaaca0aac5e5fa upstream.
User mode linux is the last user of the PT_DTRACE flag. Using the flag to indicate single stepping is a little confusing and worse changing tsk->ptrace without locking could potentionally cause problems.
So use a thread info flag with a better name instead of flag in tsk->ptrace.
Remove the definition PT_DTRACE as uml is the last user.
--- arch/um/include/asm/thread_info.h | 2 ++ arch/um/kernel/exec.c | 2 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/ptrace.c | 8 ++++---- arch/um/kernel/signal.c | 4 ++-- include/linux/ptrace.h | 1 - 6 files changed, 10 insertions(+), 9 deletions(-)
arch/um/include/asm/thread_info.h +2 -0
@@ -63,6 +63,7 @@ static inline struct thread_info *curren#define TIF_RESTORE_SIGMASK 7#define TIF_NOTIFY_RESUME 8#define TIF_SECCOMP 9/* secure computing */ +#define TIF_SINGLESTEP 10/* single stepping userspace */ #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)#define _TIF_SIGPENDING (1 << TIF_SIGPENDING)
@@ -70,5 +71,6 @@ static inline struct thread_info *curren#define _TIF_MEMDIE (1 << TIF_MEMDIE)#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)#define _TIF_SECCOMP (1 << TIF_SECCOMP) +#define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP)#endif
arch/um/kernel/exec.c +1 -1
@@ -44,7 +44,7 @@ void start_thread(struct pt_regs *regs, {PT_REGS_IP (regs) = eip;PT_REGS_SP (regs) = esp; - current->ptrace &= ~PT_DTRACE ; +clear_thread_flag (TIF_SINGLESTEP );#ifdef SUBARCH_EXECVE1 SUBARCH_EXECVE1 (regs->regs);#endif
arch/um/kernel/process.c +1 -1
@@ -341,7 +341,7 @@ int singlestepping(void * t) {struct task_struct *task = t ? t : current; -if (!(task->ptrace &PT_DTRACE )) +if (!test_thread_flag (TIF_SINGLESTEP ))return 0 ;if (task->thread.singlestep_syscall)
arch/um/kernel/ptrace.c +4 -4
@@ -12,7 +12,7 @@void user_enable_single_step (struct task_struct *child) { - child->ptrace |=PT_DTRACE ; +set_tsk_thread_flag (child,TIF_SINGLESTEP ); child->thread.singlestep_syscall =0 ;#ifdef SUBARCH_SET_SINGLESTEPPING
@@ -22,7 +22,7 @@ void user_enable_single_step(struct taskvoid user_disable_single_step (struct task_struct *child) { - child->ptrace &= ~PT_DTRACE ; +clear_tsk_thread_flag (child,TIF_SINGLESTEP ); child->thread.singlestep_syscall =0 ;#ifdef SUBARCH_SET_SINGLESTEPPING
@@ -121,7 +121,7 @@ static void send_sigtrap(struct uml_pt_r }/* -* XXX Check PT_DTRACE vs TIF_SINGLESTEP for singlestepping check and +* XXX Check TIF_SINGLESTEP for singlestepping check and * PT_PTRACED vs TIF_SYSCALL_TRACE for syscall tracing check */ int syscall_trace_enter (struct pt_regs *regs)
@@ -145,7 +145,7 @@ void syscall_trace_leave(struct pt_regsaudit_syscall_exit (regs);/* Fake a debug trap */ -if (ptraced &PT_DTRACE ) +if (test_thread_flag (TIF_SINGLESTEP ))send_sigtrap (®s->regs,0 );if (!test_thread_flag (TIF_SYSCALL_TRACE ))
arch/um/kernel/signal.c +2 -2
@@ -53,7 +53,7 @@ static void handle_signal(struct ksignalunsigned long sp;int err; -if ((current->ptrace &PT_DTRACE ) && (current->ptrace &PT_PTRACED )) +if (test_thread_flag (TIF_SINGLESTEP ) && (current->ptrace &PT_PTRACED )) singlestep =1 ;/* Did we come from a system call? */
@@ -128,7 +128,7 @@ void do_signal(struct pt_regs *regs)* on the host. The tracing thread will check this flag and * PTRACE_SYSCALL if necessary. */ -if (current->ptrace &PT_DTRACE ) +if (test_thread_flag (TIF_SINGLESTEP )) current->thread.singlestep_syscall =is_syscall (PT_REGS_IP (¤t->thread.regs));
include/linux/ptrace.h +0 -1
@@ -30,7 +30,6 @@ extern int ptrace_access_vm(struct task_#define PT_SEIZED 0x00010000/* SEIZE used, enable new behavior */ #define PT_PTRACED 0x00000001 -#define PT_DTRACE 0x00000002/* delayed trace (used on m68k, i386) */ #define PT_OPT_FLAG_SHIFT 3/* PT_TRACE_* event enable flags */
Greg Kroah-Hartman
maintainerPATCH 20/452 ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit 4a3d2717d140401df7501a95e454180831a0c5af upstream.
xtensa is the last user of the PT_SINGLESTEP flag. Changing tsk->ptrace in user_enable_single_step and user_disable_single_step without locking could potentiallly cause problems.
So use a thread info flag instead of a flag in tsk->ptrace. Use TIF_SINGLESTEP that xtensa already had defined but unused.
Remove the definitions of PT_SINGLESTEP and PT_BLOCKSTEP as they have no more users.
--- arch/xtensa/kernel/ptrace.c | 4 ++-- arch/xtensa/kernel/signal.c | 4 ++-- include/linux/ptrace.h | 6 ------ 3 files changed, 4 insertions(+), 10 deletions(-)
arch/xtensa/kernel/ptrace.c +2 -2
@@ -226,12 +226,12 @@ const struct user_regset_view *task_uservoid user_enable_single_step (struct task_struct *child) { - child->ptrace |=PT_SINGLESTEP ; +set_tsk_thread_flag (child,TIF_SINGLESTEP ); }void user_disable_single_step (struct task_struct *child) { - child->ptrace &= ~PT_SINGLESTEP ; +clear_tsk_thread_flag (child,TIF_SINGLESTEP ); }/*
arch/xtensa/kernel/signal.c +2 -2
@@ -465,7 +465,7 @@ static void do_signal(struct pt_regs *re/* Set up the stack frame */ ret =setup_frame (&ksig,sigmask_to_save (), regs);signal_setup_done (ret, &ksig,0 ); -if (current->ptrace &PT_SINGLESTEP ) +if (test_thread_flag (TIF_SINGLESTEP ))task_pt_regs (current)->icountlevel =1 ;return ;
@@ -491,7 +491,7 @@ static void do_signal(struct pt_regs *re/* If there's no signal to deliver, we just restore the saved mask. */ restore_saved_sigmask (); -if (current->ptrace &PT_SINGLESTEP ) +if (test_thread_flag (TIF_SINGLESTEP ))task_pt_regs (current)->icountlevel =1 ;return ; }
include/linux/ptrace.h +0 -6
@@ -46,12 +46,6 @@ extern int ptrace_access_vm(struct task_#define PT_EXITKILL (PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT)#define PT_SUSPEND_SECCOMP (PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT) -/* single stepping state bits (used on ARM and PA-RISC) */ -#define PT_SINGLESTEP_BIT 31 -#define PT_SINGLESTEP (1<<PT_SINGLESTEP_BIT) -#define PT_BLOCKSTEP_BIT 30 -#define PT_BLOCKSTEP (1<<PT_BLOCKSTEP_BIT) -extern long arch_ptrace (struct task_struct *child,long request,unsigned long addr,unsigned long data);extern int ptrace_readdata (struct task_struct *tsk,unsigned long src,char __user *dst,int len);
Greg Kroah-Hartman
maintainerPATCH 21/452 ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit 6a2d90ba027adba528509ffa27097cffd3879257 upstream.
The current implementation of PTRACE_KILL is buggy and has been for many years as it assumes it's target has stopped in ptrace_stop. At a quick skim it looks like this assumption has existed since ptrace support was added in linux v1.0.
While PTRACE_KILL has been deprecated we can not remove it as a quick search with google code search reveals many existing programs calling it.
When the ptracee is not stopped at ptrace_stop some fields would be set that are ignored except in ptrace_stop. Making the userspace visible behavior of PTRACE_KILL a noop in those case.
As the usual rules are not obeyed it is not clear what the consequences are of calling PTRACE_KILL on a running process. Presumably userspace does not do this as it achieves nothing.
Replace the implementation of PTRACE_KILL with a simple send_sig_info(SIGKILL) followed by a return 0. This changes the observable user space behavior only in that PTRACE_KILL on a process not stopped in ptrace_stop will also kill it. As that has always been the intent of the code this seems like a reasonable change.
--- arch/x86/kernel/step.c | 3 +-- kernel/ptrace.c | 5 ++--- 2 files changed, 3 insertions(+), 5 deletions(-)
arch/x86/kernel/step.c +1 -2
@@ -175,8 +175,7 @@ void set_task_blockstep(struct task_stru* * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if * task is current or it can't be running, otherwise we can race -* with __switch_to_xtra(). We rely on ptrace_freeze_traced() but -* PTRACE_KILL is not safe. +* with __switch_to_xtra(). We rely on ptrace_freeze_traced(). */ local_irq_disable (); debugctl =get_debugctlmsr ();
kernel/ptrace.c +2 -3
@@ -1219,9 +1219,8 @@ int ptrace_request(struct task_struct *creturn ptrace_resume (child, request, data);case PTRACE_KILL : -if (child->exit_state)/* already dead */ -return 0 ; -return ptrace_resume (child, request,SIGKILL ); +send_sig_info (SIGKILL ,SEND_SIG_NOINFO , child); +return 0 ;#ifdef CONFIG_HAVE_ARCH_TRACEHOOK case PTRACE_GETREGSET :
Greg Kroah-Hartman
maintainerPATCH 22/452 btrfs: add "0x" prefix for unsupported optional features
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit d5321a0fa8bc49f11bea0b470800962c17d92d8f upstream.
The following error message lack the "0x" obviously:
cannot mount because of unsupported optional features (4000)
Add the prefix to make it less confusing. This can happen on older kernels that try to mount a filesystem with newer features so it makes sense to backport to older trees.
--- fs/btrfs/disk-io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/disk-io.c +2 -2
@@ -3061,7 +3061,7 @@ int __cold open_ctree(struct super_block ~BTRFS_FEATURE_INCOMPAT_SUPP ;if (features) {btrfs_err (fs_info, -"cannot mount because of unsupported optional features (%llx)" , +"cannot mount because of unsupported optional features (0x%llx)" , features); err = -EINVAL ; goto fail_alloc;
@@ -3099,7 +3099,7 @@ int __cold open_ctree(struct super_block ~BTRFS_FEATURE_COMPAT_RO_SUPP ;if (!sb_rdonly (sb) && features) {btrfs_err (fs_info, -"cannot mount read-write because of unsupported optional features (%llx)" , +"cannot mount read-write because of unsupported optional features (0x%llx)" , features); err = -EINVAL ; goto fail_alloc;
Greg Kroah-Hartman
maintainerPATCH 23/452 btrfs: repair super block num_devices automatically
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit d201238ccd2f30b9bfcfadaeae0972e3a486a176 upstream.
[BUG]
There is a report that a btrfs has a bad super block num devices.
This makes btrfs to reject the fs completely.
BTRFS error (device sdd3): super_num_devices 3 mismatch with num_devices 2 found here BTRFS error (device sdd3): failed to read chunk tree: -22
BTRFS error (device sdd3): open_ctree failed
[CAUSE]
During btrfs device removal, chunk tree and super block num devs are updated in two different transactions:
btrfs_rm_device()
|- btrfs_rm_dev_item(device) | |- trans = btrfs_start_transaction() | | Now we got transaction X | | | |- btrfs_del_item() | | Now device item is removed from chunk tree | | | |- btrfs_commit_transaction() | Transaction X got committed, super num devs untouched, | but device item removed from chunk tree. | (AKA, super num devs is already incorrect) | |- cur_devices->num_devices--; |- cur_devices->total_devices--; |- btrfs_set_super_num_devices()
All those operations are not in transaction X, thus it will only be written back to disk in next transaction.
So after the transaction X in btrfs_rm_dev_item() committed, but before transaction X+1 (which can be minutes away), a power loss happen, then we got the super num mismatch.
This has been fixed by commit bbac58698a55 ("btrfs: remove device item and update super block in the same transaction").
[FIX]
Make the super_num_devices check less strict, converting it from a hard error to a warning, and reset the value to a correct one for the current or next transaction commit.
As the number of device items is the critical information where the super block num_devices is only a cached value (and also useful for cross checking), it's safe to automatically update it. Other device related problems like missing device are handled after that and may require other means to resolve, like degraded mount. With this fix, potentially affected filesystems won't fail mount and require the manual repair by btrfs check.
--- fs/btrfs/volumes.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/btrfs/volumes.c +4 -4
@@ -7191,12 +7191,12 @@ int btrfs_read_chunk_tree(struct btrfs_f* do another round of validation checks. */ if (total_dev != fs_info->fs_devices->total_devices) { -btrfs_err (fs_info, -"super_num_devices %llu mismatch with num_devices %llu found here" , +btrfs_warn (fs_info, +"super block num_devices %llu mismatch with DEV_ITEM count %llu, will be repaired on next transaction commit" ,btrfs_super_num_devices (fs_info->super_copy), total_dev); - ret = -EINVAL ; - goto error; + fs_info->fs_devices->total_devices = total_dev; +btrfs_set_super_num_devices (fs_info->super_copy, total_dev); }if (btrfs_super_total_bytes (fs_info->super_copy) < fs_info->fs_devices->total_rw_bytes) {
Greg Kroah-Hartman
maintainerPATCH 24/452 iommu/vt-d: Add RPLS to quirk list to skip TE disabling
In reply to Greg Kroah-HartmanFrom: Tejas Upadhyay <[email protected]>
[ Upstream commit 0a967f5bfd9134b89681cae58deb222e20840e76 ]
The VT-d spec requires (10.4.4 Global Command Register, TE field) that:
Hardware implementations supporting DMA draining must drain any in-flight DMA read/write requests queued within the Root-Complex before completing the translation enable command and reflecting the status of the command through the TES field in the Global Status register.
Unfortunately, some integrated graphic devices fail to do so after some kind of power state transition. As the result, the system might stuck in iommu_disable_translati on(), waiting for the completion of TE transition.
This adds RPLS to a quirk list for those devices and skips TE disabling if the qurik hits.
--- drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/iommu.c +1 -1
@@ -6296,7 +6296,7 @@ static void quirk_igfx_skip_te_disable(struct pci_dev *dev) ver = (dev->device >>8 ) &0xff ;if (ver !=0x45 && ver !=0x46 && ver !=0x4c && ver !=0x4e && ver !=0x8a && ver !=0x98 && - ver !=0x9a ) + ver !=0x9a && ver !=0xa7 )return ;if (risky_device (dev))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 25/452 drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
In reply to Greg Kroah-HartmanFrom: Liu Zixian <[email protected]>
[ Upstream commit 194d250cdc4a40ccbd179afd522a9e9846957402 ]
drm_cvt_mode may return NULL and we should check it.
This bug is found by syzkaller:
FAULT_INJECTION stacktrace:
[ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218
KASAN stacktrace:
[ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218
--- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/virtio/virtgpu_display.c +2 -0
@@ -177,6 +177,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector)DRM_DEBUG ("add mode: %dx%d\n" , width, height); mode =drm_cvt_mode (connector->dev, width, height,60 , false, false, false); +if (!mode) +return count; mode->type |=DRM_MODE_TYPE_PREFERRED ;drm_mode_probed_add (connector, mode); count++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 26/452 selftests/bpf: Fix vfs_link kprobe definition
In reply to Greg Kroah-HartmanFrom: Nikolay Borisov <[email protected]>
[ Upstream commit e299bcd4d16ff86f46c48df1062c8aae0eca1ed8 ]
Since commit 6521f8917082 ("namei: prepare for idmapped mounts") vfs_link's prototype was changed, the kprobe definition in profiler selftest in turn wasn't updated. The result is that all argument after the first are now stored in different registers. This means that self-test has been broken ever since. Fix it by updating the kprobe definition accordingly.
--- tools/testing/selftests/bpf/progs/profiler.inc.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/progs/profiler.inc.h +3 -2
@@ -826,8 +826,9 @@ int kprobe_ret__do_filp_open(struct pt_regs* ctx) SEC("kprobe/vfs_link")int BPF_KPROBE (kprobe__vfs_link , -struct dentry * old_dentry,struct inode * dir, -struct dentry * new_dentry,struct inode ** delegated_inode) +struct dentry * old_dentry,struct user_namespace *mnt_userns, +struct inode * dir,struct dentry * new_dentry, +struct inode ** delegated_inode) {struct bpf_func_stats_ctx stats_ctx;bpf_stats_enter (&stats_ctx, profiler_bpf_vfs_link);
Signature · 1 line
2.35.1
Re: [PATCH 5.10 026/452] selftests/bpf: Fix vfs_link kprobe definition
Hi!
Quoted 8 lines
[ Upstream commit
e299bcd4d16ff86f46c48df1062c8aae0eca1ed8]Since commit
6521f8917082("namei: prepare for idmapped mounts") vfs_link's prototype was changed, the kprobe definition in profiler selftest in turn wasn't updated. The result is that all argument after the first are now stored in different registers. This means that self-test has been broken ever since. Fix it by updating the kprobe definition accordingly.
I don't see 6521f8917082 ("namei: prepare for idmapped mounts") in 5.10-stable tree. In 5.10, we still have:
include/linux/fs.h:extern int vfs_link(struct dentry *, struct inode *, struct dentry *, struct inode **);
I believe that means we should not have this one, either.
Best regards,
Pavel
Quoted 17 lines
+++
b/tools/testing/selftests/bpf/progs/profiler.inc.htools/testing/selftests/bpf/progs/profiler.inc.h +3
-2@@ -826,8 +826,9 @@ int kprobe_ret__do_filp_open(struct pt_regs* ctx) SEC("kprobe/vfs_link")int BPF_KPROBE (kprobe__vfs_link , -struct dentry * old_dentry,struct inode * dir, -struct dentry * new_dentry,struct inode ** delegated_inode) +struct dentry * old_dentry,struct user_namespace *mnt_userns, +struct inode * dir,struct dentry * new_dentry, +struct inode ** delegated_inode) {struct bpf_func_stats_ctx stats_ctx;bpf_stats_enter (&stats_ctx, profiler_bpf_vfs_link);Signature · 1 line
2.35.1
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 026/452] selftests/bpf: Fix vfs_link kprobe definition
Quoted 11 lines · Pavel Machek
Hi!
Quoted 8 lines
[ Upstream commit
e299bcd4d16ff86f46c48df1062c8aae0eca1ed8]Since commit
6521f8917082("namei: prepare for idmapped mounts") vfs_link's prototype was changed, the kprobe definition in profiler selftest in turn wasn't updated. The result is that all argument after the first are now stored in different registers. This means that self-test has been broken ever since. Fix it by updating the kprobe definition accordingly.
Quoted 6 lines
I don't see
6521f8917082("namei: prepare for idmapped mounts") in 5.10-stable tree. In 5.10, we still have:include/linux/fs.h:extern int
vfs_link(struct dentry *, struct inode *, struct dentry *, struct inode **);I believe that means we should not have this one, either.
Good point, will go drop this, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 27/452 mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 3e12968f6d12a34b540c39cbd696a760cc4616f0 ]
cfg80211_ch_switch_notify uses ASSERT_WDEV_LOCK to assert that net_device->ieee80211_ptr->mtx (which is the same as priv->wdev.mtx) is held during the function's execution. mwifiex_dfs_chan_sw_work_queue is one of its callers, which does not hold that lock, therefore violating the assertion.
Add a lock around the call.
Disclaimer:
I am currently working on a static analyser to detect missing locks. This was a reported case. I manually verified the report by looking at the code, so that I do not send wrong information or patches. After concluding that this seems to be a true positive, I created this patch.
However, as I do not in fact have this particular hardware, I was unable to test it.
--- drivers/net/wireless/marvell/mwifiex/11h.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/marvell/mwifiex/11h.c +2 -0
@@ -303,5 +303,7 @@ void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)mwifiex_dbg (priv->adapter,MSG ,"indicating channel switch completion to kernel\n" ); +mutex_lock (&priv->wdev.mtx);cfg80211_ch_switch_notify (priv->netdev, &priv->dfs_chandef); +mutex_unlock (&priv->wdev.mtx); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 28/452 b43legacy: Fix assigning negative value to unsigned variable
In reply to Greg Kroah-HartmanFrom: Haowen Bai <[email protected]>
[ Upstream commit 3f6b867559b3d43a7ce1b4799b755e812fc0d503 ]
fix warning reported by smatch:drivers/net/wireless/broadcom/b43legacy/phy.c:1181 b43legacy_phy_lo_b_measure()
warn: assigning (-772) to unsigned variable 'fval'
--- drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/b43legacy/phy.c +1 -1
@@ -1123,7 +1123,7 @@ void b43legacy_phy_lo_b_measure(struct b43legacy_wldev *dev)struct b43legacy_phy *phy = &dev->phy;u16 regstack[12 ] = {0 };u16 mls; -u16 fval; +s16 fval;int i;int j;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 29/452 b43: Fix assigning negative value to unsigned variable
In reply to Greg Kroah-HartmanFrom: Haowen Bai <[email protected]>
[ Upstream commit 11800d893b38e0e12d636c170c1abc19c43c730c ]
fix warning reported by smatch:drivers/net/wireless/broadcom/b43/phy_n.c:585 b43_nphy_adjust_lna_gain_table()
warn: assigning (-2) to unsigned variable '*(lna_gain[0])'
--- drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/b43/phy_n.c +1 -1
@@ -582,7 +582,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)u16 data[4 ];s16 gain[2 ];u16 minmax[2 ]; -static const u16 lna_gain[4 ] = {-2 ,10 ,19 ,25 }; +static const s16 lna_gain[4 ] = {-2 ,10 ,19 ,25 };if (nphy->hang_avoid)b43_nphy_stay_in_carrier_search (dev,1 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 30/452 ipw2x00: Fix potential NULL dereference in libipw_xmit()
In reply to Greg Kroah-HartmanFrom: Haowen Bai <[email protected]>
[ Upstream commit e8366bbabe1d207cf7c5b11ae50e223ae6fc278b ]
crypt and crypt->ops could be null, so we need to checking null before dereference
--- drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/ipw2x00/libipw_tx.c +1 -1
@@ -383,7 +383,7 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev)/* Each fragment may need to have room for encryption * pre/postfix */ -if (host_encrypt) +if (host_encrypt && crypt && crypt->ops) bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len + crypt->ops->extra_mpdu_postfix_len;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 31/452 ipv6: fix locking issues with loops over idev->addr_list
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 51454ea42c1ab4e0c2828bb0d4d53957976980de ]
idev->addr_list needs to be protected by idev->lock. However, it is not always possible to do so while iterating and performing actions on inet6_ifaddr instances. For example, multiple functions (like addrconf_{join,leave}_anycast) eventually call down to other functions that acquire the idev->lock. The current code temporarily unlocked the idev->lock during the loops, which can cause race conditions. Moving the locks up is also not an appropriate solution as the ordering of lock acquisition will be inconsistent with for example mc_lock.
This solution adds an additional field to inet6_ifaddr that is used to temporarily add the instances to a temporary list while holding idev->lock. The temporary list can then be traversed without holding idev->lock. This change was done in two places. In addrconf_ifdown, the list_for_each_entry_safe variant of the list loop is also no longer necessary as there is no deletion within that specific loop.
--- include/net/if_inet6.h | 8 ++++++++ net/ipv6/addrconf.c | 30 ++++++++++++++++++++++++------ 2 files changed, 32 insertions(+), 6 deletions(-)
include/net/if_inet6.h +8 -0
@@ -64,6 +64,14 @@ struct inet6_ifaddr {struct hlist_node addr_lst;struct list_head if_list; +/* +* Used to safely traverse idev->addr_list in process context +* if the idev->lock needed to protect idev->addr_list cannot be held. +* In that case, add the items to this list temporarily and iterate +* without holding idev->lock. +* See addrconf_ifdown and dev_forward_change. +*/ +struct list_head if_list_aux;struct list_head tmp_list;struct inet6_ifaddr *ifpub;
net/ipv6/addrconf.c +24 -6
@@ -789,6 +789,7 @@ static void dev_forward_change(struct inet6_dev *idev) {struct net_device *dev;struct inet6_ifaddr *ifa; +LIST_HEAD (tmp_addr_list);if (!idev)return ;
@@ -807,14 +808,24 @@ static void dev_forward_change(struct inet6_dev *idev) } } +read_lock_bh (&idev->lock);list_for_each_entry (ifa, &idev->addr_list, if_list) {if (ifa->flags&IFA_F_TENTATIVE )continue ; +list_add_tail (&ifa->if_list_aux, &tmp_addr_list); + } +read_unlock_bh (&idev->lock); + +while (!list_empty (&tmp_addr_list)) { + ifa =list_first_entry (&tmp_addr_list, + struct inet6_ifaddr, if_list_aux); +list_del (&ifa->if_list_aux);if (idev->cnf.forwarding)addrconf_join_anycast (ifa);else addrconf_leave_anycast (ifa); } +inet6_netconf_notify_devconf (dev_net (dev),RTM_NEWNETCONF ,NETCONFA_FORWARDING , dev->ifindex, &idev->cnf);
@@ -3710,7 +3721,8 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)unsigned long event = unregister ?NETDEV_UNREGISTER :NETDEV_DOWN ;struct net *net =dev_net (dev);struct inet6_dev *idev; -struct inet6_ifaddr *ifa, *tmp; +struct inet6_ifaddr *ifa; +LIST_HEAD (tmp_addr_list);bool keep_addr = false;bool was_ready;int state, i;
@@ -3802,16 +3814,23 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)write_lock_bh (&idev->lock); } -list_for_each_entry_safe (ifa, tmp, &idev->addr_list, if_list) { +list_for_each_entry (ifa, &idev->addr_list, if_list) +list_add_tail (&ifa->if_list_aux, &tmp_addr_list); +write_unlock_bh (&idev->lock); + +while (!list_empty (&tmp_addr_list)) {struct fib6_info *rt =NULL ;bool keep; + ifa =list_first_entry (&tmp_addr_list, + struct inet6_ifaddr, if_list_aux); +list_del (&ifa->if_list_aux); +addrconf_del_dad_work (ifa); keep = keep_addr && (ifa->flags &IFA_F_PERMANENT ) && !addr_is_local (&ifa->addr); -write_unlock_bh (&idev->lock);spin_lock_bh (&ifa->lock);if (keep) {
@@ -3842,15 +3861,14 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)addrconf_leave_solict (ifa->idev, &ifa->addr); } -write_lock_bh (&idev->lock);if (!keep) { +write_lock_bh (&idev->lock);list_del_rcu (&ifa->if_list); +write_unlock_bh (&idev->lock);in6_ifa_put (ifa); } } -write_unlock_bh (&idev->lock); -/* Step 5: Discard anycast and multicast list */ if (unregister) {ipv6_ac_destroy_dev (idev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 32/452 fbcon: Consistently protect deferred_takeover with console_lock()
In reply to Greg Kroah-HartmanFrom: Daniel Vetter <[email protected]>
[ Upstream commit 43553559121ca90965b572cf8a1d6d0fd618b449 ]
This shouldn't be a problem in practice since until we've actually taken over the console there's nothing we've registered with the console/vt subsystem, so the exit/unbind path that check this can't do the wrong thing. But it's confusing, so fix it by moving it a tad later.
--- drivers/video/fbdev/core/fbcon.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/video/fbdev/core/fbcon.c +3 -2
@@ -3300,6 +3300,9 @@ static void fbcon_register_existing_fbs(struct work_struct *work)console_lock (); + deferred_takeover = false; + logo_shown =FBCON_LOGO_DONTSHOW ; +for_each_registered_fb (i)fbcon_fb_registered (registered_fb[i]);
@@ -3317,8 +3320,6 @@ static int fbcon_output_notifier(struct notifier_block *nb,pr_info ("fbcon: Taking over console\n" );dummycon_unregister_output_notifier (&fbcon_output_nb); - deferred_takeover = false; - logo_shown =FBCON_LOGO_DONTSHOW ;/* We may get called in atomic context */ schedule_work (&fbcon_deferred_takeover_work);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 33/452 x86/platform/uv: Update TSC sync state for UV5
In reply to Greg Kroah-HartmanFrom: Mike Travis <[email protected]>
[ Upstream commit bb3ab81bdbd53f88f26ffabc9fb15bd8466486ec ]
The UV5 platform synchronizes the TSCs among all chassis, and will not proceed to OS boot without achieving synchronization. Previous UV platforms provided a register indicating successful synchronization. This is no longer available on UV5. On this platform TSC_ADJUST should not be reset by the kernel.
--- arch/x86/kernel/apic/x2apic_uv_x.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/x86/kernel/apic/x2apic_uv_x.c +7 -1
@@ -199,7 +199,13 @@ static void __init uv_tsc_check_sync(void)int mmr_shift;char *state; -/* Different returns from different UV BIOS versions */ +/* UV5 guarantees synced TSCs; do not zero TSC_ADJUST */ +if (!is_uv (UV2 |UV3 |UV4 )) { +mark_tsc_async_resets ("UV5+" ); +return ; + } + +/* UV2,3,4, UV BIOS TSC sync state available */ mmr =uv_early_read_mmr (UVH_TSC_SYNC_MMR ); mmr_shift =is_uv2_hub () ?UVH_TSC_SYNC_SHIFT_UV2K :UVH_TSC_SYNC_SHIFT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 34/452 ACPICA: Avoid cache flush inside virtual machines
In reply to Greg Kroah-HartmanFrom: Kirill A. Shutemov <[email protected]>
[ Upstream commit e2efb6359e620521d1e13f69b2257de8ceaa9475 ]
While running inside virtual machine, the kernel can bypass cache flushing. Changing sleep state in a virtual machine doesn't affect the host system sleep state and cannot lead to data loss.
Before entering sleep states, the ACPI code flushes caches to prevent data loss using the WBINVD instruction. This mechanism is required on bare metal.
But, any use WBINVD inside of a guest is worthless. Changing sleep state in a virtual machine doesn't affect the host system sleep state and cannot lead to data loss, so most hypervisors simply ignore it. Despite this, the ACPI code calls WBINVD unconditionally anyway. It's useless, but also normally harmless.
In TDX guests, though, WBINVD stops being harmless; it triggers a virtualization exception (#VE). If the ACPI cache-flushing WBINVD were left in place, TDX guests would need handling to recover from the exception.
Avoid using WBINVD whenever running under a hypervisor. This both removes the useless WBINVDs and saves TDX from implementing WBINVD handling.
--- arch/x86/include/asm/acenv.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/x86/include/asm/acenv.h +13 -1
@@ -13,7 +13,19 @@/* Asm macros */ -#define ACPI_FLUSH_CPU_CACHE () wbinvd() +/* +* ACPI_FLUSH_CPU_CACHE() flushes caches on entering sleep states. +* It is required to prevent data loss. +* +* While running inside virtual machine, the kernel can bypass cache flushing. +* Changing sleep state in a virtual machine doesn't affect the host system +* sleep state and cannot lead to data loss. +*/ +#define ACPI_FLUSH_CPU_CACHE () \ +do { \ + if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) \ + wbinvd(); \ +} while (0)int __acpi_acquire_global_lock (unsigned int *lock);int __acpi_release_global_lock (unsigned int *lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 35/452 drm/komeda: return early if drm_universal_plane_init() fails.
In reply to Greg Kroah-HartmanFrom: Liviu Dudau <[email protected]>
[ Upstream commit c8f76c37cc3668ee45e081e76a15f24a352ebbdd ]
If drm_universal_plane_init() fails early we jump to the common cleanup code that calls komeda_plane_destroy() which in turn could access the uninitalised drm_plane and crash. Return early if an error is detected without going through the common code.
--- drivers/gpu/drm/arm/display/komeda/komeda_plane.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/arm/display/komeda/komeda_plane.c +4 -2
@@ -274,8 +274,10 @@ static int komeda_plane_add(struct komeda_kms_dev *kms,komeda_put_fourcc_list (formats); -if (err) - goto cleanup; +if (err) { +kfree (kplane); +return err; + }drm_plane_helper_add (plane, &komeda_plane_helper_funcs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 36/452 rcu-tasks: Fix race in schedule and flush work
In reply to Greg Kroah-HartmanFrom: Padmanabha Srinivasaiah <[email protected]>
[ Upstream commit f75fd4b9221d93177c50dcfde671b2e907f53e86 ]
While booting secondary CPUs, cpus_read_[lock/unlock] is not keeping online cpumask stable. The transient online mask results in below calltrace.
[ 0.324121] CPU1: Booted secondary processor 0x0000000001 [0x410fd083] [ 0.346652] Detected PIPT I-cache on CPU2 [ 0.347212] CPU2: Booted secondary processor 0x0000000002 [0x410fd083] [ 0.377255] Detected PIPT I-cache on CPU3 [ 0.377823] CPU3: Booted secondary processor 0x0000000003 [0x410fd083] [ 0.379040] ------------[ cut here ]------------ [ 0.383662] WARNING: CPU: 0 PID: 10 at kernel/workqueue.c:3084 __flush_work+0x12c/0x138 [ 0.384850] Modules linked in: [ 0.385403] CPU: 0 PID: 10 Comm: rcu_tasks_rude_ Not tainted 5.17.0-rc3-v8+ #13 [ 0.386473] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 0.387289] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.388308] pc : __flush_work+0x12c/0x138 [ 0.388970] lr : __flush_work+0x80/0x138 [ 0.389620] sp : ffffffc00aaf3c60 [ 0.390139] x29: ffffffc00aaf3d20 x28: ffffffc009c16af0 x27: ffffff80f761df48 [ 0.391316] x26: 0000000000000004 x25: 0000000000000003 x24: 0000000000000100 [ 0.392493] x23: ffffffffffffffff x22: ffffffc009c16b10 x21: ffffffc009c16b28 [ 0.393668] x20: ffffffc009e53861 x19: ffffff80f77fbf40 x18: 00000000d744fcc9 [ 0.394842] x17: 000000000000000b x16: 00000000000001c2 x15: ffffffc009e57550 [ 0.396016] x14: 0000000000000000 x13: ffffffffffffffff x12: 0000000100000000 [ 0.397190] x11: 0000000000000462 x10: ffffff8040258008 x9 : 0000000100000000 [ 0.398364] x8 : 0000000000000000 x7 : ffffffc0093c8bf4 x6 : 0000000000000000 [ 0.399538] x5 : 0000000000000000 x4 : ffffffc00a976e40 x3 : ffffffc00810444c [ 0.400711] x2 : 0000000000000004 x1 : 0000000000000000 x0 : 0000000000000000 [ 0.401886] Call trace: [ 0.402309] __flush_work+0x12c/0x138 [ 0.402941] schedule_on_each_cpu+0x228/0x278 [ 0.403693] rcu_tasks_rude_wait_gp+0x130/0x144 [ 0.404502] rcu_tasks_kthread+0x220/0x254 [ 0.405264] kthread+0x174/0x1ac [ 0.405837] ret_from_fork+0x10/0x20 [ 0.406456] irq event stamp: 102 [ 0.406966] hardirqs last enabled at (101): [<ffffffc0093c8468>] _raw_spin_unlock_irq+0x78/0xb4 [ 0.408304] hardirqs last disabled at (102): [<ffffffc0093b8270>] el1_dbg+0x24/0x5c [ 0.409410] softirqs last enabled at (54): [<ffffffc0081b80c8>] local_bh_enable+0xc/0x2c [ 0.410645] softirqs last disabled at (50): [<ffffffc0081b809c>] local_bh_disable+0xc/0x2c [ 0.411890] ---[ end trace 0000000000000000 ]--- [ 0.413000] smp: Brought up 1 node, 4 CPUs [ 0.413762] SMP: Total of 4 processors activated. [ 0.414566] CPU features: detected: 32-bit EL0 Support [ 0.415414] CPU features: detected: 32-bit EL1 Support [ 0.416278] CPU features: detected: CRC32 instructions [ 0.447021] Callback from call_rcu_tasks_rude() invoked. [ 0.506693] Callback from call_rcu_tasks() invoked.
This commit therefore fixes this issue by applying a single-CPU optimization to the RCU Tasks Rude grace-period process. The key point here is that the purpose of this RCU flavor is to force a schedule on each online CPU since some past event. But the rcu_tasks_rude_wait_gp() function runs in the context of the RCU Tasks Rude's grace-period kthread, so there must already have been a context switch on the current CPU since the call to either synchronize_rcu_tasks_rude() or call_rcu_tasks_rude(). So if there is only a single CPU online, RCU Tasks Rude's grace-period kthread does not need to anything at all.
It turns out that the rcu_tasks_rude_wait_gp() function's call to schedule_on_each_cpu() causes problems during early boot. During that time, there is only one online CPU, namely the boot CPU. Therefore, applying this single-CPU optimization fixes early-boot instances of this problem.
--- kernel/rcu/tasks.h | 3 +++ 1 file changed, 3 insertions(+)
kernel/rcu/tasks.h +3 -0
@@ -620,6 +620,9 @@ static void rcu_tasks_be_rude(struct work_struct *work)// Wait for one rude RCU-tasks grace period. static void rcu_tasks_rude_wait_gp (struct rcu_tasks *rtp) { +if (num_online_cpus () <=1 ) +return ;// Fastpath for only one CPU. + rtp->n_ipis +=cpumask_weight (cpu_online_mask);schedule_on_each_cpu (rcu_tasks_be_rude); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 37/452 rcu: Make TASKS_RUDE_RCU select IRQ_WORK
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
[ Upstream commit 46e861be589881e0905b9ade3d8439883858721c ]
The TASKS_RUDE_RCU does not select IRQ_WORK, which can result in build failures for kernels that do not otherwise select IRQ_WORK. This commit therefore causes the TASKS_RUDE_RCU Kconfig option to select IRQ_WORK.
--- kernel/rcu/Kconfig | 1 + 1 file changed, 1 insertion(+)
kernel/rcu/Kconfig +1 -0
@@ -86,6 +86,7 @@ config TASKS_RCU config TASKS_RUDE_RCU def_bool 0 + select IRQ_WORK help This option enables a task-based RCU implementation that uses only context switch (including preemption) and user-mode
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 38/452 sfc: ef10: Fix assigning negative value to unsigned variable
In reply to Greg Kroah-HartmanFrom: Haowen Bai <[email protected]>
[ Upstream commit b8ff3395fbdf3b79a99d0ef410fc34c51044121e ]
fix warning reported by smatch:
251 drivers/net/ethernet/sfc/ef10.c:2259 efx_ef10_tx_tso_desc()
warn: assigning (-208) to unsigned variable 'ip_tot_len'
--- drivers/net/ethernet/sfc/ef10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/sfc/ef10.c +1 -1
@@ -2240,7 +2240,7 @@ int efx_ef10_tx_tso_desc(struct efx_tx_queue *tx_queue, struct sk_buff *skb,* guaranteed to satisfy the second as we only attempt TSO if * inner_network_header <= 208. */ - ip_tot_len = -EFX_TSO2_MAX_HDRLEN ; + ip_tot_len =0x10000 -EFX_TSO2_MAX_HDRLEN ;EFX_WARN_ON_ONCE_PARANOID (mss +EFX_TSO2_MAX_HDRLEN + (tcp->doff <<2u ) > ip_tot_len);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 39/452 ALSA: jack: Access input_dev under mutex
In reply to Greg Kroah-HartmanFrom: Amadeusz Sławiński <[email protected]>
[ Upstream commit 1b6a6fc5280e97559287b61eade2d4b363e836f2 ]
It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to prevent this serialize access to input_dev using mutex lock.
--- include/sound/jack.h | 1 + sound/core/jack.c | 34 +++++++++++++++++++++++++++------- 2 files changed, 28 insertions(+), 7 deletions(-)
include/sound/jack.h +1 -0
@@ -62,6 +62,7 @@ struct snd_jack {const char *id;#ifdef CONFIG_SND_JACK_INPUT_DEV struct input_dev *input_dev; +struct mutex input_dev_lock;int registered;int type;char name[100 ];
sound/core/jack.c +27 -7
@@ -34,8 +34,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device)#ifdef CONFIG_SND_JACK_INPUT_DEV struct snd_jack *jack = device->device_data; -if (!jack->input_dev) +mutex_lock (&jack->input_dev_lock); +if (!jack->input_dev) { +mutex_unlock (&jack->input_dev_lock);return 0 ; + }/* If the input device is registered with the input subsystem * then we need to use a different deallocator. */
@@ -44,6 +47,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device) else input_free_device(jack->input_dev); jack->input_dev =NULL ; +mutex_unlock (&jack->input_dev_lock);#endif /* CONFIG_SND_JACK_INPUT_DEV */ return 0 ; }
@@ -82,8 +86,11 @@ static int snd_jack_dev_register(struct snd_device *device)snprintf (jack->name,sizeof (jack->name),"%s %s" , card->shortname, jack->id); -if (!jack->input_dev) +mutex_lock (&jack->input_dev_lock); +if (!jack->input_dev) { +mutex_unlock (&jack->input_dev_lock);return 0 ; + } jack->input_dev->name = jack->name;
@@ -108,6 +115,7 @@ static int snd_jack_dev_register(struct snd_device *device)if (err ==0 ) jack->registered =1 ; +mutex_unlock (&jack->input_dev_lock); return err; }#endif /* CONFIG_SND_JACK_INPUT_DEV */
@@ -228,9 +236,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,return -ENOMEM ; } -/* don't creat input device for phantom jack */ -if (!phantom_jack) {#ifdef CONFIG_SND_JACK_INPUT_DEV +mutex_init (&jack->input_dev_lock); + +/* don't create input device for phantom jack */ +if (!phantom_jack) {int i; jack->input_dev =input_allocate_device ();
@@ -248,8 +258,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,input_set_capability (jack->input_dev,EV_SW , jack_switch_types[i]); -#endif /* CONFIG_SND_JACK_INPUT_DEV */ } +#endif /* CONFIG_SND_JACK_INPUT_DEV */ err =snd_device_new (card,SNDRV_DEV_JACK , jack, &ops);if (err <0 )
@@ -289,10 +299,14 @@ EXPORT_SYMBOL(snd_jack_new);void snd_jack_set_parent (struct snd_jack *jack,struct device *parent) {WARN_ON (jack->registered); -if (!jack->input_dev) +mutex_lock (&jack->input_dev_lock); +if (!jack->input_dev) { +mutex_unlock (&jack->input_dev_lock);return ; + } jack->input_dev->dev.parent = parent; +mutex_unlock (&jack->input_dev_lock); }EXPORT_SYMBOL (snd_jack_set_parent);
@@ -340,6 +354,8 @@ EXPORT_SYMBOL(snd_jack_set_key);/** * snd_jack_report - Report the current status of a jack +* Note: This function uses mutexes and should be called from a +* context which can sleep (such as a workqueue). * * @jack: The jack to report status for * @status: The current status of the jack
@@ -359,8 +375,11 @@ void snd_jack_report(struct snd_jack *jack, int status) status & jack_kctl->mask_bits);#ifdef CONFIG_SND_JACK_INPUT_DEV -if (!jack->input_dev) +mutex_lock (&jack->input_dev_lock); +if (!jack->input_dev) { +mutex_unlock (&jack->input_dev_lock);return ; + }for (i =0 ; i <ARRAY_SIZE (jack->key); i++) {int testbit =SND_JACK_BTN_0 >> i;
@@ -379,6 +398,7 @@ void snd_jack_report(struct snd_jack *jack, int status) }input_sync (jack->input_dev); +mutex_unlock (&jack->input_dev_lock);#endif /* CONFIG_SND_JACK_INPUT_DEV */ }EXPORT_SYMBOL (snd_jack_report);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 40/452 spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit 6f381481a5b236cb53d6de2c49c6ef83a4d0f432 ]
The direction field in the DMA config is deprecated. The rspi driver sets {src,dst}_{addr,addr_width} based on the DMA direction and it results in dmaengine_slave_config() failure as RZ DMAC driver validates {src,dst}_addr_width values independent of DMA direction.
This patch fixes the issue by passing both {src,dst}_{addr,addr_width} values independent of DMA direction.
--- drivers/spi/spi-rspi.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/spi/spi-rspi.c +6 -9
@@ -1107,14 +1107,11 @@ static struct dma_chan *rspi_request_dma_chan(struct device *dev, }memset (&cfg,0 ,sizeof (cfg)); + cfg.dst_addr = port_addr +RSPI_SPDR ; + cfg.src_addr = port_addr +RSPI_SPDR ; + cfg.dst_addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE ; + cfg.src_addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE ; cfg.direction = dir; -if (dir ==DMA_MEM_TO_DEV ) { - cfg.dst_addr = port_addr; - cfg.dst_addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE ; - }else { - cfg.src_addr = port_addr; - cfg.src_addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE ; - } ret =dmaengine_slave_config (chan, &cfg);if (ret) {
@@ -1145,12 +1142,12 @@ static int rspi_request_dma(struct device *dev, struct spi_controller *ctlr, } ctlr->dma_tx =rspi_request_dma_chan (dev,DMA_MEM_TO_DEV , dma_tx_id, - res->start +RSPI_SPDR ); + res->start);if (!ctlr->dma_tx)return -ENODEV ; ctlr->dma_rx =rspi_request_dma_chan (dev,DMA_DEV_TO_MEM , dma_rx_id, - res->start +RSPI_SPDR ); + res->start);if (!ctlr->dma_rx) {dma_release_channel (ctlr->dma_tx); ctlr->dma_tx =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 41/452 tools/power turbostat: fix ICX DRAM power numbers
In reply to Greg Kroah-HartmanFrom: Len Brown <[email protected]>
[ Upstream commit 6397b6418935773a34b533b3348b03f4ce3d7050 ]
ICX (and its duplicates) require special hard-coded DRAM RAPL units, rather than using the generic RAPL energy units.
--- tools/power/x86/turbostat/turbostat.c | 1 + 1 file changed, 1 insertion(+)
tools/power/x86/turbostat/turbostat.c +1 -0
@@ -4189,6 +4189,7 @@ rapl_dram_energy_units_probe(int model, double rapl_energy_units)case INTEL_FAM6_HASWELL_X :/* HSX */ case INTEL_FAM6_BROADWELL_X :/* BDX */ case INTEL_FAM6_XEON_PHI_KNL :/* KNL */ +case INTEL_FAM6_ICELAKE_X :/* ICX */ return (rapl_dram_energy_units =15.3 /1000000 );default :return (rapl_energy_units);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 42/452 drm/amd/pm: fix double free in si_parse_power_table()
In reply to Greg Kroah-HartmanFrom: Keita Suzuki <[email protected]>
[ Upstream commit f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd ]
In function si_parse_power_table(), array adev->pm.dpm.ps and its member is allocated. If the allocation of each member fails, the array itself is freed and returned with an error code. However, the array is later freed again in si_dpm_fini() function which is called when the function returns an error.
This leads to potential double free of the array adev->pm.dpm.ps, as well as leak of its array members, since the members are not freed in the allocation function and the array is not nulled when freed. In addition adev->pm.dpm.num_ps, which keeps track of the allocated array member, is not updated until the member allocation is successfully finished, this could also lead to either use after free, or uninitialized variable access in si_dpm_fini().
Fix this by postponing the free of the array until si_dpm_fini() and increment adev->pm.dpm.num_ps everytime the array member is allocated.
--- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +3 -5
@@ -7250,17 +7250,15 @@ static int si_parse_power_table(struct amdgpu_device *adev)if (!adev->pm.dpm.ps)return -ENOMEM ; power_state_offset = (u8 *)state_array->states; -for (i =0 ; i < state_array->ucNumEntries; i++) { +for (adev->pm.dpm.num_ps =0 , i =0 ; i < state_array->ucNumEntries; i++) {u8 *idx; power_state = (union pplib_power_state *)power_state_offset; non_clock_array_index = power_state->v2.nonClockInfoIndex; non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; ps =kzalloc (sizeof (struct si_ps ),GFP_KERNEL ); -if (ps ==NULL ) { -kfree (adev->pm.dpm.ps); +if (ps ==NULL )return -ENOMEM ; - } adev->pm.dpm.ps[i].ps_priv = ps; si_parse_pplib_non_clock_info(adev, &adev->pm.dpm.ps[i], non_clock_info,
@@ -7282,8 +7280,8 @@ static int si_parse_power_table(struct amdgpu_device *adev) k++; } power_state_offset +=2 + power_state->v2.ucNumDPMLevels; + adev->pm.dpm.num_ps++; } - adev->pm.dpm.num_ps = state_array->ucNumEntries;/* fill in the vce power states */ for (i =0 ; i < adev->pm.dpm.num_of_vce_states; i++) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 43/452 ath9k: fix QCA9561 PA bias level
In reply to Greg Kroah-HartmanFrom: Thibaut VARÈNE <[email protected]>
[ Upstream commit e999a5da28a0e0f7de242d841ef7d5e48f4646ae ]
This patch fixes an invalid TX PA DC bias level on QCA9561, which results in a very low output power and very low throughput as devices are further away from the AP (compared to other 2.4GHz APs).
This patch was suggested by Felix Fietkau, who noted[1]:
"The value written to that register is wrong, because while the mask definition AR_CH0_TOP2_XPABIASLVL uses a different value for 9561, the shift definition AR_CH0_TOP2_XPABIASLVL_S is hardcoded to 12, which is wrong for 9561."
In real life testing, without this patch the 2.4GHz throughput on Yuncore XD3200 is around 10Mbps sitting next to the AP, and closer to practical maximum with the patch applied.
[1] https://lore.kernel.org/all/[email protected]
--- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/ar9003_phy.h +1 -1
@@ -720,7 +720,7 @@#define AR_CH0_TOP2 (AR_SREV_9300(ah) ? 0x1628c : \ (AR_SREV_9462(ah) ? 0x16290 : 0x16284))#define AR_CH0_TOP2_XPABIASLVL (AR_SREV_9561(ah) ? 0x1e00 : 0xf000) -#define AR_CH0_TOP2_XPABIASLVL_S 12 +#define AR_CH0_TOP2_XPABIASLVL_S (AR_SREV_9561(ah) ? 9 : 12)#define AR_CH0_XTAL (AR_SREV_9300(ah) ? 0x16294 : \ ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 44/452 media: venus: hfi: avoid null dereference in deinit
In reply to Greg Kroah-HartmanFrom: Luca Weiss <[email protected]>
[ Upstream commit 86594f6af867b5165d2ba7b5a71fae3a5961e56c ]
If venus_probe fails at pm_runtime_put_sync the error handling first calls hfi_destroy and afterwards hfi_core_deinit. As hfi_destroy sets core->ops to NULL, hfi_core_deinit cannot call the core_deinit function anymore.
Avoid this null pointer derefence by skipping the call when necessary.
--- drivers/media/platform/qcom/venus/hfi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/platform/qcom/venus/hfi.c +3 -0
@@ -104,6 +104,9 @@ int hfi_core_deinit(struct venus_core *core, bool blocking)mutex_lock (&core->lock); } +if (!core->ops) + goto unlock; + ret = core->ops->core_deinit (core);if (!ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 45/452 media: pci: cx23885: Fix the error handling in cx23885_initdev()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit e8123311cf06d7dae71e8c5fe78e0510d20cd30b ]
When the driver fails to call the dma_set_mask(), the driver will get the following splat:
[ 55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240 [ 55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590 [ 55.856822] Call Trace: [ 55.860327] __process_removed_driver+0x3c/0x240 [ 55.861347] bus_for_each_dev+0x102/0x160 [ 55.861681] i2c_del_driver+0x2f/0x50
This is because the driver has initialized the i2c related resources in cx23885_dev_setup() but not released them in error handling, fix this bug by modifying the error path that jumps after failing to call the dma_set_mask().
--- drivers/media/pci/cx23885/cx23885-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/pci/cx23885/cx23885-core.c +3 -3
@@ -2154,7 +2154,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev, err =pci_set_dma_mask (pci_dev,0xffffffff );if (err) {pr_err ("%s/0: Oops: no 32bit PCI DMA ???\n" , dev->name); - goto fail_ctrl; + goto fail_dma_set_mask; } err = request_irq(pci_dev->irq, cx23885_irq,
@@ -2162,7 +2162,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev,if (err <0 ) {pr_err ("%s: can't get IRQ %d\n" , dev->name, pci_dev->irq); - goto fail_irq; + goto fail_dma_set_mask; }switch (dev->board) {
@@ -2184,7 +2184,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev,return 0 ; -fail_irq: +fail_dma_set_mask:cx23885_dev_unregister (dev); fail_ctrl:v4l2_ctrl_handler_free (hdl);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 46/452 media: cx25821: Fix the warning when removing the module
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 2203436a4d24302871617373a7eb21bc17e38762 ]
When removing the module, we will get the following warning:
[ 14.746697] remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'cx25821[1]' [ 14.747449] WARNING: CPU: 4 PID: 368 at fs/proc/generic.c:717 remove_proc_entry+0x389/0x3f0 [ 14.751611] RIP: 0010:remove_proc_entry+0x389/0x3f0 [ 14.759589] Call Trace: [ 14.759792] <TASK> [ 14.759975] unregister_irq_proc+0x14c/0x170 [ 14.760340] irq_free_descs+0x94/0xe0 [ 14.760640] mp_unmap_irq+0xb6/0x100 [ 14.760937] acpi_unregister_gsi_ioapic+0x27/0x40 [ 14.761334] acpi_pci_irq_disable+0x1d3/0x320 [ 14.761688] pci_disable_device+0x1ad/0x380 [ 14.762027] ? _raw_spin_unlock_irqrestore+0x2d/0x60 [ 14.762442] ? cx25821_shutdown+0x20/0x9f0 [cx25821] [ 14.762848] cx25821_finidev+0x48/0xc0 [cx25821] [ 14.763242] pci_device_remove+0x92/0x240
Fix this by freeing the irq before call pci_disable_device().
--- drivers/media/pci/cx25821/cx25821-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/cx25821/cx25821-core.c +1 -1
@@ -1340,11 +1340,11 @@ static void cx25821_finidev(struct pci_dev *pci_dev)struct cx25821_dev *dev =get_cx25821 (v4l2_dev);cx25821_shutdown (dev); -pci_disable_device (pci_dev);/* unregister stuff */ if (pci_dev->irq)free_irq (pci_dev->irq, dev); +pci_disable_device (pci_dev);cx25821_dev_unregister (dev);v4l2_device_unregister (v4l2_dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 47/452 md/bitmap: dont set sb values if cant pass sanity check
In reply to Greg Kroah-HartmanFrom: Heming Zhao <[email protected]>
[ Upstream commit e68cb83a57a458b01c9739e2ad9cb70b04d1e6d2 ]
If bitmap area contains invalid data, kernel will crash then mdadm triggers "Segmentation fault".
This is cluster-md speical bug. In non-clustered env, mdadm will handle broken metadata case. In clustered array, only kernel space handles bitmap slot info. But even this bug only happened in clustered env, current sanity check is wrong, the code should be changed.
How to trigger: (faulty injection)
dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda
dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb mdadm -Ss
echo aaa > magic.txt
== below modifying slot 2 bitmap data ==
dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize mdadm -A /dev/md0 /dev/sda /dev/sdb
== kernel crashes. mdadm outputs "Segmentation fault" ==
Reason of kernel crash:
In md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn't block chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T() trigger "divide error".
Crash log:
kernel: md: md0 stopped. kernel: md/raid1:md0: not clean -- starting background reconstruction kernel: md/raid1:md0: active with 2 out of 2 mirrors kernel: dlm: ... ... kernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1 kernel: md0: invalid bitmap file superblock: bad magic kernel: md_bitmap_copy_from_slot can't get bitmap from slot 2 kernel: md-cluster: Could not gather bitmaps from slot 2 kernel: divide error: 0000 [#1] SMP NOPTI kernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod] kernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246 kernel: ... ... kernel: Call Trace: kernel: ? dlm_lock_sync+0xd0/0xd0 [md_cluster 77fe..7a0] kernel: md_bitmap_copy_from_slot+0x2c/0x290 [md_mod 24ea..d3a] kernel: load_bitmaps+0xec/0x210 [md_cluster 77fe..7a0] kernel: md_bitmap_load+0x81/0x1e0 [md_mod 24ea..d3a] kernel: do_md_run+0x30/0x100 [md_mod 24ea..d3a] kernel: md_ioctl+0x1290/0x15a0 [md_mod 24ea....d3a] kernel: ? mddev_unlock+0xaa/0x130 [md_mod 24ea..d3a] kernel: ? blkdev_ioctl+0xb1/0x2b0 kernel: block_ioctl+0x3b/0x40 kernel: __x64_sys_ioctl+0x7f/0xb0 kernel: do_syscall_64+0x59/0x80 kernel: ? exit_to_user_mode_prepare+0x1ab/0x230 kernel: ? syscall_exit_to_user_mode+0x18/0x40 kernel: ? do_syscall_64+0x69/0x80 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae kernel: RIP: 0033:0x7f4a15fa722b kernel: ... ... kernel: ---[ end trace 8afa7612f559c868 ]--- kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod]
--- drivers/md/md-bitmap.c | 44 ++++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 21 deletions(-)
drivers/md/md-bitmap.c +23 -21
@@ -639,14 +639,6 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) daemon_sleep =le32_to_cpu (sb->daemon_sleep) *HZ ; write_behind =le32_to_cpu (sb->write_behind); sectors_reserved =le32_to_cpu (sb->sectors_reserved); -/* Setup nodes/clustername only if bitmap version is -* cluster-compatible -*/ -if (sb->version ==cpu_to_le32 (BITMAP_MAJOR_CLUSTERED )) { - nodes =le32_to_cpu (sb->nodes); -strlcpy (bitmap->mddev->bitmap_info.cluster_name, - sb->cluster_name,64 ); - }/* verify that the bitmap-specific fields are valid */ if (sb->magic !=cpu_to_le32 (BITMAP_MAGIC ))
@@ -668,6 +660,16 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) goto out; } +/* +* Setup nodes/clustername only if bitmap version is +* cluster-compatible +*/ +if (sb->version ==cpu_to_le32 (BITMAP_MAJOR_CLUSTERED )) { + nodes =le32_to_cpu (sb->nodes); +strlcpy (bitmap->mddev->bitmap_info.cluster_name, + sb->cluster_name,64 ); + } +/* keep the array size field of the bitmap superblock up to date */ sb->sync_size =cpu_to_le64 (bitmap->mddev->resync_max_sectors);
@@ -700,9 +702,9 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) out:kunmap_atomic (sb); -/* Assigning chunksize is required for "re_read" */ - bitmap->mddev->bitmap_info.chunksize = chunksize;if (err ==0 && nodes && (bitmap->cluster_slot <0 )) { +/* Assigning chunksize is required for "re_read" */ + bitmap->mddev->bitmap_info.chunksize = chunksize; err =md_setup_cluster (bitmap->mddev, nodes);if (err) { pr_warn("%s: Could not setup cluster service (%d)\n",
@@ -713,18 +715,18 @@ static int md_bitmap_read_sb(struct bitmap *bitmap) goto re_read; } - out_no_sb: -if (test_bit (BITMAP_STALE , &bitmap->flags)) - bitmap->events_cleared = bitmap->mddev->events; - bitmap->mddev->bitmap_info.chunksize = chunksize; - bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep; - bitmap->mddev->bitmap_info.max_write_behind = write_behind; - bitmap->mddev->bitmap_info.nodes = nodes; -if (bitmap->mddev->bitmap_info.space ==0 || - bitmap->mddev->bitmap_info.space > sectors_reserved) - bitmap->mddev->bitmap_info.space = sectors_reserved; -if (err) { +if (err ==0 ) { +if (test_bit (BITMAP_STALE , &bitmap->flags)) + bitmap->events_cleared = bitmap->mddev->events; + bitmap->mddev->bitmap_info.chunksize = chunksize; + bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep; + bitmap->mddev->bitmap_info.max_write_behind = write_behind; + bitmap->mddev->bitmap_info.nodes = nodes; +if (bitmap->mddev->bitmap_info.space ==0 || + bitmap->mddev->bitmap_info.space > sectors_reserved) + bitmap->mddev->bitmap_info.space = sectors_reserved; + }else {md_bitmap_print_sb (bitmap);if (bitmap->cluster_slot <0 )md_cluster_stop (bitmap->mddev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 48/452 mmc: jz4740: Apply DMA engine limits to maximum segment size
In reply to Greg Kroah-HartmanFrom: Aidan MacDonald <[email protected]>
[ Upstream commit afadb04f1d6e74b18a253403f5274cde5e3fd7bd ]
Do what is done in other DMA-enabled MMC host drivers (cf. host/mmci.c) and limit the maximum segment size based on the DMA engine's capabilities. This is needed to avoid warnings like the following with CONFIG_DMA_API_DEBUG=y.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 21 at kernel/dma/debug.c:1162 debug_dma_map_sg+0x2f4/0x39c
DMA-API: jz4780-dma 13420000.dma-controller: mapping sg segment longer than device claims to support [len=98304] [max=65536]
CPU: 0 PID: 21 Comm: kworker/0:1H Not tainted 5.18.0-rc1 #19
Workqueue: kblockd blk_mq_run_work_fn
Stack : 81575aec 00000004 80620000 80620000 80620000 805e7358 00000009 801537ac
814c832c 806276e3 806e34b4 80620000 81575aec 00000001 81575ab8 09291444
00000000 00000000 805e7358 81575958 ffffffea 8157596c 00000000 636f6c62
6220646b 80387a70 0000000f 6d5f6b6c 80620000 00000000 81575ba4 00000009
805e170c 80896640 00000001 00010000 00000000 00000000 00006098 806e0000
...
Call Trace:
[<80107670>] show_stack+0x84/0x120
[<80528cd8>] __warn+0xb8/0xec
[<80528d78>] warn_slowpath_fmt+0x6c/0xb8
[<8016f1d4>] debug_dma_map_sg+0x2f4/0x39c
[<80169d4c>] __dma_map_sg_attrs+0xf0/0x118
[<8016a27c>] dma_map_sg_attrs+0x14/0x28
[<804f66b4>] jz4740_mmc_prepare_dma_data+0x74/0xa4
[<804f6714>] jz4740_mmc_pre_request+0x30/0x54
[<804f4ff4>] mmc_blk_mq_issue_rq+0x6e0/0x7bc
[<804f5590>] mmc_mq_queue_rq+0x220/0x2d4
[<8038b2c0>] blk_mq_dispatch_rq_list+0x480/0x664
[<80391040>] blk_mq_do_dispatch_sched+0x2dc/0x370
[<80391468>] __blk_mq_sched_dispatch_requests+0xec/0x164
[<80391540>] blk_mq_sched_dispatch_requests+0x44/0x94
[<80387900>] __blk_mq_run_hw_queue+0xb0/0xcc
[<80134c14>] process_one_work+0x1b8/0x264
[<80134ff8>] worker_thread+0x2ec/0x3b8
[<8013b13c>] kthread+0x104/0x10c
[<80101dcc>] ret_from_kernel_thread+0x14/0x1c
---[ end trace 0000000000000000 ]------ drivers/mmc/host/jz4740_mmc.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/mmc/host/jz4740_mmc.c +20 -0
@@ -236,6 +236,26 @@ static int jz4740_mmc_acquire_dma_channels(struct jz4740_mmc_host *host)return PTR_ERR (host->dma_rx); } +/* +* Limit the maximum segment size in any SG entry according to +* the parameters of the DMA engine device. +*/ +if (host->dma_tx) { +struct device *dev = host->dma_tx->device->dev; +unsigned int max_seg_size =dma_get_max_seg_size (dev); + +if (max_seg_size < host->mmc->max_seg_size) + host->mmc->max_seg_size = max_seg_size; + } + +if (host->dma_rx) { +struct device *dev = host->dma_rx->device->dev; +unsigned int max_seg_size =dma_get_max_seg_size (dev); + +if (max_seg_size < host->mmc->max_seg_size) + host->mmc->max_seg_size = max_seg_size; + } +return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 49/452 drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit
In reply to Greg Kroah-HartmanFrom: Vignesh Raghavendra <[email protected]>
[ Upstream commit c7666240ec76422cb7546bd07cc8ae80dc0ccdd2 ]
The ARASAN MMC controller on Keystone 3 class of devices need the SDCD line to be connected for proper functioning. Similar to the issue pointed out in sdhci-of-arasan.c driver, commit 3794c542641f ("mmc:
sdhci-of-arasan: Set controller to test mode when no CD bit").
In cases where this can't be connected, add a quirk to force the controller into test mode and set the TESTCD bit. Use the flag "ti,fails-without-test-cd", to implement this above quirk when required.
--- drivers/mmc/host/sdhci_am654.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci_am654.c +22 -1
@@ -147,6 +147,9 @@ struct sdhci_am654_data {int drv_strength;int strb_sel;u32 flags; +u32 quirks; + +#define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) };struct sdhci_am654_driver_data {
@@ -369,6 +372,21 @@ static void sdhci_am654_write_b(struct sdhci_host *host, u8 val, int reg) } } +static void sdhci_am654_reset (struct sdhci_host *host,u8 mask) +{ +u8 ctrl; +struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host); +struct sdhci_am654_data *sdhci_am654 =sdhci_pltfm_priv (pltfm_host); + +sdhci_reset (host, mask); + +if (sdhci_am654->quirks &SDHCI_AM654_QUIRK_FORCE_CDTEST ) { + ctrl =sdhci_readb (host,SDHCI_HOST_CONTROL ); + ctrl |=SDHCI_CTRL_CDTEST_INS |SDHCI_CTRL_CDTEST_EN ; +sdhci_writeb (host, ctrl,SDHCI_HOST_CONTROL ); + } +} +static int sdhci_am654_execute_tuning (struct mmc_host *mmc,u32 opcode) {struct sdhci_host *host =mmc_priv (mmc);
@@ -500,7 +518,7 @@ static struct sdhci_ops sdhci_j721e_4bit_ops = { .set_clock = sdhci_j721e_4bit_set_clock, .write_b = sdhci_am654_write_b, .irq = sdhci_am654_cqhci_irq, - .reset = sdhci_reset, + .reset = sdhci_am654_reset, };static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = {
@@ -719,6 +737,9 @@ static int sdhci_am654_get_of_property(struct platform_device *pdev,device_property_read_u32 (dev,"ti,clkbuf-sel" , &sdhci_am654->clkbuf_sel); +if (device_property_read_bool (dev,"ti,fails-without-test-cd" )) + sdhci_am654->quirks |=SDHCI_AM654_QUIRK_FORCE_CDTEST ; +sdhci_get_of_property (pdev);return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 50/452 scsi: megaraid: Fix error check return value of register_chrdev()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit c5acd61dbb32b6bda0f3a354108f2b8dcb788985 ]
If major equals 0, register_chrdev() returns an error code when it fails. This function dynamically allocates a major and returns its number on success, so we should use "< 0" to check it instead of "!".
--- drivers/scsi/megaraid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/megaraid.c +1 -1
@@ -4634,7 +4634,7 @@ static int __init megaraid_init(void)* major number allocation. */ major =register_chrdev (0 ,"megadev_legacy" , &megadev_fops); -if (!major) { +if (major <0 ) {printk (KERN_WARNING "megaraid: failed to register char device\n" ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 51/452 scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
In reply to Greg Kroah-HartmanFrom: Minghao Chi <[email protected]>
[ Upstream commit 75b8715e20a20bc7b4844835e4035543a2674200 ]
Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync() and pm_runtime_put_noidle(). This change is just to simplify the code, no actual functional changes.
--- drivers/scsi/ufs/ti-j721e-ufs.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/scsi/ufs/ti-j721e-ufs.c +2 -4
@@ -29,11 +29,9 @@ static int ti_j721e_ufs_probe(struct platform_device *pdev)return PTR_ERR (regbase);pm_runtime_enable (dev); - ret =pm_runtime_get_sync (dev); -if (ret <0 ) { -pm_runtime_put_noidle (dev); + ret =pm_runtime_resume_and_get (dev); +if (ret <0 ) goto disable_pm; - }/* Select MPHY refclk frequency */ clk =devm_clk_get (dev,NULL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 52/452 scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 646db1a560f44236b7278b822ca99a1d3b6ea72c ]
If no handler is found in lpfc_complete_unsol_iocb() to match the rctl of a received frame, the frame is dropped and resources are leaked.
Fix by returning resources when discarding an unhandled frame type. Update lpfc_fc_frame_check() handling of NOP basic link service.
--- drivers/scsi/lpfc/lpfc_sli.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_sli.c +4 -2
@@ -17445,7 +17445,6 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)case FC_RCTL_ELS_REP :/* extended link services reply */ case FC_RCTL_ELS4_REQ :/* FC-4 ELS request */ case FC_RCTL_ELS4_REP :/* FC-4 ELS reply */ -case FC_RCTL_BA_NOP :/* basic link service NOP */ case FC_RCTL_BA_ABTS :/* basic link service abort */ case FC_RCTL_BA_RMC :/* remove connection */ case FC_RCTL_BA_ACC :/* basic accept */
@@ -17466,6 +17465,7 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr) fc_vft_hdr = (struct fc_vft_header *)fc_hdr; fc_hdr = &((struct fc_frame_header *)fc_vft_hdr)[1 ];return lpfc_fc_frame_check (phba, fc_hdr); +case FC_RCTL_BA_NOP :/* basic link service NOP */ default : goto drop; }
@@ -18284,12 +18284,14 @@ lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *vport,if (!lpfc_complete_unsol_iocb (phba, phba->sli4_hba.els_wq->pring, iocbq, fc_hdr->fh_r_ctl, - fc_hdr->fh_type)) + fc_hdr->fh_type)) {lpfc_printf_log (phba,KERN_ERR ,LOG_TRACE_EVENT ,"2540 Ring %d handler: unexpected Rctl " "x%x Type x%x received\n" ,LPFC_ELS_RING , fc_hdr->fh_r_ctl, fc_hdr->fh_type); +lpfc_in_buf_free (phba, &seq_dmabuf->dbuf); + }/* Free iocb created in lpfc_prep_seq */ list_for_each_entry_safe(curr_iocb, next_iocb,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 53/452 ath11k: disable spectral scan during spectral deinit
In reply to Greg Kroah-HartmanFrom: Hari Chandrakanthan <[email protected]>
[ Upstream commit 161c64de239c7018e0295e7e0520a19f00aa32dc ]
When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed. Different crash trace is observed for each crash.
Send spectral scan disable WMI command to firmware before cleaning the spectral dbring in the spectral_deinit API to avoid this crash.
call trace from one of the crash observed:
[ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 [ 1252.882722] pgd = 0f42e886 [ 1252.890955] [00000008] *pgd=00000000 [ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 [ 1253.115261] Hardware name: Generic DT based system [ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k] [ 1253.125940] LR is at 0x88e31017 [ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 [ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 [ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 [ 1253.146946] r7 : 94734040 r6 : a0000113 r5 : 00000057 r4 : 00000000 [ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 : 00000001 [ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 [ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) [ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k]) [ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k]) [ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k]) [ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k]) [ 1253.502386] [<7f91308c>] (ath11k_ce_per_engine_service [ath11k]) from [<7f9a4198>] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci]) [ 1253.514811] [<7f9a4198>] (ath11k_pci_ce_tasklet [ath11k_pci]) from [<8032227c>] (tasklet_action_common.constprop.2+0x64/0xe8) [ 1253.526476] [<8032227c>] (tasklet_action_common.constprop.2) from [<803021e8>] (__do_softirq+0x130/0x2d0) [ 1253.537756] [<803021e8>] (__do_softirq) from [<80322610>] (irq_exit+0xcc/0xe8) [ 1253.547304] [<80322610>] (irq_exit) from [<8036a4a4>] (__handle_domain_irq+0x60/0xb4) [ 1253.554428] [<8036a4a4>] (__handle_domain_irq) from [<805eb348>] (gic_handle_irq+0x4c/0x90) [ 1253.562321] [<805eb348>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)
Tested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/spectral.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/net/wireless/ath/ath11k/spectral.c +9 -8
@@ -214,7 +214,10 @@ static int ath11k_spectral_scan_config(struct ath11k *ar,return -ENODEV ; arvif->spectral_enabled = (mode !=ATH11K_SPECTRAL_DISABLED ); + +spin_lock_bh (&ar->spectral.lock); ar->spectral.mode = mode; +spin_unlock_bh (&ar->spectral.lock); ret = ath11k_wmi_vdev_spectral_enable(ar, arvif->vdev_id, ATH11K_WMI_SPECTRAL_TRIGGER_CMD_CLEAR,
@@ -829,9 +832,6 @@ static inline void ath11k_spectral_ring_free(struct ath11k *ar) {struct ath11k_spectral *sp = &ar->spectral; -if (!sp->enabled) -return ; -ath11k_dbring_srng_cleanup (ar, &sp->rx_ring);ath11k_dbring_buf_cleanup (ar, &sp->rx_ring); }
@@ -883,15 +883,16 @@ void ath11k_spectral_deinit(struct ath11k_base *ab)if (!sp->enabled)continue ; -ath11k_spectral_debug_unregister (ar); -ath11k_spectral_ring_free (ar); +mutex_lock (&ar->conf_mutex); +ath11k_spectral_scan_config (ar,ATH11K_SPECTRAL_DISABLED ); +mutex_unlock (&ar->conf_mutex);spin_lock_bh (&sp->lock); - - sp->mode =ATH11K_SPECTRAL_DISABLED ; sp->enabled = false; -spin_unlock_bh (&sp->lock); + +ath11k_spectral_debug_unregister (ar); +ath11k_spectral_ring_free (ar); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 54/452 ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit ce216cfa84a4e1c23b105e652c550bdeaac9e922 ]
Add a quirk for the HP Pro Tablet 408, this BYTCR tablet has no CHAN package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which is the default for BYTCR devices.
It also uses DMIC1 for the internal mic rather then the default IN3 and it uses JD2 rather then the default JD1 for jack-detect.
--- sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +12 -0
@@ -615,6 +615,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_OVCD_SF_0P75 | BYT_RT5640_MCLK_EN), }, + { /* HP Pro Tablet 408 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pro Tablet 408"), + }, + .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | +BYT_RT5640_JD_SRC_JD2_IN4N | +BYT_RT5640_OVCD_TH_1500UA | +BYT_RT5640_OVCD_SF_0P75 | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, { /* HP Stream 7 */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 55/452 drm/plane: Move range check for format_count earlier
In reply to Greg Kroah-HartmanFrom: Steven Price <[email protected]>
[ Upstream commit 4b674dd69701c2e22e8e7770c1706a69f3b17269 ]
While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place.
--- drivers/gpu/drm/drm_plane.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/drm_plane.c +7 -7
@@ -186,6 +186,13 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,if (WARN_ON (config->num_total_plane >=32 ))return -EINVAL ; +/* +* First driver to need more than 64 formats needs to fix this. Each +* format is encoded as a bit and the current code only supports a u64. +*/ +if (WARN_ON (format_count >64 )) +return -EINVAL ; +WARN_ON (drm_drv_uses_atomic_modeset (dev) && (!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state));
@@ -207,13 +214,6 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,return -ENOMEM ; } -/* -* First driver to need more than 64 formats needs to fix this. Each -* format is encoded as a bit and the current code only supports a u64. -*/ -if (WARN_ON (format_count >64 )) -return -EINVAL ; -if (format_modifiers) {const uint64_t *temp_modifiers = format_modifiers;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 56/452 drm/amd/pm: fix the compile warning
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 555238d92ac32dbad2d77ad2bafc48d17391990c ]
Fix the compile warning below:drivers/gpu/drm/amd/amdgpu/../pm/legacy-dpm/kv_dpm.c:1641kv_get_acp_boot_level() warn: always true condition '(table->entries[i]->clk >= 0) => (0-u32max >= 0)'
--- drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c +1 -13
@@ -1609,19 +1609,7 @@ static int kv_update_samu_dpm(struct amdgpu_device *adev, bool gate)static u8 kv_get_acp_boot_level (struct amdgpu_device *adev) { -u8 i; -struct amdgpu_clock_voltage_dependency_table *table = - &adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table; - -for (i =0 ; i < table->count; i++) { -if (table->entries[i].clk >=0 )/* XXX */ -break ; - } - -if (i >= table->count) - i = table->count -1 ; - -return i; +return 0 ; }static void kv_update_acp_boot_level (struct amdgpu_device *adev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 57/452 ath10k: skip ath10k_halt during suspend for driver state RESTARTING
In reply to Greg Kroah-HartmanFrom: Abhishek Kumar <[email protected]>
[ Upstream commit b72a4aff947ba807177bdabb43debaf2c66bee05 ]
Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW recovery is triggered by ath10k_core_restart() which calls driver clean up via ath10k_halt(). When the suspend event occurs between the FW recovery, the restart worker thread is put into frozen state until suspend completes. The suspend event triggers ath10k_stop() which again triggers ath10k_halt() The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be called twice(Note: ath10k_htt_rx_alloc was not called by restart worker thread because of its frozen state), causing the crash.
To fix this, during the suspend flow, skip call to ath10k_halt() in ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING. Also, for driver state ATH10K_STATE_RESTARTING, call ath10k_wait_for_suspend() in ath10k_stop(). This is because call to ath10k_wait_for_suspend() is skipped later in
[ath10k_halt() > ath10k_core_stop()] for the driver state ATH10K_STATE_RESTARTING.
The frozen restart worker thread will be cancelled during resume when the device comes out of suspend.
Below is the crash stack for reference:
[ 428.469167] ------------[ cut here ]------------ [ 428.469180] kernel BUG at mm/slub.c:4150! [ 428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 428.469219] Workqueue: events_unbound async_run_entry_fn [ 428.469230] RIP: 0010:kfree+0x319/0x31b [ 428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246 [ 428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000 [ 428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000 [ 428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000 [ 428.469276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 428.469285] Call Trace: [ 428.469295] ? dma_free_attrs+0x5f/0x7d [ 428.469320] ath10k_core_stop+0x5b/0x6f [ 428.469336] ath10k_halt+0x126/0x177 [ 428.469352] ath10k_stop+0x41/0x7e [ 428.469387] drv_stop+0x88/0x10e [ 428.469410] __ieee80211_suspend+0x297/0x411 [ 428.469441] rdev_suspend+0x6e/0xd0 [ 428.469462] wiphy_suspend+0xb1/0x105 [ 428.469483] ? name_show+0x2d/0x2d [ 428.469490] dpm_run_callback+0x8c/0x126 [ 428.469511] ? name_show+0x2d/0x2d [ 428.469517] __device_suspend+0x2e7/0x41b [ 428.469523] async_suspend+0x1f/0x93 [ 428.469529] async_run_entry_fn+0x3d/0xd1 [ 428.469535] process_one_work+0x1b1/0x329 [ 428.469541] worker_thread+0x213/0x372 [ 428.469547] kthread+0x150/0x15f [ 428.469552] ? pr_cont_work+0x58/0x58 [ 428.469558] ? kthread_blkcg+0x31/0x31
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/mac.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath10k/mac.c +18 -2
@@ -5170,13 +5170,29 @@ static int ath10k_start(struct ieee80211_hw *hw)static void ath10k_stop (struct ieee80211_hw *hw) {struct ath10k *ar = hw->priv; +u32 opt;ath10k_drain_tx (ar);mutex_lock (&ar->conf_mutex);if (ar->state !=ATH10K_STATE_OFF ) { -if (!ar->hw_rfkill_on) -ath10k_halt (ar); +if (!ar->hw_rfkill_on) { +/* If the current driver state is RESTARTING but not yet +* fully RESTARTED because of incoming suspend event, +* then ath10k_halt() is already called via +* ath10k_core_restart() and should not be called here. +*/ +if (ar->state !=ATH10K_STATE_RESTARTING ) { +ath10k_halt (ar); + }else { +/* Suspending here, because when in RESTARTING +* state, ath10k_core_stop() skips +* ath10k_wait_for_suspend(). +*/ + opt =WMI_PDEV_SUSPEND_AND_DISABLE_INTR ; +ath10k_wait_for_suspend (ar, opt); + } + } ar->state =ATH10K_STATE_OFF ; }mutex_unlock (&ar->conf_mutex);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 58/452 arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall
In reply to Greg Kroah-HartmanFrom: Alexandru Elisei <[email protected]>
[ Upstream commit 3fed9e551417b84038b15117732ea4505eee386b ]
If a compat process tries to execute an unknown system call above the __ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the offending process. Information about the error is printed to dmesg in compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() -> arm64_show_signal().
arm64_show_signal() interprets a non-zero value for current->thread.fault_code as an exception syndrome and displays the message associated with the ESR_ELx.EC field (bits 31:26). current->thread.fault_code is set in compat_arm_syscall() -> arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx value. This means that the ESR_ELx.EC field has the value that the user set for the syscall number and the kernel can end up printing bogus exception messages*. For example, for the syscall number 0x68000000, which evaluates to ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error:
[ 18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000] [ 18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79 [ 18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT)
[..]
which is misleading, as the bad compat syscall has nothing to do with pointer authentication.
Stop arm64_show_signal() from printing exception syndrome information by having compat_arm_syscall() set the ESR_ELx value to 0, as it has no meaning for an invalid system call number. The example above now becomes:
[ 19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000] [ 19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80 [ 19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT)
[..]
which although shows less information because the syscall number, wrongfully advertised as the ESR value, is missing, it is better than showing plainly wrong information. The syscall number can be easily obtained with strace.
*A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative integer in compat_arm_syscal() and the condition scno < __ARM_NR_COMPAT_END evaluates to true; the syscall will exit to userspace in this case with the ENOSYS error code instead of arm64_notify_die() being called.
--- arch/arm64/kernel/sys_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/sys_compat.c +1 -1
@@ -115,6 +115,6 @@ long compat_arm_syscall(struct pt_regs *regs, int scno) (compat_thumb_mode (regs) ?2 :4 );arm64_notify_die ("Oops - bad compat syscall(2)" , regs, -SIGILL ,ILL_ILLTRP , addr, scno); +SIGILL ,ILL_ILLTRP , addr,0 );return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 59/452 drm: msm: fix error check return value of irq_of_parse_and_map()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit b9e4f1d2b505df8e2439b63e67afaa287c1c43e2 ]
The irq_of_parse_and_map() function returns 0 on failure, and does not return an negative value.
Patchwork: https://patchwork.freedesktop.org/patch/483175/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c +3 -3
@@ -598,9 +598,9 @@ struct msm_kms *mdp5_kms_init(struct drm_device *dev) pdev = mdp5_kms->pdev; irq =irq_of_parse_and_map (pdev->dev.of_node,0 ); -if (irq <0 ) { - ret = irq; -DRM_DEV_ERROR (&pdev->dev,"failed to get irq: %d\n" , ret); +if (!irq) { + ret = -EINVAL ; +DRM_DEV_ERROR (&pdev->dev,"failed to get irq\n" ); goto fail; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 60/452 ipv6: Dont send rs packets to the interface of ARPHRD_TUNNEL
In reply to Greg Kroah-HartmanFrom: jianghaoran <[email protected]>
[ Upstream commit b52e1cce31ca721e937d517411179f9196ee6135 ]
ARPHRD_TUNNEL interface can't process rs packets
and will generate TX errors
ex:
ip tunnel add ethn mode ipip local 192.168.1.1 remote 192.168.1.2 ifconfig ethn x.x.x.x
ethn: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1480
inet x.x.x.x netmask 255.255.255.255 destination x.x.x.x inet6 fe80::5efe:ac1e:3cdb prefixlen 64 scopeid 0x20<link>
tunnel txqueuelen 1000 (IPIP Tunnel)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 3 dropped 0 overruns 0 carrier 0 collisions 0
--- net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +2 -1
@@ -4200,7 +4200,8 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id, send_rs = send_mld &&ipv6_accept_ra (ifp->idev) && ifp->idev->cnf.rtr_solicits !=0 && - (dev->flags&IFF_LOOPBACK ) ==0 ; + (dev->flags &IFF_LOOPBACK ) ==0 && + (dev->type !=ARPHRD_TUNNEL );read_unlock_bh (&ifp->idev->lock);/* While dad is in progress mld report's source address is in6_addrany.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 61/452 net/mlx5: fs, delete the FTE when there are no rules attached to it
In reply to Greg Kroah-HartmanFrom: Mark Bloch <[email protected]>
[ Upstream commit 7b0c6338597613f465d131bd939a51844a00455a ]
When an FTE has no children is means all the rules where removed and the FTE can be deleted regardless of the dests_size value. While dests_size should be 0 when there are no children be extra careful not to leak memory or get firmware syndrome if the proper bookkeeping of dests_size wasn't done.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +5 -5
@@ -2024,16 +2024,16 @@ void mlx5_del_flow_rules(struct mlx5_flow_handle *handle)down_write_ref_node (&fte->node, false);for (i = handle->num_rules -1 ; i >=0 ; i--)tree_remove_node (&handle->rule[i]->node, true); -if (fte->dests_size) { -if (fte->modify_mask) -modify_fte (fte); -up_write_ref_node (&fte->node, false); - }else if (list_empty (&fte->node.children)) { +if (list_empty (&fte->node.children)) {del_hw_fte (&fte->node);/* Avoid double call to del_hw_fte */ fte->node.del_hw_func =NULL ;up_write_ref_node (&fte->node, false);tree_put_node (&fte->node, false); + }else if (fte->dests_size) { +if (fte->modify_mask) +modify_fte (fte); +up_write_ref_node (&fte->node, false); }else {up_write_ref_node (&fte->node, false); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 62/452 ASoC: dapm: Dont fold register value changes into notifications
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit ad685980469b9f9b99d4d6ea05f4cb8f57cb2234 ]
DAPM tracks and reports the value presented to the user from DAPM controls separately to the register value, these may diverge during initialisation or when an autodisable control is in use.
When writing DAPM controls we currently report that a change has occurred if either the DAPM value or the value stored in the register has changed, meaning that if the two are out of sync we may appear to report a spurious event to userspace. Since we use this folded in value for nothing other than the value reported to userspace simply drop the folding in of the register change.
--- sound/soc/soc-dapm.c | 2 -- 1 file changed, 2 deletions(-)
sound/soc/soc-dapm.c +0 -2
@@ -3427,7 +3427,6 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, update.val = val; card->update = &update; } - change |= reg_change; ret =soc_dapm_mixer_update_power (card, kcontrol, connect, rconnect);
@@ -3529,7 +3528,6 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol, update.val = val; card->update = &update; } - change |= reg_change; ret =soc_dapm_mux_update_power (card, kcontrol, item[0 ], e);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 63/452 mlxsw: spectrum_dcb: Do not warn about priority changes
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit b6b584562cbe7dc357083459d6dd5b171e12cadb ]
The idea behind the warnings is that the user would get warned in case when more than one priority is configured for a given DSCP value on a netdevice.
The warning is currently wrong, because dcb_ieee_getapp_mask() returns the first matching entry, not all of them, and the warning will then claim that some priority is "current", when in fact it is not.
But more importantly, the warning is misleading in general. Consider the following commands:
# dcb app flush dev swp19 dscp-prio # dcb app add dev swp19 dscp-prio 24:3 # dcb app replace dev swp19 dscp-prio 24:2
The last command will issue the following warning:
mlxsw_spectrum3 0000:07:00.0 swp19: Ignoring new priority 2 for DSCP 24 in favor of current value of 3
The reason is that the "replace" command works by first adding the new value, and then removing all old values. This is the only way to make the replacement without causing the traffic to be prioritized to whatever the chip defaults to. The warning is issued in response to adding the new priority, and then no warning is shown when the old priority is removed. The upshot is that the canonical way to change traffic prioritization always produces a warning about ignoring the new priority, but what gets configured is in fact what the user intended.
An option to just emit warning every time that the prioritization changes just to make it clear that it happened is obviously unsatisfactory.
Therefore, in this patch, remove the warnings.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c | 13 ------------- 1 file changed, 13 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c +0 -13
@@ -168,8 +168,6 @@ static int mlxsw_sp_dcbnl_ieee_setets(struct net_device *dev,static int mlxsw_sp_dcbnl_app_validate (struct net_device *dev,struct dcb_app *app) { -int prio; -if (app->priority >=IEEE_8021QAZ_MAX_TCS ) {netdev_err (dev,"APP entry with priority value %u is invalid\n" , app->priority);
@@ -183,17 +181,6 @@ static int mlxsw_sp_dcbnl_app_validate(struct net_device *dev, app->protocol);return -EINVAL ; } - -/* Warn about any DSCP APP entries with the same PID. */ - prio =fls (dcb_ieee_getapp_mask (dev, app)); -if (prio--) { -if (prio < app->priority) -netdev_warn (dev,"Choosing priority %d for DSCP %d in favor of previously-active value of %d\n" , - app->priority, app->protocol, prio); -else if (prio > app->priority) -netdev_warn (dev,"Ignoring new priority %d for DSCP %d in favor of current value of %d\n" , - app->priority, app->protocol, prio); - }break ;case IEEE_8021QAZ_APP_SEL_ETHERTYPE :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 64/452 mlxsw: Treat LLDP packets as control
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit 0106668cd2f91bf913fb78972840dedfba80a3c3 ]
When trapping packets for on-CPU processing, Spectrum machines differentiate between control and non-control traps. Traffic trapped through non-control traps is treated as data and kept in shared buffer in pools 0-4. Traffic trapped through control traps is kept in the dedicated control buffer 9. The advantage of marking traps as control is that pressure in the data plane does not prevent the control traffic to be processed.
When the LLDP trap was introduced, it was marked as a control trap. But then in commit aed4b5721143 ("mlxsw: spectrum: PTP: Hook into packet receive path"), PTP traps were introduced. Because Ethernet-encapsulated PTP packets look to the Spectrum-1 ASIC as LLDP traffic and are trapped under the LLDP trap, this trap was reconfigured as non-control, in sync with the PTP traps.
There is however no requirement that PTP traffic be handled as data. Besides, the usual encapsulation for PTP traffic is UDP, not bare Ethernet, and that is in deployments that even need PTP, which is far less common than LLDP. This is reflected by the default policer, which was not bumped up to the 19Kpps / 24Kpps that is the expected load of a PTP-enabled Spectrum-1 switch.
Marking of LLDP trap as non-control was therefore probably misguided. In this patch, change it back to control.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_trap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_trap.c +1 -1
@@ -709,7 +709,7 @@ static const struct mlxsw_sp_trap_item mlxsw_sp_trap_items_arr[] = { .trap = MLXSW_SP_TRAP_CONTROL(LLDP, LLDP, TRAP), .listeners_arr = {MLXSW_RXL (mlxsw_sp_rx_ptp_listener,LLDP ,TRAP_TO_CPU , - false, SP_LLDP, DISCARD), + true, SP_LLDP, DISCARD), }, }, {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 65/452 drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
In reply to Greg Kroah-HartmanFrom: Alice Wong <[email protected]>
[ Upstream commit ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f ]
When psp_hw_init failed, it will set the load_type to AMDGPU_FW_LOAD_DIRECT. During amdgpu_device_ip_fini, amdgpu_ucode_free_bo checks that load_type is AMDGPU_FW_LOAD_DIRECT and skips deallocating fw_buf causing memory leak. Remove load_type check in amdgpu_ucode_free_bo.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +1 -2
@@ -625,8 +625,7 @@ int amdgpu_ucode_create_bo(struct amdgpu_device *adev)void amdgpu_ucode_free_bo (struct amdgpu_device *adev) { -if (adev->firmware.load_type !=AMDGPU_FW_LOAD_DIRECT ) -amdgpu_bo_free_kernel (&adev->firmware.fw_buf, +amdgpu_bo_free_kernel (&adev->firmware.fw_buf, &adev->firmware.fw_buf_mc, &adev->firmware.fw_buf_ptr); }
Signature · 1 line
2.35.1
RE: [PATCH 5.10 065/452] drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
[Public]
Quoted 22 lines
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Tuesday, June 7, 2022 12:59 PM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Wong, Alice <[email protected]>; Deucher, Alexander <[email protected]>; Sasha Levin <[email protected]>
Subject: [PATCH 5.10 065/452] drm/amdgpu/ucode: Remove firmware load type check inamdgpu_ucode_free_boFrom: Alice Wong <[email protected]>
[ Upstream commit
ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f]When
psp_hw_initfailed, it will set theload_typetoAMDGPU_FW_LOAD_DIRECT.
Duringamdgpu_device_ip_fini,amdgpu_ucode_free_bochecks thatload_typeisAMDGPU_FW_LOAD_DIRECTand skips deallocatingfw_bufcausing memory leak.
Removeload_typecheck inamdgpu_ucode_free_bo.
Quoted 4 lines
Signed-off-by Alice Wong <[email protected]>Reviewed-by Alex Deucher <[email protected]>Signed-off-by Alex Deucher <[email protected]>Signed-off-by Sasha Levin <[email protected]>
I don't think this patch is relevant for kernels older than 5.19. I shouldn't hurt anything however.
Alex
Quoted 23 lines
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +1
-3@@ -625,8 +625,7 @@ int amdgpu_ucode_create_bo(struct amdgpu_device *adev)void amdgpu_ucode_free_bo (struct amdgpu_device *adev) { -if (adev->firmware.load_type !=AMDGPU_FW_LOAD_DIRECT ) -amdgpu_bo_free_kernel (&adev->firmware.fw_buf, +amdgpu_bo_free_kernel (&adev->firmware.fw_buf, &adev->firmware.fw_buf_mc, &adev->firmware.fw_buf_ptr); } --2.35.1
RE: [PATCH 5.10 065/452] drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo
[Public]
Quoted 34 lines
-----Original Message-----
From: Deucher, Alexander
Sent: Tuesday, June 7, 2022 1:33 PM
To: Greg Kroah-Hartman <[email protected]>; linux- [email protected]
Cc: [email protected]; Wong, Alice <[email protected]>; Sasha Levin <[email protected]>
Subject: RE: [PATCH 5.10 065/452] drm/amdgpu/ucode: Remove firmware load type check inamdgpu_ucode_free_bo[Public]
Quoted 7 lines
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Tuesday, June 7, 2022 12:59 PM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Wong, Alice <[email protected]>; Deucher, Alexander <[email protected]>; Sasha LevinQuoted 14 lines
Subject: [PATCH 5.10 065/452] drm/amdgpu/ucode: Remove firmware load type check in
amdgpu_ucode_free_boFrom: Alice Wong <[email protected]>
[ Upstream commit
ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f]When
psp_hw_initfailed, it will set theload_typetoAMDGPU_FW_LOAD_DIRECT.
Duringamdgpu_device_ip_fini,amdgpu_ucode_free_bochecks thatload_typeisAMDGPU_FW_LOAD_DIRECTand skips deallocatingfw_bufcausing memory leak.
Removeload_typecheck inamdgpu_ucode_free_bo.
Quoted 8 lines
Quoted 4 lines
Signed-off-by Alice Wong <[email protected]>Reviewed-by Alex Deucher <[email protected]>Signed-off-by Alex Deucher <[email protected]>Signed-off-by Sasha Levin <[email protected]>I don't think this patch is relevant for kernels older than 5.19. I shouldn't hurt anything however.
Nevermind, I see that Sasha backported the entire series that this patch depends on.
Alex
Quoted 27 lines
Alex
drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c int amdgpu_ucode_create_bo(struct
Quoted 10 lines
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +0
-0@@ -625,8 +625,7 @@ int amdgpu_ucode_create_bo(struct
amdgpu_deviceQuoted 13 lines
drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +1
-3*adev)void amdgpu_ucode_free_bo (struct amdgpu_device *adev) { -if (adev->firmware.load_type !=AMDGPU_FW_LOAD_DIRECT ) -amdgpu_bo_free_kernel (&adev->firmware.fw_buf, +amdgpu_bo_free_kernel (&adev->firmware.fw_buf, &adev->firmware.fw_buf_mc, &adev->firmware.fw_buf_ptr); } --2.35.1
Greg Kroah-Hartman
maintainerPATCH 66/452 HID: bigben: fix slab-out-of-bounds Write in bigben_probe
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit fc4ef9d5724973193bfa5ebed181dba6de3a56db ]
There is a slab-out-of-bounds Write bug in hid-bigbenff driver. The problem is the driver assumes the device must have an input but some malicious devices violate this assumption.
Fix this by checking hid_device's input is non-empty before its usage.
--- drivers/hid/hid-bigbenff.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hid/hid-bigbenff.c +6 -0
@@ -347,6 +347,12 @@ static int bigben_probe(struct hid_device *hid, bigben->report =list_entry (report_list->next, struct hid_report, list); +if (list_empty (&hid->inputs)) { +hid_err (hid,"no inputs found\n" ); + error = -ENODEV ; + goto error_hw_stop; + } + hidinput = list_first_entry(&hid->inputs, struct hid_input, list);set_bit (FF_RUMBLE , hidinput->input->ffbit);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 67/452 ASoC: tscs454: Add endianness flag in snd_soc_component_driver
In reply to Greg Kroah-HartmanFrom: Charles Keepax <[email protected]>
[ Upstream commit ff69ec96b87dccb3a29edef8cec5d4fefbbc2055 ]
The endianness flag is used on the CODEC side to specify an ambivalence to endian, typically because it is lost over the hardware link. This device receives audio over an I2S DAI and as such should have endianness applied.
A fixup is also required to use the width directly rather than relying on the format in hw_params, now both little and big endian would be supported. It is worth noting this changes the behaviour of S24_LE to use a word length of 24 rather than 32. This would appear to be a correction since the fact S24_LE is stored as 32 bits should not be presented over the bus.
--- sound/soc/codecs/tscs454.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
sound/soc/codecs/tscs454.c +6 -6
@@ -3115,18 +3115,17 @@ static int set_aif_sample_format(struct snd_soc_component *component,unsigned int width;int ret; -switch (format) { -case SNDRV_PCM_FORMAT_S16_LE : +switch (snd_pcm_format_width (format)) { +case 16 : width =FV_WL_16 ;break ; -case SNDRV_PCM_FORMAT_S20_3LE : +case 20 : width =FV_WL_20 ;break ; -case SNDRV_PCM_FORMAT_S24_3LE : +case 24 : width =FV_WL_24 ;break ; -case SNDRV_PCM_FORMAT_S24_LE : -case SNDRV_PCM_FORMAT_S32_LE : +case 32 : width =FV_WL_32 ;break ;default :
@@ -3321,6 +3320,7 @@ static const struct snd_soc_component_driver soc_component_dev_tscs454 = { .num_dapm_routes = ARRAY_SIZE(tscs454_intercon), .controls = tscs454_snd_controls, .num_controls = ARRAY_SIZE(tscs454_snd_controls), + .endianness = 1, };#define TSCS454_RATES SNDRV_PCM_RATE_8000_96000
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 68/452 net: remove two BUG() from skb_checksum_help()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit d7ea0d9df2a6265b2b180d17ebc64b38105968fc ]
I have a syzbot report that managed to get a crash in skb_checksum_help()
If syzbot can trigger these BUG(), it makes sense to replace them with more friendly WARN_ON_ONCE() since skb_checksum_help() can instead return an error code.
Note that syzbot will still crash there, until real bug is fixed.
--- net/core/dev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/core/dev.c +6 -2
@@ -3241,11 +3241,15 @@ int skb_checksum_help(struct sk_buff *skb) } offset =skb_checksum_start_offset (skb); -BUG_ON (offset >=skb_headlen (skb)); + ret = -EINVAL ; +if (WARN_ON_ONCE (offset >=skb_headlen (skb))) + goto out; + csum =skb_checksum (skb, offset, skb->len - offset,0 ); offset += skb->csum_offset; -BUG_ON (offset +sizeof (__sum16) >skb_headlen (skb)); +if (WARN_ON_ONCE (offset +sizeof (__sum16) >skb_headlen (skb))) + goto out; ret =skb_ensure_writable (skb, offset +sizeof (__sum16));if (ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 69/452 s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit 63678eecec57fc51b778be3da35a397931287170 ]
gcc 12 does not (always) optimize away code that should only be generated if parameters are constant and within in a certain range. This depends on various obscure kernel config options, however in particular PROFILE_ALL_BRANCHES can trigger this compile error:
In function ‘__atomic_add_const’,
inlined from ‘__preempt_count_add.part.0’ at ./arch/s390/include/asm/preempt.h:50:3:
./arch/s390/include/asm/atomic_ops.h:80:9: error: impossible constraint in ‘asm’
80 | asm volatile( \
| ^~~Workaround this by simply disabling the optimization for PROFILE_ALL_BRANCHES, since the kernel will be so slow, that this optimization won't matter at all.
--- arch/s390/include/asm/preempt.h | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
arch/s390/include/asm/preempt.h +11 -4
@@ -46,10 +46,17 @@ static inline bool test_preempt_need_resched(void)static inline void __preempt_count_add (int val) { -if (__builtin_constant_p (val) && (val >=-128 ) && (val <=127 )) -__atomic_add_const (val, &S390_lowcore.preempt_count); -else -__atomic_add (val, &S390_lowcore.preempt_count); +/* +* With some obscure config options and CONFIG_PROFILE_ALL_BRANCHES +* enabled, gcc 12 fails to handle __builtin_constant_p(). +*/ +if (!IS_ENABLED (CONFIG_PROFILE_ALL_BRANCHES )) { +if (__builtin_constant_p (val) && (val >=-128 ) && (val <=127 )) { +__atomic_add_const (val, &S390_lowcore.preempt_count); +return ; + } + } +__atomic_add (val, &S390_lowcore.preempt_count); }static inline void __preempt_count_sub (int val)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 70/452 perf/amd/ibs: Cascade pmu init functions return value
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit 39b2ca75eec8a33e2ffdb8aa0c4840ec3e3b472c ]
IBS pmu initialization code ignores return value provided by callee functions. Fix it.
--- arch/x86/events/amd/ibs.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-)
arch/x86/events/amd/ibs.c +29 -8
@@ -764,9 +764,10 @@ static __init int perf_ibs_pmu_init(struct perf_ibs *perf_ibs, char *name)return ret; } -static __init void perf_event_ibs_init (void ) +static __init int perf_event_ibs_init (void ) {struct attribute **attr = ibs_op_format_attrs; +int ret;/* * Some chips fail to reset the fetch count when it is written; instead
@@ -778,7 +779,9 @@ static __init void perf_event_ibs_init(void)if (boot_cpu_data.x86 ==0x19 && boot_cpu_data.x86_model <0x10 ) perf_ibs_fetch.fetch_ignore_if_zero_rip =1 ; -perf_ibs_pmu_init (&perf_ibs_fetch,"ibs_fetch" ); + ret =perf_ibs_pmu_init (&perf_ibs_fetch,"ibs_fetch" ); +if (ret) +return ret;if (ibs_caps &IBS_CAPS_OPCNT ) { perf_ibs_op.config_mask |=IBS_OP_CNT_CTL ;
@@ -791,15 +794,35 @@ static __init void perf_event_ibs_init(void) perf_ibs_op.cnt_mask |= IBS_OP_MAX_CNT_EXT_MASK; } -perf_ibs_pmu_init (&perf_ibs_op,"ibs_op" ); + ret =perf_ibs_pmu_init (&perf_ibs_op,"ibs_op" ); +if (ret) + goto err_op; + + ret =register_nmi_handler (NMI_LOCAL , perf_ibs_nmi_handler,0 ,"perf_ibs" ); +if (ret) + goto err_nmi; -register_nmi_handler (NMI_LOCAL , perf_ibs_nmi_handler,0 ,"perf_ibs" );pr_info ("perf: AMD IBS detected (0x%08x)\n" , ibs_caps); +return 0 ; + +err_nmi: +perf_pmu_unregister (&perf_ibs_op.pmu); +free_percpu (perf_ibs_op.pcpu); + perf_ibs_op.pcpu =NULL ; +err_op: +perf_pmu_unregister (&perf_ibs_fetch.pmu); +free_percpu (perf_ibs_fetch.pcpu); + perf_ibs_fetch.pcpu =NULL ; + +return ret; }#else /* defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_AMD) */ -static __init void perf_event_ibs_init (void ) { } +static __init int perf_event_ibs_init (void ) +{ +return 0 ; +}#endif
@@ -1069,9 +1092,7 @@ static __init int amd_ibs_init(void) x86_pmu_amd_ibs_starting_cpu, x86_pmu_amd_ibs_dying_cpu); -perf_event_ibs_init (); - -return 0 ; +return perf_event_ibs_init (); }/* Since we need the pci subsystem to init ibs we can't do this earlier: */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 71/452 spi: stm32-qspi: Fix wait_cmd timeout in APM mode
In reply to Greg Kroah-HartmanFrom: Patrice Chotard <[email protected]>
[ Upstream commit d83d89ea68b4726700fa87b22db075e4217e691c ]
In APM mode, TCF and TEF flags are not set. To avoid timeout in stm32_qspi_wait_cmd(), don't check if TCF/TEF are set.
--- drivers/spi/spi-stm32-qspi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-stm32-qspi.c +2 -1
@@ -295,7 +295,8 @@ static int stm32_qspi_wait_cmd(struct stm32_qspi *qspi,if (!op->data.nbytes) goto wait_nobusy; -if (readl_relaxed (qspi->io_base +QSPI_SR ) &SR_TCF ) +if ((readl_relaxed (qspi->io_base +QSPI_SR ) &SR_TCF ) || + qspi->fmode ==CCR_FMODE_APM ) goto out;reinit_completion (&qspi->data_completion);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 72/452 dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
[ Upstream commit 84bc4f1dbbbb5f8aa68706a96711dccb28b518e5 ]
We observed the error "cacheline tracking ENOMEM, dma-debug disabled" during a light system load (copying some files). The reason for this error is that the dma_active_cacheline radix tree uses GFP_NOWAIT allocation - so it can't access the emergency memory reserves and it fails as soon as anybody reaches the watermark.
This patch changes GFP_NOWAIT to GFP_ATOMIC, so that it can access the emergency memory reserves.
--- kernel/dma/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/dma/debug.c +1 -1
@@ -448,7 +448,7 @@ void debug_dma_dump_mappings(struct device *dev)* other hand, consumes a single dma_debug_entry, but inserts 'nents' * entries into the tree. */ -static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT); +static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC);static DEFINE_SPINLOCK (radix_lock);#define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)#define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 73/452 ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit d52848620de00cde4a3a5df908e231b8c8868250 ]
ASUS B1400CEAE fails to resume from suspend to idle by default. This was bisected back to commit df4f9bc4fb9c ("nvme-pci: add support for ACPI StorageD3Enable property") but this is a red herring to the problem.
Before this commit the system wasn't getting into deepest sleep state. Presumably this commit is allowing entry into deepest sleep state as advertised by firmware, but there are some other problems related to the wakeup.
As it is confirmed the system works properly with S3, set the default for this system to S3.
--- drivers/acpi/sleep.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/acpi/sleep.c +12 -0
@@ -377,6 +377,18 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), }, }, +/* +* ASUS B1400CEAE hangs on resume from suspend (see +* https://bugzilla.kernel.org/show_bug.cgi?id=215742). +*/ + { + .callback = init_default_s3, + .ident = "ASUS B1400CEAE", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"), + }, + }, {}, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 74/452 ipmi:ssif: Check for NULL msg when handling events and messages
In reply to Greg Kroah-HartmanFrom: Corey Minyard <[email protected]>
[ Upstream commit 7602b957e2404e5f98d9a40b68f1fd27f0028712 ]
Even though it's not possible to get into the SSIF_GETTING_MESSAGES and SSIF_GETTING_EVENTS states without a valid message in the msg field, it's probably best to be defensive here and check and print a log, since that means something else went wrong.
Also add a default clause to that switch statement to release the lock and print a log, in case the state variable gets messed up somehow.
--- drivers/char/ipmi/ipmi_ssif.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/char/ipmi/ipmi_ssif.c +23 -0
@@ -840,6 +840,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,break ;case SSIF_GETTING_EVENTS : +if (!msg) { +/* Should never happen, but just in case. */ +dev_warn (&ssif_info->client->dev, +"No message set while getting events\n" ); +ipmi_ssif_unlock_cond (ssif_info, flags); +break ; + } +if ((result <0 ) || (len <3 ) || (msg->rsp[2 ] !=0 )) {/* Error getting event, probably done. */ msg->done (msg);
@@ -864,6 +872,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,break ;case SSIF_GETTING_MESSAGES : +if (!msg) { +/* Should never happen, but just in case. */ +dev_warn (&ssif_info->client->dev, +"No message set while getting messages\n" ); +ipmi_ssif_unlock_cond (ssif_info, flags); +break ; + } +if ((result <0 ) || (len <3 ) || (msg->rsp[2 ] !=0 )) {/* Error getting event, probably done. */ msg->done (msg);
@@ -887,6 +903,13 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,deliver_recv_msg (ssif_info, msg); }break ; + +default : +/* Should never happen, but just in case. */ +dev_warn (&ssif_info->client->dev, +"Invalid state in message done handling: %d\n" , + ssif_info->ssif_state); +ipmi_ssif_unlock_cond (ssif_info, flags); } flags =ipmi_ssif_lock_cond (ssif_info, &oflags);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 75/452 ipmi: Fix pr_fmt to avoid compilation issues
In reply to Greg Kroah-HartmanFrom: Corey Minyard <[email protected]>
[ Upstream commit 2ebaf18a0b7fb764bba6c806af99fe868cee93de ]
The was it was wouldn't work in some situations, simplify it. What was there was unnecessary complexity.
--- drivers/char/ipmi/ipmi_msghandler.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/ipmi/ipmi_msghandler.c +2 -2
@@ -11,8 +11,8 @@* Copyright 2002 MontaVista Software Inc. */ -#define pr_fmt (fmt) "%s" fmt, "IPMI message handler: " -#define dev_fmt pr_fmt +#define pr_fmt (fmt) "IPMI message handler: " fmt +#define dev_fmt (fmt) pr_fmt(fmt)#include <linux/module.h> #include <linux/errno.h>
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 76/452 rtlwifi: Use pr_warn instead of WARN_ONCE
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit ad732da434a2936128769216eddaece3b1af4588 ]
This memory allocation failure can be triggered by fault injection or high pressure testing, resulting a WARN.
Fix this by replacing WARN with pr_warn.
--- drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/usb.c +1 -1
@@ -1015,7 +1015,7 @@ int rtl_usb_probe(struct usb_interface *intf, hw =ieee80211_alloc_hw (sizeof (struct rtl_priv ) +sizeof (struct rtl_usb_priv ), &rtl_ops);if (!hw) { -WARN_ONCE (true,"rtl_usb: ieee80211 alloc failed\n" ); +pr_warn ("rtl_usb: ieee80211 alloc failed\n" );return -ENOMEM ; } rtlpriv = hw->priv;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 77/452 media: rga: fix possible memory leak in rga_probe
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit a71eb6025305192e646040cd76ccacb5bd48a1b5 ]
rga->m2m_dev needs to be freed when rga_probe fails.
--- drivers/media/platform/rockchip/rga/rga.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/rockchip/rga/rga.c +4 -2
@@ -868,7 +868,7 @@ static int rga_probe(struct platform_device *pdev) ret =pm_runtime_resume_and_get (rga->dev);if (ret <0 ) - goto rel_vdev; + goto rel_m2m; rga->version.major = (rga_read (rga,RGA_VERSION_INFO ) >>24 ) &0xFF ; rga->version.minor = (rga_read (rga,RGA_VERSION_INFO ) >>20 ) &0x0F ;
@@ -884,7 +884,7 @@ static int rga_probe(struct platform_device *pdev) DMA_ATTR_WRITE_COMBINE);if (!rga->cmdbuf_virt) { ret = -ENOMEM ; - goto rel_vdev; + goto rel_m2m; } rga->src_mmu_pages =
@@ -921,6 +921,8 @@ static int rga_probe(struct platform_device *pdev) free_dma:dma_free_attrs (rga->dev,RGA_CMDBUF_SIZE , rga->cmdbuf_virt, rga->cmdbuf_phy,DMA_ATTR_WRITE_COMBINE ); +rel_m2m: +v4l2_m2m_release (rga->m2m_dev); rel_vdev:video_device_release (vfd); unreg_v4l2_dev:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 78/452 media: coda: limit frame interval enumeration to supported encoder frame sizes
In reply to Greg Kroah-HartmanFrom: Philipp Zabel <[email protected]>
[ Upstream commit 67e33dd957880879e785cfea83a3aa24bd5c5577 ]
Let VIDIOC_ENUM_FRAMEINTERVALS return -EINVAL if userspace queries frame intervals for frame sizes unsupported by the encoder. Fixes the following v4l2-compliance failure:
fail: v4l2-test-formats.cpp(123): found frame intervals for invalid size 47x16
fail: v4l2-test-formats.cpp(282): node->codec_mask & STATEFUL_ENCODER
test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: FAIL
[hverkuil: drop incorrect 'For decoder devices, return -ENOTTY.' in the commit log]
--- drivers/media/platform/coda/coda-common.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/media/platform/coda/coda-common.c +14 -6
@@ -1318,7 +1318,8 @@ static int coda_enum_frameintervals(struct file *file, void *fh, struct v4l2_frmivalenum *f) {struct coda_ctx *ctx =fh_to_ctx (fh); -int i; +struct coda_q_data *q_data; +const struct coda_codec *codec;if (f->index)return -EINVAL ;
@@ -1327,12 +1328,19 @@ static int coda_enum_frameintervals(struct file *file, void *fh,if (!ctx->vdoa && f->pixel_format ==V4L2_PIX_FMT_YUYV )return -EINVAL ; -for (i =0 ; i <CODA_MAX_FORMATS ; i++) { -if (f->pixel_format == ctx->cvd->src_formats[i] || - f->pixel_format == ctx->cvd->dst_formats[i]) -break ; +if (coda_format_normalize_yuv (f->pixel_format) ==V4L2_PIX_FMT_YUV420 ) { + q_data =get_q_data (ctx,V4L2_BUF_TYPE_VIDEO_CAPTURE ); + codec =coda_find_codec (ctx->dev, f->pixel_format, + q_data->fourcc); + }else { + codec =coda_find_codec (ctx->dev,V4L2_PIX_FMT_YUV420 , + f->pixel_format); } -if (i ==CODA_MAX_FORMATS ) +if (!codec) +return -EINVAL ; + +if (f->width <MIN_W || f->width > codec->max_w || + f->height <MIN_H || f->height > codec->max_h)return -EINVAL ; f->type =V4L2_FRMIVAL_TYPE_CONTINUOUS ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 79/452 media: imon: reorganize serialization
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit db264d4c66c0fe007b5d19fd007707cd0697603d ]
Since usb_register_dev() from imon_init_display() from imon_probe() holds minor_rwsem while display_open() which holds driver_lock and ictx->lock is called with minor_rwsem held from usb_open(), holding driver_lock or ictx->lock when calling usb_register_dev() causes circular locking dependency problem.
Since usb_deregister_dev() from imon_disconnect() holds minor_rwsem while display_open() which holds driver_lock is called with minor_rwsem held, holding driver_lock when calling usb_deregister_dev() also causes circular locking dependency problem.
Sean Young explained that the problem is there are imon devices which have two usb interfaces, even though it is one device. The probe and disconnect function of both usb interfaces can run concurrently.
Alan Stern responded that the driver and USB cores guarantee that when an interface is probed, both the interface and its USB device are locked. Ditto for when the disconnect callback gets run. So concurrent probing/ disconnection of multiple interfaces on the same device is not possible.
Therefore, we don't need locks for handling race between imon_probe() and imon_disconnect(). But we still need to handle race between display_open() /vfd_write()/lcd_write()/display_close() and imon_disconnect(), for disconnect event can happen while file descriptors are in use.
Since "struct file"->private_data is set by display_open(), vfd_write()/ lcd_write()/display_close() can assume that "struct file"->private_data is not NULL even after usb_set_intfdata(interface, NULL) was called.
Replace insufficiently held driver_lock with refcount_t based management. Add a boolean flag for recording whether imon_disconnect() was already called. Use RCU for accessing this boolean flag and refcount_t.
Since the boolean flag for imon_disconnect() is shared, disconnect event on either intf0 or intf1 affects both interfaces. But I assume that this change does not matter, for usually disconnect event would not happen while interfaces are in use.
--- drivers/media/rc/imon.c | 99 +++++++++++++++++++---------------------- 1 file changed, 47 insertions(+), 52 deletions(-)
drivers/media/rc/imon.c +47 -52
@@ -153,6 +153,24 @@ struct imon_context {const struct imon_usb_dev_descr *dev_descr;/* device description with key */ /* table for front panels */ +/* +* Fields for deferring free_imon_context(). +* +* Since reference to "struct imon_context" is stored into +* "struct file"->private_data, we need to remember +* how many file descriptors might access this "struct imon_context". +*/ +refcount_t users; +/* +* Use a flag for telling display_open()/vfd_write()/lcd_write() that +* imon_disconnect() was already called. +*/ +bool disconnected; +/* +* We need to wait for RCU grace period in order to allow +* display_open() to safely check ->disconnected and increment ->users. +*/ +struct rcu_head rcu; };#define TOUCH_TIMEOUT (HZ/30)
@@ -160,18 +178,18 @@ struct imon_context {/* vfd character device file operations */ static const struct file_operations vfd_fops = { .owner =THIS_MODULE , - .open = &display_open, - .write = &vfd_write, - .release = &display_close, + .open = display_open, + .write = vfd_write, + .release = display_close, .llseek = noop_llseek, };/* lcd character device file operations */ static const struct file_operations lcd_fops = { .owner =THIS_MODULE , - .open = &display_open, - .write = &lcd_write, - .release = &display_close, + .open = display_open, + .write = lcd_write, + .release = display_close, .llseek = noop_llseek, };
@@ -439,9 +457,6 @@ static struct usb_driver imon_driver = { .id_table = imon_usb_id_table, }; -/* to prevent races between open() and disconnect(), probing, etc */ -static DEFINE_MUTEX (driver_lock); -/* Module bookkeeping bits */ MODULE_AUTHOR (MOD_AUTHOR );MODULE_DESCRIPTION (MOD_DESC );
@@ -481,9 +496,11 @@ static void free_imon_context(struct imon_context *ictx)struct device *dev = ictx->dev;usb_free_urb (ictx->tx_urb); +WARN_ON (ictx->dev_present_intf0);usb_free_urb (ictx->rx_urb_intf0); +WARN_ON (ictx->dev_present_intf1);usb_free_urb (ictx->rx_urb_intf1); -kfree (ictx); +kfree_rcu (ictx, rcu);dev_dbg (dev,"%s: iMON context freed\n" , __func__); }
@@ -499,9 +516,6 @@ static int display_open(struct inode *inode, struct file *file)int subminor;int retval =0 ; -/* prevent races with disconnect */ -mutex_lock (&driver_lock); - subminor =iminor (inode); interface =usb_find_interface (&imon_driver, subminor);if (!interface) {
@@ -509,13 +523,16 @@ static int display_open(struct inode *inode, struct file *file) retval = -ENODEV ; goto exit; } - ictx =usb_get_intfdata (interface); -if (!ictx) { +rcu_read_lock (); + ictx =usb_get_intfdata (interface); +if (!ictx || ictx->disconnected || !refcount_inc_not_zero (&ictx->users)) { +rcu_read_unlock ();pr_err ("no context found for minor %d\n" , subminor); retval = -ENODEV ; goto exit; } +rcu_read_unlock ();mutex_lock (&ictx->lock);
@@ -533,8 +550,10 @@ static int display_open(struct inode *inode, struct file *file)mutex_unlock (&ictx->lock); +if (retval &&refcount_dec_and_test (&ictx->users)) +free_imon_context (ictx); + exit: -mutex_unlock (&driver_lock);return retval; }
@@ -544,16 +563,9 @@ static int display_open(struct inode *inode, struct file *file)*/ static int display_close (struct inode *inode,struct file *file) { -struct imon_context *ictx =NULL ; +struct imon_context *ictx = file->private_data;int retval =0 ; - ictx = file->private_data; - -if (!ictx) { -pr_err ("no context for device\n" ); -return -ENODEV ; - } -mutex_lock (&ictx->lock);if (!ictx->display_supported) {
@@ -568,6 +580,8 @@ static int display_close(struct inode *inode, struct file *file) }mutex_unlock (&ictx->lock); +if (refcount_dec_and_test (&ictx->users)) +free_imon_context (ictx);return retval; }
@@ -937,15 +951,12 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,int offset;int seq;int retval =0 ; -struct imon_context *ictx; +struct imon_context *ictx = file->private_data;static const unsigned char vfd_packet6[] = {0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0xFF ,0xFF }; - ictx = file->private_data; -if (!ictx) { -pr_err_ratelimited ("no context for device\n" ); +if (ictx->disconnected)return -ENODEV ; - }mutex_lock (&ictx->lock);
@@ -1021,13 +1032,10 @@ static ssize_t lcd_write(struct file *file, const char __user *buf, size_t n_bytes, loff_t *pos) { int retval = 0; -struct imon_context *ictx; +struct imon_context *ictx = file->private_data; - ictx = file->private_data; -if (!ictx) { -pr_err_ratelimited ("no context for device\n" ); +if (ictx->disconnected)return -ENODEV ; - }mutex_lock (&ictx->lock);
@@ -2405,7 +2413,6 @@ static int imon_probe(struct usb_interface *interface,int ifnum, sysfs_err;int ret =0 ;struct imon_context *ictx =NULL ; -struct imon_context *first_if_ctx =NULL ;u16 vendor, product; usbdev =usb_get_dev (interface_to_usbdev (interface));
@@ -2417,17 +2424,12 @@ static int imon_probe(struct usb_interface *interface,dev_dbg (dev,"%s: found iMON device (%04x:%04x, intf%d)\n" , __func__, vendor, product, ifnum); -/* prevent races probing devices w/multiple interfaces */ -mutex_lock (&driver_lock); - first_if =usb_ifnum_to_if (usbdev,0 );if (!first_if) { ret = -ENODEV ; goto fail; } - first_if_ctx =usb_get_intfdata (first_if); -if (ifnum ==0 ) { ictx =imon_init_intf0 (interface, id);if (!ictx) {
@@ -2435,9 +2437,11 @@ static int imon_probe(struct usb_interface *interface, ret = -ENODEV ; goto fail; } +refcount_set (&ictx->users,1 ); }else {/* this is the secondary interface on the device */ +struct imon_context *first_if_ctx =usb_get_intfdata (first_if);/* fail early if first intf failed to register */ if (!first_if_ctx) {
@@ -2451,14 +2455,13 @@ static int imon_probe(struct usb_interface *interface, ret = -ENODEV ; goto fail; } +refcount_inc (&ictx->users); }usb_set_intfdata (interface, ictx);if (ifnum ==0 ) { -mutex_lock (&ictx->lock); -if (product ==0xffdc && ictx->rf_device) { sysfs_err =sysfs_create_group (&interface->dev.kobj, &imon_rf_attr_group);
@@ -2469,21 +2472,17 @@ static int imon_probe(struct usb_interface *interface,if (ictx->display_supported)imon_init_display (ictx, interface); - -mutex_unlock (&ictx->lock); }dev_info (dev,"iMON device (%04x:%04x, intf%d) on usb<%d:%d> initialized\n" , vendor, product, ifnum, usbdev->bus->busnum, usbdev->devnum); -mutex_unlock (&driver_lock);usb_put_dev (usbdev);return 0 ; fail: -mutex_unlock (&driver_lock);usb_put_dev (usbdev);dev_err (dev,"unable to register, err %d\n" , ret);
@@ -2499,10 +2498,8 @@ static void imon_disconnect(struct usb_interface *interface)struct device *dev;int ifnum; -/* prevent races with multi-interface device probing and display_open */ -mutex_lock (&driver_lock); - ictx =usb_get_intfdata (interface); + ictx->disconnected = true; dev = ictx->dev; ifnum = interface->cur_altsetting->desc.bInterfaceNumber;
@@ -2543,11 +2540,9 @@ static void imon_disconnect(struct usb_interface *interface) } } -if (!ictx->dev_present_intf0 && !ictx->dev_present_intf1) +if (refcount_dec_and_test (&ictx->users))free_imon_context (ictx); -mutex_unlock (&driver_lock); -dev_dbg (dev,"%s: iMON device (intf%d) disconnected\n" , __func__, ifnum); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 80/452 media: cec-adap.c: fix is_configuring state
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 59267fc34f4900dcd2ec3295f6be04b79aee2186 ]
If an adapter is trying to claim a free logical address then it is in the 'is_configuring' state. If during that process the cable is disconnected (HPD goes low, which in turn invalidates the physical address), then cec_adap_unconfigure() is called, and that set the is_configuring boolean to false, even though the thread that's trying to claim an LA is still running.
Don't touch the is_configuring bool in cec_adap_unconfigure(), it will eventually be cleared by the thread. By making that change the cec_config_log_addr() function also had to change: it was aborting if is_configuring became false (since that is what cec_adap_unconfigure() did), but that no longer works. Instead check if the physical address is invalid. That is a much more appropriate check anyway.
This fixes a bug where the the adapter could be disabled even though the device was still configuring. This could cause POLL transmits to time out.
--- drivers/media/cec/core/cec-adap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/cec/core/cec-adap.c +3 -3
@@ -1271,7 +1271,7 @@ static int cec_config_log_addr(struct cec_adapter *adap,* While trying to poll the physical address was reset * and the adapter was unconfigured, so bail out. */ -if (!adap->is_configuring) +if (adap->phys_addr ==CEC_PHYS_ADDR_INVALID )return -EINTR ;if (err)
@@ -1328,7 +1328,6 @@ static void cec_adap_unconfigure(struct cec_adapter *adap) adap->phys_addr != CEC_PHYS_ADDR_INVALID)WARN_ON (adap->ops->adap_log_addr (adap,CEC_LOG_ADDR_INVALID )); adap->log_addrs.log_addr_mask =0 ; - adap->is_configuring = false; adap->is_configured = false;cec_flush (adap);wake_up_interruptible (&adap->kthread_waitq);
@@ -1520,9 +1519,10 @@ static int cec_config_thread_func(void *arg)for (i =0 ; i < las->num_log_addrs; i++) las->log_addr[i] =CEC_LOG_ADDR_INVALID ;cec_adap_unconfigure (adap); + adap->is_configuring = false; adap->kthread_config =NULL ; -mutex_unlock (&adap->lock);complete (&adap->config_completion); +mutex_unlock (&adap->lock);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 81/452 openrisc: start CPU timer early in boot
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit 516dd4aacd67a0f27da94f3fe63fe0f4dbab6e2b ]
In order to measure the boot process, the timer should be switched on as early in boot as possible. As well, the commit defines the get_cycles macro, like the previous patches in this series, so that generic code is aware that it's implemented by the platform, as is done on other archs.
--- arch/openrisc/include/asm/timex.h | 1 + arch/openrisc/kernel/head.S | 9 +++++++++ 2 files changed, 10 insertions(+)
arch/openrisc/include/asm/timex.h +1 -0
@@ -23,6 +23,7 @@ static inline cycles_t get_cycles(void) {return mfspr (SPR_TTCR ); } +#define get_cycles get_cycles/* This isn't really used any more */ #define CLOCK_TICK_RATE 1000
arch/openrisc/kernel/head.S +9 -0
@@ -521,6 +521,15 @@ _start: l.ori r3,r0,0x1 l.mtspr r0,r3,SPR_SR + /* + * Start the TTCR as early as possible, so that the RNG can make use of + * measurements of boot time from the earliest opportunity. Especially + * important is that the TTCR does not return zero by the time we reach + * rand_initialize(). + */ + l.movhi r3,hi(SPR_TTMR_CR) + l.mtspr r0,r3,SPR_TTMR + CLEAR_GPR(r1) CLEAR_GPR(r2) CLEAR_GPR(r3)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 82/452 nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
In reply to Greg Kroah-HartmanFrom: Smith, Kyle Miller (Nimble Kernel) <[email protected]>
[ Upstream commit da42761181627e9bdc37d18368b827948a583929 ]
In nvme_alloc_admin_tags, the admin_q can be set to an error (typically -ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which is checked immediately after the call. However, when we return the error message up the stack, to nvme_reset_work the error takes us to nvme_remove_dead_ctrl()
nvme_dev_disable()
nvme_suspend_queue(&dev->queues[0]).
Here, we only check that the admin_q is non-NULL, rather than not an error or NULL, and begin quiescing a queue that never existed, leading to bad / NULL pointer dereference.
--- drivers/nvme/host/pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/host/pci.c +1 -0
@@ -1666,6 +1666,7 @@ static int nvme_alloc_admin_tags(struct nvme_dev *dev) dev->ctrl.admin_q =blk_mq_init_queue (&dev->admin_tagset);if (IS_ERR (dev->ctrl.admin_q)) {blk_mq_free_tag_set (&dev->admin_tagset); + dev->ctrl.admin_q =NULL ;return -ENOMEM ; }if (!blk_get_queue (dev->ctrl.admin_q)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 83/452 ASoC: rt5645: Fix errorenous cleanup order
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 2def44d3aec59e38d2701c568d65540783f90f2f ]
There is a logic error when removing rt5645 device as the function rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and delete the &rt5645->btn_check_timer latter. However, since the timer handler rt5645_btn_check_callback() will re-queue the jack_detect_work, this cleanup order is buggy.
That is, once the del_timer_sync in rt5645_i2c_remove is concurrently run with the rt5645_btn_check_callback, the canceled jack_detect_work will be rescheduled again, leading to possible use-after-free.
This patch fix the issue by placing the del_timer_sync function before the cancel_delayed_work_sync.
--- sound/soc/codecs/rt5645.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5645.c +6 -1
@@ -4095,9 +4095,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c)if (i2c->irq)free_irq (i2c->irq, rt5645); +/* +* Since the rt5645_btn_check_callback() can queue jack_detect_work, +* the timer need to be delted first +*/ +del_timer_sync (&rt5645->btn_check_timer); +cancel_delayed_work_sync (&rt5645->jack_detect_work);cancel_delayed_work_sync (&rt5645->rcclock_work); -del_timer_sync (&rt5645->btn_check_timer);regulator_bulk_disable (ARRAY_SIZE (rt5645->supplies), rt5645->supplies);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 84/452 nbd: Fix hung on disconnect request if socket is closed before
In reply to Greg Kroah-HartmanFrom: Xie Yongji <[email protected]>
[ Upstream commit 491bf8f236fdeec698fa6744993f1ecf3fafd1a5 ]
When userspace closes the socket before sending a disconnect request, the following I/O requests will be blocked in wait_for_reconnect() until dead timeout. This will cause the following disconnect request also hung on blk_mq_quiesce_queue(). That means we have no way to disconnect a nbd device if there are some I/O requests waiting for reconnecting until dead timeout. It's not expected. So let's wake up the thread waiting for reconnecting directly when a disconnect request is sent.
--- drivers/block/nbd.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/block/nbd.c +9 -4
@@ -880,11 +880,15 @@ static int wait_for_reconnect(struct nbd_device *nbd)struct nbd_config *config = nbd->config;if (!config->dead_conn_timeout)return 0 ; -if (test_bit (NBD_RT_DISCONNECTED , &config->runtime_flags)) + +if (!wait_event_timeout (config->conn_wait, +test_bit (NBD_RT_DISCONNECTED , + &config->runtime_flags) || +atomic_read (&config->live_connections) >0 , + config->dead_conn_timeout))return 0 ; -return wait_event_timeout (config->conn_wait, -atomic_read (&config->live_connections) >0 , - config->dead_conn_timeout) >0 ; + +return !test_bit (NBD_RT_DISCONNECTED , &config->runtime_flags); }static int nbd_handle_cmd (struct nbd_cmd *cmd,int index)
@@ -2029,6 +2033,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd)mutex_lock (&nbd->config_lock);nbd_disconnect (nbd);sock_shutdown (nbd); +wake_up (&nbd->config->conn_wait);/* * Make sure recv thread has finished, so it does not drop the last * config ref and try to destroy the workqueue from inside the work
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 85/452 net: phy: micrel: Allow probing without .driver_data
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit f2ef6f7539c68c6bd6c32323d8845ee102b7c450 ]
Currently, if the .probe element is present in the phy_driver structure and the .driver_data is not, a NULL pointer dereference happens.
Allow passing .probe without .driver_data by inserting NULL checks for priv->type.
--- drivers/net/phy/micrel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/phy/micrel.c +6 -5
@@ -283,7 +283,7 @@ static int kszphy_config_reset(struct phy_device *phydev) } } -if (priv->led_mode >=0 ) +if (priv->type && priv->led_mode >=0 )kszphy_setup_led (phydev, priv->type->led_mode_reg, priv->led_mode);return 0 ;
@@ -299,10 +299,10 @@ static int kszphy_config_init(struct phy_device *phydev) type = priv->type; -if (type->has_broadcast_disable) +if (type && type->has_broadcast_disable)kszphy_broadcast_disable (phydev); -if (type->has_nand_tree_disable) +if (type && type->has_nand_tree_disable)kszphy_nand_tree_disable (phydev);return kszphy_config_reset (phydev);
@@ -1112,7 +1112,7 @@ static int kszphy_probe(struct phy_device *phydev) priv->type = type; -if (type->led_mode_reg) { +if (type && type->led_mode_reg) { ret =of_property_read_u32 (np,"micrel,led-mode" , &priv->led_mode);if (ret)
@@ -1133,7 +1133,8 @@ static int kszphy_probe(struct phy_device *phydev)unsigned long rate =clk_get_rate (clk);bool rmii_ref_clk_sel_25_mhz; - priv->rmii_ref_clk_sel = type->has_rmii_ref_clk_sel; +if (type) + priv->rmii_ref_clk_sel = type->has_rmii_ref_clk_sel; rmii_ref_clk_sel_25_mhz =of_property_read_bool (np,"micrel,rmii-reference-clock-select-25-mhz" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 86/452 media: exynos4-is: Fix compile warning
In reply to Greg Kroah-HartmanFrom: Kwanghoon Son <[email protected]>
[ Upstream commit e080f5c1f2b6d02c02ee5d674e0e392ccf63bbaf ]
Declare static on function 'fimc_isp_video_device_unregister'.
When VIDEO_EXYNOS4_ISP_DMA_CAPTURE=n, compiler warns about
warning: no previous prototype for function [-Wmissing-prototypes]
--- drivers/media/platform/exynos4-is/fimc-isp-video.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/exynos4-is/fimc-isp-video.h +1 -1
@@ -32,7 +32,7 @@ static inline int fimc_isp_video_device_register(struct fimc_isp *isp,return 0 ; } -void fimc_isp_video_device_unregister (struct fimc_isp *isp, +static inline void fimc_isp_video_device_unregister (struct fimc_isp *isp,enum v4l2_buf_type type) { }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 87/452 ASoC: max98357a: remove dependency on GPIOLIB
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 21ca3274333f5c1cbbf9d91e5b33f4f2463859b2 ]
commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a series of unnecessary dependencies on GPIOLIB when the gpio was optional.
A similar simplification seems valid for max98357a, so remove the dependency as well. This will avoid the following warning
WARNING: unmet direct dependencies detected for SND_SOC_MAX98357A
Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && GPIOLIB [=n]
Selected by [y]:
- SND_SOC_INTEL_SOF_CS42L42_MACH [=y] && SOUND [=y] && !UML &&
SND [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] &&
(SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C
[=y] && ACPI [=y] && SND_HDA_CODEC_HDMI [=y] &&
SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] ||
COMPILE_TEST [=n])--- sound/soc/codecs/Kconfig | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/Kconfig +0 -1
@@ -857,7 +857,6 @@ config SND_SOC_MAX98095 config SND_SOC_MAX98357A tristate "Maxim MAX98357A CODEC" - depends on GPIOLIB config SND_SOC_MAX98371 tristate
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 88/452 ASoC: rt1015p: remove dependency on GPIOLIB
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit b390c25c6757b9d56cecdfbf6d55f15fc89a6386 ]
commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a series of unnecessary dependencies on GPIOLIB when the gpio was optional.
A similar simplification seems valid for rt1015p, so remove the dependency as well. This will avoid the following warning
WARNING: unmet direct dependencies detected for SND_SOC_RT1015P
Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] &&
GPIOLIB [=n]
Selected by [y]:
- SND_SOC_INTEL_SOF_RT5682_MACH [=y] && SOUND [=y] && !UML && SND
[=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] &&
(SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C
[=y] && ACPI [=y] && (SND_HDA_CODEC_HDMI [=y] &&
SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] ||
COMPILE_TEST [=y]) || SND_SOC_SOF_BAYTRAIL [=n] &&
(X86_INTEL_LPSS [=n] || COMPILE_TEST [=y]))--- sound/soc/codecs/Kconfig | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/Kconfig +0 -1
@@ -1098,7 +1098,6 @@ config SND_SOC_RT1015 config SND_SOC_RT1015P tristate - depends on GPIOLIB config SND_SOC_RT1305 tristate
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 89/452 can: mcp251xfd: silence clangs -Wunaligned-access warning
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit 1a6dd9996699889313327be03981716a8337656b ]
clang emits a -Wunaligned-access warning on unionmcp251xfd_tx_ojb_load_buf.
The reason is that field hw_tx_obj (not declared as packed) is being packed right after a 16 bits field inside a packed struct:
| union mcp251xfd_tx_obj_load_buf {
| struct __packed {
| struct mcp251xfd_buf_cmd cmd;
| /* ^ 16 bits fields */
| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj;
| /* ^ not declared as packed */
| } nocrc;
| struct __packed {
| struct mcp251xfd_buf_cmd_crc cmd;
| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj;
| __be16 crc;
| } crc;
| } ____cacheline_aligned;Starting from LLVM 14, having an unpacked struct nested in a packed struct triggers a warning. c.f. [1].
This is a false positive because the field is always being accessed with the relevant put_unaligned_*() function. Adding __packed to the structure declaration silences the warning.
[1] https://github.com/llvm/llvm-project/issues/55520
--- drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/spi/mcp251xfd/mcp251xfd.h +1 -1
@@ -426,7 +426,7 @@ struct mcp251xfd_hw_tef_obj {/* The tx_obj_raw version is used in spi async, i.e. without * regmap. We have to take care of endianness ourselves. */ -struct mcp251xfd_hw_tx_obj_raw { +struct __packed mcp251xfd_hw_tx_obj_raw {__le32 id;__le32 flags; u8 data[sizeof_field(struct canfd_frame, data)];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 90/452 x86/microcode: Add explicit CPU vendor dependency
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
[ Upstream commit 9c55d99e099bd7aa6b91fce8718505c35d5dfc65 ]
Add an explicit dependency to the respective CPU vendor so that the respective microcode support for it gets built only when that support is enabled.
--- arch/x86/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/Kconfig +2 -2
@@ -1321,7 +1321,7 @@ config MICROCODE config MICROCODE_INTEL bool "Intel microcode loading support" - depends on MICROCODE + depends on CPU_SUP_INTEL && MICROCODE default MICROCODE help This options enables microcode patch loading support for Intel
@@ -1333,7 +1333,7 @@ config MICROCODE_INTEL config MICROCODE_AMD bool "AMD microcode loading support" - depends on MICROCODE + depends on CPU_SUP_AMD && MICROCODE help If you select this option, microcode patch loading support for AMD processors will be enabled.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 91/452 m68k: atari: Make Atari ROM port I/O write macros return void
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 30b5e6ef4a32ea4985b99200e06d6660a69f9246 ]
The macros implementing Atari ROM port I/O writes do not cast away their output, unlike similar implementations for other I/O buses. When they are combined using conditional expressions in the definitions of outb() and friends, this triggers sparse warnings like:
drivers/net/appletalk/cops.c:382:17: error: incompatible types in conditional expression (different base types):
drivers/net/appletalk/cops.c:382:17: unsigned char
drivers/net/appletalk/cops.c:382:17: void
Fix this by adding casts to "void".
--- arch/m68k/include/asm/raw_io.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/m68k/include/asm/raw_io.h +3 -3
@@ -80,14 +80,14 @@ ({ u16 __v = le16_to_cpu(*(__force volatile u16 *) (addr)); __v; })#define rom_out_8 (addr, b) \ - ({u8 __maybe_unused __w, __v = (b); u32 _addr = ((u32) (addr)); \ + (void)({u8 __maybe_unused __w, __v = (b); u32 _addr = ((u32) (addr)); \ __w = ((*(__force volatile u8 *) ((_addr | 0x10000) + (__v<<1)))); })#define rom_out_be16 (addr, w) \ - ({u16 __maybe_unused __w, __v = (w); u32 _addr = ((u32) (addr)); \ + (void)({u16 __maybe_unused __w, __v = (w); u32 _addr = ((u32) (addr)); \ __w = ((*(__force volatile u16 *) ((_addr & 0xFFFF0000UL) + ((__v & 0xFF)<<1)))); \ __w = ((*(__force volatile u16 *) ((_addr | 0x10000) + ((__v >> 8)<<1)))); })#define rom_out_le16 (addr, w) \ - ({u16 __maybe_unused __w, __v = (w); u32 _addr = ((u32) (addr)); \ + (void)({u16 __maybe_unused __w, __v = (w); u32 _addr = ((u32) (addr)); \ __w = ((*(__force volatile u16 *) ((_addr & 0xFFFF0000UL) + ((__v >> 8)<<1)))); \ __w = ((*(__force volatile u16 *) ((_addr | 0x10000) + ((__v & 0xFF)<<1)))); })
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 92/452 rxrpc: Return an error to sendmsg if call failed
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 4ba68c5192554876bd8c3afd904e3064d2915341 ]
If at the end of rxrpc sendmsg() or rxrpc_kernel_send_data() the call that was being given data was aborted remotely or otherwise failed, return an error rather than returning the amount of data buffered for transmission.
The call (presumably) did not complete, so there's not much point continuing with it. AF_RXRPC considers it "complete" and so will be unwilling to do anything else with it - and won't send a notification for it, deeming the return from sendmsg sufficient.
Not returning an error causes afs to incorrectly handle a StoreData operation that gets interrupted by a change of address due to NAT reconfiguration.
This doesn't normally affect most operations since their request parameters tend to fit into a single UDP packet and afs_make_call() returns before the server responds; StoreData is different as it involves transmission of a lot of data.
This can be triggered on a client by doing something like:
dd if=/dev/zero of=/afs/example.com/foo bs=1M count=512
at one prompt, and then changing the network address at another prompt, e.g.:
ifconfig enp6s0 inet 192.168.6.2 && route add 192.168.6.1 dev enp6s0
Tracing packets on an Auristor fileserver looks something like:
192.168.6.1 -> 192.168.6.3 RX 107 ACK Idle Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 192.168.6.3 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(64538) (64538) 192.168.6.3 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(64538) (64538) 192.168.6.1 -> 192.168.6.3 RX 107 ACK Idle Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 <ARP exchange for 192.168.6.2> 192.168.6.2 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(0) (0) 192.168.6.2 -> 192.168.6.1 AFS (RX) 1482 FS Request: Unknown(0) (0) 192.168.6.1 -> 192.168.6.2 RX 107 ACK Exceeds Window Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 192.168.6.1 -> 192.168.6.2 RX 74 ABORT Seq: 0 Call: 4 Source Port: 7000 Destination Port: 7001 192.168.6.1 -> 192.168.6.2 RX 74 ABORT Seq: 29321 Call: 4 Source Port: 7000 Destination Port: 7001
The Auristor fileserver logs code -453 (RXGEN_SS_UNMARSHAL), but the abort code received by kafs is -5 (RX_PROTOCOL_ERROR) as the rx layer sees the condition and generates an abort first and the unmarshal error is a consequence of that at the application layer.
--- net/rxrpc/sendmsg.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/rxrpc/sendmsg.c +6 -0
@@ -461,6 +461,12 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, success: ret = copied; +if (READ_ONCE (call->state) ==RXRPC_CALL_COMPLETE ) { +read_lock_bh (&call->state_lock); +if (call->error <0 ) + ret = call->error; +read_unlock_bh (&call->state_lock); + } out: call->tx_pending = skb;_leave (" = %d" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 93/452 rxrpc, afs: Fix selection of abort codes
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit de696c4784f0706884458893c5a6c39b3a3ff65c ]
The RX_USER_ABORT code should really only be used to indicate that the user of the rxrpc service (ie. userspace) implicitly caused a call to be aborted
- for instance if the AF_RXRPC socket is closed whilst the call was in progress. (The user may also explicitly abort a call and specify the abort code to use).
Change some of the points of generation to use other abort codes instead:
(1) Abort the call with RXGEN_SS_UNMARSHAL or RXGEN_CC_UNMARSHAL if we see ENOMEM and EFAULT during received data delivery and abort with RX_CALL_DEAD in the default case.
(2) Abort with RXGEN_SS_MARSHAL if we get ENOMEM whilst trying to send a reply.
(3) Abort with RX_CALL_DEAD if we stop hearing from the peer if we had heard from the peer and abort with RX_CALL_TIMEOUT if we hadn't.
(4) Abort with RX_CALL_DEAD if we try to disconnect a call that's not completed successfully or been aborted.
--- fs/afs/rxrpc.c | 8 +++++--- net/rxrpc/call_event.c | 4 ++-- net/rxrpc/conn_object.c | 2 +- 3 files changed, 8 insertions(+), 6 deletions(-)
fs/afs/rxrpc.c +5 -3
@@ -572,6 +572,8 @@ static void afs_deliver_to_call(struct afs_call *call)case -ENODATA :case -EBADMSG :case -EMSGSIZE : +case -ENOMEM : +case -EFAULT : abort_code =RXGEN_CC_UNMARSHAL ;if (state !=AFS_CALL_CL_AWAIT_REPLY ) abort_code =RXGEN_SS_UNMARSHAL ;
@@ -579,7 +581,7 @@ static void afs_deliver_to_call(struct afs_call *call) abort_code, ret, "KUM"); goto local_abort;default : - abort_code =RX_USER_ABORT ; + abort_code =RX_CALL_DEAD ;rxrpc_kernel_abort_call (call->net->socket, call->rxcall, abort_code, ret,"KER" ); goto local_abort;
@@ -871,7 +873,7 @@ void afs_send_empty_reply(struct afs_call *call)case -ENOMEM :_debug ("oom" );rxrpc_kernel_abort_call (net->socket, call->rxcall, -RX_USER_ABORT , -ENOMEM ,"KOO" ); +RXGEN_SS_MARSHAL , -ENOMEM ,"KOO" ); fallthrough;default :_leave (" [error]" );
@@ -913,7 +915,7 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)if (n == -ENOMEM ) {_debug ("oom" );rxrpc_kernel_abort_call (net->socket, call->rxcall, -RX_USER_ABORT , -ENOMEM ,"KOO" ); +RXGEN_SS_MARSHAL , -ENOMEM ,"KOO" ); }_leave (" [error]" ); }
net/rxrpc/call_event.c +2 -2
@@ -377,9 +377,9 @@ void rxrpc_process_call(struct work_struct *work)if (test_bit (RXRPC_CALL_RX_HEARD , &call->flags) && (int )call->conn->hi_serial - (int )call->rx_serial >0 ) {trace_rxrpc_call_reset (call); -rxrpc_abort_call ("EXP" , call,0 ,RX_USER_ABORT , -ECONNRESET ); +rxrpc_abort_call ("EXP" , call,0 ,RX_CALL_DEAD , -ECONNRESET ); }else { -rxrpc_abort_call ("EXP" , call,0 ,RX_USER_ABORT , -ETIME ); +rxrpc_abort_call ("EXP" , call,0 ,RX_CALL_TIMEOUT , -ETIME ); }set_bit (RXRPC_CALL_EV_ABORT , &call->events); goto recheck_state;
net/rxrpc/conn_object.c +1 -1
@@ -184,7 +184,7 @@ void __rxrpc_disconnect_call(struct rxrpc_connection *conn, chan->last_type =RXRPC_PACKET_TYPE_ABORT ;break ;default : - chan->last_abort =RX_USER_ABORT ; + chan->last_abort =RX_CALL_DEAD ; chan->last_type =RXRPC_PACKET_TYPE_ABORT ;break ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 94/452 eth: tg3: silence the GCC 12 array-bounds warning
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 9dec850fd7c210a04b4707df8e6c95bfafdd6a4b ]
GCC 12 currently generates a rather inconsistent warning:
drivers/net/ethernet/broadcom/tg3.c:17795:51: warning: array subscript 5 is above array bounds of ‘struct tg3_napi[5]’ [-Warray-bounds]
17795 | struct tg3_napi *tnapi = &tp->napi[i];
| ~~~~~~~~^~~
i is guaranteed < tp->irq_max which in turn is either 1 or 5. There are more loops like this one in the driver, but strangely GCC 12 dislikes only this single one.
Silence this silliness for now.
--- drivers/net/ethernet/broadcom/Makefile | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/broadcom/Makefile +5 -0
@@ -16,3 +16,8 @@ obj-$(CONFIG_BGMAC_BCMA) += bgmac-bcma.o bgmac-bcma-mdio.o obj-$(CONFIG_BGMAC_PLATFORM) += bgmac-platform.o obj-$(CONFIG_SYSTEMPORT) += bcmsysport.o obj-$(CONFIG_BNXT) += bnxt/ + +# FIXME: temporarily silence -Warray-bounds on non W=1+ builds +ifndef KBUILD_EXTRA_WARN +CFLAGS_tg3.o += -Wno-array-bounds +endif
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 95/452 selftests/bpf: fix btf_dump/btf_dump due to recent clang change
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 4050764cbaa25760aab40857f723393c07898474 ]
Latest llvm-project upstream had a change of behavior related to qualifiers on function return type ([1]). This caused selftests btf_dump/btf_dump failure. The following example shows what changed.
$ cat t.c
typedef const char * const (* const (* const fn_ptr_arr2_t[5])())(char * (*)(int));
struct t {
int a;
fn_ptr_arr2_t l;
};
int foo(struct t *arg) {
return arg->a;
}Compiled with latest upstream llvm15,
$ clang -O2 -g -target bpf -S -emit-llvm t.c
The related generated debuginfo IR looks like:
!16 = !DIDerivedType(tag: DW_TAG_typedef, name: "fn_ptr_arr2_t", file: !1, line: 1, baseType: !17)
!17 = !DICompositeType(tag: DW_TAG_array_type, baseType: !18, size: 320, elements: !32)
!18 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !19)
!19 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !20, size: 64)
!20 = !DISubroutineType(types: !21)
!21 = !{!22, null}
!22 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !23, size: 64)
!23 = !DISubroutineType(types: !24)
!24 = !{!25, !28}
!25 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !26, size: 64)
!26 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !27)
!27 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char)
You can see two intermediate const qualifier to pointer are dropped in debuginfo IR.With llvm14, we have following debuginfo IR:
!16 = !DIDerivedType(tag: DW_TAG_typedef, name: "fn_ptr_arr2_t", file: !1, line: 1, baseType: !17) !17 = !DICompositeType(tag: DW_TAG_array_type, baseType: !18, size: 320, elements: !34) !18 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !19)
!19 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !20, size: 64)
!20 = !DISubroutineType(types: !21)
!21 = !{!22, null}
!22 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !23)
!23 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !24, size: 64)
!24 = !DISubroutineType(types: !25)
!25 = !{!26, !30}
!26 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !27)
!27 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !28, size: 64)
!28 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !29)
!29 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char)
All const qualifiers are preserved.
To adapt the selftest to both old and new llvm, this patch removed the intermediate const qualifier in const-to-ptr types, to make the test succeed again.
[1] https://reviews.llvm.org/D125919
--- tools/testing/selftests/bpf/progs/btf_dump_test_case_syntax.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/progs/btf_dump_test_case_syntax.c +1 -1
@@ -94,7 +94,7 @@ typedef void (* (*signal_t)(int, void (*)(int)))(int);typedef char * (*fn_ptr_arr1_t [10 ])(int **); -typedef char * (*const (*const fn_ptr_arr2_t [5 ])())(char * (*)(int )); +typedef char * (* (*const fn_ptr_arr2_t [5 ])())(char * (*)(int ));struct struct_w_typedefs {int_t a;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 96/452 gfs2: use i_lock spin_lock for inode qadata
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit 5fcff61eea9efd1f4b60e89d2d686b5feaea100f ]
Before this patch, functions gfs2_qa_get and _put used the i_rw_mutex to prevent simultaneous access to its i_qadata. But i_rw_mutex is now used for many other things, including iomap_begin and end, which causes a conflict according to lockdep. We cannot just remove the lock since simultaneous opens (gfs2_open -> gfs2_open_common -> gfs2_qa_get) can then stomp on each others values for i_qadata.
This patch solves the conflict by using the i_lock spin_lock in the inode to prevent simultaneous access.
--- fs/gfs2/quota.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-)
fs/gfs2/quota.c +20 -12
@@ -531,34 +531,42 @@ static void qdsb_put(struct gfs2_quota_data *qd)*/ int gfs2_qa_get (struct gfs2_inode *ip) { -int error =0 ;struct gfs2_sbd *sdp =GFS2_SB (&ip->i_inode); +struct inode *inode = &ip->i_inode;if (sdp->sd_args.ar_quota ==GFS2_QUOTA_OFF )return 0 ; -down_write (&ip->i_rw_mutex); +spin_lock (&inode->i_lock);if (ip->i_qadata ==NULL ) { - ip->i_qadata =kmem_cache_zalloc (gfs2_qadata_cachep,GFP_NOFS ); -if (!ip->i_qadata) { - error = -ENOMEM ; - goto out; - } +struct gfs2_qadata *tmp; + +spin_unlock (&inode->i_lock); + tmp =kmem_cache_zalloc (gfs2_qadata_cachep,GFP_NOFS ); +if (!tmp) +return -ENOMEM ; + +spin_lock (&inode->i_lock); +if (ip->i_qadata ==NULL ) + ip->i_qadata = tmp; +else +kmem_cache_free (gfs2_qadata_cachep, tmp); } ip->i_qadata->qa_ref++; -out: -up_write (&ip->i_rw_mutex); -return error; +spin_unlock (&inode->i_lock); +return 0 ; }void gfs2_qa_put (struct gfs2_inode *ip) { -down_write (&ip->i_rw_mutex); +struct inode *inode = &ip->i_inode; + +spin_lock (&inode->i_lock);if (ip->i_qadata && --ip->i_qadata->qa_ref ==0 ) {kmem_cache_free (gfs2_qadata_cachep, ip->i_qadata); ip->i_qadata =NULL ; } -up_write (&ip->i_rw_mutex); +spin_unlock (&inode->i_lock); }int gfs2_quota_hold (struct gfs2_inode *ip,kuid_t uid,kgid_t gid)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 97/452 IB/rdmavt: add missing locks in rvt_ruc_loopback
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 22cbc6c2681a0a4fe76150270426e763d52353a4 ]
The documentation of the function rvt_error_qp says both r_lock and s_lock need to be held when calling that function.
It also asserts using lockdep that both of those locks are held. rvt_error_qp is called form rvt_send_cq, which is called from rvt_qp_complete_swqe, which is called from rvt_send_complete, which is called from rvt_ruc_loopback in two places. Both of these places do not hold r_lock. Fix this by acquiring a spin_lock of r_lock in both of these places.
The r_lock acquiring cannot be added in rvt_qp_complete_swqe because some of its other callers already have r_lock acquired.
--- drivers/infiniband/sw/rdmavt/qp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rdmavt/qp.c +5 -1
@@ -2826,7 +2826,7 @@ void rvt_qp_iter(struct rvt_dev_info *rdi,EXPORT_SYMBOL (rvt_qp_iter);/* -* This should be called with s_lock held. +* This should be called with s_lock and r_lock held. */ void rvt_send_complete (struct rvt_qp *qp,struct rvt_swqe *wqe,enum ib_wc_status status)
@@ -3185,7 +3185,9 @@ void rvt_ruc_loopback(struct rvt_qp *sqp) rvp->n_loop_pkts++; flush_send: sqp->s_rnr_retry = sqp->s_rnr_retry_cnt; +spin_lock (&sqp->r_lock);rvt_send_complete (sqp, wqe, send_status); +spin_unlock (&sqp->r_lock);if (local_ops) {atomic_dec (&sqp->local_ops_pending); local_ops =0 ;
@@ -3239,7 +3241,9 @@ void rvt_ruc_loopback(struct rvt_qp *sqp)spin_unlock_irqrestore (&qp->r_lock, flags); serr_no_r_lock:spin_lock_irqsave (&sqp->s_lock, flags); +spin_lock (&sqp->r_lock);rvt_send_complete (sqp, wqe, send_status); +spin_unlock (&sqp->r_lock);if (sqp->ibqp.qp_type ==IB_QPT_RC ) {int lastwqe;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 98/452 ARM: dts: ox820: align interrupt controller node name with dtschema
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fbcd5ad7a419ad40644a0bb8b4152bc660172d8a ]
Fixes dtbs_check warnings like:
gic@1000: $nodename:0: 'gic@1000' does not match '^interrupt-controller(@[0-9a-f,]+)*$'
--- arch/arm/boot/dts/ox820.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/ox820.dtsi +1 -1
@@ -287,7 +287,7 @@ clocks = <&armclk>; }; - gic: gic@1000 { + gic: interrupt-controller@1000 { compatible = "arm,arm11mp-gic"; interrupt-controller; #interrupt-cells = <3>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 99/452 ARM: dts: s5pv210: align DMA channels with dtschema
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 9e916fb9bc3d16066286f19fc9c51d26a6aec6bd ]
dtschema expects DMA channels in specific order (tx, rx and tx-sec). The order actually should not matter because dma-names is used however let's make it aligned with dtschema to suppress warnings like:
i2s@eee30000: dma-names: ['rx', 'tx', 'tx-sec'] is not valid under any of the given schemas
--- arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- arch/arm/boot/dts/s5pv210.dtsi | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-)
arch/arm/boot/dts/s5pv210-aries.dtsi +1 -1
@@ -637,7 +637,7 @@ }; &i2s0 { - dmas = <&pdma0 9>, <&pdma0 10>, <&pdma0 11>; + dmas = <&pdma0 10>, <&pdma0 9>, <&pdma0 11>; status = "okay"; };
arch/arm/boot/dts/s5pv210.dtsi +6 -6
@@ -240,8 +240,8 @@ reg = <0xeee30000 0x1000>; interrupt-parent = <&vic2>; interrupts = <16>; - dma-names = "rx", "tx", "tx-sec"; - dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; + dma-names = "tx", "rx", "tx-sec"; + dmas = <&pdma1 10>, <&pdma1 9>, <&pdma1 11>; clock-names = "iis", "i2s_opclk0", "i2s_opclk1";
@@ -260,8 +260,8 @@ reg = <0xe2100000 0x1000>; interrupt-parent = <&vic2>; interrupts = <17>; - dma-names = "rx", "tx"; - dmas = <&pdma1 12>, <&pdma1 13>; + dma-names = "tx", "rx"; + dmas = <&pdma1 13>, <&pdma1 12>; clock-names = "iis", "i2s_opclk0"; clocks = <&clocks CLK_I2S1>, <&clocks SCLK_AUDIO1>; pinctrl-names = "default";
@@ -275,8 +275,8 @@ reg = <0xe2a00000 0x1000>; interrupt-parent = <&vic2>; interrupts = <18>; - dma-names = "rx", "tx"; - dmas = <&pdma1 14>, <&pdma1 15>; + dma-names = "tx", "rx"; + dmas = <&pdma1 15>, <&pdma1 14>; clock-names = "iis", "i2s_opclk0"; clocks = <&clocks CLK_I2S2>, <&clocks SCLK_AUDIO2>; pinctrl-names = "default";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 100/452 arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit 1ae438d26b620979ed004d559c304d31c42173ae ]
MSM8994 actually features 24 DMA channels for each BLSP, fix it!
--- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/msm8994.dtsi +2 -2
@@ -316,7 +316,7 @@ #dma-cells = <1>; qcom,ee = <0>; qcom,controlled-remotely; - num-channels = <18>; + num-channels = <24>; qcom,num-ees = <4>; };
@@ -412,7 +412,7 @@ #dma-cells = <1>; qcom,ee = <0>; qcom,controlled-remotely; - num-channels = <18>; + num-channels = <24>; qcom,num-ees = <4>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 101/452 PM / devfreq: rk3399_dmc: Disable edev on remove()
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit 2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804 ]
Otherwise we hit an unablanced enable-count when unbinding the DFI device:
[ 1279.659119] ------------[ cut here ]------------ [ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c ... [ 1279.659352] Hardware name: Google Kevin (DT) [ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 ... [ 1279.659571] Call trace: [ 1279.659582] devfreq_event_remove_edev+0x84/0x8c [ 1279.659590] devm_devfreq_event_release+0x1c/0x28 [ 1279.659602] release_nodes+0x1cc/0x244 [ 1279.659611] devres_release_all+0x44/0x60 [ 1279.659621] device_release_driver_internal+0x11c/0x1ac [ 1279.659629] device_driver_detach+0x20/0x2c [ 1279.659641] unbind_store+0x7c/0xb0 [ 1279.659650] drv_attr_store+0x2c/0x40 [ 1279.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4 [ 1279.659693] ksys_write+0x80/0xec [ 1279.659701] __arm64_sys_write+0x24/0x30 [ 1279.659714] el0_svc_common+0xf0/0x1d8 [ 1279.659724] do_el0_svc_compat+0x28/0x3c [ 1279.659738] el0_svc_compat+0x10/0x1c [ 1279.659746] el0_sync_compat_handler+0xa8/0xcc [ 1279.659758] el0_sync_compat+0x188/0x1c0 [ 1279.659768] ---[ end trace cec200e5094155b4 ]---
--- drivers/devfreq/rk3399_dmc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/devfreq/rk3399_dmc.c +2 -0
@@ -485,6 +485,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev) {struct rk3399_dmcfreq *dmcfreq =dev_get_drvdata (&pdev->dev); +devfreq_event_disable_edev (dmcfreq->edev); +/* * Before remove the opp table we need to unregister the opp notifier. */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 102/452 crypto: ccree - use fine grained DMA mapping dir
In reply to Greg Kroah-HartmanFrom: Gilad Ben-Yossef <[email protected]>
[ Upstream commit a260436c98171cd825955a84a7f6e62bc8f4f00d ]
Use a fine grained specification of DMA mapping directions in certain cases, allowing both a more optimized operation as well as shushing out a harmless, though persky dma-debug warning.
--- drivers/crypto/ccree/cc_buffer_mgr.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
drivers/crypto/ccree/cc_buffer_mgr.c +15 -12
@@ -356,12 +356,14 @@ void cc_unmap_cipher_request(struct device *dev, void *ctx, req_ctx->mlli_params.mlli_dma_addr); } -dma_unmap_sg (dev, src, req_ctx->in_nents,DMA_BIDIRECTIONAL ); -dev_dbg (dev,"Unmapped req->src=%pK\n" ,sg_virt (src)); -if (src != dst) { -dma_unmap_sg (dev, dst, req_ctx->out_nents,DMA_BIDIRECTIONAL ); +dma_unmap_sg (dev, src, req_ctx->in_nents,DMA_TO_DEVICE ); +dma_unmap_sg (dev, dst, req_ctx->out_nents,DMA_FROM_DEVICE );dev_dbg (dev,"Unmapped req->dst=%pK\n" ,sg_virt (dst)); +dev_dbg (dev,"Unmapped req->src=%pK\n" ,sg_virt (src)); + }else { +dma_unmap_sg (dev, src, req_ctx->in_nents,DMA_BIDIRECTIONAL ); +dev_dbg (dev,"Unmapped req->src=%pK\n" ,sg_virt (src)); } }
@@ -377,6 +379,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx,u32 dummy =0 ;int rc =0 ;u32 mapped_nents =0 ; +int src_direction = (src != dst ?DMA_TO_DEVICE :DMA_BIDIRECTIONAL ); req_ctx->dma_buf_type =CC_DMA_BUF_DLLI ; mlli_params->curr_pool =NULL ;
@@ -399,7 +402,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, }/* Map the src SGL */ - rc =cc_map_sg (dev, src, nbytes,DMA_BIDIRECTIONAL , &req_ctx->in_nents, + rc =cc_map_sg (dev, src, nbytes, src_direction, &req_ctx->in_nents,LLI_MAX_NUM_OF_DATA_ENTRIES , &dummy, &mapped_nents);if (rc) goto cipher_exit;
@@ -416,7 +419,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, } }else {/* Map the dst sg */ - rc =cc_map_sg (dev, dst, nbytes,DMA_BIDIRECTIONAL , + rc =cc_map_sg (dev, dst, nbytes,DMA_FROM_DEVICE , &req_ctx->out_nents,LLI_MAX_NUM_OF_DATA_ENTRIES , &dummy, &mapped_nents);if (rc)
@@ -456,6 +459,7 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)struct aead_req_ctx *areq_ctx =aead_request_ctx (req);unsigned int hw_iv_size = areq_ctx->hw_iv_size;struct cc_drvdata *drvdata =dev_get_drvdata (dev); +int src_direction = (req->src != req->dst ?DMA_TO_DEVICE :DMA_BIDIRECTIONAL );if (areq_ctx->mac_buf_dma_addr) { dma_unmap_single(dev, areq_ctx->mac_buf_dma_addr,
@@ -514,13 +518,11 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)sg_virt (req->src), areq_ctx->src.nents, areq_ctx->assoc.nents, areq_ctx->assoclen, req->cryptlen); -dma_unmap_sg (dev, req->src, areq_ctx->src.mapped_nents, -DMA_BIDIRECTIONAL ); +dma_unmap_sg (dev, req->src, areq_ctx->src.mapped_nents, src_direction);if (req->src != req->dst) {dev_dbg (dev,"Unmapping dst sgl: req->dst=%pK\n" ,sg_virt (req->dst)); -dma_unmap_sg (dev, req->dst, areq_ctx->dst.mapped_nents, -DMA_BIDIRECTIONAL ); +dma_unmap_sg (dev, req->dst, areq_ctx->dst.mapped_nents,DMA_FROM_DEVICE ); } if (drvdata->coherent && areq_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_DECRYPT &&
@@ -843,7 +845,7 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata,else size_for_map -= authsize; - rc =cc_map_sg (dev, req->dst, size_for_map,DMA_BIDIRECTIONAL , + rc =cc_map_sg (dev, req->dst, size_for_map,DMA_FROM_DEVICE , &areq_ctx->dst.mapped_nents,LLI_MAX_NUM_OF_DATA_ENTRIES , &dst_last_bytes, &dst_mapped_nents);
@@ -1056,7 +1058,8 @@ int cc_map_aead_request(struct cc_drvdata *drvdata, struct aead_request *req) size_to_map += authsize; } - rc = cc_map_sg(dev, req->src, size_to_map, DMA_BIDIRECTIONAL, + rc = cc_map_sg(dev, req->src, size_to_map, + (req->src != req->dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL), &areq_ctx->src.mapped_nents, (LLI_MAX_NUM_OF_ASSOC_DATA_ENTRIES + LLI_MAX_NUM_OF_DATA_ENTRIES),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 103/452 soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc
In reply to Greg Kroah-HartmanFrom: QintaoShen <[email protected]>
[ Upstream commit ba56291e297d28aa6eb82c5c1964fae2d7594746 ]
The allocation funciton devm_kcalloc may fail and return a null pointer, which would cause a null-pointer dereference later.
It might be better to check it and directly return -ENOMEM just like the usage of devm_kcalloc in previous code.
--- drivers/soc/ti/ti_sci_pm_domains.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/soc/ti/ti_sci_pm_domains.c +2 -0
@@ -183,6 +183,8 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)devm_kcalloc (dev, max_id +1 ,sizeof (*pd_provider->data.domains),GFP_KERNEL ); +if (!pd_provider->data.domains) +return -ENOMEM ; pd_provider->data.num_domains = max_id +1 ; pd_provider->data.xlate = ti_sci_pd_xlate;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 104/452 fs: jfs: fix possible NULL pointer dereference in dbFree()
In reply to Greg Kroah-HartmanFrom: Zixuan Fu <[email protected]>
[ Upstream commit 0d4837fdb796f99369cf7691d33de1b856bcaf1f ]
In our fault-injection testing, the variable "nblocks" in dbFree() can be zero when kmalloc_array() fails in dtSearch(). In this case, the variable
"mp" in dbFree() would be NULL and then it is dereferenced in
"write_metapage(mp)".
The failure log is listed as follows:
[ 13.824137] BUG: kernel NULL pointer dereference, address: 0000000000000020 ... [ 13.827416] RIP: 0010:dbFree+0x5f7/0x910 [jfs] [ 13.834341] Call Trace: [ 13.834540] <TASK> [ 13.834713] txFreeMap+0x7b4/0xb10 [jfs] [ 13.835038] txUpdateMap+0x311/0x650 [jfs] [ 13.835375] jfs_lazycommit+0x5f2/0xc70 [jfs] [ 13.835726] ? sched_dynamic_update+0x1b0/0x1b0 [ 13.836092] kthread+0x3c2/0x4a0 [ 13.836355] ? txLockFree+0x160/0x160 [jfs] [ 13.836763] ? kthread_unuse_mm+0x160/0x160 [ 13.837106] ret_from_fork+0x1f/0x30 [ 13.837402] </TASK>
...
This patch adds a NULL check of "mp" before "write_metapage(mp)" is called.
--- fs/jfs/jfs_dmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +2 -1
@@ -385,7 +385,8 @@ int dbFree(struct inode *ip, s64 blkno, s64 nblocks) }/* write the last buffer. */ -write_metapage (mp); +if (mp) +write_metapage (mp);IREAD_UNLOCK (ipbmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 105/452 ARM: OMAP1: clock: Fix UART rate reporting algorithm
In reply to Greg Kroah-HartmanFrom: Janusz Krzysztofik <[email protected]>
[ Upstream commit 338d5d476cde853dfd97378d20496baabc2ce3c0 ]
Since its introduction to the mainline kernel, omap1_uart_recalc() helper makes incorrect use of clk->enable_bit as a ready to use bitmap mask while it only provides the bit number. Fix it.
--- arch/arm/mach-omap1/clock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-omap1/clock.c +1 -1
@@ -41,7 +41,7 @@ static DEFINE_SPINLOCK(clockfw_lock);unsigned long omap1_uart_recalc (struct clk *clk) {unsigned int val =__raw_readl (clk->enable_reg); -return val & clk->enable_bit ?48000000 :12000000 ; +return val &1 << clk->enable_bit ?48000000 :12000000 ; }unsigned long omap1_sossi_recalc (struct clk *clk)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 106/452 powerpc/fadump: Fix fadump to work with a different endian capture kernel
In reply to Greg Kroah-HartmanFrom: Hari Bathini <[email protected]>
[ Upstream commit b74196af372f7cb4902179009265fe63ac81824f ]
Dump capture would fail if capture kernel is not of the endianess as the production kernel, because the in-memory data structure (struct opal_fadump_mem_struct) shared across production kernel and capture kernel assumes the same endianess for both the kernels, which doesn't have to be true always. Fix it by having a well-defined endianess for struct opal_fadump_mem_struct.
--- arch/powerpc/platforms/powernv/opal-fadump.c | 94 +++++++++++--------- arch/powerpc/platforms/powernv/opal-fadump.h | 10 +-- 2 files changed, 57 insertions(+), 47 deletions(-)
arch/powerpc/platforms/powernv/opal-fadump.c +52 -42
@@ -60,7 +60,7 @@ void __init opal_fadump_dt_scan(struct fw_dump *fadump_conf, u64 node) addr =be64_to_cpu (addr);pr_debug ("Kernel metadata addr: %llx\n" , addr); opal_fdm_active = (void *)addr; -if (opal_fdm_active->registered_regions ==0 ) +if (be16_to_cpu (opal_fdm_active->registered_regions) ==0 )return ; ret =opal_mpipl_query_tag (OPAL_MPIPL_TAG_BOOT_MEM , &addr);
@@ -95,17 +95,17 @@ static int opal_fadump_unregister(struct fw_dump *fadump_conf);static void opal_fadump_update_config (struct fw_dump *fadump_conf,const struct opal_fadump_mem_struct *fdm) { -pr_debug ("Boot memory regions count: %d\n" , fdm->region_cnt); +pr_debug ("Boot memory regions count: %d\n" ,be16_to_cpu (fdm->region_cnt));/* * The destination address of the first boot memory region is the * destination address of boot memory regions. */ - fadump_conf->boot_mem_dest_addr = fdm->rgn[0 ].dest; + fadump_conf->boot_mem_dest_addr =be64_to_cpu (fdm->rgn[0 ].dest);pr_debug ("Destination address of boot memory regions: %#016llx\n" , fadump_conf->boot_mem_dest_addr); - fadump_conf->fadumphdr_addr = fdm->fadumphdr_addr; + fadump_conf->fadumphdr_addr =be64_to_cpu (fdm->fadumphdr_addr); }/*
@@ -126,9 +126,9 @@ static void opal_fadump_get_config(struct fw_dump *fadump_conf, fadump_conf->boot_memory_size =0 ;pr_debug ("Boot memory regions:\n" ); -for (i =0 ; i < fdm->region_cnt; i++) { - base = fdm->rgn[i].src; - size = fdm->rgn[i].size; +for (i =0 ; i <be16_to_cpu (fdm->region_cnt); i++) { + base =be64_to_cpu (fdm->rgn[i].src); + size =be64_to_cpu (fdm->rgn[i].size);pr_debug ("\t[%03d] base: 0x%lx, size: 0x%lx\n" , i, base, size); fadump_conf->boot_mem_addr[i] = base;
@@ -143,7 +143,7 @@ static void opal_fadump_get_config(struct fw_dump *fadump_conf,* Start address of reserve dump area (permanent reservation) for * re-registering FADump after dump capture. */ - fadump_conf->reserve_dump_area_start = fdm->rgn[0 ].dest; + fadump_conf->reserve_dump_area_start =be64_to_cpu (fdm->rgn[0 ].dest);/* * Rarely, but it can so happen that system crashes before all
@@ -155,13 +155,14 @@ static void opal_fadump_get_config(struct fw_dump *fadump_conf,* Hope the memory that could not be preserved only has pages * that are usually filtered out while saving the vmcore. */ -if (fdm->region_cnt > fdm->registered_regions) { +if (be16_to_cpu (fdm->region_cnt) >be16_to_cpu (fdm->registered_regions)) {pr_warn ("Not all memory regions were saved!!!\n" );pr_warn (" Unsaved memory regions:\n" ); - i = fdm->registered_regions; -while (i < fdm->region_cnt) { + i =be16_to_cpu (fdm->registered_regions); +while (i <be16_to_cpu (fdm->region_cnt)) {pr_warn ("\t[%03d] base: 0x%llx, size: 0x%llx\n" , - i, fdm->rgn[i].src, fdm->rgn[i].size); + i,be64_to_cpu (fdm->rgn[i].src), +be64_to_cpu (fdm->rgn[i].size)); i++; }
@@ -170,7 +171,7 @@ static void opal_fadump_get_config(struct fw_dump *fadump_conf, } fadump_conf->boot_mem_top = (fadump_conf->boot_memory_size + hole_size); - fadump_conf->boot_mem_regs_cnt = fdm->region_cnt; + fadump_conf->boot_mem_regs_cnt =be16_to_cpu (fdm->region_cnt);opal_fadump_update_config (fadump_conf, fdm); }
@@ -178,35 +179,38 @@ static void opal_fadump_get_config(struct fw_dump *fadump_conf,static void opal_fadump_init_metadata (struct opal_fadump_mem_struct *fdm) { fdm->version =OPAL_FADUMP_VERSION ; - fdm->region_cnt =0 ; - fdm->registered_regions =0 ; - fdm->fadumphdr_addr =0 ; + fdm->region_cnt =cpu_to_be16 (0 ); + fdm->registered_regions =cpu_to_be16 (0 ); + fdm->fadumphdr_addr =cpu_to_be64 (0 ); }static u64 opal_fadump_init_mem_struct (struct fw_dump *fadump_conf) {u64 addr = fadump_conf->reserve_dump_area_start; +u16 reg_cnt;int i; opal_fdm =__va (fadump_conf->kernel_metadata);opal_fadump_init_metadata (opal_fdm);/* Boot memory regions */ + reg_cnt =be16_to_cpu (opal_fdm->region_cnt);for (i =0 ; i < fadump_conf->boot_mem_regs_cnt; i++) { - opal_fdm->rgn[i].src = fadump_conf->boot_mem_addr[i]; - opal_fdm->rgn[i].dest = addr; - opal_fdm->rgn[i].size = fadump_conf->boot_mem_sz[i]; + opal_fdm->rgn[i].src =cpu_to_be64 (fadump_conf->boot_mem_addr[i]); + opal_fdm->rgn[i].dest =cpu_to_be64 (addr); + opal_fdm->rgn[i].size =cpu_to_be64 (fadump_conf->boot_mem_sz[i]); - opal_fdm->region_cnt++; + reg_cnt++; addr += fadump_conf->boot_mem_sz[i]; } + opal_fdm->region_cnt =cpu_to_be16 (reg_cnt);/* * Kernel metadata is passed to f/w and retrieved in capture kerenl. * So, use it to save fadump header address instead of calculating it. */ - opal_fdm->fadumphdr_addr = (opal_fdm->rgn[0 ].dest + - fadump_conf->boot_memory_size); + opal_fdm->fadumphdr_addr =cpu_to_be64 (be64_to_cpu (opal_fdm->rgn[0 ].dest) + + fadump_conf->boot_memory_size);opal_fadump_update_config (fadump_conf, opal_fdm);
@@ -269,18 +273,21 @@ static u64 opal_fadump_get_bootmem_min(void)static int opal_fadump_register (struct fw_dump *fadump_conf) {s64 rc =OPAL_PARAMETER ; +u16 registered_regs;int i, err = -EIO ; -for (i =0 ; i < opal_fdm->region_cnt; i++) { + registered_regs =be16_to_cpu (opal_fdm->registered_regions); +for (i =0 ; i <be16_to_cpu (opal_fdm->region_cnt); i++) { rc =opal_mpipl_update (OPAL_MPIPL_ADD_RANGE , - opal_fdm->rgn[i].src, - opal_fdm->rgn[i].dest, - opal_fdm->rgn[i].size); +be64_to_cpu (opal_fdm->rgn[i].src), +be64_to_cpu (opal_fdm->rgn[i].dest), +be64_to_cpu (opal_fdm->rgn[i].size));if (rc !=OPAL_SUCCESS )break ; - opal_fdm->registered_regions++; + registered_regs++; } + opal_fdm->registered_regions =cpu_to_be16 (registered_regs);switch (rc) {case OPAL_SUCCESS :
@@ -291,7 +298,8 @@ static int opal_fadump_register(struct fw_dump *fadump_conf)case OPAL_RESOURCE :/* If MAX regions limit in f/w is hit, warn and proceed. */ pr_warn ("%d regions could not be registered for MPIPL as MAX limit is reached!\n" , - (opal_fdm->region_cnt - opal_fdm->registered_regions)); + (be16_to_cpu (opal_fdm->region_cnt) - +be16_to_cpu (opal_fdm->registered_regions))); fadump_conf->dump_registered =1 ; err =0 ;break ;
@@ -312,7 +320,7 @@ static int opal_fadump_register(struct fw_dump *fadump_conf)* If some regions were registered before OPAL_MPIPL_ADD_RANGE * OPAL call failed, unregister all regions. */ -if ((err <0 ) && (opal_fdm->registered_regions >0 )) +if ((err <0 ) && (be16_to_cpu (opal_fdm->registered_regions) >0 ))opal_fadump_unregister (fadump_conf);return err;
@@ -328,7 +336,7 @@ static int opal_fadump_unregister(struct fw_dump *fadump_conf)return -EIO ; } - opal_fdm->registered_regions =0 ; + opal_fdm->registered_regions =cpu_to_be16 (0 ); fadump_conf->dump_registered =0 ;return 0 ; }
@@ -563,19 +571,20 @@ static void opal_fadump_region_show(struct fw_dump *fadump_conf,else fdm_ptr = opal_fdm; -for (i =0 ; i < fdm_ptr->region_cnt; i++) { +for (i =0 ; i <be16_to_cpu (fdm_ptr->region_cnt); i++) {/* * Only regions that are registered for MPIPL * would have dump data. */ if ((fadump_conf->dump_active) && - (i < fdm_ptr->registered_regions)) - dumped_bytes = fdm_ptr->rgn[i].size; + (i <be16_to_cpu (fdm_ptr->registered_regions))) + dumped_bytes =be64_to_cpu (fdm_ptr->rgn[i].size);seq_printf (m,"DUMP: Src: %#016llx, Dest: %#016llx, " , - fdm_ptr->rgn[i].src, fdm_ptr->rgn[i].dest); +be64_to_cpu (fdm_ptr->rgn[i].src), +be64_to_cpu (fdm_ptr->rgn[i].dest));seq_printf (m,"Size: %#llx, Dumped: %#llx bytes\n" , - fdm_ptr->rgn[i].size, dumped_bytes); +be64_to_cpu (fdm_ptr->rgn[i].size), dumped_bytes); }/* Dump is active. Show reserved area start address. */
@@ -624,6 +633,7 @@ void __init opal_fadump_dt_scan(struct fw_dump *fadump_conf, u64 node) {const __be32 *prop;unsigned long dn; +__be64 be_addr;u64 addr =0 ;int i, len;s64 ret;
@@ -680,13 +690,13 @@ void __init opal_fadump_dt_scan(struct fw_dump *fadump_conf, u64 node)if (!prop)return ; - ret =opal_mpipl_query_tag (OPAL_MPIPL_TAG_KERNEL , &addr); -if ((ret !=OPAL_SUCCESS ) || !addr) { + ret =opal_mpipl_query_tag (OPAL_MPIPL_TAG_KERNEL , &be_addr); +if ((ret !=OPAL_SUCCESS ) || !be_addr) {pr_err ("Failed to get Kernel metadata (%lld)\n" , ret);return ; } - addr =be64_to_cpu (addr); + addr =be64_to_cpu (be_addr);pr_debug ("Kernel metadata addr: %llx\n" , addr); opal_fdm_active =__va (addr);
@@ -697,14 +707,14 @@ void __init opal_fadump_dt_scan(struct fw_dump *fadump_conf, u64 node) }/* Kernel regions not registered with f/w for MPIPL */ -if (opal_fdm_active->registered_regions ==0 ) { +if (be16_to_cpu (opal_fdm_active->registered_regions) ==0 ) { opal_fdm_active =NULL ;return ; } - ret =opal_mpipl_query_tag (OPAL_MPIPL_TAG_CPU , &addr); -if (addr) { - addr =be64_to_cpu (addr); + ret =opal_mpipl_query_tag (OPAL_MPIPL_TAG_CPU , &be_addr); +if (be_addr) { + addr =be64_to_cpu (be_addr);pr_debug ("CPU metadata addr: %llx\n" , addr); opal_cpu_metadata =__va (addr); }
arch/powerpc/platforms/powernv/opal-fadump.h +5 -5
@@ -31,14 +31,14 @@* OPAL FADump kernel metadata * * The address of this structure will be registered with f/w for retrieving -* and processing during crash dump. +* in the capture kernel to process the crash dump. */ struct opal_fadump_mem_struct {u8 version;u8 reserved[3 ]; -u16 region_cnt;/* number of regions */ -u16 registered_regions;/* Regions registered for MPIPL */ -u64 fadumphdr_addr; +__be16 region_cnt;/* number of regions */ +__be16 registered_regions;/* Regions registered for MPIPL */ +__be64 fadumphdr_addr;struct opal_mpipl_region rgn[FADUMP_MAX_MEM_REGS ]; } __packed;
@@ -135,7 +135,7 @@ static inline void opal_fadump_read_regs(char *bufp, unsigned int regs_cnt,for (i =0 ; i < regs_cnt; i++, bufp += reg_entry_size) { reg_entry = (struct hdat_fadump_reg_entry *)bufp; val = (cpu_endian ?be64_to_cpu (reg_entry->reg_val) : - reg_entry->reg_val); + (u64)(reg_entry->reg_val)); opal_fadump_set_regval_regnum(regs, be32_to_cpu(reg_entry->reg_type), be32_to_cpu(reg_entry->reg_num),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 107/452 fat: add ratelimit to fat*_ent_bread()
In reply to Greg Kroah-HartmanFrom: OGAWA Hirofumi <[email protected]>
[ Upstream commit 183c3237c928109d2008c0456dff508baf692b20 ]
fat*_ent_bread() can be the cause of too many report on I/O error path. So use fat_msg_ratelimit() instead.
--- fs/fat/fatent.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/fat/fatent.c +4 -3
@@ -93,7 +93,8 @@ static int fat12_ent_bread(struct super_block *sb, struct fat_entry *fatent, err_brelse:brelse (bhs[0 ]); err: -fat_msg (sb,KERN_ERR ,"FAT read failed (blocknr %llu)" , (llu )blocknr); +fat_msg_ratelimit (sb,KERN_ERR ,"FAT read failed (blocknr %llu)" , + (llu )blocknr);return -EIO ; }
@@ -106,8 +107,8 @@ static int fat_ent_bread(struct super_block *sb, struct fat_entry *fatent, fatent->fat_inode =MSDOS_SB (sb)->fat_inode; fatent->bhs[0 ] =sb_bread (sb, blocknr);if (!fatent->bhs[0 ]) { -fat_msg (sb,KERN_ERR ,"FAT read failed (blocknr %llu)" , - (llu )blocknr); +fat_msg_ratelimit (sb,KERN_ERR ,"FAT read failed (blocknr %llu)" , + (llu )blocknr);return -EIO ; } fatent->nr_bhs =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 108/452 pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 2f661477c2bb8068194dbba9738d05219f111c6e ]
It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
--- drivers/pinctrl/renesas/pinctrl-rzn1.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/pinctrl/renesas/pinctrl-rzn1.c +4 -6
@@ -865,17 +865,15 @@ static int rzn1_pinctrl_probe(struct platform_device *pdev) ipctl->mdio_func[0 ] =-1 ; ipctl->mdio_func[1 ] =-1 ; - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - ipctl->lev1_protect_phys = (u32 )res->start +0x400 ; - ipctl->lev1 =devm_ioremap_resource (&pdev->dev, res); + ipctl->lev1 =devm_platform_get_and_ioremap_resource (pdev,0 , &res);if (IS_ERR (ipctl->lev1))return PTR_ERR (ipctl->lev1); + ipctl->lev1_protect_phys = (u32 )res->start +0x400 ; - res =platform_get_resource (pdev,IORESOURCE_MEM ,1 ); - ipctl->lev2_protect_phys = (u32 )res->start +0x400 ; - ipctl->lev2 =devm_ioremap_resource (&pdev->dev, res); + ipctl->lev2 =devm_platform_get_and_ioremap_resource (pdev,1 , &res);if (IS_ERR (ipctl->lev2))return PTR_ERR (ipctl->lev2); + ipctl->lev2_protect_phys = (u32 )res->start +0x400 ; ipctl->clk =devm_clk_get (&pdev->dev,NULL );if (IS_ERR (ipctl->clk))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 109/452 ARM: versatile: Add missing of_node_put in dcscb_init
In reply to Greg Kroah-HartmanFrom: Peng Wu <[email protected]>
[ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ]
The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak.
--- arch/arm/mach-vexpress/dcscb.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-vexpress/dcscb.c +1 -0
@@ -144,6 +144,7 @@ static int __init dcscb_init(void)if (!node)return -ENODEV ; dcscb_base =of_iomap (node,0 ); +of_node_put (node);if (!dcscb_base)return -EADDRNOTAVAIL ; cfg =readl_relaxed (dcscb_base +DCS_CFG_R );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 110/452 ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f038e8186fbc5723d7d38c6fa1d342945107347e ]
The Samsung s524ad0xd1 EEPROM should use atmel,24c128 fallback, according to the AT24 EEPROM bindings.
--- arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/exynos5250-smdk5250.dts +2 -2
@@ -129,7 +129,7 @@ samsung,i2c-max-bus-freq = <20000>; eeprom@50 { - compatible = "samsung,s524ad0xd1"; + compatible = "samsung,s524ad0xd1", "atmel,24c128"; reg = <0x50>; };
@@ -289,7 +289,7 @@ samsung,i2c-max-bus-freq = <20000>; eeprom@51 { - compatible = "samsung,s524ad0xd1"; + compatible = "samsung,s524ad0xd1", "atmel,24c128"; reg = <0x51>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 111/452 ARM: hisi: Add missing of_node_put after of_find_compatible_node
In reply to Greg Kroah-HartmanFrom: Peng Wu <[email protected]>
[ Upstream commit 9bc72e47d4630d58a840a66a869c56b29554cfe4 ]
of_find_compatible_node will increment the refcount of the returned device_node. Calling of_node_put() to avoid the refcount leak
--- arch/arm/mach-hisi/platsmp.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/mach-hisi/platsmp.c +4 -0
@@ -67,14 +67,17 @@ static void __init hi3xxx_smp_prepare_cpus(unsigned int max_cpus) } ctrl_base =of_iomap (np,0 );if (!ctrl_base) { +of_node_put (np);pr_err ("failed to map address\n" );return ; }if (of_property_read_u32 (np,"smp-offset" , &offset) <0 ) { +of_node_put (np);pr_err ("failed to find smp-offset property\n" );return ; } ctrl_base += offset; +of_node_put (np); } }
@@ -160,6 +163,7 @@ static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle)if (WARN_ON (!node))return -1 ; ctrl_base =of_iomap (node,0 ); +of_node_put (node);/* set the secondary core boot from DDR */ remap_reg_value =readl_relaxed (ctrl_base +REG_SC_CTRL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 112/452 PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
[ Upstream commit a91ee0e9fca9d7501286cfbced9b30a33e52740a ]
The sysfs sriov_numvfs_store() path acquires the device lock before the config space access lock:
sriov_numvfs_store
device_lock # A (1) acquire device lock
sriov_configure
vfio_pci_sriov_configure # (for example)
vfio_pci_core_sriov_configure
pci_disable_sriov
sriov_disable
pci_cfg_access_lock
pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0
Previously, pci_dev_lock() acquired the config space access lock before the device lock:
pci_dev_lock
pci_cfg_access_lock
dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1
device_lock # A (3) wait for device lock
Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may deadlock with sriov_numvfs_store() if the operations occur in the sequence
(1) (2) (3) (4).
Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires the device lock before the config space access lock, the same as the sriov_numvfs_store() path.
[bhelgaas: combined and adapted commit log from Jay Zhou's independent subsequent posting:
https://lore.kernel.org/r/[email protected]]
--- drivers/pci/pci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/pci/pci.c +5 -5
@@ -4975,18 +4975,18 @@ static int pci_dev_reset_slot_function(struct pci_dev *dev, int probe)static void pci_dev_lock (struct pci_dev *dev) { -pci_cfg_access_lock (dev);/* block PM suspend, driver probe, etc. */ device_lock (&dev->dev); +pci_cfg_access_lock (dev); }/* Return 1 on successful lock, 0 on contention */ static int pci_dev_trylock (struct pci_dev *dev) { -if (pci_cfg_access_trylock (dev)) { -if (device_trylock (&dev->dev)) +if (device_trylock (&dev->dev)) { +if (pci_cfg_access_trylock (dev))return 1 ; -pci_cfg_access_unlock (dev); +device_unlock (&dev->dev); }return 0 ;
@@ -4994,8 +4994,8 @@ static int pci_dev_trylock(struct pci_dev *dev)static void pci_dev_unlock (struct pci_dev *dev) { -device_unlock (&dev->dev);pci_cfg_access_unlock (dev); +device_unlock (&dev->dev); }static void pci_dev_save_and_disable (struct pci_dev *dev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 113/452 tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 2b132903de7124dd9a758be0c27562e91a510848 ]
Fixes following sparse warnings:
CHECK mm/vmscan.cmm/vmscan.c: note: in included file (through include/trace/trace_events.h, include/trace/define_trace.h, include/trace/events/vmscan.h):./include/trace/events/vmscan.h:281:1: sparse: warning:
cast to restricted isolate_mode_t./include/trace/events/vmscan.h:281:1: sparse: warning:
restricted isolate_mode_t degrades to integer
--- include/trace/events/vmscan.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/trace/events/vmscan.h +2 -2
@@ -283,7 +283,7 @@ TRACE_EVENT(mm_vmscan_lru_isolate, __field(unsigned long, nr_scanned) __field(unsigned long, nr_skipped) __field(unsigned long, nr_taken) - __field(isolate_mode_t, isolate_mode) + __field(unsigned int, isolate_mode) __field(int, lru) ),
@@ -294,7 +294,7 @@ TRACE_EVENT(mm_vmscan_lru_isolate, __entry->nr_scanned = nr_scanned; __entry->nr_skipped = nr_skipped; __entry->nr_taken = nr_taken; - __entry->isolate_mode = isolate_mode; + __entry->isolate_mode = (__force unsigned int )isolate_mode; __entry->lru = lru; ),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 114/452 powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr
In reply to Greg Kroah-HartmanFrom: Haren Myneni <[email protected]>
[ Upstream commit c127d130f6d59fa81701f6b04023cf7cd1972fb3 ]
In init_winctx_regs(), __pa() is called on winctx->rx_fifo and this function is called to initialize registers for receive and fault windows. But the real address is passed in winctx->rx_fifo for receive windows and the virtual address for fault windows which causes errors with DEBUG_VIRTUAL enabled. Fixes this issue by assigning only real address to rx_fifo in vas_rx_win_attr struct for both receive and fault windows.
--- arch/powerpc/include/asm/vas.h | 2 +- arch/powerpc/platforms/powernv/vas-fault.c | 2 +- arch/powerpc/platforms/powernv/vas-window.c | 4 ++-- arch/powerpc/platforms/powernv/vas.h | 2 +- drivers/crypto/nx/nx-common-powernv.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-)
arch/powerpc/include/asm/vas.h +1 -1
@@ -52,7 +52,7 @@ enum vas_cop_type {* Receive window attributes specified by the (in-kernel) owner of window. */ struct vas_rx_win_attr { -void *rx_fifo; +u64 rx_fifo;int rx_fifo_size;int wcreds_max;
arch/powerpc/platforms/powernv/vas-fault.c +1 -1
@@ -352,7 +352,7 @@ int vas_setup_fault_window(struct vas_instance *vinst)vas_init_rx_win_attr (&attr,VAS_COP_TYPE_FAULT ); attr.rx_fifo_size = vinst->fault_fifo_size; - attr.rx_fifo = vinst->fault_fifo; + attr.rx_fifo =__pa (vinst->fault_fifo);/* * Max creds is based on number of CRBs can fit in the FIFO.
arch/powerpc/platforms/powernv/vas-window.c +2 -2
@@ -403,7 +403,7 @@ static void init_winctx_regs(struct vas_window *window,* * See also: Design note in function header. */ - val =__pa (winctx->rx_fifo); + val = winctx->rx_fifo; val =SET_FIELD (VAS_PAGE_MIGRATION_SELECT , val,0 );write_hvwc_reg (window,VREG (LFIFO_BAR ), val);
@@ -737,7 +737,7 @@ static void init_winctx_for_rxwin(struct vas_window *rxwin,*/ winctx->fifo_disable = true; winctx->intr_disable = true; - winctx->rx_fifo =NULL ; + winctx->rx_fifo =0 ; } winctx->lnotify_lpid = rxattr->lnotify_lpid;
arch/powerpc/platforms/powernv/vas.h +1 -1
@@ -383,7 +383,7 @@ struct vas_window {* is a container for the register fields in the window context. */ struct vas_winctx { -void *rx_fifo; +u64 rx_fifo;int rx_fifo_size;int wcreds_max;int rsvd_txbuf_count;
drivers/crypto/nx/nx-common-powernv.c +1 -1
@@ -827,7 +827,7 @@ static int __init vas_cfg_coproc_info(struct device_node *dn, int chip_id, goto err_out;vas_init_rx_win_attr (&rxattr, coproc->ct); - rxattr.rx_fifo = (void *)rx_fifo; + rxattr.rx_fifo = rx_fifo; rxattr.rx_fifo_size = fifo_size; rxattr.lnotify_lpid = lpid; rxattr.lnotify_pid = pid;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 115/452 powerpc/xics: fix refcount leak in icp_opal_init()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit 5dd9e27ea4a39f7edd4bf81e9e70208e7ac0b7c9 ]
The of_find_compatible_node() function returns a node pointer with refcount incremented, use of_node_put() on it when done.
--- arch/powerpc/sysdev/xics/icp-opal.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/sysdev/xics/icp-opal.c +1 -0
@@ -195,6 +195,7 @@ int icp_opal_init(void)printk ("XICS: Using OPAL ICP fallbacks\n" ); +of_node_put (np);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 116/452 powerpc/powernv: fix missing of_node_put in uv_init()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit 3ffa9fd471f57f365bc54fc87824c530422f64a5 ]
of_find_compatible_node() returns node pointer with refcount incremented, use of_node_put() on it when done.
--- arch/powerpc/platforms/powernv/ultravisor.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/powernv/ultravisor.c +1 -0
@@ -55,6 +55,7 @@ static int __init uv_init(void)return -ENODEV ; uv_memcons =memcons_init (node,"memcons" ); +of_node_put (node);if (!uv_memcons)return -ENOENT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 117/452 macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
In reply to Greg Kroah-HartmanFrom: Finn Thain <[email protected]>
[ Upstream commit 86ce436e30d86327c9f5260f718104ae7b21f506 ]
drivers/macintosh/via-pmu-event.o: In function `via_pmu_event':
via-pmu-event.c:(.text+0x44): undefined reference to input_event' via-pmu-event.c:(.text+0x68): undefined reference to input_event' via-pmu-event.c:(.text+0x94): undefined reference to input_event' via-pmu-event.c:(.text+0xb8): undefined reference to input_event' drivers/macintosh/via-pmu-event.o: In function `via_pmu_event_init':
via-pmu-event.c:(.init.text+0x20): undefined reference to input_allocate_device' via-pmu-event.c:(.init.text+0xc4): undefined reference to input_register_device' via-pmu-event.c:(.init.text+0xd4): undefined reference to `input_free_device' make[1]: *** [Makefile:1155: vmlinux] Error 1
make: *** [Makefile:350: __build_one_by_one] Error 2
Don't call into the input subsystem unless CONFIG_INPUT is built-in.
--- drivers/macintosh/Kconfig | 4 ++++ drivers/macintosh/Makefile | 3 ++- drivers/macintosh/via-pmu.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-)
drivers/macintosh/Kconfig +4 -0
@@ -67,6 +67,10 @@ config ADB_PMU this device; you should do so if your machine is one of those mentioned above. +config ADB_PMU_EVENT + def_bool y + depends on ADB_PMU && INPUT=y + config ADB_PMU_LED bool "Support for the Power/iBook front LED" depends on PPC_PMAC && ADB_PMU
drivers/macintosh/Makefile +2 -1
@@ -12,7 +12,8 @@ obj-$(CONFIG_MAC_EMUMOUSEBTN) += mac_hid.o obj-$(CONFIG_INPUT_ADBHID) += adbhid.o obj-$(CONFIG_ANSLCD) += ans-lcd.o -obj-$(CONFIG_ADB_PMU) += via-pmu.o via-pmu-event.o +obj-$(CONFIG_ADB_PMU) += via-pmu.o +obj-$(CONFIG_ADB_PMU_EVENT) += via-pmu-event.o obj-$(CONFIG_ADB_PMU_LED) += via-pmu-led.o obj-$(CONFIG_PMAC_BACKLIGHT) += via-pmu-backlight.o obj-$(CONFIG_ADB_CUDA) += via-cuda.o
drivers/macintosh/via-pmu.c +1 -1
@@ -1460,7 +1460,7 @@ pmu_handle_data(unsigned char *data, int len)pmu_pass_intr (data, len);/* len == 6 is probably a bad check. But how do I * know what PMU versions send what events here? */ -if (len ==6 ) { +if (IS_ENABLED (CONFIG_ADB_PMU_EVENT ) && len ==6 ) {via_pmu_event (PMU_EVT_POWER , !!(data[1 ]&8 ));via_pmu_event (PMU_EVT_LID , data[1 ]&1 ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 118/452 powerpc/iommu: Add missing of_node_put in iommu_init_early_dart
In reply to Greg Kroah-HartmanFrom: Peng Wu <[email protected]>
[ Upstream commit 57b742a5b8945118022973e6416b71351df512fb ]
The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak.
--- arch/powerpc/sysdev/dart_iommu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/powerpc/sysdev/dart_iommu.c +4 -2
@@ -403,9 +403,10 @@ void __init iommu_init_early_dart(struct pci_controller_ops *controller_ops) }/* Initialize the DART HW */ -if (dart_init (dn) !=0 ) +if (dart_init (dn) !=0 ) { +of_node_put (dn);return ; - + }/* * U4 supports a DART bypass, we use it for 64-bit capable devices to * improve performance. However, that only works for devices connected
@@ -418,6 +419,7 @@ void __init iommu_init_early_dart(struct pci_controller_ops *controller_ops)/* Setup pci_dma ops */ set_pci_dma_ops (&dma_iommu_ops); +of_node_put (dn); }#ifdef CONFIG_PM
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 119/452 RDMA/hfi1: Prevent panic when SDMA is disabled
In reply to Greg Kroah-HartmanFrom: Douglas Miller <[email protected]>
[ Upstream commit 629e052d0c98e46dde9f0824f0aa437f678d9b8f ]
If the hfi1 module is loaded with HFI1_CAP_SDMA off, a call to hfi1_write_iter() will dereference a NULL pointer and panic. A typical stack frame is:
sdma_select_user_engine [hfi1]
hfi1_user_sdma_process_request [hfi1]
hfi1_write_iter [hfi1]
do_iter_readv_writev
do_iter_write
vfs_writev
do_writev
do_syscall_64
The fix is to test for SDMA in hfi1_write_iter() and fail the I/O with EINVAL.
--- drivers/infiniband/hw/hfi1/file_ops.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/hfi1/file_ops.c +2 -0
@@ -306,6 +306,8 @@ static ssize_t hfi1_write_iter(struct kiocb *kiocb, struct iov_iter *from)unsigned long dim = from->nr_segs;int idx; +if (!HFI1_CAP_IS_KSET (SDMA )) +return -EINVAL ; idx =srcu_read_lock (&fd->pq_srcu); pq =srcu_dereference (fd->pq, &fd->pq_srcu);if (!cq || !pq) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 120/452 drm: fix EDID struct for old ARM OABI format
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
[ Upstream commit 47f15561b69e226bfc034e94ff6dbec51a4662af ]
When building the kernel for arm with the "-mabi=apcs-gnu" option, gcc will force alignment of all structures and unions to a word boundary (see also STRUCTURE_SIZE_BOUNDARY and the "-mstructure-size-boundary=XX" option if you're a gcc person), even when the members of said structures do not want or need said alignment.
This completely messes up the structure alignment of 'struct edid' on those targets, because even though all the embedded structures are marked with "__attribute__((packed))", the unions that contain them are not.
This was exposed by commit f1e4c916f97f ("drm/edid: add EDID block count and size helpers"), but the bug is pre-existing. That commit just made the structure layout problem cause a build failure due to the addition of the
BUILD_BUG_ON(sizeof(*edid) != EDID_LENGTH);
sanity check in drivers/gpu/drm/drm_edid.c:edid_block_data().
This legacy union alignment should probably not be used in the first place, but we can fix the layout by adding the packed attribute to the union entries even when each member is already packed and it shouldn't matter in a sane build environment.
You can see this issue with a trivial test program:
union {
struct {
char c[5];
};
struct {
char d;
unsigned e;
} __attribute__((packed));} a = { "1234" };
where building this with a normal "gcc -S" will result in the expected 5-byte size of said union:
.type a, @object .size a, 5
but with an ARM compiler and the old ABI:
arm-linux-gnu-gcc -mabi=apcs-gnu -mfloat-abi=soft -S t.c
you get
.type a, %object .size a, 8
instead, because even though each member of the union is packed, the union itself still gets aligned.
This was reported by Sudip for the spear3xx_defconfig target.
--- include/drm/drm_edid.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/drm/drm_edid.h +3 -3
@@ -121,7 +121,7 @@ struct detailed_data_monitor_range {u8 supported_scalings;u8 preferred_refresh; } __attribute__((packed)) cvt; - } formula; + } __attribute__((packed)) formula; } __attribute__((packed));struct detailed_data_wpindex {
@@ -154,7 +154,7 @@ struct detailed_non_pixel {struct detailed_data_wpindex color;struct std_timing timings[6 ];struct cvt_timing cvt[4 ]; - } data; + } __attribute__((packed)) data; } __attribute__((packed));#define EDID_DETAIL_EST_TIMINGS 0xf7
@@ -172,7 +172,7 @@ struct detailed_timing {union {struct detailed_pixel_timing pixel_data;struct detailed_non_pixel other_data; - } data; + } __attribute__((packed)) data; } __attribute__((packed));#define DRM_EDID_INPUT_SERRATION_VSYNC (1 << 0)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 121/452 dt-bindings: display: sitronix, st7735r: Fix backlight in example
In reply to Greg Kroah-HartmanFrom: Noralf Trønnes <[email protected]>
[ Upstream commit 471e201f543559e2cb19b182b680ebf04d80ee31 ]
The backlight property was lost during conversion to yaml in commit abdd9e3705c8 ("dt-bindings: display: sitronix,st7735r: Convert to DT schema"). Put it back.
--- Documentation/devicetree/bindings/display/sitronix,st7735r.yaml | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/display/sitronix,st7735r.yaml +1 -0
@@ -72,6 +72,7 @@ examples: dc-gpios = <&gpio 43 GPIO_ACTIVE_HIGH>; reset-gpios = <&gpio 80 GPIO_ACTIVE_HIGH>; rotation = <270>; + backlight = <&backlight>; }; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 122/452 ath11k: acquire ab->base_lock in unassign when finding the peer by addr
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 2db80f93869d491be57cbc2b36f30d0d3a0e5bde ]
ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be held when calling that function in order to protect the list. All callers except ath11k_mac_op_unassign_vif_chanctx have that lock acquired when calling ath11k_peer_find_by_addr. That lock is also not transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. The solution is to acquire the lock when calling ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx.
I am currently working on a static analyser to detect missing locks and this was a reported case. I manually verified the report by looking at the code, but I do not have real hardware so this is compile tested only.
--- drivers/net/wireless/ath/ath11k/mac.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +8 -3
@@ -5325,6 +5325,7 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,struct ath11k *ar = hw->priv;struct ath11k_base *ab = ar->ab;struct ath11k_vif *arvif = (void *)vif->drv_priv; +struct ath11k_peer *peer;int ret;mutex_lock (&ar->conf_mutex);
@@ -5336,9 +5337,13 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,WARN_ON (!arvif->is_started);if (ab->hw_params.vdev_start_delay && - arvif->vdev_type ==WMI_VDEV_TYPE_MONITOR && -ath11k_peer_find_by_addr (ab, ar->mac_addr)) -ath11k_peer_delete (ar, arvif->vdev_id, ar->mac_addr); + arvif->vdev_type ==WMI_VDEV_TYPE_MONITOR ) { +spin_lock_bh (&ab->base_lock); + peer =ath11k_peer_find_by_addr (ab, ar->mac_addr); +spin_unlock_bh (&ab->base_lock); +if (peer) +ath11k_peer_delete (ar, arvif->vdev_id, ar->mac_addr); + } ret =ath11k_mac_vdev_stop (arvif);if (ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 123/452 ath9k: fix ar9003_get_eepmisc
In reply to Greg Kroah-HartmanFrom: Wenli Looi <[email protected]>
[ Upstream commit 9aaff3864b603408c02c629957ae8d8ff5d5a4f2 ]
The current implementation is reading the wrong eeprom type.
--- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +1 -1
@@ -5615,7 +5615,7 @@ unsigned int ar9003_get_paprd_scale_factor(struct ath_hw *ah,static u8 ar9003_get_eepmisc (struct ath_hw *ah) { -return ah->eeprom.map4k.baseEepHeader.eepMisc; +return ah->eeprom.ar9300_eep.baseEepHeader.opCapFlags.eepMisc; }const struct eeprom_ops eep_ar9300_ops = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 124/452 drm/edid: fix invalid EDID extension block filtering
In reply to Greg Kroah-HartmanFrom: Jani Nikula <[email protected]>
[ Upstream commit 3aefc722ff52076407203b6af9713de567993adf ]
The invalid EDID block filtering uses the number of valid EDID extensions instead of all EDID extensions for looping the extensions in the copy. This is fine, by coincidence, if all the invalid blocks are at the end of the EDID. However, it's completely broken if there are invalid extensions in the middle; the invalid blocks are included and valid blocks are excluded.
Fix it by modifying the base block after, not before, the copy.
--- drivers/gpu/drm/drm_edid.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_edid.c +3 -3
@@ -1995,9 +1995,6 @@ struct edid *drm_do_get_edid(struct drm_connector *connector,connector_bad_edid (connector, edid, edid[0x7e ] +1 ); - edid[EDID_LENGTH -1 ] += edid[0x7e ] - valid_extensions; - edid[0x7e ] = valid_extensions; - new =kmalloc_array (valid_extensions +1 ,EDID_LENGTH ,GFP_KERNEL );if (!new)
@@ -2014,6 +2011,9 @@ struct edid *drm_do_get_edid(struct drm_connector *connector, base +=EDID_LENGTH ; } + new[EDID_LENGTH -1 ] += new[0x7e ] - valid_extensions; + new[0x7e ] = valid_extensions; +kfree (edid); edid = new; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 125/452 drm/bridge: adv7511: clean up CEC adapter when probe fails
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
[ Upstream commit 7ed2b0dabf7a22874cb30f8878df239ef638eb53 ]
When the probe routine fails we also need to clean up the CEC adapter registered in adv7511_cec_init().
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +1 -0
@@ -1306,6 +1306,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)return 0 ; err_unregister_cec: +cec_unregister_adapter (adv7511->cec_adap);i2c_unregister_device (adv7511->i2c_cec);if (adv7511->cec_clk)clk_disable_unprepare (adv7511->cec_clk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 126/452 spi: qcom-qspi: Add minItems to interconnect-names
In reply to Greg Kroah-HartmanFrom: Kuldeep Singh <[email protected]>
[ Upstream commit e23d86c49a9c78e8dbe3abff20b30812b26ab427 ]
Add minItems constraint to interconnect-names as well. The schema currently tries to match 2 names and fail for DTs with single entry.
With the change applied, below interconnect-names values are possible:
['qspi-config'], ['qspi-config', 'qspi-memory']
--- Documentation/devicetree/bindings/spi/qcom,spi-qcom-qspi.yaml | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/spi/qcom,spi-qcom-qspi.yaml +1 -0
@@ -45,6 +45,7 @@ properties: maxItems: 2 interconnect-names: + minItems: 1 items: - const: qspi-config - const: qspi-memory
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 127/452 ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 4f4e0454e226de3bf4efd7e7924d1edc571c52d5 ]
Call of_node_put(platform_node) to avoid refcount leak in the error path.
--- sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/mediatek/mt8173/mt8173-max98090.c +4 -1
@@ -167,7 +167,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev)if (!codec_node) {dev_err (&pdev->dev,"Property 'audio-codec' missing or invalid\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_platform_node; }for_each_card_prelinks (card, i, dai_link) {if (dai_link->codecs->name)
@@ -182,6 +183,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) __func__, ret);of_node_put (codec_node); + +put_platform_node:of_node_put (platform_node);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 128/452 ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 05654431a18fe24e5e46a375d98904134628a102 ]
This node pointer is returned by of_parse_phandle() with refcount incremented in this function.
Calling of_node_put() to avoid the refcount leak.
--- sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/soc/mediatek/mt2701/mt2701-wm8960.c +7 -2
@@ -129,7 +129,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev)if (!codec_node) {dev_err (&pdev->dev,"Property 'audio-codec' missing or invalid\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_platform_node; }for_each_card_prelinks (card, i, dai_link) {if (dai_link->codecs->name)
@@ -140,7 +141,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) ret =snd_soc_of_parse_audio_routing (card,"audio-routing" );if (ret) {dev_err (&pdev->dev,"failed to parse audio-routing: %d\n" , ret); -return ret; + goto put_codec_node; } ret =devm_snd_soc_register_card (&pdev->dev, card);
@@ -148,6 +149,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev)dev_err (&pdev->dev,"%s snd_soc_register_card fail %d\n" , __func__, ret); +put_codec_node: +of_node_put (codec_node); +put_platform_node: +of_node_put (platform_node);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 129/452 x86/delay: Fix the wrong asm constraint in delay_loop()
In reply to Greg Kroah-HartmanFrom: Ammar Faizi <[email protected]>
[ Upstream commit b86eb74098a92afd789da02699b4b0dd3f73b889 ]
The asm constraint does not reflect the fact that the asm statement can modify the value of the local variable loops. Which it does.
Specifying the wrong constraint may lead to undefined behavior, it may clobber random stuff (e.g. local variable, important temporary value in regs, etc.). This is especially dangerous when the compiler decides to inline the function and since it doesn't know that the value gets modified, it might decide to use it from a register directly without reloading it.
Change the constraint to "+a" to denote that the first argument is an input and an output argument.
[ bp: Fix typo, massage commit message. ]
--- arch/x86/lib/delay.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/lib/delay.c +2 -2
@@ -54,8 +54,8 @@ static void delay_loop(u64 __loops)" jnz 2b \n" "3: dec %0 \n" - : /* we don't need output */ - :"a" (loops) + : "+a" (loops) + : ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 130/452 drm/ingenic: Reset pixclock rate when parent clock rate changes
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
[ Upstream commit 33700f6f7d9f6b4e1e6df933ef7fd388889c662c ]
Old Ingenic SoCs can overclock very well, up to +50% of their nominal clock rate, whithout requiring overvolting or anything like that, just by changing the rate of the main PLL. Unfortunately, all clocks on the system are derived from that PLL, and when the PLL rate is updated, so is our pixel clock.
To counter that issue, we make sure that the panel is in VBLANK before the rate change happens, and we will then re-set the pixel clock rate afterwards, once the PLL has been changed, to be as close as possible to the pixel rate requested by the encoder.
v2: Add comment about mutex usage
--- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 61 ++++++++++++++++++++++- 1 file changed, 60 insertions(+), 1 deletion(-)
drivers/gpu/drm/ingenic/ingenic-drm-drv.c +60 -1
@@ -10,6 +10,7 @@#include <linux/clk.h> #include <linux/dma-mapping.h> #include <linux/module.h> +#include <linux/mutex.h> #include <linux/of_device.h> #include <linux/platform_device.h> #include <linux/regmap.h>
@@ -68,6 +69,21 @@ struct ingenic_drm {bool panel_is_sharp;bool no_vblank; + +/* +* clk_mutex is used to synchronize the pixel clock rate update with +* the VBLANK. When the pixel clock's parent clock needs to be updated, +* clock_nb's notifier function will lock the mutex, then wait until the +* next VBLANK. At that point, the parent clock's rate can be updated, +* and the mutex is then unlocked. If an atomic commit happens in the +* meantime, it will lock on the mutex, effectively waiting until the +* clock update process finishes. Finally, the pixel clock's rate will +* be recomputed when the mutex has been released, in the pending atomic +* commit, or a future one. +*/ +struct mutex clk_mutex; +bool update_clk_rate; +struct notifier_block clock_nb; };static const u32 ingenic_drm_primary_formats[] = {
@@ -111,6 +127,29 @@ static inline struct ingenic_drm *drm_crtc_get_priv(struct drm_crtc *crtc) return container_of(crtc, struct ingenic_drm, crtc); } +static inline struct ingenic_drm *drm_nb_get_priv (struct notifier_block *nb) +{ + return container_of(nb, struct ingenic_drm, clock_nb); +} + +static int ingenic_drm_update_pixclk (struct notifier_block *nb, +unsigned long action, +void *data) +{ +struct ingenic_drm *priv =drm_nb_get_priv (nb); + +switch (action) { +case PRE_RATE_CHANGE : +mutex_lock (&priv->clk_mutex); + priv->update_clk_rate = true; +drm_crtc_wait_one_vblank (&priv->crtc); +return NOTIFY_OK ; +default : +mutex_unlock (&priv->clk_mutex); +return NOTIFY_OK ; + } +} +static void ingenic_drm_crtc_atomic_enable (struct drm_crtc *crtc,struct drm_crtc_state *state) {
@@ -276,8 +315,14 @@ static void ingenic_drm_crtc_atomic_flush(struct drm_crtc *crtc,if (drm_atomic_crtc_needs_modeset (state)) {ingenic_drm_crtc_update_timings (priv, &state->mode); + priv->update_clk_rate = true; + } +if (priv->update_clk_rate) { +mutex_lock (&priv->clk_mutex);clk_set_rate (priv->pix_clk, state->adjusted_mode.clock *1000 ); + priv->update_clk_rate = false; +mutex_unlock (&priv->clk_mutex); }if (event) {
@@ -936,16 +981,28 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)if (soc_info->has_osd)regmap_write (priv->map,JZ_REG_LCD_OSDC ,JZ_LCD_OSDC_OSDEN ); +mutex_init (&priv->clk_mutex); + priv->clock_nb.notifier_call = ingenic_drm_update_pixclk; + + parent_clk =clk_get_parent (priv->pix_clk); + ret =clk_notifier_register (parent_clk, &priv->clock_nb); +if (ret) { +dev_err (dev,"Unable to register clock notifier\n" ); + goto err_devclk_disable; + } + ret =drm_dev_register (drm,0 );if (ret) {dev_err (dev,"Failed to register DRM driver\n" ); - goto err_devclk_disable; + goto err_clk_notifier_unregister; }drm_fbdev_generic_setup (drm,32 );return 0 ; +err_clk_notifier_unregister: +clk_notifier_unregister (parent_clk, &priv->clock_nb); err_devclk_disable:if (priv->lcd_clk)clk_disable_unprepare (priv->lcd_clk);
@@ -967,7 +1024,9 @@ static int compare_of(struct device *dev, void *data)static void ingenic_drm_unbind (struct device *dev) {struct ingenic_drm *priv =dev_get_drvdata (dev); +struct clk *parent_clk =clk_get_parent (priv->pix_clk); +clk_notifier_unregister (parent_clk, &priv->clock_nb);if (priv->lcd_clk)clk_disable_unprepare (priv->lcd_clk);clk_disable_unprepare (priv->pix_clk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 131/452 drm/mediatek: Fix mtk_cec_mask()
In reply to Greg Kroah-HartmanFrom: Miles Chen <[email protected]>
[ Upstream commit 2c5d69b0a141e1e98febe3111e6f4fd8420493a5 ]
In current implementation, mtk_cec_mask() writes val into target register and ignores the mask. After talking to our hdmi experts, mtk_cec_mask() should read a register, clean only mask bits, and update (val | mask) bits to the register.
--- drivers/gpu/drm/mediatek/mtk_cec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_cec.c +1 -1
@@ -84,7 +84,7 @@ static void mtk_cec_mask(struct mtk_cec *cec, unsigned int offset,u32 tmp =readl (cec->regs + offset) & ~mask; tmp |= val & mask; -writel (val, cec->regs + offset); +writel (tmp, cec->regs + offset); } void mtk_cec_set_hpd_event(struct device *dev,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 132/452 drm/vc4: hvs: Reset muxes at probe time
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 8514e6b1f40319e31ac4aa3fbf606796786366c9 ]
By default, the HVS driver will force the HVS output 3 to be muxed to the HVS channel 2. However, the Transposer can only be assigned to the HVS channel 2, so whenever we try to use the writeback connector, we'll mux its associated output (Output 2) to the channel 2.
This leads to both the output 2 and 3 feeding from the same channel, which is explicitly discouraged in the documentation.
In order to avoid this, let's reset all the output muxes to their reset value.
--- drivers/gpu/drm/vc4/vc4_hvs.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
drivers/gpu/drm/vc4/vc4_hvs.c +21 -5
@@ -564,6 +564,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)struct vc4_hvs *hvs =NULL ;int ret;u32 dispctrl; +u32 reg; hvs =devm_kzalloc (&pdev->dev,sizeof (*hvs),GFP_KERNEL );if (!hvs)
@@ -635,6 +636,26 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) vc4->hvs = hvs; + reg =HVS_READ (SCALER_DISPECTRL ); + reg &= ~SCALER_DISPECTRL_DSP2_MUX_MASK ; +HVS_WRITE (SCALER_DISPECTRL , + reg |VC4_SET_FIELD (0 ,SCALER_DISPECTRL_DSP2_MUX )); + + reg =HVS_READ (SCALER_DISPCTRL ); + reg &= ~SCALER_DISPCTRL_DSP3_MUX_MASK ; +HVS_WRITE (SCALER_DISPCTRL , + reg |VC4_SET_FIELD (3 ,SCALER_DISPCTRL_DSP3_MUX )); + + reg =HVS_READ (SCALER_DISPEOLN ); + reg &= ~SCALER_DISPEOLN_DSP4_MUX_MASK ; +HVS_WRITE (SCALER_DISPEOLN , + reg |VC4_SET_FIELD (3 ,SCALER_DISPEOLN_DSP4_MUX )); + + reg =HVS_READ (SCALER_DISPDITHER ); + reg &= ~SCALER_DISPDITHER_DSP5_MUX_MASK ; +HVS_WRITE (SCALER_DISPDITHER , + reg |VC4_SET_FIELD (3 ,SCALER_DISPDITHER_DSP5_MUX )); + dispctrl =HVS_READ (SCALER_DISPCTRL ); dispctrl |=SCALER_DISPCTRL_ENABLE ;
@@ -642,10 +663,6 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)SCALER_DISPCTRL_DISPEIRQ (1 ) |SCALER_DISPCTRL_DISPEIRQ (2 ); -/* Set DSP3 (PV1) to use HVS channel 2, which would otherwise -* be unused. -*/ - dispctrl &= ~SCALER_DISPCTRL_DSP3_MUX_MASK ; dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ | SCALER_DISPCTRL_SLVWREIRQ | SCALER_DISPCTRL_SLVRDEIRQ |
@@ -659,7 +676,6 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)SCALER_DISPCTRL_DSPEISLUR (1 ) |SCALER_DISPCTRL_DSPEISLUR (2 ) | SCALER_DISPCTRL_SCLEIRQ); - dispctrl |=VC4_SET_FIELD (2 ,SCALER_DISPCTRL_DSP3_MUX );HVS_WRITE (SCALER_DISPCTRL , dispctrl);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 133/452 drm/vc4: txp: Dont set TXP_VSTART_AT_EOF
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 234998df929f14d00cbf2f1e81a7facb69fd9266 ]
The TXP_VSTART_AT_EOF will generate a second VSTART signal to the HVS. However, the HVS waits for VSTART to enable the FIFO and will thus start filling the FIFO before the start of the frame.
This leads to corruption at the beginning of the first frame, and content from the previous frame at the beginning of the next frames.
Since one VSTART is enough, let's get rid of it.
--- drivers/gpu/drm/vc4/vc4_txp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_txp.c +1 -1
@@ -295,7 +295,7 @@ static void vc4_txp_connector_atomic_commit(struct drm_connector *conn,if (WARN_ON (i ==ARRAY_SIZE (drm_fmts)))return ; - ctrl =TXP_GO |TXP_VSTART_AT_EOF |TXP_EI | + ctrl =TXP_GO |TXP_EI |VC4_SET_FIELD (0xf ,TXP_BYTE_ENABLE ) |VC4_SET_FIELD (txp_fmts[i],TXP_FORMAT );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 134/452 drm/vc4: txp: Force alpha to be 0xff if its disabled
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 5453343a88ede8b12812fced81ecd24cb888ccc3 ]
If we use a format that has padding instead of the alpha component (such as XRGB8888), it appears that the Transposer will fill the padding to 0, disregarding what was stored in the input buffer padding.
This leads to issues with IGT, since it will set the padding to 0xff, but will then compare the CRC of the two frames which will thus fail. Another nice side effect is that it is now possible to just use the buffer as ARGB.
--- drivers/gpu/drm/vc4/vc4_txp.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/vc4/vc4_txp.c +6 -0
@@ -301,6 +301,12 @@ static void vc4_txp_connector_atomic_commit(struct drm_connector *conn,if (fb->format->has_alpha) ctrl |=TXP_ALPHA_ENABLE ; +else +/* +* If TXP_ALPHA_ENABLE isn't set and TXP_ALPHA_INVERT is, the +* hardware will force the output padding to be 0xff. +*/ + ctrl |=TXP_ALPHA_INVERT ; gem =drm_fb_cma_get_gem_obj (fb,0 );TXP_WRITE (TXP_DST_PTR , gem->paddr + fb->offsets[0 ]);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 135/452 libbpf: Dont error out on CO-RE relos for overriden weak subprogs
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit e89d57d938c8fa80c457982154ed6110804814fe ]
During BPF static linking, all the ELF relocations and .BTF.ext information (including CO-RE relocations) are preserved for __weak subprograms that were logically overriden by either previous weak subprogram instance or by corresponding "strong" (non-weak) subprogram. This is just how native user-space linkers work, nothing new.
But libbpf is over-zealous when processing CO-RE relocation to error out when CO-RE relocation belonging to such eliminated weak subprogram is encountered. Instead of erroring out on this expected situation, log debug-level message and skip the relocation.
--- tools/lib/bpf/libbpf.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
tools/lib/bpf/libbpf.c +11 -4
@@ -5945,10 +5945,17 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path) insn_idx = rec->insn_off /BPF_INSN_SZ ; prog =find_prog_by_sec_insn (obj, sec_idx, insn_idx);if (!prog) { -pr_warn ("sec '%s': failed to find program at insn #%d for CO-RE offset relocation #%d\n" , - sec_name, insn_idx, i); - err = -EINVAL ; - goto out; +/* When __weak subprog is "overridden" by another instance +* of the subprog from a different object file, linker still +* appends all the .BTF.ext info that used to belong to that +* eliminated subprogram. +* This is similar to what x86-64 linker does for relocations. +* So just ignore such relocations just like we ignore +* subprog instructions when discovering subprograms. +*/ +pr_debug ("sec '%s': skipping CO-RE relocation #%d for insn #%d belonging to eliminated weak subprogram\n" , + sec_name, i, insn_idx); +continue ; }/* no need to apply CO-RE relocation if the program is * not going to be loaded
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 136/452 bpf: Fix excessive memory allocation in stack_map_alloc()
In reply to Greg Kroah-HartmanFrom: Yuntao Wang <[email protected]>
[ Upstream commit b45043192b3e481304062938a6561da2ceea46a6 ]
The 'n_buckets * (value_size + sizeof(struct stack_map_bucket))' part of the allocated memory for 'smap' is never used after the memlock accounting was removed, thus get rid of it.
[ Note, Daniel:
Commit b936ca643ade ("bpf: rework memlock-based memory accounting for maps") moved cost += n_buckets * (value_size + sizeof(struct stack_map_bucket)) up and therefore before the bpf_map_area_alloc() allocation, sigh. In a later step commit c85d69135a91 ("bpf: move memory size checks to bpf_map_charge_init()"), and the overflow checks of cost >= U32_MAX - PAGE_SIZE moved into bpf_map_charge_init(). And then 370868107bf6 ("bpf: Eliminate rlimit-based memory accounting for stackmap maps") finally removed the bpf_map_charge_init(). Anyway, the original code did the allocation same way as /after/ this fix. ]
--- kernel/bpf/stackmap.c | 1 - 1 file changed, 1 deletion(-)
kernel/bpf/stackmap.c +0 -1
@@ -121,7 +121,6 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)return ERR_PTR (-E2BIG ); cost = n_buckets *sizeof (struct stack_map_bucket *) +sizeof (*smap); - cost += n_buckets * (value_size +sizeof (struct stack_map_bucket )); err =bpf_map_charge_init (&mem, cost);if (err)return ERR_PTR (err);
Signature · 1 line
2.35.1
Re: [PATCH 5.10 136/452] bpf: Fix excessive memory allocation in stack_map_alloc()
Hi!
Quoted 6 lines
The '
n_buckets* (value_size+sizeof(struct stack_map_bucket))' part of the allocated memory for 'smap' is never used after the memlock accounting was removed, thus get rid of it.[ Note, Daniel:
Quoted 8 lines
Commit
b936ca643ade("bpf: rework memlock-based memory accounting for maps") movedcost += n_buckets * (value_size + sizeof(struct stack_map_bucket))up and therefore before thebpf_map_area_alloc()allocation, sigh. In a later step commitc85d69135a91("bpf: move memory size checks tobpf_map_charge_init()"), and the overflow checks ofcost >= U32_MAX - PAGE_SIZEmoved intobpf_map_charge_init(). And then370868107bf6("bpf: Eliminate rlimit-based memory accounting for stackmap maps") finally removed thebpf_map_charge_init(). Anyway, the original code did the allocation same way as /after/ this fix. ]
We don't have 370868107bf6 in 5.10. Can someone verify this is still right think to do for 5.10?
Best regards,
Pavel
Quoted 9 lines
+++
b/kernel/bpf/stackmap.ckernel/bpf/stackmap.c +0
-1@@ -121,7 +121,6 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)return ERR_PTR (-E2BIG ); cost = n_buckets *sizeof (struct stack_map_bucket *) +sizeof (*smap); - cost += n_buckets * (value_size +sizeof (struct stack_map_bucket )); err =bpf_map_charge_init (&mem, cost);if (err)return ERR_PTR (err);
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
PATCH 1/1 bpf: Fix excessive memory allocation in stack_map_alloc()
The 'n_buckets * (value_size + sizeof(struct stack_map_bucket))' part of the allocated memory for 'smap' is never used, get rid of it.
---
This is the modified version for 5.10, the original patch is:
[ Upstream commit b45043192b3e481304062938a6561da2ceea46a6 ]
It would be better if the new patch can be reviewed by someone else.
kernel/bpf/stackmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/bpf/stackmap.c +2 -2
@@ -121,8 +121,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)return ERR_PTR (-E2BIG ); cost = n_buckets *sizeof (struct stack_map_bucket *) +sizeof (*smap); - cost += n_buckets * (value_size +sizeof (struct stack_map_bucket )); - err =bpf_map_charge_init (&mem, cost); + err =bpf_map_charge_init (&mem, cost + n_buckets * + (value_size +sizeof (struct stack_map_bucket )));if (err)return ERR_PTR (err);
Signature · 1 line
2.36.0
Greg KH
maintainerRe: [PATCH] bpf: Fix excessive memory allocation in stack_map_alloc()
Quoted 6 lines · Yuntao Wang
The '
n_buckets* (value_size+sizeof(struct stack_map_bucket))' part of the allocated memory for 'smap' is never used, get rid of it.Fixes b936ca643ade ("bpf: rework memlock-based memory accounting for maps")Signed-off-by Yuntao Wang <[email protected]>
Quoted 6 lines
---
This is the modified version for 5.10, the original patch is:[ Upstream commit
b45043192b3e481304062938a6561da2ceea46a6]It would be better if the new patch can be reviewed by someone else.
What is wrong with the version that we have queued up in the 5.10-stable review queue right now?
Quoted 9 lines
kernel/bpf/stackmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)kernel/bpf/stackmap.c +0
-0
kernel/bpf/stackmap.c static struct bpf_map *stack_map_alloc(union bpf_attr *attr) · line 125
Quoted 7 lines
kernel/bpf/stackmap.c +2
-2@@ -121,8 +121,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)return ERR_PTR (-E2BIG ); cost = n_buckets *sizeof (struct stack_map_bucket *) +sizeof (*smap); - cost += n_buckets * (value_size +sizeof (struct stack_map_bucket )); - err =bpf_map_charge_init (&mem, cost); + err =bpf_map_charge_init (&mem, cost + n_buckets * + (value_size +sizeof (struct stack_map_bucket )));
This differs from what we have queued up for 5.4.y and 5.10.y, why? If you are going to modify the upstream version, you need to document in great detail what you have changed and why you have changed it.
thanks,
greg k-h
Re: [PATCH] bpf: Fix excessive memory allocation in stack_map_alloc()
Quoted 10 lines · Greg KH
Quoted 9 lines · Yuntao Wang
The '
n_buckets* (value_size+sizeof(struct stack_map_bucket))' part of the allocated memory for 'smap' is never used, get rid of it.Fixes b936ca643ade ("bpf: rework memlock-based memory accounting for maps")Signed-off-by Yuntao Wang <[email protected]>---
This is the modified version for 5.10, the original patch is:
Quoted 6 lines
Quoted 3 lines
[ Upstream commit
b45043192b3e481304062938a6561da2ceea46a6]It would be better if the new patch can be reviewed by someone else.
What is wrong with the version that we have queued up in the 5.10-stable review queue right now?
Since the 5.10 branch doesn't have commit 370868107bf6, the upstream version is not correct for it, I modified the original patch and wanted to backport it to the 5.10 branch.
Quoted 24 lines
Quoted 9 lines
kernel/bpf/stackmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)kernel/bpf/stackmap.c +0
-0kernel/bpf/stackmap.c static struct bpf_map *stack_map_alloc(union bpf_attr *attr) · line 125
Quoted 7 lines
kernel/bpf/stackmap.c +2
-2@@ -121,8 +121,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)return ERR_PTR (-E2BIG ); cost = n_buckets *sizeof (struct stack_map_bucket *) +sizeof (*smap); - cost += n_buckets * (value_size +sizeof (struct stack_map_bucket )); - err =bpf_map_charge_init (&mem, cost); + err =bpf_map_charge_init (&mem, cost + n_buckets * + (value_size +sizeof (struct stack_map_bucket )));This differs from what we have queued up for 5.4.y and 5.10.y, why? If you are going to modify the upstream version, you need to document in great detail what you have changed and why you have changed it.
thanks,
greg k-h
Greg KH
maintainerRe: [PATCH] bpf: Fix excessive memory allocation in stack_map_alloc()
Quoted 13 lines · Yuntao Wang
Quoted 12 lines · Greg KH
Quoted 11 lines · Yuntao Wang
The '
n_buckets* (value_size+sizeof(struct stack_map_bucket))' part of the allocated memory for 'smap' is never used, get rid of it.Fixes b936ca643ade ("bpf: rework memlock-based memory accounting for maps")Signed-off-by Yuntao Wang <[email protected]>---
This is the modified version for 5.10, the original patch is:[ Upstream commit
b45043192b3e481304062938a6561da2ceea46a6]
Quoted 8 lines
Quoted 4 lines
Quoted 1 line
It would be better if the new patch can be reviewed by someone else.
What is wrong with the version that we have queued up in the 5.10-stable review queue right now?
Since the 5.10 branch doesn't have commit
370868107bf6, the upstream version is not correct for it, I modified the original patch and wanted to backport it to the 5.10 branch.
This does not apply to the 5.10 branch now, can you provide a working version?
thanks,
greg k-h
PATCH 1/1 bpf: Fix incorrect memory charge cost calculation in stack_map_alloc()
commit b45043192b3e481304062938a6561da2ceea46a6 upstream.
This is a backport of the original upstream patch for 5.4/5.10.
The original upstream patch has been applied to 5.4/5.10 branches, which simply removed the line:
cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));
This is correct for upstream branch but incorrect for 5.4/5.10 branches, as the 5.4/5.10 branches do not have the commit 370868107bf6 ("bpf:
Eliminate rlimit-based memory accounting for stackmap maps"), so the bpf_map_charge_init() function has not been removed.
Currently the bpf_map_charge_init() function in 5.4/5.10 branches takes a wrong memory charge cost, the
attr->max_entries * (sizeof(struct stack_map_bucket) + (u64)value_size))
part is missing, let's fix it.
---
Note that the original upstream patch is currently applied to linux-stable-rc/linux-5.4.y branch, not linux/linux-5.4.y, this patch depends on that patch.
kernel/bpf/stackmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/bpf/stackmap.c +2 -1
@@ -121,7 +121,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)return ERR_PTR (-E2BIG ); cost = n_buckets *sizeof (struct stack_map_bucket *) +sizeof (*smap); - err =bpf_map_charge_init (&mem, cost); + err =bpf_map_charge_init (&mem, cost + attr->max_entries * + (sizeof (struct stack_map_bucket ) + (u64 )value_size));if (err)return ERR_PTR (err);
Signature · 1 line
2.36.0
Greg KH
maintainerRe: [PATCH] bpf: Fix incorrect memory charge cost calculation in stack_map_alloc()
Quoted 21 lines · Yuntao Wang
commit
b45043192b3e481304062938a6561da2ceea46a6upstream.This is a backport of the original upstream patch for 5.4/5.10.
The original upstream patch has been applied to 5.4/5.10 branches, which simply removed the line:
cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));This is correct for upstream branch but incorrect for 5.4/5.10 branches, as the 5.4/5.10 branches do not have the commit
370868107bf6("bpf:
Eliminate rlimit-based memory accounting for stackmap maps"), so thebpf_map_charge_init()function has not been removed.Currently the
bpf_map_charge_init()function in 5.4/5.10 branches takes a wrong memory charge cost, the
attr->max_entries* (sizeof(struct stack_map_bucket)+ (u64)value_size))part is missing, let's fix it.
Quoted 7 lines
Cc <[email protected]> # 5.4.yCc <[email protected]> # 5.10.ySigned-off-by Yuntao Wang <[email protected]>---
Note that the original upstream patch is currently applied to linux-stable-rc/linux-5.4.y branch, not linux/linux-5.4.y, this patch depends on that patch.
Now queued up, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 137/452 nl80211: show SSID for P2P_GO interfaces
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit a75971bc2b8453630e9f85e0beaa4da8db8277a3 ]
There's no real reason not to send the SSID to userspace when it requests information about P2P_GO, it is, in that respect, exactly the same as AP interfaces. Fix that.
--- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
@@ -3485,6 +3485,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flagwdev_lock (wdev);switch (wdev->iftype) {case NL80211_IFTYPE_AP : +case NL80211_IFTYPE_P2P_GO :if (wdev->ssid_len &&nla_put (msg,NL80211_ATTR_SSID , wdev->ssid_len, wdev->ssid)) goto nla_put_failure_locked;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 138/452 drm/komeda: Fix an undefined behavior bug in komeda_plane_add()
In reply to Greg Kroah-HartmanFrom: Zhou Qingyang <[email protected]>
[ Upstream commit f5e284bb74ab296f98122673c7ecd22028b2c200 ]
In komeda_plane_add(), komeda_get_layer_fourcc_list() is assigned to formats and used in drm_universal_plane_init(). drm_universal_plane_init() passes formats to __drm_universal_plane_init(). __drm_universal_plane_init() further passes formats to memcpy() as src parameter, which could lead to an undefined behavior bug on failure of komeda_get_layer_fourcc_list().
Fix this bug by adding a check of formats.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.
Builds with CONFIG_DRM_KOMEDA=m show no new warnings, and our static analyzer no longer warns about this code.
--- drivers/gpu/drm/arm/display/komeda/komeda_plane.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/arm/display/komeda/komeda_plane.c +4 -0
@@ -264,6 +264,10 @@ static int komeda_plane_add(struct komeda_kms_dev *kms, formats =komeda_get_layer_fourcc_list (&mdev->fmt_tbl, layer->layer_type, &n_formats); +if (!formats) { +kfree (kplane); +return -ENOMEM ; + } err = drm_universal_plane_init(&kms->base, plane, get_possible_crtcs(kms, c->pipeline),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 139/452 drm: mali-dp: potential dereference of null pointer
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 73c3ed7495c67b8fbdc31cf58e6ca8757df31a33 ]
The return value of kzalloc() needs to be checked. To avoid use of null pointer '&state->base' in case of the failure of alloc.
--- drivers/gpu/drm/arm/malidp_crtc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/arm/malidp_crtc.c +4 -1
@@ -483,7 +483,10 @@ static void malidp_crtc_reset(struct drm_crtc *crtc)if (crtc->state)malidp_crtc_destroy_state (crtc, crtc->state); -__drm_atomic_helper_crtc_reset (crtc, &state->base); +if (state) +__drm_atomic_helper_crtc_reset (crtc, &state->base); +else +__drm_atomic_helper_crtc_reset (crtc,NULL ); }static int malidp_crtc_enable_vblank (struct drm_crtc *crtc)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 140/452 spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 8b1ea69a63eb62f97cef63e6d816b64ed84e8760 ]
wait_for_completion_timeout() returns unsigned long not int. It returns 0 if timed out, and positive if completed. The check for <= 0 is ambiguous and should be == 0 here indicating timeout which is the only error case.
--- drivers/spi/spi-ti-qspi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/spi/spi-ti-qspi.c +3 -2
@@ -448,6 +448,7 @@ static int ti_qspi_dma_xfer(struct ti_qspi *qspi, dma_addr_t dma_dst,enum dma_ctrl_flags flags =DMA_CTRL_ACK |DMA_PREP_INTERRUPT ;struct dma_async_tx_descriptor *tx;int ret; +unsigned long time_left; tx =dmaengine_prep_dma_memcpy (chan, dma_dst, dma_src, len, flags);if (!tx) {
@@ -467,9 +468,9 @@ static int ti_qspi_dma_xfer(struct ti_qspi *qspi, dma_addr_t dma_dst, }dma_async_issue_pending (chan); - ret =wait_for_completion_timeout (&qspi->transfer_complete, + time_left =wait_for_completion_timeout (&qspi->transfer_complete,msecs_to_jiffies (len)); -if (ret <=0 ) { +if (time_left ==0 ) {dmaengine_terminate_sync (chan);dev_err (qspi->dev,"DMA wait_for_completion_timeout\n" );return -ETIMEDOUT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 141/452 scftorture: Fix distribution of short handler delays
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
[ Upstream commit 8106bddbab5f0ba180e6d693c7c1fc6926d57caa ]
The scftorture test module's scf_handler() function is supposed to provide three different distributions of short delays (including "no delay") and one distribution of long delays, if specified by the scftorture.longwait module parameter. However, the second of the two non-zero-wait short delays is disabled due to the first such delay's "goto out" not being enclosed in the "then" clause with the "udelay()".
This commit therefore adjusts the code to provide the intended set of delays.
--- kernel/scftorture.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/scftorture.c +3 -2
@@ -253,9 +253,10 @@ static void scf_handler(void *scfc_in) }this_cpu_inc (scf_invoked_count);if (longwait <=0 ) { -if (!(r &0xffc0 )) +if (!(r &0xffc0 )) {udelay (r &0x3f ); - goto out; + goto out; + } }if (r &0xfff ) goto out;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 142/452 net: dsa: mt7530: 1G can also support 1000BASE-X link mode
In reply to Greg Kroah-HartmanFrom: Russell King (Oracle) <[email protected]>
[ Upstream commit 66f862563ed68717dfd84e808ca12705ed275ced ]
When using an external PHY connected using RGMII to mt7531 port 5, the PHY can be used to used support 1000BASE-X connections. Moreover, if 1000BASE-T is supported, then we should allow 1000BASE-X as well, since which are supported is a property of the PHY.
Therefore, it makes no sense to exclude this from the linkmodes when 1000BASE-T is supported.
--- drivers/net/dsa/mt7530.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/net/dsa/mt7530.c +4 -10
@@ -1952,13 +1952,7 @@ static void mt7531_sgmii_validate(struct mt7530_priv *priv, int port,/* Port5 supports ethier RGMII or SGMII. * Port6 supports SGMII only. */ -switch (port) { -case 5 : -if (mt7531_is_rgmii_port (priv, port)) -break ; - fallthrough; -case 6 : - phylink_set(supported, 1000baseX_Full); +if (port ==6 ) { phylink_set(supported, 2500baseX_Full); phylink_set(supported, 2500baseT_Full); }
@@ -2315,8 +2309,6 @@ static void mt7530_mac_port_validate(struct dsa_switch *ds, int port, unsigned long *supported) { - if (port == 5) - phylink_set(supported, 1000baseX_Full); } static void mt7531_mac_port_validate(struct dsa_switch *ds, int port,
@@ -2353,8 +2345,10 @@ mt753x_phylink_validate(struct dsa_switch *ds, int port, }/* This switch only supports 1G full-duplex. */ -if (state->interface !=PHY_INTERFACE_MODE_MII ) +if (state->interface !=PHY_INTERFACE_MODE_MII ) { phylink_set(mask, 1000baseT_Full); + phylink_set(mask, 1000baseX_Full); + } priv->info->mac_port_validate (ds, port, mask);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 143/452 NFC: NULL out the dev->rfkill to prevent UAF
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 1b0e81416a24d6e9b8c2341e22e8bf48f8b8bfc9 ]
Commit 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") assumes the device_is_registered() in function nfc_dev_up() will help to check when the rfkill is unregistered. However, this check only take effect when device_del(&dev->dev) is done in nfc_unregister_device(). Hence, the rfkill object is still possible be dereferenced.
The crash trace in latest kernel (5.18-rc2):
[ 68.760105] ================================================================== [ 68.760330] BUG: KASAN: use-after-free in __lock_acquire+0x3ec1/0x6750 [ 68.760756] Read of size 8 at addr ffff888009c93018 by task fuzz/313 [ 68.760756] [ 68.760756] CPU: 0 PID: 313 Comm: fuzz Not tainted 5.18.0-rc2 #4 [ 68.760756] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 68.760756] Call Trace: [ 68.760756] <TASK> [ 68.760756] dump_stack_lvl+0x57/0x7d [ 68.760756] print_report.cold+0x5e/0x5db [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] kasan_report+0xbe/0x1c0 [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] __lock_acquire+0x3ec1/0x6750 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? register_lock_class+0x18d0/0x18d0 [ 68.760756] lock_acquire+0x1ac/0x4f0 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? mutex_lock_io_nested+0x12c0/0x12c0 [ 68.760756] ? nla_get_range_signed+0x540/0x540 [ 68.760756] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 68.760756] _raw_spin_lock_irqsave+0x39/0x50 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] rfkill_blocked+0xe/0x60 [ 68.760756] nfc_dev_up+0x84/0x260 [ 68.760756] nfc_genl_dev_up+0x90/0xe0 [ 68.760756] genl_family_rcv_msg_doit+0x1f4/0x2f0 [ 68.760756] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x230/0x230 [ 68.760756] ? security_capable+0x51/0x90 [ 68.760756] genl_rcv_msg+0x280/0x500 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? lock_acquire+0x1ac/0x4f0 [ 68.760756] ? nfc_genl_dev_down+0xe0/0xe0 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] netlink_rcv_skb+0x11b/0x340 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? netlink_ack+0x9c0/0x9c0 [ 68.760756] ? netlink_deliver_tap+0x136/0xb00 [ 68.760756] genl_rcv+0x1f/0x30 [ 68.760756] netlink_unicast+0x430/0x710 [ 68.760756] ? memset+0x20/0x40 [ 68.760756] ? netlink_attachskb+0x740/0x740 [ 68.760756] ? __build_skb_around+0x1f4/0x2a0 [ 68.760756] netlink_sendmsg+0x75d/0xc00 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] sock_sendmsg+0xdf/0x110 [ 68.760756] __sys_sendto+0x19e/0x270 [ 68.760756] ? __ia32_sys_getpeername+0xa0/0xa0 [ 68.760756] ? fd_install+0x178/0x4c0 [ 68.760756] ? fd_install+0x195/0x4c0 [ 68.760756] ? kernel_fpu_begin_mask+0x1c0/0x1c0 [ 68.760756] __x64_sys_sendto+0xd8/0x1b0 [ 68.760756] ? lockdep_hardirqs_on+0xbf/0x130 [ 68.760756] ? syscall_enter_from_user_mode+0x1d/0x50 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] RIP: 0033:0x7f67fb50e6b3 ... [ 68.760756] RSP: 002b:00007f67fa91fe90 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 68.760756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f67fb50e6b3 [ 68.760756] RDX: 000000000000001c RSI: 0000559354603090 RDI: 0000000000000003 [ 68.760756] RBP: 00007f67fa91ff00 R08: 00007f67fa91fedc R09: 000000000000000c [ 68.760756] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffe824d496e [ 68.760756] R13: 00007ffe824d496f R14: 00007f67fa120000 R15: 0000000000000003
[ 68.760756] </TASK> [ 68.760756] [ 68.760756] Allocated by task 279: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] __kasan_kmalloc+0x81/0xa0 [ 68.760756] rfkill_alloc+0x7f/0x280 [ 68.760756] nfc_register_device+0xa3/0x1a0 [ 68.760756] nci_register_device+0x77a/0xad0 [ 68.760756] nfcmrvl_nci_register_dev+0x20b/0x2c0 [ 68.760756] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 68.760756] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 68.760756] tty_ioctl+0x764/0x1310 [ 68.760756] __x64_sys_ioctl+0x122/0x190 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] [ 68.760756] Freed by task 314: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] kasan_set_track+0x21/0x30 [ 68.760756] kasan_set_free_info+0x20/0x30 [ 68.760756] __kasan_slab_free+0x108/0x170 [ 68.760756] kfree+0xb0/0x330 [ 68.760756] device_release+0x96/0x200 [ 68.760756] kobject_put+0xf9/0x1d0 [ 68.760756] nfc_unregister_device+0x77/0x190 [ 68.760756] nfcmrvl_nci_unregister_dev+0x88/0xd0 [ 68.760756] nci_uart_tty_close+0xdf/0x180 [ 68.760756] tty_ldisc_kill+0x73/0x110 [ 68.760756] tty_ldisc_hangup+0x281/0x5b0 [ 68.760756] __tty_hangup.part.0+0x431/0x890 [ 68.760756] tty_release+0x3a8/0xc80 [ 68.760756] __fput+0x1f0/0x8c0 [ 68.760756] task_work_run+0xc9/0x170 [ 68.760756] exit_to_user_mode_prepare+0x194/0x1a0 [ 68.760756] syscall_exit_to_user_mode+0x19/0x50 [ 68.760756] do_syscall_64+0x48/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae
This patch just add the null out of dev->rfkill to make sure such dereference cannot happen. This is safe since the device_lock() already protect the check/write from data race.
--- net/nfc/core.c | 1 + 1 file changed, 1 insertion(+)
net/nfc/core.c +1 -0
@@ -1158,6 +1158,7 @@ void nfc_unregister_device(struct nfc_dev *dev)if (dev->rfkill) {rfkill_unregister (dev->rfkill);rfkill_destroy (dev->rfkill); + dev->rfkill =NULL ; } dev->shutting_down = true;device_unlock (&dev->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 144/452 efi: Add missing prototype for efi_capsule_setup_info
In reply to Greg Kroah-HartmanFrom: Jan Kiszka <[email protected]>
[ Upstream commit aa480379d8bdb33920d68acfd90f823c8af32578 ]
Fixes "no previous declaration for 'efi_capsule_setup_info'" warnings under W=1.
--- include/linux/efi.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/efi.h +2 -0
@@ -167,6 +167,8 @@ struct capsule_info {size_t page_bytes_remain; }; +int efi_capsule_setup_info (struct capsule_info *cap_info,void *kbuff, +size_t hdr_bytes);int __efi_capsule_setup_info (struct capsule_info *cap_info);typedef int (*efi_freemem_callback_t ) (u64 start,u64 end,void *arg);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 145/452 target: remove an incorrect unmap zeroes data deduction
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 179d8609d8424529e95021df939ed7b0b82b37f1 ]
For block devices, the SCSI target drivers implements UNMAP as calls to blkdev_issue_discard, which does not guarantee zeroing just because Write Zeroes is supported.
Note that this does not affect the file backed path which uses fallocate to punch holes.
--- drivers/target/target_core_device.c | 1 - 1 file changed, 1 deletion(-)
drivers/target/target_core_device.c +0 -1
@@ -831,7 +831,6 @@ bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib, attrib->unmap_granularity = q->limits.discard_granularity / block_size; attrib->unmap_granularity_alignment = q->limits.discard_alignment / block_size; - attrib->unmap_zeroes_data = !!(q->limits.max_write_zeroes_sectors);return true; }EXPORT_SYMBOL (target_configure_unmap_from_queue);
Signature · 1 line
2.35.1